Startups

SYSINFO.ORG STARTUP LIST : 11th June 2006 (c) Paul Collins Status X X X X X X X X Y Y N ? X X X X X X X X X X X X N N U N U N U N X X X X X U X X X X X X X X Y X X X X X X X X X X X X X X X X X X

Name/Startup Item

Command

Comments

system32.exe Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field pathex.exe Added by the MKMOOSE-A WORM! svchost.exe Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco SystemBoot services.exe Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc WinCheck services.exe Added by the SOBER-S WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Windows services.exe Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco WinStart services.exe Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco winsystem.sys smss.exe Added by the SOBER.K TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfi !1_pgaccount pgaccount.exe DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks. You will see one instant of pgaccou !1_ProcessGuard_Startup procguard.exe DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks !NoLoad winrecon.exe WinRecon - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it $EnterNet Enternet.exe Connection manager for the EnterNet ISP. You can also use RASPPOE $sys$cmp $sys$xp.exe Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer $sys$crash $sys$sonyTimer.exe Added by the WELOMOCH TROJAN! $sys$crash $sys$sos$sys$.exe Added by the WELOMOCH TROJAN! $sys$crash $sys$WeLoveMcCOL.exe Added by the WELOMOCH TROJAN! $sys$drv $sys$drv.exe Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer $sys$momomomochin $sys$sonyTimer.exe Added by the WELOMOCH TROJAN! $sys$momomomochin $sys$sos$sys$.exe Added by the WELOMOCH TROJAN! $sys$momomomochin $sys$WeLoveMcCOL.exe Added by the WELOMOCH TROJAN! $sys$umaiyo $sys$sonyTimer.exe Added by the WELOMOCH TROJAN! $sys$umaiyo $sys$sos$sys$.exe Added by the WELOMOCH TROJAN! $sys$umaiyo $sys$WeLoveMcCOL.exe Added by the WELOMOCH TROJAN! $WindowsRegKey%update IEXPLORE.EXE Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure %cmpmixtitle% %cmpmixstr% Possibly related to C-Media Mixer Control panel? %FP%012-L2TP fts.exe fts.exe 012.Net.il Israeli ISP software front-end %FP%012-L2TP FWPortal.exe FWPortal.exe 012.Net.il Israeli ISP dial-up software %FP%1776 Internet fts.exe fts.exe 1776 Internet US ISP software ISP software front-end %FP%1776 Internet FWPortal.exe FWPortal.exe 1776 Internet US ISP dial-up software %FP%Barak013 fts.exe fts.exe Barak013 Israeli ISP software front-end %FP%Barak013 FWPortal.exe FWPortal.exe Barak013 Israeli ISP dial-up software %FP%Friendly fts.exe fts.exe Friendly ISP software front-end (*)API Machine winSOCKS.exe Homepage hijacker, see here (* = any digit) (*)Run win32API.exe Homepage hijacker, see here (* = any digit) (default) [random filename].exe Added by the BLACKMAL WORM! (default) rundll32.exe [path] Zykheptd.dll Added by the HESIVE.B TROJAN! (L4r1$$4) (4nt1) (V1ruz) SP00Lsv32.pif Added by the ASSIRAL.B WORM! )Start Service upssrv.exe Cyber Power PowerPanelPlus software. "In the event of a power outage, PowerPanelPlus Software automatically saves and closes all open files, and then shuts down the computer system in an intelligen *JanisRuckenbrodII janis.com Added by the POPS WORM! *Microsoft Update ctxma.exe Added by the STMU TROJAN! *Microsoft Update cxma.exe Added by the STMU TROJAN! *Microsoft Update wstcl.exe Added by the STMU TROJAN! *Microsoft Update wucxt.exe Added by the STMU TROJAN! *Microsoft Update wuytc.exe Added by the STMU TROJAN! *MS Setup [random filename] Virtumondo adware, also known as the VUNDO TROJAN! *Security Center secctr.exe Added by the SDBOT.BRO WORM! *StateMgr statemgr.exe Windows ME default for System Restore. Do NOT disable! *windows update wrauclt.exe Added by the RBOT-QU WORM! *windows update wuanclt.exe Added by the RBOT-PG WORM! *windows update wuaucrlt.exe Added by the SPYBOT.HUR WORM! *windows update wuraclt.exe Added by the RBOT-PO WORM! *windows update wurauclt.exe Added by the RBOT-SY WORM! *windows update wsctl.exe Added by the SPYBOT.PR WORM! *windows update wkmst.exe Added by the SDBOT.AVD WORM! *windows update wscxt.exe Added by the RBOT.AOS WORM! *windows update waurclt.exe Added by a variant of the RBOT WORM! *Windows [filename] Checker [filename] Added by the KEDEBE-B WORM! *WindowsAudio systemupd.exe Added by the AGENT-TH WORM! *WinLogon [trojan path] ren time:[random number] Added by the VUNDO TROJAN! *winstats winstats.exe Added by the GARGAFX TROJAN! *wuauclt.exe w****.exe [* = random char] Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe, wtmsv.exe, wxmst.exe, wmsvc.exe and so on... ,main drive Loader wininfo.exe Suspected malware as it appears in 3 different registry locations - see here .mscdr lassa.exe Added by the WEBUS.C TROJAN! .mscdr lsvchost.exe Added by the WEBUS.D TROJAN! .mscdsr lsvchost.exe Added by the CR TROJAN!

X X X ? X X X X X X X X X N U X U X ? ? U U U X X X X X X X U ? X X X X X U U N N Y Y ? X U U U X X X X X X U X U X X ? Y Y N Y Y N Y X U X

.mscsbl .msfupdate .mssecure .NET config .norton .nvsvc .Prog .Prog .svchost .TEXTCONV .TEXTCONV .WMAudio .WMAudio /l:eng

svhost.exe Added by the CMQ TROJAN! msveup.exe Added by the ALLOCUP.A WORM! mssecure.exe Added by the DDOS_BOXED.X TROJAN! sysmon32.exe ?? rchost.exe Added by a variant of the BOXED-A TROJAN! smss.exe Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! CSRSS.EXE Added by the WEBUS.F TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf N/A Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R 0 pit.exe Added by the PrivateEye surveillance software! Note - If you did not intentionally install this remove it 000hpdllhos hpdllhost.exe LZIO.com adware downloader 000StTHK 000StTHK.exe Toshiba Hot key functionality for the function keys (Fn-Esc, Fn-F1 (lock), Fn-F2, Fn-F3, Fn-F4, Fn-F5 (switching between laptop and CRT display output), etc...) 0050726-007-i32-1 0050726-007-i32-1.exe Added by the BANCBAN-EC TROJAN! 00DSKSVR00 desksaver.exe Related to Advanced Desktop Shield 00DSKSVR01 desksaver.exe Related to Advanced Desktop Shield 00THotkey 00THotKey.exe For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev. 0190 Warner WARN0190.EXE Anti-dialer program (Germany) 0900 Warner WARN0900.EXE Anti-dialer program (Germany) 0mcamcap 0mcamcap.exe Added by the COSIAM-H TROJAN! 0utlook Express *****.exe [* = random char] Added by the RBOT-CC WORM! Note the first letter is actually the digit "0" and not a capital "o" 1 1.exe Added by the ESTEEMS TROJAN! 1 lsass.scr Added by the BANCOS.V TROJAN! 1 svchost.scr Added by the BANCOS.X TROJAN! 1111swapmgr.exe 1111swapmgr.exe Added by the IC TROJAN! 123456 rundll32.exe shell32.dll, Control_RunDLL Added...123456.cpl by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number 12Ghosts Popup-Killer 12popup.exe 12Ghosts Popup-Killer 17779Proj2002 N/A ?? 180adsolution 180adsolution.exe NCase adware 180ax 180ax.exe NCase adware 180ClientStubInstall stubinstaller****.exe [* = digit] 180Solutions adware related 180ClientStubInstall [path to trojan] 180Solutions adware related 180ClientStubInstall ******.tmp [* = random digit/char] 180Solutions adware related 196_150_ni 196_150_ni.exe Added by WinFixer foistware! 197_150_ni_3 197_150_ni_3.exe Added by WinFixer foistware variant! 1:00 hpdrv.exe HP utility for monitoring when and how many recoveries have been done 1A:MacVisionTrayMonitor TrayMonitor.exe Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock) 1A:Stardock MCP mcpserver.exe Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications 1A:Stardock TrayMonitor TrayServer.exe For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX 1CmailS NETMAIL.EXE ?? 1on1 1on1.exe Adult content dialler 1Srv32 SpyAgent4.exe SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC." 1Win32Cfg SpyBuddy.exe SpyBuddy keystroke logger/monitoring program - remove unless you installed it yourself! 1Win32Cfg Keyloggerpro.exe Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself! 1WinCfg32 WebMailSpy.exe WebMailSpy spyware 2020Downloader mssvr.exe 2020Search Toolbar 252 winmgr.exe Added by the LEGMIR-AT TROJAN! 27 slsorve.exe Added by the SLSORVE-A TROJAN! 27 csrss32.exe Added by the SLSORVE-D TROJAN! 27 msm32.exe Added by the SLSORVE-E TROJAN! 2Search main.exe Added by 2Search ADWARE! 2thousandbuck [path to file] Added by the RANKY.L TROJAN! 2wSysTray 2portalmon.exe 2Wire Homeportal user interface 32-bit Thunking service thunk32.exe Added by the DERDERO.A WORM! 357AA41A-B7A8-4632-A27D-5B980B25CF43 services.exe Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally fig 39ELTFH25Z8SKF Ezg1q5.exe Seems to be associated with software by Resplendence SP ? 3c1807pd 3cmlink.exe 3cpipe-3c1807pd 3Com WinModem driver. See here for more WinModem information 3capplnk 3capplnk.exe US Robotics Modem driver 3cdminic 3CDMINIC.EXE 3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards 3CM Link 3cmcnkw.exe Required for a US Robotics WinModem as it provides the link to Windows - won't work without it 3Cmlink 3CmlinkW.exe For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information 3ComDMIAgent 3CDMINIC.EXE 3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards 3cpipe-USRpdA USRmlnkA.exe Modem driver files from US Robotics 3D Text 3D Text.scr Added by the JERMY.A WORM! 3Deep Control Panel 3DeepCTL.EXE From LightSurf Technologies (nee E-Color) - 3Deep corrects lighting, shading and color for all your 2D and 3D games 3Dfx Acc GFXACC.EXE Added by the GIBE WORM!

N Y Y ? U Y X U Y X X X X X X X X X X Y X X X X N N X X X X U Y U U ? ? N U X X ? ? N U X U N X U U U X X X X U Y U X U N X U X U N N U N X

3dfx Task Manager 3dfxMan.exe System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs 3dfx Tools 3dfxCmn.dll Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards 3dfxv2ps.dll 3dfxv2ps.dll Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards 3Dlabs Taskbar Display Manager 3DLman.exe 3DLabs graphics driver related. System Tray access to display settings? 3DLabsHelperDemon 3dldemon.exe Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a 3DMouse.EXE 3DMouse.EXE Dritek System Inc. 3D Mouse driver 3d_sound 3d_sound.exe Added by the RIADOS-A TROJAN! 3qdctl.exe 3qdctl.exe Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup, restoring volume and other audio settings to a pre-determined default. Similar to Creative Lab's AudioHQ 3ware 3DM 3dm.exe Monitors status of the disk array on 3ware IDE RAID controllers 456655 explorer.exe Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added 4wd!!! Natal!.pif Added by the OPASERV.AI WORM! 5-1-61-96 members-area.exe Adult content dialler 5-2-46-112 5-2-46-112.exe Adult content pop-up dialler. Removal instructions here 55278 grepclient1.exe Added by the LINEAGE-S TROJAN! 5p4m [path to trojan] Added by the LITEBOT-C TROJAN! 5whgue21 5whgue21.exe ClearSearch adware 666 Ska.exe Added by the PIPES TROJAN! 678 lsas32.exe Added by the SLSORVE-B TROJAN! 98D0CE0C16B1 rundll32.exe D0CE0C16B1, D0CE0C16B1 BrowserAid/BrowserPal foistware 9xadiras 9xadiras.exe Allied Telesyn AT series router/modem related - apparently required 9xHtProtect AVprotect9x.exe Added by the NETSKY.M WORM! ;Rundll [filename] Added by the PWSLEGMIR.E TROJAN! ?ekio Startups ?nksvc32.exe Added by the AGOBOT-OV WORM where ? is a random character @ regedit -s ..win.dll Added by the SEEKER.K TROJAN! @Hoc Toolbar AtHoc.exe One-click activated browsing toolbar used by various web-sites. See here for more info @loha reminder.exe Registration reminder for @loha@home E-mail utility @tour_ww @tour_ww[1].exe Adult content dialler a a.exe Commercials file that registers itself in the system registry and redirects IE to a certain commercial website a jesse.exe Added by the MELO-A WORM! A New Windows Updater w32NTupdt.exe Added by MYTOB.BM WORM! a-squared a2guard.exe a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a² 'Background Guard' real time protection feature a-winpoet-service winpppoverethernet.exe WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. A1000 Settings Utility cpqa1000.exe Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan, print, copy and fax. Only required if you use these features A4Proxy A4Proxy.exe Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites AAACLEAN AAACLEAN.INF ?? AAAKeyboard ?? ?? AAATraySaver TraySaver.exe System Tray management utility from Mike Lin which allows you to hide, show, restore icons that are lost in an Explorer crash, remove dead tray icons, minimize any window to the System Tray AAK aak.exe Advanced Anti-Keylogger - "Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere" Aaou amee.exe PurityScan/Clickspring adware Aapp adprot.exe AdBlaster adware aauclient ACNUpdater.exe Appears to be related to software from Accenture.comF1527 ab EazyScheduler ezsched.exe ?? ABBYY Community Agent CAGENT.EXE Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt t ABC keylogger.exe Keystroke logger/monitoring program - remove unless you installed it yourself! abcdefgh abcdefgh.exe EPJ TROJAN! ABIT uGuru uGuru.exe ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to "hardware monitoring, overclocking, BIOS flashing and audio tweakin ABITEQ abiteq.exe Monitoring utility for ABIT Motherboards. Displays system voltages, temperatures and fan speeds Abrada WIN32 abrada.exe Added by the DERMON-G TROJAN! Absolute Shield dseraser.exe Absolute Shield Evidence Eliminator - internet history eraser Absolute StartUp monitor ASMon.exe Absolute Startup - startup monitor from F-Group Software AbsoluteShield Internet Eraser cseraser.exe AbsoluteShield Internet Eraser - "protects your privacy by cleaning up all the tracks of your Internet and computer activities" ABsr absr.exe Added by the AUTOUPDER TROJAN! absr mwsvm.exe SeekSeek search hijacker related - see here abtu mp3serch.exe Loads the executable for Lop.com. mp3serch.exe is the final version abtu lopsearch.exe Loads the executable for Lop.com. lopsearch.exe is the beta version AbyssWebServer abyssws.exe Abyss web server AcBtnMgr_Xxx AcBtnMgr_Xxx.exe Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation acc acc.exe Advanced Call Center - "full-featured yet easy-to-use answering machine software for your voice modem" ACCDEFRAGINFO [path to worm] Added by the DARBY-O WORM! Accelerate accelerate.exe Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection Access Ramp Monitor armon32.exe Monitors your progress on the internet; hang-ups, connection speeds, internet congestion and traffic flow. It prevents some games from running also. To disable the Access Ramp Monitor (1) Open Wind Access WebControl [path to file] Added by the PPDOOR-M TROJAN! AccessManager AccessMgr.exe Part of SmartPipes SecureSite software. "SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management, access control AccessMedia P2P Loader amp2pl.exe My AccessMedia toolbar related, stealth installed! AccessoriesPlus clockplus.exe Clock Plus, part of Accessories Plus allows you to select from dozens of alternatives for the Windows clock AccessRamp Monitor01 ARMon32a.exe From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are AccessRampLAN01 ARUpld32.exe Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup pro AcctMgr AcctMgr.exe Norton(tm) Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information, and retrieves the data needed for email logins, shopping orders, banking, and othe AccuWeather.com(r) Desktop ?? Desktop weather from AccuWeather.com accwizz.exe accwizz.exe Added by the RULAND.A WORM!

X ? N U U X N Y X X U X U N U U U N N N N ? N U X U X X N U U Y U X U N U U U U U U U U U ? N X X U U U U N N X N X X X X X X X U X ? ? N Y

accwizzz.exe Ace bows AceGain LiveUpdate AcerNotebookManager AcerPowerkey Aceu Acme.PCHButton ACMonitor_Xxx acocash acocash Acombo3dmouse Aconti acoustic acpart Acrobat Assistant *.* Acronis Popup Blocker Acronis Scheduler2 Service Acronis TrueImage Monitor AcronisTrueImage Monitor Acronis True Image Monitor Action Manager 32 ActionAgent Activation Activboard Active Bit Station Active shield ActiveDesktop ACTIVEDS ActiveEyes ActiveMenu ActivePlus ActiveShield ActiveSpeed ActiveXUpdate Activity ActivSurf ActMaker ActMaker Actual Window Minimizer ACU ACU_QSB ACWLIcon Ad Blocker Ad Blocker Pro Ad Muncher Ad Online Guide Ad-aware Ad-Aware Ad-Eliminator Ad-Muncher Ad-Protect Ad-watch AD2KClient Adaptec DirectCD AdaptecDirectCD AdAware Adaware Bootup Adaware lptt01 Adaware ml097e Add**.exe [* = random char] Add**32.exe [* = random char] AddClass AddClass AddClass AdDelete AdDestroyer addproxy ADG ADGJdet Adiras

accwizzz.exe Added by the RULAND.A WORM! Ace bows.exe ?? LiveUpdate.exe AceGain_LiveUpdate. "AceGain LiveUpdate provides a fully managed and customizable LiveUpdate platform that seamlessly integrates with a game. As soon as an update is made available, AceGain ma almxptray.exe System Tray access on some Acer Notebooks to give faster access to system settings Powerkey.exe PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3 [random filename] PurityScan/Clickspring adware pchbutton.exe Used by HP Instant Support ACMonitor_Xxx.exe Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation fastdown.exe Adult content dialler fastdown.exe Adult content dialler Acombo3d.exe Mouse driver - required if you use non-standard Windows driver features aconti.exe Adult content dialler acoustic.exe Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained agpart11.exe Program for finding trucks on-line ACROTRAY.EXE Used to create PDF files with Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the "U" recommendation. *.* repr RunDll32.exe [path] Blocker.dll, Run Part of Acronis Privacy Expert - anti-spyware and security suite schedhlp.exe Part of Acronis True Image - backup software. Co-operates with the "schedul2.exe" servuce to perform backup/restore tasks correctly. Required if you want to use TrueImage to do some real backup/res TrueImageMonitor.exe Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage TrueImageMonitor.exe Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage TrueImageMonitor.exe Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage am32.exe Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs actionagent.exe A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented cl Activation.exe Part of Microsoft Money MMKeybd.exe Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock, Caps Lock, Scroll Lock keys abs.exe Added by the MYTOB.BZ WORM! Activeshield.exe Active Shield is "an heuristic screen that actively protects your computer from trojans, spyware, adware, trackware, dialers, keyloggers, and even some special kinds of viruses" systray32.exe Added by the DABOOM WORM! ACTIVEDS.EXE Added by the OPASERV.T WORM! ActiveEyes.exe ActiveEyes from TFI Technology ActiveMenu.exe Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collec activeplus.exe Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on) MCVSSHLD.EXE McAfee VirusScan On-line. See also the McAgentExe entry AS.exe Ascentive ActiveSpeed Internet Optimizer svcss.exe Added by a variant of the DEDLER.C TROJAN! actik.exe ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself! backweb*****.exe Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates ActMak25.exe ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding, nor are you required to know a lot about the compute ActMaker25.exe ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload ActualWindowMinimizerCenter.exe Actual Window Minimizer - "allows minimizing any window to task tray notification area or to the edge of the screen" ACU.exe Atheros wireless Client Utility For HP Compaq ACU.exe Atheros wireless Client Utility For HP Compaq ACWLIcon.exe Related to IBM ThinkVantage Connectivity Solution blocker.exe Ad Blocker - blocks popups, and also removes banners, image ads and flash ads Ad Blocker Pro.exe Ad Away popup and banner remover AdMunch.exe Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications adonlineguide.exe ?? Ad-aware.exe Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs Ad-Aware.exe Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-aware spware/adware removal tool and is located in the WinntSystem32 or WindowsSystem32 directory ad-eliminator.exe Spyware remover - not recommended, see here ADMUNCH.EXE Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications ad-protect.exe Ad-Protect spyware and spam monitoring tool Ad-watch.exe Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system AD2KClient.exe Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip(r) disk. Required if you wish the applications to launch on insertion of a disk Directcd.exe DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the progra Directcd.exe DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the progra wini.exe Added by the RBOT-XN WORM! ad-aware.exe Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs adaware.exe RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware adaware.exe RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware Add**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log Add**32.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log AddClass.exe CoolWebSearch Addclass parasite variant [Installation_Path] Added by the Startpage.F hijacker [path to trojan] Added by the SECDL-A TROJAN! AdDelete.exe Banner advertisment blocker AdDestroyer.exe Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer addproxy.exe Related to Adobe Photoshop ADG.exe SoundBlaster Audigy related? ADGJDet.exe Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Adiras.exe ADSL USB modem related

X X X X X U X X X X X X X X U N N N N U X X X X X N X X X X N X X X X U U N ? Y X ? Y X X X U X X X X X X X U X X U X N U X N U X U N U X ?

ADM Library Loader admlib32.exe Admanager Controller AdManCtl.exe Admilli Service AdmilliServ.exe Administrator svchost.scr AdminSoft sysfile.vbs admtray.exe admtray.exe Adobe Adobe.exe Adobe sysconfig.exe adobe gam.exe Adobe sysbat32.exe Adobe zteam.exe Adobe Acrobat Distiller Application acrotray.exe Adobe Acrobat Reader CFG [random filename] Adobe Filter Platform afilterplatform.exe Adobe Gamma Loader Adobe Gamma Loader.exe Adobe Photo Downloader apdproxy.exe Adobe Reader Speed Lauch reader_sl.exe Adobe Reader Speed Lauch READER~1.EXE Adobe Reader Speed Launch reader_sl.exe Adobe Version Cue CS2 VersionCueCS2Tray.exe AdobeA adobes.exe AdobeFonts fonts.hta adobemgr adobemgr.exe AdobeReaderPro msnxpsp.exe AdobeReaderPro ntkernell32.exe AdobeVersionCue VersionCueTray.exe Adope File Manager lsasv.exe adp adp.exe AdPopup dcf5678.exe adprot adprot.exe ADQuickAccess Adtray.exe AdRoarUpdate ARUpdate.exe AdRotator.Application [path to csrss.exe] AdRotator.Application services.exe AdsBlocker stopAds.exe ADService ADService.exe AdsGone Adsgone.exe ADSL Diagnostic Tools mapiicon.exe ADSLSYSTEMTRAY SystemtrayV100B.exe AdslTaskBar rundll32.exe stmctrl.dll, TaskBar AdslTaskBars taskmng.exe ADSL_A2 A2Installed ADSS ADSS.exe adstartup automove.exe adstartup Adstartup.exe AdStatus Service AdStatServ.exe AdSubtract adsub.exe adtech2005 adtech2005.exe adtech2006 adtech2006.exe Adtools Service AdTools.exe AdultX AdultX.exe Adult_Chat Adult_Chat.exe Adult_Chat1 Adult_Chat1.exe AdUpdater sysupudt.exe ADUserMon ADUserMon.exe Advanced Internet Protocol cerf.exe Advanced Protection System advpsys.exe Advanced Spyware Remover Asr.exe Advanced Tool Checks advchks.exe Advanced Tools Check ADVCHK.EXE Advanced Uninstaller PRO Installation monitor.exe Monitor Advapi Advapi.exe ADVCHK ADVCHK.EXE Advertising Killer Akiller.exe advmon32 advmon32.exe Adware Agent adware agent.exe Adware Spy AdwareSpy.exe AdwareAlert AdwareAlert.Exe AdwareDelete adwaredelete.exe Aeiwlsta.exe Aeiwlsta.exe

Added by a variant of the SDBOT TROJAN! Adware, probably a Windupdates variant Windupdates adware variant Added by the NOVACAL TROJAN! Added by the STARGRUB-A WORM! Related to Acer Inc. destop tray Added by an unidentified VIRUS, WORM or TROJAN! Added by an unidentified WORM or TROJAN! Added by an unidentified WORM or TROJAN! Added by the LOWZONES.T TROJAN! Added by an unidentified TROJAN! Added by the RANDEX.DFJ WORM! Added by a variant of the RBOT WORM! Added by the RBOT-OP WORM! Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here) Speeds up the launch of Adobe (Acrobat) Reader 7 Speeds up the launch of Adobe (Acrobat) Reader 7 Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly File manager that's part of Adobe Creative Suite 2 - "find files fast, track versions across applications, link files together, and share them in creative collaboration without fear of overwriting someone els Added by the FLOOD.BA TROJAN! Browser hijacker - redirecting to Hugesearch.net Added by the ADCLICKER TROJAN! Added by the RBOT-ASK or RBOT-AUS WORMS! Added by the RBOT-ATY WORM! An exclusive feature of the Adobe(r) Creative Suite, Version Cue(tm) helps you find files fast, track multiple versions of your files, and share your files for creative collaboration Added by an unidentified WORM or TROJAN! Spyware installed by Net2Phone, Limewire, Cydoor, Grokster, KaZaa, etc Added by the AGENT-FZ TROJAN! AdBlaster adware variant After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95 AdRoar adware updater Added by the SMALL-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally fig Reported as DILAER.DW by NOD32 Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip(r) disk. Required if you wish the applications to launch on insertion of a disk AdsGone - pop-up stopper System tray access to ADSL modem diagnostic tools. Available via Start -> Programs Apparently Annex A ADSL modem related. What does it do and is it required? ISP software, initializes DSL modem Added by the RBOT-AXZ WORM! Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required? ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its runnin Adlogix adware variant Adlogix adware variant WindUpdates AdStatus Service adware AdSubtract blocks ads, cookies, pop-up windows, animations, music, and more. Can be disabled from within AdSubtract. Available via Start -> Programs Reported as Trojan.Win32.StartPage.aw by Kaspersky Anti-Virus Detected as Clicker.Win32.VB.kc by Kaspersky Anti-Virus Windupdates Adware Adult content dialler and hijacker Adult content dialler Adult content dialler Unidentified adware downloader/updater Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip(r) disk. Required if you wish the applications to launch on insertion of a disk Added by a variant of the SPYBOT WORM! Added by a variant of the RBOT WORM! Advanced Spyware Remover anti spyware tool Added by a variant of the RBOT WORM! Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Innovative Solutions Advanced Uninstaller PRO - "easy-to-use suite for uninstalling applications and keeping your computer fast, clean, and in its best shape" Added by the NETDEVIL.12 WORM! Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget AKiller - pop-up stopper Added by a variant of the CRYPTER.C TROJAN! Adware Agent popup blocker Adware remover - not recommended, see here Adware program, previously not recommended (see here). It has now been delisted, so make sure you have the latest version Adware remover - not recommended, see here IBM High Rate Wireless LAN Adapter driver. Is it required?

N X N ? U U N X X ? U X Y N U U U ? N X X X X X U N U X X X X X X U N N N Y X X U X U ? N ? ? X X U U ? N X X X X N X X U ? X X X N N Y ? X

AELaunch AERVICESN AeXAgentLogon AeXSWDUsr AEZBProc AFAFilter Agent Agent Browser Agent Explorer Agente AgfaCLnk agp AGRSMMSG AGSatellite ahfp ahfprog AHNSD AHNUE AHQInit Ahst AHU ahui32.exe Aica Aida aiepk AIM AIM AIM Instant Message Cookies Aim Plugin AIM reminder AIM95 Startup aimaol lptt01 aimaol ml097e aimb.exe AimingClick AIMster AIMWDInstall Aiptek Graphics Tablet (USB) aircity AKEYNAME AKiller ala.exe Alarm Manager AlarmWatcher Album Fast Start AlcFDMonitor ALCFDRTM16 Alchem alcmtr Alcohol Alcohol Autorun Alcom PCL Capture AlcWzrd AlcxMonitor aldefr ere service Alevir AlevirOld Alexa AlexaToolbar AlfaCleaner AlfaClock Classic ALFY Accellerator ALG.EXE ALG32 ALGU Alias SketchBook Snapshot AlienAutopsy ALiSndMgr AliUSBfix Alive SYstem

AELaunch.exe AERVICESN.exe AeXAgentActivate.exe AeXSWDUsr.exe aptezbp.exe windefault.exe Agent.exe [random filename] [random filename] Remupd.exe AgfaCLnk.exe agp32.exe AGRSMMSG.exe AGSatellite.exe ahfp.exe ahfp.exe AhnSD.exe AHNUE.exe ahqinit.exe iebs.exe [path to worm] ahui32.exe tuaa.exe ttuh.exe aiepk2.exe aim.exe AIM+.exe [random filename] aimplugin.exe AIM reminder.exe aim95.exe aimaol.exe aimaol.exe aimb.exe AimingClick.exe ?? AIMWDInstall.exe atwtusb.exe aircity.exe WinServ.exe akiller.exe ala.exe Alarm.app.exe AlarmWatcher.exe ABMTSR.EXE ALCFDRTM.EXE ALCFDRTM16.com Alchem.exe ALCMTR.EXE Alcohol.exe Alcohol.exe FMW_PCAP.EXE ALCWZRD.EXE Alcxmntr.exe tay0x.exe Alevir.exe [worm filename] alexa.exe alt.exe AlfaCleaner.exe AlfaClock.exe AlfyAC~1.exe iexplorer .exe ALG32.EXE ALGU.EXE ALIASS~2.EXE Test_BS.exe ALiSndMg.exe GREENMK.exe scchost.exe

Audio Applications Launcher for the Philips Acoustic Edge soundcard Added by the RANDON-AO WORM! Altiris Agent transmits information about your machine for the purpose of asset management and deployment Altiris Express NS Client Manager software. Is it required? IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation, volume control, and few quickstart buttons. Keyboard will work without it but you lose the special functio AFAFilter - internet filter software Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs Added by the PPdoor.M-bdr backdoor TROJAN! Unidentified adware Part of Panda Antivirus Titanium. Is this an update reminder (guess because of the name), virus definition update reminder or something similar? For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive Added by the GAOBOT.SY WORM! IBM AMR modem driver Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis ?? Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required PurityScan/Clickspring adware Added by the ANACON-B WORM! Added by the CERTIF-M TROJAN! PurityScan/Clickspring adware PurityScan/Clickspring adware Another IE Popup Killer - pop-up stopper AOL Instant Messenger. If connected to the internet, automatically runs up AIM. Convenience more than anything. Available via Start -> Programs AIM plus - a free add-on to AOL's Instant Messenger for Windows from Big-O Software Added by the RBOT-AFV WORM! Added by the GUAP-F WORM! Added by the BUDDY TROJAN! Added by the AGOBOT.AEE WORM! RapidBlaster variant (in a "Aimaol" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "Aimaol" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here IMSufSentinel is a spy program which can record IM conversations, log keystrokes, record URLs visited, and take screenshots. If you didn't install this yourself remove it AimingClick from AimingTech. Web searching tool. Available via Start -> Programs Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals info USB interface for Aiptek Graphics Tablet (USB) Related to "Prutect" malware from e2Give Added by the EVILBOT.C TROJAN! BuyPin Advertising Killer - popup killer Access Lock is a system-tray security utility you can use to secure your desktop when you are away from your computer Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required? Scanner software, not required for scanner to work RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup? RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup? VX2.Transponder parasite updater/installer related Realtek AC97 Audio - Event Monitor. "Sypware" file used surreptitiously monitor one's actions. It is not a sinister one, like remote control programs, but it is being used by Realtek to gather data about c Alcohol 120% - CD/DVD emulation/writing/copying software Alcohol 120% - CD/DVD emulation/writing/copying software ?? RealTek High Definition audio driver related - detects new devices when plugged in, then pops up a dialog box. If everything works as expected you should be able to disable this one Realtek AC97 Audio - Event Monitor - used to surreptitiously monitor one's actions. It is not a sinister one, like remote control programs, but it is being used by Realtek to gather data about customers Added by the RBOT-XS WORM! Added by the OPASERV-A WORM! Added by the OPASERV WORM! Related to Alexa. Note - collects and stores information about the web pages you view, the data you enter in online forms and search programs and, with versions 5.0 and higher, the products you purch Reported as the DELF.EB hijacker by Ewido Security Suite AlphaCleaner is now a stealth install using exploits on unpatched systems. Seen alongside RazeSpyware AlfaClock from AlfaSoft Research Labs - "enhances your taskbar clock (tray clock) with fully customizable clock display, alarms, time synchronization and more" ?? Added by the DEMOTRY-B WORM! Added by the Startpage.K hijacker Added by the CWS-I TROJAN! Screen-capture utility for Alias Sketchbook Alienware computer technical support software ALi AC97 Sound driver May be realted to a USB 2.0 PCI card - the IOgear GIC220OU? Added by the TOFDROP-B TROJAN!

X X U X X N U U X U U Y U ? X X U U X U N U N U N X N N U Y Y U U X Y ? ? N N U U U X X X U X N U U X X X X U U Y X X X X X X X ? X U X Y Y

Alive SYstem scchostc.exe Added by the TOFDROP-B TROJAN! alkasr ÎäÒíÑ.exe Added by the BALKART TROJAN! All Aboard Status stswin.exe All Aboard! Internet Connection Sharing status icon All Sea screen saver TaskTray.exe Free screensaver, installs lots of foistware. See here. Get rid of it All Sea web link FWLink.exe Free screensaver, installs lots of foistware. See here. Get rid of it AllerCalc AllerCalc.exe AllerCalc is an expression calculator which allows you to directly enter an expression to be evaluated. Can be started manually allSnap allSnap.exe allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop AllToTray ALLTOTRAY.EXE AlltoTray from DNTSoft - minimize any program to your System Tray Alogrithm Link Queue alq.exe Added by a variant of the SDBOT WORM! Alogserv Alogserv.exe From McAfee VirusScan for logging scanning activities. In some cases, if left running it can cause CPU % usage to go between 5-95% or go to and stay at 100%. Disabling it impacts on the reported last ALPass ALPass.exe ALPass password manager Alps Electric USB Server Monserv.exe Alps Electric USB Server - required according to this article AlpsPoint Apoint.exe Touchpad software for laptop PC's. For instance it is found on the Panasonic machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of ALServ ALServ.exe Altec Lansing AMS speaker related. What does it do and is it required? Altnet points manager.exe Altnet TopSearch adware AltnetPointsManager points manager.exe Altnet TopSearch adware AltoMB_service AltoMBsrv.exe Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory ALTOOLS AccessL.exe ALTools family of PC utilities AltPayments AltPayments.exe WeirdOnTheWeb ADWARE! ALUAlert ALUNotify.exe Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis Aluria Security Center SecurityCenter.exe Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here Aluria's Pop-Up Stopper eps.exe Aluria Pop-Stopper Aluria's Spyware Eliminator ASE.exe Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here AlwaysOnTopMaker AlwaysOnTopMaker.exe Always On Top Maker - utilty to enable an application to always be displayed "on top" of others on the desktop AlwaysReady Power Message APP ARPWRMSG.EXE Related to HP and Compaq Desktop PCs. Read this article AmazingTens AmazingTens.exe Premium rate adult content dialler America Online *.* Tray Icon aoltray.exe Puts AOL icon in System Tray (*.* denotes version if present). Connect to AOL via the desktop shortcut or Start -> Programs AME_CSA rundll32 amecsa.cpl, RUN_DLL Loads ADSL modem Control Panel applet AModemLockDown ModemLockDown.exe ModemLockDown - allows you to supervise internet access by disabling the modem, protects againt dialers accessing dial-up connections, etc Amon AMON.EXE Monitoring part of Eset's NOD32 virus-scanner Amonitor amon.exe Tiny Personal Firewall AMP WinOFF winoff.exe WinOFF is " a utility designed to shut down Windows computers automatically, in a fully configurable way" AMSN amsn.exe aMSN P2P client - can be started manually anbv32 nabv32.exe Added by the TITOG.C WORM! ANIWZCS2Service WZCSLDR2.exe ALPHA Networks wireless driver ANIWZCSService WZCSLDR.exe D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity AnnotateCheck AnnCheck.exe Genius Wizard Pen Tablet driver related. Is it required? Announcements Annclist.exe MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Anntext Anntext.exe Caere Pagekeeper text annotation server Anonymizer Total Net Shield AnonTns.exe Anonymizer Total Net Shield ANONYMIZER_SPYWAREKILLER SpyWareKiller.exe Anonymizer Spyware Killer Another Internet Explorer Popup Killer aiepk.exe Another IE Popup Killer - pop-up stopper ansjava [path to worm] Added by the RANDON-AN WORM! Anskya PYSKY.NET.exe Added by the DLOADER-MW TROJAN! Answer Problem dSAFsqs.exe Added by the SDBOT-SC WORM! AnswerTool AnswerTool.exe AnswerTool - save your E-mail replies in AnswerTool, then reuse them again and again Anti Spam Service spamsvc.exe Added by the MYTOB-BK WORM! Anti-Blaxx Manager Anti-Blaxx.exe Anti-Blaxx - bypass blacklistings from different copy protections bypassing methods like virtual CD or DVD drives Anti-keylogger check antikey.exe Anti-keylogger - protects against keylogger programs monitoring your keystrokes Anti-Trojan-Watch ATWatch.exe Anti-Trojan Watch - trojan detector Anti-Virus Product Sync [unprintable character][3 characters]log.exe Added by the KEDEBE.D WORM! Anti-Virus Update Scheduler [path to trojan] Added by the SPAMMIT-A TROJAN! Anti-Virus Update Scheduler winsp3.exe Malware - detected by Kaspersky antivirus as TrojanProxy.Agent.fp - A Proxy Trojan is a backdoor which allows a remote hacker to connect to other systems via the compromised system Anti-Virus Update Scheduler V1.39.12R [path to trojan] Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe, kaspersky.exe, nrton.exe, wins.exe, gah32.exe, 1.tmp, syste.exe, alg.exe, socks.exe, winx antidialer.co.uk Dialer_Watcher.exe Dialer_Watcher is an application that allows you to detect Dialers on your computer AntiPopUp AntiPopUp.exe AntiPopUp for IE - pop-up stopper AntiVir XP AVwin.exe AntiVir(r) PersonalEdition Classic - antivirus Antivirus av.exe Added by the SINKIN TROJAN! Resets IE start page to realphx.com Antivirus maja.exe Added by the NETSKY.H WORM! Antivirus iexpl0res.exe Added by an unidentified WORM or TROJAN! AntiVirus kaspery.exe Added by a variant of the RBOT WORM! Antivirus Installer [path to trojan] Added by the BADGENT-A TROJAN! antivirus32 antivirus.exe Added by the SPYBOT.KAI WORM! AntivirusGold AntivirusGold.exe Malware masquerading as an antivirus - also installs the Winnook TROJAN! AntiVirusProtection qumk.exe ?? antiware elite***32.exe [*** = random char]Added by the DLOADER-HW TROJAN! AntiWindowsMessenger AntiMsMsg.exe Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory anti_troj anti_troj.exe Added by the LODEAR.D TROJAN! AnVir AnVir.exe AnVir Task Manager - protects computer against viruses and manages running processes and startup files AnVir Task Manager AnVir.exe AnVir Task Manager - protects computer against viruses and manages running processes and startup files

U U ? U N X U N X ? X X ? X X X X X X X U U Y Y ? X N N X X N Y U Y X X X X X X X X U ? U X X U X U X Y U X U Y Y Y X X X X X X X N U N N X

anvshell anvshell.exe Any To-Do List anytodo.exe anycom bluetooth ftflauncher.exe AnyDVD AnyDVD.exe AO Tray AOTray.Exe AOL 9.0 Optimized AOLClient.exe AOL Broadband Check-Up matcli.exe AOL Companion companion.exe Aol Configuration Loader aimsng.exe AOL Fast Start AOL.exe AOL Instant Messanger aim.exe AOL Instant Messengar aol.exe AOL Instant Messenger AlM.EXE Aol Instant Messenger aolmsg.exe AOL Instant Messenger 7.213 aim9283.exe Aol Instant Messenger Fix aolfix.exe AOL Messenger [random filename] AOL Messenger aolmsngr.exe AOL Messenger Optimized AOLOpt.exe AOL Services Hosts aolserviceshosts.exe AOL Spyware Protection AOLSP Scheduler.exe AOL TopSpeedMonitor aoltsmon.exe AolAcsDaemon1 Acsd.exe AolAcsDaemon1 AOLACSD.EXE AOLCC ACCAgnt.exe AolCon config.com AOLDialer AOLDial.exe AolFix AolFix.exe AOLRegKey32 AOREGSVR512.EXE Aornum aornum.exe AOTray AOTray.Exe APC UPS Status Display.exe APC_SERVICE mainserv.exe apc_tray apc_tray.exe APD123 APD123.exe Api**.exe [* = random char] Api**.exe [* = random char] Api**32.exe [* = random char] Api**32.exe [* = random char] API32 api32.exe APIClass lexplore_.exe APIMon apimonx.exe APIMon winapix.exe apisvc.exe apisvc.exe APL APL.exe Apmsrv9x APMSRV9X.EXE Apoint Apoint.exe App**32.exe [* = random char] App**32.exe [* = random char] App.EXEName [path to worm].exe Appcon vAppCon.exe appconn appconn.exe AppExtender AppExtCB.exe appis.exe appis.exe Application mdmsetsp.exe Application Explorer Naldesk.exe Application Layer Gateway Service algs.exe AppPlus AppPlus.exe Apvxd APVXDWIN.EXE Apvxdwin APVXDWIN.EXE Apwheel Apwheel.exe apyginapygin simenu.exe aqadcup.exe aqadcup.exe Aqujyjax [path to file] Aqujyjax aqujyjax.exe ara-key [random filename] Archive archive.exe ARCHIVE CONTROL fixupdattr.exe ARCSolo Recovery N/A Ardamax Keylogger akl.exe ares ares.exe areslite AresLite.exe Aritima aritima.exe

System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar Any To-Do List "the ultimate software solution to keep yourself organized and reminded" Associated with an Anycom bluetooth wireless card. What does it do and is it required? AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel Added by the SPYBOTER.A TROJAN! matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. The AOL Self Part of the AOL Connection Suite and installs an icon on the system tray offering easy access to AOL's additional utilities and functions. This program is a non-essential process, and is installed for ease Added by the SDBOT-XE WORM! AOL ISP software related. What does it do and is it required? Added by the SDBOT-YT WORM! Added by the AGOBOT-FN WORM! That is an L between the A and M, the start up location is wrong for AIM. What does this relate to? Added by KELVIR.AL WORM! Added by the SDBOT-ZF WORM! Added by the SDBOT-ABJ WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by the SDBOT-JF WORM! Added by the AOLOPT TROJAN! Added by an unidentified WORM or TROJAN! AOL's spyware protection program AOL's TopSpeed web acceleration technology supposedly helps to make web browsing faster. Most important for those users who still access AOL via dial-up AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually AOL ISP software related, file located in a "AOL Computer Check-Up" folder. What does it do and is it required? Added by the TAPLAK WORM! AOL ISP software dialer - can be activated through a desktop shortcut Run on Gateway Astra computers, and maybe a few others. Designed to repair a bad registry key in Gateway computers that would not allow AOL to run correctly. Not seen much any more and should Unidentified malware - see here Installed along with iWon Prize Machine. Based upon their privacy statement this can be regarded as spyware System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel APC PowerChute Personal Edition status icon PowerChute(r) Personal Edition - "safe system shutdown software with sophisticated power management functions" Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure PacerD Media/Pacimedia.com adware CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Added by the IRCBOT-B TROJAN! Added by the MSNOPT-A TROJAN! Added by the TIBSER.A downloader TROJAN! Added by a variant of the TIBSER.A downloader TROJAN! Added by a variant of the LAMEBOT TROJAN! Sage Software's ACT! The application pre-loader (apl.exe) is a self contained executable that pre-loads the necessary .NET framework and ACT! 2005 assemblies. This pre-loading of assemblies enhance Intel AnyPoint Wireless II Home Network related. What does it do and is it required? Touchpad software for laptop PC's. For instance it is found on the Panasonic machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of CoolWebSearch/HomeSearch adware - for examples, see this log Added by the BODIRU WORM! Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connecti Added by the CARGAO WORM! Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received Added by the AGENT-BC TROJAN! Aztech Labs modem driver Novell Zenworks Application Explorer Executable. "For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each succ Added by the LINKBOT.M WORM! AppPlus - "menu bar or tray launcher that docks to your desktop, floats or sits in your System Tray. Create graphic/text-based buttons that launch any number of programs, Websites, e-mail addresses o Part of Panda Anti-Virus. Required to enable permanent virus protection Part of Panda Anti-Virus. Required to enable permanent virus protection Wheel support for an Alps mouse Added by the SDBOT.BTR WORM! Added by the AGENT.BG WORM! Added by the RANCK-CQ TROJAN! Added by the SDBOT-YC WORM! Added by the ANTINNY WORM! Adware, recognized by Kaspersky antivirus as Trojan-Downloader.Centim.a Added by the MYTOB.GU WORM! Backup software by Computer Associates - no longer supported Ardakey B keystroke logger/monitoring program - remove unless you installed it yourself! Ares is "a Windows program that enables peer-to-peer file-sharing on the Ares P2P network. As a member of the P2P community you can search and download any file shared by other users. You can m Ares Lite Edition is "a Windows program that enables peer-to-peer file-sharing on the Ares P2P network. As a member of the P2P community you can search and download any file shared by other users Added by the ARITIM WORM!

N U ? ? X X X X X X X X X X X X X X X X X X X X X N U Y X Y U X X U X X X N Y X X X X U X N N N N U U N U N X U X U N N N U X Y Y N N N X X

ARMOR2NET Artera AS00 Gear511 AS00_WPN511 ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN ASDPLUGIN asdx ASE Scheduler Ashampoo PopUpBlocker ashAvast ASHLT ashMaiSv AsioReg ASK asl Asmw Soft Popups Burner ASP.NET State Service ASP.NET State Service ASP.NET State Service asp4tray AspireTimeMachine assistse AST AST AST ASTART AStart asTray Astro ASUS Live Update ASUS Probe ASUS SmartDoctor ASUS TweakEnable ASUSKey asustweakenable ASWDP ASWnk AT-Watch atapidrv Athan ATI CATALYST System Tray ATI DeviceDetect ATI GART Set-up Utility ATI Launchpad ATI Rage3d Pro ATI Remote Control ATI Remote Control ATI Scheduler ATI Task Application ATI Task Application (Atikey) ATI Technology Startup ATI VIDEO REGKEY

Armor2net.exe arteraui.exe Gear511.exe WPN511.exe dsldbaccess.exe canada.exe france.exe fullgames.exe 100171be.exe 100176br.exe adult1.exe Austria.exe belgium nm.exe czech.exe dbaccess.exe dslgeaccess.exe Finland.exe geaccess.exe mexico.exe netherlands.exe turkey.exe uk nm.exe Xadult1.exe temp532.exe xwinrpc32.exe ASE Scheduler.exe PopUpKiller.exe ashAvast.exe Ashlt.exe ashmaisv.exe regsvr32.exe ctasio.dll rundll32.exe [path] ASK.dll rdl Aslru.exe popups burner.exe csrss.exe crsass.exe servicos..exe asp4tray.exe acertmb.exe ASSISTSE.EXE AST AST AST.exe astart.exe AStart Astray.exe Astro.exe ALU.exe AsusProb.exe VGAProbe.exe astart.exe V38SHELL.EXE ATweak.exe ASWDP.exe aswnk.exe ATWatch.exe atapidrv.exe Athan.exe CLI.exe SystemTray ATIDtct.EXE Atigart.exe launchpd.exe AtiRage4dPro.exe ATIRW.exe ATIX10.exe Atisched.exe Atitkad.exe Atitask.exe techstart.exe ati2vid.exe

Related to Armor2net personal firewall (possibly contains or is related to an anti-spyware product known as ArmorWall, which is a spyware remover - not recommended, see here Artera Turbo Internet Accelerator - "surf faster, boost download speed". Only required if you find it helps improve your performance Software for Netgear wireless network cards. Unknown whether it is required for the wireless card to run but does not seem to be a resource hog. Not required for laptop to run if the wireless network ca NetgearRev MFC Application - software for Netgear wireless network cards - what does it do and is it required in startup? AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant AsdPlug premium rate adult content dialer variant Added by the AGOBOT.VO WORM! Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here Ashampoo popup blocker, part of Privacy Protector Plus - see here Part of Avast antivirus Ashlt adware Part of Avast! anti-virus software - E-mail scanner ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Added by the BANCOS-CU TROJAN! Popup blocker, part of Asmw Soft PC Optimizer Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the BANLOAD-M TROJAN! Added by the DADOBRA-I TROJAN! System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP, allowing you to restore a PC back to a working state with minimal re-entry CnsMin (Chinese Keywords) hijacker related Added by the TROJANDOWNLOADER.WIN32.VB.AH VIRUS! Added by the VB.AH TROJAN! AutoStarter parasite ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings Added by the VB.AH TROJAN! Voyetra Audio Station - part of Voyetra's Ultimate MP3 & CD Manager. MP3 and digital music jukebox/organizer Checks for updates to Quicken on a system reboot ASUS Live Update utility for their motherboards ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area ASUS video card fan/thermal monitor Restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings System tray Icon for quickly changing video modes Asus tweaking utility - for fine tuning the settings of your ASUS display card MLS Pulse - real estate software. Keeps the home buyer/seller continually informed on the status of his/her local/regional real estate market Adult content dialler Anti-Trojan Watch - trojan detector Added by the AGOBOT-SL WORM! Athan - an application that calculates and reminds the five daily Islamic prayer times for anywhere in the world System Tray access to ATI's CATALYST(tm) CONTROL CENTER. Note that this has "SystemTray" appended to CLI.exe in the "Command" column of MSCONFIG. Not required to run the control center - wh Utility meant for future use of the ATI TV WONDER(tm) USB 2.0 video driver and can be disabled Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one, once installed it shouldn't be needed Convenient way to start all your Multimedia Center applications (DVD, Video CD, CD Audio, File Player). You can right-click LaunchPad, and uncheck Load on Startup in the menu Added by the AGOBOT-OG WORM! Driver for the ATI REMOTE WONDER(tm) RF remote control for ATI's All-In-Wonder graphic cards and other products. Required if you use it ATI Remote Wonder(tm) - PC wireless remote control driver. Required if you use it Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. F System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Added by the RBOT-AEU WORM! Added by the SDBOT.UR WORM!

? N N X U U U U U U X X N ? N U U X U U U U U U U U U X U U U X X U U X X X X X Y X X X N X X U N U U U U U U X X X X X N Y X U X Y X X ? X

Ati2cwxx Ati2mdxx ATICCC aticpaxx.exe AtiCwd AtiCwd AtiCwd AtiCwd32 AtiCwd32 AtiCwd32 AtiDisplayDrv atidriver AtiKey AtiKey Atikey ATIMACE ATIModeChange atipatxx ATIPOLAB ATIPOLAB ATIPOLL AtiPTA AtiPTA AtiPTAAA AtiPTAAA atiptaxx atiptaxx atiptext AtiQiPcl ATISmart AtiSound atisrc2 ATITech atitray AtiTrayTools atiupdate atiupdate ATIUpdater Atiupdpl ativopen ATIX10 Atl**.exe [* = random char] Atl**32.exe [* = random char] ATM Control ATnotes Atomic-x27 Atomic-x27C Atomic.exe Atomica AtomicTime Atrack Atray ATSpooler ATTBroadbandUpdate ATTRedUpdate AttuneClientEngine AttuneContentUpdater AttuneDiscovery Attunel AttuneSystray aTuner atwtusb AtxBrw AU Agent au.exe AUCBPNP Aucompat Audcntr AudCtrl AUDIO

Ati2cwxx.exe Ati2mdxx.exe cli.exe runtime aticpaxx.exe AtiCwd.exe AtiCwd32.exe Ati2cwad.exe AtiCwd.exe AtiCwd32.exe Ati2cwad.exe atidrvxx.exe reaIplayer.exe AtiKey32.exe atiptkad.exe Atitask.exe MACE.exe Ati2mdxx.exe atipatxx.exe ati2evxx.exe ati2evae.exe ati2evxx.exe Ati2ptxx.exe Atiptaxx.exe Ati2ptxx.exe Atiptaxx.exe Ati2ptxx.exe Atiptaxx.exe atiptext.exe AtiQiPcl.exe ati2s9ag.exe csrss.exe windfind.exe Active.exe atitray.exe atitray.exe ATIUPDATE5.EXE msshed32.exe atiupdxx.exe atiupdpl.exe ativopen.exe atix10.exe Atl**.exe [* = random char] Atl**32.exe [* = random char] adpn.exe atnotes.exe Atomic-x27.exe AtomicpartC.exe Atomic.exe atomica.exe ATOMICTIME.EXE atrack.exe Atray.exe AppsTraka.exe SAUpdate.exe AutoUpdate.exe attune_ce.exe attune_cu.exe attune_di.exe Attunel.exe attune_st.exe atuner.exe atwtusb.exe Iexplor.exe AUagent.exe au.exe aucbnpn.exe Aucompat.exe audcntr.exe RunDll32 AudCtrl.dll, RCMonitor SOUND.exe

For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it For ATI video cards. System Tray access to display mode changing ATI's CATALYST(tm) CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this ha Added by the RBOT-XP WORM! This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Added by the RBOT-VZ WORM! Added by the WARPIGS-E WORM! Note the uppercase "I" in the filename, rather than a lower case "L" System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display ATI Technologies Control Centre - installed alongside ATI graphics hardware and provides additional configuration options for these devices in the Managed Access to Catalyst Environment (MACE) comp System Tray icon to access ATI graphics card settings and the Hydravision Desktop Manager Added by the SMALL-ED TROJAN! ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers, but it can help with graphics card problems. Leave enabled unless it consumes too many CPU ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers, but it can help with graphics card problems. Leave enabled unless it consumes too many CPU Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need Added by the COSIAM-A TROJAN! Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's ATI's "SMARTGART", which is included with the "Catalyst" drivers. When the system boots, it runs a couple of bus tests & tries to apply the most stable settings Added by the WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or Sy Added by the WINDFIND-A TROJAN! Added by the ROAMER-A TROJAN! ATI Tray Tools - allows quick access to ATI graphics card settings ATI Tray Tools - allows quick access to ATI graphics card settings Added by the DEBESKI.A TROJAN! Added by the DELF.EP downloader TROJAN! Added by the RBOT-ABX WORM! Added by the SMALL.AOS TROJAN! Premium rate adult content dialler ATI Remote Wonder(tm) - PC wireless remote control driver. Required if you use it CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Added by the MMS.A WORM! Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs Added by the KATOMIK-A WORM! Added by the KATOMIK-A WORM! Atomic Clock Sync - synchronizes your computer's time with the NIST time server Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key AtomicTime - utility that synchronizes your PC clock to an atomic clock New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker, an instant notification feature. The Alert Tracker displays information about events as they happ Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons AppsTraka keystroke logger/monitoring program - remove unless you installed it yourself! Big Brother from Quest Software. System and network monitor Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you p Spyware - part of an automated helpdesk software called Aveo Attune Spyware - part of an automated helpdesk software called Aveo Attune Spyware - part of an automated helpdesk software called Aveo Attune Spyware - part of an automated helpdesk software called Aveo Attune Spyware - part of an automated helpdesk software called Aveo Attune aTuner - tweak tool for GeForce based graphics cards USB interface for Aiptek Graphics Tablet (USB) Pop Marketing adware Au Agent from Zilab Software. Win2K/NT enhancement tool. Allows you to run applications under any security context without closing the whole logon session to process a new logon Added by the BEAGLE.B WORM! Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot Added by the GEMA TROJAN! Added by the GEMA TROJAN! Audio control panel? Added by the PLOYB-A TROJAN!

X N X U N N X X X X X Y Y X X X X U X U N X X X X X X X X U U U N X X X X N X X X N X N X X ? U N N N N N X X X X X X X X X X X X X N X X X

Audiocntl audiocntl.exe Added by a variant of the CRYPTER.C TROJAN! AudioDeck ADeck.exe ADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items Audiodrv audiodrv.exe Added by the CRYPTER-C TROJAN! AudioDrvEmulator DLLML.exe AudDrvEm.dll Related to Creative DLL Module Loader. This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems AudioHQ Ahqtb.exe For Creative Soundblaster Live! series soundcards. System tray application for SB Live! functions. Available via Start -> Programs AudioHQU AHQTBU.EXE System Tray application installed with the drivers for Creative Labs' SoundBlaster Live! Can be run from Start -> Programs audioinf audioinf.exe Added by a variant of the CRYPTER.C TROJAN! AUNPS2 RUNDLL32 AUNPS2.DLL, _Run@16 AlwaysUpdatedNews.com parasite related - see here aupd symcsvc.exe Added by the ABWIZ.D TROJAN! aupd sysvcs.exe Added by the ABWIZ.C TROJAN! aupd sywsvcs.exe Added by the ORSE-M TROJAN! Aureal A3D Interactive Audio sa3dsrv.exe For Aureal based 3D soundcards. A3D sound features won't work with this disabled Aureal A3D Interactive Audio Init A3dInit.exe For Aureal based 3D soundcards. A3D sound features won't work with this disabled ausvc ausvc.exe Added by the AUTOUPDER TROJAN! Auth Starter Ident startauth.exe Added by the RBOT-WP WORM! authz authz.exe Added by an unidentified VIRUS, WORM or TROJAN! Auto CD-ROM Startup cdaccess.exe Added by the SPYBOT.BLA WORM! Auto EPSON Stylus CX6400 on DDLS1Z11 E_S4I2L1.EXE Related to Epson Stylus CX6400 Series printer auto repair system qualityx.exe Added by an unidentified WORM or TROJAN - probably a SPYBOT variant Auto Switch TASKBAR.exe Related to 2-port Bitronics AutoSwitch kit from Belkin Auto T Bar autotbar.exe If you disable the HP VIEW toolbar in IE and rarrange the toolbars on a reboot they will be back as they were before if this is left enabled Auto updat crsrs.exe Added by the FORBOT-AK WORM! Auto Updat WindowsSys32.exe Added by a variant of the FORBOT WORM! Auto updat crcss.exe Added by the SDBOT.AAG WORM! Auto Update AUP.exe Added by an unididentified WORM or TROJAN! Auto Update dma.exe Added by the RBOT-AVO WORM! Auto Update svchost.exe Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Auto Updates svchost.exe Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Auto WinUpdate taskmrg.exe Added by the RBOT-AFA WORM! Autobar autobar.exe Connect buttons on the keyboard for internet direct access, etc. on HP computers AutoCAD Startup Accelerator acstart16.exe Preloads some libraries that are used by AutoCAD in order to make the software load faster autoclk autoclk.exe Autoclik is a Windows utility "that allows you to perform all mouse activity with absolutely no clicking" AutoEA Ahqrun.exe For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ AUTOEXE AUTOEXE.exe Added by the SEMAPI-A WORM! Autoloaderaproposclient Apropos_Client_Loader.exe AproposMedia adware Autoloaderaproposclient cxtpls_loader.exe AproposMedia adware AutoLoaderEnvoloAutoUpdater auto_update_loader.exe Envolo/AproposMedia adware updater AutoMate Task Service automate.exe Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start -> Programs Automatic Defrag Manager defrag.exe Added by the RBOT-AKE WORM! Automatic Microsoft Windows Updater suchost.exe Added by the RBOT-EQ WORM! Automatic Windows Updater Update.exe Added by the GAOBOT.AO WORM! Automatically launches the United Devices UD.EXE Agent when you start your The computer United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home Autopdate Autopdate.exe Added by the RBOT-AGL WORM! AUTOPROP REGPROP.EXE WMPADDIN.DLL Both the files are in the MS Office/Bots/FP_WMP directory. Apparently, it registers the FrontPage WiMP extension AUTOPROTECTU navapq32.exe Added by an unidentified WORM or TROJAN! autorepair dexs.exe Added by a variant of the SDBOT WORM! AutoShutdown pssvc.exe Utility to fix vCard Export in MS Outlook 2000 - although why are these together? AutoSizer AUTOSIZER.EXE AutoSizer - utility that automatically maximizes windows when they're opened AutoSpell autospel.exe AutoSpell - spell checker (version 6.*) AutoSpell 5 ASWATC32.EXE AutoSpell - spell checker autotbar autotbar.exe If you disable the HP VIEW toolbar in IE and rarrange the toolbars on a reboot they will be back as they were before if this is left enabled AutoTKit AUTOTKIT.EXE On HP PC's. Unclear what purpose it serves - but there's a known issue with Internet Explorer Toolbar settings not being saved with it enabled autoupd autoupd.exe Raxco Software Auto Update utility."Used to keep your software up-to-date" autoupd autoupd.exe Added by an unidentified VIRUS, WORM or TROJAN! - found in a folder of the same name autoupdate WINUP2DATE.DLL, SHStart Unidentified adware - detected by Panda antivirus as the CLICKER.CY TROJAN! autoupdate rundll32 [path] DATADX.DLL, SHStart Added by a variant of the QOOLOGIC TROJAN! Autoupdate Service kaka.exe Added by the SYMPE-B TROJAN! AutoUpdater aupdate.exe Tinybar variant AutoUpdater AutoUpdate.exe PeopleonPage foistware autoupdatev2 [path to file] Added by the DROPPER-BM TROJAN! autoupdatev2 autoupdatev2.exe Reported by Kaspersky Anti-Virus as Clicker.Win32.Agent.fq TROJAN! AutoVirusProtection ciscv.exe Added by a variant of the RBOT WORM! auto__antiav__key antiav_exe.exe Added by the BAGLEDI-AA TROJAN! auto__hloader__key hloader_exe.exe Added by the BAGLE.AB TROJAN! aux.exe aux.exe Added by the ZINS TROJAN! auxAudioDevice aux32.exe Added by the AIZU WORM! AUXXTRAY au30setp.exe System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel AV UPDATE-28062004.exe[25 blank spaces].vbs Added by the MIDFIN WORM! AV Client patch31345.exe Added by the MYDOOM.AD WORM! AV Industry patch31345.exe Added by the MYDOOM.AD WORM!

X Y Y Y Y X U X X X Y Y Y Y Y Y Y Y Y Y Y Y Y Y X X X Y Y Y Y X X X X Y Y X X Y Y X X X X X X X U N ? Y Y Y Y ? U N U U ? U ? X Y ? U N X N

AV UpDate Avast! avast! avast! Web Scanner Avast32 avc AvconsoleEXE AveoAttune AvG AVG Grisoft Updater AVG7_AMSVR AVG7_CC AVG7_EMC AVG7_Run avgamsvr.exe avgcc32 AVGCtrl avgmsvr.exe AVGnt Avgserv9.exe AVGuard AVG_CC AVG_EMC AVG_RegCleaner avidrv Avimgt Avimgt32 avinit AVK Mail Checker AVKBar AvMaiSrv avnort avnort avnort AVP avpcc avpm Avpr Avril Lavigne - Muse AVSCHED32 AVSchedScan AvSer AvSer AvSer AvSer avserve.exe avserve2.exe avserve3.exe AVStation premium Avtray AVWLPSTA AVWUpd32 avx communicator Avxlive avxlni Avxnews Awatch awhost32 AWMON AWMON AWUSGSTA awxDTools AxFilter AXVenore azmodem a_vpd a² B'sCLiP b.exe B.Reader

Update.exe ashserv.exe ashDisp.exe Ashwebsv.exe Astart32.exe avmon.exe Avconsol.exe atmdlusr.exe svchost323.exe updater.exe Avgamsvr.exe AVGCC.exe AVGEMC.exe avgw.exe Avgamsvr.exe avgcc32.exe AVGCTRL.EXE avgmsvr.exe AVGNT.EXE Avgserv9.exe AVGUARD.EXE avgcc32.exe AVGEMC.exe AVGREGCL.exe drvsc.exe Avimgt.exe Avimgt32.exe AVINIT9X.EXE AVKPop.exe AVKBar.exe Avmaisrv.exe formatsys.exe msmbw.exe serbw.exe [path to trojan] avpcc.exe avpm.exe avpr.exe [random filename] AVSched32.exe SCHSC9X.EXE dsm.exe msmpatch.exe svosm.exe sysup.exe avserve.exe avserve2.exe avserve3.exe AVStation agent.exe Avtray.exe AVWLPSTA.exe AVWUPD32.EXE xcommsur.exe avxlive.exe avxinit.exe ?? Awatch.exe awhost32.exe Ad-Watch.exe Ad-Monitor.exe AWUSGSTA.exe awxDTools.dll, awxRegisterDll Rundll32 AXFILTER.DLL, Rundll32 AXVenore.exe azexe.exe vpd.exe a2guard.exe BSCLIP.exe b.exe remin.exe

Added by the FUROOT-A TROJAN! Avast! anti-virus software Part of Avast! anti-virus software Avast! antivirus Part of Avast! anti-virus software Added by an unidentified TROJAN! From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it Spyware - part of an automated helpdesk software Added by the RBOT-ZA WORM! Added by the AGOBOT-OT WORM! AVG antivirus related AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components, settings and updates AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses AVG Anti-Virus 7.0 related AVG antivirus related AVG anti-virus control center. Also enables scheduled tests, Outlook E-mail plug-in and automatic updates Background task of the AntiVir antivirus program which scans files transparently in the background AVG Anti-Virus 7.0 related AntiVir(r) PersonalEdition Classic - System Tray icon and control program AVG antivirus background monitoring AntiVir(r) PersonalEdition Classic - antivirus. Background task which scans files transparently AVG anti-virus control center. Also enables scheduled tests, Outlook E-mail plug-in and automatic updates AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses AVG Anti-Virus 7.0 Registry Cleaner - for checking the registry for virus additions and other security problems Detected as the Trojan-Downloader.Win32.Agent.ph TROJAN! by Kaspersky Anti-Virus Added by the GEMA TROJAN! Added by the GEMA TROJAN! Command antivirus related eXtendia AVK AntiVirus email checker GData AntiVirusKit Anti-virus Part of Avast! anti-virus software - E-mail scanner Added by the SERFLOG.A WORM! Added by the SERFLOG.A WORM! Added by the SERFLOG.A WORM! Added by the MUTBO-A TROJAN! Kaspersky Labs anti-virus Kaspersky antivirus Added by the MYDOOM.AF WORM! Added by the AVRIL-A WORM! AntiVir(r) PersonalEdition Classic - antivirus Command antivirus related Added by the SERFLOG.B WORM! Added by the SERFLOG.B WORM! Added by the SERFLOG.B WORM! Added by the SERFLOG.B WORM! Added by the SASSER WORM! Added by the SASSER.B or SASSER.C WORMS! Added by the SASSER.G WORM! Related to Samsung AV Station - instant playback of music, photos, videos Command Antivirus tray icon PRISM Status Tray Applet - but what is it for and is it required? AntiVir(r) PersonalEdition Classic - updater Anti-virus part of BitDefender virus scanner/firewall Bullguard or BitDefender antivirus Anti-virus part of BitDefender virus scanner/firewall ?? Diagnosis tool that monitors DSL connections, installed alongside DSL drivers from AVM Fritz's range of modem products Part of Symantec's pcAnywhere remote PC management software. Provides an automatic startup of the client PC in host mode in conjuction with a host-definition file, so system administrators can acce Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system F-Secure Anti-Spyware Reportedly related to a USB Wifi Adapter - is it required at startup? AwxDTools related - a Windows Shell-Extension for the Daemon-Tools. It extends the context-menu of ImageFiles supported by Daemon-Tools (i.e.: *.cue, *.iso, *.ccd ...) ?? Identified as a TROJAN! Aztech Labs modem driver Located in the IBMTOOLSVPD sub-directory. What does it do and is it required?" a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a² 'Background Guard' real time protection feature CD recording utility that comes with a lot of CDR/CDRW drives and isn't required Added by the SDBOT.BND WORM! Birthday Reminder 5.0 - as the name implies

X X U X X N N X X X U N X U ? N N U N X X X X X U U X X X ? U X N X N U X U U X U X U U U U ? N U U U Y U Y ? N X X U N N X Y Y Y Y N U X ?

b3d BDEsecureinstall.exe b3dUpdate Zupdate.exe b9 B9.exe b99 msmm.exe babeie rundll32 cnbabe.dll, dllstartup Babylon Client Babylon.exe Babylon Translator Babylon.exe Back Updates Uninstall.log.vbs Backdoor.NuAgent agent.exe Background Intelligent Transfer Service rundll32.exe BackgroundSwitcher bgswitch.exe Backpack UDF bpudfmon.exe Backup Service backup.svc BackupExecScheduler besch.exe BackupNotify backupnotify.exe BackWeb backweb.exe Backwork Backwork.exe BACPI10 bacpi10a.exe BacsTray BacsTray.exe BADDATE BADDATE.EXE BagleAV csrss.exe Bakra IEHost.EXE Band-Aid [path to file] Bandook ali.exe Bandwidth Monitor Pro Bandwidth Monitor Pro.exe Banpopup by Pratik Banpopup.exe Bar Ding lolt Analiz.exe bargains bargains.exe bargains bargainbuddy.exe Bart Station station.sbrt Bart Station PPCOLink.exe BarTheme bartent32.exe bascstray BascsTray.exe Bat secure2.bat Batchreg1 N/A BatInfEx rundll32.exe BatSrv batserv2.exe Battery Scope batmgr.exe BatteryBar batterybar.exe BatzBack BatzBack.scr BAUSB BAUSB.exe bawindo bawindo.exe BayMgr DockApp.exe Bayswap bayswap.exe Bayswap2 TbUpdate.exe BBC News alerts skinkers.exe BBDial BT Broadband.exe bbSysTray bbSysTray.exe bbui bbui.exe bca bca.exe BCDetect bcdetect.exe BCMDMMSG bcmdmmsg.exe BCMHal rundll32.exe bcmhal9x.dll, bcinit BCMSMMSG BCMSMMSG.exe bcmwltry bcmwltry.exe BCNT bcnt.exe BCPC bcpc.exe bcpc_c bcpc_c.exe BCTweak bctweak.exe Bcvsrv32 bcvsrv32.exe BCWipeTM bcwipetm.exe BD dc.exe BDMCon Bdmcon.exe BDNewsAgent bdnagent.exe BDOESRV bdoesrv.exe BDSwitchAgent bdswitch.exe BearShare bearshare.exe BeatNik Internet Clock BeatNik.exe Beegees Update beegees.exe BEEI beei.exe

B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C: B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C: FireTrust Benign - allows you to receive e-mail which is safe from viruses, worms, scripts, web bugs, privacy threats and other security risks, without affecting your e-mail. "Benign neutralizes or strips o ClientMan parasite variant CommonName Toolbar spyware. To uninstall see here Babylon-Pro is a powerful information tool that instantly provides relevant information, translations & conversions for any word or value you click on" Babylon-Pro is a powerful information tool that instantly provides relevant information, translations & conversions for any word or value you click on Added by the YPSAN.D WORM! Added by the AGENT-DP TROJAN! Added by the VB-ZD TROJAN! Note - this file is located in the C:Windowshelp folder, and is not to be confused with the legitimate rundll32.exe file! Background Switcher Powertoy. Included with the last beta version of the XP Powertoys. Whenever a user right clicked his desktop and chose properties he could see a new tab which allowed him to ena Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk Unidentified adware Veritas "Back Up My PC" software HP Digital Imaging related. What does it do and is it required? Automatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Avai Backwork trojan detector Known as "PowerKey" - a minimalistic keyboard driver that allows power management keys on BTC keyboards to function properly in older OS's (i.e. Win95/98/NT4). Also adds an icon to the system tray Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems Added by an unidentified VIRUS, WORM or TROJAN! Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the MULTIDR-AH TROJAN! Added by the RANKY.O TROJAN! Added by the EXEMAS-B TROJAN! Bandwidth Monitor Pro - utililty to track your current download/upload limit that may be set by your ISP Banpopup - popup killer Added by the RBOT-RP WORM! BargainBuddy foistware BargainBuddy foistware Related to PeoplePC ISP. May be a dialler for dial-up accounts? Dialer for PeoplePC ISP Added by the AGOBOT-UG WORM! Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems Added by the ZCREW.C TROJAN! Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation, a Displays battery status information on an IBM Thinkpad Detected as Win32.Locksky.m WORM by Kaspersky Anti-Virus! Monitors battery levels on a notebook/laptop PC BatteryBar - displays battery usage, and the current percentage of battery power left Added by the BACKZAT WORM! Boston Acoustics Audio, USB driver Added by the BEAGLE.AR or BEAGLE.AU WORMS! Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens Part of BT Broandband - is it required? Philips CD-RW related - "the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions" AOL DSL status monitor displaying a red/green icon indicating if you have a connection BeClean Agent - registry, history, temp files, etc cleaner Bcdetect.exe searches the system to make sure Creative drivers are installed for the video card. It loads the BlasterControl when the drivers are detected. Your choice - try it and see BCM voicemodem driver. Required for dial-up if you have one of these modems BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings BCM voicemodem driver. Required for dial-up if you have one of these modems Broadcom Corporation Wireless Network Tray Applet. Is it required? AWS Weatherbug related. What does it do? BroadcastPC adware variant BroadcastPC adware variant BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings Added by the GAOBOT.BQJ WORM! BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task, as well as special options for the task. Run manually when needed Added by the RASDOOR-A TROJAN! BitDefender antivirus BitDefender antivirus - updater Bitdefender 8 antivirus and firewall Bitdefender 8 antivirus and firewall BearShare file sharing client. Versions known to include spyware - see here BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock Added by the SDBOT-ADK WORM! ??

U ? ? N U ? ? X X N X Y U U Y N N U U X N U N N X X ? U X X X ? N X Y U U Y Y Y Y U N N N N N N U X X X X X X X X X X X X N N U X U X X N U

BeFaster befaster3.exe BeFaster internet connection optimization tool BEHL BEHL.exe ?? BEHLO BEHLO.exe ?? Belkin PCMCIA WLAN Monitor monitorbk.exe Belkin USB Network Adapter Management utility - can be started manually BelNotify [path] NPBelv32.dll, RunDll32_BelNotify BelTech enables licensees to offer automated, Web-based problem resolution to their end-users. BelTech allows the end-user to simply go to a web page and automatically resolve their problem or poin BELORVBI BELORVBI.exe ?? Belsta.exe Belsta.exe Configuration tool for Belkin wireless network cards. Required to change the card's configuration. Is it required for correct operation once the confuiguration is changed? Belt Belt.exe VX2.Transponder parasite updater/installer related Benadril Alert Tool benadrilalert.exe Plug-in for WeatherBug advising when pollen count in your area is high - prompting you to buy Benadril BestPopUpKiller BestPopupKiller.exe Popup killer by Swanksoft - not recommended, see here BeSys [path to file] Added by BeSys ADWARE! bg bullguard.exe Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster BGInfo Bginfo.exe BGinfo automatically displays relevant information about a Windows computer on the desktop's background, such as the computer name, IP address, service pack version, and more BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} NMBgMonitor.exe Related to Nero Home BGNewsAgent bgnewsag.exe BullGuard antivirus updater bgsmsnd bgsmsnd.exe Printer driver to generate PDF files from any program BHOCop BHOCop.exe ZDNet's BHO Cop that lets you see what browser helper objects are installed. Useful for detecting spyware BHODemon 2.0 BHODemon.exe BHODemon "protects you from unknown Browser Helper Objects (BHOs), by letting you enable/disable them individually. When running, it also monitors your Registry and alerts you when a BHO is insta BI1HelperStartUp BI1HEL~1.EXE ScreenScenes Beach Islands screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purcha BIE Rundll32.exe BDSrHook.dll, Rundll32 BDplugin parasite bigfix BIGFIX.EXE BigFix can automatically download and read technical support information provided by computer and software manufacturers and other technical support experts (published in the form of Fixlet(r) Mess BigPond Toolbar bpumTray.exe Telstra BigPond Toolbar - "Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier" BigPondCable bpcable.exe Telstra Bigpond Cable login software - can be started manually Billminder Billmind.exe Can be setup in Quicken to remind user of due payments. Available via Start -> Programs bin32hpu ppstub.exe PrecisionPop adware bingdian Bingdian.vbs Added by the BINGD WORM! Bingo Charm charms.exe Some kind of screen icon kind of like desk flag, but it gives you a choice of icons? Biomenu menusw.exe Related to Sony VAIO - passwords, encryption, and a biometric fingerprint sensor Bios Bios32.exe Added by an unidentified VIRUS, WORM or TROJAN! BIOS XP Loader [random filename] Added by the RBOT-IC WORM! BIOS1 BIOS1.EXE Added by the OPASERV.T WORM! BIOVCIP BIOVCIP.exe ?? BitComet BitComet.exe BitComet P2P client - can be launched from Start -> Programs BitDefender Antivirus BITDEFENDERX.EXE Added by a variant of the SPYBOT WORM! BitDefender Communicator xcommsvr.exe BitDefender antivirus BitDefender for MSN Messenger msnmon.exe Bitdefender anti-virus for MSN Messenger. Unless you have MSN Messenger running all the time start it manually BitDefender for Yahoo! Messenger yahmon.exe BitDefender Antivirus for Yahoo! Messenger - free AV add-on for Yahoo! Messenger BitDefender Live! Init bdinit.exe BitDefender antivirus BitDefender Scan Server bdss.exe BitDefender antivirus BitDefender Virus Shield vsserv.exe BitDefender antivirus bitdefenderlive avxlive.exe Main program of BitDefender virus scanner/firewall BitDefender_P2P_Startup BitDefender_P2P_Startup.exe Bitdefender anti-virus for file transfers via internet messaging clients such as ICQ and MSN Messenger. Unless you have these running all the time start it manually BitWare Print Monitor bwprnmon.exe FaxServe network fax software BJ Printer Status Monitor Cjstsr.exe Canon BJ printer status monitor BJ Status Monitor 5xx CJSTRxx.EXE Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers bjcfd cdf.exe BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs BlackICE PC Protection blackice.exe Loads the user interface for the BlackICE PC Protection (was Defender) firewall program. From the parent site - '(the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user i BlackIce Utility blackice.exe Loads the user interface for the BlackICE PC Protection (was Defender) firewall program. From the parent site - '(the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user i blads blads.exe A Tweak-XP component, blocks advertisement banners in Internet Explorer. Can be enabled/disabled via Tweak-XP / Internet Tweaks blah service winupdate.exe Added by the GAOBOT.BIA WORM! blah service winsysengine.exe Added by the RBOT-KI WORM! blah service internet.exe Added by a variant of the RBOT WORM! blah service smnp.exe Added by the RBOT.IZ WORM! blah service msnmsgrr.exe Added by the RBOT.PZ WORM! blah service tazkmgr.exe Added by the RBOT.UA WORM! blah service FaLeH.exe Added by the RBOT-AES WORM! blah service microsoft.exe Added by a variant of the RBOT WORM! blah service evosys.exe Added by a variant of the RBOT WORM! blah service win32.exe Added by the RBOT-AXO WORM! blahh service msengine.exe Added by a variant of the RBOT WORM! blahx service msnjompa.exe Added by the SDBOT.AML WORM! BlazeChanger FBZPaper.exe Ember graphic file viewer, manager, and touch-up system bldbubg bldbubg.exe Part of Dell Alerts which provides customers with an update on latest updates for his/her system blinkx blinkx.exe Blinkx Desktop "Smart Folders" software BLMessagingIntegration blengine.exe BuddyLinks adware BlockAds blads.exe A Tweak-XP component, blocks advertisement banners in Internet Explorer. Can be enabled/disabled via Tweak-XP / Internet Tweaks BlockChecker Block-checker.exe BlockChecker adware Blocker System611 Monitoring PopUpBlocker611.exe Added by the RBOT.BLJ WORM! BlockTracker BlockTracker.exe If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file blsloader blsloader.exe BellSouth ISP Internet Tools

X N N U U U U N X U U ? U N X X X U X Y Y U X U X X X N N N N U X X X X X X X X X X X U U X N X ? X X X X U X U N U X X X X U X X X X Y U N

blss BLSTAPP Blubster Blue Frog BlueSpace NE BlueToothAuthentication Agent Blueyonder Instant Support Tool BMail Installation Bman BMMGAG BMMLREF BMMMONWND BMO MasterCard Wallet BMupdate BMZ Bndt32 Bnexe BO1HelperStartUp Boarddata BOC412 BOCleanautostart Boingo Wireless Utility boler.exe bombshel Bonzi Buddy boo BookedSpace BookmarkCentral BookMarkSink BookMarkSync BookMarkSync2It Boost XP Service boot Boot Manager Boot Manager BootCfg BootCTRL BootLoader bootpd.exe BootsCfg BootsCfg BootsCfg BootsCfg BootStatus BootWarn boot_reg Bose Wave/PC Monitor BossIdea Boston Bot Loader Bouncer RunStartup Bouncer RunStartup boy lovers of bsd bpcpost.exe BPCv2 re BPK BPServer BQTray.exe Brasil Brasil BrasilOld Brct Break_Reminder Breg Breg Breg Bridge Brindys BriTray BrmfRmPA Broadband Wizard

blss.exe Added by the BLARUL TROJAN! blstapp.exe Puts access to Creative's BlasterControl in the System Tray Blubster.exe Related to Blubster Music sharing service bluefrog.exe Blue Frog by Blue Security Inc. - actively fights spam by posting complaints on the sites advertised by the spam you receive BlueSpaceNE.exe BlueSpace NE is a utility program used to run the Bluetooth(r) function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter. Shortcut a RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Associated with BlueTooth software, designed to allow bluetooth mobile devices to authenticate to the computer, when connecting a PDA to your computer - necessary for the computer and the PDA to matcli.exe matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file. Blueyonder Ins FTP_back.exe Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not BMan1.exe Abcsearch.com/DealHelper adware variant Rundll32 PWRMONIT.DLL, StartPwrMonitor Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery information window BMMLREF.EXE Battery Manager for IBM ThinkPad laptops rundll32.exe [path] BatInfEx.dll, BMMAutonomicMonitor IBM Thinkpad related. What does it do and is it required? EWALLET.EXE The wallet conveniently stores billing, shipping and payment information on your PC BMupdate.exe Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example, and you install the driver self-install bmz.exe NCase adware Bndt32.exe Added by the LACON WORM! [random filename] Added by the KITRO.D (or ARGEN.A) WORM! BO1HEL~1.EXE ScreenScenes Butterfly Oasis screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purch [path] repcale.exe [path] palsp.exeAdded by a variant of the RANDON.AN WORM! BOC412.exe Version 4.12 of NSClean's BOClean anti-trojan software Boclean.exe NSClean's BOClean anti-trojan software Icon###XXX#X#.exe Starts the Boingo Wireless utility, used to detect and login into Boingo wireless hotspots. The filename may be autogenerated when installing, two different variations along the lines listed here, where # syser.exe Added by the RBOT-AYS WORM! BOMB32.EXE Part of McAfee Nuts & Bolts. Protects your Windows system from application failure and crashes - similar to Norton Crashguard. Your choice - may cause problems ?? Spyware - read here for information and here for removal instructions boo.exe Adware downloader - detected by Kaspersky antivirus as the FAVADD.O TROJAN! RunDLL32.EXE [path] bs2.dll, DllRun BookedSpace parasite BMLauncher.exe Bookmark Express - "offers a more flexible way to manage Web site bookmarks, regardless of which browser you use" syncit.exe Bookmark synchronization utility syncit.exe Sync2IT BookMarkSync - "real-time automatic synchronization service that allows you to access your bookmarks, favorites and favorite files from any computer or any browser". Only installed with the u sync2it.exe Sync2IT BookMarkSync - "real-time automatic synchronization service that allows you to access your bookmarks, favorites and favorite files from any computer or any browser". Only installed with the u bxservice.exe Boost XP from Systweak - WinXP tweaking utility boot.exe Added by the PUPPET-A TROJAN! Njgal.exe Added by the KILO TROJAN! bootmng.exe Added by a variant of the SPYBOT WORM! Install.log.vbs Added by the YPSAN.D WORM! bootctrl.exe Added by an unidentified WORM or TROJAN! BootLoader.exe.vbs Added by the WATERWORKS WORM! bootpd.exe Added by the AGENT-DT TROJAN! Date.POP.vbs Added by the KUULLIO WORM! wscript.exe [path] All Users.vbe Added by the SPILTRON WORM! wscript.exe [path] All Users.vbs Added by the SPILTRON WORM! wscript.exe [path] Install.log.vbs Added by the YPSAN.E WORM! BOOTST~1.EXE Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it, it has no more effect on resources BootWarn.exe From here: "Norton AntiVirus Boot Warning. This program is installed as a startup item when you install Norton AntiVirus, and also sometimes when you do a LiveUpdate which updates Norton AntiVirus [path to file] Added by the BANCBAN-CA TROJAN! wavepcmonitor.exe System Tray access for this system (more info on the system here). Available via Start -> Programs winlogin.exe Added by the LINEAGE-I TROJAN! Boston.exe Part of the Boston Acoustics USB speaker systems. What does it do and is it required? svchostt.exe Added by the GAOBOT.ALV WORM! bouncer.exe Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer LiveUpdate.exe Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer ilikeboys.exe Added by the MYTOB.LY WORM! bpcpost.exe MS TV Viewer Post Setup Program. Part of MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall bpc2 re inst.exe BroadcastPC adware variant bpk.exe Blazing Tools Perfect Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! G6FTPSrv.exe BulletProof FTP Server BQTray.exe System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility, hence the U recommendation. Create your own desktop shortcut to start manually Brasil.exe Added by the OPASERV.E WORM! BRASIL.PIF Added by the OPASERV.E WORM! [worm filename] Added by the OPASERV.P WORM! trdb.exe Reported as PurityScan.y TROJAN! by Kaspersky Anti-Virus BREAK REMINDER.exe Break Reminder - Remind yourself to take breaks to prevent computer related injuries. See here bcre.exe BroadcastPC adware variant bptre.exe BroadcastPC adware variant breg.exe BroadcastPC adware variant rundll32.exe ...Bridge.dll Flingstone.com browser hijacker BRITRAY.EXE Main process for the following applications: GEDEX, SICARIO, BRINOTES, BRIRESPA, SICURE, TRASGO, UNDOCS, FRESH & BRIFAME (all of them from Brindys Software). Performs the following tasks [un]in BrmfRmPA.exe Brother resource manager - needed for a Brother MFC printer/copiert/scanner and PC to properly communicate bbwiz.exe Starts Broadband Wizard so it runs in the System Tray. This application tests and optimizes your Cable or DSL connection. Available via Start -> Programs

U N X X X X X X X X X X X N X X X X Y U X U X X N N N X N X X U X X ? U U ? U U Y Y X N U N X X X U Y U Y Y Y X ? X N U N N U X X X X X X U

Broadcom Wireless Manager UI Broadcom Wireless Manager UI Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus Bron-Spizaetus-5118REPM Bron-Spizaetus-cfgmktoq Bron-Spizaetus-cfgmmnru BrowseProxy browser browser browser aid Browser Help Svc Browser Hijack Blaster Browser Launcher Browser Pal Browser Sentinel BrowserUpdateSched BrowserUpdateSched BrowserWebCheck BS Player BsCLiP Bsoft lppt01 bsplayer Bsx3 BT BT Broadband Help BT00003* BT00003* btinst BTModemProtection BTopenworld BTSETBOOTKEY BtStart bttray BTUSRBDG BTUSRBDGF BTV Buddyizer bugwatcher service BuildBU BuildLab BuildLab BuildLabs Bulldog Service BullGuard BullGuard Update BullGuard XComm BullGuardInit BullguardoptIn BullsEye Network BullsEye Tracker Bunx BurnQuick Queue Button Server ButtonKey Buzme Buzof.exe bxproxy bxsx5 bxxs5 Bymer.Scanner Bymer.Scanner c C-Media Echo Control

bcmntray.exe Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems wltray.exe System tray access to wireless LAN card configuration options CVT.exe Added by the RONTOKBRO WORM! norBtok.exe Added by the RONTOKBRO.B WORM! [path to file] Added by the BRONTOK-F WORM! bronstab.exe Added by the RONTOKBRO.C WORM! eksplorasi.exe Added by the RONTOKBRO.J WORM! ElnorB.exe Added by the RONTOKBRO.D WORM! sempalong.exe Added by the BRONTOK-E WORM! RakyatKelaparan.exe Added by the BRONTOK-J or BRONTOK-L WORMS! komodo-6321422.exe Added by the BRONTOK-R WORM! bbm-qotkmgfc.exe Added by the BRONTOK-M WORM! bbm-urnmmgfc.exe Added by the BRONTOK-N WORM! FindService.exe Actual Names - "It is now possible to enter a particular word or keyword phrase that is associated with your business, and immediately be directed to YOUR WEBSITE! The Actual Names technology can msgaol.exe Added by the TACTSLAY.C TROJAN! s menu.exe Added by the TACTSLAY.C TROJAN! browseraid.exe BrowserAid/BrowserPal foistware BHSV.EXE Added by the RBOT-AVQ WORM! bhblaster.exe Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings Commandr.exe Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys adblck.exe BrowserAid/BrowserPal foistware BrowserSentinel.exe Browser Sentinel. Notifies you if a program wants to penetrate into Internet explorer, add itself to the Windows auto-run list or change your home page. See here qwinnsap.exe Added by a variant of ZenoSearch ADWARE! twinorag.exe Added by ZenoSearch ADAWARE! loadwc.exe Checks to make sure that IE is still your default browser bsplayer.exe BSplayer - A video player used to play avi, mpg, wmv and other multimedia files BSCLIP.exe CD recording utility that comes with a lot of CDR/CDRW drives and isn't required Bsoft.exe RapidBlaster variant (in a "BelmontSoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here bsplayer.exe BSplayer - a video player used to play avi, mpg, wmv and other multimedia files RunDLL32.EXE [path] bs3.dll, DllRun BookedSpace parasite [path to trojan] Added by the LITEBOT-B TROJAN! matcli.exe matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. BT Broadband abcdefg23.exe Added by the VB-VT TROJAN where * = 5,6 or 7! hiklmnop27.exe Added by the VB-VT TROJAN where * = 2,3 or 4! btinst.exe Associated with an Anycom bluetooth wireless card. What does it do and is it required? BTModemProtection.exe BT Privacy Online modem protection software, see here DialBTYahoo.exe BT Yahoo! internet connection manager BTSetBootKey.exe Related to a USB Bluetooth adaptor. What does it do and is it required? btstart.exe Broadcorp (formerly WIDCOMM) Bluetooth Connectivity Software bttray.exe System tray icon which shows the status of a BlueTooth wireless module. Most systems with such a module installed can enable/disable the module. The system tray icon changes from blue/white to blu BtUsrBdg.exe Used with a Mitsumi USB Bluetooth adaptor (and maybe others) BtUsrBdg.exe Used with a Mitsumi USB Bluetooth adaptor (and maybe others) btv.exe BroadcastPC adware variant Buddyizer.exe Part of the AIMster Peer to Peer (P2P) file sharing application that runs over the AOL Instant Messenger network bugwatcher.exe Bugtoaster is a service that sends reports on system/program crashes (certain types) back to Bugtoaster. They relay information to program authors and provide, if available, any known solutions to the bldbubg.exe Part of Dell Alerts which provides customers with an update on latest updates for his/her system services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! upsd.exe Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link mgui.exe Part of Bullguard antivirus avxlive.exe Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions XCOMMSVR.EXE Part of Bullguard antivirus AVXINIT.EXE Part of Bullguard antivirus bulldownload.exe Part of Bullguard antivirus bargains.exe BargainBuddy foistware BeTrack.exe Bullseye - intelligent research assistant beagle.exe Added by the LEBREAT-E WORM! BQTray.exe System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility, hence the U recommendation. Create your own desktop shortcut to start manually bttnserv.exe Found on a Compaq PC, for the extra buttons on the keyboard for the speaker volume, media player, sleep and internet buttons. If the buttons aren't used on the keyboard or your's doesn't have them, ButtonKey.exe CyberView TWAIN driver for the Pacific Image range of 35mm film scanners. Enables the one touch scanning button and places an icon an the System Tray. Use your scanners software or run it manuall Bmui.exe Buzme by RingCentral, Inc - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem buzof.exe Buzof from Basta Computing "enables you to automatically answer, close or minimize virtually any recurring window including messages, prompts, and dialog boxes" bxproxy.exe Added by the BXPROXY TROJAN! RunDLL32.EXE [path] bsx5.dll, DllRun BookedSpace parasite RunDLL32.EXE [path] bxxs5.dll, dllrun BookedSpace parasite Wininit.exe Added by the BYMER WORM! Msinit.exe Added by the BYMER WORM! c:archiv~1win.com Added by the CUYDOC TROJAN! EchoCtrl.exe C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer

N U U X X X X U Y X X X U X N Y N U U U U N X N Y U N X X N U X ? U U N N U N N N N ? N U X X U ? N ? N U Y X X N N X U X U X X X U X X X X

C-Media Mixer Mixer.exe C2K CYB2K.EXE c32cs2 c32cs2.exe C7 [path to worm] C:\WINDOWS\IEXPLOR.EXE IEXPLOR.EXE C:\WINDOWS\VCMnet11.exe VCMnet11.exe C:\WINDOWS\WinTask.exe WinTask.exe CA-AMAgent amagent.exe CaAvTray CAVTray.exe Cabchk Cabchk.exe Cabchk32 Cabchk32.exe CABCInstall CABCInstall.exe CacheBoost trayicon.exe CacheLoader [path to trojan] Cacheman Cacheman.exe CacheMgr CacheMgr.exe CACStarter cacstart.exe Caddais BackupOnDemand BODMon.exe Cadenza CdzSvc.exe CADS cads.exe CafeStation CafeStation.exe CAgent CAgent.exe cAgOu [filename].hta CahootWebcard CahootWebcard.exe CAISafe isafe.exe CaISSDT caissdt.exe Cal Reminder Shortcut calrem.exe Calc Microsoft Windows wincalc.exe CALC32 CALC32.EXE Calendar 200X Reminder calendar.exe Calendarscope cs.exe calk calk.exe CallBumping cbpopw.exe CallCenter Main Application V3calmcp.exe CallCenter Printer Interface V3faxecp.exe CallControl ftctrl32.exe CamCheck CamCheck.exe Cameno Cameno.exe Camera Detector CAMDET~*.EXE Camera Detector Camdetect.exe Camera Detector DEVDET~*.EXE Camio Viewer x IXApplet.exe CamMonitor hpqcmon.exe Canada Canada.exe Canary canary-std.exe candy command32.exe candynet Taskmsg.exe Canon MultiPASS Status Monitor monitr32.exe Canon PC1200 iC D600 iR1200G Status CAPM1LAK.EXE Window Canon Printer Monitor BJCxxx Cjstlst.exe CAP3ON CAP3ONN.EXE Capfax capfax.exe CAPing CAPing.exe Capon Capon.exe CaptionMgr32 crssr.exe capture capture.exe Capture Express 2000 capexp.exe Card Monitor REGCNT09.exe Care20 Care20.exe Care2GTU Care2GTU.exe CARPserver CARPserver.exe CARPservice carpserv.exe cartao [path to file] CAS Client casclient.exe Cas2Stub cas2stub.exe CasAgnt CasAgnt.exe Casdvqwa bmqnzkg.exe caseyvideo CaseyVideo.exe caseyvideo caseyvideo[*].exe [* = digit] CashBack cashback.exe

C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Pan CYBERsitter 2000 or 2001 - anti-adult content filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser Cyber Sentinel - internet filtering software Added by the MEDIAKILL.A WORM! Pop Marketing adware Windows AFA Internet Enhancement - a browser hijacker, redirecting to adsourcecorp.com. See here Pop Marketing adware Unicenter Asset Management is a solution for proactively managing IT assets in a business environment. It provides full-featured asset tracking capabilities through automated discovery, hardware inve eTrust(tm) EZ Antivirus system tray application from Computer Associates Added by the GEMA TROJAN! Added by the GEMA TROJAN! CABC content delivery software CacheBoost "optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers, resulting in a performance boost" Added by the DLOADER-NZ TROJAN! Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up Sophos Antivirus Remote Update Cash A Check - check writing software Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices Cyber Sentinel internet filtering software CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations, manage customer database, sell products and generate detailed reports and statistic Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents Added by the KAKWORM WORM! The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transactio Part of Computer Associates eTrus EZ Antivirus Computer Associates Dashboard Tray applet Produces a pop-up reminder of events scheduled using the MS Office Calendar Added by an unidentied WORM or TROJAN! Added by the SPYBOT-EC WORM! Calendar 200X - shows holidays, reminders of various anniversaries,tasks etc Calendarscope calendar software Added by the STARTPA-FH TROJAN! ?? V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answe V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answe FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, a NuCam camera software related Cameno is a program which brings tabbed windows to MSN Messenger 6.0 and above ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version From HP and related to digital imaging Known to be a dialler - but is it maliscous or clean? Canary keystroke logger/monitoring program - remove unless you installed it yourself! Added by the RBOT-LV WORM! Added by the RBOT-NA WORM! Cannon Multi-Pass status monitor - your choice Cannon printer related - is it required in startup? Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs Canon driver, purpose unknown. Is it required in startup? PhoneTools fax software Citibank Citianywhere software Canon printer driver Added by the ZAR.A WORM! Added by the THEEF-B TROJAN! Capture Express - screen capture utility For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs TopMoxie adware Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is, thanks to over 200 company profiles from Coop Americ Added by the BANKER-AN TROJAN! Associated with Zoltrix modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example Added by the DLOADER-QD TROJAN! CasinoClient adware CasinoClient ADWARE! Program by Extended Systems which allows you to sync your Casio PDA with your PC Added by the RANDEX.BE WORM! Malware causing p0rn popups Malware causing p0rn popups Part of eXact Advertising Software, consisting of "CashBack by BargainBuddy", BullsEye Network and NaviSearch

X N X X X X X Y Y X X U U ? X X Y X X X X X X X X X X X X U N Y Y Y X X X U X X U Y X Y X X X Y X X U U U U N X N X X N X X N U U ? X X X ?

CashFiesta Cashsurfers Cashbar Navigator CashToolbar CashToolbar Cassandra Cassandra CasStub CAVRID CAVS CAZNOVAS CBACK.EXE CBWAttn CBWHost CBWUser CC2KUI Ccao ccApp ccApp ccApp ccApp ccApp ccAppr ccAppr ccAppr ccAppr ccApps ccApps ccApps ccApps CCD Manager Ccdecode CCDoctorLogonTesting ccenter CcEvtMgr ccEvtMrg.exe ccExecute ccHelp ccleaner ccpApps ccpApps ccProxy CcPxySvc ccreg CcRegVfy ccRegVfY ccRegVfY ccRegVfY ccSetMgr ccsvit.exe ccUpdate ccWasher CCWC7a CCWC7I CCWC7s CD Storage Master cd1 CDANTSRV Cdcompat cddrv32 CDInterceptor Cdrom Controller cds CDTray CeEKEY CeEPOWER Ceic Cekirge center CentralProcessor CEPA

Cashfiesta.exe CASHFIESTA.A pay-per-surf adware Cashbar.Exe Cashsurfers CashBar Navigator - "The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals" CD_Load.exe CashToolbar Downloader-MY adware svchost.exe CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! [10 to 14 random char]THD.EXE Added by the KREPPER-AI TROJAN! cassandra.exe SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN! casstub.exe Added by the CASS-A TROJAN! CAVRID.exe eTrust(tm) EZ Antivirus Real Time Infection Report from Computer Associates CAVS.exe Cheyenne (now eTrust) antivirus CAZNOVAS.exe Added by the CAZNO TROJAN! CBACK.EXE Added by the PENTA-A TROJAN! CBWAttn.exe Required for Bitware to answer incoming faxes, can cause sleep mode problems CBWHost.exe Required for Bitware to answer incoming faxes, can cause sleep mode problems CBWDial.exe Associated with Bitware that integrates fax, voice, pager, and data communications on your desktop comet.exe Comet Cursor adware regedit.exe Probably a variant of MediaTickets adware. Note - this is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in a "mduu" ccApp.exe Part of Norton AntiVirus. Auto-protect and E-mail check will not function without this [random filename] Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus WMADZ.EXE Added by the RBOT-LJ WORM! .EXE Added by the RBOT-LJ WORM! gcasServ.exe Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name svcrhost.exe Added by the TACTSLAY.A TROJAN! expIorer.exe Added by the TACTSLAY.A TROJAN! outIook.exe Added by the TACTSLAY.A TROJAN! svcshost.exe Added by the TACTSLAY.A TROJAN! services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! N/A Added by the KANGAROO-A TROJAN! ccApps.exe Added by the KANGAROO-B WORM! DDS.EXE Project Labs Century CD manager for their CD/DVD storage device rundll32.exe streamci, StreamingDeviceSetup Part of the closed caption decdoder/MS VBI codec. Should only run once ccdoctor.exe Checks your system to make sure it's configured properly for running Rational ClearCase, a source code management tool. ClearCase is fairly sophisticated so there are a lot of system-related things tha CCenter.exe RAV AntiVirus ccEvtMgr.exe Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via "ccApp" and was not required as a seperate entry but a recent ccEvtMrg.exe Added by the RBOT.GZ WORM! bootcfg1.exe Added by the NEMSI-B VIRUS! ccHelp.hta Searchq adware ccleaner.exe CCleaner - removes unused files from your system csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf CCPROXY.EXE Part of Norton Internet Security, proxy server that is used to support the parental controls. If you turn parental controls off at user level the process is not loaded. Reported to cause excessive CPU usag CCPXYSVC.exe Part of Norton's AntiVirus 2003, Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall explorer.exe Added by the ZCREW TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m ccRegVfy.exe Part of Norton AntiVirus 2003. "ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack expIorer.exe Added by the TACTSLAY.A TROJAN! svcrhost.exe Added by the TACTSLAY.A TROJAN! svcshost.exe Added by the TACTSLAY.A TROJAN! ccSetMgr.exe Part of Norton AntiVirus 2004. What does it do? ccsvit.exe Added by the STARTPA-HP TROJAN! ccUpdate.exe Added by the AGOBOT.YS WORM! aolwasher.exe Webroot Cache & Cookie Washer - cleaning browser tracks, including cache, cookies, history, mail trash, drop-down address bar, auto-complete forms and downloaded program files for IE, Netscape and ac.exe Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean idxl.exe Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean stealth.exe Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 cdstorager.exe CD Storage Master - a program designed to catalog CD information, boasts a number of handy features for organizing your collection cd1.exe Premium rate adult content dialler CDANTSRV.exe C-Dilla License Management software. Used for any program that uses C-dilla Protection, example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Cdcompat.exe Added by the GEMA TROJAN! cddrv32.exe Added by a variant of the CRYPTER.C TROJAN! cdi.exe CD indexer for measuring the speed of CD players cdromcntrl.exe Added by the BATTRY-A TROJAN! cds.exe Added by the SPYMON TROJAN! CDTray.exe On HP PCs, this is the small CD icon next to the time CeEKey.exe Hot Key utility included on Toshiba Satellite laptops cepmtray.exe Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed, Monitor Shut Off, Hard Drive Shut-Off, Monitor Brigh Ceic.exe ?? [path to worm] Added by the KERGEZ.A WORM! [random name]32.exe Added by the BOFRA.A WORM! taskimgr.exe Added by the BANCOS.J TROJAN! wsot.exe ??

U N X X N X Y X X N ? ? U X X X U X X U X U ? N N X X N N U N X U U Y X X X ? Y U X U U U N X X X X U U U N ? ? X X N U N N X U N X Y Y X X

CertReg CesarFTP FTP Server cesmain.dll CEventMgr CFD CFDStart cfgintpr cfgmgr51 cfgmgr52 cfgwiz cFosDNT cFosInst_Check cFosSpeed cftmon32 cfy CGI Firewall Script CGServer Cgtask Services Cgywin ChamClock change-me-now ChangeICON ChangeLines Chatango Chcenter che32 Cheatle Check for One Touch Update Check for TWS Updates Check Messenger CheckCustomWorksUpdate Checkdisk CheckIt CheckIt 86 CheckMsgPlus checkrun checkrun CheckScan32 checktime CheckVCR CherryKeyMan china11msn ChineseStar CHIPDRIVEPinManager CHIPDRIVESmartcardManager CHKADMIN chkdsk Choke chope chostsv CHotKey CHotKey CHotKey Christmas Music Player ChromeMark ChronitelInitTV CiaBackdoor cihost.exe CIJxP2PSERVER Cisco Systems VPN Client Cisco Systems VPN Client CISrvr Program Cissi CitiUCS CitiVAN CJET Cjstcom ClamWin Classes Classes

certreg.exe Related to Gemplus Card Reader server.exe CesarFTPd - FTP server cmail.dll, Rundll32 CnsMin (Chinese Keywords) hijacker related Cell.exe Added by the BIFROSE-AK TROJAN! CFD.exe BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs WinMuschi.exe WINMUSCHI dialler cfgintpr.exe Configuration Interpreter - part of Tiny Personal Firewall V4 RunDLL32.EXE [path] cfgmgr51.dll,BookedSpace DllRun parasite RunDLL32.EXE [path] cfgmgr52.dll,BookedSpace DllRun parasite cfgwiz.exe Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it cFosDNT.exe cFos DSL Modem driver related. What does it do and is it required? cfosinst.exe cFos DSL Modem driver related. What does it do and is it required? cFosSpeed.exe cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly taskmgr*.exe [* = number] Added by the SOWSAT.C and SOWSAT.J WORMS! cfy.exe Surfenhance.com SearchForIt adware variant CGIAGENT.EXE Added by the BROPIA-U WORM! cgserver.exe Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure c cgtask.exe Added by the LALA.B TROJAN! cgywin32.exe Added by the RBOT-AEI WORM! ChamClock.exe Chameleon Clock - system tray clock replacement msgfix1.exe Added by the SDBOT.ZD WORM! SPMSMON.EXE Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem chngline.exe ?? Chatango.exe Chatango - "allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions, blogs, personal websites, Friendster pr chcenter.exe IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" che.ocx.vbs Added by the ADENU-B VIRUS! GigaByte.exe Added by the SHODI.B VIRUS! wiseupdt.exe Checks for updates for Visioneer OneTouch scanners WiseUpdt.exe Interactive Brokers - check for update to their standalone Java-based trading platform cmesseng.exe Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account CheckCWupdate.exe Update checker, part of CustomWorks - "customize any embroidery designs to design your own unique creations" mscas.exe Added by the VAGON-A TROJAN! ToolBox.exe CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parame CheckIt86.exe CheckIt 86 popup blocker MsgPlusH.dll, VerifyInstallation Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. elite***32.exe [* = random char] EliteBar ADWARE! elitelsj32.exe Added by the MULTIDR-ER TROJAN! regload16.exe Added by the AEBOT.K WORM! ct.exe Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required? IOMagic.exe Driver for the I/OMagic Personal Video Recorder (DR-PCTV100) KeyMan.exe Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys CHINA11MSN.EXE Added by the ENVID.O WORM! cstar.exe Chinese language support software sokscmpn.exe ChipDrive Smartcard software SCMgr.exe ChipDrive Smartcard software CHKADMIN.EXE Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" c:autoexec.bat Added by the ANPES WORM! Choke.exe-blahh Added by the CHOKE WORM! runlli32.exe Added by the QQPASS-U TROJAN! chostsv.exe Added by the BANPAES.C TROJAN! mhotkey.exe Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features MK9805.EXE Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features zHotkey.exe Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol , vol-, mute, etc. Only required for extended features TTEST6.EXE Christmas Music Player brings the music of the Christmas Holiday to your desktop keysh.exe Related to this. Don't know what keysh.exe does though and if it's required CHTVINIT.EXE ?? msldr.com Added by a VIRUS! cihost.exe Added by the LINST TROJAN! CIJxP2PS.EXE Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 ipsecdialer.exe Cisco VPN Client - lets local users gain Administrator privileges on the operating system vpngui.exe Sets up IPSec communications for Cisco's VPN Client CISRVR.EXE Related to internet setup on Compaq PC's Cissi.exe Added by the CISSI.A WORM! CitiUCS.exe Citibank Virtual Account Numbers - "With this free service for Citi cardmembers, you never have to give out your real credit card number online" CitiVAN.exe Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again CJet.exe Added by the Adware.FFToolBar adware toolbar Cjstcom.exe Canon printer BJ status language monitor ClamTray.exe ClamWin antivirus int1.exe Switch adult content dialler intl.exe Switch adult content dialler

X X X X X U ? ? U N U U N ? X X N N N U X X X X U N ? N N U X X ? X X X X X X X N N N N N N N X X N N U ? X X X U U U U ? X X X X X X X X ?

Classes run_21.exe Switch adult content dialler Classes srv.exe Switch adult content dialler Classes srv2.exe Switch adult content dialler Classes MSTAR2.EXE Switch adult content dialler Classes mstart.exe Switch adult content dialler CLCLSet CLCL.exe CLCL clipboard caching utility CleanEasyImg cleanall.exe ?? CleanRegPath CleanReg.exe Apparently Annex A ADSL modem related. What does it do and is it required? CleanSweep Smart Sweep- InternetCsinsm32.exe Sweep Automatic logging of installs from Norton CleanSweep - available via Start -> Programs CleanSweep Useage Watch CSUSEM32.EXE Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time CleanTemp CLEANT~1.EXEB CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory CleanTemp CleanTemp.exe CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory Cleanup ONICTASK.EXE Internet Cleanup from Aladdin Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet CleanupProgram cleanup.exe In a C:Sonysys folder - Sony Vaio related? clean_service clean_service.cmd Added by the REFAZ WORM! clfmon.exe clfmon.exe Added by the AGENT-BJ TROJAN! Click Radio Tuner clickr~1.exe ClickRadio - subscription service playing radio music via the internet Click Tray Calendar ClickT~1.EXE ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc ClickMe ClickMe.exe ClickM "JOKE" program Clickoff Clickoff.exe Clickoff automatically dismisses annoying dialog boxes ClickTheButton CTB.EXE ClickTheButton Downloader-MY adware ClickTheButton csrss.exe ClickTheButton Downloader-MY adware! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup! ClickTheButton MSCStat.exe ClickTheButton Downloader-MY adware CLICONFG CLICONFG.EXE Added by the OPASERV.T WORM! Client Access API Daemon cwbappcd.exe IBM iSeries Client Access, see here Client Access Check Version cwbckver.exe Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries Client Access Express Welcome cwbwlwiz.exe Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? Client Access Help Update cwbinhlp.exe Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates Client Access Service CwbSvStr.Exe Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Client Access Taskbar cwbuitsk.exe IBM iSeries Client Access taskbar, see here Client Agent ipxwping.exe Added by the PPDOOR-N TROJAN! Client Agent photes.exe Added by the PPDOOR-P TROJAN! Client agent for ARCserve W95AGENT.EXE Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? Client for Microsoft Networks msclient32.exe Added by the SDBOT-BXQ WORM! Client Server Control Process [path to trojan] Added by the AGENT-HR TROJAN! Client Server Runtime Process csrsss.exe Added by the SDBOT-LD WORM! Client Server Runtime Process csrs.exe Added by the LINKBOT.M WORM! Client Server Runtime Process smmss.exe Backdoor TROJAN! Possible SDBOT-GEN variant Client Update wup.exe Added by a variant of the OPANKI-A WORM! ClientMan1 mscman.exe ClientMan parasite variant Clik Status Monitor toolsclickstat.exe Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed Clipbook Service Clipsrv.exe Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks ClipMate5x ClipMt5x.exe Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs Clipmate6 CLIPMT60.EXE Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs ClipMate7 ClipMate.exe Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard Clipomatic Clipomatic.exe Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data Clipsrv Clipsrv.exe Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks ClipSrv clipserv.exe Added by the SDBOT-AAV and SDBOT-AFE WORMS! ClipSrv CLIPBRD3D.EXE Added by the MOFEI-D WORM! ClipTrak ClipTrak.exe ClipTrak - clipboard extender ClipTrakker ClipTrakker.exe Cliptrakker - clipboard extender CLMFrontPanel clmpanel.exe System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost clnwall rundll.exe setupx.dll, InstallHinfSection ?? ..delwall.inf clock [various filenames] LiveChat Adware - known file names include: mssetup.exe, kstatus.exe, spoolsv.exe, sptsupd.exe, osk.exe, msswchx.exe, netdde.exe, msbkup.exe Clock Manager amsngr.exe Added by the SDBOT-XM TROJAN! ClockSync Sync.exe ClockSync - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one o ClockWise CLOCKWISE.EXE ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock se CloneCD CloneCDTray.exe System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions CloneCDElbyCDFL ElbyCheck.exe From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognize CloneCDTray CloneCDTray.exe System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions Clotusorgreg0 prtStart.exe Orgprt.exe Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? Clre mmdc.exe Added by the PURSCAN-AI TROJAN! ClrSchLoader [path to file] ClearSearch adware CLSID com.exe Adult content dialler CLSID dll.exe Adult content dialler CLSID msgplus.exe Adult content dialler CLSID plugin.exe Adult content dialler CLSID sed.exe Adult content dialler CLSID msgplus.exe Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension CM-SmWizard SmWizard.exe SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?

U X N X X X X X X N ? X X U U X X X X X X X X X X X X X X X X X X X X N X X X Y N U U X U N X X X X X X X X X X X X N U X X X X X X U U X X

cma CMAPP Cmaudio Cmd cmd32 cmdcon CME CmeSYS CmeUPD CmFlywaveName CMGrdian CMMan Cmmon32Sys CmPCIaudio CMPDPSRV Cmpnt Cmpnt cmrss cmrss cmrst cmrst cms cmsound cmsound cmss cmssapp cmssapp cmssSystemProcess cmssSystemProcess cmssSystemProcess CMSystem cmt101 cmx32 Cn323 CNBABE cnet Cnfrm32 CnsMax CnsMin CnxAdslL CnxDslTaskBar Codename Dashboard CognizanceTS Coldlife -icmp coloreal Colorific Control Panel COM Service COM Service COM Service COM Service COM Service COM+ Event System COM+ EventSystem Services Com+ Sys COM+ System Applications COM++ System COM++ System COM++ System COM-IP ComAgent combo.exe combop.exe Comcast Network ComcastSUPPORT COMCFG comctl32 COMDRV32 Comm Driver Command Command

cma.exe DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" cmappclient.exe CasClient adware - also detected as the CMAPP TROJAN! Rundll32 cmicnfg.cpl, CMICtrlWnd System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel cmd32.exe Added by the TANKED WORM! configs.exe Hijacker, also detected as the QURL-2 TROJAN! cmdcon.exe Added by the CRYPTER.A TROJAN! cme.exe Part of Gator advertising spyware - see here for removal instructions CMEsys.exe Part of Gator advertising spyware - see here for removal instructions CMEupd.exe Part of Gator advertising spyware - see here for removal instructions CmFlywav.exe Driver for Linksys Wireless-G Music Bridge CMGrdian.exe One of the McAfee shared components. What does it do and is it required? CMMan.exe Added by the CMAPP TROJAN! cmmon32.exe Added by the SMALL.CL TROJAN! RunDll32 CMICNFG3.CPL, CMICtrlWnd Registers the Control Panel applet for a C-Media PCI sound card CMPDPSRV.EXE Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more." Installed with some C Devices2.exe Added by the TOMPAI-D TROJAN! mainsv.exe Added by the TOMPAI-C TROJAN! cmrss.exe Added by the DELF.DU TROJAN! crmss.exe Added by the DLOADER-EK TROJAN! cmrst.exe Added by the BANCOS.S TROJAN! cmrst.scr Added by the DLOADER-FP TROJAN! iserver.exe Added by the DLOADER-WK TROJAN! vcpdll.exe Added by the TCXMEDI-D downloader TROJAN! vcsystem.exe Added by the TCXMEDI-D downloader TROJAN! system.exe Added by a variant of the RBOT WORM! iexplore_.exe Added by the BANCBAN-CQ TROJAN! iexplore.exe Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally fi csmss.exe Added by the AGENT-CO TROJAN! mcsmss.exe Added by a variant of the AGENT.EI TROJAN! csms.exe Added by the AGENT-Y TROJAN! CMSystem.exe CASClient adware variant cmt101.exe Added by a variant of the CRYPTER.C TROJAN! cmx32.exe Added by the GEMA.D TROJAN! cnfrm33.exe Added by the MIMAIL.G WORM! CNBABE.EXE Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing kontiki.exe Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops cnfrm.exe Added by the MIMAIL.D WORM! Internat.exe Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir% Rundll32.exe CNSMIN.DLL, Rundll32 CnsMin (Chinese Keywords) hijacker related CnxAdslL.exe DLink, Zoom, or Conexant modem driver CnxDslTb.exe Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems dashboard.exe Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have rundll32.exe [path] AsTsVcc.dll, RegisterModule Cognizance Corp Identity And Access Management suite Systray.exe Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process coloreal.exe Makes colours sharper and brighter, but will only work with coloreal capable monitors Hgcctl95.exe From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor mscom32.com Added by the BEASTY.H TROJAN! msynvr.com Added by the BEASTY.G TROJAN! msjclh.com Added by the PLUX TROJAN! msdrce.com Added by the BEASTY.I TROJAN! msflyx.com Added by the BEASTDO-O TROJAN! DRWTSN16.EXE Added by a variant of the LOVGATE WORM! ECSERVER.EXE Added by a variant of the SDBOT WORM! csrs.exe Added by the FORBOT-BT WORM! lsas.exe Added by the AGOBOT.SE WORM! exploier.exe Added by a variant of the LOVGATE WORM! suchost.exe Added by a variant of the LOVGATE WORM! svchost.exe... Added by a variant of the LOVGATE WORM! COMIP.EXE COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) ComAgent.exe ComAgent - MDaemon's instant messaging client combo.exe Added by the CHIMO-C TROJAN! combop.exe Added by the BOWFEED-A TROJAN! ribiva.exe Added by an IRC TROJAN variant! tgkill.exe Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was m comcfg.exe Added by the TOADCOM.A TROJAN! comctl32.exe Adware - recognized by Kaspersky antivirus and others as TrojanDownloader.Win32.Agent.am svdhost.exe Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Note - asks for permission to contact commh32.exe G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! system.exe Added by the GATECRASH.A or GATECRASH.B TROJANS! Gotit.exe Added by the TITOG WORM!

X X X X N U N ? N N N X N X U N U X X X X X X X X X X X X X X X X X X N X X X ? N X X N X X U U X N X X X X X X X X X X X X X X U U N X X X

COMMAND command.exe Added by the QQPASS.E TROJAN! command javaw.exe Added by the AGOBOT-LG WORM! Command Prompt32 CmdPrompt32.pif Added by the ASSIRAL.B WORM! command32 command32.exe Added by the LINEADI-A TROJAN! CommCtr commctr.exe Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!. Available via Start -> Programs Compaq Alerter CPQAlert.exe Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rath Compaq Computer Corp SCCenter Module SCCENTER.EXE For Compaq PC's. Part of Backweb Compaq Computer Security Rundll32.exe SECURE32.CPL, Service ?? Compaq Connections COMPAQ~1.EXE See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer own Compaq Connections BackWeb-1940576.exe See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer own Compaq DMI cpqdmi.exe Compaq version of the Desktop Management Interface Compaq Drivers F1rewalls.exe Added by the SDBOT-WD WORM! Compaq Internet Setup inetwizard.exe For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list Compaq Jes Drivers winjes.exe Added by the SDBOT-XR WORM! Compaq Knowledge Center silent.exe & matcli.exe matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe Compaq Message Server COMPAQ-RBA.EXE Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send inform Compaq PK Daemon cpqkl.exe For Compaq laptops for programming user configurable keys. Not required unless you use them Compaq Print Fax cpqa1000.exe Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm Compaq Service Drivers systeminfos.exe Added by the SDBOT-XC WORM! Compaq Service Drivers compq.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers navapqwa.exe Added by the SDBOT.BBQ WORM! Compaq Service Drivers amsn.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers compqs.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers msnt.exe Added by the SDBOT.CQL WORM! Compaq Service Drivers NtKernelSystem.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers wincmd.exe Added by the RBOT.ATV WORM! Compaq Service Drivers wind32.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers winmsn.exe Added by a variant of the SDBOT WORM! Compaq Service Drivers compaq.exe Added by the SDBOT-AFU WORM! Compaq Service Drivers msnsvc.exe Added by the RBOT.BKT WORM! Compaq Service Drivers ntsys32.exe Added by the RBOT.CIW WORM! Compaq Service Drivers 32 compq32.exe Added by a variant of the SDBOT WORM! Compaq Service Drivrs copq.exe Added by a variant of the RBOT WORM! Compaq Services Drivers ndt32.exe Added by the RBOT.CQZ WORM! Compaq Sound Drivers For WINDOWS sounddr.exe Added by the SDBOT-XG WORM! Compaq Video CD Watcher ?? For Compaq PC's. MPEG viewer Compaq32 Service Drivers ms32.exe Added by the SDBOT.BWH WORM! Compaq32 Service Drivers msconfig32.exe Added by the SDBOT-ADC WORM! Compaq32 Service Drivers msnt32.exe Added by the RBOT.BVF WORM! CompaqHW Comp Manager cpqhcm.exe Running on a Compaq laptop - any ideas? CompaqPrinTray printray.exe Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop Compaqs Service Driver copypad32.exe Added by the SDBOT.CSO WORM! Compaqs Service Drivers compqs.exe Added by a variant of the SDBOT WORM! CompaqSystray cpqpscp.exe Compaq System Tray icon Compatibility Service Process regsvs.exe Added by the GAOBOT.YN WORM! Compd Service Drivrs codq.exe Added by a variant of the SDBOT WORM! ComproRemote ComproRemote.exe VideoMate TV tuner and capture card - remote control driver ComproSchedulerDTV ComproSchedulerDTV.exe VideoMate TV tuner and capture card - scheduler Computing Technologie Firewall lsauth.exe Added by the SDBOT-WX WORM! COMSMDEXE comsmd.exe 3Com tray icon ComTry Web Searcher wstray.exe Comtry MP3 Downloader related - spyware comxt comxt.exe Added by the COMXT TROJAN! con [path to trojan] Added by the BRAVE-A TROJAN! Config service.exe Added by the ISRAZ.B WORM! Config Loadation iEEexplore.exe Added by the SDBOT.H TROJAN! Config Loadatiorin I3Explorer.exe Added by the SDBOT.H TROJAN! Config Loader svchosl.exe Added by the GAOBOT.P WORM! Config Loader sysldr32.exe Added by the GAOBOT WORM! Config Loader scvhost.exe Added by the GAOBOT.AE or GAOBOT.AO WORMS! Config Loader for Microsoft Windows mwincfg32.exe Added by the AGOBOT.BD WORM! Config Loader2 explores.exe Added by the GAOBOT.BT WORM! Config Loadr winsys32.exe Added by the AGOBOT-HN WORM! Config33.exe Config33.exe Added by the SDBOT.T TROJAN! ConfiggLoader cart322.exe Added by the GAOBOT.DJ WORM! ConfigSafe CFGSAFE.EXE ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice ConfigSafe AUTOCHK.EXE ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice ConfigServices Config.exe Part of initial setup on a Compaq PC configsetup configsetup32.exe Added by the AGOBOT-AFP WORM! Configuration [filename] Added by the SDBOT-ML WORM! configuration apphost.exe Added by the SDBOT-VP WORM!

X X X X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N U X X X N U

Configuration Configuration Default Configuration File Configuration Loaded Configuration Loaded Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader configuration loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Configuration Loader Service Configuration Loader Service Configuration Loader10 Configuration Loading Configuration Loading Configuration Loading Service Configuration Manager Configuration Manager Configuration Manager Configuration Service Configuration Services Configuration Utility Configuration Utility Configuration Wizard Configuration32 Loader32 ConfLoader Conmgr ConMgr.exe

ntsys32.exe Wuxat.exe Winset32.exe wupdated.exe lssas.exe aim95.exe cmd32.exe service5.exe lfass.exe sycfg34.exe wincrt32.exe windex.exe dosrun32.exe Service.exe Servicess.exe sw32.exe System.exe Winreg.exe sysinfo.exe microsoft.exe confgldr.exe winicfg32.exe svhst.exe msgfix.exe msnss.exe IEXPL0RE.EXE loadcfg32.exe MSTasks.exe systemry.exe ccSort.exe smss32.exe wincffg.exe seru32.exe botss.exe ldasp.exe msgcfgsrv.exe smsai.exe svupdate.exe crcss.exe lexplore.exe scvhost.exe svchost.exe svchost2.exe dezi.exe mouse.exe msg.exe WinHelper.exe extrac.exe DVD-Player.exe IEXPLORE.EXE svchost.exe syscfg32.exe Winsys32.exe devl32.exe ip7.exe svchos1.exe configldr.exe wscel.exe CNFGLD32.EXE Cnfgldr.exe cfg32.exe suchost.exe mswords.exe CONFIG.EXE wlanutil.exe Cfgwiz32.exe winamp32.exe sysconf16.exe conmgr.exe conmgr.exe

Added by the SDBOT-LN WORM! Added by the SPYBOT-CA WORM! Added by the FLUX.101 TROJAN! Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS! Added by a variant of the SDBOT WORM! Added by the LOADCFG or SDBOT TROJANS! Added by the LOADCFG or SDBOT TROJANS! Added by the GAOBOT.AF WORM! ?? Added by the GAOBOT.AN WORM! Added by the GAOBOT.BF WORM! Added by the GAOBOT.BZ WORM! Added by the GAOBOT.AO WORM! Added by the GAOBOT.AO WORM! Added by the GAOBOT.AO WORM! Added by the AGOBOT.BQ WORM! Added by the GAOBOT.AO WORM! Added by the GAOBOT.AO WORM! Added by the GAOBOT.FQ WORM! Added by the GAOBOT.JB WORM! Added by the POLYBOT WORM! Added by the GAOBOT.GEN!POLY WORM! Added by the GAOBOT.YC WORM! Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS! Added by the GAOBOT.AUS WORM! Added by the LOADCFG or SDBOT TROJANS! Added by the LOADCFG or SDBOT TROJANS! Added by the LOADCFG or SDBOT TROJANS! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the AGOBOT.SR WORM! Added by the AGOBOT.MB WORM! Added by the AGOBOT.A3 WORM! Added by the SDBOT-VR WORM! Added by the SDBOT-XS WORM! Added by the AGOBOT.BH WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the SDBOT-YE WORM! Added by the RANDEX.DXP WORM! Added by the AGOBOT.ADG WORM! Added by the RBOT-AGX WORM! Added by the AGOBOT-AAE and SDBOT.AR WORMS! Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the AGOBOT.JR WORM! Added by the SDBOT-OB WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the SDBOT.BT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the SDBOT-AFP WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fig Added by the PARADROP-AI WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Added by the SDBOT.B TROJAN! Added by the RBOT-YV WORM! Added by the SDBOT-XY WORM! Added by the AGOBOT-ANZ WORM! Added by the GAOBOT.DK WORM! Added by the AGOBOT-EC WORM! Added by the SDBOT-WJ WORM! Added by the SDBOT TROJAN! Added by the SDBOT TROJAN! BookedSpace parasite Added by the TREB TROJAN! Added by the SDBOT-YM WORM! Controls linksys wireless connection. Available from the Desktop NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards) Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) Added by the SDBOT-BIC WORM! Added by the SDBOT-FB TROJAN! Starts Winfax pro at startup Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut

X N X X X X X X X ? X X X X X N X X X N X X N N X N X X X X X X X X X X X X X U U U U U U X X U N X N U U N U U N N N N N N N N X N N X ? N

Connect2Party connect2party.exe Adult content dialler Connection Manager CManager.exe SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Pr Connectivity Tool [path to trojan] Added by the LITEBOT-E TROJAN! Connector SYS.EXE Added by the dialer.Nunci premium dialer Connector sms.EXE Added by the ExDial-B premium rate adult content dialer Cons consol32.exe Hijacker - redirects to a p0rn portal, where foistware like ISTBar gets stealth installed conscorr conscorr.exe VX2.Transponder parasite updater/installer related Console de Gerenciamento Microsoft csrss.exe Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup Console de Gerenciamento Microsoft csrss.exe Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Contacte contacte.exe Some kind of driver? Content connector [random filename].exe Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder ContentDownload rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related ContentService winservn.exe Homepage hijacker ContinueInstall bpsinstall.exe BrowserAid/BrowserPal foistware Control rundll32.exe ctrlpan.dll, Restore ControlPanel CoolWebSearch Msconfd parasite variant Control Center Center.exe Related to an Asus WLAN card Control handler ***********.exe [* = random char] CoolWebSearch parasite variant Control handler ahjinst.exe CoolWebSearch parasite variant Control handler [10 to 14 random char]THD.EXE Added by the KREPPER-AI TROJAN! control panel smctrlw.exe System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card Control Panel System.exe Added by the DANI TROJAN! Controladores [path to trojan] Added by the TELEFO-A TROJAN! ControlCenter2.0 brctrcen.exe Brother scanner 'Control Center' application - can be started manually ControlCentreTray XWCTray.exe System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc Controlled Resource System Service crss.exe Added by the AGOBOT.GH WORM! Controller WFXCTL32.EXE From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Sta ControlPanel rundll32 internat.dll, LoadKeyboardProfile CoolWebSearch parasite variant ControlPanel host32.exe internat.dll, LoadKeyboardProfile Added by a vairant of the DELF.DW TROJAN! ControlPanel [path] cmd32.exe internat.dll, LoadKeyboardProfile Awmcash.biz foistware ControlPanel systemctrl.exe internet.dll, LoadNetworkProfile Browser hijacker, also detected as STARTPA-FX ControlPanel internat.dll, LoadKeyboardProfile Added by the BIZVES-A TROJAN! ControlPanel popcorn.exe internat.dll, LoadKeyboardProfile Added by the BIZVES-B TROJAN! ControlPanel popcorn64.exe Browser hijacker, redirecting to loadcash.biz ControlPanel popcorn64.exe rundll.dll, LoadMouseProfile Added by the DLOADER-OI TROJAN! ControlPanel popcorn72.exe rundll.dll, LoadMouseProfile Added by the DLOADER-RA TROJAN! ControlPanel svcc.exe WorldSearch adware ControlPanel popcorn320.exe rundll.dll, LoadMouseProfile Added by a variant of the DLOADER-RA TROJAN! ControlPanel [path] private.exe internat.dll, LoadMouseCarpetProfile Reported by Norman Virus Control as W32/Downloader. Creates the files sdfff, fdsf and zxczxc. In the C:WINDOWSSYSTEM32 directory creates the files d.exe, s.exe and r.exe ControlServiceMgr csmsv.exe Added by the AGENT-XC TROJAN! Cookie Cop 2 CookieCop.exe Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Cookie Pal CPBRWTCH.EXE Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return CookieJar Cookiejar.exe Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return CookiePatrol CookiePatrol.exe CookiePatrol - PestPatrol's cookie interceptor stopping spyware cookies CookieWall cookie.exe CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Cool Desk cdesk.exe Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of the CoolDownloads rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related CoolMP3 rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related CoolSwitch taskswitch.exe ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen Coolwallpaper cwm_tray.exe Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers coolwebprogram clrssn.exe CoolWebSearch Smartsearch parasite variant Copernic Desktop Search DesktopSearch.exe Copernic Desktop Search - "Easily search your entire hard drive in less than a second to pinpoint the right file, e-mail, music or pictures" CopernicPerUserTaskMgr CopernicPerUserTaskMgr.exe Automatic tasking feature of Copernic Pro multi-search engine tool Copy handler Copy Handler.exe Copy Handler lets you copy between hard disks, floppies, local networks, CDs, and many other storage media. Copy Handler gives you the power to pause, resume, restart, and cancel during the copyin Copyright mwcpyrt.exe Displays copyright information on IBM ThinkPads CoreCenter CoreCenter.exe MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking CoreCenter CORECE~1.EXE MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking Corel Colleagues & Contacts Reminders cffrem.exe Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of Corel Print Office Corel Desktop Application Director dadx.exe The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs Corel Family & Friends reminders CFFREM.EXE Corel Family & Friends - all-in-one calender, address book and list manager. Part of Corel Print House Magic Corel Photo Downloader MediaDetect.exe Related to Corel Photo Album Corel Registration Remind32.exe If you don't want to register Corel products and be reminded about it every 2 weeks disable it Corel Registration Reminder Remind32.exe If you don't want to register Corel products and be reminded about it every 2 weeks disable it Corel Reminder NAVBROWSER.EXE If you don't want to register Corel products and be reminded about it every 2 weeks disable it CorelCENTRAL 10 I_26dadCC.exe CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs CorelDraw Toolbox CorelDraw.exe Added by the SDBOT-VZ WORM! CorelMedia FoldersIndexer8 MFindexer.exe Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office CorelMedia FoldersIndexer8 MFINDE~1.EXE Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office CoreSrv coresrv.exe Some IRC trojans/worms use this - see here for more information CORESYS coresys.exe ?? CorrectConnect CConnect.exe Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available

X U N N ? X ? U U ? U U Y X X X N N X X X X ? Y U N Y N U U U U N U N Y X X X X X U X X X X ? ? X X X U N U X X X X X U X N N N N N N N N X

cosine cosine.exe Added by the RBOT-SW WORM! CostAware niIPCApp.exe NetInternals CostAware - download quota measuring tool Country Select pctptt.exe Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem CountrySelection pctptt.exe Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem Coupon Offers ?? ?? couponica couponica.exe Adware - see here CP CopyProtectionNotifier.exe Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition CP32NOT CP32BTN.EXE For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons CP4HPOT OneTouch.EXE One Touch keyboard driver. Required if you use the additional keys CPA9P2PSERVER CPA9P2PS.exe Found on a Compaq Presario but what is it? CPATR10 CPATR10.EXE Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast CPBrWtch CPBrWtch.exe Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return CPD_EXE CPD.EXE Firewall bundled with McAfee VirusScan 6.* cpl deamon.exe Added by the TACTSLAY.C TROJAN! cpl msgaol.exe Added by the TACTSLAY.C TROJAN! cpl s menu.exe Added by the TACTSLAY.C TROJAN! CplBTQ00 CplBTQ00.EXE Related to EZbutton CPLDBL10 CPLDBL10.exe Related to the EZbutton quick launcher cpntmgc wincomp.exe Added by the WINTRIM_A TROJAN! cpntmgc simcss.exe Added by the MAGICON.A TROJAN! cpntmgc navpmc.exe Added by the SIMCSS TROJAN! cpntmgc winmgts.exe Added by the WINTRIM-B TROJAN! CPortPatch cppatch.exe CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? CPQAcDc CPQAcDc.exe Compaq PowerCon power management software for laptops CPQAlert CPQAlert.exe Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rath CPQBootPerfDB CPQBootPerfDB.EXE See the entry for Compaq Message Server CPQCalib CPQCalib.exe Compaq PowerCon power management software for laptops CPQDFWAG CpqDfwAg.exe For Compaq PC's. Runs Compaq diagnostics on every boot CPQEASYACC cpqeadm.exe For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys cpqeaui cpqeaui.exe For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys cpqek kcpqek.exe For Compaq PC's. Easy Access button support for the keyboard CPQInet Runtime Service CpqInet.exe For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers CPQINKAGENT cpqinkag.exe That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) cpqns cpqnpcss.exe Related to Compaq.Net - not required if you don't use that Cpqset Cpqset.exe Default settings software in Hewlett Packard notebook CPQSTUTFIX stutfix.exe For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton cpr cpr Adroar.com adware downloader CPU Manager cpumgr.exe Added by the PANDEM.B WORM! CPU Temp Control wuitgurd.exe Added by the RBOT-AHV WORM! CPU Watcher rundll32.exe [path] cpu.dll,load Added by the DLOADER-LO TROJAN! CPU Windows Status cpustats.exe Added by a variant of the RBOT WORM! CPUcool Cpucool.exe Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel Cpusave Cpusave.exe Added by the GEMA TROJAN! Cpusave32 Cpusave32.exe Added by the GEMA TROJAN! cpyt hidep.exe Added by the MIRJACK-A TROJAN! cqlyg world_cup_.bat Added by the WCUP.A WORM! CQSCP2P SERVER ?? Compaq printer utility which is required in the startup menu in order to make the printer work correctly. Personally I doubt whether it is actually needed CQSCP2PS ?? Compaq printer utility which is required in the startup menu in order to make the printer work correctly. Personally I doubt whether it is actually needed Cr**.exe [* = random char] Cr**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log Cr**.exe [* = random char] Cr**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log Cr**32.exe [* = random char] Cr**32.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log cracked_windows1 cracked_windows1.exe Cracked Windows popup killer CrazyTalk Serve rundll32.exe CrazyTalk.dll, DIIServeMediaFile CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be inst CRBroadCasting CRBroadCasting.exe CardReader2 from On Track Inovations Ltd. USB Card Reader CRC Value Verifier crsss32.exe Added by a variant of the RBOT WORM! CRC Value Verifier Crsss64.exe Added by the RBOT-NY WORM! CRC Value Verifier svchost32.exe Added by the RBOT-OA WORM! CRC Value Verifier crsss.exe Added by the SPYBOT.UK WORM! Crc32stats Dependencies Crc32stats.exe Added by the MYTOB.GT WORM! Creata Mail JMSrvr.exe Creata_Mail. Smileys, stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express Create A Monster createAMonster.exe Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related CreateCD Createcd.exe Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs CreateCD50 Createcd50.exe Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs Creative AGP Wizard agpwiz.exe Part of Creative's BlasterControl Creative Launcher CTLauncher.exe For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs Creative MediaSource Go CTCMSGo.exe Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats Creative PCI Audio Configuration Utility starter.exe System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer Creative Service for CDROM AccessCtsvccda.exe Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> P Creative WebCam Tray Camtray.exe Creative WebCam tray control - can be started manually Creative.exe Creative.exe Added by the PROLIN WORM!

N U X N X X X X X X X X ? N Y U X X U X X X X X X X X X X X X X X X X U U Y X U X X X X X Y X N U N N X X U X X X X U X X X X X X X X X X U

CreativeDiscNotifier CreativeMixer Critical Update Check CriticalUpdate CriticalUpdate Crnsava cronos CrossMenu crs Crusty cryptdlg Cryptographic Service Crystal 3D Audio Control csaRem CSAV_CheckViruses csc CSCRS Value CSCRS Value Check CSINJECT.EXE csm Win Updates csoftok csrsc CSRSS Csrss csrss csrss csrss csrss CSRSS Loader csrss.exe csrssLevel4 CSRSSU CSRSSW CSRSWIN CSRSX CSS Server cssauth CSScheduleCheck csss CSS_Central CSV10P1 CSV10P70 CSV7P26 CSV7P70 CSV7P91 ct CT Control Settings CTAVTray CTCMonitor CTDVDDet CTDVDDet ctflog manager CTFM0N.exe ctfmon ctfmon ctfmon ctfmon ctfmon CTFMon ctfmon Ctfmon.exe ctfmon.exe ctfmon.exe ctfmon.exe CTFMON32 CTFMONSS ctfnom ctfnom.exe ctfnom.exe CTHELPER

CTNOTIFY.EXE CTMIX32.EXE battlenet.exe Wucrtupd.exe wucrtupd.exe scrnsave.pif MARCO!.SCR CrossMenu crs.exe dmcpl.exe cryptdlg.exe ******.exe [* = random char] CWD3DSND.EXE spqmdmui.exe vchk.exe csc.exe cscrs.exe MsPMSPSd.exe CSINJECT.EXE csm.exe softok.exe csrsc.exe CSRSS.EXE csrss.exe csrss.exe csrss.exe msmsgs.exe nwiz.exe csrsss.exe csrss.exe csrss.exe CSRSSU.exe CSRSSW.EXE [trojan filename] [trojan filename] CSSServer.exe cssauth.exe SCHWIZEX.EXE Csss.exe CSS_1631.EXE CSP001.exe CSv10P070.exe CSV7P26.exe CSV7P070.exe CSV7P91.exe ct.exe CTSVCCD.EXE CTAvTray.exe CTCMonitor.exe CTDVDDet.exe CTDetect.exe ctflog.exe CTFM0N.exe ctfmon.exe taskmgr32*.exe [* = number] cftmon.exe mIRC.dll WinConst.exe ctfmon.exe msnmsgr.exe ctfmon32.exe ctfmon.exe msupdate32.exe ctfmon.exe CTFMON32.EXE CTFMONSS.EXE rundIl32.exe SVOHOST.exe OSRSS.exe CTHELPER.EXE

For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the stand Added by the DELF-LB TROJAN! MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder, and must not be confused with the legitimate Windows process of the same name as described here Added by the SDBOT-ZV WORM! Added by the OPASERV.G WORM! Toshiba CrossMenu Utility - allows the user to create their own menus Added by the AGOBOT-TJ WORM! Added by the RUSTY WORM! Added by an unidentified TROJAN! Added by the KORGO.W or KORGO.X or KORGO.AB WORMS! Crystal 3D Audio sound driver. Is it required? Compaq modem country selection Part of Command AntiVirus Command line compiler for Microsoft C# it gets installed with the .NET SDK Added by the RBOT-AAA WORM! Added by a variant of the SDBOT WORM! Part of Quarterdeck/Norton CleanSweep. For a full description see here. An excerpt - "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry Added by the ZOTOB.B WORM! Added by the QQPASS.G TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup and the executeable resides in a random folder name Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the CHODE-J WORM! Added by the CHODE-J WORM! Added by the AGOBOT.TX WORM! Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in the WinntSystem32 or WindowsSystem32 folder and should not normally figure in Msconfig/St Unidentified malware. Note - this file is placed in a C:WindowsSystemLevel4 folder, and should NOT be confused with the legitimate csrss.exe process which is always located in the WinntSystem32 or W CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN! Added by the CWS-F TROJAN! Added by the WINSHELL.50 TROJAN! Added by the WINSHELL.50.B TROJAN! Added by the ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself Related to IBM ThinkVantage Client Security Solution Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part ta Added by the BALICK TROJAN! CSS Communication Agent (95 Host) from Command Software Systems "CSS Central(tm) provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strate ClearSearch adware ClearSearch adware ClearSearch adware ClearSearch adware ClearSearch adware ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it Added by the RBOT-YS WORM! For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office, it is not requi Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then un Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then un Added by the DONBOMB.A TROJAN! Added by the STARTPAGE.P TROJAN! CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and S Added by the SOWSAT.B WORM! Added by the DELIVE-A TROJAN! Note - this file is found in C:Windows or C:Winnt and is not the valid MS Office file of the same name (see here) Added by the DELBOT-E TROJAN! Added by the ASSASIN-G TROJAN! Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you i Added by the JV TROJAN! CoolWebSearch Ctfmon32 parasite variant Added by the RAIDYS TROJAN! Note - this should not be confused with the valid Office XP file, see here Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, dow CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and S CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN! Added by the CWS-F TROJAN! Added by the LEGMIR-AW TROJAN! Added by the DIGIDOR-A TROJAN! Added by the DLOADER-UQ TROJAN! CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, an

X X X U ? N U N U ? X N X X X Y X X N N U N X Y U U N N N ? ? U U N N U U X U N X X X ? N X Y Y N Y N X X X U N Y N U X U N X X U X N X X X

CTHelper CTime CTin10 CTNMRUN CTPDPSRV CTRegRun CtrlVol CTStartup CTsysVol cttdpsrv CTUpdate CTxfiHlp Ctykd CU1 CU2 cuagentExe cuo Current Security Config cursor CursorXP Customizer2000 CuteMX cvmonitor.exe CVPND CW CWatch cwbckver cwbinhlp cwbsvstr cwbwlwiz Cwcdschk.exe cwcptray cwupdate CXMon Cyber Cyber Trio Cyber-Defender 2003 cyberfree.exe CyberLat Ram Cleaner CyberMedia Agent CyberWolf CyDoor CydoorUpdate CYNHKey CyphTray D SYSTEM D-Link Air USB Utility D-Link Air Utility D-Link AirPlus DWL-650+ Utility D-Link AirPlus G D066UUtility D3**.exe [* = random char] D3**32.exe [* = random char] d3dupdate.exe D4 DACONFIGEXE DadApp Daemon Daemon Daemon DAEMON Tools-1033 Daily Planner Daily Weather Forecast DamedWare Services Dancer Danton* Dap dark dark dark

cthelper.exe [path to trojan] CTin10.exe ctnmrun.exe CTPDPSRV.EXE CTRegRun.exe CtrlVol.exe CTEaxSpl.exe CTSYSVOL.exe cttdpsrv.exe ctupdclt.exe CTXFIHLP.EXE [path to file] VCClient.exe VCMain.exe Cuagent.exe cuo.exe csecure.exe Screendragon_VS_Taskbar.exe CursorXP.exe logon.exe CuteMX.EXE cvmonitor.exe cvpnd.exe cw4.exe cw.exe cwbckver.exe cwbinhlp.exe cwbsvstr.exe cwbwlwiz.exe Cwcdschk.exe cwcptray.exe cwupdate.exe Hpi_Monitor.exe cyberchk.exe showmode.exe uwcdsvr.exe ****.dat [* = random char] CLRamCleaner.exe CMAGENT.EXE CyberWolf.exe CD_Load.exe CD_Load.exe CYNHKey.exe CyphTray.exe dd.exe AirCFG.exe AirCFG.exe WLANMON.exe AirGCFG.exe D066UUTY.EXE D3**.exe [* = random char] D3**32.exe [* = random char] bbeagle.exe D4.exe daconfig.exe dadapp.exe DAEMON32.EXE Daemon.exe daemon.exe c daemon2.exe Daemon.exe dayplan.exe weather.exe dwdrce.exe DncLE.exe [random filename] DAP.exe imgst.scr imgrt.scr csrs.scr

Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here Added by the HTTPDOS TROJAN! Added by the BANCOS.E TROJAN! Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required? For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative Volume control key on Acer, Fujitsu and other laptops Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard Creative sound card volume controls ?? Added by the RBOT-ABG WORM! Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card SMALL.SN spyware Associated with the Surf Sidekick adware and should be removed Associated with the Surf Sidekick adware and should be removed Command Antivirus related Added by the BUGBEAR.A WORM! Added by the RBOT-AMO WORM! ScreenDragon video player CursorXP from Stardock - tool for creating mouse cursors Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make chan File sharing utility Added by the SDBOT.BV WORM! Sub-system used by Cisco VPN client for making a connection to a remote IPSec server Chat Watch "is a monitoring and logging software for online chat and instant messaging programs" ChatWatch - chat monitoring tool Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? IBM Thinkpad related? Related to ContentWatch Parental Control internet filter ContentProtect from ContentWatch - internet filter Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs Part of Belkins "Multimedia Cleaning Kit" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after "x" amount of time has passed From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environme Cyber Defender 2003 Unidentified adware CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disa Added by the KICKIN.A (or CYDOG.C) WORM! Adware. Check here for information about Cy-Door and here for a program that can remove it Adware. Check here for information about Cy-Door and here for a program that can remove it ?? Cypherus - encryption software Added by the MYTOB-FN WORM! D-Link wireless PCI adapter related D-Link wireless PCI adapter related D-Link Air Plus Wireless PC modem connection monitor D-Link Airplus Wireless Router driver TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Added by the BEAGLE.A WORM! Dimension 4 - network time synchronization freeware - starts-up, adjusts the system clock, then shuts down 3Com NIC Diagnostics. Available via Start -> Programs DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required, but should be left in because it can create a hassle and doesn't always restore functionality to those butt Pre-loads game profiles for MS Sidewinder game controllers prior to release 2.0 of the software. Recommend upgrade. Available via Start -> Programs Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive Added by the SELOTIMA.A WORM! Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive Daily Planner - discontinued, and now part of KMCS Deluxe System Suite. Tool to plan your days, and check activities off as you complete them Added by the DLOADER-IP TROJAN! Added by the RBOT-AOJ WORM! Part of Microsoft Plus! Digital Media Edition - see here Added by the DANTON TROJAN! where * = random number Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based Added by the BANCOS.U TROJAN! Added by the BANCBAN-FH TROJAN! Added by the BANCBAN-GT or BANCBAN-GU TROJANS!

X X ? X X X N N X X X N U X N X X ? X X ? U U N X U U X N N N X U X ? X N X X X X X X X X U X X X X X X X X X U U U ? X U N N N N ? N U N ?

DarkDevil.Grasiele.BR Grasiele.VBS Added by the LEMBRA WORM! DarKNesS LsasS LsasS23.exe Added by an unidentified WORM or TROJAN! DashIE N/A Could be related to "Dash Power Shopping" tool bar in IE? dasxdads fsdqd.exe Added by the GAOBOT.BIQ WORM! Data System.dat.vbs Added by the BISCUIT.A WORM! data msngs.exe Added by the RBOT-ADQ WORM! Data LifeGuard BACKWE~1.EXE Data LifeGuard diagnostic tools for Western Digital's series of hard drives Data LifeGuard LifeLine Lite installer DLGLI.EXE Backweb installer - see here Data Restore Service prq8.exe Added by the KELVIR.AI WORM! Data789 Regedit.exe ....data789.tmp Homepage hijacker DATABASE MySql [path] repcale.exe [path] beird.exeAdded by a variant of the RANDON.AN WORM! DataCaching FlashKsk.exe SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon DataLayer DataLayer.exe Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." Synchronize the phone with, for example Outlook. You can also use it to browse your phone DataViz Inc Messenger DvzIncMsgr.exe Installed with DataViz "Documents to Go" software DataViz Messenger DvzMsgr.exe DataViz Documents to Go - "allows you to use your Word, Excel and PowerPoint files on your handheld anywhere, anytime. In addition, it now synchronizes e-mail with attachments, PDF files, pictures a Datcheck datcheck.exe Added by the KEYPANIC TROJAN! Date Manager datemanager.exe Date Manager - calender program. Spyware/adware based provided by The Gator Corporation Datechecker N/A Could be related to this? DateMakerIntl DateMakerIntl.exe Premium rate adult content dialler DAupdate DAupdate.exe NavEnhance adware DAW9532.exe DAW9532.EXE Loaded during installation of some 3Com network cards. Enables their DynamicAccess desktop management software. Is it required? DayToday DAYTODAY.EXE DayToday from RoboMagic Software Corp. Displays the date on the taskbar DAZEL Delivery Agent DcDaemon.exe Control and send documents, etc, to any destination - see here dbserv dbserv.exe Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled DCE Manager dcemgr.exe Added by the TUMAG TROJAN! DCfssvc dcfssvc.exe Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup, your camera will not cause your computer to open a pop-up window when y dcfssve dcfssvc.exe Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup, your camera will not cause your computer to open a pop-up window when y Dcom System Patch Microsoft.exe Added by the RANDEX.MS WORM! DDCActiveMenu DDCActiveMenu.exe Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information DDCM DDCMan.exe Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information DDCMan DDCMan.exe Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information ddeproc ddeproc.exe Associated with Webcelerator - spyware. Read eAcceleration's privacy statement here ddhelper W815DM.EXE Enuff Parental Control Software by Akrontech DDialler DDialler.exe Adult content dialler DDT N/A ?? de32gen de32gen.exe Added by a variant of the CRYPTER.C TROJAN! DeadAIM rundll32.exe DeadAIM.ocm, ExportedCheckODLs DeadAIM - feature enhancing product for AOL's Instant Messenger program DealHelperBrwsr dhbrwsr.exe DealHelper adware DealHelperDown download.exe DealHelper adware DealHelperUpdate DHUpdt.exe DealHelper adware Debug DebugW32.exe Added by the GUBED TROJAN! Debugger dbg32.exe Added by the MYTOB-FW WORM! Debugger explorer32dbg.exe Added by the CWS-M TROJAN! Debugger iexplore_dbg.exe Added by the CWS-M TROJAN! DebugMonitor debugmonitor.exe Added by the MYDOOM.BG WORM! DeeEnEs DeeEnEs.exe DeeEnEs - automatically updates a dynamic IP address when it changes deejay forboo.exe Added by the FORBOT-AY WORM! Default explore.vbs Added by the ALLEM WORM! Default mtask.vbe Added by the ALLEM WORM! default shell32.exe Added by the BINGHE TROJAN! Default System Research vhchost.exe Added by the TARNO.I TROJAN! Default web browser IexpIore.exe Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer), the first has a captial "i" in place of lower case "L" Default_Page_URL http://find.naupoint.com Naupoint browser hijacker Default_Search_URL http://find.naupoint.com Naupoint browser hijacker defragm_check defragment.exe CoolWebSearch parasite variant defwatch defwatch.exe Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis Delay delayrun.exe On HP PCs this program is used to help prevent conflicts or timing issues on fast computers Delayrun delayrun.exe On HP PCs this program is used to help prevent conflicts or timing issues on fast computers delcab deltreew.exe C:cabs ?? Delete Me worm.exe Added by the DOOMHUNTER WORM! DeleteHistoryFree dhf.exe Delete History Free - "Privacy protection software for deleting Internet surfing and other computer activity tracks from your PC" Dell AIO Printer A*** dlbabmgr.exe Dell AIO Printer A*** related (*** = model). Not Required at Startup Dell AIO Printer A*** dlbfbmgr.exe Dell AIO Printer A*** related (*** = model). Not Required at Startup Dell AIO Printer A*** dlbkbmgr.exe Dell AIO Printer A*** related (*** = model). Not Required at Startup Dell Alert DAMon.exe Dell Alert utility, that's supposed to make interaction with Support easier Dell Photo AIO Printer 962 dlbxmon.exe DellPhoto AIO Printer 962 Device Monitor - is it required? Dell QuickSet quickset.exe Dell taskbar icon allowing you to quickly change settings Dell Wireless Manager UI WLTRAY Installed alongside Dell Wireless WLAN Card and provides additional configuration options for these devices Dell Wireless Manager UI wltray.exe System tray access to wireless LAN card configuration options DellDMI delldmi.exe Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the c

U N U U X X ? X ? N ? X U ? X ? X N N X U X X N N X ? N N N N X U N X U ? N U X U N U X X U X U U ? ? ? X N X Y ? N X X X U U U X N N X ? X

DELLMMKB DellSC DellTouch DellTouch delmsbb delsaap delstart delsubmit DelTmp DeltTray demon Deneca DepFrez Description of Shortcuts Desire desk-top-service DeskAd Service DeskColor Deskflag DeskMateAutoUpdate Desksite CMA Desktop desktop Desktop Architect Desktop Plant Desktop Search Desktop Service Centre Desktop Weather Desktop Weather 3 Desktop Weather 3 desktopmgr DesktopUpdate DesktopX deskup destroyb11 detect detect Detector DEventAgent Device Configuration Loader Device Detector Device Detector 2 DeviceDiscovery DevicePath DevicePath Devices Devicewin devldr16 devldr16.exe Devlog Devlog DGJM dgtstart dguard DHCP Server dhcpagnt DHNUXB diagent Dial22 Dial33 Dialer Dialer Control Dialer Detect Dialgo SDK DialNet Dialog Box Assistant Dialog Helper DialUp Network Application Diamondview DIECOX

DELLMMKB.EXE Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys dellsc.exe Dell Solution Center - web-based troubleshooting tools and educational offerings MMKeybd.exe Dell multimedia keyboard manager. Required if you use the additional keys DELLMMKB.EXE Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys delmsbb.exe NCase adware delsaap.exe NCase adware delstart.exe Reportedly part of BT ISP software - what does it do and is it required in startup? rundll32.exe advpack.dll, DelNodeRunDLL32 CoolWebSearch submit.exe parasite variant DelTemp.exe Added to the startup list after installing a Creative SoundBlaster Audigy soundcard. Deletes temporary files once an installation is complete? deltray.exe System Tray access to the control panel for the M-Audio Delta 44 PCI Analog Recording Interface. Available via a desktop shortcut, Start -> Programs or Start -> Settings -> Control Panel demon.exe Part of the French Wanadoo ADSL extense pack. What does it do and is it required? Virus salvado Added by the DELUZ VIRUS! frzstate.exe Deep Freeze from Hyper Technologies. "Freezes" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely t *.exe * seems to be a sequence of alphanumerics that can be different, i.e., 1960F8A9, 4EBD23F5, etc. Each of these files would appear to be a shortcut, i.e., 4EBD23F5 is actually Works Calender Reminder ( desires.exe Adult content dialler desk-top-service.exe ?? DeskAdServ.exe DeskAd.Service adware DESKCOLOR.EXE Provides transparent icon text backgrounds and coloured icon text Deskflag.exe DeskFlag - animated USA flag on the desktop DeskMateAutoUpdate.exe DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related cma.exe DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" rundll32.exe msconfd.dll, Restore ControlPanel Added by the BOOKMARKER TROJAN! desktop.exe Added by the SDBOT.MD WORM! DATRAY.EXE Desktop theme manager available here - for managing the desktop appearance, fonts, sounds, etc AZARE10S.PLT Vritual plant from here - this version is an Azalea, there are others so the filename may be different desktop.exe iSearch "Desktop Search" hijacker DSC.exe OptusNet DSL or Dial-Up connection software - is it required? THE WEATHER CHANNEL.exe Desktop Weather by The Weather Channel - provides current temperature, conditions, alerts, etc THE WEATHER CHANNEL.exe Desktop Weather 3 by The Weather Channel - provides current temperature, conditions, alerts, etc THEWEA~1.EXE Desktop Weather 3 by The Weather Channel - provides current temperature, conditions, alerts, etc desktopmgr.exe Synchronisation manager for the cradles for the Research In Motion range of wireless handhelds, including the "Blackberry" rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related DESKTOPX.EXE A program that replaces the regular Desktop and Taskbar, and can be changed to the user's liking deskup.exe Adds Iomega Zip drive icons to the desktop destroyb11.exe Added by the DELF-KO TROJAN! idetect.exe iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled turbodetect.exe ?? detector.exe USB port detector for LG scanners. Sits in the System Tray, and when it detects the scanner through the USB port, you can run the scanner software from the tray. It is not required at all, since you can eventagt.exe DEvent Agent Module client - part of Dell OpenManage and used for server management. Only required if you use this msdvc32.exe Added by a variant of the AGOBOT/GAOBOT WORM! DevDetect.exe Watches for external digital imaging products being connected from ACD Systems DevDtct2.exe Installed by various Olympus products, this program detects the active connection of a speech device (voice recorder, etc) to a USB port then runs specific client software used to access that device. Th hpotdd01.exe Detection of new imaging, printing and other peripherals on HP machines such as USB printers, cameras and Bluetooth products. "This program is a non-essential process, but should not be terminated Proyecto1.exe Added by the GRUEL WORM! Root.exe Added by the GRUEL WORM! olesvr.exe Salfeld Child Control 2003 - parental control software [path to trojan] Added by the BANKER-AEV TROJAN! devldr16.exe Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To d devldr16.exe Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To di ?? ?? devlog.exe Apparently mainboard/chipset related, by a French company called AS Media - what exactly is it, and is it required DGJM.exe ?? dgtstart.exe DigitalNames.g adware dguard.exe eAcceleration Stop-Sign related - not recommended, see note regsvr.exe Added by the RBOT-PR WORM! dhcpagnt.exe Intel DSL modem driver - leave enabled or you'll have to re-install the drivers DHNUXB.exe ?? diagent.exe System Tray access for Creative Diagnostics for the Creative SoundBlaster series soundcards. Available via Start -> Programs dlm.exe Adult content dialler dlm.exe Adult content dialler rundll32.exe msa32chk.dll Unidentfied malware dc.exe Dialer-Control. Detects and protects from premium rate p0rn diallers dd.exe DialerDetect detects stealth installed premium rate diallers, and sounds the alarm when such a connection is being installed without you knowing it PhoneAnswer.exe Dialgo Wave Modem ActiveX - "Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID, Wave Playback, Wave Recording, mxt32.exe Adult content dialler OSDEx.exe Dialog Box Assistant from Duality Software. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders PDDLGHLP.EXE Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs Rnaap.exe Added by a variant of the SDBOT WORM! Diamondview.exe Manulife Financial Insurance program. Is it required at startup? csrss.exe Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!

X U U X N N U N N N X N N U N U U X X X X U X X X N X U X X X X X X X X X X X X X X X U ? N ? ? N X X X X X N X ? N X X X X U U X N N U N X

Diesel DietK DigiCell DigiD DigiGuide DigiGuide DigiSrv Digital Dashboard Digital Line Detect Digital River eBot DigitalNames DigitalWizard DigitalWizard Monitor DIGServices DIGStream Dimension Dimension4 Dino3 Dinst Dir1 Direct settings Direct Update Direct X Direct3D Direct X Opengl direct3d.exe DirectCD directs.exe DIRECTVDSL DirectX directx directx DirectX directx directx DirectX 32 DirectX For Microsoft Windows DirectX for Microsoft Windows DirectX for Microsoft Windows DirectX For Microsoft(r) Windows DirectX shell driver DirectX Video Driver DirectX64 DirectX9 Diag Dirkey Disable EHCI Disc Detector disc detector discoveg DiscoverDeskshop Disk Keeper Disk Keeper Disk Manager Disk Master DiskCheck DiskeeperSystray diskinf DISKMON.EXE Disknag Diskstart Diskstart Diskstart Diskstart Disk_Monitor display Display Drivers Display Settings DisplayTrayIcon Disspy Distiller Assistant 3.01 Distributed File System

Recalculate.exe DietK.exe DigiCell.exe DigitalSound.exe CLIENT.EXE client01.exe DigiSrv.exe devgulp.exe DLG.exe downlo~1.exe DigitalNamesStart.exe ISWizard.exe dwMon.exe DIGServices digstream.exe Dimension.exe d4.exe dino3.exe dinst.exe caKe sdchost.exe DUControl.exe dxd3d.exe dxopengl.exe direct3d.exe DirectCD.exe directs.exe Directvdsl.exe ddhelp32.exe Directx.exe Sqlexploit.exe DirectX.exe NTCmd.exe PipeCmd.exe directx32.exe dtxservice.exe Fservice.exe Sservice.exe fservice.exe [path to trojan] dxterm5.exe DirectXset.exe dx9diag.exe Dirkey.exe nousb20.exe CtNotify.exe qnetquestnotifty.exe discoveg.exe Deskshop.exe [path to trojan] SECURITY.EXE diskver.exe [trojan name] msdarkend.exe DkIcon.exe diskinf.exe DISKMON.EXE disknag.exe Code.exe cat.exe hit.exe Snt.exe Disk_Monitor.exe The_Eye.exe cssrs.exe hptasks.exe TrayIcon.exe disspy.exe DISTASST.EXE Dfsvc.exe

Added by the LAZAR TROJAN! DietK - add-on for Kazaa Media Desktop; "removes all adware and popups, built in Download Accelerator, makes searches faster and helps produce more results" MSI DigiCell - "the most useful and powerful utility that MSI has spent much research and efforts to develop, helps users to monitor and configure all the integrated peripherals of the system, such as au Adware downloader TV guide and reminder TV guide and reminder Related to camera software from DigitalDreams For Compaq PC's. Loads Digital Dashboard options Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom mode Digital River Systems EBOT for downloading software from their site. In some cases, if you purchase software online for a download from a software manufacturer, you will be sent to this online compan DigitalNames spyware variant InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content Created by Disney but licensed to ESPN for watching videos DIGStream Cache Manager - part of ESPN Motion and Disney Motion that periodically check for new videos and indication they're available in the System Tray. Starting ESPN Motion/Disney Motion starts Dimension - a program which lets you customize MSN messenger such as adding animated and coloured nicknames, personal toast creator, war tools (login flooder), and allows viewing and interacting Dimension 4 - network time synchronization freeware - starts-up, adjusts the system clock, then shuts down Related to Jurassic Park III and enables a dinosaur to walk across the screen. Also generates adverts and classified as adware as a result IMIServer/IEPlugin adware Added by the CAKE WORM! Added by the DAEMONI-I TROJAN! DirectUpdate dynamic DNS updater Added by a variant of the SDBOT WORM! Added by a variant of the RBOT-CJ WORM! Added by the CERTIF-F TROJAN! DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the progra Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS! Starts DirectTV DSL modem at boot up. Can also be started manually Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe Added by the SDBOT.D TROJAN! Added by the SDBOT.D TROJAN! Added by the BLAXE or LOGPOLE WORMS! Added by the SDBOT.D TROJAN! Added by the SDBOT.D TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the PROGENT TROJAN! Added by the PRORAT TROJAN! Added by the PRORAT TROJAN! Added by the PRORAT-P TROJAN! Added by the MARKTMAN-B TROJAN! Added by the WILAB-A TROJAN! Added by the BROWNEY.A WORM! Added by the RBOT-ALT WORM! Dirkey - small utility that allows you to bookmark up to 9 folders by using the Ctrl+Alt+1..9 shortcut keys in an Open/Save File dialog or in Windows Explorer. After this the Ctrl+1..9 shortcut keys can be ?? For Creative sound cards. Detects when you insert a CD, DVD, etc ?? ?? Discover Deskshop - single use "virtual" credit card Added by the SMALL-VE TROJAN! Daosearch adware Added by the RBOT.AQT WORM! Added by the DISTER TROJAN! - a spam relayer Added by an unidentified WORM or TROJAN! DisKeeper defragmentation software - can be started manually Added by the CRYPTER.A TROJAN! ?? Dell program that reminds you to make your backup diskettes Adult content dialler MS-Connect dialler Adult content dialler Adult content dialler Multi-media, Smartmedia, Compact Flash card reader for reading digital camera cards. Device is recognised as internal USB disk drive. Necessary if camera cards are to be recognised as soon as they a Added by the ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself Added by the AGOBOT.FX WORM! Allows for the adjustment of the display for LCD screen, CRT Monitor and TV output on HP computers System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution, etc regularily use Control Panel -> Display Disspy spyware detection and removal software From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs Added by the MYFIP.A or MYFIP.K WORMS!

X X U U Y X N ? X X X X X X N X Y X X X ? Y U N ? X X ? N N N X X U X X X X X X X X X X X X X X X X N X ? X X X X X X X N N N X X U X X X X

Distributed File System kernel32dll.exe Distributed File System blade.exe Distributed File System win.exe distributed.net client DNETC.EXE Dit dit.exe Dit dit.exe DiTask.exe DiTask.exe Divamon.exe Divamon.exe divx divxenc.exe Divx codll.exe DivX MediaPlayer 7.0 Dr.DivX.exe DivX Player DivXPlayer.exe DivX Updater DivX.Exe Divx4 codec devldr32.exe DJREGFIX regedit /s c:hpdjregfix.reg dKernel dKernel.exe DkService DkService.exe DKTime dktime.exe Dkware lptt01 dkware.exe Dkware ml097e dkware.exe dkzzixm dkzzixm.exe dla tfswctrl.exe DLA DLACTRLW.EXE DlaTray Dlatray.exe dlbcserv dlbcserv.exe dlder dlder.exe DlDir1 caKe DLForcerExe DLForcerEXE.exe DLF_00000B00 Vcdlf.exe DLG DLGCHBW.exe DLHelperEXE WATCH.exe DLHelperEXE.exe N/A dlhost dlhost.exe DLink System Tray dlnetst.exe Dlite dllmanager.exe Dll Boot Loader on Startup (do not remove [variousthis) filenames] DLL Manager dllmngr32.exe DLL Service Manager [path to worm] DLL32 dllmem32.exe DLL32 dllhost.dll DllCacherv2 dllcachev2.exe dlldmt dlldmt.exe DllExecutable [path to file] dllhelp dllhelp.exe dllhelp dllhlp.exe dllhostxp.exe dllhostxp.exe DllLoader lssas.exe Dlload killer.exe dllreg dllreg.exe DLLService32 dllsvc32.exe dlmMgr AdobeDownloadManager.exe dlsp2mx dlsp2mx.exe DLT dlt.exe dluca dluca.exe dluca dluca.exe dluxde dluxde.exe Dluxjp cnfrm.exe DM mgr dm_mgr.exe dm***.exe [* = random char] dm***.exe [* = random char] DMC dmc.exe DMILDR dmildr.exe DMISL DMISL.EXE DMISLAPP DMISLAPP.exe Dmsvc32 Dmsvc32.exe dmtdll dmtdll.exe DMXLauncher DMXLauncher.exe dm[3 random letters].exe dm[3 random letters].exe DM_server dmserver.exe dm_service [path to file] dnam d140113.a.Stub.EXE

Added by the MYFIP-C or MYFIP.K WORMS! Added by the MYFIP.AC WORM! Added by the MYFIP.AB WORM! Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed Drive Icon and Label Utility - assigns drive icons and names to flash memory cards. Required, otherwise the drives aren't found Added by the LAZAR-A TROJAN! Note - this is located in the System (9x/Me) or System32 (NT/2K/XP) folder Associated with an Eicon Networks ISDN or ADSL modem. System Tray icon which shows you the status of your lines (free, occupied with incoming or outgoing call). Available via Start -> Programs Associated with an Eicon Networks Diva ISDN or ADSL modem - what does it do and is it required? Added to the SPBOT.B TROJAN! Added by the GRAVEBOT-A TROJAN! Added by the ALADINZ.G TROJAN! Added by a variant of the RBOT WORM! Added by the NALDEM TROJAN or MASTAK VIRUS! Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file DJRegFix showed up first in WinME as a "clever" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This "utility" adds the fun Added by the DECOY-A WORM! From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled, otherwise you could have problems starting it manu Added by the LUNII TROJAN! RapidBlaster variant (in a "DonkeySoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "DonkeySoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here ?? Drive letter access to a UDF packet writer for CD-RW - from HP, Veritas an others. Similar to Roxio's DirectCD and does the same thing. From HP - "This is a needed file as it controles the readability of th Sonic CD/DVD burning applications System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - "This is a needed file as it controles the readability of the Combo dr Related to a Dell Photo Printer - what does it do and is it required? Advertising spyware. Considered to be one oft the worst - even creating a fake "explorer.exe" file. Can be installed via versions of "Grokster", "Lime Wire" and "KaZaA" amongst other file-sharing utilitie Added by the CAKE WORM! ?? Known to cause problems with "Out of memory" errors (see here). Otherwise, it's purpose is unknown Backweb part of Data LifeGuard - diagnostic tools for Western Digital's series of hard drives. Automatically detects an internet connection and downloads any available updates Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished Downloader for Microgaming/Casino software - stealth installed Added by the EXPHOOK-A TROJAN! Related to D-Link DGE-530T PCI card for servers and workstations Added by the WOOTBOT.DN WORM! Added by an unidentified TROJAN! Added by a variant of the RBOT WORM! Added by the RPCBOT.F TROJAN! Added by the KWBOT.E WORM! Added by the SUCLOVE.A WORM! Added by the LATEDA TROJAN! Added by a variant of the CRYPTER.C TROJAN! Added by the VB-SP WORM! Added by the STARTPAGE.DQ hijacker Added by the Downloader-HI TROJAN! Browser hijacker and adware downloader Added by the JE WORM! Added by the KILLAV-FK TROJAN! Added by the CRYPTER.A TROJAN! Added by the AGOBOT.VX WORM! Adobe Download Manager - "can prevent you from having to start from the beginning should your download process be interrupted, and it offers a level of service not possible Added by the MPB-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "dlsp2mx" ?? Adult content dialler - see here Added by the DLUCA.C TROJAN! All-In-One-Telcom (adult content dialler) variant Added by the DLUCA.D TROJAN! Added by the JITTAR TROJAN! Wareout - malware masquerading as a spyware and dialer remover Added by Trojan-Downloader.Win32.Dluca.bv TROJAN! Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client com DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here Added by the AGOBOT.ABU WORM! Added by a variant of the CRYPTER.C TROJAN! Part of Dell's Media Experience, a multimedia suite which offers the user functionality to organise and play music and digital video files Added by the RUINDEM TROJAN! Comet Cursor adware Added by the MITGLIEDER.P TROJAN! Added by the STUB_A TROJAN!

X Y Y X X X X X X X X ? X X ? X N X X ? X X U U U X X ? U N X X U N X N N X X X X N Y N X Y Y U X X U X N N ? N X X X ? N ? N X X X X X X X

Dnar DNE Binding Watchdog DNE DUN Watchdog DNS DNS DNS DNS DNS DNS Dns Resolver DNS Service DNS2GoClient DNSCacheBoost dnscleaner DNXVC DocTor DocuMagix Init Doggy Style DOGStart Doing doit.exe Domain Name Resolve Service Don't Panic Don't Panic Pop-Up Stopper Dopus dos Dos Prompt Loader Dosbat DoubleDesktop DoUWantIt down down Down2Home Download Accelerator Plus 5.0 Download Plus Download Wonder DownloadAccelerator DownloadLegalMusic DownloadWare DownloadWare Engine Downxz DPAgnt Dpcnav DPConfig dpcproxy DPCProxyLoadOnStartup Dpcstart Dpcstart dpi dpnsvr32 dpps2 dps dptracker Drag'n'Drop_Autolaunch DragDrop DragnDrop_Autolaunch DrCache DrefIW DrefIW dregfix DrgToDsc dried.exe DriveLED Driver Driver32 DriverCheck DriverDB DriverLoad DriverModule DriverPath

Dnar.exe Unknown, except that it is not necessary. Tends to phone home a lot. DMI related - see here rundll dnes.dll, DnDneCheckBindings Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat C rundll dnes.dll, DnDneCheckDUN13Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat C mc-58-12-0000080.exe Shorty adware - also detected as the AGENT.FD TROJAN! mc-58-12-0000093.exe Shorty adware - also detected as the AGENT.FD TROJAN! mc-110-12-0000079.exe Shorty adware - also detected as the AGENT.FD TROJAN! mc-58-12-0000120.exe Shorty adware - also detected as the AGENT.FD TROJAN! mc-58-12-0000140.exe Shorty adware - also detected as the AGENT.FD TROJAN! [worm filename] Added by the CQG WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ dnsrslve.exe Added by the RBOT-WS WORM! dnsresolver.exe Added by the RBOT-PQ WORM! dns2goclient.exe DNS2Go is a Domain Name System that will make your computer accessible anytime, anywhere by associating a domain name of your choice to your currently assigned IP address. Is it required? dnsping.exe Added by the DNSBUST-A TROJAN! dnscleaner.exe CoolWebSearch parasite variant dnxvc.exe ?? Doctor.exe Added by the DOTOR.A WORM! PWATCH.EXE PaperMaster is an application for the PC designed to automate the process of organizing, archiving, and retrieving digital versions of files. Start manually if needed MsPMSPSd.exe Added by the SDBOT-AAP WORM! GSDOGST.EXE Added by an unidentified VIRUS, WORM or TROJAN! A possibility is a trojan known as PENIS doing.exe ?? doit.exe Added by the FORBOT-EK WORM! dnsresolver.exe Added by the KIMAN.A WORM! dontpanicdemodp.exe 30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite." dpps2.exe Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause pro dopus.exe Directory Opus - a file manager from GPSoft dos64.exe Adware downloader trojan cygwin.exe Added by the SDBOT-VV WORM! ?? ?? dd.exe DoubleDesktop is a smart and elegant system tray utility that effectively doubles the width of your Windows desktop duwi.exe DoUWantIt - online shopping assistant. Start it manually hlp32.exe Added by the DLOADER.BG TROJAN! [trojan filename] Added by the Small-QJ TROJAN! Down2Home.exe Down2Home - "monitors your ADSL/Cablemodem/Dialup traffic and provides you with usefull statistics about the amount of data your PC has transferred" DAP.exe Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based DownloadPlus.exe DownloadPlus adware DownloadWonder.exe Download Wonder from Forty Software. Download manager for resuming downloads, amongst other features DAP.EXE Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related dw.exe DownloadWare adware Dwe.exe DownloadWare adware Downxz.bat Added by the MYDOOM.W WORM DPAgnt.exe digitalPersona fingerprint scanner dpcnav.exe DirecWay from DirectTV satellite based high-speed internet access DPConfig.exe Compuware DevPartner Studio Configuration Utility, a tool for software developers - System Tray access to configure the utility's analysis. Not required at startup, can be launched from the Start Menu p dpcproxy.exe Added by the GOLDENP-A TROJAN! dpcstart.exe DirecWay from DirectTV satellite based high-speed internet access dpcstart.exe DirecWay from DirectTV satellite based high-speed internet access. Proxy software dpcstart.exe Startup program for Direcway 2-way satellite internet service. Loads DirecWay's Navigator, tray icon, etc dpi.exe Delfin Media Viewer or "Promulgate" adware dpnsvr32.exe Added by the AOLPASS-B TROJAN! dpps2.exe Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause pro dps.exe SmartestSearch parasite - poses as a foistware, bogus adware/spyware remover called "scumware-remover" dptracker.exe CamTrack webcam software that enhances the way people video chat Autolaunch.exe Iomega HotBurn - CD-RW burning software DragDrop.exe ?? Autolaunch.exe Iomega HotBurn - CD-RW burning software MSTDC.EXE Added by the JM TROJAN! SysDrefIWv2.exe Added by the DREF-C WORM! SysDref.exe Added by the DREF-D WORM! ph_finder.exe ?? DrgToDsc.exe Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". No dried.exe ?? OODLed.exe O&O DriveLED - displays your HDD LED on your monitor. Start manually gbot.exe Added by the JUNTADOR.K TROJAN! Scam32.exe Added by the SIRCAM WORM! svchost.exe Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco svcmdx32.exe Added by the BERPI TROJAN! svchost.exe Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco csrnvrt.exe Added by the IRCBOT.I TROJAN! system32.exe Added by the PRORAT-S TROJAN!

N U U X X X X X ? U X X X X X X X X Y X X U X X X N X X X N Y Y U X X X X X X X X ? N X X N N X X N X U ? X N N N N N Y Y Y Y X X U X X N U

DriveSelect drkly16j dRMON SmartAgent drmu drocher DropSpam Lifestyle drvddll.exe Drvddll_exe DrvListnr drvlsnr drvnetw drvr32h drvrmanager drvsys.exe drvupd DrWatson DrWatson DrWeb Antivirus Drwebscheduler DR_S ds DS Clock dsa DSAcass DSB DSentry Dsi Dsi Dskcompat DSL Monitor DSLagentexe dslmon DSLSTATEXE DsmSer DsmSer DsmSer DsmSer DsplObjects DSS DSS DSService DSSSGENS DU Meter duck Dumeter Services dumprep 0 -k dumprep 0 -u DUN_SERVICES3 Duweculey dvd43 dvd98 DVDBitSet DVDCheck Dvdcompat DVDLauncher DVDSentry DVDTray DVDUpgrade DVDXGhost Dvp95 dvpapi9x DvpInitExe dvprpt dvraudio dvsfss DVSync Dvx dw DW4 DWHeartbeatMonitor

driveselect.exe DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs rundll32.exe drkly16j.dll, ServiceCheck KidsWatch Time Control parental control software SmartAgt.exe Part of the network monitoring program group for 3Com NIC cards. See here for more info W95Mm.exe Homepage hijacker installing a toolbar: http://tdko.com/. Lop.com in disguise. See this thread d.exe Adult content dialler dslifestyle.exe Added by the Dropspam ADWARE! drvddll.exe Added by the BEAGLE.AP WORM! drvddll.exe Added by the BEAGLE.X WORM! DrvListnr.exe Analog Devices SoundMAX soundcard related. What does it do and is it required? drvlsnr.exe Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly drvnetw.exe Added by the BROGGER-B TROJAN! drvr32h.exe Added by an unidentified VIRUS, WORM or TROJAN! drvrquery32.exe Added by the BOOHOO WORM! drvsys.exe Added by the BEAGLE.W WORM! rundll32 ..drvupd.inf Hijacker - drvupd.inf file installs a "searchforge.com" hijack drwatson_.exe Added by the LOHAV-S TROJAN! drwatson_32.exe Added by the LOHAV-S TROJAN! DRWEBAV.EXE Added by an unidentified WORM or TROJAN! Drwebscd.exe Dr. Web antivirus related - scheduler that allows you to manage an automatic launch of applications, in particular the antivirus scanner or the update subsystem DR_S.exe AdShooter adware ds.exe Added by the SPYMON TROJAN! dsclock.exe Digital desktop clock including synchronization with atomic servers - see here dsa.exe Homepage hijacker - redirecting to downseek.com [path to file] Added by the RANKY.M TROJAN! DSB.exe EnergyPlugin adware DSentry.exe Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement a dp-******.exe Added by an unidentified adware where ****** are random characters dp-him.exe Added by the MULTIDR-AH TROJAN! Dskcompat.exe Added by the GEMA TROJAN! spdstrm.exe Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray DSLagent.exe Used in conjunction with USB connected ADSL modems from Eicon Networks (as used by BT for its Broadband internet service for example). Required for a permanent ADSL connection dslmon.exe Sagem DSL modem related. Apparently needed to detect the modem dslstat.exe System tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example) dsm.exe Added by the SERFLOG.B WORM! msmpatch.exe Added by the SERFLOG.B WORM! svosm.exe Added by the SERFLOG.B WORM! sysup.exe Added by the SERFLOG.B WORM! windspl.exe Added by the BEAGLE.DN WORM! dssagent.exe DSSAgent by Brøderbund - spyware. Sends encrypted emails about the system back to the originators of the program. Also a resource hog. See here for more info [path to trojan] Added by the DSSDOOR-C TROJAN! dmrss.exe Added by the AGOBOT-XX WORM! dssagens.exe ?? DUMETER.EXE Hagel Technologies internet bandwidth monitor duck.exe Added by the AGOBOT-AVG WORM! dumeter.exe Added by the SDBOT-AEQ WORM! dumprep 0 -k Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recover dumprep 0 -u Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recover dun3.exe Added by the SOKIRON TROJAN! yujixit.exe Added by the SDBOT.BRP WORM! DVD43_Tray.exe DVD43 is "a small tool that integrates into Windows and overrides CSS copy-protection found on DVD movies" windvd98.exe Added by the CULT.P WORM! DVDBitSet.exe DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used DVDCheck.exe Related to an Intervideo program. What does it do and is it required in startup? Dvdcompat.exe Added by the GEMA TROJAN! DVDLauncher.exe Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion DSentry.exe Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement a DVDTray.exe HP CD/DVD Tray icon installed with the DVD writer software. Periodically checks for new drive firmware DVDUpgrd.exe Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs DVDGhost.EXE DVD Ghost - "utility to make your software DVD players and DVD copy/backup softwares restriction-free, and copy/backup DVD to hard disk" Dvp95.exe Scan engine for F-Secure and Command antivirus software based on the F-Prot AntiVirus engine DVPAPI9X.exe Command AntiVirus for Windows 95/98/Me Dvpinit.exe Command Antivirus related Dvprpt.exe Command Antivirus real time protection dvraudio.exe Added by a variant of the CRYPTER.C TROJAN! fbsfsdrs.exe Added by the SDBOT-QA WORM! dvsync.exe DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC wsxsvc.exe Delfin Media Viewer or "Promulgate" adware variant dw.exe DownloadWare adware Weather.exe Desktop Weather DWHeartbeatMonitor.exe DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference

N Y X X X X N X N X X X X X X X X X X X U N X U U ? X U X X U N U X U X ? N N N N N N N N U N U X X X U U U X X U U U X N X X U U N ? N X N

DwlClient dwStart Dx Dx8compat dxdiags.exe dxdll32 DXDllRegExe DxLoad DXM6Patch_981116 dxmsrv Dxsty Dxupdate.exe dxvid DyFuCA DyFuCA Active Alert Dynamic Dns Binary Dynamic Dns Binary Dynamic Dns Binary Dynamic Dns Binary Dynamic Link Library loader DynDNS Updater DynDNS-Updater Traytool DynHttp Dns Binary DynSite Dynu Basic Client DZKillMe E-Card E-color E-nrgyPlus e-Surveiller Station E06DXLRD_7604703 E6TaskPanel eabconfg.cpl Eac Download EACLEAN Eac_Cnry Eac_rnvdl EanthologyApp EanthologyApp eanthology_install.exe eanth_critical_update_alert eanth_system_patcher Eapcisetup EAPCISETUP EarthLink ToolBar 5.0 Easy Key Easy Start Button Easy-PrintToolBox EasyAV EasyDates EasyDates_nl EasyKey EasyKeyboardLogger EasyMessage EasySearchBar easyServ EasySync Pro EasyTuneIII EasyTuneIV easywww EbatesMoeMoneyMaker EbatesMoeMoneyMaker0 eBay Toolbar eBayToolbar eBoard eBot ecpe edexter editpad EDLoader

support.exe FireWall.exe sys*.exe [* = random number] Dx8compat.exe dxdiags.exe ntxdll.exe dxdllreg.exe DX3DRndr.exe p_981116.exe dxmsrv.exe Dxsty.exe Dxupdate.exe dxvid.exe optimize.exe actalert.exe dynitora.exe CMD16.EXE winxp34.exe WinHelpcfn.exe Loader32.exe DynDNS.exe ddutray.exe dynizari.exe DynSite.exe dynubas.exe DZSAVEME.EXE ecard.exe IconMgr.Exe E-nrgyPlus.exe estation.exe EDICT.EXE TaskPanl.exe EabServr.exe download.exe eaclean.exe canary.exe ANTIVIRUS_INSTALL.EXE EANTHO~1.EXE eanthology.exe eanthology_install.exe sys_alert.exe sys_alert.exe sbsetup.exe wizard.exe etoolbar.exe easykey.exe esb.exe BJPSMAIN.EXE EasyAV.exe EasyDates.exe EasyDates_nl.exe easykey.exe EasyKeyboardLogger.exe em2.exe ESBUpdate.exe Server.exe XCPCMenu.exe EasyTune.exe ET4Tray.exe easywww2.exe wjview ...Code EbatesMoeMoneyMaker0.exe EBAYTBAR.EXE eBayTBDaemon.exe Eboard.exe DownloadWizard.exe ECPE.EXE edexter.exe editpad.exe DTLoader.exe

Download manager for Dell support alerts The Shield firewall Added by the DEXTER.A WORM! Added by the GEMA TROJAN! Added by the CERTIF-G TROJAN! Added by the GAOBOT.CPX WORM! Created when you select "Yes" to check the "WHQL Digital signatures" in the DirectX9 files at the first time you open it Added by the GIBE.B WORM! Win32 cabinet self extractor. More info here Added by an unidentified WORM or TROJAN! Added by the GEMA TROJAN! Added by the MAFEG WORM! Added by Trojan-Downloader.Win32.Dluca.by TROJAN! Adult content dialler - see here Adult content dialler - see here Added by the RBOT-WT WORM! Added by the RBOT-XM WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the KOL TROJAN! Dynamic DNS IP address updater tool, used as a client for Dynamic DNS service providers such as http://www.DynDNS.org DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually Added by a variant of the RBOT WORM! DynSite - dynamic DNS client, also called an automatic IP updater Dynu online dynamic IP update client. Useful when using a dial up modem ?? Added by the YODI WORM! Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a progra Added by the Energyplus TRACKWARE! Tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a Added by ESurveiller spyware. Note - ESurveiller is spyware that monitors and records keystrokes and mouse clicks, instant message conversations, Internet activity and applications used, must be man Related to Microsoft Encarta dictionary functions Earthlink Task Panel - part of Earthlink TotalAccess 2003 internet access software. Quick access to internet, E-mail and web-space Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys Associated with Webcelerator - spyware. Read eAcceleration's privacy statement here For Compaq PC's. Easy Access button support for the keyboard Added by the CANARY TROJAN! ?? eAcceleration Stop-Sign related - not recommended, see note eAcceleration Stop-Sign related - not recommended, see note eAcceleration Stop-Sign related - not recommended, see note eAcceleration Stop-Sign related - not recommended, see note eAcceleration Stop-Sign related - not recommended, see note Rockwell RipTide soundcard application software. Sound works without it Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar, but you can delete these or add more buttons any time For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys A utility to launch the applications that are bundled with a Canon bubblejet printer Added by the NETSKY.S or NETSKY.T WORMS! Premium rate adult content dialler Adult content dialler For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used EasyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Easy Messenger, instant messenger for MSN, AOL, ICQ, and Yahoo. See here EasySearchBar adware downloader Added by the EASYSERV TROJAN! EasySync Pro is a Lotus program for synchronizing a PDA with Lotus Notes Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Added by an unidentified VIRUS, WORM or TROJAN! Ebates adware Ebates adware eBay Toolbar - reportes as spyware as it "phones home" eBay toolabar related - also contains eBay account Guard which monitors for fraudulent eBay sites eMachines multimedia keyboard manager. Required if you use the extra keys eBot from Digital River - "helps ensure your computer always has the latest technology, fixes, add-ons, upgrades and 'cool stuff'." Can optionally be installed with software such as Net Nanny internet fil ?? eDexter supplements internet filtering by substituting local images for filtered images in order to prevent browser stalls and other annoyances. Can be activated manually when starting the browser Added by the CONSPER-B TROJAN! Effective Desktop from MiniStars Software - desktop management software no longer being supported

U U X U N N X X U U X U U X U U X X X N X U Y U N U Y X X X X X X N U N ? N N N U ? U X U Y X X N ? ? U U U X Y U U N N U N N N U N N N N U

eDonkey2000 edonkey2000.exe File sharing network - not recommended as the free version of this application should be avoided as it installs, without permission, New.Net, Webhancer, WebSearch Toolbar and WinTools EDRestore ?? Set Point from Easy Desk Software - "small utility that automatically sets System Restore points for WinME/XP" educational writer [random filename] Added by the RBOT-LZ WORM! Edwizard Edwizard.exe SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful a eFax Tray Menu HotTray.exe eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here eFax.com Tray Menu HotTray.exe eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here efaxs lptt01 efaxs.exe RapidBlaster variant (in a "efaxs" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here efaxs ml097e efaxs.exe RapidBlaster variant (in a "efaxs" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Efpap.exe Efpap.exe Easy File & Folder Protector. Deny access to certain files and folders, or to hide them securely from viewing and searching ehTray ehtray.exe Windows XP Media Center Edition 2005. Enables the user to access Windows Messenger from within Media Center ei10.exe ei10.exe Added by the AGOBOT-NK WORM! Eicon NetworksLAN_DAEMON watch.exe Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can Eicon TechnologyLAN_DAEMON watch.exe Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can eixfi china.bat Added by the WCUP.A WORM! Elbycheck ElbyCheck.exe From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognize Electron Microscope EMIII.exe Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home, FAH. It will monitor up to 50 clients and give you the details about each c Element Element.txt Added by the ELEM TROJAN! element furth [path] repcale.exe [path] palsp.exeAdded by a variant of the RANDON.AN WORM! elitemedia elitemediapop.exe Added by the LOWZONE-BB TROJAN! Also known as Elitebar/EliteToolbar/EliteSidebar adware elm Elmenv.exe ViaTech eLicense for securing, distributing and selling music online ELNKProxy smproxy.exe Surfmonkey adware ELSA WINman Suite Winmsuit.exe Allows you to totally customize your ELSA graphics card settings, including overclocking the GPU ElsaCapiCtl Rcapi.exe Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there you can not bring up the dialog box which is so ELSAChipGuard elsavect.exe ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed, and will halt the system if either are at dangerous levels and restore the default clock EMA.exe EMA.EXE Time management system which helps you to manage your time and appointments eMachines eBoard Eboard.exe eMachines multimedia keyboard manager. Required if you use the extra keys EmailScan mcvsescn.exe Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails eMakeSV EMAKESV.EXE Switch premium rate adult content dialler variant eMakeSV EMAKE2B.EXE Switch premium rate adult content dialer variant eMCryT Sh3ars Panagers [path to worm] Added by the RBOT-AWI WORM! emoc0re emo.exe Added by the AGOBOT-AGE WORM! emsw.exe emsw.exe Attune HelpExpress - spyware. Disable and uninstall - see here emule emule.exe Added by the RBOT-ALZ WORM! eMusicClient Systray eMusicClient.exe eMusic MP3 download software EM_EXEC EM_EXEC.EXE Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled EN4060C Taskbar en4060ct.exe Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray encapsulated command tool wintr.com ?? Encarta Dictionary Quickshelf QSHLFED.EXE Provides quick access to Encarta's Dictionary features? ENCMONITOR monitor.exe The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it Encoder Agent WMENCAGT.EXE MS Windows Media Encoder, which already has a shortcut in the Start Menu if installed Encompass_ENCMONTR ENCMONTR.EXE Optional simple browser from Yahoo (Encompass) ENCSurf surfboard.exe ?? Energizer FileSaver Energizer FileSaver.exe Energizer FileSaver - UPS back-up utility for Energizer UPS products EnergyPlugIn EnergyPlugin.exe EnergyPlugin adware variant enginecs2 enginecs2.exe Cyber Sentinel - internet filtering software EngUtil EngUtil.exe Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking Enh Win Updt enhupdt.exe Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.OneClickNetSearch.h enhance32 enhance32.exe Added by the CRYPTER.A TROJAN! EnigmaPopupStop EnigmaPopupStop.exe Part of Enigma SpyHunter - not recommended, see note ENSApServer2_0 APSERVER.EXE Intel AnyPoint Wireless II Home Network related. What does it do and is it required? ENSMIX32.EXE ENSMIX32.EXE Sound card driver. Is it required? EnsoniqMixer starter.exe Puts the Ensoniq mixer in system tray. From Ensoniq Technologies "Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used". If yo Entbloess 2 Entbloess2.exe Related to Window-Switcher - it allows you to see previews of all your open applications via a single keystroke in a manner similar to Apple's Exposé, for Windows 2K/XP Enterra Icon Keeper IcnKeepr.exe Icon Keeper - "tool to save and restore icon positions on the desktop" Enumerate Service wsys.exe Added by the MANIFEST TROJAN! EnvyHFCPL EnMixCPL.exe VIA Envy24 PCI Audio Controller driver eonemng eOneMng.exe eOne Manager, provides access to the buttons on the keyboard and on the front of the console for the eMachines eOne PC EPoXUSDM USDM.EXE EPoX Universal Serial Data Monitor - a diagnostics tool that shows Temps, Fan Speeds, Voltages...etc ePrint 3.0 Service EPRINT3.EXE LEADTOOLS ePrint file conversion software - "convert any file to and from over 150 document and image formats including searchable PDF, DOC, HTML, TXT, Multi-page TIFF, JPG, GIF, PNG and many m ePrint 4.0 Service EPRINT4.EXE A component of the "LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF, DOC, HTML, TXT , Multi-page TIFF, JPG, ePrompter ePrompter.exe ePrompter - E-mail notification software EPS e_srcv02.exe According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPS e_srcv03.exe According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPSON Background Monitor STMS.EXE Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not EPSON CardMonitor EPSON CardMonitor1.0.exe Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint EPSON Status Monitor 3 Environment e_srcv03.exe Check According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPSON Status Monitor 3 Environment e_srcv02.exe Check According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPSON Status Monitor 3 Environment e_srcv03.exe Check 2 According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPSON Status Monitor 3 Environment e_srcv02.exe Check 2 According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File m EPSON Stylus C44 Series E_S10IC2.EXE Epson Stylus C44 Series printer monitor - for checking ink levels, etc

U U U U U X ? U U N X X X ? X N X X X X X X X ? U Y U Y U U X N X X N ? ? Y ? Y Y U ? X X N X X X X X X Y U Y X U ? N N X U N X U N X N U X

EPSON Stylus C46 Series E_S4I0T1.EXE Epson Stylus C62 Series E-S0BIC1.EXE Epson Stylus C82 Series e_s0hic1.EXE EPSON Stylus Photo RX420 Series E_FATI9CE.EXE EpsonPhotoStarter EPSON_PhotoStarter.exe EQAdvice EQAdvice.exe Equipmen Equipmen.exe Eraser eraser.exe eRecoveryService check.exe EReg reg32.exe erfgddfk wind2ll2.exe erghgjhgdr windlhhl.exe erghgjhjgdr windlhhl.exe erm erm.exe eros.exe eros.exe Error Nuker ErrorNuker.exe Error Safe ers.exe ErrorGuard ErrorGuard.exe errorhandler errorhandler.exe erthegdr windll2.exe erthgdr windll.exe erthgdr svc.exe erthgdr2 svc23.exe ERTS0749 ERTS0749.exe ERUNT AutoBachup AUTOBACK.EXE eSafe Protect ESPWatch.exe ESB esb.exe eScan Monitor AVKWCTL9X.EXE eScan Scheduler avkserv.exe eScan Updater Trayicos.exe EScorcher escorcher.exe ESFTP esftp.exe Esoh Esoh123.exe Especial Deneca.bat ESPN BottomLine bline.exe ESS Daemon Essd.exe essapm essapm.exe Essdc essdc.exe ESSNDSYS ESSNDSYS.EXE ESSOLO ESSOLO.exe esspk esspk.exe EssSpkPhone essspk.exe eSupInit eSupCmd.exe ETB Tester etbtest.exe etbrun elit***32.exe [* = random char] Ethernet tcaudiag.exe ethernet airftp.exe ethernet msnger.exe ethernet msftp.exe Ethernet Drivers smrrs.exe Ethernet Drivers ethernet.exe Etraffic JavaRun.exe eTrust EZ Firewall efpeadm.exe eTrust PestPatrol Active Protection PPActiveDetection.exe eTrustCIPE ezdsmain.exe eTunnel winfw.exe EuroGlot EuroGlot.exe Event Log eventlog.exe Event Planner Reminders PLNRnote.exe Event Reminder pmremind.exe EventApplicationCmd smschk.exe EVENTLISTENER EvLstnr.exe eventmgr eventmgr.exe eventwvr eventwvr.exe Evidence Cleaner ecleaner.exe Evidence Eliminator ee.exe Evil Evil.exe evntsvc evntsc.exe EVOLOSTA EVOLOSTA.EXE EvtHtm evthtm.exe

Epson Stylus C46 Series printer monitor - for checking ink levels, etc Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Related to the EPSON Stylus Photo RX420 Series printer/scanner/copier Only needed if you want to make full use of the capabilities of an Epson printer that included this Added by NewAds1 ADAWARE! ?? Eraser allows for complete removal of data from your hard drive Acer Notebook related. Acer eRecovery allows the user to restore the operating system or backup the current system profile, thus ensuring system integrity EReg is a software registration tool incorporated on products such as those by Brøderbund, Connectix, Hewlett-Packard, The Learning Company, and Sierra. Needless to say you don't need it Added by the BEAGLE.CQ WORM! Added by the BEAGLE.BG WORM! Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS! ?? Adult content dailler ErrorNuker registry cleaner - only required if you want the application to run a scan at startup. The program can be launched manually if required Added by ErrorSafe - security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove Spyware remover of dubious repute Added by ErrorHandler ADAWARE! Added by the BEAGLE.CG WORM! Added by the BEAGLE.AO or BEAGLE.AQ WORMS! Added by the BEAGLE.BN or BEAGLE.BP WORM! Added by the BAGLE.CG WORM! IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? ERUNT - "Registry Backup and Restore for Windows NT/2000/2003/XP" eSafe from Aladdin - internet security for gateway and E-mail servers Easy Start Button - provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys eScan antivirus eScan antivirus scheduler eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead ESftp - FTP client for transfering files between a local PC and another remote computer Added by the AGOBOT.FF WORM! Added by the DELUZ VIRUS! ESPN BottomLine. "You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop, without even worrying about a browser. As long you keep the BottomLine running Related to an ESS based soundacard. Is it required? ESS Solo soundcard driver. Is it required? Related to an ESS Solo soundcard. Seems as though it's required Related to an ESS based soundacard. Is it required? Sound card driver that re-instates itself every time it's removed ESS Technology modem speaker driver file. Required to get on-line with this modem ESS Technologies Call waiting, which gets installed by the drivers for V92 modems based on ESS Technologies chipsets Related to SupportSoft "Real-Time Service Management software". What does it do and is it required? Added by the RBOT-ABR WORM! EliteBar ADWARE! 3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs Added by a variant of the SDBOT WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT.BXJ WORM! Added by the RBOT-AAK WORM! Added by the GAOBOT.CEZ WORM! Marketing software from TopMoxie eTrust EZ Firewall PestPatrol real-time protection feature. "Stops spyware before it infects your system" eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior Added by an unidentified TROJAN! Euroglot - "multilanguage translating system, available in the languages Dutch, English, French, German, Spanish and Italian" ?? Sierra Event Planner tray icon A calendar/alarm program that installs with Brøderbund Printmaster Added by the IRCBOT-AO TROJAN! Used with a Nikon digital camera to recognize when the camera is plugged in Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs Added by the COSIAM_G TROJAN! Evidence Cleaner cleans up tracks left by your PC and Internet activities Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis Added by the MYTOB.JM WORM! Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID, peer-to-peer mode channel, link speed, WEP encryption options, and has enable/disable and re Premium rate adult content dialler

U N X X N ? N X X X X X ? X ? U U U ? X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X U X U ? ? N Y N N N N X ?

EW Message Server eWare Startup ewupdater example Excite Platform Excite Private Messenger Pipe ExciteAssistantEXE exdl.exe exe lptt01 exe ml097e execfg4 ExecUser Execute ExeName32 exgiwsl Exif Launcher Exif Launcher ExitKiller exmon EXPL0RE.EXE Expl0rer soft expler Explkw explore Explore Explore explore manager explore.exe exploreff.exe explorer explorer Explorer explorer Explorer Explorer EXPLORER EXPLORER Explorer Explorer explorer explorer EXPLORER explorer Explorer Loader Explorer Loader Explorer lptt01 EXPLORER MICROSOFT SYSTEM Explorer ml097e Explorer soft Explorer soft Explorer Updater explorer.exe explorer.exe Explorer32 Explorer32 Explorer32 exporet Exshow95 External Dependencies ExtraDNS Extranet AutoDial ExxtremeHelperDemon Eye Tide Launcher EZ Firewall ezagent EzButton EZDesk EzEjMnAp eZmmod EZNORUN

msg32.exe iWareStart.exe ewupdater.exe [random filename].exe Exlaunch.exe x8impipe.exe ASSISTANT.EXE exdl.exe exe.exe exe.exe execfg4.exe ExecUser.exe delfolders.exe Warm.scr exgiwsl.exe Exiflaquickdcr.exe QuickDCF.exe Ekiller.exe hpimoniter.exe EXPL0RE.EXE expl0rer.pif Updadv.exe expup.exe explore.exe Explorer.exe explore.exe explore.exe Explore.exe exploreff.exe explorer.exe wscript.exe [filename] shellexpl.exe expl32.exe [path to worm] shellexp.exe EXPL0RER.EXE sys.exe config_.com drv.exe [path to trojan] explorer.exe EXPLORER.exe explorer.exe explr32.exe explorerl.exe explorer.exe explore.exe explorer.exe explorer.pif explorer.com IEXPLORE.exe explorer.exe explorer.exe Expl32.exe explorer6s4.exe efsdfgxg.exe winset.exe EXSHOW95.exe External.exe ExtraDNS.exe AutoExt.exe exxdemon.exe oneeyetideone.exe ca.exe ezagent.exe EzButton.EXE EZDESK.EXE EzEjMnAp.exe mmod.exe EZNORUN.EXE

Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices eWare iWare task bar. Not required EasyWebSearch adware updater Added by the NUCLEAR TROJAN! Note - this trojan file is found in the WindowsNR or WinntNR folder Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). Ma ?? With Excite Assistant, you can access a wide variety of online information, including email, news, and stock quotes without having to have a browser window open BargainBuddy foistware RapidBlaster variant (in a "Exe" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "Exe" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Added by the ELECTRON WORM! Added by a variant of the RBOT WORM! ?? Added by the SCOLD WORM! ?? USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly Exit Killer - automatically closes pop-up windows in your browser Some kind of hp digital camera maybe or a photo smart connection probe? Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit "0" instead of the uppercase letter "o" Added by the RBOT-AQR WORM! Added by the QQPASS-N TROJAN! Keywords hijacker Added by any number of VIRUSES, WORMS or TROJANS! Added by the IRC.FLOOD.G TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you adde Adult content dialler Added by the DONBOMB.A TROJAN! Added by the GRAYBIRD.G TROJAN! Added by the FINFANSE TROJAN! Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explor Sneaky way to start any VBS script. Many viruses use VBS files Added by the GPIX and SHELDOR VIRUSES! Added by the RATSOU TROJAN! Added by the AUTEX WORM! Added by a variant of the SHELDOR TROJAN! Added by the BEASTDO-Y TROJAN! Note the "0" in the filename rather than upper case "o" Added by the SILLYFDC-A TROJAN! Added by the FLOPPY-D WORM! Added by the SMALL-FD TROJAN! Added by the AGENT-EU TROJAN! Added by the KEYLOG-AK TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Added by the NETHIEF-P TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it Added by the BLOCKEY-A TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Added by the AGOBOT.N WORM! Added by the SDBOT-ADI WORM! RapidBlaster variant (in a "explorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the legitimate Windows Explorer (explorer.exe) which wo Added by a variant of the RBOT WORM! RapidBlaster variant (in a "explorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the legitimate Windows Explorer (explorer.exe) which wo Added by the RBOT-APK WORM! Added by the RBOT-ARM WORM! Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the AGENT-EW or PWS-CY TROJANS! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless Added by the DELF-ACL TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it Added by the HACKTACK.B TROJAN! Added by the Downloader.Win32.Small.biq TROJAN! Added by the CLICKER-Y TROJAN! Added by the QQPASS-I TROJAN! Support software for some of the Kensington mice. Provides access to extra features like those available with enhanced Logitech and MS devices Added by the MYTOB.EC WORM! ExtraDNS - DNS configuration tool Nortel Networks Contivity Extranet Switching Software Creative Exxtreme graphics card related? Nascar wallpaper eTrust EZ Armor Internet Security EzVCR recording software for the ASUS TV FM card. Available via Start -> Programs EZbutton is a quick launcher for the Media player app that comes with certain laptops. Typically installed in a C:Program FilesEzButton folder Utility that remembers icon locations for each user and resolution. Available here For IBM Thinkpad Notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, r eZula TopText adware Easy Internet related?

N Y Y Y Y U X X X X U U N N U X Y U Y Y Y Y U X X U X ? X X N N X X X X U X X X N N N U U U U N U ? X X X X X U X U X U X U X U X X X U U X

EzPrint ezPS_Px ezPS_Px ezShieldProtector for Px ezShieldProtector for Px EZSMART App ezula eZulaMain eZuluMain eZWO E_S10IC2 E_S23 E_S4I2F1 E_S4I2G1 E_SOEIC1 F-Secure 2005 F-Secure 2006 F-Secure Management Agent F-Secure Manager F-Secure Startup Wizard F-Secure TNB F-StopW f1Tray.exe f607 f73cdc8ee94e FamilyKeyLogger Fantasia injector fapmon farmmext Fash fast FAST Defrag Fast Home Fast Search Fast start Fast start FastCache FastStart FastStart FastStart FastTrack Accelerator FastUser FastUsr FatPipe Fatpipe Dialer fatrecov FaxCenterServer FaxTalk CallControl 6.0 FBDirect FBI fc FCEngine FCHelp FDD SYSTEM Fdr Command Module FD_SAP feelalright FEELitDeviceManager fegoze Fellowes Proxy Fen Startups FerrariWallPaper ffis FG1_00 fGQEGqHOME FHPage FHStart Fhtisxk FieldForms Sync FiendlyType

ezprint.exe ezSP_PxEngine.exe ezSP_Px.exe ezSP_Px.exe ezSP_PxEngine.exe ezsmart.exe eZmmod.exe eZulaMain.exe eZuluMain.exe wo.exe E_S10IC2.exe E_SICN03.exe E_S4I2F1.exe E_S4I2G1.EXE E_SOEIC1.exe svchost.exe fspex.exe FSMA32.EXE FSM32.EXE FSSW.EXE TNBUtil.exe F-StopW.exe F1TRAY.EXE f607.exe btsendto.exe cisvc.exe wincfg.exe fapmon.exe farmmext.exe Fash.exe fast.exe FAST2.EXE svcnvt.exe svcnv.exe Ntut.exe svcnt.exe fc.exe ntnut32.exe svcnut.exe svcnut32.exe SPEED UP.EXE fast.exe fast.exe DHCP fpdialer.exe fatrecov.exe fm3032.exe FTClCtrl.EXE FBDirect.exe FBISM.exe runfc.exe FCEngine.exe FCHelp.exe Fdd.exe sp2.exe FD.exe mirc.exe feelitdm.exe SVCH0ST.EXE R3proxy.exe fensvc32.exe FerrariWP.exe ffisearch.exe frntgate.exe gwwgtp.exe shdochp.exe shdocsvc.exe fhtisxk.exe SyncService.exe csrss.exe

Configuration options for Lexmark printing devices Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported eZula TopText adware eZula TopText adware Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work eZula TopText adware Epson Stylus C44 Series printer monitor - for checking ink levels, etc Epson printer status monitor - for checking ink levels, etc. Epson Status Monitor 3 for the Epson Stylus Photo R300 (and probably others) printers - monitors the status of a print job spooled to that printer Related to the Epson Stylus CX5400 printer/scanner/copier - not required Epson Stylus printer monitor - for checking ink levels, etc. Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M F-Secure Anti-Virus automatic updater F-Secure Antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products F-Secure Antivirus - carry out scheduled virus scans automatically F-Secure antivirus F-Secure antivirus F-Prot anti-virus background scanner by F-Risk Software System Tray icon for FusionOne's MightyPhone software. "MightyPhone is a concept for wirelessly synchronizing the data on your mobile phone with your web-based or PC based organizer" Added by the URAT.B TROJAN! Associated with mysearchnow.com/searchbar.html Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you i Added by the AGOBOT.US WORM! Fair Access Policy monitor for DirecPC/DirecWay internet access VX2.Transponder parasite updater/installer related Unidentified adware Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it FastDefrag defragmenting software Reported by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Delf.ks This file may be found in the System folder on 9x machines, however as of this writing it has only been seen in the System32 folde Homepage, Startpage hijacker. Possible variant of Trojan-Downloader.Win32.Delf Added by unidentified adware - recognized by Kaspersky antivirus as Trojan.Win32.Favadd.i Added by unidentified adware - recognized by Kaspersky antivirus as a variant of the FAVADD TROJAN! FastCache from AnalogX - speeds up browsing by resolving DNS requests locally Added by the Startpage.L hijacker Browser hijacker - a variant of the STARTPAGE.L TROJAN! Browser hijacker - a variant of the STARTPAGE.L TROJAN! FastTrack Accelerator - "speedup" utility for programs that use the FastTrack network such as KaZaA Media Desktop, Grokster and Morpheus Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself! FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark, MCI, Lotus, My Software, Broderbu This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort De Compaq related but what does it do? Added by the CAMPURF WORM! CASClient adware variant Added by either FCHelp adware or a variant of it Added by the MYTOB-FO WORM! Added by the SDBOT.WP WORM! Reported to be the autopassword program from the Sony Microvault thumb drive Added by the IRCFLOOD-M WORM! Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals) Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase "o" Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice Added by the RANDEX.CCF WORM! Calendar that replaces the default desktop background image. It comes with every Acer Ferrari 3000 laptop. Also downloadable for members of www.ferrari.com iSearch "Desktop Search" hijacker FrontGate MX - e-mail spam blocker Added by the RANKY.J TROJAN! Added by the DELF-Ks TROJAN! Added by the DELF-Ks TROJAN! XtraKeys keystroke logger/monitoring program - remove unless you installed it yourself! Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run, on a wide range of mobile devices. Supports Microsoft Access databases, and provides for synchroniza Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!

X ? X X X X X N X X U U U X X Y X N N X X X X X X X X X X X X X U X X X X X X X Y Y U N X ? U X N N N N X U U U U ? U X X X ? X X ? Y X U X

FILE file indexing service file laoder configuration File System File System Service File0_0 File1 FileFreedom_Plugin FileManager32 FileSoft FilmLoop FilterGate Filterguard Find Find Fast Find Virus Launch Program FindHack FinePrint Dispatcher vx FineReader7NewsReaderPro FireFox FireFox Service Drivers FireFox Startup Drivers Firewall Firewall Firewall Firewall firewall Firewall Policy Firewall Sp2 system Firewall Update System1 Firewall Updater FirewallActivies FirewallStartup FirewallSvr firewall_anti FireWire Driver FireWire Service FireWire Services First Home Page FIX Fix-it Fix-it AV FjMenu fkSysMon FlaCPY FLASH32 FlashEnc Flashget Download Manager FlashPath Monitor FlashPath Monitor FlashPath Status FlashPath Status FlenCPY Flexicd FLMK08KB FLMOFFICE4DMOUSE FLMOFFICE4DMOUSE FLMTRUSTKB FLMTRUSTMOUSE FlnCPY FLooDNeT Floppy Master Flow Go TV flps flpycntl FLSVCI FltProcess FlyswatDesktop FmctrlTray fmnwebassist

abcdefg.exe msfindfile.exe rnd32.exe taskmqrs.exe wmiprvsc.exe MD1.exe Dia Claro.htm wtm.exe Wscript.exe ..ChkMgr32.vbs Wscript.exe UpdataFiles.vbs FilmLoopService.exe filtergate.exe Filtrgrd.exe find.exe Findfast.exe fvlaunch.exe [path to trojan] FPDISPxA.EXE AbbyyNewsReader.exe firefox.exe ssmss.exe wuaclt.exe wmlaunch .exe wmlaunch .exe SP2 UPDATE.exe Firewall.bat fw_304.exe MidiDef32.exe sys32Conf.exe WinedowsUpdater1.exe msnupdateit.exe csrss.exe Firewallstartup.exe FirewallSvr.exe firewall_anti.exe samx.exe nvscv32.exe nvcsv32.exe http://find.naupoint.com WinFIX1.0.vbs mxtask.exe memcheck.exe FjMenu.exe fksysmon.exe flacpy.exe #NAME? FlashEnc.exe Flashget.exe SDSTAT.EXE FLSHSTAT.EXE SDSTAT.EXE FLSHSTAT.EXE flencpy.exe Flexicd.exe MMKEYBD.EXE moffice.exe moffice.exe, mouse32a.exe KbdAp32A.exe mouse32a.exe flncpy.exe FLooDeR.exe [path to trojan] flogotv.exe flps.vbs flpycntl.exe FLSVCI.exe msinet.exe flydesk.exe Fmctrl.EXE fmnwebassist.exe

Added by the KELVIR.DD WORM! New version of MS FindFast and still a resource hog? Added by the RBOT.BQJ WORM! Added by a variant of the TOXBOT/CODBOT WORM! Added by the AGOBOT-HZ TROJAN! Added by the DLOADER-OR TROJAN! Added by the DLOADER-OR TROJAN! FileFreedom peer-to-peer sharing program Added by the NOTUP.A WORM! Added by the SST.B WORM! Related to FilmLoop - a photocasting network. Share your pictures with your family and friends Filtergate internet filtering software - filters sounds, popup ads, background sound and other unnecessary website items An icon located in the lower left of the screen and looks like a lifesaver. This icon is a "short-cut" to access the basic features of SOS-Guardian, SOS-KidProof Lite, SOS Best Defense and SOS Pro such as Added by the OPANKI WORM! Complete utter waste of space! Part of MS Office - searches disk drives for Office file types to make opening them easier Part of Dr. Solomon's Antivirus Added by the KELVIR-BA TROJAN! FinePrint - virtual printer for use with any printer. Search for "dispatcher" here for more information. If removed, it will re-install when program is run - hence the Y recommendation ABBYY FineReader OCR software Added by the RBOT-ATP WORM! Note - this is not the popular FireFox web browser and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Added by a variant of the SDBOT WORM! Added by the RBOT.BYX WORM! Added by the ELIPTER.A or ELIPTER.B or ELIPTER.D WORMS! Added by the ELIPTER.D WORM! Added by the ELITPER.E WORM! Added by the YPSAN.G WORM! Added by the JQ TROJAN! Added by the PIEBOT-A TROJAN! Added by the Rbot-ABT WORM! Added by the RBOT-ARU WORM! Added by the RBOT-AAQ WORM! Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Innovative Startup Firewall - "designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewal Added by the NETSKY.X or NETSKY.Y WORMS! Added by the NETDENY-B TROJAN! Added by the SDBOT.AE WORM! Added by a variant of the SDBOT WORM! Added by a variant of the SPYBOT WORM! Naupoint browser hijacker Added by the GORMLEZ-A WORM! Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard, intellicluster, anti-virus, or autoupdater. Otherwise not required Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could b From the "Fujitsu Menu" tray icon you have instant access to the Control Panel, Tablet pc keyboard, Tablet and pen settings, Fujitsu display controls, brightness control, sounds and audio devices, captu fkWrae SysMon - system monitor - "displays the current memory consumption, CPU and resource usage, date, time, Windows uptime, IP address and a lot more" FlashEnhancer adware variant ?? Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission, which is a pain. No Added by the RBOT-AGZ WORM! System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs FlashEnhancer adware variant CD player - part of the Win95 Power Toys Multimedia keyboard manager. Required if you use the additional keys Mouse properties for Logytech Typhoon Office Mouse Mouse properties for Typhoon office mouse Keyboard utility for a Trust brand keyboard. What does it do and is it required? Mouse utility for a Trust brand mouse FlashEnhancer adware variant Added by of the ENDOOL TROJAN! Added by the ZONIT-F TROJAN! ?? Added by the BYRON WORM! Added by the CRYPTER.C TROJAN! ?? Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done Advertising spyware Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used) Adware popup generator

U X X ? X U U N N X N X X X X Y Y N X N U N U U X X X X Y ? N X X U N ? U Y U U X U X U X X U N ? ? X X X N U ? U N X Y Y X Y N ? X U Y N U

FMStart FMSZ fnmwebassist Focus Folder Service Folder View FolderClone v*.*.* Folding@home FoneSyncSystemTray FontFix fontnav FontsLoader FONTVIEW foobin lptt01 foobin ml097e FoolProof FoolProofSweep Forbes ForceShow Forget Me Not Fortis Secure Layer Config FotoStation Easy AutoLaunch Foul PX FourthDay foxdh foxdh foxrxjh foxwudy9912 FP Loader FPWGMWZD Fpx fqor France Fraps Free Download Manager Free Downloads Monitor Free Ram Optimizer Freedom FreeMem Pro FreeMemVn2 FreeMP3download FreeRAM XP freestyle freesurfer freexstyle freexstyle Fresh Desktop freshclam frguk FridaysInHellInstaller FriendlyType FriendlyTypeName FriendlyTypeName FriendlyWebQuick-Launch FRISK FP-Scheduler FRITZ!DSL Startcenter FRITZ!webProtect Fromine WinPopup Frsk FRW_EXE frxmxins FS Agent fsaa FSCBoss FSDPSRV FSH fsp fspr FSScrCtl fsserv

Fmstart.exe GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks, allows all users to send and receive faxes right from their desktop fmsz.exe Added by the FMSZ TROJAN! fnmwebassist.exe WinPL adware Focus.exe ISDN configuration wizard? wssdtu.exe Added by the MANIFEST TROJAN! folderview.exe Folder View enhances the Windows file Explorer by making all folders you need available in a single click folderclone.exe Folderclone backup and synchronization software WINFAH.EXE Folding@Home is a distributed computing project which studies protein folding, misfolding, aggregation, and related diseases - must be running in order to access the internet to upload to the servers. A FoneSyncSystemTray.exe System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the com fontfix.exe Added by an unidentified VIRUS, WORM or TROJAN! FontNav.exe Font Navigator from Bitstream Inc. - a font management utility ldfnt32.hta Unidentified malware FONTVIEW.EXE Added by the OPASERV.T WORM! adaware.exe RapidBlaster variant (in a "foo1" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here adaware.exe RapidBlaster variant (in a "foo1" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here fpwinldr.exe FoolProof Security PC security software from SmartStuff ?? Part of FoolProof Security PC security software from SmartStuff ForbesAlerts.exe Forbes Business News Alerts - displays business news headlines in a little window on the screen rundll32.exe QaBar.dll, ForceShowBar AdultLinks.QBar parasite related AGRemind.exe Calendar reminder part of American Greetings(r) CreataCard(r) cseinst.exe Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay sy FotoStation Easy AutoLaunch.exe Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either FoulPX.exe Foul PX, Optusnet usage stat checker FourthDay.exe The Fourth Day - "astronomical clock and almanac for your system tray" foxdhend.exe Added by the MENGHUAN TROJAN! foxdh.exe Added by the GWGHOST-Q TROJAN! foxrxjh.exe Added by the GWGHOST-T TROJAN! service.exe Added by the BANCOS-BT TROJAN! loadfp.exe FoolProof Security - PC security software from SmartStuff FPWGMWZD.exe ?? mnmsrvc.exe Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations stub_113_4_0_4_0.exe TargetSaver adware svchost.exe Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon fraps.exe Fraps Real-Time Video Capture software fdm.exe Free Download Manager - see here fdcmon.exe ?? fro.exe Free Ram Optimizer monitors your memory, and frees up ram if it falls below a certain minimum. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this Freedom.exe Zero Knowledge Freedom - Anti-Virus, Personal Firewall and Parental Control, it also blocks ads, safeguards your personal information, encrypts your passwords, and much more FMEMPRO.EXE FreeMem Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind FreeMem.exe FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related FreeRAM XP Pro *.exe FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your lockx.exe Added by the RBOT-ATH WORM! fs20.exe EMS Free Surfer mk II - pop-up stopper lockbar.exe Added by the LOXBOT.D WORM! lockbr.exe Added by the LOXBOT.C WORM! freshdesktop.exe Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals freshclam.exe Auto update agent of the open source Clamwin virus scanner shdrkmck.exe ?? FridaysInHellInstaller.exe ?? lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! SELFCERT.EXE selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remo F-Sched.exe Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis StCenter.exe FRITZ! ISP software "StartCenter" User interface that allows you to manage, tweak and diagnose many aspects of your internet connection - is it required? FwebProt.exe Firewall included in FRITZ! ISP DSL software winpopup.exe Instant Messenger program frsk.exe Unidentified adware downloader trojan FRW.EXE ConSeal Signal9 firewall - now McAfee Personal firewall frxmxins.exe ATI 3D Studio MAX/VIZ driver fagent.exe Added by the VOLVER-B TROJAN! fsaa.exe F-Secure antivirus Authentication Agent - creates and stores private keys used by a client to access servers FSCBoss.exe Free Store Club shop online software FSDPSRV.exe ?? svcnva.exe Malware, detected by Ewido Security Suite as TrojanDownloader.Delf.ks fsp.exe Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents FolderShield.exe Folder Shield - hide personal files and folders FSScrCtl.exe Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver" fserv.exe Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time

X U U X X N U U X X X X Y X N N X U X X X X X ? N N X X U U X N X X X N U U X X X X X X U U X U X ? N X X U N N N X N U X X X X X X X X X X

FSW FSW.exe FreeScratchAndWin parasite FSWebServer fsws.exe Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services FTMSFLT(USB) FTMSFLTU.EXE Fujitsu's Touch Panel Message Notifier FTP FOR WINDOWS ftpwin32.exe Added by a variant of the RBOT WORM! FTPGraber FTPGraber.exe Added by the DLOADER-DT TROJAN! FTPManager FTPDM.exe Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another, remote computer system connected via a modem and telephone lines or by a loc Ftpqueue Ftpsched.exe Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers Fujitsu Menu FjMnuIco.exe From the "Fujitsu Menu" tray icon you have instant access to the Control Panel, Tablet pc keyboard, Tablet and pen settings, Fujitsu display controls, brightness control, sounds and audio devices, captu fukerservice fukerz.exe Added by a variant of the RBOT WORM! FUKLBAR bar.exe PurityScan/Clickspring adware fvek fvek.exe Added by the DRIVOL-A TROJAN! FWDMON.EXE fwdmon.exe Added by the PROXY-S TROJAN! fwenc.exe fwenc.exe Check Point SecuRemote VPN client - "dynamic and fixed IP addressing for all ISP services - dial-up, cable modem, or DSL - the ideal solution for telecommuters and mobile workers" Fwr Command Module fwr.exe Added by the SDBOT-PP WORM! fwrastrc fwrastrc.exe Dial-up software for Friendly Technologies/1NationOnLine free ISP fwservice fwservice eAcceleration Stop-Sign related - not recommended, see note FX ieloader.exe Added by the SMALL.RR TROJAN! fxredir fxredir.exe Canon MultiPASS fax redirector f~a ra32.exe Added by the CAY TROJAN! g.exe g.exe Added by the GRAYBIRD.Q TROJAN! G00123 [worm filename] Added by the BUGBROS WORM! G0mez G0mez.vbs Added by the GORMLEZ-A WORM! G3 GSMedia3.exe Malware downloader - detected by Kaspersky antivirus as Trojan.Win32.VB.ux g3dctl g3dctl.exe ?? Gadu-Gadu gg.exe Polish language Instant Messaging client Gadwin PrintScreen PrintScreen.exe Gadwin PrintScreen - utility to capture, print or save the current window GAELICUM.EXE GAELICUM.EXE Added by the PENTA-A TROJAN! gah95on6 gah95on6.exe ShopAtHome/SAHagent adware gaim gaim.exe Gaim is an instant messenger client with capability to connect to AIM, ICQ, MSN Messenger, Yahoo, IRC, Jabber, Gadu-Gadu and Zephyr networks Gainward TBPanel.exe Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel game shit.exe Added by the Netclap Gold backdoor TROJAN! Game Device JOYUPDRV.EXE Genius game controller profile activator Games Acceleration svshost.exe EasySearch adware Games Acceleration [path to trojan] Added by the SMUTSRCH-A TROJAN! Games toolbar rundll32.exe [path] tbGame.dll, DllShowTB Topconverting.com180Search "Games Toolbar" adware GameSpot kontiki.exe Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops gameutil.exe gameutil.exe Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot GammaHotKeys setgamma.exe Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop gaSrv gaSrv.exe Adware downloader, identified by Panda antivirus as Trojan.Downloader.ALQ gaSrve gaSrve.exe Adware downloader, identified by Panda antivirus as Trj/Downloader.ALQ Gate Personal Firewall Systpl.exe Added by the RBOT.ADC WORM Gator gator.exe Gator eWallet adware Gator eWallet gator.exe Gator eWallet adware Gay_Sexy_** Gay_Sexy_**.exe Premium rate adult content dialler (where * is a random char) GazelDisplay gsyno.exe BT Digital Access USB - Gazel ISDN installation System Tray icon GBTray GBTray.exe System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes fa gcasDtServ gcasDtServ.exe Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup gcasServ gcasServ.exe Giant Antipsyware - now superseeded by Microsoft Windows AntiSpyware gcasServ realsched.exe Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name GCC Reminder gccrem.exe Associated with AcraMax Greeting Card Creator. Is it a registration reminder? GCS GrabClipSave.exe GrabClipSave screen capture tool GDAX [path to backdoor] Added by the RANKY.K TROJAN! gdien32 gdien32.exe Added by the SINGU-P TROJAN! GDMgr.exe gdmgr.exe GuardMon is a commercial surveillance software program designed to monitor all forms of user activity on a computer GDrive GDriver.exe Found on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager Gearbox confsvr.exe NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details availa GEARsec gearsec.exe Installed by Apple Quicktime package - iPod/iTunes CDRW support. Can be disabled if you only require Quicktime player GEDZAC GEDZAC.exe Added by the GEMEL WORM! GemStRmW GemStRmW.exe For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card, start it manually Gene USB Monitor USBMonit.exe Monitors USB ports for insertion of Sandisk USB flashdrives general lptt01 general.exe RapidBlaster variant (in a "General" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here general ml097e general.exe RapidBlaster variant (in a "General" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Generic host proccess for windows SVCHOSTS.EXE Added by the SPYBOT-GQ WORM! Generic Host Process SCHOST.EXE Added by the RBOT-NC WORM! Generic Host Process svchost.exe Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Generic Host Process for Win32 Services ntspcv.exe Added by the SDBOT.S TROJAN! Generic Host Process for Win32 Services intspvc.exe Added by the DINFOR.D WORM! Generic Host Process for Win32 Services winsvc.exe Added by the SDBOT-O WORM! Generic Host Process for Win32 Services bazzi.exe Added by the AHKER.E WORM! Generic Host Process for Win32 Services winsvc32.exe Added by the SDBOT-P WORM!

X X X X X X Y X X X X X N N X X U N N ? Y X X Y Y X X X ? U X Y X X X X X ? X X X Y U U X X X ? X X U U U U X X U X X X N X N X X N U U U X

Generic Host Process2 System Backup scvhost2.exe Added by the RBOT-BAH WORM! Generic Host Process326a System Backup scvhost326a.exe Added by a variant of the SDBOT WORM! Generic Host Service lshost.exe Added by the RBOT.LU WORM! Generic Service Process regsvc32.exe Added by the GAOBOT.UJ or GAOBOT.UL WORMS! Generic Service Process serv1ces.exe Added by the AGOBOT-JK WORM! Generic Services Process regsvc32.exe Added by the GAOBOT.SY WORM! Genie USB Monitor USBmonitor.exe Port monitor for an external USB hard drive. Required to enable access to the drive Geography TX 1.0 NT CompuSpeed.vbs Added by the NEWLEY-A WORM! Gerenciamento de arquivos do Windows Winmod32.exe Added by the DLOADER-WG TROJAN! german.exe winsystems.exe Added by the BAGLEDl-AE TROJAN! german.exe wintems.exe Added by the BAGLE-AS TROJAN! Gestionnaire de disques universel sysoobe.exe Added by the TOADER-A TROJAN! Get Smile getsmile.exe Puts smilie faces in your E-mail. Run manually when required GetRight Tray Icon GETRIGHT.EXE GetRight from Headlight Software - download manager for resuming downloads and choosing multiple download locations. The freeware version is/was spyware. The registered version isn't if you don't GetTheMusic rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related getwin winB_.exe Added by the BANKER-HS TROJAN! GhostSecuritySuite gss.exe Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools GhostStartService GhostStartService.exe Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard GhostStartTrayApp GhostStartTrayApp.exe System Tray access to Norton Ghost - added from the 2003 version GhostSurfDelSatellite DeleteSatellite.exe SpyCatcher spyware remover related. What does it do and is it required? GhostSurfDelSatellite DeleteSatellite.exe Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning, you'll w gigabit.exe gigabit.exe Added by the BEAGLE.U WORM! GigaByte Cheatle.exe Added by the SHODI.B VIRUS! Gilat SOM Enumerator dllhost.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system GilatFTC ftc.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system gimmygames [path to trojan] Added by the DLOADR-LN TROJAN! gimmysmileys gimmysmileys.exe Added by GimmySmileys ADWARE! GinaDll ntgina.dll Added by the ANIG.A WORM! GisdnLog gisdnlog.exe BT Digital Access USB Glass2k Glass2k.exe Glass2k is a small little program that allows Win2K/XP users to make any window transparent GLF Network Lan Monitor NPFMNTOR.exe Added by the RBOT-AGY WORM! Glide Glidew32.exe Cirque touchpad driver Global Startup WinDash.EXE Reported by Kaspersky Anti-Virus as IM-Worm.Win32.VB.q, may be related to the ATTECH-C WORM! GlobalSCAPE [random filename] Added by the RBOT-AYM WORM! GLSetIT32 msiexec16.exe Added by the OPTIX PRO TROJAN! GLSetIT32 isass.exe Added by a variant of the OPTIX PRO TROJAN! GLSetT32 smsiexec.exe Added by the OPTIX-D TROJAN! gluon gluon.exe In a gluon/bin sub-directory glv glv.exe Added by the DLOADER-NG TROJAN! GMedia2 GSM2.exe Malware downloader - detected by Kaspersky antivirus as Trojan.Win32.VB.ux GMedia2 GSMedia3.exe Malware downloader - detected by Kaspersky antivirus as Trojan.Win32.VB.ux Gmouse Gmouse.exe Amouse mouse driver - required if you use non-standard Windows driver features Gnetmous gnetmous.exe Genius NetScroll+ mouse driver - required if you use non-standard Windows driver features GNETMOUSE gnetmouse.exe Genius mouse driver - required if you use non-standard Windows driver features GNP Generic Host Process svchost.exe Added by the ZAPCHAS TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! GNP Generic Host Process svchost.exe Added by the ZAPCHAS-R TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup and is always located in the System32 folder. This worm file is foun GNP Generic Host Process svchost.exe Added by the ZAPCHAS-AA TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M gnub gnub.exe ?? Go!Zilla gozilla.exe Download manager for resuming downloads and choosing multiple download locations. Advertising spyware Go!Zilla Monster Downloads Go.exe Download manager for resuming downloads and choosing multiple download locations. Advertising spyware GoBack GBMenu.exe Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same f GoBack GBTray.exe System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes fa GoBack Polling Service GBPoll.exe Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same f GoBack Tray Icon GBTray.exe System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes fa GOG GOG.exe Added by the PHILIS.B VIRUS! goidr goidr.exe Goidr adware Goldensoft_MndlSvr MndlSvr.exe Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200 Golum services.exe Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! golumm services.exe Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in google google.exe Added by the RBOT-AMW WORM! Google Desktop Search GoogleDesktop.exe Google Desktop Search - "a desktop search application that provides full text search over your email, computer files, chats, and the web pages you've viewed. By making your computer searchable, Goo Google Earth [random filename] Added by the RBOT-AXK TROJAN! Google Earth Viewer GOOGLEMAPS.EXE Google Earth "combines satellite imagery, maps and the power of Google Search to put the world's geographic information at your fingertips" google Intrenet Explorer google.pif Added by the RBOT-ARA WORM! google toolbar ggtb32.exe Added by the AGOBOT-RR WORM! GoogleDCClient GoogleDCC.exe Google Compute Client - only present if you installed the Google Toolbar with "Google Compute" client active. Does complex calculations in the background when idle. If you want to turn it off go to you googletalk googletalk.exe Google Talk "enables you to call or send instant messages to your friends for free-anytime, anywhere in the world". Can be launched manually GoToMyPC g2svc.exe ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web brows GotSmiley GotSmiley.exe GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended gouday.exe readme.exe Added by the BEAGLE.C WORM!

N ? X X U U ? N X X N N X ? X N ? N X X X N U N U U X X Y N N U U ? X X U X X X U U U X U X X X U U X U U X N N U X U N X X U U ? N X X X X

GRA gramdate Graphic Driver Graphic Loader Gravis Appawareloader Gravis Xperience Driver Support GrdSys32 Greetings Workshop gremier Gremlin Grokster GrpConv GsAds Gscbc gshp Gsiconexe GsiFinal GSOrganizer gssomatic GStartup gsv Gtwatch Guard Guardian Guardian PC Security Tools GuruNet GustavVED gvagfxj gw port controller GWInkMonitor GWMDMMSG GWMDMpi gwum gyy G_Server.exe G_Server1.2.exe H/PC Connection Agent h4te Service Drivers hachimitsu-lemon hagent HalifaxHowardCluster HaMFrontPanel Handy Backup 3.9 Hard drive Controller Hardware Doctor Hardware Monitor Service Hardware Profile Hardware Profile Hardware Sensors Monitor Hare HATAPE HawkEye HawkEye IV Control Panel Hbinst HC Reminder HCDetect hcenter hclean32.exe Hcontrol HDAShCut HDAudio Driver 1.0 HDAudio Driver 2.0 HDDHealth HDDlife HDhelp HDtray he3bbcff he3e3fc4 HELLBOT TEST HELLBOT3

gra.exe Looks at system resources at startup and warns you if they have dropped. Contains links to the Disk Clean Up, Defrag and Start Up Menu. It does have a link to a startup configuration utility. Similar to m 2Stop.exe ?? smss32.exe Added by a variant of the RBOT WORM! ntvdm32.exe Added by a variant of the RBOT WORM! dbserver.exe Looks like it's associated with Gravis game controllers and the Keyset Manager, allowing the user to program the buttons for games that don't support them Grxp4exe.exe Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not GrdSys32.exe X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand? GWREMIND.EXE You really want to be reminded about somebody's birthday at the expense of resources? wscript.exe gpremier.vbs Added by the GPREMIER WORM! intrenat.exe Added by the DOOMJUICE WORM! Grokster.exe Grokster Peer-To-Peer File Sharing program grpconv.exe Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base a gms2.exe PacerD_Media/Pacimedia.com adware Gscbc.exe ?? zzgshp.vbs Homepage hi-jacker Gsicon.exe ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of c rundll32 gspndll.dll, postInstall finalUSB DSL modem related - [what does it do and is it required in startup? GSOrganizer.exe GoldenSection Organizer - personal information manager gssomatic.exe Searchcentrix hijacker GMT.exe Gator spyware component - see here gsv.exe Added by the ROBAL 1.0 backdoor TROJAN! gtwatch.exe Associated with a Mustec scanner and not required Guard.exe Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program CMGrdian.exe McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System Pfft.exe Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite GuruNet.exe GuruNet lets you click on any word on your screen to get the relevant information you want [filename].exe Added by the OPASERV.H WORM! rundll32 ...gvagfxj.dll Unidentified adware, spyware or virus PORTCT95.EXE From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties, the file is known as "Smart Thru Fax Driv GWInkMonitor.exe Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink, do you want to buy some! GWMDMMSG.exe Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly GWMDMpi.exe Used with internal modems on Gateway PCs such as the 450SX Notebook. Required for audio settings to be maintained and does not remain in memory once run. See here for more information gwum.exe Gigabyte utility manager. Loads if you have a Gigabyte motherboard and got a full bundle of utilities installed. Monitors CPU, fans, BIOS etc. Only used by system "tweakers" gyy.exe Possibly Gator (and therefore spyware) related? G_Server.exe Added by the FEUTEL-C TROJAN! G_Server1.2.exe Added by the GRAYBIRD-Z TROJAN! WCESCOMM.EXE Active sync for use with Windows CE based palm PC h4te.exe Added by a variant of the RBOT WORM! hachimitsu-lemon.exe Added by the HACHILEM TROJAN! avp.exe Added by the "Herman Agent" remote access TROJAN! skinkers.exe Howard the Weatherman desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages hampanel.exe Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget, but otherwise pointless hbagent.exe Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers hdcontroller.exe Added by the KIMAN.B WORM! Hwdoctor.exe Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds, voltages, temperatures. Only required if you're concerned about your sy mshms.exe Added by the WOLLF-A TROJAN! hxdef.exe Added by a variant of the LOVGATE WORM! hxdef.exe... Added by a variant of the LOVGATE WORM! hmonitor.exe Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems hare.exe Hare - improve and optimize performance of desktop/laptop PCs [path to trojan] Added by the BANKER-QF TROJAN! HAWK_95.EXE Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs HAWK_32.EXE Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs Hbinst.exe Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regar hc.exe For Compaq PC's. Help Compiler, crunches help database, will run without being in startup when needed HCDetect.exe MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification, d tgcmd.exe See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user inform hclean32.exe Wareout - malware masquerading as a spyware and dialer remover hcontrol.exe Hotkeys on an ASUS Notebook. Only required if you use the additional keys HDAShCut.exe High definition audio page shortcut - not required [random filename].exe Added by the TEADOOR-D TROJAN! [random filename].exe Added by the TEADOOR-E TROJAN! hddhealth.exe HDD Health is a "full-featured failure-prediction agent for machines using Windows 95, 98, NT, Me, 2000 and XP. Sitting in the system tray, it monitors hard disks and alerts you to impending failure" HDDlife.exe HDDlife checks the health of your hard drives at regular intervals and informs you about the results of these checks tbhdhelp.exe Associated with Philips Edge series soundcards. Is it required? HDtray.exe Philips Edge Series Control Panel Tray Utility - system tray icon for a Philips Edge series soundcards. Available via Start -> Settings -> Control Panel rundll32.exe [path] he3bbcff.dll, EnableRunDLL32 LZIO.com adware downloader rundll32.exe [path] he3e3fc4.dll, EnableRunDLL32 LZIO.com adware downloader 1hellbot.exe Added by the MYDOOM.BO WORM! coolbot.exe Added by the MYTOB.AB WORM!

X X X ? X X X X X X X X X X X X X X X X X U X N U X U U X N ? U X U X X U N U X N U X U X U N X X U U X X X X X U X X X N X N U ? X ? U U Y

hellodolly shost.exe Added by the YODO WORM! helloworld nb32ext2.exe Added by the MYDOOM.BV WORM! helloworld nb32ext3.exe Added by the MYTOB.JT WORM! Help helpext.exe ?? Help Temp Files netreg.exe Added by the FORBOT-EM WORM! helpctl.exe helpctl.exe Added by the GASLIDE TROJAN! Helper eschlp.exe Added by the BLASTER.T WORM! HELPER greece nm.exe AsdPlug premium rate adult content dialer variant HELPER Netherlands.exe AsdPlug premium rate adult content dialer variant HELPER new zealand.exe AsdPlug premium rate adult content dialer variant HELPER sweden.exe AsdPlug premium rate adult content dialer variant HELPER canada.exe AsdPlug premium rate adult content dialler variant HELPER france.exe AsdPlug premium rate adult content dialler variant HELPER temp532.exe AsdPlug premium rate adult content dialler variant helper.dll [path] rundll32.exe [path] helper.dllCnsMin (Chinese Keywords) hijacker related HelpExp.exe HelpExp.exe Attune HelpExpress - spyware. Disable and uninstall - see here helpmanager spoler.exe Added by the RANDEX.J WORM! helpw helpw.exe Adware downloader hen [filename].exe Added by the TARNO.G TROJAN! heomstool heomstool.exe Added by the HEOMS TROJAN! hErcUnes softhost.exe Added by the GARROCH WORM! Hermes Messenger DGDRHE~1.EXE A LAN messenger alternative to WinPopUp - Digital Dreams Software Hewlett Packard Manager hpmanager.exe Added by the MYTOB.KE WORM! Note - this is not a valid Hewlett-Packard program Hewlett Packard Recorder Remind32.exe HP multifunction registration Hf Hf.exe Hide Folders - hide your folders so only you can view them HF Security hfsecure.exe Added by the AGOBOT-TI WORM! hffsrv hffsrv.exe Hide Files & Folders is a "password-protected security utility working at the Windows kernel level allowing you to password-protect files and folders, or to hide them securely from viewing and searching hfxp hfxp.exe Hide Folders XP - hide your folders so only you can view them hgqhp.exe hgqhp.exe Added by the FLUSH.F TROJAN! HGTXPEI FirstReboot.exe Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel HiberMonitor HCount.exe ?? Hibernation hib32.exe Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate, etc. Required if you run of battery regul Hid.exe hid.exe Added by the RATSOU.B TROJAN! HideOE HideOE.exe HideOE - allows you to 'hide' Outlook Express or minimize it to the System Tray HideRun.exe Hiderun.exe and svhost.exe and pro.gif Added by the BOOHOO WORM! HideStyle Ante Browse Trust.exe IE toolbar taking you to Lop.com. If the exe is running, end it and remove the "Stupidmore" directory from C:Program Files hidserv hidserv.exe This is the Human Interface Device Server for Win98SE/2000/Me/XP, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia High Definition Audio Property PageHDAudPropShortcut.exe Shortcut Realtek audio card related - probably adds the odd feature to one of the "Sounds" Control Panel applet tabs - doesn't appear to be required HijackThis startup scan HijackThis.exe HijackThis lists the contents of key areas of the Registry and hard drive areas that are used by both legitimate programmers and hijackers. The program is continually updated to detect and remove new HijSrv32 hijsrv.exe Added by the BANKGERM-D TROJAN! HistoryKill histkill.exe HistoryKill removes your web surfing path by removing the URL drop-list history, detailed history file, cache, and cookies in both IE and Netscape Navigator browsers. Available via Start -> Programs Hitman Pro SurfRight Helper srhelper.exe Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy HitQ HitQ.exe Hijacker, for more information see here HitwarePKLite HITWAR~1.EXE Hitware Popup Killer Lite HIV HIV.exe Added by the HIVA TROJAN! hk hk.exe KeyLoggerExp keystroke logger/monitoring program - remove unless you installed it yourself! hkcmd hkcmd.exe Installed by the Intel 810 and 815 chipset graphic drivers. If the user wishes to have "HotKey" access to Intel's customised graphics properties, it is required, otherwise not. It can be disabled via the Dis HKEYok runlli32.exe Added by the QQPASS-U TROJAN! HKLM\Run windowsupdate.exe Added by the FORBOT-BJ WORM! (where HKLMRun represents HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun) hkserv HKserv.exe Keyboard manager program required to use programmable power and function keys on some laptops such as the Sony PCG R505TS hkss hkss.exe Compaq HotKey Support - multimedia keyboard support HLcleanup hlsetup2.exe LinkReplacer/FFinder adware hlhtxo.exe hlhtxo.exe Added by the QLOWZONES-27 TROJAN! HLL Data Parameter hllcxpa.exe Added by the RBOT.AFG WORM! HMI PowerSystem hmisvc32.exe Added by the RANDEX.CZZ WORM! HML PowerSource hmlsvc32.exe Added by the SDBOT-XL WORM! Hmonitor Hmonitor.exe Hardware sensor monitoring program. Only required if you overclock your system and want to check on the status HMV PowerSource hmusvc32.exe Added by the SDBOT-YW WORM! ho2stdll.exe ho2stdll.exe Added by the BANKER-HO TROJAN! HOI Services holsvc32.exe Added by the AGOBOT-SF WORM! Holiday Lights Holiday Lights.exe Holiday Lights from Tiger Technologies. Festive desktop enhancement that adds lights. Available via Start -> Programs Hollaback slvhosts.exe Added by the SDBOT.BMO WORM! Home Theater SchSvr SchSvr.exe WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs HomeAlarm HomeAlarm.exe Chameleon Clock - system tray clock replacement HomeCentre WakeUp LGWAKEUP.EXE Associated with the no longer supported Xerox HomeCentre printer/scanner Homeland Network HomelandNetwork.exe Homeland Network Notifier - pops ads, see their privacy policy Honor honor.exe ?? Hook99startup hk2re.exe Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons, bitmaps and can e HookSys HookSys.exe SurfinGuard Pro - protects against all malicious code delivered through executables, scripting files, ActiveX and Java HorngTech4D bally4d.exe HorngTech 4D mouse driver

X X X X U N X X X X X X X U U U ? X X X X U U N X X N X X X X X X U ? U N N N X N N X U U ? N N U N N N U ? ? ? N X ? N N U U U N U X ? N N

Host host Host Process hostdll.exe HostManager HostManager Hostren.exe hostserv hostserv HostSrv HostSrv HostSrv HostSVC syse Hot Corners Hot Key Kbd 2690 Daemon Hot Key Keybd 9910 Daemon Hot Party 22 HotAction_hr Hotbar Hotbar Hotfix Updat HotIDE HotkeyApp HotKeysCmds HotPix hotplug HotSync Manager hotwetlove Hot_Kiss Hot_Tarts Hot_Tarts_** Hot_Tarts_Au Hot_Tarts_mc HoverDesk hp 1000 firmware HP AutoIndexer HP CD Writer HP CD-DVD HP CD-Writer hp center hp center UI HP Component Manager HP Deskjet HP Digital Imaging Monitor HP Display Settings HP IDScheduler HP Image Zone Fast Start HP Info Express HP Instant Support HP Internet Center HP JetDiscovery HP JetSpeed Autostart HP Laser Jet Director HP Network Registry Agent HP OfficeJet Series xxx Startup HP OfficeJet Series xxx Startup HP Parallel Port Test HP Photo Manager HP Port Resolver HP Precision Scan HP Presentation Ready hp psc 2000 Series HP RecordNow HP ScanPatch HP ScanPicture HP SchedIndexer HP Service Drivers hp Silent Service HP Simple Trax HP software update

N/A help.exe mame.exe hostdll.exe AOLHostManager.exe AOLSoftware.exe Hostren.exe hostserv.exe wiz98.exe sachostx.exe sachostx.exe sachostx.exe... HostSVC.exe Hotc.exe SK9910DM.exe SK9910DM.exe hotpart22.exe hotaction_hr.exe Hbinst.exe HbOEAddOn.exe svdhost32.exe hotide.exe HotkeyApp.exe hkcmd.exe hotpix.exe hotplug.exe hotsync.exe hotwetlove.exe Hot_Kiss.exe Hot_Tarts.exe Hot_Tarts_**.exe Hot_Tarts_Au.exe Hot_Tarts_mc.exe HoverDesk.exe fwdl.exe hppautoindexer.exe hpcdtray.exe hpcdtray.exe hpcdtray.exe BACKWEB-*****.exe ShadowBar.exe hpcmpmgr.exe HP_DeskJet_500.exe hpqtra08.exe hpdisply.exe HPIDSCHD.exe hpqthb08.exe ?? matcli.exe SURFBRD.EXE HPJETDSC.EXE AUTOSTART.EXE hppdirector.exe hpnra.exe HPOSTR03.EXE HPOstr05.exe hppt.exe HPPhotoManager.exe hpbpro.exe hpmdlbwx.exe PresRdy.exe hpobnz08.exe ?? HPScanFix.exe hpsplmwa.exe hppschedindexer.exe hdsys.exe HpSrvUI.exe Hpcron.exe HPWuSchd2.exe

Added by the POPDIS or STARTPAGE.F TROJANS! Identified as the DELF.LF by Ewido Security Suite Added by the RBOT-APO WORM! Added by the BANKER-BO TROJAN! Manages a component essential to the operation of most current AOL software. If you remove it from startup it will load when IE is launched, increasing lauching time Quoted from AOL Beta Team, "Manages a component essential to the operation of most current AOL software, client or not. You should be able to remove it from Startup (it'll just load when Explorer is l Added by PWS.BANKER.F, a variant of the BANKER-BO TROJAN! Added by the RBOT.BPZ WORM! Added by a variant of the SDBOT WORM! Added by the LOOKSKY.H WORM! Drops multiple files in the System (9x/ME) or System32 (NT/2K/XP) folders Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMs! Added by the LOOKSKY.E WORM! Added by the RBOT-ANZ WORM! Hot Corners - "lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen" Multimedia keyboard manager - required if you use any special keys Multimedia keyboard manager - required if you use any special keys ?? Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "HotAction_hr" Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regar Hotbar adware Added by the GAOBOT.ZW WORM! HotIDE allows Acer TravelMate owners to hot-swap external drives without switching of their notebooks Programmable keys on Acer, Fujitsu and other laptops Installed by the Intel 810 and 815 chipset graphic drivers. If the user wishes to have "HotKey" access to Intel's customised graphics properties, it is required, otherwise not. It can be disabled via the Dis Adult content dialler Added by the SILLYDL TROJAN! Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start -> Programs Adult content dialler. Will not uninstall - components have to be manually deleted Adult content dialler Adult content dialler Premium rate adult content dialer (where * is a random char) Premium rate adult content dialler HotTarts adult content dialer HoverDesk - desktop replacement software HP LaserJet 1000 related. Is it a driver or automatic firmware update (based upon the filename)? Installed by HP multi-function printer driver software, related to PC faxing. If you are not using the PC faxing feature you can go ahead and disable these services from the startup System Tray access to a HP CD-Writer's functions. Available via Start -> Programs System Tray access to a HP CD-Writer's functions. Available via Start -> Programs System Tray access to a HP CD-Writer's functions. Available via Start -> Programs See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer own User Interface for HP Center - see here Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error "Windows can't shutdown the computer because hpcmpmgr.exe can't be ended" Added by the FORBOT-DA WORM! System Tray access to HP Director. Required if you prefer to use the all-in-one buttons to manually scan documents or transfer photos froma camera, for example Sets default display settings. Unchecking this item has been reported to cure a "Problem sending command to keyboard" error message HP Instant Delivery Scheduler Improves the startup time of HP Image Zone. If you disable it, HP Image Zone takes a long time to start up only the first time you run it. Subsequent startups are much faster than the first time On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file. HP Instant Supp Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them HP JetAdmin software which monitors printing jobs on a network environment Autostart executable for the old multiplayer game HP Jetspeed System Tray icon that opens various functions such as copy, fax, email, scan, copy plus, etc. Right-click on it and you see a few options such as the preceding bar plus About, Help, ToolBox, Exit, etc ?? xxx represents the series number - such as 700. What does it do and it it required? xxx represents the series number - such as 700. What does it do and it it required? Associated with a HP ScanJet scanner Added by the SDBOT.AXU WORM! ?? HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device" System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start From HP "Software for the CD writer. Do not prevent from starting unless the CD writer is never going to be used." Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used, then it is safe to remove or prevent from starting HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required Installed by HP multi-function printer driver software, related to PC faxing. If you are not using the PC faxing feature you can go ahead and disable these services from the startup Added by the SDBOT-ZE WORM! HP related Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon HP software updates. If a shortcut doesn't exist create your own and run it manually

N N N ? U N ? N N ? N N N N U U U U N U N U U U U U ? U X N N ? N ? X Y U U Y U U X N N N Y Y X N U ? U ? N N X U N U N U N X X U U X X X X

HP software update HPWuSchd.exe HP software update HPWuSchd2.exe HP Status hpstatus.exe HP Status Server hpboid.exe HP TV Now HpTvNow.exe HP Updates ?? HP Visualize Init HpVisIni.exe HP-Aio Flight Remind32.exe hpaiodevice hpodev07.exe HPAiODevice(hp officejet g series) hpoavn07.exe HPAiODevice(hp psc 900 series) -1 hpobrt07.exe HPAIO_PrintFolderMgr hpoopm07.exe HPBootOp HPBootOp.exe hpcmpmgr hpcmpmgr.exe HPDJ Taskbar Utility hpztsbol.exe HPDJ Taskbar Utility hpztsd02.exe HPDJ Taskbar Utility hpztsb04.exe HPDJ Taskbar Utility hpztsb05.exe hpfsched hpfsched.exe HPGamesActiveMenu ActiveMenu.exe hpgs2wnd hpgs2wnd.exe Hpha1mon Hpha1mon.exe HPHAxMON HPHAxMON.EXE HPHmon** HPHMON**.EXE HPHmon03 hphmon03.exe HPHmon04 hphmon04.exe HPHmon05 hphmon05.exe HPHmon06 hphmon06.exe Hphome hphome.js HPHUPD** hphupd**.exe hphupd04 hphupd04.exe HPHUPD05 hphupd05.exe HPHUPD06 hphupd06.exe hpjsiroute hpjsira.exe HPl Services hmlsvc32.exe HpLamp HPLAMP.EXE hplampc hplampc.exe HPLaptopGamesActiveMenu ActiveMenu.exe HPLJ Config SetConfig.exe HPLogiFinder hp_finder.exe HpMmKbd HpMmKbd.exe HPNT hpdll.exe hpodblia hpodblia.exe hpoddt01.exe N/A hpodlb08 hpodlb08.exe hpotdd01.exe hpotdd01.exe hpppta HPPPTA.exe HpPrinter hpserver.exe HPPROPTY HPPROPTY.EXE HPPWRSAV HPPWRSAV.EXE hpqcmon hpqcmon.exe HPSCANMonitor hpsjvxd.exe hpScannerFirstBoot scannerfb.exe hpsjbmgr hpsjbmgr.exe HPStart hpstart.wsf hpsysconf1 [random filename] hpsysdrv hpsysdrv.exe HPU ProvenTactics.exe hpWirelessAssistant HP Wireless Assistant.exe HPZTS04 hpzts04.exe hpztsb07 hpztsb07.exe HP_dla dlatray.exe HQI Services hqisvc32.exe HQI Services hqlsvc32.exe HR Hr.exe HREF.OCX regsvr32.exe ....HREF.OCX Hrn_qtv hrnsvc32.exe hsim isearch.exe hsim sexgame.exe hsim toolbar.exe

HP software updates. If a shortcut doesn't exist, create your own and run it manually HP software updates. If a shortcut doesn't exist, create your own and run it manually HP Printer Status and Alerts Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required? Application supplied with HP notebooks. It activates the S-Video port and is said to improve the quality of the output signal (resolution/timeouts) On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb HP Visualize software related. What does it do and is it required? HP multifunction registration Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installatio HP Printer related, reportedly lets file transfers from an HP device pass files through Windows firewall. Is it required? Installed with a Hewlett Packard 900 series colour printer, scanner, fax, photo card slot printer, copier. Assumed to perform an identical function to the hpaiodevice entry Directly from HP: "This process has one purpose - detects if the device moves to a different port, and notifies other processes to look on the new port." For various HP all-in-one printer/scanner/copier de HP Boot Optimizer - - what does it do? Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error "Windows can't shutdown the computer because hpcmpmgr.exe can't be ended" (1) Ghostscript device driver for printers understanding Hewlett-Packard's Printer Command Language - see here for more info or (2) Creates 1 or all 3 icons on taskbar. The 1st one has a yellow border (1) Ghostscript device driver for printers understanding Hewlett-Packard's Printer Command Language - see here for more info or (2) Creates 1 or all 3 icons on taskbar. The 1st one has a yellow border (1) Ghostscript device driver for printers understanding Hewlett-Packard's Printer Command Language - see here for more info or (2) Creates 1 or all 3 icons on taskbar. The 1st one has a yellow border (1) Ghostscript device driver for printers understanding Hewlett-Packard's Printer Command Language - see here for more info or (2) Creates 1 or all 3 icons on taskbar. The 1st one has a yellow border HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not wan Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collec HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites. Available via Start -> Programs Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature and known to cause system crashes in some cases. "x" ca Monitors the status of the memory card reader slot on a HP printers and displays a tray icon if a memory card isn't inserted. Also creates a virtual drive and assigns it the first available drive letter - whic Related to the Hewlett-Packard Photosmart's configuration and diagnostics module Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature ?? Related to the Hewlett Packard software HP Photosmart printer, it provides easy access to flash card reading functions. This program is not essential to the running of the system. Your choice Homepage hijacker HP software update checker and wizard launcher. ** represents the version number. Available via Start -> Programs HP Photosmart software update checker and wizard launcher. Available via Start -> Programs ?? Belongs to the HP Photosmart application and is responsible for keeping this software upto date. This program is not essential to the running of the system Related to HP laserjet printers and IP addresses. An IP address is appended to the name field - ie "hpjsiroute192.168.1.2" Added by the AGOBOT-SI WORM and variants! HP Scanner Utility that controls your scanner's light bulb. Needed if it's switched on. Also refer here for troubleshooting HP Scanner Lamp Utility - fixes an issue with the scanner lamp not going off Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collec Connects system to networked HP printer. HP LogiFinder helps detect and allows the use of the centre button for the Logitech mouse. Can be disabled if not used HP's multimedia keyboard driver which enables the end-user to use the automation features of the HP multimedia keyboard Malware - detected by Kaspersky antivirus as Trojan-Downloader.Win32.VB.ku HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Installed by the "HP Photo and Imaging Director" software. If you ask for the imaging software, this program will be started HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Detection of new imaging, printing and other peripherals on HP machines such as USB printers, cameras and Bluetooth products. "This program is a non-essential process, but should not be terminated HP parallel port driver for certain hardware Added by the CMJSPY-W TROJAN! HP LaserJet Toolbox Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com, pick your OS option under the From HP and related to digital imaging HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner HP scanner related HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup, unless the scanner is used eve This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot Added by a variant of the VIVIA.A TROJAN! This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Man Proven Internet Marketing software The HP Wireless Assistant is a user application that provides a way to control the enablement of individual wireless devices (such as Bluetooth or WLAN devices) and that shows the state of the radios fo Hewlett Packard printer toolbox shortcut that resides in the system tray HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer On HP PCs, tray icon for dla - which provides drive letter access to HP's and Veritas' version of DirectCD Added by the AGOBOT-RO WORM! Added by the AGOBOT-RP WORM! HiddenRecorder periodically takes screenshots of the computer. If you didn't install this yourself remove it HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller Added by the SDBOT-AET WORM! Unidentified malware Unidentified malware Unidentified malware

U U U X X U X X X X X X X X X X X X X X X X X ? X X X Y X X X X X U U U X X X X X X ? U U Y X ? U X X X ? N ? U ? U ? Y U U Y X X X X N X U

HSLAB Logger logger.exe HSLABLogger logs user activity and Internet activity. The gathered information can be sent to a predetermined email address. If you didn't install this yourself uninstall it HSTrans hstrans.exe Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielse Hti npdor.exe Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required HTML Help System hhs.pif Added by the RBOT-ATB WORM! HTML32 Help System hhs32.pif Added by the RBOT-ATE WORM! HTpatch htpatch.exe HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6% HtProtect AVprotect.exe Added by the NETSKY.L WORM! http://www.lienvandekelder.be LienVandeKelder.exe Added by the MYTOB-AZ WORM! http://www.lienvandekelder.be Lien Van de Kelder.exe Added by the MYTOB-AP WORM and variants! http://www.lienvandekelder.be Lien Vande Kelder.exe Added by the MYTOB-AQ WORM! http://www.lienvandekelder.be Lien vd Kelder.exe Added by the MYTOB-M WORM! http://www.lienvandekelder.be Lien.exe Added by the MYTOB-CZ WORM! http://www.lienvandekelder.be Lientjeuh.exe Added by the MYTOB-P WORM! http://www.lienvandekelder.be LienVdK.exe Added by the MYTOB-U WORM! http://www.lienvandekelder.be Van de Kelder Lien.exe Added by the MYTOB-BF WORM! http://www.lienvandekelder.be We Love Lien Van de Kelder.exe Added by the MYTOB-CV WORM! http://www.lienvandekelder.com Lien Van de Kelder.exe Added by the MYTOB-EQ WORM! http://www.lienvandekelder.com/ LienVandeKelder.exe Added by the MYTOB-EO WORM! httpd c_pan.exe Added by a variant of the DELF-A TROJAN! httpd deamon.exe Added by the TACTSLAY.C TROJAN! httpd msgaol.exe Added by the TACTSLAY.C TROJAN! httpd s menu.exe Added by the TACTSLAY.C TROJAN! https-ssl https.exe Added by the MOEGA.D WORM! huhdir huhdir.exe ?? huigezi HgzServer.exe Added by the GRAYBIRD.C TROJAN! Hvid Hvid.exe Added by the GEMA TROJAN! HWINFO* HWINFO* Added by the PUROL WORM! where * is a random character HWinst N/A For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Hwp system_wc.exe Added by Eziin adware hws hws.exe Added by the STARTPA-CT TROJAN! hxadsec [path to trojan] Added by the ADCLICK-AP TROJAN! HXDL.EXE HXDL.EXE Attune HelpExpress - spyware. Disable and uninstall - see here HXIUL.EXE HXIUL.EXE Attune HelpExpress - spyware. Disable and uninstall - see here HydarVisionDesktopManager desk95.exe ATI's HydraVision desktop management software, allowing for multi-monitor support, as included in ATI HydraVision versions 2.5 and earlier. Has been reported to cause problems, such as this one. Hyd HydraVisionDesktopManager desk98.exe ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup HydraVisionViewport viewport.exe ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup Hyper Start instantmsgrs.exe Added by the RBOT-NH WORM! I am not Ranky. I am eTunnel! msyervice.exe Added by an unidentified WORM or TROJAN! I am not Ranky. I am eTunnel! winsys.exe Added by an unidentified WORM or TROJAN! I-Worm.GiGu uGiG.eXe Added by the GINK WORM! I/O Controllers svcnet.exe Added by the TIBIK-B TROJAN! I386 I386.exe Added by the MYPOWER WORM! I81SHELL I81SHELL.exe Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard i8kfangui i8kfangui.exe Graphical interface for fan speed control IAAnotif iaanotif.exe IAA Event Monitor User Notification Tool - part of Intel(r) Application Accelerator - "a performance software package for desktop PCs using select Intel(r) chipsets" that "replaces the ATA drivers that com iamapp iamapp.exe AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago, it's now the Norton Personal Firewall executable as well Iamnacho On Irc.MusIrc.com Is a Homosexual! XBox64.exe Added by the RANDEX.Y WORM! Iap iap.exe Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the c ias ias.exe InvisibleASpy keystroke logger/monitoring program - remove unless you installed it yourself! IASHLPR IASHLPR.EXE Added by the OPASERV.T WORM! ibin [path to trojan] Added by the PERDA-C TROJAN! ibm ibm.exe Added by the LEGMIR-AH TROJAN! IBM Warranty Notification ERTS0749.exe IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? ibmmessages ibmmessages.exe Allows IBM to push messages onto users' computers. Quote: "The Access IBM Message Center can display messages to inform you about software and solutions available from IBM as well as messages f Ibmmon.exe Ibmmon.exe ?? Ibmpmsvc ibmpmsvc.exe Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn, F3, F4 & F12 - which have specific functions to control the standby IBMPRC ibmprc.exe IBM application - what does it do and is it required? IBMUltraBayHotSwapCPLLoader IBMBAY2N.EXE Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops IBMUltraBayHotSwapSound IBMBAYSN.EXE Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound? IBM_PWMGR pwmgr.exe IBM Password Manager IBWin Background process IBackground.exe IBackup for Windows IBWin Monitor IBMonitor.exe IBackup for Windows IcaBar icabar.exe Related to Citrix MetaFrame icasServ icasServ.exe Browser hijacker, redirecting to Searchforfree.info. Also detected as the ICASERV-A TROJAN! ICcontrol iccontrol.exe Added by the ICcontrol premium rate adult content dialer icdd7ee6 rundll32.exe [path] icdd7ee6.dll, EnableRunDLL32 LZIO.com adware downloader icddefff rundll32.exe [path] icddefff.dll, EnableRunDLL32 LZIO.com adware downloader ICH Synth eusexe.exe Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analo icifati yujixit.exe Added by the SDBOT.ZZH WORM! iClean iClean.exe IEClean - "advanced, comprehensive package of tools which perform a number of functions to allow you to control your online privacy"

Y N N N N N X X Y U N X N N X X X X N X X X N X X X X X X U N Y N N X X ? X X X U N X N X U X X U X X X X X X X X X X N X X X U X X X X X X

ICM ICM.EXE Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voi iCn NAG.EXE iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy, if they exist ICO ICO.EXE Found on a Sony Vaio laptop and seems to be related to Mouse Suite 98 Daemon according to the properties. Appears to cause a behaviour where the desktop suddenly flips back up when playing Direc Icon Animation HDE.EXE Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons Icon Hearit 95 hearit95.exe Audio desktop customization utility from Moon Valley Software. Resource hog Icon Hearit 98 hearit98.exe Audio desktop customization utility from Moon Valley Software. Resource hog Icon lptt01 icon.exe RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Icon ml097e icon.exe RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here ICONCLNT iconclnt.exe APC PowerChute Tray Icon. Associated with the UPS listing ICONDESK ICONDESK.EXE Small utility which will allow you the option of hiding or showing your desktop icons Iconfig.exe Iconfig.exe Icon for LS-120 "Superdisk" iConfigLoader DIIhost.exe Added by the GAOBOT.AO WORM! Iconoid Iconoid.exe Iconoid is a desktop icon manager Iconsaver Iconsaver.exe IconSaver is a desktop icon manager ICQ ICQNET.vbs Added by the GORMLEZ-A WORM! ICQ Center [path to worm] Added by the RANDIN WORM! ICQ Chat Service icqjdhs.exe Added by a variant of the RBOT WORM! ICQ Hacking Pro ICQpro.exe Added by a variant of the NETSPY TROJAN! ICQ Lite ICQLite.exe ICQ Lite - compact version of the popular messaging program ICQ Lite Messenger [random filename] Added by an unidentified VIRUS, WORM or TROJAN! Unlike the legitimate ICQ Lite executable, which will be located in the ICQLITE folder in Program Files, this particular impostor is located in the Window ICQ Messenger 2002 ICQ2002.exe Added by the SDBOT-ABL WORM! ICQ Net winlogon.exe Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup! ICQ Plus vplus.exe ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs ICQNet winlogon.exe Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the icrosof Avps32 Control av32.pif Added by the RBOT-AVC WORM! icrosoft Visual plscx.exe Added by the RBOT-AYO WORM! icrosoft Visual InterDevc zvslmqb.exe Added by the RBOT-AYP WORM! icrosoft Windows DLL Services Configuration poker3.exe Added by the SDBOT-AER WORM! icrosoftf Avpx Control avpx.exe Added by the RBOT-AYN WORM! ICSDCLT rundll32.exe Icsdclt.dll, ICSClient Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines ICServer Icserver.exe Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations ICSMGR ICSMGR.EXE Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers IC_KEY_3 spvic.exe Instant Chess related ID Commander IDCom.exe Caller ID utility for identifying incoming telephone numbers ID8525 ID8525.exe Added by the ID8525.A TROJAN! ID8525 id85255.exe Added by the ID8525.A TROJAN! IDA IDA.EXE HP related - in a Program FilesHewlett-PackardPC COE folder IDE ide.exe Added by the ASSASIN.F TROJAN! IDE Loader IDElibr32.exe Added by the XILON TROJAN! Related to the game "Diablo II" idecntl idecntl.exe Added by a variant of the CRYPTER.C TROJAN! iDesktop idesktop.exe Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse IDMan IDMan.exe Internet Download Manager - download files faster, schedule and resume IDTemplates IDTemplate.exe Added by the BRONTOK-H WORM! IDW Logging Tool idwlog.exe Added with WinXP SP1. Usually only found in internal builds only to indicate the current build being used. Can cause slow network logon problems IE configure explorer.exe Added by the LINEAGE-C TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! IE Doctor IEDoctor.exe IE Doctor Toolbar - "IE Doctor can help you to Repair IE easily, protect IE and OE from all malicious changes. It can Repair the HomePage, context menu, IE toolbar button, startup items, Favorites, typed IE Java Update iejava.exe Added by the AGENT-HD TROJAN! IE Menu Extension toolbar rundll32.exe [path] tbextn.dll DllShowTB Topconverting.com/180Search "IEMenuExtension" toolbar IE New Window Maximizer iemaximizer.exe IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows IE Runtime wini.exe Added by the PICRATE.B WORM! IE Runtimes winis.exe Added by the a href="http://www.sophos.com/virusinfo/analyses/w32rbotadz.html" target=_blank>RBOT-ADZ TROJAN! IE**.exe [* = random char] IE**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log IE**32.exe [* = random char] IE**32.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log IE6 wkstmg.exe Added by a variant of the SDBOT WORM! IE6 ssmss.exe Added by the GAOBOT.DXO WORM! IE6 porn.pif Added by the RBOT-ATF WORM! IEACCESS temp532.exe AsdPlug premium rate adult content dialer variant IEACCESS surfya.exe IEAccess premium rate adult content dialer variant IEAgent update check iewatch.exe Added by the BOMKA TROJAN! iecheck iecheck.exe Integrity checker for IconEdit2 icon editor. It serves for IconEdit2 internal tasks only and can be safely deleted from the system if you are running the latest version of IconEdit2 IECheck MSDTCs.exe Added by the TIRBOT-D WORM! IECheck xpssl.exe Added by the TIRBOT-E WORM! IECheck mssvp.exe Added by the TIRBOT-G WORM! IECleanAux Ieboot6.exe IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc. Performs cleaning tasks at startup iedll iedll.exe Homepage hijacker, redirecting to coolwwwsearch.com IEDriver IEDriver.exe Installed as part of adware (Cydoor) based peer-to-peer file sharing software called URLBlaze IEDriver xplore.exe IEDriver adware variant IEDriver TD.exe IEDriver adware variant IEengine IEeng.exe STARTPAG.AI hijacker ieexec.exe ieexec.exe Added by an unidentified WORM or TROJAN!

X X X X X X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X U X X N ? X ? X X X N Y Y U X X ? U N X Y N U U X X X N X N N N N X U

IEFeatures IEFeatures IefxTray ieharv.exe Iehelper iel2cde8 ielcaabe IELoader32 Iesar Iesearch.exe iestart ietsr ieupdate ieupdate IEXPL0RER iexpl0res Iexploit Iexplore IEXPLORE IExplore IExplore Iexplore Services IEXPLORE.EXE IEXPLORE.EXE IExplorer IExplorer IEXPLORER Iexplorer iexplorer lptt01 iexplorer ml097e Iexplorer.exe IExplorer32 Java Scripting IExplorer32c Java Scripting IExplorer6 Java Scripting IExplorer7 Java Scripting IFSplash.exe igamatu igamatu igfxtray Iglpbv igsex2x iHP-100 iilc Iinl iisvers iIWiper IJ75P2PSERVER IKE Service 95 iKeyWorks iLLeGaL iLLeGaL.exe ILO_Office_Manager iLyric iM Start Center Image Image & Restore Image Transfer ImageDrive-{hex numbers} Imagefox Imagemgt32 ImagePath IMAPI iMarkup Client IMClass imekrig IMEKRMIG6.1 Imesh Imesh Auto Update IMEvtMgr.exe ImgIcon

IEFeatures.exe Added by the POPMON.A TROJAN! - also known as PopMonster adware Internetfeatures.exe Added by the POPMON.A TROJAN! - also known as PopMonster adware IefxTray.exe Added by the RILER-H TROJAN! ieharv.exe Added by the BANKER-HH TROJAN! syslaunch.exe Outwar adware downloader rundll32.exe [path] iel2cde8.dll, EnableRunDLL32 LZIO.com adware downloader rundll32.exe [path] ielcaabe.dll, EnableRunDLL32 LZIO.com adware downloader iexplore32.exe Added by the SPEX or SPEX.B WORMS! Iesar.exe Browser hijacker - redirecting to an adult web page Iesearch.exe LookNSearch adware iexp1orer.exe Added by the NEMOG.C TROJAN! ietsr.exe IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc MCP****.exe [**** = random char] Added by the ASOXY TROJAN! mcpdll32.exe Adware downloader trojan IEXPL0RER.EXE Added by the AGOBOT-QL WORM! Note the filename has a "0" rather than an upper case "o" iexpl0res.exe Added by the RBOT.AEX WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot Iexploit.html Added by the INKER.B WORM! iexplore.exe Added by the BOXER TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in iexplore.exe Added by the APHEXDOOR TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally fig IEXPLORE.EXE Added by the DLOADER-YZ TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally fi IEXPLORE.exe Added by the DLOADR-AAM TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally f iexplore.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should [path to trojan] Added by the BANCOS-CJ TROJAN! goot.exe Added by the BIFROSE-C TROJAN! Iexplor32.exe Added by the BDOOR-BY TROJAN! IExplorer.EXE Added by the BANCOS-CH TROJAN! msiecfg.exe Added by the JU or BANCBAN-IP TROJANS! explorer.exe Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added iexplorer.exe RapidBlaster variant (in a "iexplorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here iexplorer.exe RapidBlaster variant (in a "iexplorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Iexplorer.exe Added by the BANCBAN-EN TROJAN! IExplore32b.exe Added by the RBOT.ABO WORM! IExplore32cb.exe Added by the RBOT.ABN WORM! IExplore326.exe Added by a variant of the SDBOT WORM! IExplore327.exe Added by a variant of the SDBOT WORM! IFSplash.exe I-FORCE driver for force feedback steering wheel ekor.exe Added by the SDBOT.AQ TROJAN! atecaca.exe Added by the IRCBOT.R WORM! igfxtray.exe Quick access to the control panel via a System Tray icon for graphics based upon the Intel chipsets (ie, i810). These chipsets are often included on motherboards. Available via Start -> Settings -> Cont Iglpbv.exe ?? igsex2x.exe NewDial premium rate adult content dialler iHPDetect.exe Drive Letter Searcher, iRiver iHP-100 iHP and H Series player related - does it need to start with Windows every time? IILC.EXE Homepage hijacker iptl.exe PurityScan/Clickspring adware iisvers.exe Added by an unidentified TROJAN or adware Systemwiper.exe System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis IJ75P2PS.EXE Printer utility which is required in order to make the printer work correctly IKEService.exe Associated with PGP. The PGP Tray can be disabled, but without IKESERVICE you won't be able to de- or encrypt anything IKEYMAIN.EXE A4Tech wireless keyboard driver and utility Mplayer.exe Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename Mplayer.exe Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename IntEdReg.exe /OFFMAN Intense Educational Ltd - Language Office Software. Is it required? iLyric.exe iLyric plugin for Winamp media player. Allows you to retrieve the lyrics for your songs with the press of a button iM_Tray.exe Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner rundll32 image.dll, Install CoolWebSearch parasite variant IMAGE32.exe Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased, if Image was recently run SonyTray.exe Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually ImageDrive.exe Nero ImageDrive from Ahead - virtual CD/DVD drive software imagefox.exe ImageFox 2.0 is an "add-on" graphics previewer for most Windows Open/Save As dialog boxes Imagemgt32.exe Added by the GEMA TROJAN! taskbarmngr.exe Added by the SDBOT-XB WORM! load.exe Added by the DOWNDEL-A TROJAN! iUtil.exe Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs Svhosl.exe Added by an unidentified WORM or TROJAN! imekrig.exe Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) IMEKRMIG.EXE Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) ?? Imesh is a file sharing system ?? Update check for the Imesh file sharing system. Turn the update off under "options" IMEvtMgr.exe Added by the KEYLOG-AR TROJAN! ImgIcon.exe Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If y

X N N ? U N U X X X Y N N N N X U X N X X X X X X X U ? U U X X X U X U ? X U X U X X X Y X N N Y Y U ? X X ? N U X X ? X U X X X X X X X N

imgit ImgStart Imjpmig*.* immcheck.exe IMOL Imonitor IMStart IMwire im_autorn im_autorn InCD IncMail InControl Desktop Manager Incredimail Incredimail Index Service Index Washer Indexindicator IndexSearch ine Inet DataBase Inet Delivery Inet Delivery Inet Delivery Inet Delivery Inetapi inetcntrl InetConf Inetd inetinfo.exe inetinfomon manager inetmgr InetMSN Info Select Info32x InfoPenMSN Infoplay.exe Information Update Infra-red Monitor infus Infuzer infwin Init32 Initial Page Initialize8x8 injob Ink Monitor InkWatch InoRPC InoRT InoTask insCOA5 InstaFinderK Install Install Pending Files InstallAurealDemos InstallBuddy Installed shell32.dll Installer InstallNAIProduct Installs SP2 Installstub Instance 001 Instant Access Instant Access Instant Access Instant Access Instant Access Instant Access Instant Update Center

[path to file] Added by the BANKER-EM TROJAN! ImgStart.exe Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs IMJPMIG.EXE Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Korean and this one is Japanese). *.* represents the version number immcheck.exe Related to I-FORCE driver for force feedback steering wheel? IMOLApp.exe IncrediMail for Office Outlook Add-On Plguni.exe McAfee QuickClean 3.0 - removes internet clutter and unwanted programs IMStart.exe InterMute security software related imwireup.exe SafeSurfing adware variant im_1.exe Added by the IMAV.A WORM! im_2.exe Added by the BAGLEDL-BO TROJAN! incd.exe Ahead InCD packet writing software - similar to DirectCD. For Nero 5.0 or 5.5 (InCD3), it does not need to start with Windows. You can run InCD.exe manually before inserting an appropriately formatted IncMail.exe IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits DMHKEY.EXE For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs incredimail.exe IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits IncMail.exe IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits dllhost32.exe Added by the AGOBOT.CH WORM! WashIdx.exe Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherw Indexindicator.exe Added by the LAZAR TROJAN! IndexSearch.exe Associated with PaperPort scanner software from ScanSoft svchosts.exe Added by the RBOT.BNL WORM! Inetdbs.exe Added by the QEDS WORM! Intdel.exe Spyware intdel_2.exe Spyware inetdl.exe Inet Delivery adware inetdl_2.exe Inet Delivery adware Netapi.exe Added by the NETDEVIL.14 TROJAN! inetcntrl.exe Bsafe Online - internet filter inetconf.exe ?? INETD32.EXE Windows Inet Daemon from Hummingbird Communications. "Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons". inetinfo.exe Executable used by MS Internet Information Server (IIS). If it's running, then so is IIS. Useful in knowing whether you require the patch for the Code Red worm. Comes with PWS (Personal Web Server) or inetinfomon.exe Added by the DONBOMB.A TROJAN! inetmgr.exe Actual Names (AdvSearch) Internet Keywords parasite msnet.exe Added by a variant of the SDBOT TROJAN! is.exe Info Select from Micro Logic - personal information manager Info32x.exe Added by the GEMA TROJAN! InfoPenIM.exe InfoPenMSN is a MSN Messenger plugin that allows you to send data written/drawn by hand Infoplay.exe Written by New Media Properties, LLC and you're asked if you want to download and install it if you visit one of their search engine websites (which I chose not to). What does it do and is it needed? iu.exe Reported by Kaspersky Anti-Virus as Downloader.Win32.Centim.ch TROJAN! Note - the file associated with this is located in the Program FilesInformation Update folder IRMON.EXE System Tray access to infra-red devices. Not required unless you use infra-red devices infus.exe Adult content dialler Infuzer.exe Infuzer - "is a service that copies dates from the web or an email straight to your electronic calendar". Beware of the following adware trait - "Infuzer provides web site owners with a unique opportunity infwin.exe VX2.Transponder parasite updater/installer related Init32.exe Added by the WINEX.A TROJAN! install.exe EasySearch browser hijack installer 8x8_init.exe Tool that initializes a Pinnacle PCTV card - maybe in capture or in showing overlay injobs.exe Added by the BINJO TROJAN! InkMonitor.exe Associated with Epson (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line InkWatch.exe Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line InoRpc.exe Associated with eTrust Antivirus/InoculateIT InoRT9x.exe Associated with the Realtime Monitor of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. For NT/2K/XP users you may need a patch if seeing high CPU useage - see here InoTask.exe Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine sca insCOA5.exe ?? InstaFinderK inst.exe InstaFinder adware Install.exe Added by the BANCBAN-HG TROJAN! sifxinst.exe Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required? InstallAurealDemos.js Used to initialize the Aureal A3D demos InstallShield wizard Ibtna.exe InstallBuddy - automatically translates and installs your desktop documents, such as Adobe PDF, HTML, Microsoft Word, Excel and PowerPoint files, to your Palm organizer when you HotSync Office.exe... Added by a variant of the LOVGATE WORM! dial.exe Malware - detected by Kaspersky antivirus as the AGENT.MM TROJAN! SETUP.EXE Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" wa [path] repcale.exe [path] palsp.exeAdded by a variant of the RANDON.AN WORM! installstub.exe Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone [path to worm] Added by the Alasrou-A WORM! rundll32.exe EGDHTML_1023.dll, InstantAccess Electronic_Group/InstantAccess premium rate adult content dialer variant rundll32.exe eg_auth_****.dll, InstantAccess Electronic_Group/InstantAccess [**** = digits] premium rate adult content dialer variant rundll32.exe EGCOMLIB_****.dll, InstantAccess Electronic_Group/InstantAccess [**** = digits] premium rate adult content dialer variant rundll32.exe EGCOMSERVICE_****.dll, Electronic_Group/InstantAccess InstantAccess [**** = digits] premium rate adult content dialer variant rundll32.exe EGDACCESS_****.dll, InstantAccess Electronic_Group/InstantAccess [**** = digits] premium rate adult content dialer variant rundll32.exe p2esocks_****.dll, InstantAccess Electronic_Group/InstantAccess [**** = digits] premium rate adult content dialer variant reminder.exe From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it keeps re-checking itself when using MSCONFIG. P

U U N U X X N X X ? X X U U U U N X X X X X U X X X U U U U Y N ? X Y X X X X X X X X X N X X X X X X U U X X X X U X X X X X X X X X X X U

Instant Wireless Configuration Utility WUSB11cfg.exe Instant Wireless Configuration Utility WPC11Cfg.exe InstantAccess INSTAN~1.EXE InstantDrive InstantDrive.exe InstantPleasure instantpleasure.exe InstantPleasureXXX instantpleasurexxx.exe InstantTray PCLETray.exe instit instit.bat instit INSTIT.BAT InstUtlR.exe InstUtlR.exe intdctrr idctup20.exe Intec Service Drivers msmsgrs.exe Intel Active Monitor imontray.exe Intel File Transfer xfr.exe Intel PDS pds.exe Intel Product Number Utility IntelProcNumUtility.exe Intel PROSet Tray Icon promon.exe Intel Service Drivers msconfig16.exe Intel system tool hookdump.exe Intel system tool winnook.exe Intel system works iis.exe intel32.exe intel32.exe IntelAPMClient amclient.exe InteliSys smss.exe intell321.exe intell321.exe Intelliflag_be.exe Intelliflag_be.exe IntelliPoint point32.exe Intellitype type32.exe IntelMEM IntelMEM.exe IntelProcNumUtility cpunumber.exe IntelWireless ifrmewrk.exe Intel(r) Common User Interface igfxtray.exe Intense Registry Service IntEdReg.exe /CHECK InterceptedSystem [path to worm] InterCheck Monitor Icmon.exe Interdll Interdll.exe Internal [trojan filename] Internal regedit.exe /s %windir%c:[month InternalSystray Kazza.exe internat internat.exe Internat systray.exe Internat msgsrv32.exe Internat [trojan filename] Internat Conf bootconf.exe internat.exe internat.exe Internat.exe internat.exe internct WinSocks5.exe internet smss.exe Internet Internet.exe Internet recruit.exe internet [trojan filename].exe Internet Answering Machine IAMNET~1.EXE Internet Answering Machine IAM.exe Internet Config svchosts.exe Internet Connection Wizard stisvsq.exe Internet Connection Wizard [path to trojan] Internet Content Publisher ICP.EXE Internet Download Accelerator ida.exe Internet Exploere Services urlmon32.dll.exe Internet Explore Microsoft lEXPLORE.EXE Internet Explorer iexplorer.exe Internet Explorer IEXPLORE.EXE Internet Explorer IExplorer.exe Internet Explorer http.exe Internet Explorer iexpiore.exe Internet Explorer Configuration IEXPLORE.EXE Internet Explorer Security iexplore.pif Internet Explorer Updater lexbac.exe Internet Explorer Updater iexplorer.exe Internet History Eraser HERASER.exe

Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software Adult content dialler Adult content dialler Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually Added by the OPASERV.H WORM! Added by the OPASERV.K WORM! ?? SafeSurfing adware variant Added by the SDBOT-ADN WORM! System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you ch Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start th Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon prov System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Added by the MSCONFIG16 TROJAN! Added by the SPYRE-H TROJAN! Added by the SPYRE-C TROJAN! Added by the RBOT.QGA WORM! Added by a variant of the SmitFraud alias FAKEALE-C TROJAN! LANDesk Management Suite software component Advertisingvision adware! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Star Added by the SPYJACK-B TROJAN! Added by the Intelliflag SPYWARE! Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings un Related to connection events on an Intel chipset based modem. It can alert you if the telephone line is being used when you're trying to get online (when you're using dial-up). It can also alert you if you Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon prov Associated with the Intel PRO/Set Wireless software Quick access to the control panel via a System Tray icon for graphics based upon the Intel chipsets (ie, i810). These chipsets are often included on motherboards. Available via Start -> Settings -> Cont Intense Educational Ltd - Language Office Software. Is it required? Added by the ANACON-B WORM! Part of Sophos ant-virus sofware Added by the DELF family of TROJANS! Added by the SMOTHER and TRANSLAT TROJANS! number] Added by the FORTNIGHT.D TROJAN! Added by a variant of the OPTIX TROJAN! Note - unlike the valid KaZaA executable, this is located in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP) Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir% Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the "Properties" reveal it to be a Microsoft file Added by the NYRUBOT-A WORM! Added by the CMJSPY-Y TROJAN! Homepage hijacker, redirecting to coolwwwsearch.com; see for example here Language selection icon in system tray Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) and has a "?" icon wheras this version resid Added by the GRAYBIRD.F TROJAN! Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Added by the PWS-CS TROJAN! Added by the RBOT-AJG WORM! Added by the MIFENG-D TROJAN! From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access Added by the SDBOT TROJAN! EasySearch adware Added by the SMUTSRCH-A TROJAN! Added by the RBOT-UD WORM! Internet Download Accelerator download manager Added by the EVIAN.C WORM! Added by the RBOT-AOF WORM! Note - the filename is spelled with a lowercase "L" in place of an uppercase "i" Added by the LORSIS WORM! Note - the legitimate IE (iexplore.exe) does not figure in Msconfig/Startup unless added manually and this loads from the "RunServices" key Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure Added by the NETHIEF-O TROJAN! Added as part of a new potential CWS infection, and part of a suite of programs that installs a web server, php, ftp server, socks, and mail server on your computer without your knowledge. These files a Added by the RBOT-AZC WORM! Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the RBOT-ALQ WORM! Added by the DOWNLOAD TROJAN! Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) Internet History Eraser - deletes your browsing tracks

X X X U X X X X X X X X X X X Y X N U X X X X X X U X X N X N N N N N N U X X X X N N X U X N U U U N U U U ? N N N U X X X N X X X X X X X

Internet Loader1 Internet Mail and News Internet Mail and News Internet Optimizer Internet Optimizer Internet Send Internet Server Internet Service internet service internet service Internet Services Internet Services Internet Services Internet Services INTERNET SERVISES Internet Sharing Server Internet Suspention Internet Sweeper Internet Timer Internet Washer Pro Internet.exe internet.exe Internet2 Optimizer InternetWasherPro INTERNET_SERVISES InternodeUsage Internt Intersoft Msngr InterTrust Quick Start InterU Intervideo Win Cinema Manager Intervideo Win Cinema Manager Intervideo WinCinema Manager Intervideo WinCinema Manager Intervideo WinScheduler Intervideo WinScheduler InterWARN Intespention Intmgr intranet Intrenat Introducing Media Manager Introduction-Registration IntruderAlert Inventory Scan Ioadqm iobi iolo Task Agent Iomega Automatic Backup Iomega Automatic Backup 1.0.1 Iomega Backup Scheduler Iomega Disk Icons Iomega Drive Icons Iomega ImIconXP Iomega QuickSync Iomega Startup Options Iomega Watch IomegaWare Iomon98.exe IP Stack IP**.exe [* = random char] IP**32.exe [* = random char] iPalm IPC Connection IPC Spool Manager IPC Spool Manager ipcfg.exe IPConfig IPConfig IpCtrl

MSInstall61.exe msqdevl.exe [path to trojan] optimize.exe optimize.exe More log.exe inetsrv.exe intersvc.exe syscfg32.exe ssvhost.exe systemdev.exe internet.exe interserv.exe Netsvc.exe winz32.exe iss_srvr.exe story.exe Sweeper.exe ITIMER.exe iw.exe Internet.exe yinyin3345.vbs wkfix.exe iw.exe winz32.exe mum.exe Internt.exe intersoftmsngr.exe it_cpq~1.exe WINDRV.EXE WinCinemaMgr.exe WINCIN~1.EXE WinCinemaMgr.exe WINCIN~1.EXE WinScheduler.exe SchSvr.exe interwarn.exe IEXPLORE.exe Intmgr.exe SYS32CFG.EXE Intrenat.exe SPLASHA.EXE ?? ia99.exe LDISCN32.EXE Media Player.exe iobiClient.exe Task_Agent.exe ibackup.exe ibackup.exe dtiom98.exe IMGICON.EXE IMGICON.EXE imiconxp.exe Quicksync.exe IMGSTART.EXE IOWATCH.EXE COMMANDER.EXE Iomon98.exe ipstack.exe IP**.exe [* = random char] IP**32.exe [* = random char] mon.exe ipcconn.exe wnmgre.exe winspec.exe ipcfg.exe svcxnv32.exe svcxnw32.exe ipcon32.exe

Added by the KWBOT.B WORM! EasySearch adware Added by the SMUTSRCH-A TROJAN! Internet connection optimizer. Leave this enabled if you find it improves your connection Internet Optimizer parasite, MoneyTree variant - ActiveX control used to download premium-rate dialers Unidentfied adware Added by the STARTPA-EM TROJAN! Added by the SPYBOT-DE WORM! Added by the RBOT-QS WORM! Added by a variant of the RBOT WORM! Added by the SDBOT-PW WORM! Added by the MYTOB.BT WORM! Added by the RBOT.BNT WORM! Added by the MYTOB.MN WORM! Added by the KWBOT.Z WORM! Intel AnyPoint internet sharing software Added by the WOOTBOT.HV WORM! Internet Sweeper - removes unnecessart left over files after browsing the internet Shareware dial-up connection call cost calculator from Ratsoft Internet Washer manages temporary browser files, cookies, etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003 Added by the MAGICCALL VIRUS! Added by the YINI MACRO! Added by a variant of the RBOT WORM! Internet Washer manages temporary browser files, cookies, etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003 Added by the SDBOT.Q TROJAN! Australian ISP's free monthly download meter Added by the PEEPER or CARUFAX.A TROJANS! Added by the AGOBOT-NW WORM! InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business Added by the IRCINTER.A TROJAN! WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs InterWARN by Storm Alert Inc. Provides customized, automated access to critical weather and civil emergency information from the US National Weather Service. Required if audio and screen crawler al Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the GEMA TROJAN! Added by the SPYBOT-DW WORM! Added by the LEMIR.E TROJAN! MS Media Manager tour. Not required For Compaq PC's. Should only run first time, PC Introduction & Compaq registration Intruder Alert '99 from Bonzi - spyware LANDesk Management_Suite software component Added by the HAWAWI WORM! iobi Home - a mail/voice service by Verizon iOlo System Mechanic Task Agent. Scheduled maintenance Iomega Automatic Backup - automatic backups for use with Iomega portable HDD Iomega Automatic Backup - automatic backups for use with Iomega portable HDD Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If y Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If y Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system, and provides drag-and-drop file access, access and write protect ?? Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Used by Iomega drives. Available via Start -> Programs Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs PC-Cillin 98 real time virus check. Can cause floppy disk accesses to hang Added by the AGOBOT.CW WORM! CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Installed with a Panasonic iPalm digital camera. Used to uploaded photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded Added by the RBOT-AEG WORM! Added by the SDBOT-ZC WORM! Added by the SDBOT-BLU WORM! Adware - recognized by McAfee antivirus as a variant of the AdClicker-BM trojan Added by the HACARMY.E TROJAN! Added by a variant of the HACARMY.E TROJAN! Added by an unidentified VIRUS, WORM or TROJAN!

X X N Y X X X U ? X X X X N X N U X Y X U X X N X X ? U X X Y N N U N U ? X X X X U X X N X U N U N U U U Y Y U X N X U Y Y X X X N N X U U

IPFW IPInSightLAN 0* IPInSightMonitor 0* IPinst ipmon.exe IpNetwork Ipnuker iPodManager iPodWatcher IPOT Service Drivers IPOT Service Drivers IPOT USB Service DRIVER IPOT USB Service DRV32 IPPDetect ipreg iPrint Tray iProtectYou iprun IPSecMon IPTable Configuration iptray IPv6 Helper Driver IPv6 STUN Service IPW ipwf IpWins IQES.exe Ir41_32.ax irassync irc session IREIKE iRis Active Monitor iRiS AntiVirus Active Monitor iRiver AutoDB iRiver Updater IrMon IRPMonitor irssyncd Irwftp irwftp irwftp IrXfer ir_ftp ir_ftp IS CfgWiz Isass ISBMgr.exe isdbdc isDeleteMe ISDN Monitor ISDNwatch ISHelp iShield ISLP2STA ISP.COM High Speed iSpyNOW Israfel IsReminder issEnc32Svr ISStart ISSVC ISS_Certtool IST Service ist service uninstall istinstall zazzer.exe ISUSPM Startup ISUSScheduler isystem Itk iTouch

ipwf.exe ipclient.exe ipmon32.exe N/A ipmon.exe ipnetwork.exe Ipnuker.vbs iPodManager.exe iPodWatcher.exe compaq.exe compaq.exe hpsebc087.exe hpsebc08.exe IPP4Detect.exe ipreg.exe iprntctl.exe ip.exe iPY.exe IPSecMon.exe Winipcfgs.exe iptray.exe csass.exe netstun.exe IPW.exe ipwf.exe ipwins.exe iqes.exe regsvr32.exe [path] Ir41_32.ax irasyncd.exe sessionmgr.exe IreIKE.exe winmon32.exe WIMMUN32.exe MLService.exe Updater.exe IRMON.EXE itcnmon.exe irssyncd.exe [path to trojan] iexplorer.exe ftpmon.exe IrXfer.exe ir_ftp.exe irwftp.exe cfgwiz.exe Isass.exe ISBMgr.exe isdbdc.exe isDel.bat Linksts.exe IWatch.exe help.exe iShield.exe ISLP2STA.EXE slipgui.exe ispynow.exe Israfel.vbs ISPopup.exe issEnc32.exe ISStart.exe ISSVC.exe certtool.exe istsvc.exe [random filename] istinstall zazzer.exe ISUSPM.exe issch.exe isystem.exe Itk.exe iTouch.exe

Added by the DLOADER-YF TROJAN! Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly "phones home" and wastes resou Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. * represents 1 or 2 For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Added by the RECERV or R3C.B TROJANS! Added by Maxifiles ADWARE! Added by the INKER.B WORM! Apple iPod Management software for the iPod MP3 player. Allows updating, formating, restoring and other functions associated with iPods Associated with Apple's iPod MP3 player. Detects when the iPod is connected? Added by a variant of the FUROOTKIT TROJAN! Added by a variant of the FUROOTKIT TROJAN! Added by the SDBOT-WA WORM! Added by the SDBOT-WH WORM! Part of Presto! Mr.Photo - "an ideal program for creating, sharing, and manag-ing digital images and videos" Added by the ZAGABAN-H TROJAN! Novell(r) iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net iProtectYou - internet filtering/parental control and network monitoring software iProtectYou spyware Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Added by a variant of the RBOT WORM! Intel Desktop Utility module - provides system info such as estimated cpu temp, fan speed, etc Added by the AGOBOT.TC WORM! Added by a variant of the SDBOT WORM! Internet Phone Wizard from Actiontec - Voice over IP (VoIP) that allows you to "make and receive free Internet calls on your regular phone" whilst "at the same time, make and receive regular (landline) Added by the SCHOEBERL TROJAN! Added by Maxfiles adware ?? Intel Indeo(r) video 4.4 Decompression Filter related Added by IRASSync ADWARE! Added by the SDBOT-ACE WORM! Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Iris Antivirus - discontinued, replace with good alternative Iris Antivirus - discontinued, replace with good alternative Associated with the iRiver Music Manager Updates for the iRiver Music Manager - used with their digital music players System Tray access to infra-red devices. Not required unless you use infra-red devices ?? SafeSurfing adware variant Added by the BANCOS-AP TROJAN! Added by the BANKER-AN TROJAN! Added by the BANCBAN-BO TROJAN! Microsoft Infrared Transfer application Added by the IRFTP TROJAN! Added by the BANCOS.H TROJAN! Norton Internet Security configuration wizard Added by the FUTRO TROJAN! Related to Sony ISB Utility. This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems For Compaq PC's. May install properties in dial-up networking when you register with an ISP Used by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your IS FRITZ!X ISDNWatch - "dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block ISpy is a security risk that logs keystrokes and captures screenshots. If you didn't install this yourself uninstall it GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser A process from Cisco Systems Inc associated with Windows Update for wireless NIC drivers User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to iSpyNOW - remote monitoring and surveillance software Added by the GAGGLE.D or GAGGLE.E WORMS! Related to GuardWare iShield - this is the registration reminder for the trial version, so not required in startup Added by a variant of the RBOT WORM! LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and Part of Norton Internet Security Suite IBM Client Security Certification Tool ISTBar adware ISTBar parasite related Unidentified adware downloader/installer InstallShield Update Service Scheduler. Automatically searches for and performs any updates to the software so you're always working with the most current version InstallShield Update Service Scheduler. Automatically searches for and performs any updates to the software so you're always working with the most current version Added by the CHORUS-A TROJAN! Searchforfree browser hijacker In The Know - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it iTouch loads the iTouch configuration program for Logitech keyboards. It's needed if your keyboard has shortcut buttons and if you use them. It's also needed if your keyboard does not have the num lo

N X X Y Y ? N N N U X X X ? N X U X X X X X X X X X X X X X N N Y X X U U U ? X X X N X U X U U U X X X X ? X N X X U X X N U U X Y X X X X

ItsDeductiblePopUp ITUNES ITUNES iTunes Helper iTunesHelper itype Iusage IVPServiceMgr IW ControlCenter iwctrl ixplore ixproxy iyelejiv IZE j2 Tray Menu JA Cfg Util v2 Jammer Jammer2nd Java applet Java Auto Update Java Runtimes Java Virtual Machine Java**.exe [* = random char] Java**32.exe [* = random char] JavaScript Debugging Service JavaUpdate0.07 JavaUpdateSched JavaVM jawa32 Jawa322 JB Jet Detection JetAdmin Discovery Indicator jete jijbl JobHisInit Jog Serve JogServ2 jotl Jreg Jufualt Jufualt jusched jushed32.exe JussDropUtility jutsu jv16 PT TempFileTool jv16PT - Privacy Protector Jv16pt Network Resident jvdnlssn JVM0.12 JVM0.14 jxef1104 Jzi16 K2ps_full.task K6CPU.EXE Kadoc kak Kalibump kalvsys kalvsys Kana Reminder Karen's Once-A-Day II KASP Kasper Antivirus Kaspersky Anti-Hacker Kaspersky Antivirus KasperskyAv KasperskyAVEng KAVFOX

ItsDeductible.exe itune.exe itunes.exe iTunesHelper.exe iTunesHelper.exe itype.exe netdet.exe ivpsvmgr.exe iwctrl.exe iwctrl.exe ixplore.exe [path to trojan] yujixit.exe N/A HotTray.exe jacfg2.exe jammer.exe Jammer2nd.exe javaup.exe ujm.exe iexplore.exe javaw.exe Java**.exe [* = random char] Java**32.exe [* = random char] JsDbgMan.exe [filename] jusched32.exe java.exe jawa32.exe jawa32.exe Jiffybar.exe ADGJDet.exe HPJETDSC.EXE yujixit.exe ezlwy.bat JobHisInit.exe JogServ2.exe JogServ2.exe millenzje.exe Jreg2b.exe winxp2.exe svhost.exe jusched.exe jushed32.exe JussDrop.exe jutsu.exe TempTool.exe Task.jvb jv16pt_network.exe fljzsshc.exe [random filename] [random filename] jxef1104.exe jzi16.exe K2ps_full.exe K6CPU.EXE [random filename].exe kak.hta Kalibump.exe kalv****.exe [* = random char] kalv***32.exe [* = random char] Reminder.exe PTOAD.exe OESpamTest.exe KASPERANTIVIRUS.EXE KAVPF.exe KasperskyAV.exe kaspersky.exe Kasperskyaveng.exe win1ogoin.exe

ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays Added by the RBOT-ZU WORM! Added by a variant of the RBOT WORM! Note - this file will be placed in the WindowsSystem32 or WinntSystem32 folder, and should not be confused with the (legitimate) Apple iTunes process, always lo Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Microsoft IntelliType Pro keyboard related - what does it do and is it required? Internet Usage Monitor - utility to calculate the cost and time on the internet via dial-up Toshiba IVP Service Manager application which appears as a red satellite dish icon in the System Tray. This is Toshiba's equivalent to the Windows Automatic Update feature as, whenever you are conne Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-R Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-R Added by the SDBOT-CY TROJAN! Added by the XORPIX-A TROJAN! Added by the SDBOT.BJK WORM! ?? eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Added by the RBOT-AL WORM! Jammer by Agnitum - "Jammer is the last word in Internet security. It combines a user-friendly interface with very sophisticated and powerful security measures that protect your Windows system while Added by the NETSKY.Z WORM! Added by the SDBOT-ACF WORM! Added by the SDBOT-ADH WORM! Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure Added by a variant of the RBOT WORM! CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Added by the DERDEO.E WORM! Added by the JUPDATE TROJAN! Added by the CKB TROJAN! Added by the MYDOOM.M or MYDOOM.N or other variants of the MYDOOM WORMS! Note - not to be confused with the valid Windows "java.exe" which resides in C:WindowsSystem (Win9x/Me), C:WinntS Added by the AGENT.BG WORM! Added by a variant of the AGENT.BG trojan Get Paid As You surf application Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the re Added by the SDBOT.BRT WORM! Added by the REDDW WORM! Used by Ricoh network printers to enable network printing from the client Jog Dial on a Sony Vaio laptop. The dial can select various functions such as control audio. Needed if you use its features Jog Dial on a Sony Vaio laptop. The dial can select various functions such as control audio. Needed if you use its features ?? BroadcastPC adware variant Added by the SDBOT-AAB WORM! Added by the SDBOT-ADJ WORM! Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel CoolWebSearch parasite variant - also detected as the BIZTEN-L TROJAN! Related to DropShots Inc. A subscription based service for family to connect, converse and share photos and videos Added by the RBOT-LS WORM! jv16 PowerTools' temporary file remover jv16 PowerTools 2005 - Privacy Protector allows you to protect your privacy by clearing the unwanted history items and cookies from you computer every time you startup your computer jv16 PowerTools' network resident program. Only needed if you are using the program's network features Flingstone.com adware - and its Golden Palace Casino program Added by the TEADOOR-A TROJAN! Added by the TEADOOR-B TROJAN! Added by the XIPI-A WORM! ?? Added by the JUNTADOR.K TROJAN! Authenticates CPU as K6 in system properties Added by the STAPREW TROJAN! Added by the KAKWORM WORM! Used with the now unsupported Kali software for on-line gaming. This is used to automatically bump up the priority of WinProxy to GREATLY improve game speed when using a SOCKS proxy EliteBar ADWARE! EliteBar ADWARE! Kana Reminder is a program which can be used to set a reminder to be triggered at a specified time Have a job that should be run exactly once each day? Karen's Once-A-Day II is just what you need! Scheduler that lets you specify progams, web pages and files that be run or opened automatically, the Kaspersky Anti-Spam Added by a variant of the SPYBOT WORM! Kaspersky Anti-Hacker firewall Added by a variant of the RBOT WORM! Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky AntiVirus Added by the NETSKY.V WORM! Added by GWGHOST-M TROJAN!

X Y X Y X Y Y X X X X N X X X X N N Y U U X X N U N U X U ? U X X X X X X X X X X X X X X X X X X X X X X N N X X X X X X X X X X X X X N X

KAVPersonal svchost.exe Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms KAVPersonal50 Kav.exe Kaspersky Anti-Virus Personal 5.0 KAVPersonal90 wscntfy.exe Added by the BANKER-FZ TROJAN! KavPFW KavPFW.exe KingSoft Personal Firewall KavRuns Windll.exe Added by the TRYNOMA TROJAN! KavStart KAVStart.exe KingSoft Personal Firewall kavsvc kavsvc.exe Kaspersky antivirus kavsvc [random 6 char filename] Qoologic downloader trojan variant using random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) - do not confuse with the Kaspersky antivirus startup item, as described here KavSvc ******.exe reg_run [* = random char] Added by the QOOLOGIC TROJAN! kavsvc [random 6 char filename] Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) KAVutil [worm filename] Added by the WINTOO.B WORM! KAZAA kazaa.exe KAZAA is a file-sharing program which unfortunately being ad-based includes "Cy-door" adware. Check here for information about "Cy-door" and here for a program that can remove it Kazaa Download Accelerator Updater regsvr32 (required) [path] kdp****.dll [* = random SafeguardProtect/Veevo char] hijacker Kazaa lptt01 kazaa.exe RapidBlaster variant (in a "kazaa" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same e Kazaa ml097e kazaa.exe RapidBlaster variant (in a "kazaa" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same e KAZAACuf 9 Added by the KITRO.D (or ARGEN.A) WORM! kazaalite kazaalite.exe Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original, this one does not contain any advertising or tracking mechanisms KaZooM KaZooM.Exe KaZoom from Blue Haven Media - "add-on application that automatically speeds up the download process and finds the files you want with far more power than regular KaZaA searches" KB891711 KB891711.exe Installed by the Windows KB891711 critical update, see this security bulletin - this file reportedly needs to continue running in order to patch the vulnerability, at least until a more practical solution is fo KBD KBD.EXE Multimedia keyboard manager. Required if you use the multimedia keys KBD MediaCenter MEDIACTR.EXE Multimedia keyboard manager. Required if you use the multimedia keys kbddrv32 kbddrv32.exe Added by the CRYPTER.A TROJAN! kbddrvinf kbddrvinf.exe Added by the CRYPTER.A TROJAN! KCeasy KCeasy.exe KCeasy - a Windows peer-to-peer filesharing application which uses giFT as its 'back end' foundation. The networks currently supported are OpenFT and Gnutella KClient kstatus.exe KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet kdx KHost.exe KonTiki Secure Delivery Plug In related. "The Kontiki Delivery Management System (DMS) is a secure delivery network for distribution of video, software, audio, documents, and other digital media. The KE9801 DriBat32.exe KE-9801 multimedia keyboard - required if you use the multimedia keys Keenvalue Keenvalue.exe eUniverse/KeenValue adware KEMailKb KEMailKb.EXE Controls the buttons at the top of the Micro Innovations 650i Internet Access Keyboard. If you disable it you cannot use the buttons - like volume control or shut down Kemet kemet.exe ?? Kerio VPN Client kvpnclient.exe Kerio VPN Client kern64dll [random filename] Added by the TARNO.J TROJAN! Kernal Fault Check ntosrkl.exe Added by a variant of the SDBOT WORM! kernctl32 rundll32 kctl32.dll, initialize Added by the AGENT.AT TROJAN! Kernel bboy.exe Added by the MUMU.B WORM! Kernel services.exe Added by the FOOZ-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco KERNEL 32 SKERNEL32.com Added by the SEMAPI-A WORM Kernel Faults ftphost.exe Added by the RBOT.BHU WORM! Kernel Loader ntkrnl.exe Added by the CERVIVEC.A WORM! Kernel Manager krnlmgr.exe Added by the JUNY.A TROJAN! kernel system daemon ACTIVAT0R.exe Added by the RANDEX.AW WORM! kernel12.exe kernel12.exe Added by an unidentified WORM or TROJAN! kernel32 kern32.exe Added by the BADTRANS.A WORM! Kernel32 Kernel32.exe Added by a number of VIRUSES, WORMS and TROJANS! kernel32 kernel.dli Added by the NETDEVIL.B TROJAN! Kernel32 Kernel.dll Added by the REDLOF.M VIRUS! kernel32 kernel32.dlI Added by the NETDEVIL.15 TROJAN! Kernel32 krnl32.exe Added by the EPON WORM! Kernel32 Kernel32.win Added by the GAGGLE.D or GAGGLE.E WORMS! Kernel32 kernel32s.exe Added by the SDBOT-PU TROJAN! kernel32 kernel32.exe Added by the CHODE-I WORM! kernel32dll guardpc.exe Added by the FORBOT-CU WORM! KernelCheck sys****.exe [* = digit] Added by an unidentified TROJAN! kernelfaultcheck dumprep 0 -k Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recover kernelfaultcheck dumprep 0 -u Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recover KernelFaultCheck ptool32.exe Added by the LEGMIR-BN TROJAN! KernelFaultChk sms.exe Added by the DEADHAT WORM! Do not confuse with the valid "kernelfaultcheck" which runs "dumprep 0 -k" or "dumprep 0 -u" Kernell systems.exe Added by the TARNO.C TROJAN! Kernell32 Kernell.dll Added by the DESTINY.A TROJAN! KernellApps csrss.exe Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! KernellApps lexplore.exe Added by the BANCBAN-BS TROJAN! KernellApps32 smss.exe Added by the BANCBAN-AN TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Kernelw Kernelw32.exe Added by the INDOR.E WORM! Kernel_check wmiprvse.exe Added by the SONEBOT-B WORM! Note - this is not the legitimate wmiprvse.exe process which is always located in the System32wbem folder and should not normally figure in Msconfig/Startup! key sysxp.exe Added by the BEAGLE.AB WORM! key sys_xp.exe Added by the BEAGLE.AC WORM! key winxp.exe Added by the BEAGLE.AG WORM! Key Logger csrss.exe Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Key Text KeyText.exe Key Text 2000 from MJMSoft Design - utility to automate repetitive keyboard tasks. Available via Start -> Programs Key1 Rlid.exe Added by the LIXY TROJAN!

? X Y X U X U Y X U U X U X U U X N U U X N U X X U X X U U U U U N U N N N Y U N N Y U X U X X X U X X X X X N U X X X X X U X X U U U X X

Key2 serve.exe ?? key2 winlog.exe Added by the BAGLEDI-AL TROJAN! KeyAccess keyacc32.exe KeyServer KeyAccess client software - "when the KeyServer program is launched, the KeyServer process becomes active so license requests from client computers can be serviced. Without KeyAccess, Keybdcntl keybdcntl.exe Added by a variant of the CRYPTER.C TROJAN! KeyBoard Keyboard.exe Labtec keyboard utility keyboard keyboard*.exe [* = number] Recognized by Kaspersky antivirus as TrojanDownloader.VB.zg Keyboard Manager MMKeybd.exe Multimedia keyboard manager. Required if you use the additional keys Keyboard Preload Check Preload.exe Millenium Multi-Function Keyboard driver keyboard_enum keyboard_enum.exe Added by the GP TROJAN! KeyMaestro kmaestro.exe Multimedia keyboard manager. Required if you use the multimedia keys keymap keymap.exe System Tray utility and background task used by games produced by Kesmai (published by Interactive Magic) and which enables you to program keys to do specific actions during the game keymgrldr rundll32 setupapi, InstallHinfSection... CoolWebSearch keymgr3.inf Oemsyspnp parasite variant KeyPatrol KeyPatrol.exe KeyPatrol - detects Key Loggers ("keyboard loggers" or "keyloggers") using both behavioral and pattern-matching algorithms keyserv keyserv.exe Added by the KeyThief SPYWARE! keystroke keystroke.exe QuickLaunch is a surveillance software program that logs keystrokes and captures screenshots. If you didn't install this yourself remove it KeyWallet KWallet.exe KeyWallet is a useful and convenient desktop utility that spares you the trouble of filling in your logins, passwords and other personal data manually kfienq masbl.bat Added by the KIFER TROJAN! khooker khooker.exe SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required KICKMON.EXE KICKMON.EXE KeepItClean - utility that deletes safe to remove files, cookies, browsing history, etc. This is the scheduler - if you don't schedule clean-ups it isn't required Kill Popup KillPopup.exe KillPopup - pop-up stopper kimochiz.exe kimochiz.exe Added by the MDROP-BB TROJAN! Kinberlink Kinberlink.exe Kinberlink network messaging. Available via Start -> Programs KK Loader loadkk.exe KeyKey XP Professional from KeyKey.com. "Monitor Instant Messages, Chats, Emails, Web Site URLs, Passwords, Computer Programs, Start Up and Shut Down time and much more completely undetecte KKM Service kkm.exe Added by the NANPY-I WORM! KL AntiFunLove flcss.exe Added by the FUNLOVE.4099 WORM! KLog Keyspy.exe KeyLoggPro.B keystroke logger/monitoring program - remove unless you installed it yourself! klop [path to file] Added by the AGENT-WQ TROJAN! klop [random].tmp Found with Trojan.Win32.StartPage.aw. Possibly a variant of the AGENT-WQ TROJAN! klp run32dll.exe PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online klp explorer.exe ComSurveilSys keystroke logger/monitoring program - remove unless you installed it yourself! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would KM9801U MMHotKey.exe Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen kmw_run.exe kmw_run.exe Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features kmw_show.exe kmw_show.exe Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features Kodak Batch Transfer pezdow1.exe Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC Kodak EasyShare software EasyShare.exe Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually Kodak Picture Easy *.* Batch Transfer PezDownload.exe Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version Kodak Picture Transfer Software pts.exe Looks for Kodak camera connection and media insertion. Available via Start -> Programs Kodak Software Updater backweb*****.exe Software updater for Kodak Easyshare digital cameras KodakCCS KodakCCS.exe Kodak DC File System Driver Komunikator tlen.exe Tlen - a Polish language instant messaging client Konni Symbol Autostart KonniSymbol.exe Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5 kontiki kontiki.exe Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops KPDrv4XP KPDrv4XP.exe MediaKey USB Keypad Driver KREC32 krec32.exe StarrCommander Pro Keystroke logging software Krnlcheck csrss.exe Added by the BOTNACHALA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Krnlmod Krnlmod.exe Keystroke logger/monitoring program - remove unless you installed it yourself! ksrlnhm zxatgso.exe Added by the DLOADER-LI TROJAN! Ksrv32 Ksrv32.exe Added by the AGOBOT-PI WORM! KTAX Auto Loader ktax.exe Added by the SDBOT-MZ WORM! ktchnsnk ktchnsnk.exe HP program found with the Office Jet 500/600/700 series which initializes the Office Jet manager each time the computer is booted up or rebooted KV2005 word.EXE Added by the IW TROJAN! kv3000 lover.vbe Added by the ZSYANG.B WORM! kvern16.dll regsvr32.exe [path] kvern16.dll DailyWinner adware KV_HOST cxjx.exe Added by the LEGMIR-BB TROJAN! kw3eef76 rundll32.exe [path] kw3eef76.dll, EnableRunDLL32 LZIO.com adware downloader kX Mixer kxmixer.exe Provides Mixer and Control functionality to KxProject Audio driver for EMU10k based soundcards KX509 kx509_kfwk5.exe Kerberos Secure Authentication for Windows KYK Control Settings KYSVCXD.EXE Added by a variant of the RBOT WORM! KYM Control Settings phqghum.exe Added by the RBOT.BQD WORM! L4r1$$a L4r1$$a.pif Added by the ASSIRAL-C WORM! LAN Driver landriver32.exe Added by the RBOT.BT WORM! lanbrup lanbrup.exe SafeSurfing adware LanguageMonitor Oplmsb01.exe OKI Printer language support monitor LanGuard languard.exe Adware downloader - also detected as the SECONDT-C TROJAN! LanGuard [path to trojan] Added by the DLOADER-VO TROJAN! LanSpeed2 LanSpeed2.exe Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card) laokey.exe LaoKey.exe Lao Script for Windows (LSWin) is an extension to the Windows operating system to allow Lao language to be used with many different Windows-based applications LapLink scheduler Llsched.exe Utility that automatically performs file transfers as unattended background operations Lar Llass.exe Added by the INOR-A TROJAN! lar [trojan filename] Added by the ROXY.C TROJAN!

X ? X X Y ? U ? U N U X N U U U X N X U Y X U Y N ? U X X N N X U U N X X U U U Y Y Y Y Y N X N U X U N X X X X X X N U X X X N N X U X N X

LARISSA ANTI VIRUS LARISSA_ANTI_VIRUS.exe Added by the KLASSIR TROJAN! Lasb ewat.exe ?? LasErma Ermasys32.exe Added by the LERMA-A WORM! LAsIAf32 RePEAtLD.exe Added by the REPEATLD WORM! LASTinst N/A For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Later later.exe ?? LaunApp LaunApp.exe Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Launcg launcg.exe ?? Launch Ai Booster OverClk.exe ASUS Ai Booster is an application that allows you to overclock the CPU either manually or automatically without the hassle of entering the BIOS Setup Launch Context 5.0 Launch.exe Context - electronic dictionary Launch LCDMon LCDMon.exe Logitech LCD G-Series software driver Launch Norton AntiVirus 2000 jorgf.exe Added by the RBOT-AUI WORM! Launch YahooPOPs! at Windows startup YAHOOPOPS.EXE YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs LaunchAp LaunchAp.exe Programmable keys on Acer, Fujitsu and other laptops LaunchApp Alaunch.exe Acer Launch tool utility on laptops Launchboard lnchbrd.exe LaunchBoard software from Darwin turns your keyboard into a remote control for the Internet and your computer! With LaunchBoard 2.0, you can customize up to 38 keys on your PC keyboard to instan Launcher launcher.exe Spyware component related to DownloadWare and found in Program FilesKFH Launcher relaunch.exe Audio Applications Launcher for the Philips Rythmiic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtray). Available via Start -> Programs Lavasoft Ad-Aware Ad-Aware.exe Added by the RBOT-SO WORM! Note - this is not the popular Ad-aware spware/adware removal tool Lavasoft Adwatch Ad-watch.exe Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system laxmsp32.exe laxmsp32.exe Lexmark Scan and Copy Control Program for the X63 (and maybe others) printer/scanner. Required for the scanner to work Laz Kernn.exe Added by the BANCOS-LN WORM! LCDC LCDC.exe LCDC is an application that displays various information on your LCD or VFD screen. The number of things that LCDC can do is expandable by Plugins LCDPlayer LCDPlyer.exe Related to SuperAdBlocker lcfep lcfep.exe Tivoli 'TME' System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to fu LCIDConfig lcidchng.exe ?? LClock lclock.exe LClock is a program that makes the Windows' clock look like a Windows Longhorn Clock lcvga lcvga.exe Added by the HOSTOL-A TROJAN! ld ld.exe CoolWebSearch Tooncomics parasite affiliate variant - redirects to fastwebfinder.com LDM backweb-8876480.exe Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech LDM ldmconf.exe Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech ldriver ldriver.exe Added by the CHORUS-A TROJAN! Searchforfree browser hijacker LED TRAY LEDTRAY.EXE Installs a USB compact flash card reader or drive on start-up. The device is distributed by Microtech and is made by a company called SnapShot. Required if you want the reader to work ledpointer CNYHKey.exe Chicony Electronics Multimedia Keyboard Hotkey Driver LeechGet LeechGet.exe LeechGet download manager leeman leeman.exe Added by the COSIAM-D TROJAN! LetsSearch LetsSearch.exe BrowserAid/BrowserPal foistware Lexmark **** Series lxbabmgr.exe Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Lexmark **** Series lxbkbmgr.exe Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Lexmark **** series lxbtbmgr.exe Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Lexmark 2200 Series Button Manager lxbvbmgr.exe Lexmark printer button manager. Required for correct operation Lexmark 3100 Series lxbrbmgr.exe Lexmark printer button manager. Required for correct operation Lexmark X6100 Series lxbfbmgr.exe Lexmark X6100 printer button manager - required for correct operation Lexmark Xxx Button Manager AcBtnMgr_Xxx.exe Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Lexmark Xxx Button Monitor ACMonitor_Xxx.exe Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation LexmarkPrinTray printray.exe Lexmark Printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. Can also be listed as PrinTray lexplore lexplore.exe Added by the BROPIA WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer lexpps lexpps.exe For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC, the file is not used, (or should not be used) at all". It LexStart lexstart.exe Lexmark printer software may add Lexstart.exe in the startup folder to handle print commands that you send to the printer. Sometimes required for the printer to work correctly - not in the case of a Le Lfh Lfh.exe Added by the ZAURGA-A TROJAN! Lfsndmng lfsndmng.exe LightningFAX Enterprise Fax Server - "puts faxing at the fingertips of networked enterprise users. It enables rapid, secure sending and Direct-To-Desktop Delivery of mission-critical documents" lhttseng rundll32.exe ..lhttseng.inf, RemoveCabinet Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine li-multi**** li-multi****.exe Adult web-dialler - **** is random li-rcash00001 vldial.exe Added by the Vl TROJAN! li-speed**** dlres.exe Adult web-dialler - **** is random li-thund**** li-thund****.exe Adult web-dialler - **** is random li-vita**** li-vita****.exe Adult web-dialler - **** is random li01f948 rundll32.exe [path] li01f948.dll, EnableRunDLL32 LZIO.com adware downloader LicCrtl runservice.exe Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program LicCtrl rundll32.exe [path] MMFS.DLL, Service Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program License Manager license_manager.exe MediaPipe peer-to-peer file swapping program also reported as a hijacker lich lich.exe Added by QLOWZON-BN TROJAN! Life FireWall Update1 FireWall-Update1.exe Added by the RBOT-ARS WORM! LifeDrive Manager LifeDriveMgr.exe Keeps the Palm LifeDrive Manager utility in the systray. Shortcut available via Start -> Programs LifeScape Media Detector PicasaMediaDetector.exe Media detector for Picasa's automatic photo organizer lify yujixit.exe Added by a variant of the SDBOT WORM! Lightning Download Lightning.exe Lightning Download download manager. Can be launched manually, but will need to start up if you want it to "catch clicks" off Internet Explorer Limewire LimeWire.exe Added by the RBOT-AGH WORM! LimeWire x.x LimeWire.exe LimeWire - Peer to Peer (P2P) file-sharing client. x.x represents the version number. Note - as with all P2P sharing programs they are susceptible to various forms of malware Limpet explorer16.exe Added by the RBOT-AJD WORM!

N X X N X X U X X X N N N N N X U X X X ? X N X U U U U X U N ? X N Y X X X X X X X X X X X X X X X U X X X X X X X X N U ? U Y N ? N ? Y Y

Line Speed Meter V3.0 Linker links Linksts Linksts Linux LiquidView Lisa List checker 32 BIT Litebot LIU LIU Live Menu LiveMonitor LiveNote LiveSexCams LiveUpdate LiveUpdate Livre lk3h1 LLMODCL2 llsass LM Status LMA Manager LManager LManager LManager LManager lMAPl LMgrOSD LMonitor lmpdpsrv lmrt LMSTATUS LMSXXD lmu lnternet Explorer load load load Load load load load load load load load load Load Service LOAD WB Load-Guard LOAD32 load32 load32 load32 load32 load32 load32 load= load= load= load= load= load= load= load= load= load= load=

LineSpeedMeter.exe LineSpeedMeter - detect the download and upload speed of your internet connection LinkMaker.exe Links adware links.exe Added by the LOWZONE-BI TROJAN! linksts.exe Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your IS linksts.exe Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your IS Linux.vbs Added by the LOVELETTER.AS VIRUS! lviewj.exe Liquid View lets you increase the legibility of the Microsoft Windows interface regardless of your display's native resolution. The software lets you increase the size of items that are hard to read on your Lisa.exe Added by the SCOM-D premium rate adult content dialler list32.exe Added by the RBOT-AHO WORM! [path to trojan] Added by the LITEBOT-A TROJAN! LIU.exe Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway Rubicon.exe Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway Dllcmd32.exe eFax Send button for eFax Messenger Plus. Available via Start -> Programs Disabling instructions available here LMonitor.exe MSI Live Update - auto-detects and suggests the latest BIOS/Driver/Utilities information Livenote.exe Asus graphics card driver live update feature LiveSexCams.exe Premium rate adult content dialler LiveUpdate.exe Web-update utility as used by various types of software - see here [Windows username]05.exe Added by the LINEAGE TROJAN! Dibane.bat Added by the BANEDI VIRUS! [path to file] Added by the MOSUCK-G TROJAN! rundll.exe setupx.dll, InstallHinfSection ?? ..LLMODCL2.INF llsass.exe Added by the PROXY-GG TROJAN! Note - this malware actually changes the default value data of the registry "Run" key in order to force Windows to launch it at boot. Name field may be empty LMSTATUS.EXE Xerox WorkCenter XE - language monitor status application lmamanager.exe Added by the TILEBOT-AD WORM! QtZgAcer.EXE Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio QtZpAcer.exe Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio HotkeyApp.exe Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio QtaET2S.EXE Acer Launch Manager - on Acer laptops, provides configurability for the special keys on their range of multimedia keyboards lMAPl.exe Added by the AGOBOT-RE WORM! OSDCtrl.exe OSD (on-screen-display) utility - part of Acer Launch Manager. Gives you control to customize the monitor to your liking...from sound, brightness, contrast, horizontal and vertical positions, phase, pixel LMonitor.exe MSI Live Update - auto-detects and suggests the latest BIOS/Driver/Utilities information lmpdpsrv.exe Related to a Lexmark printer/scanner. Printer sharing server? Is it required? lmrt.exe Unidentified adware LMSTATUS.EXE Xerox WorkCenter XE - language monitor status application LMSXXD.exe Driver for Xerox XD series printer/copiers LMU.exe Downloader trojan, recognized by Kaspersky antivirus as Agent.bg AMSNDMGR.EXE Added by the KWBOT.R WORM! Note that the "l" is a lower case "L" and not an upper case "I" mdm.exe Added by the BINGHE TROJAN! msgsr32.exe Added by the SDBOT-QR WORM! [path to worm] Added by the KELVIR.AI WORM! MyGame.exe Added by the LAMEYEAR-A WORM! _Kerne1.exe Added by the LINEAGE-AN TROJAN! Internat.exe Added by the WOWCRAFT TROJAN! rundll32.exe Added by the WOWCRAFT TROJAN! svhost32.exe Added by the WOWCRAFT TROJAN! svchsot.exe Added by the GWGHOST-O TROJAN! explorer.exe Added by the LINEAGE-OZ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Kerne121.exe Added by the LINEAGE-ON TROJAN! Kerne1211.exe Added by the LINEAGE-DY TROJAN! SvHost.exe Added by the PESIN-D WORM! LOADWB.EXE Part of Stardock's WindowBlinds custom desktop program. "WindowBlinds is the first utility of its kind. It extends Win98/NT/2K/XP to have a fully skinnable user interface. You can change the style of titl Wscript.exe LGuarg.exe.vbs Added by the YENO.B and YENO.C WORMS! Lorena.exe Added by the MAPSON.C WORM! load32.exe Added by the NIBU, BAMBO TROJANS and DUMARU WORM! l32x.exe Added by the DUMARU.Z or DUMARU.Y or DUMARU.AD WORM! 1111a.exe Added by the DUMARU.AH WORM! swchost.exe Added by the TURTA.A WORM! netda.exe Added by the NIBU.E TROJAN! winldra.exe Added by the BACKDOOR.NIBU.J or DUMARU-BI TROJANS! Note - also known as Srv.SSA-KeyLogger by Sunbelt Software which has developed a free removal tool for this keylogger adw30.exe After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95 asistat.exe Status monitor for an NEC SuperScript printer cfgsys32.exe ?? esspk.exe Speakerphone capability through a soundcard for an ESS modem hotkey.exe Solo 5300 display driver for Win2K on some Gateway laptops HPWHRC.EXE Loads the Status Window software for the HP Laserjet printers WPSLOAD.EXE Windows printing system that comes with the setup for Canon BJC series on the manufacturer's disk vi_grm.exe Monitor drivers for Trio2x/3x based video cards - displays control panel for quick access to display settings WINOSCFG.EXE Could it be something to do with configuring Windows on a new PC from an OEM supplier? wpshrc.exe Required to prevent configuration errors on a Compaq LBP-660 and LBP-460 parallel port laser printers (and maybe others) Bfrecv.exe Bitware modem driver

X X X ? Y X X X X X Y X X X Y ? X X ? X X X X X X X X X X X X X X X X X X N X U X X U X X X X U X X X X X X X ? X X X X X X X X X X X X X X

load= msater.exe Added by the RETSAM TROJAN! load= shambl3r.exe Added by the REMABL WORM! load= Spoolsv.exe Added by the CIADOOR.B TROJAN! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Load= wtfeat.exe Associated with the Wintab Digitizer load= AICLIENT.EXE Asset Insight from Tangram - asset managing software. Required if an organisation is running a centrally administered asset management system load= hint.exe Added by the ATAK WORM! load= win32exec.exe Added by the BITTER WORM! load= a1g.exe Added by the ATAK.B WORM! load= dapdll.exe Added by the ATAK.E WORM! load= svhost32.exe Added by the LINEAGE-AB TROJAN! load= 01comm32.exe Related to Elsa CommPro (Communicate Pro) access software for Microlink modems - this software contains answering machine and fax functions, plus a terminal program, a WWW-browser launch func load= inetinfo.exe Added by the PROXY-GG TROJAN! load= Kerne14.exe Added by the LINEAGE-BA TROJAN! Loadab1 explorer.exe Added by the LINEAGE-AJ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added LoadBlackD blackd.exe This is the "intrusion detection system" of the BlackICE PC Protection (was Defender) firewall which loads independently of the "user interface" (BlackICE Utility) LoadBtnHnd BtnHnd.exe Fujitsu LifeBook related LoadDBackUp BcTool.exe Added by the GIBE WORM! loaddll loaddll.exe Winvest spyware LoadDvpApi9x DVPAPI9X.exe Part of Command AntiVirus for Windows 95/98/Me. Is it needed? loader loader.exe Homepage hijacker, redirecting to coolwwwsearch.com. Downloader for iedll.exe loader WMPLAYER.EXE Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup loader32 Loader32.exe Added by an unidentified TROJAN! loader32 sys*****.exe [***** = random digit]Added by the DOMCOM TROJAN! Loaders HeIp.exe Added by the SDBOT-ADB WORM! loadfax loadfax.exe Added by the WINFLUX-C TROJAN! LoadFonts LoadFonts.vbs Homepage hijacker that changes your homepage to an adult content site LoadFonts Tahoma.vbs Homepage hijacker that changes your homepage to an adult content site LoadGolfCourses LoadGolfCourses.exe PlayMiniGolf.com foistware - stealth installed! LoadHTML rundll32.exe mshtmpre.dll, MShtmpre Mshtmpre adware LoadingAgent ZipLoader32.exe Added by the OBLIVION TROJAN! This executable is one of the most common but there are more LoadingAgent msload32.exe Added by the OBLIVION TROJAN! This executable is one of the most common but there are more LoadManager msload.exe Added by the OPASERV.T WORM! loadMecq0 explorer.exe Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added loadMecq3 rundll32.exe Added by the LEGMIR-AS TROJAN! loadMect1 explorer.exe Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it loadMefs rundll32.exe Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the Window loadMefs smss32.exe Added by the FLOOD-EL TROJAN! LoadMSvcmm msvcmm32.exe Auto-update for Movielink - internet movie rental System Tray access LoadOrderVerification [random filename] Added by the TRON.A TROJAN! Loadout Manager nost_LM.exe Manager for the Belkin Nostromo n50 SpeedPad game controller - see here LoadPFW wmimgr.exe Added by the QEDS-B WORM! LoadPowerProfile ASDAPI.EXE Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll LoadPowerProfile Rundll32.exe powrprof.dll Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your selected power scheme. May not be required LoadPowerProfile Rundll.exe powerprof.dll Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses "Rundll.exe" whereas the uninfected version uses "Rundll32.exe" LoadPowerProfile rundl.exe Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll LoadPowerProfile Rundll32.exe Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line LoadPowerScheme rundll32.exe powerprof.dll CheckPowerProfile Ulubione adult content dialer LoadQM loadqm.exe Installed with MSN Explorer and loads the MSN Queue Manager. Required to enable the WU AutoUpdate feature. Note that disabling this can sometimes prevent internet sharing working on Win2K Pro S loads.exe loads.exe Added by MediaMotor ADWARE! loads.exe medload.exe Added by Medload ADWARE! loads.exe suploads.exe Added by the AGENT-BZ TROJAN! LoadService Rest In Peace Added by the KANGAROO-A WORM! LoadService Maaf, tempatmu bukan di sin Added by the KAGEN-A TROJAN! LoadService Virus Added by the CAGER.A WORM! LoadSIPS rundll32.exe [path] SIPSPI32.dll, SIPSPI32 123Mania adware LoadWatcher Test.exe Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct? LoadWatcher watcher.exe Added by the Watcher SPYWARE! loadwin winset.exe Added by the QQPASS-I TROJAN! loadwin winsys.exe Added by the QQPASS-J TROJAN! LoadWindowsFile [filename] Added by the DELF.B TROJAN! where [filename] is the infected file Local Area Network OpenGL.exe Added by a variant of the RBOT WORM! Local Authority Service lsass.exe Added by the AMRKTMAN-C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Local Internet Connection LIC.exe Added by the SDBOT-YA WORM! LOCAL INTERNET WEB DRIVERS FOR phqghume.exe WIN32 Added by a variant of the RBOT WORM! Local Page http://find.naupoint.com Naupoint browser hijacker Local runole service srvc32.exe Added by the SMALL-DP TROJAN! Local Security Authority Servce lssas.exe Added by the POEBOT-T WORM! Note - this is not the legitimate lsass.exe process Local Security Authority Service lssas.exe Added by the POEBOT-J WORM! Local Security Authority Service Isass.exe Added by the LINKBOT.M WORM! Local Service Intenat.exe Added by the NUCLEAR-J TROJAN!

U X U U X X X X X X X X X X N N U U U N X U U U N X N U N N U U U X U U X U X X U X Y N X N N U X X X U U X N X X X X X X X X X X X X X X X

LocalProxy proxy4free.exe Locator Service [filename] Lock My PC lockpc.exe Login winlog.exe login [path to trojan] Login Login.exe Login Screen Saver login.scr Login Service [path to file] LoginPassport Lgnpsp32.exe Logitech Logitech.exe Logitech Camera Soundcane.exe Logitech Desktop ApPache.exe Logitech Desktop IPCONN.EXE Logitech Desktop Controller wrcam.exe Logitech Desktop Messenger backweb-8876480.exe Logitech Desktop Messenger ldmconf.exe Logitech Hardware Abstraction Layer Khalmnpr.exe Logitech SetPoint KEM.exe Logitech Utility Logi_MwX.exe Logitech Wakeup lgwakeup.exe Logitech Wireless logitechwls.exe LogitechCameraAssistant CameraAssistant.exe LogitechCameraService(E) ElkCtrl.exe LogitechGalleryRepair ISStart.exe LogitechImageStudioTray LogiTray.exe Logitechs Logitechs.exe LogitechSoftwareUpdate ManifestEngine.exe LogitechVideoRepair ISStart.exe LogitechVideoTray LogiTray.exe LogiTray LogiTray.exe Logi_Mwx Logi_MwX.exe LogMeIn GUI LogMeInSystray.exe LogMeIn GUI ragui.exe Logo [path to trojan] Logon Loader LogonLoader.exe Logon Loader Random LogonLoader.exe Logon.exe logon.exe LogonStudio logonstudio.exe LogService wincalc.exe LogService lsass.exe LogWatch logwat95.exe longos WIWT.EXE Look 'n' Stop looknstop.exe LookNMeet Agent.exe Lookup_Sys lookupsys.exe Lotus Organizer EasyClip easyclip.exe Lotus QuickStart smartctr.exe Lotus SuiteStart suitest.exe LowVersionSupport [filename] Lpr Lpr123.exe Lpr123 Lpr123.exe LPS Lps.exe LPtask lptask.exe LRBZ Utility 32 lrbz32.exe LS120 Superdisk ?? LSA wfdmgr.exe LSA lsa.exe LSA Service LSASS.exe lsa Services lsa2srv.exe LSA Shell (Export Version) LSASS.exe LsaManager lsamgr.exe lsass lsass.exe lsass start.bat lsass [path to lsass.exe] lsass lsasrv.exe Lsass woekd.exe lsass elite***32.exe Lsass Lsass.exe Lsass Lsass.exe LSASS 32 ISASS32.pif

ProxyTools is a package of Perl network utilities designed mainly to assist those whose Internet access is censored, unreliable, or otherwise damaged. Uncensored access is provided to any outside serv Added by the AGOBOT-KY TROJAN! Lock_My_PC - a tool for quick computer locking when you leave it unattended. It shows a lock screen, disables Windows hot keys and mouse Salfeld Child Control 2003 - parental control software Added by the HOTWORD-A TROJAN! Added by the BANCBAN-AH TROJAN! Added by the RBOT-AVN WORM! Added by the MIGMAF TROJAN! Added by the REDIST.C WORM! Added by the RBOT.BJH WORM! Added by the SDBOT.MUC WORM! Added by the RBOT-YP WORM! Added by the SDBOT-WE WORM! Added by a variant of the RBOT WORM! Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech For a Logitech Bluetooth wireless mouse. Part of SetPoint that sets the Windows mouse sensitivity to minimum. The idea is that you will use the SetPoint Control Panel to adjust your mouse sensitivity. T Keyboard and mouse drivers and utilities for Logitech's latest products - supersedes iTouch and MouseWare on their older products. Required if you use special features such as multimedia keys Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control ce Added by the MYTOB-BS WORM! Related to Logitech QuickCams and provides additional configuration options for these devices Related to Logitech Camera Service and provides additional configuration options for these devices LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and Logitech Image Studio - installed with Logitech QuickCams Added by the SDBOT.BWE WORM! Updater, part of Logitech Image Studio - installed with Logitech QuickCam cameras LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and Logitech Image Studio - installed with Logitech QuickCams Logitech Image Studio - installed with Logitech QuickCams Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, an intranet or the Internet) - and on the client sid RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, an intranet or the Internet) - and on the client sid Added by the DLOADER-RH TROJAN! Logon Loader - customize boot & login screens Logon Loader - customize boot & login screens Added by the ZINS.A TROJAN! WinCustomize LogonStudio - "Allows Windows XP users to edit, change, and apply new logon screens. LogonStudio comes built with a visual editor to make it easy to create your own logons which can t Added by the PAPROXY TROJAN! Added by the IU TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Start Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll - see here. Not required if you already have a newer version or the patc Added by the BANKER-CD TROJAN! Look 'n' Stop personal firewall LooknMeet dating service P04n trojan The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address, appointment, task or Notepad page. Available via Start -> Programs Lotus central application, called SmartCenter, which runs on the Windows desktop. SmartCenter toolbar stretches across the top or, optionally, the bottom of the screen. Uses a lot of resources. Availab Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available Added by the LASTRAS TROJAN! Added by the REMPSTEAL password stealer TROJAN! Added by the REMPSTEAL password stealer TROJAN! Local Port Scanner - "With LPS you're able to check your computer for open or listening ports" Program Lock It And Protect Pro - lock and protect your folders from being opened, moved or deleted Added by the AGOBOT-JQ WORM! Supposed to accelerate transfer rate on LS-120, contributes to system lockups Added by the MYTOB.C WORM! Added by the SDBOT-YV WORM! Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Added by the TAME-C WORM! Added by several variants of the AHKER WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally Added by the BEAGLE.DR WORM! Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the ZCREW TROJAN! Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup! Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS! Added by an unidentified WORM or TROJAN! EliteBar ADWARE! Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the ASSIRAL-C WORM!

X X X X X X X X X X N X X X N X N X X Y X X X X X X X U Y Y N X X Y X X X U X Y U U U U N ? ? ? Y ? ? ? ? U U ? N ? U X ? X N X X X X N X U

LSASS Authority LSASS Daemon lsass service lsass2k Update LSASS32 lsass32 lsass64BiT.exe lsassig lsasss lsasss.exe lsburnwatcher lsess lsmass lsmss.exe LSPFix lspins LSPmonitor lssass LSvr LT DAEMON LTDMgr LTM2 LTM2 LTM2 LTM2 LTM2 LTM2 LtMoh LTMSG Lto Manager LTSMMSG LTSMSG LTT2 LTWinModem1 ltwob ltwob ltwob LUGuard lup Lusetup LVComs LVCOMSX LWBMOUSE LWBMOUSE Lwinst Run Profiler lxamsp32 LXbbmgr LXBLKsk lxbrbmgr LXBRKsk LXBSCATS LXBTCATS LXCCCATS lxccmon.exe LXCGCATS lxcgmon.exe LXSUPMON lycosInside LyraHD2TrayApp LzioMediaUpdater M Player Post Installer M S DVD DirectX Dll Drivers M-Audio Delta Taskbar Icon M-soft Office M1cr0s0ft S3rcurity M1cr0s0ft Upd4t4zS m32info M3Tray Macfee Security Patch Machine Debug Manager

lshosts32.exe Added by the SDBOT-UY TROJAN! LSASSd.exe Added by a variant of the AGOBOT/GAOBOT WORM! lsass2.exe Added by a variant of the AGOBOT/GAOBOT WORM! lsass2k.exe Added by a variant of the RBOT WORM! Isass32.exe Added by the KELVIR.M WORM! lsass32.exe Added by the LYDRA-B TROJAN! lsass64BiT.exe Added by the FORBOT-CK WORM! lsassig.exe Added by the BANCOS-EC TROJAN! lsasss.exe Added by the GEEKMY-A TROJAN! lsasss.exe Added by the SASSER.E WORM! lsburnwatcher.exe Used for automatically updating HP programs lsess.exe Added by the SINNAKA.A WORM! lsmass.exe Added by the WALLOP-B TROJAN! lsmss.exe Added by the PROXY-GG TROJAN! LSPmonitor.exe eAcceleration Stop-Sign related - not recommended, see note igps.exe Reported as the VB.KC TROJAN by Kapersky Anti-Virus LSPmonitor.exe eAcceleration Stop-Sign related - not recommended, see note lssas.exe Added by the AGOBOT.RL WORM! LSvr.exe PowerStrip foistware ltdaemon.exe Acts as a data spooler for the DSL modem (similar to a cache). Do not uncheck if the DSL modem is being used LTDMgr.exe PowerStrip foistware MSGSRV32.EXE Added by the LITMUS.A TROJAN! Note - MSGSRV32.EXE in this case is in a Litmus sub-directory and is not to be confused with the valid version in C:WindowsSystem MPGSRV32.EXE Added by the LITMUS.201 TROJAN! MSGSRV320.EXE Added by the LITMUS.C TROJAN! winupdate.exe Added by the LITMUS.203 TROJAN! bible.exe Added by the LITMUS.203 TROJAN! winscan.exe Added by the LITMUS-B TROJAN! Ltmoh.exe Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet ltmsg.exe One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem inf DesktopLtoManager.exe Related to Global Positioning System (GPS) found on HP iPAQ hw6500 unit and others LTSMMSG.exe Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook, Acer and Sony Vaio notebooks, maybe others too Shell32.exe Added by the LEMIR.B TROJAN! rundll32.exe Added by the LINEAGE-BI TROJAN! ltmsg.exe One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem inf formatsys.exe Added by the SERFLOG.A WORM! msmbw.exe Added by the SERFLOG.A WORM! serbw.exe Added by the SERFLOG.A WORM! LUGuard.exe PC-Duo Remote Control enables your help desk technicians to take instant control of any remote desktop PC at any location across the LAN, WAN or internet lup.exe Added by the IRCBOT_GEN WORM! LUSetup.exe Symantec LiveUpdate installer - required to install a new version of the application. Will only run once, and the entry is automatically deleted after a reboot lvcoms.exe Lvcomm server. Related to Logitech Quick Cam - works fine without it but it is needed for the Logitech ImageStudio software to connect to the camera LVCOMSX.EXE It provides extra functionality for Logitech multimedia webcam devices. It is non-essential to the running of the system, but should not be terminated unless suspected to be causing problems lwbwheel.exe Mouse driver - required if you use non-standard Windows driver features MOUSE32A.EXE Mouse driver - required if you use non-standard Windows driver features lwtest.exe Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs lxamsp32.exe Associated with a Lexmark Printer - is it required? LXbbmgr.exe Lexmark printer button manager? Is it required? LXBLKsk.exe Lexmark related. What does it do, and is it required? lxbrbmgr.exe Lexmark printer button manager. Required for correct operation LXBRKsk.exe Lexmark printer related. What does it do and is it required? rundll32 [path] LXBStime.dll, _RunDLLEntry@16 Related to the DLT LibraryXpressLXB tape backup storage device - what does it do and is it required? rundll32 [path] LXBTtime.dll, _RunDLLEntry@16 Lexmark printer related - what does it do and is it required? rundll32 [path] LXCCtime.dll, _RunDLLEntry@16 Lexmark printer related - what does it do and is it required? lxccmon.exe Lexmark 3300 series printers/scanners LXCGtime.dll Lexmark printing software - reports back on printer and cartridge useage lxcgmon.exe Lexmark printer related - what does it do and is it required? LXSUPMON.EXE Lexmark Printer. The printer should work fine without it Lyc_SysTray.exe Lycos eMail related - what does it do and is it required? LYRAHD2TrayApp.exe Related to RCA Lyra MP3 Player LzioMediaUpdater.exe LZIO.com adware downloader postinstallm.exe ?? msxdl.exe Added by the SDBOT-BJN WORM! DeltTray.exe M-Audio Delta Control Panel for M-Audio brand Delta series audio cards. System Tray access to audio settings - available through Control Panel M-soft Office.hta HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! systemconfig.exe Added by the RBOT.BKB WORM! update32.exe Added by the RBOT-MI WORM! m32info.exe Added by the CRYPTER.A TROJAN! m3tray.exe Movielink - internet movie rental System Tray access Mpfsheild.exe Added by the RBOT-NP WORM! mdm.exe Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and

X X N N X X X Y N U U U N ? U U U X Y X U ? X X X X X U X U N X X X X X X N U N U U U X X N N N N N N X Y U Y U U ? U U X X X X X X X X X X

Machine Debug Manager msdn.exe Added by a variant of the RBOT WORM! Machine Update Soft wusas.exe Added by an unidfentified WORM! MacLic MacLic.exe Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks MacName MacName.exe Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks Macromedia Critical Updater rarww.exe Added by a variant of the RBOT WORM! Macromedia Dreamweaver XM macdwXM.exe Added by the AGOBOT-RI WORM! Macromedia Drive Iexplor32.exe Added by a variant of the RBOT WORM! MAD.EXE MAD.EXE MAD.exe is the MS Exchange 5.5 System Attendant and can also consume a large amount of resources - resolved by the latest Exchange 5.5 Service Pack. Also part of Exchange 2000 Server but does it MadExe LaunchRA.exe Dell Resolution Assistant MAFWTaskbarApp MAFWTray.exe Drivers for the M-Audio Firewire Audiophile - Interface MagicDsk MAGICDSK.EXE Magic DeskTop is a small and novel utility which will allow you the option of hiding or showing your desktop icons MagicKeyboard PreMKBD.exe Related to Samsung laptops. Provides ability to program keys to perform specific functions Magitime Magitime.exe Magitime - connection tracking utility which monitors online time, expense, data transfer Mail.com mcalert.exe Mail.com - free web-mail service. Does mcalert.exe notify you when new mail has arrived? MailBell mailbell.exe MailBell e-mail notification tool that will notify you about new messages arrived to your mailbox. Works with both POP3 mailboxes and web-mail based systems. You should be able to set your mail syste Mailbox Verifier mboxvrfy.exe Mailbox Verifier (MV) is free software that will notify you about new messages arrived to your mailbox. Only works with POP3 mailboxes (not web-mail based systems). You should be able to set your ma MailCleaner MAILCLEANER.EXE MailCleaner "protect your computer from viruses sent to your machine via the popular e-Mail reader Incredimail. In addition the program will check all incoming files downloaded by Internet Explorer, Ne mailman.exe mailman.exe Added by the CERTIF-E TROJAN! MailScan Dispatcher Launch.exe MailScan Dispatcher splits each e-mail message into various components such as the header, body and attachment. Compressed formats (ZIP, ARJ, etc.) are scanned for viruses and cleaned Mail_Check Mail_Check.exe Added by the PANOIL.C WORM! MAIN main.exe SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Main Executable (HP) HP05T0R5.exe HP (Hewlett-Packard) related. Maybe related to printers. Now - what does it do? main16 main16.exe Added by the CRYPTER.A TROJAN! main32 main32.exe Added by the CRYPTER.A TROJAN! MainStart svcmfte32.exe Added by the STINX-A TROJAN! mainviewex mainviewex.exe Added by the GEMA.D TROJAN! Major Microsoft Windows Driver Boot bpool.exe loader Added by the MYTOB.AJ WORM! Malware Sweeper MalSwep.exe Malware Sweeper - "Protects the user from malicious malware and monitors the sanity of the running programs" ManageProtocolCtrl csmsv.exe Added by the LOOKSKY.B TROJAN! Manager Monitor monitor.exe MindStorm AnalyzerPro from Secure Associates. "A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices" Mania Win Restore RESWIN.EXE Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs Mantis [filename] Added by the MANTIBE VIRUS! MapiDrv mpisvc.exe Added by the MIPSIV TROJAN! mapisvc32 mapisvc32.exe Added by the KX VIRUS and also recognised by Symantec as FPAI adware mark the service xxtra32.exe Added by the SDBOT.APP WORM! Martini pinmart.exe Added by a variant of the SDBOT WORM! Mascro soft SDK updates2 SDKrepair2.exe Added by the SDBOT.BXM WORM! masqform.exe masqform.exe PureEdge Viewer 6.0, reportedly associated with viewing and text editing US Air Force electronic forms masqform.exe masqform.exe PureEdge Viewer - provides automation framework to manage and deploy XML forms-based processes for e-business and e-government systems. PureEdge was taken over by IBM (see here) and the pro Mass storage check registry rundll32.exe MSDServ.dll, check registry Used with a USB based smartmedia card reader Master Volume Spy MASTERVOLUMESPY.EXE Volume control for the Gateway Destination "DestiVu" media interface Matador mlfbuddy.exe MailFrontier - anti-spam application Matador mantispm.exe MailFrontier Desktop (Matador) email spam blocker software MatrixScreen [filename] Added by the MATRIXSCREEN TROJAN! MatrixScreenSaver mss.exe Malware, see here Matrox Color Control hgcctl95.exe For Matrox video cards. Quick access to changing colors Matrox Control Center mgactrl.exe For Matrox video cards. Quick access to settings Matrox Diagnostic mgadiag.exe For Matrox video cards. Quick access to diagnostics Matrox Powerdesk PDesk.exe For Matrox video cards. Quick access to tweak your card to your liking Matrox PowerDesk 8 Matrox.PowerDesk.exe /silent For Matrox video cards. Quick access to tweak your card to your liking Matrox QuickDesk mgaqdesk.exe For Matrox video cards. Quick access to tweak your card to your liking MaxAlerts max.exe Bonzi MaxALERT - spyware MaxtorCombo ComboButton.exe Required to be able to use the Maxtor OneTouch button on your external Maxtor harddrive. It is used to start up backup software (Retrospect) MaxtorReg AUTOREG.EXE Part of SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of MayaPan MayaPan.Exe Audiotrak Maya soundcard driver MBM 4 MBM4.exe Motherboard Monitor 4 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs MBM 5 MBM5.exe Motherboard Monitor 5 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs MBMon Rundll32 CTMBHA.DLL, MBMon Creative Filter AudioControlMB Module - related to the Creative Audigy line of sound cards. What does it do and is it required? MBNet mbnet.exe MBNet (Portugal) Credit Card Processing software MBProbe mbrpobe.exe MBProbe - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs MC wintrims.exe Added by the WINTRIM TROJAN! MC MAGICON.EXE Added by the MAGICON.A TROJAN! MC N/A Added by the SIMCSS TROJAN! MC WINTRIM.EXE Added by the WINTRIM_A TROJAN! McAfee McAffeAv.exe Added by the NETSKY.AL WORM! Mcafee Anti Scan NortonScn.exe Added by a variant of the RBOT WORM! McAfee Antivirus McAfeeAV.exe Added by a variant of the RBOT WORM! Mcafee Antivirus Monitoring System326 VSStatmn326.exe Added by a variant of the SDBOT WORM! Mcafee Antivirus Monitoring System32mn VSStatmn32.exe Added by a variant of the RBOT WORM! McAfee Antivirus Protection mcafeeAV.exe Added by a variant of the RBOT WORM!

X Y N N X X N U X Y Y Y X U ? N X ? X Y Y U Y Y X X X X N N X X X U X X X X X X X X N X X X X X U X X X X X X X X X X X X X X X X N U U U X

Mcafee Auto Protect mcafeshield.exe McAfee Firewall CPD.EXE McAfee Guardian CMGRDIAN.EXE McAfee QuickClean Imonitor Plguni.exe mcafee Software Intrenet mcafee.exe McAfee Windows Protection mcafee32.exe McAfee Winguage ?? McAfee.InstantUpdate.Monitor RuLaunch.exe McAfeeScanPlus McAfeeScanPlus.exe McAfeeUpdaterUI UpdaterUI.exe McAfeeVirusScanService Avsynmgr.exe McAfeeWebscanX WebScanX.exe Mcaffe Antivirus Mcafeescn.exe McAgentExe mcagent.exe Mcappins.exe mcappins.exe MChanger MChanger.exe MCM3 mcm3.exe McRegWiz mcregwiz.exe Mcrosoftr Update Mcrosoftr.exe McShld9x mcshld9x.exe MCTskShd mctskshd.exe McUpdateExe mcupdate.exe McVsRte mcvsrte.exe mcvsshld mcvsshld.exe MCX Update wisp.exe MCX Updte scorti.exe MD IE Plugin md.exe MD IE Plugin winy.exe mdac_runonce runonce.exe MDDiskProtect.exe MDDiskProtect.exe mdetect [path to trojan] Mdm Mdm.vbs mdm mdm.exe MDM7 mdm.exe Mdmdll mdmdll.exe Mdmdll32 mdmdll32.exe MDN MDNS.exe MDN MDNZ.exe MDN MDN.exe mds.exe mds.exe MDSA Sentinel X smss.exe mdwmdmsp mdwmdmsp.exe MECA Meca.exe MedGS MEDGS1.exe Media Access MediaAccK.exe Media Access MediaAccK.exe Media Gateway MediaGateway.exe Media Load msn32.exe Media Manager Indexer AIRSVCU.EXE Media Pass MediaPassK.exe Media Pass MediaPass.exe Media Player media.exe Media Player wmplayer.exe Media Player Sysdll.exe Media Player Sysnet.exe Media Player Update xpsp1mfh.exe Media Plug x.1.2 msdm.exe Media Service msn64.exe Media service msnmsgxr.exe Media service SYSTEM64.EXE Media service notpad.exe Media Software UPdater sscs.exe Media X Services MSNGRx.exe Media-XP-Service-Pack3 msnzx.exe MEDIA32 [path to trojan] MediaFace Integration Sethook.exe Mediafour Mac Volume NotificationsMacvntfy.exe Mediafour XPlay Tray Notification Icon Xptryicn.exe MediaKey MediaKey.exe MediaLoads dw.exe

Added by the RBOT-UH WORM! Firewall bundled with McAfee VirusScan 6.*. Can also be listed as CPD_EXE McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Added by the RBOT-ATR WORM! Note - this is not a valid McAfee program Added by a variant of the SPYBOT WORM! Part of McAfee Nuts & Bolts. "WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Added by the Backdoor.Mepcod TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder Associated with McAfee Enterprise 7.0.0. - background process From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe), WebScanX (Webscanx.exe), VirusScan System Scan (Vshwin32.exe) and VirusScan Console (Avconsol.exe) under one app From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc Added by a variant of the SPYBOT WORM! From McAfee VirusScan On-line. The Agent is a red M icon that appears in the Windows system tray or Notification Area (if you're running Windows XP). If you don't see the agent icon, VirusScan Online McAfee Application Installer. What does it do and is it required? Media Changer - utility that allows you to change wallpapers, sounds, themes, etc ShopAtHome/SAHagent adware variant McAfee antivirus related. What does it do and is it required? Added by a variant of the RBOT WORM! Part of McAfee's Virusscan Online. Must be enabled for scanning to work Part of McAfee SecurityCenter. Runs in the background controlling critcal updates and control antivirus related actions. This program is important for the stable and secure running of your computer From McAfee VirusScan On-line. Automatically updates your virus definitions. Leave enabled unless you regularly update these definitions Part of McAfee's SecurityCenter. Must remain checked but one user reports Windows glitches with no response from McAfee as to why McAfee VirusScan On-line. See also the McAgentExe entry Added by the RBOT-AQH WORM! Added by the RBOT-ARP WORM! Marketdart spyware Adware Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe". MediaFour MacDrive for Windows - easily open, edit and save files from Mac-formatted disks, format Mac disks and burn Mac CDs and DVDs! Added by the SPABOT TROJAN! Added by the WHITEHO VIRUS or TRAPPY WORM! Added by the LYDRA-F TROJAN! Note - this is not the valid Machine Debug Manager which shares the same filename Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and Added by the CRYPTER TROJAN! Added by a variant of the CRYPTER.C TROJAN! Added by the SPYBOT.JPB WORM! Added by the RBOT.AQD WORM! Added by the RBOT.AOA WORM! Added by the MADS-A TROJAN! Added by SentinelX spyware. Note - SentinelX is spyware that logs keystrokes. It also monitors and records Web sites visited and applications used. The risk can capture periodic screen shots and may b Adware - recognized by Kaspersky antivirus and others as TrojanDownloader.Win32.Agent.am Meca instant messenging client PacerD_Media/Pacimedia.com adware Windupdates MEDIAPAS.A adware Added by the PODROP-C TROJAN! 180Solutions Windupdates adware variant - also see here Added by a unidentified WORM or TROJAN! Part of MS Visual InterDev, Media Manager is an easy media file management system that works in conjunction with Windows Explorer. The Media Manager Indexer is a program that indexes all the info MediaPass adware WindUpdates MediaPass adware Added by the FLDMEDIA-A TROJAN! Added by the AGOBOT-BM WORM! Added by the BANKER-BR TROJAN! Added by the BANKER.MW WORM! Added by a variant of the RBOT WORM! Added by the MULDROP.352 VIRUS! Added by the SPYBOT.EV WORM! Added by the SDBOT.TF WORM! Added by the RBOT.QV WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the RBOT-ABE WORM! Added by the RBOT.AUL WORM! Added by the SDBOT-ACW WORM! Added by the PURSCAN-Z TROJAN! Fellowes Neato(tm) cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod Multimedia keyboard manager. Required if you use the multimedia keys Medialoads adware

X N X X X X X N X X X X X X X U X X U U X X X N U X U U U X U X X N U N N X N U X X X Y X X X X X X X X X U N N N X X N X X X X ? X X ? N ?

MediaLoads Installer dw.exe MediaMonitor Mediam~1.exe mediamotor.exe mmups.exe MediaPath Proyecto1.exe MediaPath Root.exe MediaPipe P2P Loader mpp2pl.exe mediapluscash.exe mediapluscash.exe MediaRing Talk mrtalk.exe MediaXPServicePack mxpsp.exe media_driver media_driver.exe media_manager mediaman.exe media_stub stub.exe Meeting Connection comsutil.exe Meeting Connection wowdache.exe Meeting Connection hgakdl32.exe MegaPanel HSTrans.exe Members area ******.exe [* = random digit] MemConfig SetupIE.com MemMonster memmnstr.exe MemoKit MK.EXE memory outlookrem.exe Memory Check memore.exe Memory manager himem32.exe Memory Stick Monitor MSTAT.exe Memory Stick Monitor MSstat.exe Memory Watcher MemoryWatcher.exe Memory+ tfimemsr.exe MemoryBoost MemoryBoost.exe MemoryCardManager MemCard.exe MemoryMeter MemoryMeter.exe MemoryZipperPlus memzip.exe memreader.exe memreader.exe MEMreaload MEMreaload.exe MemScanner MemScanner.exe MemTurbo memturbo.exe MenuSnap MenuSnap.exe Mercora MercoraClient.exe Message Queuing msmqs.exe MessagerStarter Freeserve StartMessager.exe Message_Blocker messageblock.exe Messanger trillian.exe Messanger deamon.exe Messanger msgaol.exe Messanger s menu.exe Messenger messenger.exe Messenger ntsubsys.exe Messenger Wmsngr.exe Messenger Block msngrblock.exe Messenger Protocol netsender.exe Messenger Service msmsgs.exe Messenger Service nvhost.exe Messenger start-up Msgran.exe Messenger6 command.pif MessengerDiscovery MessengerDiscovery.exe MessengerPlus MsgPlus.exe MessengerPlus2 MsgPlus.exe MessengerPlus3 MsgPlus.exe messnger [worm filename] messnger Dvldr32.exe Metacafe MetacafeAgent.exe MeTaLRoCk (irc.musirc.com) has sex metalrock-is-gay.exe with printers MeuPrograma accwizz.exe Mfc**.exe [* = random char] Mfc**.exe [* = random char] Mfc**32.exe [* = random char] Mfc**32.exe [* = random char] mfgboot ?? mFilter MNeck.exe mfin32 mfin32.exe MGA Hook Mgahook.exe MGA Quickdesk MGAQDESK.EXE Mgabg Mgabg.exe

Medialoads adware Installed by Smartdisk MVP CD burning software. Software will work fine without it Added by the AGENT-BY TROJAN! Added by the GRUEL WORM! Added by the GRUEL WORM! MediaPipe peer-to-peer file swapping program also reported as a hijacker Added by MediaGateway ADWARE! Media Ring Talk, voice recognition software, Resource hog. Available via Start -> Programs Added by the SDBOT.CDT WORM! Added by the TUPEG VIRUS! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Mini-Player, IMESH related foistware, see here Mini-Player, IMESH related foistware, see here Added by the PPDOOR-E TROJAN! Added by the PPDOOR-D TROJAN! Looks like a variant of the PPDOOR-E TROJAN! Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielse Premium rate adult content dialer Added by the TAPLAK WORM! MemMonster - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Memory optimizer. It loads from startup group and it goes off as soon as the program (memokit.exe) is loaded in the System Tray. Mk.exe does not run while the memokit.exe is running. Probably loads Added by the NOPIR.C WORM! Added by the KILLAV.C TROJAN! Added by the MANCSYN TROJAN! Used with the Sony floppy disk adapter for memory sticks, showing if there is a stick in the computer Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive MemoryWatcher spyware Memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind MemoryBoost - memory optimizing program made by Tenebril Inc. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own Memory Card Manager - for removable memory cards found on Dell or Lexmark photo printers Autoinstalling spyware by Total Velocity Memory Zipper Plus - "optimizes the memory management of your system and boost-up its performance amazingly!" Added by the AGOBOT-TY WORM! Added by the LAZAR TROJAN! Part of Enigma SpyHunter - not recommended, see note MemTurbo memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicki Mercora MusicSearch "Search, find and listen to music on the world's largest jukebox, built by people just like you". Note - if you subscribe make sure you read the Privacy Policy Added by the FREEFORS TROJAN! Freeserve Messenger Message Blocker - "prevents Outlook Express from loading images or other content from the internet without confirmation, as well as executing scripts when displaying a formatted email message" Added by a variant of the AGOBOT/GAOBOT WORM! Added by the TACTSLAY.C TROJAN! Added by the TACTSLAY.C TROJAN! Added by the TACTSLAY.C TROJAN! Added by the KUTEX TROJAN! Added by the SDBOT.BGE WORM! Added by a variant of the RBOT WORM! Added by the PATOO WORM! Added by the SDBOT-ACC WORM! Added by the SDBOT-ZB WORM! Added by the JLOK-A WORM! Added by the GRAMOS WORM! Added by the INZAE.B WORM! MessengerDiscovery is a MSN Messenger add-on - adding over 70 new features MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - mak MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - mak MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - mak Added by the DELODER WORM! Added by the DELODER.A WORM! Metacafe - video sharing on the web. Note - if you subscribe make sure you read the Privacy Policy Added by the RANDEX.Q WORM! Added by the RULAND.A WORM! CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log ?? Added by the CLICKER-AG TROJAN! MyFreeInternetUpdate - adware downloader MATROX Graphics card related. What does it do and is it required? For Matrox video cards. Quick access to tweak your card to your liking Matrox BIOS Guard. What does it do and is it required?

Y Y Y Y N X X N X X X X X X X X X X U N X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X X X X X X X

mgavctrl mgavrtcl.exe mgavctrl mgavrte.exe mgavrtclexe mgavrtcl.exe mgavrtclexe mgavrte.exe MGA_CD_Install mgasetup.exe mgmtapi mgmtapi.exe MHDOGStart mhdogst.EXE MHINIT MHINIT.EXE Mickey Mouse Cereal [random filename].exe Micr Update soundblaster.exe Micr0s0ft Ms D0s msdx.exe Micrcoft Exploerer spoolsal.exe Micrcoft Exploerer svchose.exe Micrcoft Updat spoolsae.exe Micrcoft Updat spoolsaex.exe Micrcoft Updat Internet.exe Micro Process appconf.exe Micro Update dailin.exe Microangelo Desktop Muamgr.exe microAttuneDownload atmdlusr.exe MicroCQ0 explorer.exe MicroDialler atdialler1.exe MicroedSoft Toolbar Smoked.exe Microfinder lptt01 mcf.exe Microfinder ml097e mcf.exe Microfot Update winldx32.exe Microft Exploerer spoolsac.exe Microft Update 32 winssx.exe MicroLoad [random filename] Micromedia Flash Update wdfmrg.exe Microoft Timing pupdate.exe MICROSFT ANTIVIRUS UPDATE SUPPORT [random 10-letter filename].EXE MICROSFT ANTIVIRUS UPDATE SUPPORT MSGUPDATED.EXE Microsft Confige 32 msaconfigurez.exe MICROSFT MX UPDATE SUPPORT taskmngrs.exe MICROSFT RAMA UPDATE SUPPORT[random filename] MICROSFT RAMA UPDATE SUPPORTMSN32.EXE MICROSFT RAMA UPDATE SUPPORTmtakthmyn.EXE microsft windows updates mwupdate32.exe Microsof Value nmatt.exe Microsof Windows Host svhost32.exe Microsof Winlog Host wilogon32.exe Microsofot x386 System Monitor system32.exe microsoft svchost.exe microsoft microsoft.hta Microsoft win32.exe Microsoft iexplore.exe Microsoft svchost.exe Microsoft Associates, Inc. iexplorer.exe Microsoft (C) HTML Application host[random filename] Microsoft .NET Confingurator msnconf.exe Microsoft 16Bit Update wuapdate16.exe Microsoft 64 Bit Runtime Updater wupdt64.exe Microsoft ActiveX Debugger NT [path to trojan] Microsoft ADservice [random filename] Microsoft Agent mdss32.exe Microsoft ALG32 Protocol alg32.exe Microsoft Announcement Listener Annclist.exe Microsoft Ansti Update msie.exe Microsoft AntiSpyware Bazzi.exe Microsoft AOL Instant Messenger MSAOL32.exe Microsoft AOL32 Protocol aol32.exe Microsoft Application Manager msapl32.exe Microsoft AUT Update MSlti32.exe Microsoft AUT Update MSlti16.exe Microsoft Authority Service lsass.exe Microsoft auto update winupdate.exe Microsoft Automatic Update Serivcemsautou.exe Microsoft Automatic Updater Explorer.exe Microsoft AutoUpdater svhost.exe

McAfee's Virus Scan Online McAfee's Virus Scan Online McAfee's Virus Scan Online McAfee's Virus Scan Online Matrox Millennium video driver. Not required once drivers installed Unidentified malware Added by an unidentified VIRUS, WORM or TROJAN! A possibility is a trojan known as PENIS Part of the Cybermedia Clean Sweep package Added by the RANKY.Q TROJAN! Added by the SDBOT.NP WORM! Added by the RBOT-AON WORM! Added by the RBOT-AKK WORM! Added by the RBOT-ASL WORM! Added by the RBOT-AIB WORM! Added by the RBOT-AJM WORM! Added by the RBOT-ANA WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT-ER WORM! Quick access to MicroAngelo 5.0. It can make the background of the icon text transparent and also change the color of the shortcut's text to a color you want. Very useful, if you have a wallpaper. Availa Application Launcher, MS Office application. USR (US Robotics) modem auto updater. May be a sub-set of Attune Added by the LINEAGE-AK TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered Added by the RBOT-ALN WORM! RapidBlaster variant (in a "mcf" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "mcf" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Added by a variant of the RBOT WORM! Added by the RBOT-AMD WORM! Added by the RBOT-AQS WORM! Added by the DARBY WORM! Added by a variant of the SDBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AQA WORM! Added by the RBOT-APZ WORM! Added by the RBOT.CLC WORM! Added by the RBOT-AUZ WORM! Added by the RBOT-ASM or RBOT-AUW WORMS! Added by the RBOT-AWJ WORM! Added by the RBOT-AUJ WORM! Added by a variant of the TOXBOT/CODBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT.ADY WORM! Added by the RBOT.XC WORM! Added by the WOOTBOT.M WORM! Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Added by the DARKMOON TROJAN! Added by the QQROB-R TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figur Added by the ADUYO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by a variant of the LOVGATE WORM! Added by the RBOT-YB WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by the RBOT.CZ WORM! Added by a variant of the RBOT WORM! Added by the BANCOS-DO TROJAN! Added by a variant of the RBOT WORM! Added by the KEYLOG-AG TROJAN! Added by a variant of the SPYBOT WORM! MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Added by the RBOT-LE WORM! Added by the AHKER.J WORM! Added by the RBOT-AAI WORM! Added by a variant of the SPYBOT WORM! Added by the BROPIA-AE TROJAN! Added by the RBOT-X WORM! Added by the RBOT.EB WORM! Added by the KALEL-D WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Added by the BMBOT TROJAN! Added by the RBOT-AOB WORM! Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m Added by the RBOT.QG WORM!

X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft

Bool Value MV2.exe boot system cfg32 actboost.exe Broadband Networking MSBNTray.exe Cab Manager exec.exe checker MsPMSPTv.exe Client mshost.exe Client Pc spoolsrv.exe Client/Server Runtime Server csrs.exe Subsystem Client/Server Runtime Server csrssa.exe Subsystem Command Line wincmd.exe Conf Ldr sysconf.exe ConfgKeys wurmgrd32.exe Config msconf.exe Config MSCONF.EXE Config 32 msconfigx32.exe Config 32bit mscnfg32.exe Config File config.exe Configs 32 msgconfigrs.exe Configure 32 msgconfigre.exe Connection Manager Monitor cmmon.pif Control Center crtl.exe Core Support MSxUP32.exe Corp Updates wupdates.exe Corporation [random filename] Corporation jview.exe Crs Fix Serv wincrs.exe CSRSS32 Protocol csrss32.exe CSRSS386 Protocol csrss386.exe Cvrt mscvrt32.exe Data Helper cihost.exe Data Machine csdata32.exe Database Handler mssql32.exe Datalog Application msdata.exe DDE Control wupades.exe DDEs Control Erun.pif Debug Service dbgbgr.exe Decryption Technology Msfenoe.exe Desktop Manager msdesk32.exe Dev iexplorer32.exe Development Debugger msdev.exe Device Manager msdevmgr32.exe Diagnostic [random filename] Diagnostic msdiag32.exe Digital Clock msclock.exe DirectX Spoolserv.exe DirectX rasmngr.exe DirectX PDSched.exe DirectX wuamgrd.exe DirectX time123.exe DLL fumeta.exe DLL Extensions SystemDll.exe Dll Management windll.exe Dll Printer Manager dllpt.exe DLL Verifier file.exe DLL Verifier chkfile.exe DLL Verifier csrssv.exe DLLSet32 dllset32.exe DNS Query msdns.exe Document krisp.exe Driver faet.exe Driver Manager mswindrv.exe driver update Mshome.exe Drivers WSconf.exe ErgoPack wserb32.exe EV32 Service MSev32.exe Excel msexcel.exe Excell wuamngr32.exe Executing microsoft.exe Explorer svapache.exe Explorer explorer.scr

Added by a variant of the RBOT WORM! Added by the BROPIA.R WORM! Microsoft Broadband Networking Tray Application Affilred.B adware Added by a variant of the SDBOT WORM! Added by the RBOT-AND WORM! Added by the RBOT-AQM WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the SDBOT TROJAN! Added by the RBOT-ARX WORM! Added by the RBOT.PV WORM! Added by the RBOT-LG WORM! Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant Added by the RBOT-Z WORM! Added by the KILLFILES.GR TROJAN! This is malware that will attempt to delete all system dlls! Added by a variant of the SDBOT WORM! Added by a variant of the GAOBOT/AGOBOT WORM! Added by the RBOT-AKV WORM! Added by the RBOT-VX WORM! Added by the RBOT-ANR WORM! Added by the RBOT-AUU WORM! Added by various VIRUSES, WORMS & TROJANS! Added by the RBOT-AOD WORM! Added by the SDBOT.BWF WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by a variant of the SPYBOT WORM! Added by an unidentified VIRUS, WORM or TROJAN! Malware, possibly a variant of the LINST TROJAN Added by a variant of the RBOT WORM! Added by the RANDEX.AX WORM! Added by a variant of the SDBOT WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-AMU WORM! Added by a variant of the RBOT WORM! Added by the SPYBOT-DG WORM! Added by a variant of the RBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by a variant of the RBOT WORM! Added by the LATEDA.B TROJAN! Added by the ACEBOT TROJAN! Added by the RBOT-UC WORM! Added by the NACKBOT-D WORM! Added by the DINFOR WORM! Added by a variant of the RBOT WORM! Added by the SDBOT.CN WORM! Added by the SDBOT.MY WORM! Added by the SDBOT.MD WORM! Added by the RBOT-AUG WORM! Added by the RBOT-ADV WORM! Added by the RBOT-MT WORM! Added by the SDBOT.BIH WORM! Added by the RBOT-AED WORM! Added by the RBOT-AOC WORM! Added by the RBOT-ATK WORM! Added by the RBOT.OZ WORM! Added by a variant of the WOOTBOT WORM! Added by the SDBOT-RQ WORM! Added by a variant of the RBOT WORM! Added by the FORBOT-EZ WORM! Added by the SDBOT.BL WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-RI WORM! Added by a variant of the RBOT WORM! Added by the RBOT-TQ WORM! Added by the RBOT-QH WORM! Added by the AGOBOT.UV WORM! Added by the RBOT-VR WORM! Added by the RBOT-ADH WORM!

X X X X X X X Y X X X N N N X X X X X X U X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Explorer explorer.pif Microsoft EXPLOREXP Protocol explorexp.exe Microsoft Features ms32cfg.exe Microsoft Features msie.exe Microsoft File Demand Manager wmgrdf.exe Microsoft Find Fast Findfast.exe Microsoft Firewall firewallsp2.exe MICROSOFT FIREWALL CLIENT ISATRAY.EXE Microsoft Games gamemanager.exe Microsoft Generic Update Manager wupdate.exe Microsoft Gina V Encryption MSGINAV.EXE Microsoft Greetings Reminders MHPRMIND.EXE Microsoft Greetings Workshop Reminder Gwremind.exe Microsoft Greetings Reminder MHPRMINF.EXE Microsoft Help Support mshelp32.exe Microsoft Help SVC msnmngr.exe Microsoft Help System mshelp32.exe Microsoft Host Protocol svhost.exe Microsoft Hosting Service WINHOSTING.EXE Microsoft Hosts Service Isass.exe microsoft hotmail monitor mshotmon.exe Microsoft Hyptertext Helper mshtha.exe Microsoft IDCN mshe1p.exe Microsoft IE Iexplore.exe Microsoft IE Execute shell IEExec.exe MicroSoft IE Sasser ISASS.EXE Microsoft IIS syshost.exe Microsoft IIS [filename] Microsoft Inc. iexplorer.exe Microsoft Incroporate mfs.exe Microsoft Inet Xp.. teekids.exe Microsoft Instant Messenger msngmsngr32.exe Microsoft Int Service MsIntSrv.exe Microsoft Intellitype Pro speedkey.exe Microsoft Internal AntiVirus Systems dIlhost.exe Microsoft Internet expl0rer.exe Microsoft Internet windows32.exe Microsoft Internet Acceleration Utility iau.exe Microsoft Internet Acceleration Utility [path to file] Microsoft Internet Acceleration Utility [path to trojan] Microsoft Internet Exp iiexplorer.exe Microsoft Internet Explorer iexplore.exe Microsoft Internet Explorer iexplorer.exe Microsoft Internet Explorer crsys32.exe Microsoft Internet Explorer movies.exe Microsoft Internet Explorer svzhost.exe Microsoft Internet Explorer mccagent.exe Microsoft Internet Explorer sysini.exe Microsoft Internet Explorer svchost.exe Microsoft Internet Firewall ManagerGMT16.exe Microsoft Internet Services Smss32.exe Microsoft Intrenet Explorer goaw.pif Microsoft Intrenet Explorer Soundsyst.exe Microsoft Intrenet Explorer cnsg.pif Microsoft Intrenet Explorer wcumrg.exe Microsoft IPC system.exe Microsoft IPC svshost.exe Microsoft IT Update win64.exe Microsoft IT Update [random filename] Microsoft IT Update IEserv.exe Microsoft IT Update msupdate.exe Microsoft IT Update winn43.exe Microsoft IT Update svchsst.exe Microsoft IT Update win43.exe Microsoft IT Update windows.exe Microsoft IT Update winsyst32.exe Microsoft Java Virtual Machine winscr32.exe Microsoft Java Virtual Machine MsConfiG.exe Microsoft Java Virtual Machine msjvm.exe Microsoft Java Virtual Machine javavm.exe

Added by the SDBOT-ACX WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT.HO WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Complete utter waste of space! Part of MS Office - searches disk drives for Office file types and creates an index to make opening them easier Added by the RBOT-MC WORM! MS Internet Security and Acceleration Server - see here Added by the SPYBOT.AHQ WORM! Added by the RBOT-AWC TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Microsoft Home Publishing greetings reminder You really want to be reminded about somebody's birthday at the expense of resources? You really want to be reminded about somebody's birthday at the expense of resources? Addded by the KELVIR-BF WORM! Added by the SDBOT-PQ WORM! CoolWebSearch parasite variant Added by a variant of the RBOT WORM! Added by the RBOT.AEV WORM! Added by a variant of the RBOT WORM! Added by the MYTOB.LY WORM! Added by a variant of the SPYBOT WORM! Added by an unidentified TROJAN! Added by the FORBOT-AG WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the ALADINZ.N TROJAN! Added by the SDBOT.MX WORM! Added by the FRANCETTE WORM! Added by the FRANCETTE-S WORM! Added by a variant of the LOVGATE WORM! Added by the RBOT-ANF WORM! Added by the BLASTER.C WORM! Added by the SPYBOTER.GEN TROJAN! Added by a variant of the RBOT WORM! Additional keyboard shortcuts on MS programmable keyboard Added by the RBOT-AEV WORM! Added by a variant of the SPYBOT WORM! Added by the SDBOT-F WORM! EasySearch adware Added by the AGENT-CX TROJAN! Added by the SMUTSRCH-A TROJAN! Added by the RBOT-KX WORM! Added by the POEBOT-J WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure Added by the SDBOT-XN WORM! Added by the RBOT.UZ WORM! Added by the BANCOS-DZ TROJAN! Added by a variant of the RBOT WORM! Added by the DLOADER-UD TROJAN! Added by the DELF-LN TROJAN! Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the RANDEX.AT WORM! Added by the RBOT.MS WORM! Added by the RBOT-API WORM! Added by the RBOT-AQU WORM! Added by the RBOT-ARO WORM! Added by the SDBOT-AFD WORM! Added by the NULLBOT TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Added by the RBOT.GA WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-DH WORM! Added by the RBOT-SA WORM! Added by the RBOT-GL WORM! Added by the RBOT-FC WORM! Added by a variant of the WOOTBOT WORM! Added by the FORBOT-DV WORM! Added by a variant of the SDBOT WORM! Added by a variant of the RBOT WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N N X N X X X X X X X X X N U N X N N X X

Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft

Java Windows Update [filename] JavaVM msjarun.exe Kernel Windows_kernel32.exe LAN32 Protocol lanXp.exe Lmhosting Service lmhosts.exe Locals 332 [random filename] Login winlogin.exe LSA layer MSLSA32.exe LSASS386 Protocol scvhost32.exe LV [path to file] Machine winjava.exe Macro Protection SubSsy msacroprots386.exe Macro Protection Subsystems msmacroprotxz.exe Macro Protection Subsystems Msmacroprot32.exe Management lmas.exe Management Console lssas.exe Management Console [path to trojan] Manager msmanager.exe Map PC mappc.exe Mapped PC mappedpc.exe media winmplayers.exe Media player 9 msmedia32.exe media services Iassd.exe media services winmplayer.exe MediaScope winmes.exe Message Machine msmesg32.exe Messenger Management Controls msmgmctl.exe Messenger Service msmsg32.exe Messenger XP MSMSN32.exe MicroP Protocol wdgmr32.exe Movie Maker Mmaker.exe MSGPLUS32 Protocol msgplus32.exe MSNGR32 Protocol msngr32.exe msnseru msnseru.exe MsnST msnst32.exe MSUPDATE SpoolSvc.exe Neser Experience nese.exe NetMeeting Associates, Inc. NetMeeting.exe Netview gesfm32.exe Netview mssvc32.exe Netview Component v5.1msnv32.exe Network msnet.exe Network Networksystem.exe Network Daemon for Win32 Netd32.exe Network Host svc0host.exe Network Services Controller mmsvc32.exe Networking Agent For SP2msnac32.exe NotePad notepad.exe NT Update winexec32.exe Office Osa.exe Office Msoffice.exe Office MSMSGR.exe Office Osa9.exe Office lserv.exe Office Microsoft Office.hta Office msoicons.exe Office Nxcao.exe Office nxcxtpr.exe Office svxhost.exe Office msoffice32.exe Office msoff.exe Office microsoft.exe Office Fast Cache Fastboot.exe Office OneNote 2003 Quick ONENOTEM.EXE Launch Office Shortcut Bar Msoffice.exe Office Start winupdates.exe Office Startup Osa.exe Office Startup Osa9.exe Office Studio scvhvst.exe OfficeXP officeXP.exe

Added by the RBOT-DZ WORM! Added by the RBOT-JW WORM! Added by the NETSKY.AE WORM! Added by the RBOT-SS WORM! Added by the RBOT-RC WORM! Added by the RBOT-KU WORM! Added by the RBOT-AJP WORM! Added by the RBOT-AKZ WORM! Added by a variant of the SPYBOT WORM! Added by the BDL TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the RBOT-KE WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT.KN WORM! Added by the FORBOT-CZ WORM! EasySearch adware Added by the SMUTSRCH-A TROJAN! Added by the MYTOB.LF WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT-ADO WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the RBOT.ZO WORM! Added by the RBOT-XU WORM! Added by the SPYBOT.BI WORM! Added by the RBOT-APA WORM! Added by the RBOT.BOK WORM! Added by the RBOT-ZP WORM! Added by a variant of the RBOT WORM! Added by the IRCBOT.C TROJAN! Note that this is not a valid Microsoft program Added by a variant of the SPYBOT WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT-APB WORM! Added by a variant of the RBOT WORM! Added by the SXTB-A TROJAN! Added by the RBOT-YH WORM! Added by a variant of the LOVGATE WORM! Added by the RANDEX.C WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by the RANDEX.F WORM! Added by the MOCKBOT.A WORM! Added by the SDBOT-AAI WORM! Added by the SDBOT.R TROJAN! Added by the SDBOT-AEN WORM! Added by the NANPY-A WORM! Added by the SPYBOT.PEN WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Alternative shortcuts to the Start -> Programs way of running applications installed as part of MS Office. Some people prefer it but a better way is to create Desktop Shortcuts if you want access these p Added by the GAOBOT.BB WORM! Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Added by the SDBOT.MH WORM! HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups! Added by the RBOT-ZE WORM! Added by the RBOT-YG WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RAKER-C TROJAN! Added by the BANKER-VF TROJAN! Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2003. It's required for the side note windows to work Alternative shortcuts to the Start -> Programs way of running applications installed as part of MS Office. Some people prefer it but a better way is to create Desktop Shortcuts if you want access these p Added by the GAOBOT.BC WORM! Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Added by the RANDEX.CST WORM! Added by the KILLAV.MA WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X

Microsoft Opeions IEXwe.exe Microsoft PC Health Remote Assistance sfrcdlg32.exe File Open & Save controls Microsoft PCHealth32 [path to file] Microsoft PCHealth32 NDDENB.exe Microsoft PCI Manager mspci.exe Microsoft Personal Firewalls bakw.exe Microsoft Proc Driver32 msprc.exe Microsoft Procedure Call MSPCALL.exe Microsoft PSTCP32 Data pstcp32.exe Microsoft QMGR msnqmgr.exe Microsoft RDLL sysconf32.exe Microsoft Redirect [path to file] Microsoft Redirect systen.exe Microsoft Registro svchostt.exe Microsoft Registry csrse.exe MicroSoft Remote Secure Service MSRSS.exe Microsoft Restore scrgrd.exe Microsoft Rundll windos.exe Microsoft Runtime CfgDll32.exe Microsoft Scanreg microsoftscanreg.exe Microsoft SCVHOST32 Protocol scvhost32.exe Microsoft sddcE Contol taskmnegr.exe Microsoft sdk temp sdktemp.exe Microsoft SDKP3 mswinsdq.exe Microsoft Secure Messenger.NET Service securitychk.exe Microsoft Security winService.exe Microsoft Security Center savservices.exe Microsoft Security Controlers fxsecues.exe Microsoft Security GManagers [random filename] Microsoft Security Hot Fix Update mshotfix.exe Microsoft Security Management winnt.exe Microsoft Security Management winserv.exe Microsoft Security Management winamp.exe Microsoft Security Management wuauct1.exe Microsoft Security Manager winamp.exe Microsoft Security Panager [filename] Microsoft Security Panagers [random filename] Microsoft Security Panagers zzoboony.exe Microsoft Server Applacations msnmsg.exe Microsoft Server Applacations wuauct1.exe Microsoft Server Applacations lsasss.exe Microsoft Server Application Sound.exe microsoft server base lass.exe Microsoft Service microhost.exe Microsoft Service winsvc.exe Microsoft Service rundll.exe Microsoft Service Controller services.exe Microsoft Service Drivers System.exe Microsoft Service Drivers VSADNIM.exe Microsoft Service Host Process svchost.exe Microsoft Service Pack WindowsSP.exe Microsoft Service Pack2.1 svchost2.exe Microsoft Services lsserv.exe Microsoft Services lssrv.exe Microsoft Services services.exe Microsoft Services lsrv.exe Microsoft Services svshost.exe Microsoft Services bsc32.exe Microsoft Services Smss32.exe Microsoft Services svssshost.exe Microsoft Services Unitd MSU32.exe Microsoft Servicez Manager servicemgrz.exe Microsoft Session Manager Subsystem smss.exe Microsoft Sidewinder Game Controller SWTRAY.EXE Software Microsoft Sinsup odjiwjf.exe Microsoft Software sysinfo33.exe microsoft software ****.exe E255 [* = random char] Microsoft software cdaccess.exe Microsoft Software Update nmon.exe Microsoft Sound Driver sound32.exe

Added by a variant of the RBOT WORM! Added by the RBOT-AVY WORM! Added by the NICE-A TROJAN! Added by the PWSYAHOO-A TROJAN! Added by a variant of the SDBOT WORM! Added by the RBOT-KS WORM! Added by a variant of the WOOTBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the IRCBOT-S TROJAN! Added by a variant of the SDBOT TROJAN! Added by the BANKER-FW TROJAN! Added by the BANCOS-FO TROJAN! Added by the BANCOS-DH TROJAN! Added by the RBOT-PC WORM! Added by a variant of the RBOT WORM! Added by the SPYBOT.BR WORM! Added by the SDBOT-WF WORM! Added by the RANDEX.BD WORM! Added by the FRANRIV.A WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AUM WORM! Added by the RBOT-ANP WORM! Added by the RBOT-ARY WORM! Added by the SDBOT.VT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ANU WORM! Added by a variant of the SDBOT WORM! Added by a variant of the SDBOT WORM! Affilred adware Added by the RBOT-MQ WORM! Added by the RBOT-MJ WORM! Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which has the filename "winampa.exe" Added by a variant of the RBOT WORM! Added by the RBOT.TU WORM! Note - this is not the Winamp media player executable (WinAmpa.exe) Added by the RBOT-ANL WORM! Added by the RBOT-AIG WORM! Added by the RBOT-AOI WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AQQ WORM! Added by the RBOT-NE WORM! Added by a variant of the RBOT WORM! Added by the RBOT-LC WORM! Added by the SPYBOT-DB WORM! Added by the POPO-A WORM! Note - this is NOT the Windows system file of the same name as described here Added by the KALEL-D WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the KRYNOS.B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the RBOT-RF WORM! Added by a variant of the RBOT WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by the RBOT.CW WORM! Added by the ALETS TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the RBOT-BK WORM! Added by the ALETS.B TROJAN! Added by the BDOOR-AW TROJAN! Added by the RBOT-AD WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ASN WORM! Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! MS SideWinder game controller system tray icon. Available via Start -> Programs Added by the RBOT-DN WORM! Added by the RBOT.LS WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT.ABK WORM! Added by the RBOT.HZ WORM! Added by a variant of the SPYBOT WORM!

X N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Sound Technology winsound.exe Microsoft Sound Volume Tool mssvol.exe Microsoft SourceSafe csrss.exe Microsoft SpA Service msapps.exe Microsoft SpA Service win32.exe Microsoft SpA Service Winupd32.exe Microsoft Special offer infoebay.exe Microsoft Spool Server for Win32 spoolsrv.exe Microsoft SSISVRI32 Protocol ssisvri.exe Microsoft Standard Executions Library win32lib.exe Microsoft standard protector winsocks5.exe Microsoft standard protector [path to trojan] Microsoft Sum32 sum32.exe Microsoft Support sys32ms.exe Microsoft Synchronization Managerasgard.exe Microsoft Synchronization Managerbot.exe Microsoft Synchronization Managernetscape.exe Microsoft Synchronization Managerslhost.exe Microsoft Synchronization Managersvhost.exe Microsoft Synchronization ManagerWinLoginnn.exe Microsoft Synchronization Managerwinupdate.exe Microsoft Synchronization ManagerxXx.exe Microsoft Synchronization Manager___synmgr.exe Microsoft Synchronization Manageral.exe Microsoft Synchronization Managerwin.exe Microsoft Synchronization Managerjava.exe Microsoft Synchronization Managersvchosts.exe Microsoft Synchronization Managerwinlogon32.exe Microsoft Synchronization Managersvxhost.exe Microsoft Synchronization Managerwincfg32.exe Microsoft Synchronization Managerscreen.exe Microsoft Synchronization Managerdevldr32.exe Microsoft Synchronization Managerexplorer.exe Microsoft Synchronization Managerfirewire.exe Microsoft System msupdtm.exe Microsoft System Backup [random filename] Microsoft System Checkup Cool.exe Microsoft System Checkup Wnetlib.exe Microsoft System Checkup dbnetlib.exe Microsoft System Checkup Keymgr.exe Microsoft System Checkup inetman.exe Microsoft System Checkup ntsysmgr.exe Microsoft System Checkup ntsysman.exe Microsoft System Checkup libsysmgr.exe Microsoft System Checkup sysmgr.exe Microsoft System Checkup netapi32.exe Microsoft System Checkup wnetmgr.exe Microsoft System Checkup libsys32.exe Microsoft System Debug services32.exe Microsoft System DLL Services Configuration windir32.exe Microsoft System NT svhost.exe Microsoft System Restore Configuration CBRSS.EXE Microsoft System Services msnmgsr.exe Microsoft System Services msmsgr.exe Microsoft System Update sysupdate.exe Microsoft System32 Update cmsrg.exe Microsoft Taskmanager Updater keyboard.exe Microsoft Telecom Center tellecom.exe Microsoft Telecoma Center tellcoma.exe Microsoft Telecoms Center telcoms.exe Microsoft Time Manager dveldr.exe MicroSoft Toolbar key.exe Microsoft Transfer File Server mtfs.exe Microsoft Tray [random filename] Microsoft U wuamkopxp.exe Microsoft UMA Update MSuma32.exe MICROSOFT UNPACCKER SYSTEM unpak32.exe MICROSOFT UNPACK SYSTEM winrarx.exe Microsoft Update Microsoft.exe Microsoft Update mssmgrd.exe

Added by the RBOT-AGG WORM! This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Added by the RBOT-VI WORM! Added by the RBOT.ATS WORM! Added by the RBOT.LT WORM! Added by a variant of the RBOT WORM! Added by the RANDEX.H WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT-AUK WORM! Added by the SMALL.CF TROJAN! Added by the STOX-C TROJAN! Added by the RBOT-YW WORM! Added by the RBOT-AHI WORM! Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added i Added by the SDBOT.IH WORM! Added by the RANDEX.AE WORM! Added by the SDBOT.YH WORM! Added by the SDBOT-PY WORM! Added by the SPYBOT.FO WORM! Added by the SDBOT.ER WORM! Added by the SDBOT-KZ WORM! Added by the MASLAN.A or MASLAN.C WORMS! Added by the OPTXPRO.132 TROJAN! Added by the SDBOT.AK WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT-LM WORM! Added by the SDBOT.AEU WORM! Added by the SDBOT-ZU WORM! Added by the SDBOT.DO WORM! Added by the SDBOT-ACO WORM! Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would only be in startups if you added it manually. This one is loca Added by the SDBOT-AFC WORM! Added by the SPYBOT.PKC WORM! Added by the RBOT-AGM WORM! Added by the DONK.B WORM! Added by the DONK.C WORM! Added by the DONK.L WORM! Added by the DONK.M WORM! Added by the DONK.O WORM! Added by the DONK.S WORM! Added by the SDBOT-QW WORM! Added by the SDBOT-CAF WORM! Added by the SDBOT-OO TROJAN! Added by the DONK-E WORM! Added by the DONK.Q WORM! Added by the SDBOT-ACK WORM! Added by the RBOT.AKH WORM! Added by the SDBOT-ACY TROJAN! Added by the SDBOT.COU WORM! Added by a variant of the SPYBOT WORM! Added by the KELVIR.K WORM! Added by the RBOT-ZH WORM! Added by the SDBOT.DG WORM! Added by the RBOT-GN WORM! Added by the RBOT-ALU WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AWX WORM! Added by the IRCBOT.GEN WORM! Added by the RBOT-HQ WORM! Added by the RBOT-AEW WORM! Added by the RBOT.AFE WORM! Added by the DELF.BZ TROJAN! Added by the RBOT-AHC WORM! Added by the RBOT.FS WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the GAOBOT.AFJ WORM! Added by the SDBOT.JT WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft

Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update Update

mvsc.exe ascdl.exe Isac.exe automgr32.exe mediap.exe Microsoftx.exe msconfg.exe Mslti32.exe muamgrd.exe navmgrd.exe Smss32.exe sys32cfg.exe VPC32.EXE winsys32.exe wuamgrd.exe wuammgr32.exe wudmate.exe msawindows.exe msiwin84.exe wuamgrd32.exe NAV.exe systemi32.exe xpupdate.exe webm.exe wuagrd.exe aaupdt.exe lsac.exe Mupdate.exe prowind32.exe snlogsvc.exe svhost.exe wauguard.exe winscv.exe winsys.exe wserv32.exe wtm32.exe wumgrd.exe wuampd.exe msupdate32.exe Botnet.exe sghost.exe update_w.exe windows24.exe wingrd32.exe wssvr.exe wuamagr32.exe WinUpdate32.exe wkfix.exe Kkk.exe mcupdate.exe Micr0s0ft.exe Msnmsngr.exe msupdate32.exe scvhost.exe svghost.exe sys.exe up2dat5.exe winamp.exe winamp.exe win-mang.exe winupdater.exe wuamk0032.exe wuamk032.exe wuamk0p32.exe wuamkop.exe wuamkop32.exe wuampkd.exe svzhost.exe win32.exe wininit.exe

Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added

by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by

the SPYBOT.DAZ WORM! the GAOBOT.SY WORM! the RBOT-AU WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! the RBOT.H WORM! the RBOT-LX WORM! a variant of the AGOBOT/GAOBOT WORM! the SDBOT.DP TROJAN! the RBOT.CB WORM! a variant of the SPYBOT WORM! the AGOBOT.XM WORM! a variant of the RBOT WORM! the RBOT-LK WORM! the RBOT-AW WORM! the RBOT.AP WORM! the GAOBOT.AFJ WORM! the GAOBOT.AFJ WORM! the RBOT.ZB WORM! the RBOT-IV WORM! a variant of the SPYBOT WORM! the RBOT-QE WORM! the SDBOT.WK WORM! the RBOT-FK WORM! the RBOT-RQ WORM! the GAOBOT.XW WORM! the RBOT-AG WORM! a variant of the AGOBOT/GAOBOT WORM! a variant of the RBOT WORM! the RBOT-PI WORM! the RBOT.AEE WORM! the RBOT-BH WORM! the RBOT-GV WORM! the RBOT.AF WORM! the RBOT-AQ WORM! the SDBOT-KY WORM! the RBOT-UT WORM! a variant of the SPYBOT WORM! the RBOT.AFL WORM! the SDBOT.AKV WORM! the RBOT-EW WORM! a variant of the RBOT WORM! the RBOT-DW WORM! the RBOT-OD WORM! the SPYBOT.CG WORM! the RBOT-TI WORM! the RBOT-ABZ WORM! the RBOT-AHL WORM! a variant of the RBOT WORM! Note - this file is located in the WindowsSystem32 or WinntSystem32 folder, and should not be confused with the McAfee antivirus executable as described here the AGOBOT.AAR WORM! the RBOT.BQS WORM! the SPYBOT.LZ WORM! the RBOT-AEM WORM! a variant of the RBOT WORM! the RBOT-AJ WORM! a variant of the SDBOT WORM! a variant of the RBOT WORM! Note - this is not the Winamp media player executable (WinAmpa.exe) a variant of the RBOT WORM! Note - this is not the Winamp media player executable (WinAmpa.exe) the RBOT-AFK WORM! the RBOT.BIN WORM! a variant of the RBOT WORM! the RBOT-AHD WORM! a variant of the RBOT WORM! the RBOT-AFI WORM! the RBOT.BGU WORM! the SDBOT.BBX WORM! the RBOT.OX WORM! a variant of the SDBOT WORM! the RBOT-AKR WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Update wuamgrd3.exe Microsoft Update Wudates.exe Microsoft Update ms.exe Microsoft Update wuagmsd.exe Microsoft Update cmss.exe Microsoft Update wuamgrb.exe Microsoft Update 23 NtKernelSystem.exe Microsoft Update 32 explore32.exe Microsoft Update 32 MSupdate32.exe Microsoft Update 32 wininit.exe Microsoft Update 32 wininit32.exe Microsoft Update 32 [path to file] Microsoft Update 32 mscnfg.exe Microsoft Update 32 servic.exe Microsoft Update 32 winitXP32.exe Microsoft Update 32 mssetup32.exe Microsoft Update 32 wiit.exe Microsoft Update 32 explorer.exe Microsoft Update 32 network.exe Microsoft Update 32 om4r.exe Microsoft Update 32 winin.exe Microsoft Update 32 wuinit.exe Microsoft Update 33 init.exe Microsoft Update 64 BIT wininit32.exe Microsoft Update 64 BIT winman32.exe Microsoft Update 64 BIT schvost.exe Microsoft Update 64 BIT winl32xe.exe MICROSOFT UPDATE CONFIGURATION WIN32SNC.EXE Microsoft Update Control Ms64.exe Microsoft Update Debugger wincfg32.exe Microsoft Update DLL rxxhost.exe Microsoft Update Emulator kern-mxe.exe Microsoft Update Loader [random filename] Microsoft Update Loaders 2006 winusersystem32.exe Microsoft Update Machine expl0rer.exe Microsoft Update Machine rxhost.exe Microsoft Update Machine servicz.exe Microsoft Update Machine SP2.exe Microsoft Update Machine winini.exe Microsoft Update Machine xvshost.exe Microsoft Update Machine memstat.exe Microsoft Update Machine ntce.exe Microsoft Update Machine system03.exe Microsoft Update Machine wuawx.exe Microsoft Update Machine zonealarm.exe Microsoft Update Machine systemll.exe Microsoft Update Machine winupdt.exe Microsoft Update Machine svshost.exe Microsoft Update Machine wuamgd.exe Microsoft Update Machine wupdt32x.exe Microsoft Update Machine [random filename] Microsoft Update Machine linux.exe Microsoft Update Machine lmrss.exe Microsoft Update Machine windowsu.exe Microsoft Update Machine wininigo.exe Microsoft Update Machine winmgr.exe Microsoft Update Machine Winmsixp32.exe Microsoft Update Machine Winregs32.exe Microsoft Update Machine winxpini.exe Microsoft Update Machine wuamgrd.exe Microsoft Update Machine wuagrd.exe Microsoft Update Machine LANWAKE.EXE Microsoft Update Machine scvhost.exe Microsoft Update Machine winhost.exe Microsoft Update Machine winss.exe Microsoft Update Machine WUAMGRDXS.EXE Microsoft Update Machine crss32.exe Microsoft Update Machine lsasse.exe Microsoft Update Machine qwerty.exe Microsoft Update Machine rxxhost.exe

Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added Added

by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by by

the RBOT-AMC WORM! a variant of the RBOT WORM! the SDBOT.CC WORM! the RBOT-AX WORM! the RBOT-ATQ WORM! the RBOT-AZE WORM! a variant of the RBOT WORM! the SPYBOT.CYM WORM! a variant of the SPYBOT WORM! the RBOT-ANY WORM! a variant of the RBOT WORM! the RBOT-AJJ WORM! the RBOT-ALM WORM! the RBOT-AXN WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! the RBOT-AMS WORM! the RBOT-ARF WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m the RBOT-ARZ WORM! the RBOT-AQP WORM! the RBOT-ARR WORM! the AGOBOT-UE WORM! the RBOT-ATT WORM! the RBOT-AHE WORM! the RBOT-AKI WORM! the RBOT.CAU WORM! the RBOT-AQO WORM! the RBOT-AI WORM! a variant of the RBOT WORM! the SPYBOT.ZC WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! a variant of the AGOBOT/GAOBOT WORM! the SDBOT.OK WORM! the RBOT.FC WORM! the RBOT-HU WORM! the SPYBOT.FP WORM! the RBOT-KV WORM! the RBOT.QP WORM! the RBOT-OM WORM! the RBOT-FA WORM! the RBOT-NM WORM! the RBOT-CE WORM! the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program! the RBOT-JT WORM! the RBOT-FP WORM! the RBOT.AK WORM! the SDBOT.HQ WORM! a variant of the SDBOT WORM! a variant of the RBOT WORM! the RBOT-IM WORM! the RBOT-DY WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! a variant of the RBOT WORM! the RBOT.DN WORM! the RBOT.DN WORM! the RBOT-OB WORM! the RBOT-HE WORM! the RBOT-GF WORM! the RBOT-QZ WORM! the RBOT-GS WORM! the RBOT-GK WORM! the RBOT.JU WORM! the RBOT-GL WORM! a variant of the RBOT WORM! the RBOT-DI WORM! a variant of the RBOT WORM! the RBOT.EP WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X

Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft

Update Machine servicez.exe Update Machine spoolserv.exe Update Machine Systemnt.exe Update Machine systemse.exe Update Machine taskmngrs.exe Update Machine windowsup.exe Update Machine wuamgard.exe Update Machine wupdate32.exe Update Machine system.exe Update Machine TMEMSER.EXE Update Machine winnie.exe Update Machine winortho.exe Update Machine wins32.exe Update Machine serviz.exe Update Machine TASKMAN4.EXE Update Machine wftestb.exe Update Machine Win32.exe Update Machine windns.exe Update Machine MSOICONS.EXE Update Manager WINRLS.EXE Update Manager svshost.exe Update Manager scvhost.exe Update Mechene Updatez.exe Update Module rundll24.exe Update Process wmipcvse.exe Update Security Patch mssecurityupdatepatch.exe Update Server mssrv.exe Update Service csrss32.exe Update Service mswin32.exe update service systemm.exe Update SERVICE phqghum.exe Update Service msupdate.pif Update Services wcsnfty.exe Update Services wsnfty.exe Update Time wuam.exe Update USB2 wuammgrd32.exe Update v2.6 lxxex.exe Update Win32a winupdate32a.exe Update Win32x winupdate32x.exe Updater Winsys32.exe Updater Resources WinFixd32.exe UPDATER32 lsass.exe Updaters tskmgr.exe Updaters sysconfigs.exe Updaters Pros WINDLL32XP.EXE Updates systemc32.exe Updates wkssvr.exe Updates wkssvrs.exe Updates wuamgrd.exe Updates wtemp32.exe Updates 2 USB wgafixer.exe Updates 5 USB sp3fixer.exe Updates Resources WinFixIDs.exe Updating navguard.exe Updating syswr.exe Updating wuamguards.exe Updating Client websvc.exe Updating Machine sysc0de.exe Updatting miroupdate.exe Updote [random filename] UpMachine doezs.exe upnp Update msie.exe uptime Service sysuptime.exe uptime Service sycuptime.exe UpToDate Driver (32-bits)[random filename].exe USB2 Driver crmss.exe Utility Startup OSA9.exe Vertupdate MSvert32.exe Video Capture Controls MSsrvs32.exe Video Controls tskmsgr.exe

Added by the SPYBOT.BI WORM! Added by a variant of the RBOT WORM! Added by the RBOT.DA WORM! Added by the RBOT-BD WORM! Added by the RBOT-CR WORM! Added by the RBOT-FV WORM! Added by the SPYBOT.CS WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-NQ WORM! Added by the RBOT-ACD WORM! Added by the RBOT-NW WORM! Added by the RBOT.EZ WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AFZ WORM! Added by the SDBOT.UV WORM! Added by the RBOT.EF WORM! Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup! Added by the RBOT-AF WORM! Added by a variant of the RBOT WORM! Added by the AGOBOT.AXJ WORM! Added by the RBOT-GI WORM! Added by the RBOT-PS WORM! Added by the AGOBOT-JF TROJAN! Added by the AGENT.EF TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Added by the AGOBOT-HC WORM! Added by a variant of the SPYBOT WORM! Added by a variant of the SDBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AQB WORM! Added by the RBOT-AGK WORM! Added by the RBOT-AFU WORM! Added by the RBOT-M WORM! Added by the RBOT-ADT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-LO WORM! Added by the RBOT-AJN WORM! Added by a variant of the RBOT WORM! Added by the SPYBOT.CA WORM! Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup! Added by a variant of the RBOT WORM! Added by the RBOT-DF TROJAN! Added by the SPYBOTTER.GEN VIRUS! Added by the RBOT-GR WORM! Added by the RBOT.R WORM! Added by the RBOT-EB WORM! Added by the RBOT-CO WORM! Added by the RBOT-AHQ WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ADS WORM! Added by a variant of the RBOT WORM! Added by the RBOT.HW WORM! Added by a variant of the RBOT WORM! Added by the RBOT-BY WORM! Added by the RBOT.AQ WORM! Added by the RBOT.RB WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ARC WORM! Added by the RBOT.BCT WORM! Added by the RBOT-LQ WORM! Added by the RBOT-ACG WORM! Added by the RBOT-AHY WORM! Added by the SPYBOT.LXJ WORM! Added by the RBOT-VK WORM! Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Added by the MYTOB-CY WORM! Added by the SDBOT-AAK WORM! Added by a variant of the SPYBOT WORM!

X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Virual Machine sms.exe Microsoft Visual SourceSafe services.exe Microsoft Visual SourceSafe winlogon.exe Microsoft Visual Studio plscdksxg.exe Microsoft Visual Studio VSA varpc32.exe Microsoft Web Device wdevice.exe Microsoft Webserver svctrl.exe MicroSoft Wind0ws Updater winsupdater.exe Microsoft Windows mstask0.exe Microsoft Windows atup Microsoft Windows Microsoft Windows.hta Microsoft Windows explorar.exe Microsoft Windows [path to file] Microsoft Windows 128bit Subsystem system12.exe Microsoft Windows 16Bit mswinn16.exe Microsoft Windows 2000 Winupdsdgm.exe Microsoft Windows 32Bit mswinn32.exe Microsoft Windows 64 Bit mswin32.exe Microsoft Windows Control mswctl32.exe Microsoft Windows CSRSS csrss.exe Microsoft Windows DHCP ___r.exe Microsoft Windows DLL 32-BIT msncheck32.exe Microsoft Windows DLL Services mwindll.exe Microsoft Windows DLL Services Configuration dllmanager32.exe Microsoft Windows DLL Services Configuration newdll.exe Microsoft Windows DLL Services Configuration newdll2.exe Microsoft Windows DLL Services Configuration poker.exe Microsoft Windows DLL Services Configuration poker3.exe Microsoft Windows DLL Services Configuration proxy.exe Microsoft Windows DLL Services Configuration windir32.exe Microsoft Windows DLL Services Configuration windir32a.exe Microsoft Windows DLL Services Configuration windll32.exe Microsoft Windows DLL Services Configuration winDSL.exe Microsoft Windows DLLHandler bitpaint.exe Microsoft Windows DVR windvr.exe Microsoft Windows Explorer iexplorer.exe Microsoft Windows Files Loader cgy32win.exe Microsoft Windows Game Updater msgame32.exe Microsoft Windows GUI Windowz.exe Microsoft Windows GUI msmonk32.exe Microsoft Windows Kernel Services winkrnl386.exe Microsoft Windows Loader wloader.exe Microsoft Windows Logon Process winlogon.exe Microsoft Windows Media Player mediaplayer.exe Microsoft Windows Media Player wimp.exe Microsoft Windows Secure Server rpcxWindows.exe Microsoft Windows Secure Update rpcxwinupdt.exe Microsoft Windows Securety wurguar.exe Microsoft Windows Security spvsper.exe Microsoft Windows Security wscndrives.exe Microsoft Windows Service winsys.exe Microsoft Windows Service Pack winspkn.exe Microsoft Windows Session Manager smss.exe Subsystem Microsoft Windows Storage Machinewinms.exe Service Microsoft Windows System srwhost.exe Microsoft Windows System syshost.exe Microsoft Windows System Service winsvc.exe Manager Microsoft Windows Task Manger Mstosk.exe Microsoft Windows Updata scvhost.exe Microsoft Windows Update rundlls.exe Microsoft Windows Update msoffice2.exe Microsoft Windows Update spools.exe Microsoft Windows Update svchos.exe Microsoft Windows Update svcshost.exe Microsoft Windows Update svmhost.exe Microsoft Windows Update svshost.exe Microsoft Windows Update msnmessenger.exe Microsoft Windows Update msnwun.exe Microsoft Windows Update scvvhost.exe Microsoft Windows Update swwhost.exe

Added by the RBOT-SP WORM! Added by the NEVEG.B or NEVEG.C WORMS!. Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup or the Microsoft Visual SourceSafe program Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup or the Microsoft Visual SourceSafe program Added by the RBOT-AWV WORM! Added by a variant of the SPYBOT WORM! Added by a variant of the SDBOT WORM! Personal web server program which enables you to create and host a web server from your computer. Not required for most people Added by a variant of the RBOT WORM! Added by the SDBOT.FQ WORM! Added by a variant of the RBOT WORM! HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Added by a variant of the RBOT WORM! Added by the LI TROJAN! Added by the RANCK-CZ TROJAN! Added by a variant of the SPYBOT WORM! Added by the GAOBOT.AO WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT.JP WORM! Added by the KALEL-A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Added by the MASLAN.A or MASLAN.C WORMS! Added by the SDBOT-XX WORM! Added by the SDBOT-VX WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT-ZR WORM! Added by the SDBOT-ABD WORM! Added by the SDBOT-ZY WORM! Added by the SDBOT-AAH WORM! Added by the SDBOT-ZL WORM! Added by the SDBOT.BHF WORM! Added by a variant of the SDBOT.BHF WORM! Added by the SDBOT.BHD WORM! Added by the SDBOT-ZG WORM! Added by the SDBOT.AHG WORM! Added by the RBOT-AXD WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AXR WORM! Added by a variant of the RBOT WORM! Added by the RANDEX.AEV WORM! Added by the SDBOT-PE WORM! Added by the ZEBROXY TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is pla Added by a variant of the RBOT WORM! Added by the RBOT-FN WORM! Added by the RBOT-LL WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT-KY WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-AJK WORM! Added by the RBOT-ADP WORM! Added by the RBOT-AYD WORM! Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the RBOT-AHK WORM! Added by a variant of the RBOT-ASW WORM! Added by the RBOT-ASW WORM! Added by the SPYBOT.LR WORM! Added by the SDBOT-WW WORM! Added by a variant of the RBOT WORM! Added by the HABRACK WORM! Added by the RBOT-GB WORM! Added by the SDBOT.TD WORM! Added by the SDBOT.AC WORM! Added by the FORBOT-CF WORM! Added by the FORBOT-CH WORM! Added by the WOOTBOT.CJ WORM! Added by the SDBOT.AJ WORM! Added by the SDBOT-RM WORM! Added by the FORBOT-DH WORM! Added by a variant of the RBOT WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N N N X X X X X X X X X X X X X X X X X X X X X X X X X

Microsoft Windows Update MSNMSGR.EXE Microsoft Windows Update svzhost.exe Microsoft Windows Update sccvhost.exe Microsoft Windows Update scrhost.exe Microsoft Windows Update mnswinsx.exe Microsoft Windows Update Application wuap.exe Microsoft Windows Update Logon win-logon.exe Microsoft Windows Update Service wupdmgr32.exe Microsoft Windows Updater winupdgm.exe Microsoft Windows Updater WINIUPDATES.EXE Microsoft Windows Updater WINUPDATE.EXE Microsoft Windows Updater TMNTSrv.exe Microsoft Windows Updater win32upd.exe Microsoft Windows Updater msnupdateit.exe Microsoft Windows Updater windates.exe Microsoft Windows Updater spoolvs.exe Microsoft Windows Updater suvhost.exe Microsoft Windows updaterD log32zx.exe Microsoft Windows Updates explorer32.exe Microsoft Windows W32 Services mssw32.exe Microsoft Windows WinSaSS Management winsass.exe Microsoft Windows Workstation devcode.exe Microsoft Windows XP Configurationm32svco.exe Loader Microsoft WINGS32 Protocol WinSGR32.exe Microsoft WinRaR winrar.exe Microsoft Winsock mswinsck.exe Microsoft Winsock Service msusvc.exe Microsoft Winsock Wrapper ws2_32s.exe Microsoft WinUpdate mntcgf032.exe Microsoft WinUpdate svh0st.exe Microsoft WinUpdate syslx32.exe Microsoft WinUpdate syswin32.exe Microsoft WinUpdate spfix.exe Microsoft WinUpdate Winamp61.exe Microsoft WinUpdate Winupd32.exe Microsoft WinUpdates serm32.exe Microsoft WM mswm32.exe Microsoft Word BootSector.exe Microsoft Word Profissional csrss.exe Microsoft Word Profissional Java Plug In close.exe Microsoft Word Profissional csrss.exe Microsoft Word Profissional csrss.exe Microsoft Works Calendar Reminders wkcalrem.exe Microsoft Works Portfolio WksSb.exe Microsoft Works Update Detection wkdetect.exe Microsoft World Service winworld.exe Microsoft Wxdate Syswu32.exe Microsoft X Update wuamkoppnp.exe microsoft xdaemon 2.0 xdaemon.exe Microsoft XML Service msxmlx.exe Microsoft Xp Systems loader winsystem32xp.exe Microsoft Xp Systems loaders win32xpsys.exe Microsoft XPSP Protocol xp386.exe Microsoft xpsp2 Networksystem.exe Microsoft xpsp2 xpsp2.exe Microsoft's System Module Sysmodule.exe Microsoft--Updates sxvhost.exe Microsoft-software ****.exe [* = random char] Microsoft-Update wngard.exe Microsoft-Updates svxhost.exe microsoft420 microsoft420.exe Microsoft64 antiv.exe Microsoftf DDEs ContDLL rune.pif Microsoftf DDEs ContrDL runm.pif Microsoftf DDEs Control lxes.exe Microsoftf DDEs Control wees.exe Microsoftf DDEs Control soff.pif Microsoftf DDEs Control why-.exe Microsoftf DDEs Control msnn.exe Microsoftkeysd systemproc.exe

Added by the SDBOT-WM WORM! Added by the FORBOT-EV WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-AOW WORM! Added by the RBOT-AWH WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the DOS.AUTOCAT TROJAN! Added by the GAOBOT.BI WORM! Added by the RBOT-KK WORM! Added by the SDBOT-PU WORM! Added by a variant of the RBOT WORM! Added by the RBOT-EC WORM! Added by the AGOBOT-RL WORM! Added by the SDBOT.TE WORM! Added by the RBOT.ACQ WORM! Added by a variant of the SDBOT WORM! Added by the MYDOOM.W WORM! Added by the SDBOT.VQ WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT-APW WORM! Added by the RBOT-AWL WORM! Added by the SDBOT.WORM.48548 Added by the RBOT-APU WORM! Added by the RBOT-AEC WORM! Added by the RBOT-ANK WORM! Added by the RBOT-ANS WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT-PF WORM! Added by the SPYBOT.DL WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by the RBOT-HO WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT.MQ WORM! Added by the RBOT.GE WORM! Added by the BCKDR-AM TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the BANCBAN-DB TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the BANKER-EL TROJAN! Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Produces a pop-up reminder of events scheduled using the MS Works Calendar The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program.Can be prevented from starting from a setting within Portfolio Checks for updates to MS Works Added by an unidentified IRC worm with backdoor capability! Added by the SPYBOT.HZ WORM! Added by the RBOT-ANI WORM! Added by the DELF.D TROJAN! Added by the RBOT.KS WORM! Added by the KELVIR.W WORM! Added by the SPYBOT.NYT WORM! Added by a variant of the RBOT WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT-YQ WORM! Added by the FJ TROJAN! Added by the RBOT-FH WORM! Added by a variant of the RBOT WORM! Added by the RBOT-JV WORM! Added by the RBOT-CT WORM! Added by the MENACE.B WORM! Added by the SOBER WORM! Added by the RBOT-AGF WORM! Added by the RBOT-AFQ WORM! Added by the RBOT.BOF WORM! Added by a variant of the the RBOT.BOF WORM! Added by the RBOT-AKH WORM! Added by the RBOT-AMV WORM! Added by the RBOT-AXT WORM! Added by the FORBOT-BI WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N ? N X X N U N X N ? X X X U X N N N U N X X X X X N U X

Microsoftkeysd systemwin32s.exe Added by the WOOTBOT.CO WORM! Microsoftkeysds lass32.exe Added by a variant of the RBOT WORM! MicrosoftKs Drivers.bat Added by the SHUTDOWN-F TROJAN! microsoftm eegs cuntrol loor.pif Added by a variant of the RBOT WORM! Microsoftmsn32.exe microsoftmsn32.exe Added by the CERTIF-C TROJAN! MicrosoftMultimediaTask Mmtask.exe Adware downloader - not the valid MusicMatch Jukebox which shares the same filename MicrosoftNetwork Daemon for Win32 NETD32.EXE Added by the RANDEX.F WORM! MicrosoftOEM smvss.exe Added by the DEDLER-G TROJAN! Microsofts media winmplayd.exe Added by an undidentified WORM or TROJAN! Microsofts media wingtp.exe Added by the RBOT-VO WORM! Microsofts MediaScope winmep.exe Added by the RBOT-WB WORM! Microsofts MediaScope winmedplay.exe Added by a variant of the RBOT WORM! Microsofts Security Manager ****.exe [**** = random char] Added by the RBOT-WH TROJAN! Microsofts Service lcsrv16.exe Added by a variant of the RBOT WORM! Microsofts Updates lsasss.exe Added by the RBOT-AEX WORM! Microsofts Updatez cmsssr.exe Added by an unidentified VIRUS, WORM or TROJAN! Microsofts Updatez exploirez.exe Added by a variant of the RBOT WORM! MicrosoftServiceManager mstask32.exe Added by the YAHA.P WORM! MicrosoftServiceManager Wintsk32.exe Added by the YAHA.U WORM! MicrosoftServiceManager EXPLORERE.EXE Added by the YAHA.AB WORM! MicrosoftServiceManager msupdat.exe Added by the YAHA.AA WORM! MicrosoftSourceSafe lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf MicrosoftSys SPOOLSYS.exe Added by the TARNO.N TROJAN! MicrosoftUpdate syshelper.exe Added by the WOOTBOT.AC WORM! MicrosoftUpdate WinUp32.exe Added by an unidentified VIRUS, WORM or TROJAN! MicrosoftUpdates [path to trojan] Added by the DELF-LO TROJAN! MicrosoftValue syscnfg.exe Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside Microsoftvirus sysoverload.exe Added by the FORBOT-AL WORM! MicrosoftWindows [various filenames] MagicSearch - a CoolWebSearch parasite variant Microsoftz turn Control aexl.exe Added by the SDBOT.BCO WORM! Microsoftz turn Control read.pif Added by the RBOT-AFS WORM! Microsoft(c) PID Lex PIDLex.exe Added by the NIOVADOOR TROJAN! Microsoft" ActiveX Debugger NT setdebugnt.exe Added by the BANCOS-CZ TROJAN! Microsoft(r) System Mapper SysMap.exe Added by the MAPSY TROJAN! Microszoft Update Mach1nezs svchst.exe Added by the RBOT-ED WORM! Microzoft_Ofiz KdzEregli.exe Added by the AMUS.A WORM! Micrsoft CFG 32 lrbzus32.exe Added by a variant of the AGOBOT/GAOBOT WORM! Micrsoft Driver windrive.exe Added by the SDBOT.AF TROJAN! Micrsoft Driver msdriver.exe Added by the SDBOT-XD WORM! Micrsoft Internet Explorer IEXPL0RE.EXE Added by the RBOT-AQV WORM! Note the number "0" in the filename Micsorosft Security Center wcnsfty.exe Added by the RBOT-AHU WORM! MightyFAX Controller MFNTCTL.EXE Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software" MigrationVendorSetupCaller rundll32.exe migrate.dll, CallVendorSetupDlls ?? MimBoot mimboot.exe Starts Musicmatch Jukebox at bootup - can be started manually Mincer Mincer.exe Added by the MINCEME-A WORM! MINIBUG MINIBUG.EXE Displays ads inside Weatherbug - see here MINIFERT.EXE MINIFERT.EXE Part of Backweb minilog MINILOG.EXE If you don't have ZoneAlarm or ZoneAlarm Pro running you don't need this. This must be enabled if programs such as VisualZone Report utility or ZoneLog Analyzer are in use MiniMavis MiniMavis.exe Mavis Beacon typing tutor minimo [path to file] Added by the MOSUCK-X TROJAN! MiniNote MININOTE.EXE Mini NoteTab was the first in the family of "NoteTab" text and HTML editors from Fookes Software Miniphone glophone.exe VoiceGlo Glophone Voice over Internet Protocol (VOIP) communications software - "an affordable and convenient way to call friends and family throughout the world using a dial-up or broadband Interne miniport usb2chk.exe Added by the LAZAR-A TROJAN! MiniPortRt miniport_mp.exe Malware - see here MiniServer.exe MiniServer.exe Added by the LITTLEW-E TROJAN! MinMaxExtender Mmext.exe MinMaxExtender - window handling tool Miosf Update wimsqaad.exe Added by the SDBOT.AG TROJAN! Mirabilis ICQ NDetect.exe If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Mirabilis ICQ icq.exe If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Mirabilis ICQ ICQNet.exe If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Miramar Systems, Inc. atmsg.exe Miramar PC/Mac networking software Miranda IM miranda32.exe Miranda instant messaging client Mirate Sp 2 Information miratesp2.exe Added by the RBOT.QH WORM! Mircosoft DNS Service svchost.exe Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Mircosoft Update wuampkd.exe Added by a variant of the SDBOT WORM! Mircrosoft Svchost32 svchost32.exe Added by the RBOT-AZW WORM! Mircrosoft Windows Config DLL rundllc32b.exe Added by the RBOT-ZY WORM! miroVIDEO Tray Tool misitray.exe Tool for quickly changing options for miro/Pinnacle capture cards during capture/playback/output. When this program is closed, another program (mv-ctrl) is also closed, but mv-ctrl does not have its ow MirrorFolderShell mrfshl.exe MirrorFolder backup software Mirsoft sdcE taskmegr.exe Added by the RBOT-AWY WORM!

X ? ? X N N X U X ? X X X N X U X U ? N U X N N ? ? X Y N X N N N N ? X X X X X U X X U N X N X X U X U N X X N N N N N X U U X X X X N X U

Miscrosoft Windows Explorer misiCTRL misiTRAY Mismo Mixer Mixghost ml00!.exe ML1HelperStartUp mload MM Install MMB2 MMC mmcndmgr MMCWINMGMT mmemdrv MMERefresh Mmgsvc MMhid MMHK MMHotKey MMKeybd mmod mmpti MMReminderService MMRun mmsys MMSystem MMTASK mmtask MMtask Service MMTray MMTray MMTray2K MMTrayLSI mmusrstp mmxp2passion.exe mmxrun mmxrun mnklins MNPol MNS mnsvc mnsvcsp Mobile Phone Suite mobsync MOBSYNC32.EXE MOD Modem Modem Driverz Updates MODEMBTR Modeminf ModemOnHold ModemUtility ModularConfig Module Call initialize Money Express MoneyAgent MoneyAgent MoneyStartUp MoneyStartUp10.0 monitor Monitor Apache Servers Monitor Helper Monitoring Service Monitormgt MonitorSD MONPluginSrIvcs Monstersoundtray MonTest MoodBook

IEEXPLORER.exe misiCTRL.exe misiTRAY.exe win32x.exe Mixer.exe mixghost.exe ml00!.exe ML1Helper.exe lxmstart.exe setup.exe explorer.exe inisys.exe mmcndmgr.exe winmgmt.exe mmemdrv.exe MMERefresh.exe mmgsvc.exe mmhid.dll mmhk.exe MMHotKey.exe MMKeybd.exe mmod.exe m1mmpti.exe MMReminderService.exe mmrun.exe recover.exe RunDll32 mmtask.tsk mmtask.exe mmtask.exe mm_tray.exe MMTray.exe MMTray2K.exe MMTrayLSI.exe procrun.exe mmxp2passion.exe msosa.exe mswinindex.exe mnklins.exe mnpol.exe MNS.exe mnsvc.exe mnsvcsp.exe MobilePhoneSuite.exe mobsync.exe mobsync32.exe muamger.exe locatesvc.exe mdmdrv.exe MODEMBTR.EXE Modeminf.exe MOH.EXE mdmsetpe.exe syscnfg.exe RUNDLL32.EXE reg.dll, ondll_reg moneyexpress.exe money express.exe mnyexpr.exe Money Startup.exe Activation.exe monitor.exe ApacheMonitor.exe monitor.exe svchost.exe Monitormgt.exe SDMonitor.exe n3monap23.exe Freectrl.exe vccxzq.exe mb.exe

Reported as the SDBOT.YX WORM! Miro video driver related. Is it required? Miro video driver related. Is it required? Added by the RBOT-JP WORM! C-Media Mixer - C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Setting Management software for Altec Lansing speakers. If a change is needed, the user can launch it from the Start menu Malware, detected by Panda antivirus as Trj/Downloader.BWD ScreenScenes Midnight Lake screensaver. The freeware version comes with Gator branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purch Added by an unidentified VIRUS, WORM or TROJAN! Possibly Money Manager from Moneysoft? Added by an unidentified WORM or TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless yo Added by the OSCABOT-I WORM! Added by an unidentified VIRUS, WORM or TROJAN! Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here Added by SecondSight spyware. Note - SecondSight is spyware that captures keystrokes and screen shots, and logs user activity on the compromised computer. The risk can then send the logged inform Part of Digidesgin Protools. Refreshes your midi ports on the 002(R) (the 002R is a hardware audio/midi converter connected to your computer via firewire). Must be running in order to use the MIDI func Mmgsvc spyware This is the Human Interface Device Server for Win98, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia keyboards with A driver found on a Compaq Presario 800T notebook. Possibly something to do with multimedia hot keys? Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen Multimedia keyboard manager. Required if you use the additional keys eZula TopText adware Mpact Mediaware Properties Taskbar Icon - multimedia software icon for Chromatic Research Mpact video cards Mind Manager from Mindjet - "easy way to organize ideas and information". Registration reminder ?? ?? Added by the FUNNER-A WORM! A check on the file's properties reveals "Multimedia background task support module". MMTASK is a very simple 16-bit program used by certain multimedia drivers (which are still 16-bit on Win9x) to pe Part of MusicMatch Jukebox - digital music player / CD burner and ripper / music organizer / playlist creator Added by the BACKGAT.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename MusicMatch Jukebox icon in the task tray - digital music player / CD burner and ripper / music organizer / playlist creator Part of Morgan Multimedia Codecs. Only required when the codecs are used Part of Morgan Multimedia Codecs. Only required when the codecs are used Part of Morgan Multimedia Codecs. Only required when the codecs are used ?? Added by MediaMotor ADWARE! Added by an unidentified TROJAN or WORM! TwoSeven spyware VX2.Transponder parasite updater/installer related Added by the DLUCA.B TROJAN! Mobile Net Switch enables you to use your computer on more then one network with the click of a button. It allows you to automatically select the correct drive mappings, printer settings, IP settings an Added by the AUTOUPDER TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Logitech Mobile Phone Suite MS Syncrhonization Manager - updates the network copy of materials that were edited offline, such as documents, calendars, and e-mail messages Added by the FINERO TROJAN! MicroAngelo On Display from Impact Software lets you customize Windows icons. With a few exceptions, you can customize icons by right-clicking on them Added by a variant of the SPYBOT WORM! Added by a variant of the SDBOT WORM! Modem Booster from inKline Global to improve ISP connections Added by a variant of the CRYPTER.C TROJAN! NetWaiting Modem-on-Hold Application System Tray configuration icon for Aztech modems Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside Added by a variant of the LOVGATE WORM! Part of MS Money. Available via Start -> Programs Part of MS Money. Available via Start -> Programs Microsoft Money Microsoft Money Part of MS Money 2002. Available via Start -> Programs Browser hijacker, redirecting to NCM Search Part of the Apache Web Server package. Useful only if you're running such a server on your PC. Available via Start -> Programs MyLittleSpy keystroke logger/monitoring program - remove unless you installed it yourself! Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the GEMA TROJAN! Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Added by a variant of the RBOT WORM! Diamond Multimedia sound card control panel Added by the SDBOT-EA WORM! MoodBook is a free Windows utility that brings art to your desktop

N N X X X N N N U N U X U X N N X X N X X X U U U X U X X N X X X X N N X X U Y Y Y X X U X U X X Y X X U Y ? X N X N U X N U N U X X X X X

moon phase Morpheus morphstb mosearch MotherBoard Sounds Motive SmartBridge Motive SmartBridge Motive SmartBridge MotiveMonitor MotiveSB MotMon motoin Mount Safe & Sound mouse Mouse 32A Mouse Suite 98 Daemon mousebut Mousecntl MouseCount mousedrv MouseDrv MouseDrv mouseElf mouseElf MouseImp mousepad Mousinfo MoussaEvil MoveSearch Movielink Manager Uninstall MovieM MovieNetworks Movieplace Mozilla Firefox Mozilla Quick Launch Mozilla Quick Launch MP Tcloaxs Mp3 Loader MPEO MPFExe MPFExe MPFTray MPL32 driver MPlay64 MplSetup MPM Manager MPower MPR MSG MPREXE MPREXE.exe MprHTML mprocessor MPSExe MpsOnn MPT MPtask Services MPTBox mptsgsvc.exe MPXTray MP_STATUS_MONITOR mqbkup mrtMngr MRU-Blaster Scheduler MRU-Blaster Silent Clean MRUBlaster MS Auto-IPSec Protection MS Autoloader 32 Ms Builders MS Config Loader MS Config Loader

moon.exe morpheus.exe morphstb.exe mosearch.exe Sounds.exe mpbtn.exe MotiveSB.exe BTHelpNotifier.exe motmon.exe MotiveSB.exe motmon.exe mm15201518.Stub.exe Fbmount.exe mouse.exe Mouse32A.exe pelmiced.exe mousebut.exe mousecntl.exe MC.exe mousedrv.exe [path to worm] update.exe MC.exe mouseElf.exe MImpHost.exe mousepad.exe mousinfo.exe [path to file] Search.exe msvcmm32.exe lmovie.exe MovieNetworks.exe Movieplace.exe F1REF0X.EXE Netscp6.exe Mozilla.exe mptcloaxs.exe Sysdata.EXE Csinsm32.exe mpf.exe MpfTray.exe MpfTray.exe MPL32.exe mplay64.exe MplSetup.exe MPM.exe MPower.exe mprmsg32.exe MPREXE.EXE mprexe.exe MprHTML.exe mprocessor.exe mscifapp.exe MpsOnn.exe MPT.exe mptask.exe MPTBOX.EXE mptsgsvc.exe mpxptray.exe monitr32.exe mqbkup.exe mrtMngr.exe scheduler.exe mrublaster.exe indexcleaner.exe MSASP32.exe MSAuto32.exe Wupated.exe svchos1.exe MSWin32bck.exe

Moon Phase - tray icon that indicates the phases of the moon MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free, a Adware downloader - detected by Kaspersky antivirus as Trojan-Downloader.Win32.Stubby.c Fast Search in Office XP - similar to the new revision of the Find Fast feature in Office 2000. Fast Search uses the Indexing Services in Office XP to create a catalog of Office files on your computer's hard Added by the RBOT-AAP WORM! System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - no System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - no System tray icon for help from BT Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - no Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer Delfin Promulgate adware variant From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start Added by the RBOT-AHJ WORM! Mouse driver to control mouse functions from Azona. Available via Start -> Programs Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Added by the CRYPTER.A TROJAN! Added by a variant of the CRYPTER.C TROJAN! MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required Added by the CRYPTER.A TROJAN! Added by the ZOLOAD-B WORM! Added by the ZOTOB.N WORM! Genius NetScroll mouse driver - required if you use non-standard Windows driver features System Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features MouseImp Pro - "A reliable assistant that turns your mouse into a simple, native but powerful controlling device" Added by the CLICKER TROJAN! MS mouse information tool - for troubleshooting mouse problems Added by the MUSANUB-A WORM! PigSearch adware Auto-update for Movielink - internet movie rental System Tray access Added by the BEAGLE.DS WORM! MovieNetworks will connect you by DOMESTIC PREMIUM RATE TELEPHONE NUMBER 900-xxx-xxxx. So you get xxx rated pictures and junk. And it will allow you to stay on the internet on their line and $$ MoviePlace malware Added by a variant of the SDBOT WORM! Netscape 6 and Mozilla browsers Netscape 6 and Mozilla browsers Added by the RANDEX.CT WORM! Added by the AVETTE-A VIRUS! Automatic logging of installs from Norton CleanSweep - available via Start -> Programs McAfee Personal Firewall McAfee Personal Firewall McAfee Personal Firewall Added by the LOONY-M TROJAN! Added by the MPLAY64 TROJAN! Used by Ricoh network printers to enable network printing from the client Added by the DONBOMB.A TROJAN! MPower from MindBeat. "Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your C Added by the MYTOB.CF WORM! Added by the OPASERV.T WORM! Note - this is not the legitimate Mprexe.exe system file WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here and here. No Added by a variant of the VAGRNOCKER TROJAN! InstallDollars.com foistware McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering" Canon printer driver ?? Added by the LALA or AOT TROJANS! Cannon Multi-Pass toolbox - a button bar Hacker Tool - detected by TDS-3 antitrojan as "HackTool.Win32.Hidd.j" Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause, next,previous) etc Cannon Multi-Pass status monitor - your choice Added by the OPASERV.K WORM! Maintenance Release Task Manager for Intuit's QuickBooks or Quicken MRU-Blaster scheduler - detects and cleans MRU (most recently used) lists on your computer MRU-Blaster - performs silent cleaning of MRU lists at boot MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder Added by the RBOT-AER WORM! Added by the SPYBOT.BD WORM! Added by the AGOBOT-SS WORM! Added by the AGOBOT.R WORM! Added by the GAOBOT.AA WORM!

X X U X X X X X X X X X X X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

MS Config Loader MS Config Service MS Config v13 MS Configuration Ms Configuration MS DATABASE MS Decryption Software MS DirectX Sound Drivers MS DVD DirectX Dll Drivers MS DVD DirectX Sound Drivers MS Explorer MS FIREWALL MS FIREWALL MS HTML MS HTML MS HTML Location Class MS Internet Executor 32 MS lsass Startup MS management console MS Microsoft Socket Deamon MS MSN Menssenger 7.0 MS MSN Menssenger 7.0 MS Network Control ms ownage MS PLUS INC Ms Processe Manager MS Real Player MS Registry Service MS Remote Procedure Call MS Screen Saver MS Security MS Security Authority Service MS Security Hotfix MS service MS Sound Config 16bit Ms Sound Drivers Ms Spool32 MS SyS Restore MS Sys Security MS System Security Ms task manager MS taskbar MS taskbar MS taskbar MS Taskbars MS taskmanager MS UniX MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Unix Binary MS Update MS Updates MS Updates MS Updates MS Updating Utility MS USB 2.0 Windows Support Ms Valud Loader ms window update MS Windows AOL Driver MS windows Data list process MS Windows procces 32 MS Windows Process Class MS Windows Process Init MS Windows Security Updater

svcrhost.exe Msloader32.exe lrbz32.exe MSFramer.exe microsoftsa32.exe MSDATA32.EXE active.exe msdrvdx.exe mdxdl.exe msdrvdx.exe mexplore.exe msfrewall.exe msfirewall.exe msHtml.exe mslat.exe MSHTML32.exe MSIXEC32.exe lsass135.exe mms.exe MSSCKD32.exe MSMSN7.exe MSEXPORT.exe mswin.exe winPE.exe wpad.exe msproc.exe RealPlyr.exe MSRMS32.exe msrpc32.exe scrsave.scr systm.pif lsass.exe service5.exe msservice.exe sndcfg16.exe msdrv.exe MS SPOOL32.EXE sysrestore.exe mswin.pif mswin32.pif tskmgr.exe crssr.exe nts.exe taskbars.exe taskbars.exe tskmgr.exe navupdate64.exe win32ttb.exe msmq2inst.exe msnupdate.exe outlookexpressupdate.exe Win32Update.exe Norton2005Update.exe trmupdate.exe WinGuard.exe msnq3insller.exe syshost.exe mscache.exe syshosts.exe aupd.exe msupdater.exe msusb32.exe Svhots.exe ******.exe [* = random character] MSAOLdrv.exe MSDATLST.exe msprocces.exe MSPRCSS32.exe MSWPI32.exe updater.pif

Added by a variant of the RBOT WORM! Added by the RBOT-KJ WORM! Added by the GAOBOT.AOL WORM! Added by the RANDEX.OL WORM! Added by the KELVIR.X WORM! Added by a variant of the SDBOT WORM! MediaTickets adware variant Added by the RBOT.BCX WORM! Added by the SDBOT-XI WORM! Added by the SDBOT-XJ WORM! Added by the YAHA.AE WORM! Added by the SDBOT-PU WORM! Added by the SDBOT-QH WORM! Added by the PESTDOOR.31 TROJAN! Added by the LATINUS.SVR TROJAN! Added by the RBOT-YD WORM! Added by the RBOT-AEQ WORM! Added by the RBOT.WM WORM! Suspicious as the Microsoft Management Console is "mmc.exe" and doesn't normally run at startup Added by a variant of the RBOT WORM! Added by the RBOT-ACA WORM! Added by a variant of the SDBOT WORM! Added by the DUMBA TROJAN! Added by the RBOT-AJL WORM! Added by the MYTOB-AN WORM! Added by the RBOT.ATO WORM! Added by the RBOT.MR WORM! Added by the RBOT-AKP WORM! Added by the RBOT-QL WORM! Added by the RBOT-AGT WORM! Added by the RBOT-AQN WORM! Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the GAOBOT.AG WORM! Added by the RBOT-ZG WORM! Added by the SDBOT.MB TROJAN! Added by the SDBOT-WR WORM! Added by the ASASSIN TROJAN! Added by the RBOT.XM WORM! Added by the RBOT-APJ WORM! Added by the RBOT-AOX WORM! Added by the SDBOT.CCD WORM! Added by the RBOT-AGO WORM! Added by the RBOT-AGB WORM! Added by the RBOT.BRW WORM! Added by the SDBOT-ACV WORM! Added by the RBOT-AKA WORM! Added by a variant of the RBOT WORM! Added by the SPYBOT.OQ WORM! Added by the RBOT-YF WORM! Added by the RBOT-AAM WORM! Added by the RBOT-YU WORM! Added by the RBOT-BAS WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ACC WORM! Added by the RBOT-ACL WORM! Added by a variant of the RBOT WORM! Added by the EVAMAN-F WORM! Spyware web downloader Added by the MYDOOM.Y WORM! Spyware web downloader Added by the RBOT-XR WORM! Added by a variant of the RBOT WORM! Added by the AGOBOT-SP WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ASP WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT-AEZ WORM! Added by the RBOT-YQ WORM! Added by the RBOT-ASQ WORM! Added by the RBOT-AKY WORM!

X X X X X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X ? X U X X X X N X X X X X X X X X X X X X X N X X X X X X X X X X X X X

MS Windows Update MS WINS Binary Ms**.exe [* = random char] Ms**32.exe [* = random char] MS-Connect MS-Connect MS-Connect MS-Connect MS-Connect MS-DOS Boot Service MS-DOS Security Service MS-DOS Windows Service MS-HTML MS-patch MS-patch MS-RunKey ms2src MS7531 MSACM msadcheck MSAdmin MSAgent MSAgent MSAgentXP msaim msappts32 MsAudio MsAudio MSbackups MSBB msbcs MsBootMgr.exe msbsc MSChoExE msci mscman mscn Mscnt Mscolour MSCommX MSCONFG32.EXE MSConfig MSConfig msconfig Msconfig msconfig MSConfig Msconfig lptt01 MSConfig Manager Msconfig ml097e msconfig service msconfig.exe msconfig.exe msconfig38 MSConfig45 MSConfigr MSConfigReminder MsConfigs MSControl28 MSControl31 MSControl3d1 MSCORE Mscsgs Mscsgs32 mscsvc.exe Msctrl32 MSCVT MSDcom msdev msdev

scguard.exe Added by the RBOT-YZ WORM! ign32.pif Added by the RBOT-ASB WORM! Ms**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log Ms**32.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log arr.exe Adult content dialler - see here cdm.exe Adult content dialler - see here game.exe Adult content dialler - see here msite18.exe Adult content dialler - see here web.exe Adult content dialler - see here Boot32.pif Added by the RBOT-AMF WORM! ms-dos.pif Added by the RBOT-AMR WORM! MS-DOS.PIF Added by the RBOT-AJW WORM! [random filename] Added by the LATINUS.15 TROJAN! msconfig32.exe Added by the RBOT-AUF WORM! mspatch32.exe Added by the RBOT-AWF TROJAN! arr.exe MS-Connect dialler/hijacker ms2src.exe Added by a TROJAN - see here ms7531.exe Homepage hijacker msacm.exe Added by the OPASERV-O WORM! msadcheck32.exe Browser hijacker, redirecting to search-system.com jdbgmrg.exe Added by the DASMIN.A TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here mshtm.exe Browser hijacker - redirecting to buldog-search.com hhnt.exe Added by the AGENT.JI spyware MSAgentXP.exe Reported by Ewido Security Suite as TrojanDownloader.Reqlook.c msaolim.exe MessageSpy keystroke logger/monitoring program - remove unless you installed it yourself! msappts32.exe Added by the ELBURRO-A TROJAN! explorer.exe Added by the LEGMIR-BY TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added i MsVM_STI.EXE RunDll32 cmicnfg.cpl, Added CMICtrlWnd by the LEGMIR-BY TROJAN! Note - this is not associated with C-Media based audio which uses a similar command entry (see here) backups.exe Added by BANLOAD-TL TROJAN! msbb.exe Advertising spyware msbcs.exe Added by the DADOBRA-G TROJAN! MsBootMgr.exe Added by the VERIFY TROJAN! [path to trojan] Added by the BANKER-DF TROJAN! suge.exe Added by a variant of the RBOT WORM! mcinfo.exe McAfee Internet Security related. What does it do and is it required? mscman.exe ClientMan parasite variant mscn.exe Part of the SafeChildNet internet filtering program - required if you use it mscnt.exe Added by the DLUCA-C TROJAN! mscolour.exe Added by the GEMA TROJAN! mscommx.exe Added by a variant of the RBOT WORM! MSCONFG32.EXE Added by the OPTIX.04.C TROJAN! msconfig.exe Entry that appears when you uncheck an item in the MSConfig Startup group, and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup MSCONFIG32.EXE Added by the SPYBOT.B WORM! msconfig.exe CoolWebSearch parasite related. Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry an msconfig.exe Added by the WINUR WORM! Note - this is not the real msconfig.exe as it's located in C:winrun wins.exe Added by the RBOT.PF WORM! MSCONFIG35.EXE Added by a variant of the SPYBOT WORM! msconfig.exe RapidBlaster variant (in a "msconfig" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executa msupdate.exe CoolWebSearch parasite variant msconfig.exe RapidBlaster variant (in a "msconfig" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executa MSupdate32.exe Added by a variant of the SPYBOT WORM! proxy.exe Added by a variant of the AGENT.AH downloader TROJAN! uline.exe Added by a variant of the AGENT.AH downloader TROJAN! mssvcc.exe Added by the RBOT-BJV WORM! MSConfig45.exe Added by the SDBOT.OJ TROJAN! jdbgmrg.exe Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here msconfig.exe Entry that appears when you uncheck an item in the MSConfig Startup group, and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup MsConfigs.exe Added by the ALCAN.A WORM! crsss.exe Added by the SPYBOT.AJX WORM! winnsyst.exe Added by the RBOT.CFY WORM! isasse.exe Added by the RBOT.CGU WORM! syscnfg.exe Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside MSCSGS.EXE Added by the ZEZER WORM! MSCSGS32.EXE Added by the ZEZER WORM! mscsvc.exe Added by the BANCOS.T TROJAN! Msctrl32.scr Added by the REDIST WORM! MSCVT.exe Added by the SLIDESHOW WORM! MSDcom.exe Added by a variant of the SDBOT WORM! msdev.exe Added by the FORBOT-CR WORM! msconfig.exe Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry

X X X X X X X X X X N N X X X X X X X X X X N X X X X X Y X X U X X X X X X X X X X X ? X X X X X U X U X X U X U X X ? X X X X X X X X X X

msdirect.exe MSDLL Msdmxm MSDN MSDN HELP MSDOS Security Service MSDOS Service MSDOS Windows Service Msdos32 msdos423 MSDosdrv MSDTC Msemu32 mservices.exe Msfind MSFind32 msfindosa.exe MSFTP Service Config MSFWAVTSM Msg Fixage MsgApi msgb1 MsgCenterExe msgex32 Msgmgr msgserv_ msgsm32 Msgsrv16 MSGSRV32.exe MsgSvcMgr32 msgsvr32 MSGTAG Msgtray Mshelp32 MSHT@ msident msidle MsIdle32.exe MSIdll msiew MSIEXEC MSIEXEC MSIMN32 MSIN Msinet MSInfo MSInfo MSInstall msjava service MSKAGENTEXE MSKCES32 MSKDetectorExe MSKernel32 MSkernel32 MSKExe mskj MSKServerExe mslagent MSLARISSA MSLIB32 MSLog Mslogon lptt01 Mslogon ml097e MsManager msmanager32 msmautoprotect msmc msmc msmc msmc

msdirect.exe syscnfg.exe msdmxm.exe nese.exe msdn.exe msdos.pif MSDOS.PIF MSDOS.PIF Msdos32.pif msdos423.exe msdosdrv.exe msdtc.exe Msemu32.exe mservices.exe Msfind.exe msfind32.exe msfindosa.exe r3grun.exe FTPDev.exe msgfixed.exe [path to file] msgb1.exe RealOneMessageCenter.exe msgex32.exe [path to worm] Syss.exe msgsm32.exe Msgsrv16.exe msgsrv32.exe cmdzxdll.exe msgsvr32.exe MSGTAG.exe sys16.exe mshelp32.exe [email protected] msident.exe msidle.exe MsIdle32.exe winmp.exe mseiw.exe MSIEXEC32.exe MSIEXEC.EXE MSIMN32.EXE MSin.exe Msinet.exe msinfo.exe AVBgle.exe smvss.exe xpcd.exe MskAgent.exe [random filename] MSKDetct.exe MSKernel32.vbs System.exe 4820 spamkiller.exe mskj.exe MSKSrvr.exe mslagent.exe MSLARISSA.pif mswatch32.exe MicrosoftLog.exe mslogon.exe mslogon.exe msmgr32.exe msmngr32.exe msmssgs.exe mscpbo.exe msgdmf.exe msongn.exe msmc.exe

Added by the CERTIF-L TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside Added by the DLOAD-DC TROJAN! Added by the SDBOT.AHY WORM! Added by the AGOBOT.AIB WORM! Added by the RBOT-AMP WORM! Added by the RBOT-AIY WORM! Added by the RBOT-AKF WORM! Added by the RECORY WORM! Added by the MENACE.A WORM! Added by the BACROS WORM! MS Distributed Transaction Coordinator - handles transactions across multiple servers and is installed by MS Personal Web Server and MS SQL Server Unidentified spyware/adware/hijacker Added by the SDBOT.WJ WORM! CoolWebSearch parasite variant Added by the CAYAM WORM! Added by the DOWNLOADER-BS TROJAN! Added by a variant of the SDBOT WORM! Added by the RBOT-ACF WORM! Added by the SDBOT.ZD WORM! Added by the DEDLER-D TROJAN! Added by the DLUCA.GEN TROJAN! RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way Added by the APPFLET-A WORM! Added by the BABYBEAR WORM! Added by the FANTA TROJAN! Added by the RBOT-ASG WORM! Added by the DELF family of TROJANS! Windows 32-bit VxD Message Server. For more information on its function and why it's needed, see here. Note - why some people have it listed in start-up programs I don't know but I was asked to inclu Added by the RBOT-AEK WORM! Added by the DEADHAT.B WORM! Note - not to be confused with the valid "msgsrv32.exe" file which resides in the same directory (C:WindowsSystem) on a Win9x/Me machine MSGTAG is an application that tells you when your emails have been received and opened Added by an unknown VIRUS! CoolWebSearch parasite variant Added by the MAGISTR.A VIRUS! Unidentified adware or trojan Added by the OPASERV-O WORM! Added by the VERIFY TROJAN! Added by a variant of the RBOT WORM! Added by the LITTLOG TROJAN! Added by the AINESEY.A WORM! Added by the YOSENIO-A VIRUS! Added by the CWS-M TROJAN! ?? Added by the RBOT-AOA WORM! Added by the ALADINZ.M TROJAN! Added by the NETSKY.O WORM! Added by the DEDLER-G TROJAN! Added by the SDBOT.VM WORM! Part of McAfee Spamkiller Added by the CLONER TROJAN! Part of McAfee Spamkiller Added by the LOVELETTER (I LOVE YOU) VIRUS! Added by the TUXDER TROJAN! McAfee SpamKiller Added by the KAEMON TROJAN! Part of McAfee Spamkiller Added by the WINTRIM-F TROJAN! Added by the ASSIRAL.B WORM! ?? Added by a variant of the SDBOT WORM! RapidBlaster variant (in a "Mslogon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "Mslogon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Added by the YAHA.AF WORM! Added by the RANDON-R (or WOMANIZ.A) WORM! Added by the BIFROSE-AJ TROJAN! ClientMan parasite variant ClientMan parasite variant ClientMan parasite variant ClientMan parasite variant

X X X X X ? X X X X X X X X ? X U X X X X X X X X X X X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X

msmc MSMcAfeee MSMcAfeeh MSMcAfeeS MSMessnger msmgr msMGR Msmgt MSMNTGNT MSMNTJBE MSMNTJNG MSMNTMTS msmon MsMovies MsmqIntCert msmsgr MSMSGS msn MSN MSN MSN MSN MSN msn MSN MSN MSN 9.0 Plus MSN Administration For Windows MSN ang MSN BETA Msn Config Msn Configuration Loader MSN Funny Images MSN Internet Access MSN Manager MSN Manager MSN Message Background loader MSN Messages MSN Messanger Msn Messeng Msn Messenge MSN messenger Msn Messenger MSN Messenger MSN MESSENGER MSN Messenger MSN Messenger MSN Messenger MSN Messenger MSN Messenger Msn Messenger MSN Messenger MSN Messenger 32 MSN Messenger 323 MSN Messenger 6.2 MSN messenger service MSN Messenger Service Starter Msn Messenger Update MSN Messenger User Controls Msn Messengers MSN MMISSENGER Msn Patch Msn Patches Msn Plus Updater Msn Processe Manager MSN Quick View MSN Registry loader MSN service MSN Service Msn Service

ms****.exe [* = random char] Avsynmgr32e.exe Avsynmgr32h.exe Avsynmgr32S.exe msnupd.exe msmgr.exe rtkmsg.exe msmgt.exe MSMNTGNT.EXE MSMNTJBE.EXE MSMNTJNG.EXE MSMNTMTS.EXE msmon.exe MsMovies.exe regsvr32 /s mqrt.dll msmsgss.exe msmsgs.exe msnmsg.exe msnmsgs.exe ctfmoons.exe msnmesengers.exe MSN.exe msnmsgr.exe msnsvc.exe msn16.exe msnsgr.exe [random letters].exe msnadp32.exe cssrss.exe service.exe msngf.exe msngms.exe imsngsr.exe trayclnt.exe cvss.exe mscmgr.exe msnmesg.exe msnmesg.exe msnmsng.exe windns.exe IExplorer.exe messenger.exe msnmsgs.exe Reosmsngr.exe msmmsgr.exe msmsgs.exe msnmsgr.exe msmsgs.exe msnmsngr.exe IExplorer.exe msnmsnr.exe PIC1324.exe msniu.exe msniu3.exe tyd.exe mssgs.exe msnmgsr.exe msnupdate.exe msmsgr.exe MSNMSGR.EXE mssmmspgr.exe msndp.exe msndr.exe msnplus.exe msni32.exe Msndc.exe msmnwin.exe msnmgr16.exe amsnmsgrs.exe matrixcam.exe

ClientMan parasite variant Added by the FRAMAR TROJAN! Added by the FRANGO TROJAN! Added by the VOLAC or VOLAC.DR TROJANS! Added by the RBOT-ADY WORM! ?? Added by the SDBOT-BPY WORM! Total Velocity adware/hijacker Added by the BANKER-IE TROJAN! Added by the Bancos-EF TROJAN! Added by the GRABER-G TROJAN! Added by the BANKER-GZ TROJAN! Added by a variant of the GEMA.D TROJAN! Malware - detected by Kaspersky antivirus as Trojan-Dropper.Win32.WinAD.h Microsoft Message Queue Server - Internal Certificate - see here for more info and here for a potential problem. Is it required? Reported by Kaspersky Anti-Virus as RBOT.AJJ KITRO.A WORM! Added by the RBOT-GO WORM! Added by the RBOT-KL WORM! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Added by the SPYBOT.HI WORM! Added by the RBOT-ME WORM! Added by the MINIT WORM! Added by the MYTOB or MYTOB.B WORMS! Note - this is not the valid MSN Messenger utility Added by a variant of the SDBOT WORM! Added by the SDBOT-VN WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT-ALY WORM! Added by the BROPIA.W WORM! Added by the FORBOT-CE WORM! Added by the RBOT.AUU WORM! Added by the RBOT-QG WORM! Added by the KELVIR.T WORM! Added by the AGOBOT-TT WORM! Quick way to connect to MSN internet service - replaces "MSN Quick View" from V5.6 onwards Added by a variant of the SPYBOT WORM! Unidentified malware - causes multiple browser windows to open Added by a variant of the RBOT WORM! Added by the RBOT-ACN WORM! Added by the SDBOT.XN WORM! Added by a variant of the RBOT WORM! Added by the DELF-LL TROJAN! Added by an unidentified TROJAN! Note - this is not the real MSN Messenger, see this thread Added by the LOONY-P TROJAN! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Added by a variant of the SPYBOT WORM! Added by the KELVIR.Q WORM! Added by the DLOADER-LN or ZLOB-C or ZLOBDROP-C TROJANS! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder, and should not be mistaken for the Added by the AGOBOT.AOQ WORM! Note - this is not the valid MSN Messenger utility Added by the ZHOPA TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder, and should not be mistaken for the MSN Messenger file of the same na Added by a variant of the RBOT WORM! Added by the BANKER-EU TROJAN! Added by the BANKER-GG TROJAN! Added by the CHOKE.C WORM! Added by the RBOT-AWB WORM! Added by the RBOT-AXB WORM! Added by a variant of the RBOT WORM! Added by an unidentified TROJAN! Note - this is not the real MSN Messenger, see this thread Added by the RBOT-AOS WORM! Added by a variant of the RBOT WORM! Added by the KELVIR.HI WORM! Added by the RBOT.KX WORM! Added by the KELVIR.AJ WORM! Added by the RBOT.AAI WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-MU WORM! Added by the RBOT-ADX WORM! Quick way to connect to MSN internet service Added by the KELVIR.FK WORM! Added by a variant of the RBOT WORM! Added by a variant of the SDBOT WORM! Added by the MYTOB.JH WORM!

X X X X X X X X X X X X X X X X X X N X X X X X X X X ? X X N X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Msn Service MSN service MSN Service Updates MSN Service Utilities MSN Start MSN Update MSN Update MSN Update Msn Update Manager (Sp2) Msn Update Service MSN Updater Msn Updater Msn Updater MSN UPDATERS msn.exe MSN32 X Service MSN8m Startup msnager32 msnappau Msnarrator MSNavWH msndrvsys MSNET MsnExplorer MsnExplorer MsnExplorer MsnExplorer MsnFixer MSNGrabber msngta32 MSNIA msnload32.exe MSNMESENGER msnmsg msnmsg msnmsg.exe msnmsgq32 msnmsgr MsnMsgr msnmsgr32-.exe MSNMSGR5 MSNMSGRE MSNMSGRR MSNMSGRS MSNMSGRS MSNMSGRS1 msnmsgs.exe msnmsgsgs MSNPluginSrIvcs MSNPluginSrvcs MSNPluginSrvcs msnsched2 MSNService msnsgs msnshed MSNSysRestore msnToolbaar MSObject32 Msoffice MSOffice MSOffice32 MSOfficeCfg MSOfficeCfg MSOfficeCfg MSOfficeCfg MSOfficeCfg msoffwz msoft-updater23 msoft-updater23 MSOleath32

raloded.exe msnmsgr16.exe winproc.exe nkn.exe msnmsgr7.exe mscon.exe msn32.exe DLLCON.EXE MSMSGS.EXE userx.exe msnms.exe msnplugins.exe windatemanager.exe virtualmemory.exe son.exe MSN32x.EXE msn8m.exe svchostt.exe msnappau.exe msnarrator.exe MSWkwrH.exe msndrvsys.exe msnet.exe winagent.exe MSEXPLOREN.EXE SHCH.EXE SVCHST.EXE msnfixjs.js MSNgrabber.exe msngta32.exe MSNIASVC.EXE msnload32.exe Main.exe asgag.exe TBC.exe mscmd32.exe msnmsgq.exe msnmsgr.exe MsnMsgrs.exe msnmsgr-.exe MSNMSGR5.exe swef.bat swin.bat swe.bat swiss.bat swed.bat msnmsgs.exe msnmsgsgs.exe n3vasap23.exe p6.exe sagate.exe msnsched2.exe MSNService.exe msnsgs.exe msnshed.exe pc32.exe msnmsgesc.exe MSObject32.js msoffice.hta services.exe msjcf.exe msocfg.exe navchk.exe qservice.exe shman.exe ssvr.exe msoffwz.EXE mssysstems.exe slssystem.exe winss.exe

Added by the MYTOB-DY WORM! Added by the RBOT-RZ WORM! Added by the KELVIR-BB WORM! Added by the KELVIR-BC WORM! Added by the RBOT-PH WORM! Added by the RBOT-QA WORM! Added by the RBOT.AHN WORM! Added by the RBOT-EA WORM! Added by the AGOBOT-NL WORM! Added by the MYTOB.JF WORM! Added by the FORBOT-CG WORM! Added by the RBOT-HS WORM! Added by the SDBOT.TS WORM! Added by the RBOT-JK WORM! Added by the STARTPA-GS TROJAN! Added by an unidentified WORM! Added by a variant of the RBOT WORM! Added by the WOMANIZ.E TROJAN! Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to "update" the toolbar Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware Added by the ANAV-A WORM! Added by the BROGGER-D TROJAN! Added by the BOA WORM! Added by the EQ TROJAN! Added by the EB TROJAN! Added by the EB TROJAN! Added by the EB TROJAN! Located in the HPbinmsnfix directory of a HP PC Added by the ENVID.A WORM! Added by a variant of the RBOT WORM! Added with MSN version 9. Resets certain internet settings upon bootup and can't be disabled via MSCONFIG Added by the BANCOS.M TROJAN! Added by the PRORAT TROJAN! CoolWebSearch parasite variant Added by an unidentified TROJAN! Added by a variant of the AGENT.AH TROJAN! Added by the TACTSLAY.H TROJAN! MSN Messenger utility. If you don't use MSN Messenger, this can be annoying. Available via Start -> Programs. Go to MS Messenger > Tools > Options > Preferences and uncheck "Run this program wh Added by the NETSKY-AD WORM! Added by a variant of the SPYBOT WORM! Added by the RBOT.PQ WORM! IRC backdoor TROJAN or WORM! IRC backdoor TROJAN or WORM! IRC worm or backdoor trojan! IRC worm or backdoor trojan! IRC backdoor TROJAN or WORM! Added by the BANKER-HK TROJAN! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Added by the "Catal" alias Spy.Delitall.B backdoor TROJAN! Added by a variant of the RBOT WORM! Added by the SDBOT.AKJ or RBOT-VJ WORMS! Added by the SDBOT.AKJ WORM! Added by the SPYBOT.NNT WORM! Added by the CARPET.C WORM! Added by the CHEUKO-B TROJAN! Added by the RBOT-YN WORM! Added by a variant of the MASTAK VIRUS! Added by the RBOT.BMF WORM! Added by the PUN TROJAN! Hijacker - redirecting to Searchdot.net Added by the DLOADER-EU TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Added by the RAKER-A TROJAN! Premium rate adult content dialer Premium rate adult content dialer Premium rate adult content dialer Premium rate adult content dialer Premium rate adult content dialer Added by the BANCBAN-HQ TROJAN! Added by the RBOT-ATU WORM! Added by the RBOT-ASR WORM! Added by the KATHER TROJAN!

X X X X X X X X X X X X X U U U U N X X X X X U X X X X X X X U X X X X X X X X X X X X X X X X X X X Y X X X X X X X X U X X X X X X X ? N

MSOOBD mspaint.exe Mspatch69 Mspatch89 msping msping.exe MSPluginSrvc MSPLUS MSPP System Update 64 MSPQFile MSPRO32 MSPRO32 MSprotect.exe mspwr mspwr mspwr mspwr MSPY2002 MSR Msrc msreg.exe msReg32 Loader MSREGIT MSRegScan MSRegScan MSRegSvc msresear msresearch msresearch msrundll msrunocx32 MSSCDL msserv msserv32 msservice mssfos MSSGisg MSShow MSSHVC mssoul mssp3 MSSQL Msstart MSStartOptimizer MSStartOptimizer MSStartOptimizer msstask mssurfer lptt01 mssurfer ml097e mssvc MSSVC MSSVC.EXE mssvc32 mssys mssysint mssysint mssyslanhelper MsSystem MsSystem MSSYSTEM Mstapi Mstask mstask MSTask MStask MsTask MSTaskbar 32 mstasks Mstcgww MSTMON_N

MSOOBD.EXE check32.exe [path to trojan] cnqmax.exe msping.exe msping.exe p3.exe msplus32.exe wiaadmgr.exe MSA****.TMP [path to worm] pnp.exe MSprotect.exe pupstman.exe pupxpman.exe pwrupst.exe PuXpMan2.exe ImScInst.exe msr.exe Msrc.exe msrege.exe msreg32.exe Msgp.exe SGP.exe SSDemo.exe regsvc32.exe [path to trojan] msresearch.exe tool3.exe msrund1l32.exe msrunocx32.exe MSSCDLL.exe msserv.exe msserv32.exe msserv.exe sfool.exe [path to file] MSShow.exe MSSHVC.exe msmscc2.exe mssp22.exe Mssql.exe msstart.exe Iexpres.exe WINUPD.EXE SCVHOST.EXE msstask.exe mssurfer.exe mssurfer.exe [path to trojan] svcsys.exe MSSVC.EXE mssvc32.exe mssys.exe Iexplore .exe comime.exe msmsgri32.exe msdos.exe mssys.exe svcsys.exe Mstapi.exe mstask.exe mstask.exe run dll.exe svchost.exe wstask32.exe tbsvc32.exe mstasks.exe MSTCGWW.EXE MSTMON_N.EXE

Added by the MAGISTR.A VIRUS! Added by the AGENT.AH TROJAN! Added by the MPROX TROJAN! Added by the RANDEX.P WORM! Added by the FLOODBLACK TROJAN! Added by the MZ TROJAN! Added by the RBOT-WV WORM! Added by the MYTOB-AM or MYTOB-CL WORMS! Reported by Kaspersky Anti-Virus as the RANKY.GEN TROJAN! Homepage hijacker. See here for more information. **** can be anything Added by the IBERIO WORM! Added by the ZOTOB.O WORM! Added by the DABYREV.A VIRUS! Transparent icon background feature of Ashampoo's PowerUp XP (WinNT/2K/XP) and PowerUp Deluxe (Win98/Me) Related to Ashampoo's PowerUp XP Ashampoo PowerUp XP is a "tool for fine-tuning your Windows(r) NT4, 2000, 2003 Server and XP configuration" Related to Ashampoo Magic Defrag Utility Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Added by the AGOBOT.RT WORM! Added by the KRYPTONIC GHOST TROJAN! Added by the ZINX TROJAN! Added by the AGOBOT.IU WORM! Added by the KRYPGHOS.13 TROJAN! SpyGator is a surveillance software program that monitors Internet activity, logs keystrokes, and takes screenshots Added by the Supremespy SPYWARE! Homepage hijacker that changes your homepage to an adult content site Added by the WEASYW-B TROJAN! TROJAN! - 180SearchAssistant adware related Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, dow Added by the BINGHE TROJAN! Added by the SKUS WORM! SpyCapture keystroke logger/monitoring program - remove unless you installed it yourself! Added by the BLACKLOG-A TROJAN! Added by the RBOT-ACK WORM! Added by the HYD WORM! Added by the RANDEX.EUS WORM! Added by the RANKY.N TROJAN! Added by the QQROB-M TROJAN! Added by the NUFFY.A WORM! Added by the DAPIZL.A banker WORM! (A "banker worm" is designed to pillage banking information and send it back to the perpetrators!) Added by the IBANK-D TROJAN! Added by the SDBOT TROJAN! Added by the LIVUP.C TROJAN! Added by the DASMIN-E TROJAN! Added by the DASMIN-E TROJAN! Added by the DASMIN-E TROJAN! Added by the MYPARTY WORM! RapidBlaster variant (in a "surfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "surfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Added by the PSK TROJAN! Added by the FATOOS-C TROJAN! Stealthdisk - hides folders, files and applications. Will also encrypt them for better protection Added by the AGOBOT-ME WORM! Added by the MYSS.B TROJAN! Added by the PWSTEAL.ABCHLP and PSPIDER.310.B TROJANS! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the ".exe" Added by the NETSNAKE-I TROJAN! Added by the RANDEX.D WORM! Adult content downloader - see here Added by the VANTA.A TROJAN! Added by the FATOOS-C TROJAN! Keystroke logger/monitoring program - remove unless you installed it yourself! Added by the OPASERV.N WORM! Note - this is not the legitimate mstask.exe system file and the executable resides in C:Windows or C:WINNT Browser hijacker - redirecting to find-more.net. Note - this is not the legitimate mstask.exe system file Yuupsearch adware Added by the LDPINCH-BV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the MYTOB-FE WORM! Added by the RBOT.BQZ WORM! Added by the MULTIDR-AY TROJAN! ?? Generates an error message on startup if a Konica Minolta printer is not turned on and ready

N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X

MSTMON_Q Mstng32 msupd MSUpdate MSUpdate msupdate MSUpdate msupdate Msupdate Msupdate Msupdate Msupdate Msupdate MSupdate.exe MSUpdateDevKit MsUpdater System MSupdater.exe msupdater25 msupdates MSUpdSrv msurl msuser32.exe MsVBdll MsVBdll MSVBVM60 msvc32 msvc32 msvcc MSVersion MSVersion msvhost msvload32 msvsc32 MSVsmt MSVSync MSVXD mswave Mswavedll MSwheel MSWin Mswincfg MsWindows DRT Drivers MsWindows SSL Drivers MsWindows SysDate MSWindows Syspg MSWindowsUpdate Mswinpid32 MSWinSrv MSWinSrv32 MSWinupd MSWinupdate MsWinVgr mswkork Service msword mswspl mswspl mswspl mswspl msxct Msy1 Startups msys lptt01 Msys32 MSysDrv ms_anti_spyware ms_anti_spywarebxp ms_anti_spywarebxp MS_LARISSA MS_NETD_WIN32 MS_SETUP.EXE MS_Update Check

MSTMON_Q.exe MSTng32.exe msupd.exe wupd.exe svchosthlp.exe msupdate.exe criticalUpdate.exe update.exe expIorer.exe outIook.exe svchosts.exe svcrhost.exe svcshost.exe N/A axfd.exe udpsys32.exe N/A lsasser.exe msupdt.exe msupdsrv.exe msurl32.exe msuser32.exe sys32dll.exe MsVBdll.pif MSVBVBM60.pif msvc32.exe msvc32.exe msvchost.exe INTERNETFEATURES.exe clrschp038.exe aig.exe msvload32.exe msdev.exe rpcxctx.exe videosync.exe MSVXD.EXE mswave.exe mswavedll.exe mswheel.exe mswin.exe Mswincfg32.exe wsdrt32.exe mssl32.exe sysmsvc.exe mspg32.exe Systern.exe mswinpid32.exe MSWinSrv.exe MSWinSrv32.exe winupd.exe winupdate.exe msvgr.exe msework.exe msword.exe [random filename] searchbarcash.exe vnmispoisn downloader.exe plugin1.exe msxct.exe msyj32.exe msys.exe morfitwebentrance.exe msdrv.exe mwfirewall.exe mwfirebpx.exe mwfibpx.exe MS_LARISSA.exe netd32.EXE MS_SETUP.EXE wdfmgr.exe

Generates an error message on startup if the Konica Minolta PagePro 1350W printer is not turned on and ready Added by the TANG WORM! Added by the IEACCESS DIALER! Added by the ALADINZ.M TROJAN! Added by the BLASTER.T WORM! Added by the RBOT-MZ WORM! Affilred adware Added by a variant of the SDBOT WORM! Added by the TACTSLAY.A TROJAN! Added by the TACTSLAY.A TROJAN! Added by a variant of the TACTSLAY TROJAN! Added by the TACTSLAY.A TROJAN! Added by the TACTSLAY.A TROJAN! CoolWebSearch parasite variant - resets home page to an adult content site Added by the SDBOT-ZD WORM! Added by the RBOT.AAA WORM! CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin Added by the RBOT-ATS WORM! Added by the RBOT-JO WORM! Browser hijacker, redirecting to a adult content site Added by the CRYPTER.A TROJAN! Added by the ANDROV TROJAN! Added by the AIMDES.B or AIMDES.C WORMS! Added by the AIMDES.A WORM! Added by the SCOLD-B WORM! ClientMan parasite variant Added by the AGOBOT-NT WORM! Added by the XOMBE TROJAN! Added by the POPMON.A TROJAN! - also known as PopMonster adware Added by the POPMON.A TROJAN! - also known as PopMonster adware Added by the AIMBOT-BC TROJAN! Added by the RBOT-ACI WORM! Added by the RBOT-GJ WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the SPYBOT WORM! Added by the DATOM.A WORM! Added by the CRYPTER.A TROJAN! Added by the CRYPTER-C TROJAN! Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Added by the BANKER-CU TROJAN! Added by the CYBRSPY.D TROJAN! Added by the RBOT.ALT WORM! Added by the SPYBOT.API WORM! Added by the SPYBOT.FCD WORM! Added by the RBOT-TB WORM! Added by the RBOT-AFD WORM! Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim Added by the MTRON TROJAN! Added by the MTRON-B TROJAN! Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJAN! Added by the DLOADR-AAW TROJAN! Added by the MYTOB.LE WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ADR WORM! Added by the SMALL.IQ TROJAN! SearchBarCash adware SearchBarCash adware variant Added by the SMALL.IQ TROJAN! eXact Advertising (NaviSearch, BargainBuddy, CashBack) adware Added by the AGOBOT-QQ WORM! RapidBlaster variant (in a "Msyss" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Morfit ADjectPager - "uses home page rental technology for generating revenues". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed ap Added by the VB.WF TROJAN! Added by the GAMQOWI TROJAN! Added by the SURILA-D TROJAN! Added by the SURILA-J TROJAN! Added by the ASSIRAL WORM! Added by the RANDEX.F WORM! Added by the CHARGE TROJAN! Added by the AGOBOT-TB WORM!

X U U ? U U X X X U U X U U Y N X N U U U N N U X X X U U U X X X U X U X X X Y U N X X X U N X X X U X U U X X N U X X X X X U U U U N N Y

Mtr2 MUAL muamgr Mufix Multi-function keyboard MultiCAM Initializer Multimedia Codecs Multimedia extensions Multimedia extensions Multimedia KBD MULTIMEDIA KEYBOARD multiran MultiRes MUPS murphy shield Music01 Server MusIRC (irc.music.com) client MutexServiceEx MVRescue MW1HelperStartUp mwavscan MWProEng MWSnap mwsoemon Mwsvm mxb2 MxHLp32 MXO Auto Loader MXOBG MxRunner My Agent My App My Search Bar Eq My-disgo MyAccessMedia MyAgtTry Myapp Myapp MyAV MyCIO Agent Service myCIO.com ASaP myCIO.com Splash MyCometCursor MyDailyHoroscope MyDailyHoroscope MyEmoticons MyFastAccess myhuy myhuy MyLife myNetWatchman MyPointsPointAlert MyPopupKiller myprint mileage MySLScan mysoft MySoftware NewsFlash MytekSystrayExePath MyTotalSearch Email Plugin MyVBApp MyVBApp MyVBApp MyVirt.exe MyVitalAgent MyVitalAgent MyWebSearch Email Plugin N2PTray NADaemon Naggerrunkey Naimagent_service

mtr2.exe Added by the KRYPTONIC GHOST TROJAN! mual.exe Millesky video mail updater and launcher muamgr.exe Quick access to MicroAngelo 5.0. It can make the background of the icon text transparent and also change the color of the shortcut's text to a color you want. Very useful, if you have a wallpaper. Availa mufix.exe Part of INFOConnect, web-based, enterprise client configuration, management, and deployment software, as used by ABSS (a financial management system used by the US military which will allow purc GWHotkey.exe Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail, browser, volume and CD/DVD controls, etc) MCamBoot.exe The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears mcc.exe Added by the DLOADER-MB TROJAN! mservice.exe EasySearch adware [path to trojan] Added by the SMUTSRCH-A TROJAN! MMKeybd.exe Multimedia keyboard manager. Required if you use the additional keys MMKeybd.exe Multimedia keyboard manager. Required if you use the additional keys multiran.exe Added by the COSIAM-E TROJAN! MultiRes.exe MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP MUPS.exe Lauches the Belkin Bulldog Plus Service - required if you want to access the UPS advanced functions lmgui.exe Firewall part of BitDefender virus scanner/firewall Music01 Server.exe J River Media Jukebox musirc4.71.exe Added by the RANDEX.Q WORM! Sys32Smm.exe Webroot Sofware's discontinued "Privacy Master" mvrescue Related to Multivision Computers back up/restore program. Multivision Computers ceased operating in 2004 MW1HEL~1.EXE MagicWaterfall screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the scre mwavscan.com MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system, including memory, services, starup items and registry, or only scan files in a s MWProEng.exe Logitech Mouseware Pro software - only required when using special functions MWSnap.exe MWSnap - screen capture utility. Start manually when required mwsoemon.exe My Way Search/My Web Search Toolbar - "browser search tool compatible with IE (4.x or above) and Netscape 4.x. The Toolbar displays algorithmic search results from Google, Ask Jeeves, Yahoo and Lo mwsvm.exe SeekSeek search hijacker related - see here [path to worm] Added by the IXBOT-G WORM! MxHLp32.exe Added by a variant of the VAGRNOCKER TROJAN! MXOaldr.exe Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTou MXOALDR.EXE Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTou MxRunner.exe EasyUninstall from Aladdin Systems (formerly by Ontrack) msagent.exe Added by the NEGASMS.A TROJAN! SMSSvc.exe Added by the NEGASMS.A TROJAN! S4BAREQ.EXE MySearch parasite MyKey disgo.exe Related to disgo pro. Program will synchronize data tmp**.exe [* = random char/digit] My AccessMedia toolbar related, stealth installed! MyAgtTry.exe System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications [filename] Added by the FATEE.B WORM! service.exe Homepage hijacker avpguard.exe Added by the NETSKY.J WORM! myagtsvc.exe McAfee VirusScan ASaP Agent service MyAgtTry.exe System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications Splash.exe Splash screen for McAfee VirusScan ASaP on-line scanner MYCOME~1.EXE Comet Cursor adware MYDAIL~1.EXE MyDailyHoroscope foistware MyDailyHoroscope.exe MyDailyHoroscope foistware MYEMOTICONS.EXE MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail myfastupdate.exe My-Fast-Access toolbar updater huy.exe Added by the BLASTER-C WORM! huy2.exe Added by the BLASTER-L WORM! CmdServ.exe Added by the HOLAR.A WORM! nwclient.exe Sends your firewall alerts to a website, which then filters them and forwards details of suspicious activities to the host ISP they originated from. Only needs to be running when your firewall is running wjview ...MyPointsPointAlertrun.exeWith MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles. Dubious privacy policy mpk.exe MyPopupKiller - popup killer mpm.exe Reports battery status on a portable printer msvc32.exe Added by the FORBOT-EH WORM! winexplor.exe Browser hijacker, also detected as the STARTPA-JR TROJAN! Newsflsh.exe Runs in your task bar and receives alerts and release information on MySoftware products MyTekSystray.exe MyTek system tray - web site providing computer tech support in Australia mtsoemon.exe MyTotalSearchBar adware SysNT.exe ReferAd adware install.exe Detected as Generic Downloader.s by McAfee, probable variant of ReferAd adware! setup.exe Detected as Clicker.Win32.VB.kb TROJAN by Kaspersky Anti-Virus! File location is in the Root folder (C:), (D:), etc MyVirt.exe Added by the REMADM-C TROJAN! VtlAgent.exe MyVitalAgent from Lucent Technologies. Replacement for Net.Medic, monitoring all popular internet transactions and alerting the user of the loaction of connection problems. Available via Start -> Prog VtlAgent.exe MyVitalAgent from Lucent Technologies. Replacement for Net.Medic, monitoring all popular internet transactions and alerting the user of the location of connection problems. Available via Start -> Prog mwsoemon.exe My Way Search/My Web Search Toolbar - "browser search tool compatible with IE (4.x or above) and Netscape 4.x. The Toolbar displays algorithmic search results from Google, Ask Jeeves, Yahoo and Lo Net2fone.exe An Internet telephony application. Needed only if you have an account at Net2Phone, Inc NADAEMON.EXE Program by NetActive which appears to be piggybacked onto some Nvidia graphics cards software. They seem to look after "digital rights management". One user reports disabling it has no detrimenta nagger.exe Packard Bell Free Internet Signup screen EPOAgentnaimas32.exe Networked version of McAfee VirusScan. Installs, configures and updates the software and DAT (virus definition) files on local computers from a network server. A resource hog but required for DAT upd

Y Y X X X X X X X Y X X X X X X X X X X X X X X X N N U X X X X X Y X X U X X ? X X X X X X X X X N N N U U X ? X X ? N ? N X X ? X X X X X

Naimagent_UI EPOAgentnaimag32.exe Workstation background program for Network Associates' McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works w Naimagent_UI naimag32.exe Workstation background program for Network Associates' McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works w Name Iexplorer0.exe Added by the THREADSYS TROJAN! NAMEDPIPE SYSTEM namedpipe.exe Added by the MYTOB-FH TROJAN! nano svchost.exe Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon NAP32 NAP32.exe Premium rate adult content dialler Narrator ******.exe [* = random char] Added by the QOOLOGIC TROJAN! Natal Natal.scr Added by the OPASERV.AE WORM! NAV RuxDLL32.exe Added by the MAPSON.D WORM! NAV Agent navapw32.exe Norton Anti-Virus's background scanning process nAv AGENT N/A Added by the RIOSYS MACRO! Note the lower-case "n" and "v" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes NAV Agent systems.exe Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name NAV Agent winsnav.vbs Added by the ANPES WORM! NAV Agent wmilib32.exe Added by the VB-XU TROJAN! NAV Auto Prot navprot1.exe Added by the RBOT.ZAC WORM! NAV Auto Protect msfwe1.exe Added by a variant of the RBOT WORM! NAV Auto Protect navprotect.exe Added by a variant of the RBOT WORM! NAV Auto Protect dnsserv.exe Added by a variant of the SDBOT WORM! NAV Auto Protect mcafee32.exe Added by a variant of the SPYBOT WORM! NAV Auto Update Navautoupdate.exe Added by a variant of the SPYBOT WORM! NAV Auto Updates csrssp.exe Added by a variant of the SDBOT WORM! NAV Auto Updates navwindows.exe Added by a variant of the SDBOT WORM! NAV Auto Updates slserves.exe Added by a variant of the SDBOT WORM! NAV Auto Updates navupdaters.exe Added by the RBOT-UN WORM! NAV Auto Updates navupdaterx.exe Added by a variant of the RBOT WORM! NAV CfgWiz cfgwiz.exe Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it NAV Configuration Wizard cfgwiz.exe Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it NAV DefAlert DefAlert.exe Norton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis NAV Live Update [path to worm] Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec NAV Scan Service NAVSCAN32.EXE Added by the SDBOT.VG WORM! NavAgent32 lasvr32.exe Added by the FEMOT.D WORM! NavAgent32 SCardSvr32.Exe Added by the MOFEI.B WORM! navapp navapp.exe NavExcel adware variant navapw32 navapw32.exe Norton Anti-Virus's background scanning process NAVCheck navchk.exe Premium rate adult content dialer NAVCheck shman.exe Premium rate adult content dialer Naviscope naviscope.exe Naviscope is a multipurpose browser enhancement that can speed up Web searches, lock out cookies, examine HTML send/receive headers, provide single-click network diagnostics, and much more NaviSearch nls.exe NaviSearch, eXact Advertising variant navman_20 sysnav32.exe Hijacker, possibly a CoolWebSearch parasite variant NAVMD25 UpdtNv28.exe Added by Symantec for updating the MicroDefs for their AV products - is it required? navp.exe navp.exe Added by the AGOBOT-OE WORM! NavPass NavPass.exe Free system for gaining access to and downloading from adult content web-sites NavScan [filename] Added by the OBSORB TROJAN! NAVSCAN32.EXE NAVSCAN32.exe Added by the SDBOT-DO WORM! NAVSCANNER32 NAVSCANNER32.EXE Added by the RBOT.QC WORM! NAVUpd rundll32.exe navupd.dll, Startup Added by the NAVU TROJAN! NAV_Update NAV_Update.exe Unidentified WORM or TROJAN! nawadll32 nawadll32.exe Added by the SDBOT-ZI WORM! nawdll32 nawdll32.exe Added by the SDBOT-ZM WORM! NB Common Dialog Enhancements COMDLGEX.EXE Part of McAfee Nuts & Bolts. With Common Dialog Enhancements, you can add MRU list box to open dialogs NB Start Menu STARTM.EXE Part of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B NB Windows Patterns WINDBKGND.EXE Part of McAfee Nuts & Bolts. With Background Patterns, you can change background patterns of wizard and dialog windows NBJ NBJ.exe Ahead Nero BackItUp backup program. Only required for if you have scheduled back-ups NbkCtrl NbkCtrl.exe Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here NBT System alias [path] repcale.exe [path] beird.exeAdded by a variant of the RANDON.AN WORM! nbustrce1D nbustrce1D.exe Device driver, possibly CD/DVD - what exactly is it and is it required in startup? NC1565 winntsrv -l -p10001 -d -e cmd.exe -L Added by the NEWLEY-A WORM! Ncao osoa.exe PurityScan/Clickspring adware NCClient N/A ?? NCD ncd.exe Norton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path NCLAUNCH NCLAUNCH.Exe Part of SWF Studio from Northcode Inc - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP. Is it required? NCS_SS Csinsm32.exe Same as CleanSweep Smart Sweep-Internet Sweep NDAv csnss.exe Added by the SERFLOG.C WORM! NDAv svhost.exe Added by the SERFLOG.C WORM! NDDEAGNT NDDEAGNT.EXE WinNT default process. Network Dynamic Data Exchange (DDE) Agent, handles requests for network DDE services NDIS Adapter ndis.exe Added by the SDBOT.VF WORM! NDIS Adapter windows.exe Added by the FORBOT-BR WORM! NDIS Adapter lsass2.exe Added by the WOOTBOT.CW WORM! NDIS Adapter servenxpp.exe Added by the FORBOT-GP WORM! Ndpldaemon [path to trojan] Added by the RPCSDBOT-A TROJAN!

X X U X U N Y U ? X X N X X X U X U X N X X U U X X X N U X X X X X X U X X X X X ? ? U X U N X X X X X X X U U X N N X X U N N U X X X X U

NDplDeamon NDplDeamon NDPS NDrv NDSTray Necbar NECMFK Necutray neqprvfy.exe Nero Nero Checker Nero DriveSpeed Nero Updater.6.12 Nero.ma NeroAutoStartClient NeroCheck NeroCheck NeroFilterCheck NeroLoader NeroNETTrayIcon NeroUpdater6.8 Net Net Accelerator Net Activity Diagram NET Bios Stats Net**.exe [* = random char] Net**32.exe [* = random char] Net-It Launcher NetAccelerator NetAdm7 Netapi netapi32 NetApp Netbios Helper netconfig NetCruiser Dialer netdaemon netdll32 netdllex NetDy NETFP32.EXE netfxupdate NetFxUpdate_v1.0.3705 NetGuard nethost.exe Netlimiter Netline User NetLink NetLogon NetManagerService NetMeter NetMeter NetMon Netmonw netmsg NetPatrol netpc32.exe NetPerSec NetPumper NetReach Netropa Internet Receiver NetRun Netscape Messenger Netscp6 NetScreen-Remote NetService netservices netservices NETServices NetShow Powerpoint Helper

nstask32.exe winlogin.exe DPMW32.EXE NDrv.exe NDSTray.exe Necbar.exe necmfk.exe Necutray.exe neqprvfy.exe shch.exe nerocheck.exe DRIVESPEED.EXE wmp9.exe ***.exe [*** = 2 to 3 digits] NeroASM.exe nerocheck.exe regedit.exe NeroCheck.exe NeroLoader.exe NNServiceCtrl.exe winjava.exe WINREG.EXE NetAccelerator.exe nad.exe ntbstats.exe Net**.exe [* = random char] Net**32.exe [* = random char] NILaunch.exe NetAccel.exe NETADM7.EXE Netapi.exe netapi32.exe winserv.exe nbthlp.exe netconfig.exe NCDialer.exe netdaemon /v netdll32.exe netdllex.Exe VisualGuard.exe NETFP32.EXE netfxupdate.exe netfxupdate.exe NetGuard.exe [path to file] Netlimiter.exe netchk.exe netlink32.exe userint.exe ntss.exe NetMeter.exe NielsenOnline.exe netmon.exe Netmonw.exe netmsg.exe winclient.exe netpc32.exe NetPerSec.exe NetPumperIEProxy.exe nrcheck.exe Netropa.exe NetRun.exe NETSCAPE.EXE Netscp6.exe SafeCfg.exe ntsvc.exe recall.exe svchostn.exe csxrs.exe NSPPTHLP.EXE

Added by the RANDEX.E WORM! Added by the RANDEX.E WORM! Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature PurityScan/Clickspring adware ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for pe Nec Assistant; Ark's Navigator, a graphical interface for NEC computers NEC wireless keyboard driver Driver for external USB storage devices (hard drives, flsh disks, etc) Appears to be related to the downloading of some application - possibly verifying updates? Added by a variant of the EB TROJAN! Added by the PROXY-X TROJAN! Note - this is not related to "Nero Burning Rom" CD writing software Ahead Nero DriveSpeed - set the CD reading speed of a CD/DVD drive on-the-fly to reduce the noise on high-speed drives Added by the AGOBOT-AAG WORM! Added by the JONBARR.D WORM! Added by the AGOBOT.VG WORM! Associated with "Nero Burning Rom" CD writing software. Checks for driver issues Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD/DVD burning program. Also, it is not the valid Windows registry editor which resides in Windows or Winnt and will not figur Associated with "Nero Burning Rom" CD writing software. Checks for driver issues Added by the BANCBAN-EJ TROJAN! System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network Added by the AGOBOT.AMK WORM! Added by the ASSASIN.D TROJAN! Rizal NetAccelerator - "Optimizing Dial-Up, Lan, Cable, DSL, and Satellite connections do you want to speed up your Internet access up to 200% - 300% ???". Only required if you find it helps improve yo Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs Added by the SDBOT-ZX WORM! CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Net-It - web publishing software NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster, browse faster, surf faster!. Only require Added by the BANCOS.F TROJAN! Added by the NETDEVIL.14 TROJAN! Added by an unidentified TROJAN! Added by the SHADOWTHIEF TROJAN! Added by the BANKER.Y TROJAN! Added by the NETCONF TROJAN! NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected, dial and hangup at predefined times and auto Malware designed to "kill" a number of antispyware applications (SpyBot, Giant, SpyDoctor, SpySweeper, SpyHunter, Anvir, WinPatrol, and more) Added by the CRYPTER.A TROJAN! Added by the CRYPTER.A TROJAN! Added by the NETSKY.N or NETSKY.W WORMS! Added by the AGENT.CD TROJAN! Would appear to be a valid Microsoft .NET file (see here) but this suggest's it's a trojan? Would appear to be a valid Microsoft .NET file (see here) but this suggest's it's a trojan? FBM Software ZeroSpyware 2004 spyware detector and remover - real time monitor Added by the PERDA-J TROJAN! Netlimiter - "An internet traffic control tool to monitor applications which access the internet and actively control their internet traffic. Use it o set (download/upload) speed limits for applications or even Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game, for example Added by the GAOBOT.WO WORM! Added by the SDBOT-BC WORM! Added by the BESTPICS.A TROJAN! NetRatings Premeter spyware Appears to have possible Malware functions, for more information see here Added by the MIMAIL.M WORM! Added by the BDOOR-FX TROJAN! Net_Message is a small tool to send messages across the network, using the Windows Messenger Service, so there is no client install required to receive the messages. It has a number of other features NetPatrol network monitoring software Malware, probably a CoolWebSearch parasite variant NetPerSec - measures the real-time speed of your Internet connection NetPumper download manager - bundles Cydoor and SaveNow adware, see here Added by an unidentified VIRUS, WORM or TROJAN! Netropa Internet Receiver. Shows a scrolling bar with the news. Major resource hog and flagged as spyware NetRun - will 'RUN' a 'List' of programs only when a internet connection is detected, and close/kill the same 'List' when the connection is lost In Netscape 6 (I know for sure with 6.2.1, maybe with 6.0) Netscape.exe is the main executable file for Netscape Navigator, Netscape Mail and News, and Netscape Messenger (the new name for the em Netscape 6 NetScreen Remote VPN client software Added by the QQPASS-DU TROJAN! Added by a variant of the SDBOT WORM! Added by the SDBOT.GI WORM! Added by a variant of the SDBOT WORM! If disabled, user created fonts can no longer be seen by other programs

X N X U U X X X N X X X X U X X U X X X X X X X X X X X X X X X X X N X N X N X X X X X X ? N X X N X U U N U X N X X X X X X X U X N Y Y U

NetStart svchost.exe Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf NetStat Live Nsl.exe AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data netsv32 netsv32.exe Added by the SDBOT-PX WORM! NetTime NETTIME.EXE From a visitor - "This is the executable for NetTime. It is started from the registry when you check the box to start at startup. NetTime allows you to synchronize your computers' clock with a server on y NetTurbo netturbo.exe NetTurbo from SharewareOnline.com. "Accelerate Your Internet Connections by up to 600%". If you find it helps your connectivity leave it enabled Netunit32 wunit32.exe Added by an unidentified WORM or TROJAN! NETVISIONPasse-partout Passe-partout.exe Added by the DIALCAR-M DIALER! NetWatch32 netwatch.exe Added by the MIMAIL.C WORM! Netword Agent nwant33.exe An interesting browser utility that allows you to navigate by typing a single word or phrase (a "NetWord") related to what you're looking for into your browser's location field. It also puts an icon in the sy NetWork csrs.exe Added by the AGOBOT.JJ WORM! Network Access winssh.exe Added by a variant of the SDBOT WORM! Network Administration NAS.exe Added by the ANTILAM.20.Q TROJAN! Network Administration Service rsvc32.exe Added by the RBOT.ABH WORM! Network Associates Error ReportingTBMon.exe Service Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software Network Connections internat.exe Added by the ZD TROJAN! network device driver msfirewall.exe Added by the DELF-LB TROJAN! NetWork Device Switch NetDevSW.exe Toshiba laptops with built-in Wi-Fi. Allows switching between Wi-Fi and internal ethernet. Only necessary if you have regular need to switch back and forward between these network interfaces. Located Network Host Controller [path to trojan] Added by the WHISPER TROJAN! Network Host Service msmnart32.exe Added by the RBOT-CJV WORM! Network Host Service [random]32.exe Added by the RBOT-BAB WORM! Network Protocol Service wuamgrd.exe Added by the RBOT.EA WORM! Network protocol service wintcp.exe Added by a variant of the AGOBOT/GAOBOT WORM! Network Security secsvc.exe Added by the RBOT-ALX WORM! Network Security Guard **********.exe [* = random char] CoolWebSearch parasite variant Network Security Guard [path to trojan] Added by the COLEM-A TROJAN! Network Service svchost.exe Added by the STARTPA-CC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Network Service svhost.exe Added by the HACDEF-K TROJAN! Network Service Manager netsvc.exe Added by a variant of the AGOBOT/GAOBOT WORM! Network Service Manager netsvc.exe Added by a variant of the GAOBOT/AGOBOT WORM! NetworkAssociates Inc internet.exe Added by the LOVGATE WORM! NetworkClient NetworkClient.exe Added by the LEMUR WORM! NetworkKey netkey.exe Added by the IRCBOT-AJ TROJAN! Networks Configurator NetConfs.exe Added by the RBOT-OX WORM! Networks Controler Netsis.exe Added by the RBOT-NG WORM! NetworkSetup dlink.exe D-Link System Tray icon Netzip Smart Downloader npnzdad.exe Advertising spyware NetZIPFolders nzfprop.exe Netzip Classic zip file manager NeuroMedia(IESpeaker) NeuroMedia.exe Part of an older freeware version of IESpeaker - a program that allows you to listen to web pages. NeuroMedia.exe only downloads advertisments. Not included in the paid-for version currently available NeuroSpeech OESpeaker OEMonitor.exe Part of OESpeaker - a program that allows you to listen to long E-mails instead of reading them in Outlook Express. OEMonitor.exe checks whether OE is open or not New Csnm Manager csmn.exe Added by the SDBOT.BZS WORM! New.net rundll32.exe NewDotNetStartup Newdot~2.exe NewDotNet foistware New.net Startup rundll32 [path], NewDotNetStartup NewDotNet -s foistware NEWDOT~1 rundll32.exe NewDotNetStartup Newdot~2.exe NewDotNet foistware Newman playavi.exe Added by the LINEAGE-AT TROJAN! Note - This trojan file is found in the Windowsjava or Winntjava folder newname [path to trojan] Added by the DRSMARTL-S TROJAN! News Service ispnews.exe F-Secure antivirus related. However, is this particular item required? Newsalrt NEWSALRT.EXE MSNBC News system tray utility to alert you to new news Newsgroup lptt01 newsgroup.exe RapidBlaster variant (in a "newsgroup" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Newsgroup ml097e newsgroup.exe RapidBlaster variant (in a "newsgroup" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here NewsUpd newsupd.exe For Creative Soundblaster Live! series soundcards. System tray application for News updates. Available via Start -> Programs. Also spyware - see here. NewtonKnowsUpd NewtKnow.exe ...NewtnUpd.dll, runkey NewtonKnows hijacker NexusServer PNXSERVR.exe Related to ProCoder 2.0 from Canopus. "ProCoder 2.0 software combines speed and flexibility into a streamlined video conversion tool for professionals. Featuring, extensive input/output options, advan NFM Service NPDOR9x.exe Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required nForce Tray Options sstray.exe nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys NGClient ngctw32.exe Symantec Ghost Server software - needed for a "a Ghost multicast" (transfer images to multiple machines). Can be launched manually ngpw36 ngpw36.exe AdBlaster adware variant NGServer ngserver.exe Symantec/Norton Ghost Console service NI.UERSM_0001_N68M1602 UERSM_0001_N68M1602NetInstaller.exe Added by ErrorSafe - a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remo NI.UWAS6_0001_N68M2301 UWAS6_0001_N68M2301NetInstaller.exe WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here NI.UWFX5 UWFX5NetInstaller.exe WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here NI.UWFX5T UWFX5TNetInstaller.exe Added by the DOWNLDR-BO TROJAN! NI.UWFX5[various] [various filenames] WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here. Example filenames are UWFX5LP_0001_0802NetInsta NiceDownloads rundll32.exe MSA64CHK.dll, DllMostrar MatrixDialer related Nielsen NetRatings insight.exe NetRatings Premeter spyware NIHomeAM LiteClientAM.exe A managed web based internet security service that provides comprehensive & total protection for laptops/desktops - regardless of how, when or where they connect to the Internet. Made by Netintellig nikLaus nikLaus.exe Added by the NIKLAS WORM! NInit NInit.exe Norton Uninstall Deluxe. Monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging - not required nisserv NISSERV.EXE Norton Personal Firewall Nisum NISUM.EXE Norton Personal Firewall niSvcLoc niSvcLoc.exe Related to National Instruments Corp. LabView

X N N N X X ? X ? Y ? U X U X U U U U U X X U Y Y Y X ? X X N U U N U U X X X X X X X X X Y X X ? N N X Y X N X X X X N X X X X Y U U ? X X

NJG40 NJG40.EXE NkbMonitor NkbMonitor.exe NkvMon.exe NkvMon.exe NkVwMon.exe NkVwMon.exe NLS Keyboard keyboard.exe NLS Monitor nlsmon.exe NMBgMonitor NMBgMonitor.exe nmgr nnmgr.exe NMSSvc NMSSVC.EXE NMSVC nmSvc.exe nMTaskBarService nMtsk.exe NNLL nnll.exe nnqcouu nnqcouu.exe NNSvc nnsvc.exe No Credit Card plugin-[random].exe No-IP DUC DUC20.exe NoAds NoAds.exe NoAdware NoAdware.exe NoAdware3 NoAdware3.exe NoAdware4 NoAdware4.exe Nocana [path to worm] Nod32 Free antivirus nod32krn.exe Nod32CC nod32cc.exe NOD32kernel Nod32krn.exe nod32kui nod32kui.exe NOD32POP3 Pop3scan.exe Nod3d2 Free antivirus N0D32KRN.EXE NodeMnger Nodemngr.exe nodriver AUEKXRZ.EXE Noha aasd.exe Nokia Connection Monitor NclConf.exe Nokia Tray Application NclTray.exe NOMAD Detector ctnmrun.exe NomdCheck nomdchek.exe nomtray nomtray.exe Norman ZANDA ZLH.EXE NortE Antivirus norte.exe NortE Antivirus norten.exe norten Software Intrenet norten.pif Norton Antivirus nortonav.exe Norton Antivirus 2004 SYMANTECAV2.EXE Norton Antivirus 7.0a [path to file] Norton Antivirus AV FVProtect.exe Norton AntiVirus Sys NAVsys32.exe Norton Auto Protect nava.exe Norton Auto-Protect navapw32.exe Norton Auto-Protect ccApp.exe Norton Auto-Protect SERVICES.exe Norton AV Preload Premend.exe Norton Crashguard Monitor cgmenu.exe Norton Disk Doctor Ndd32.exe Norton Drive Protection msdt32.exe Norton eMail Protect POPROXY.EXE Norton Firewall [path to trojan] Norton Ghost 9.0 GhostTray.exe Norton Guard 32 ntguard32.exe Norton Live Update Server cpsdv.exe Norton Live Updater Cavapsvc.exe Norton Live Updater Sochost.exe Norton Navigator Loader nnloader.exe Norton Personal Firewall jah.exe Norton Personal Firewall npfw.exe Norton Personal Firewall lah.exe Norton Personal Firewall npfw32.exe Norton Personal Firewall IntroWiz.exe Norton Program Scheduler nsched32.exe Norton Program Scheduler NPSsvc.exe Norton Program Scheduler Event Checker npscheck.exe Norton Protect npprotect.exe Norton Protect Activies csrss.exe

Added by the BANCOS.D TROJAN! Part of Nikon PictureProject - image management for Nikon digital cameras Nikon View 5 - for transferring pictures from Nikon digital cameras Nikon View - for transferring pictures from Nikon digital cameras Added by a variant of the SPYBOT WORM! Added by the RBOT-AXJ WORM! Associated with the Nero digital media suite - what does it do and is it required? Added by the Adware.FFToolBar adware toolbar NIC Management Service - diagnostics program for Intel Pro family network cards Covenant Eyes - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Disabling it means loss of internet connectio Taskbar control for ISDN NetMod modem. What does it do and is it required? Net Nanny internet filter The Abi Network adware NetNanny internet filter Adult content pop-up dialler Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on co Blocks advertisement banners in Internet Explorer NoAdware - spyware remover. This version is not recommended - see here NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here Added by the ANACON-B WORM! Added by the RBOT-AAO WORM! Note - not the popular free Nod32 antivirus software, which shares the same filename Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button Nod32 Antivirus Version 2 Nod32 Antivirus Version 2 POP3 E-mail part of Eset's NOD32 virus-scanner Added by the RBOT-ABQ WORM! Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon? Added by a variant of the SPYBOT WORM! PurityScan/Clickspring adware Monitors the infrared port, the serial ports and the Bluetooth for a Nokia phone connection. It is installed by the Nokia PC Suite (and Nokia PC Connectivity SDK), and the tray icon shows if a phone has b Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." Synchronize the phone with, for example Outlook. You can also use it to browse your phone Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required Part of Intel's Native Audio System Tray access to NetMotion Wireless options - including connectivity status (see here) System Tray icon for Norman Antivirus Added by the RBOT.BQQ WORM! Added by the RBOT-AFF WORM! Added by the RBOT-AWA WORM! Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV! Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV! Added by the PERDA-B or RANCK-CT TROJANS! Added by the NETSKY.P WORM! Note - this is not the popular AV software! Added by a variant of the WOOTBOT WORM! Added by an unidentified WORM or TROJAN! Norton Anti-Virus's background scanning process Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is "navapexe". This is also not the valid Norton AV file with the same filename Added by the Ahker.B WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Norton Antivirus related. What does it do and is it required Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001 Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, checking for disk errors. Better than ScanDisk but can be started manually via Start -> Programs. Delete the shortcut in the Start Added by the FORBOT-GB WORM! Note - this not a valid Norton program! Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads t Added by the BANKER-ET TROJAN! Norton Ghost tray icon - the application can be launched manually Added by a variant of the RBOT WORM! Added by the AGOBOT.EW TROJAN! Added by the GAOBOT.AO WORM! Added by the GAOBOT.AO WORM! An older Norton utility for file management under Windows 95. More information here Added by a variant of the SDBOT WORM! Added by the RBOT-UI WORM! Added by a variant of the RBOT WORM! Added by the RBOT-UQ WORM! Part of Norton Personal Firewall or Norton Internet Security Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95, WinNT(?), Win2K(?)) to schedule automatic tasks such as Norton Anti-Virus scans Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95, WinNT(?), Win2K(?)) to schedule automatic tasks such as Norton Anti-Virus scans Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker Added by the RBOT-WW WORM! Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco

X X X N N X X X X X X X X X X X X X X X X U ? X X X X X X X X X X X X U ? U X X ? U ? X X X X X X X X U U X X X X X X U X N N X X X X X X X

Norton Service Driver Norton Service Process Norton SpySweeper AutoUpdate Norton System Doctor Norton SystemWorks Norton Update Norton Update Norton updated Norton Updater Norton Updater Norton Updater Norton Updater Norton Updater Norton Wizzard norton32 NortonAntivirus NortonAV nortonav Nortons AV SYSTEM nortonsantivirus NortonVPlus Notebook Maximizer NotebookManager NOTEPAD Notepad lptt01 Notepad ml097e notepad.exe notepad.exe notepad.exe notepad.exe notepad2.exe notes Notification Utility Notn Notn NovaBackup * Tray Control NovaPortal Single User Service NovastorSchedulerd NOYPI_KANG_ASTIG NPF Value NPFMonitor NPROTECT NPS Event Checker NS NSCheck nscntrl nsdcmd services nsdcmd vid process nsdlua nsdriver nse Nsengine NSHelper nssysconf nstat NSupdate Nsv nsvcin Nsvdr nsys nsys32 NSystemMonitor NT Kernel Patch NT Logging Service NT MICROSOFT SVCD NT security NT Service NT Services NT Virtual Machine Nt**.exe [* = random char]

wsul.exe navapvc.exe navsw.exe Sysdoc32.exe cfgwiz.exe ccUpdate.exe winsvc.exe NVSV32.EXE winset.exe lsa.exe NortonUpdate.exe ccUpdate.exe navupdtr.exe nwiz.exe norton32.exe LSASS.exe norton_antivirus.exe CCUPD32.EXE scvchost.exe ccEvtMngr.exe svchost.exe maximizer_startup.exe nbm.exe NOTEPAD.exe notepad.exe notepad.exe upx.exe msmsgs.exe msmsgs.exe msmsgs.exe popuper.exe notepaad.exe altpayV2.exe Eber.exe wtta.exe NbkCtrl.exe NPSU.exe SCHENGD.EXE Exit to DosPrompt.pif NPFMONTR.exe NPFMntor.exe nprotect.exe npscheck.exe ns.exe NSCHECK.EXE nscntrl.exe nsdcmdav.exe nsdcmdwin.exe nsdlua.exe nssys32.exe nse.exe Nsengine.exe aexnsinstallhelper.exe [random filename] netstat.exe NSupdate.exe nsvsvc.exe n20050308.exe nsvdr.exe nsys.exe nsys32.exe Symmon.exe ntkrnlpt.exe Syslog32.exe ntvsvcd.exe rundll32.com NTOKSRNL.EXE ntsvc.exe [path to file] Nt**.exe [* = random char]

Added by the RBOT-ABI WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the FORBOT-AS WORM! Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, major resource hog and best started manually form Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup fo Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it Added by a variant of the AGOBOT/GAOBOT WORM! Added by the AGOBOT.ALP WORM! Added by the SDBOT.ABH WORM! Added by a variant of the SPYBOT WORM! Added by a variant of the RBOT WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the SDBOT.AXV WORM! Added by the GAOBOT.ZX or GAOBOT.ADV WORMS! Note - this is not the valid nVidia application that shares the same name Added by an unidentified VIRUS, WORM or TROJAN! Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program Added by an unidentified WORM or TROJAN! Added by a variant of the RBOT WORM! Added by the HZDOOR-A TROJAN! Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency Associated with Acer notebook PCs. What does it do and is it required? Added as the result of the RUSTY VIRUS! Note - not to be confused with the valid Windows "NOTEPAD" text editor! This malware actually changes the default value data of the Registry "Run" key in orde RapidBlaster variant (in a "Notepad" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name RapidBlaster variant (in a "Notepad" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name Added by a variant of the AGENT.AH TROJAN! Added by a variant of the FAKESPY-B TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder, and should not be mistaken for the MSN Messenger file Added by the ZLOB-I TROJAN! Note - not be mistaken for the MSN Messenger file of the same name! Added by the ZLOB-I and ZLOB-H TROJANS! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Added by the PUPER-E TROJAN! Added by the RBOT.BME WORM! Reported by Ewido Security Suite as WeirWeb ADWARE! PurityScan/Clickspring adware PurityScan/Clickspring adware Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here. * represents the version number ?? NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it Added by the FILUKIN.A WORM! Added by a variant of the SPYBOT WORM! Norton AntiVirus Firewall Install Monitor. What does it do and is it required? Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid - see here Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker Added by the AGOBOT-HS WORM! MarketScore parasite - ActiveX control used to download premium-rate dialers Added by the DLOAD-DC TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! All-In-One Telcom - adult content dialler NetShagg adware Added by the AGOBOT-ML WORM! Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here Altiris Express Notification Server Install helper - monitors integrity of the installation Added by the VIVIA.A TROJAN! Adult content dialler Added by the Dial/Laet-B premium rate dialer! Delfin Promulgate adware Adware, probably VX2/Look2Me related Adult content dialler NetSpy keystroke logger/monitoring program - remove unless you installed it yourself! Added by the AGOBOT-SU WORM! Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging FaxServe network fax software Added by the DONK.B or DONK.C or DONK.L or DONK.M or DONK.O WORMS! Added by a variant of the RBOT WORM! Added by the RBOT-AJC WORM! Added by the RBOT-AAG WORM! Added by the AGOBOT.VJ WORM! Added by the SCAERBOT-A WORM! CoolWebSearch/HomeSearch adware - for examples, see this log

X X X X X X X X X X X X X Y X X X Y X N X Y N X X X X X X X X X X X X U X X X U X X Y X X X X ? ? X U X X X X X X X N U X X X X X X X X X X

Nt**32.exe [* = random char] NT-Virtual Device Manager Ntcheck NTCommLib3 ntddetect NTdhcp NTdhcp ntdll NTDLM Ntech.patchs ntechin nternet Explorer NTFS16 NTFSCLUP ntfsmonitorpro NTFSS Microsoft System NTFSS MICROSOFT SYSTEM ntl Netguard ntldr ntlfreedom NTP Server nTrayFw NTrtc NTSet32 NTSF Microsoft System NTSF MICROSOFT SYSTEM NTSF MICROSOFT SYSTEM NTSF MICROSOFT SYSTEM NTSF MICROSOFT SYSTEM NTSF MICROSOFT SYSTEM NTSF MICROSOFT SYSTEM ntsmod NTsocket NTsrv.exe Ntsysv nTune ntupd32 ntupdate NTupdater NTVDM ntvdmd ntvdscm NuTCSetupEnviron NvagNT nvc Win32 NvClipRsv NvClipRsv NVCLOCK NvColorInit NVCOM NvCpl NvCpl NvCpl NvCpl NvCpl NvCpl32Deamon NvCplD NvCplD NvCplDaemon NvCplDaemon NvCplDaemon NvCplDaemon32 NvCplDeamon NvCplDmn NvCplScan NvCplScan NvCplScan NvCplScan NvCplScan nvctrl.exe

Nt**32.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log ntvdmn.exe Added by the SDBOT-AAA WORM! mapserver.exe Added by the TOMPAI-B WORM! NTCommLib3.exe Admess adware variant ntddetect.exe Added by the AGENT-CU TROJAN! NTdhcp.exe Added by the QQROB-C TROJAN! CiKewl.exe Added by the QQROB-N TROJAN! ntdll.exe Added by the BIONET.404 TROJAN! csrss.exe Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/S [trojan filename] Added by the LEMIR.G TROJAN! n20050308.exe Adware, probably VX2/Look2Me related iexplore.exe Added by the FORBOT-CT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fi ntfs16.exe Added by the RBOT-LY WORM! NTFSCLUP.EXE Part of ConfigSafe- "checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiti ntfs64.exe Added by the FORBOT-EB WORM! filees.exe Added by the RBOT.GAB WORM! filess.exe Added by the RBOT.AXZ WORM! RPS.exe ntl Netguard - anti-virus a package of services, specifically designed to keep you safe and secure with their ntlworld online services ntldr.exe Browser hijacker to search-control.com (TrojanDropper.Win32.Small.ig). In addition to Registry changes found by HijackThis, also creates the following system files: C:WINDOWSSYSTEMntldr.exe, C:m.ex rundll32 [path] RyDial.dll, QuickStart NTL Freedom dial-up ISP software - not required [path to trojan] Added by the RANKY.F TROJAN! ntrayfw.exe Software interface for NVIDIA ActiveArmor - hardware firewall built into nVidia nForce motherboard chipsets ntrtc.exe Dell year 2000 tool to deal with non-standard applications. Only required on older Dell PCs that may need this support - see here services.exe Added by the WINSPY-C TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc fylez.exe Added by a variant of the RBOT WORM! wntsf.exe Added by the RBOT.ATC WORM! fufffy.exe Added by the RBOT-AEL WORM! ntssf.exe Added by a variant of the RBOT WORM! scvhost.exe Added by a variant of the RBOT WORM! winsis32.exe Added by a variant of the RBOT WORM! marya.exe Added by the RBOT-AXY WORM! ntsmod.exe Adware downloader/installer, probably VX2/Look2Me related - also detected as the WIN32.VB.RL TROJAN! NoeWinnt.exe Added by the ATAKA-E TROJAN! NTsrv.exe Added by a variant of the SERVU-O TROJAN! ntsysv.exe Added by the MIFENG-E TROJAN! nTune.exe nVidia nTune - motherboard monitoring and overclocking utility for nVidia nForce chipset based motherboards ntupd32.exe Unidentified adware/spyware dnsvc.exe Added by the SDBOT-TC WORM! [path to trojan] Added by the DIGARIX-D TROJAN! NTVDM.EXE Windows NT Virtual DOS Machine (NTVDM) for running 16-bit tasks on the 32-bit OS's (Windows NT, 2K and XP). Required if hardware on a machine with these OS's needs 16-bit DOS drivers. You can fin ntvdmd.exe Adware downloader - also detected as the DLOADER-YP TROJAN! ntvdscm.exe Added by the SCKEYLOG.O TROJAN! ncoeenv.exe Used by the MKS Toolkit for Enterprise Developers product. NuTCracker is a Unix runtime environment for Windows, so disabling this would be unwise if you are using NuTCracker or any 3rd party packa nvagNT.exe Added by the AGOBOT-RV WORM! nvcvc.exe Added by the RBOT-ADD WORM! svchost.exe Added by the DUMARU-K WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc swchost.exe Added by the DUMARU-AK WORM! rundll32 nvclock.dll, fnNvclock Overclocking utility for nVidia based graphics cards? rundll32.exe NvQtwk.dll, NvColorInit Associated with Nvidia based graphics cards NVCOM.exe Added by the AGOBOT-SB WORM! rundll32.exe NvCpl.dll, NvStartup Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card NvCpl.EXE Added by the YANZ.B WORM! [random filename] Added by the AGOBOT-APJ WORM! windowsp.exe Added by a variant of the SDBOT WORM! rundl32.exe Added by the AGOBOT-TO WORM! Note - the valid version of this entry has the command line as "rundll32.exe NvCpl.dll,NvStartup" nvcpl.exe Added by the RPCSDBOT.B WORM! m2gr32.exe Switch premium rate adult content dialler ntcpl.exe Switch adult content dialler rundll32.exe NvQtwk.dll, NvCplDaemon System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way y rundll32.exe NvCpl.dll, NvStartup Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card msmsgrs.exe Added by the DLOADER-YI TROJAN! anvshell32.exe Added by the XU TROJAN! nvdisp.exe Added by the PEEPVIE-I TROJAN! NAVSVC.EXE Added by an unidentified VIRUS, WORM or TROJAN! nvsc32.exe Added by a variant of the IRC.BOT TROJAN! msc32.exe Added by the FORBOT-DD WORM! winasp.exe Added by the FORBOT.BZ WORM! nvsc32.exe Added by the BROPIA.N WORM! kav32.exe Added by the FORBOT-EW WORM! nvctrl.exe Added by the ZLOB.G TROJAN!

X X X X X Y X X X X N U U X X X N X U X N X X Y N U N X X N N N ? X X X X N X X X X X ? N X Y U X Y ? Y U N U Y ? ? N N X X X X X X U X N U

nvd32 lptt01 nvd32 ml097e Nvid Nvid32 Nvidex32 NVIDIA ActiveArmor Nvidia Control Daemon Nvidia Control Panel NVIDIA Driver nVidia Drivers NVIDIA nForce APU1 Utilities NVIDIA nTune NVidia System Utility NVIDIA Video drivers NVIDIA Video drivers Nvidia32 NvidiaQuickTweak nvidll32 NVIEW nviload32 NvInitialize nvirundll nvjxue NVmax NVMCTRAY NvMediaCenter NVMixerTray nvmsgdwn nvpatch NVQuickTweak NVRaidService NVRT NVRTClk nvsv32.exe nvsv32.exe nvsv32.exe nvsv32.exe NvSvc nvsvc nvsvca32 NVSystem32 NvUpdater NvXplDeamon NWEReboot nwiz nwiz32 Nwpopup nwrecmsg nwss NWTRAY oadaemon oahstifr OAKSTART OAKTASK OASClnt Object Store Server objtjprx obsver OCAudioIni ocraware ocx32 OCXUPDT32 OD od-matrxx od-stndxx od-teenxx ODBC BackUp oddworldz.exe Odometer ODSPConfig

nvd32.exe RapidBlaster variant (in a "nvd32" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here nvd32.exe RapidBlaster variant (in a "nvd32" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here [8 random charachters] Unidentified adware Nvid32.exe Added by the GEMA TROJAN! Nvidex32.exe Added by the GEMA TROJAN! ntrayfw.exe Software interface for NVIDIA ActiveArmor - hardware firewall built into nVidia nForce motherboard chipsets nksvc32.exe Added by an unidentified WORM or TROJAN! ncsvc32.exe Added by an unidentified VIRUS, WORM or TROJAN! MSPMSPSU.EXE Added by the WOOTBOT.Y WORM! nVidiaDrvers.exe Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card NVATray.exe nVidia's nForce Audio Processing Unit (APU)- "provides 3D positional audio and DirectX 8.0 compatibility, and encodes and decodes Dolby Digital 5.1 audio in real time" nTune.exe nVidia nTune - motherboard monitoring and overclocking utility for nVidia nForce chipset based motherboards NVSystemUtility.exe NVidia System Utility lets you adjust bus speeds, hardware voltages, memory controller timings, and fan speed as well as additional settings to increase performance aggressiveness and hardware volta video_32D.exe Added by the AGOBOT.KV WORM! video_32sD.exe Added by the RBOT-BB WORM! nvidia32.exe CoolWebSearch parasite variant - also detected as the HOSTS-B TROJAN! rundll32.exe NvQtwk.dll, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, setting nvidll32.exe Added by the RBOT-XK WORM! rundll32.exe nview.dll, nViewLoadHook This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers nviload32.exe Added by the SDBOT-VT WORM! rundll32.exe NvQtwk.dll, NvXTInit Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled nvirundll.exe Added by the SPYBOT.NPS WORM! nvjxue.exe Added by the EYEVEG-J WORM! NVmax.exe NVmax is a old tweaking utility for NVidia graphics cards. In the startup list if the user chooses to overclock their card RUNDLL32.EXE ...NVMCTRAY.DLL, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, setting RunDLL32.exe NvMCTray.dll, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, setting NVMixerTray.exe System Tray access to audio controls from nVidia's motherboard ForceWare software NVMSGDWN.EXE Added by the GRABER-D TROJAN! napatch.exe Added by the SASSER-F WORM! rundll32.exe NvQtwk.dll, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, setting nvraidservice.exe nVidia NVRaid - hard disk striping/mirroring utility for increased performance and reliability. Doesn't seem to be required if you have a RAID setup as there is no performance difference without it nvrt.exe NVRefreshTool is a utility that will automatically detect the maximum refresh rate at each resolution that your monitor supports NVRTClk.exe Related to a Gigabyte video card. What does it do, and is it required? nvsv32.exe Added by the FORBOT-DI WORM! cstr.exe Added by a variant of the SDBOT WORM! asr_fnt.exe Added by the WOOTBOT.GE WORM! nvsv33.exe Added by the WOOTBOT.FP WORM! nvsvc.exe NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active, but no nvsvc.exe Added by the BANKER-HQ TROJAN! Note - this is not the valid NVIDIA Driver Helper Service and is located in the System (9x/Me) or System32 (NT/2K/XP) folder nvsvca32.exe Added by the TACTSLAY.E TROJAN! nvscv32.exe Added by the AGOBOT-NO WORM! nwiz32.exe Added by a variant of the RBOT WORM! xstyles.exe Added by the SMALL.AJ VIRUS! dummy.exe ?? nwiz.exe Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the o nwiz32.exe Added by the SINBANK-A TROJAN! Nwpopup.exe Broadcast message handler part of Novell Netware that displays server, printer and other messages nwrecmsg.exe Broadcast message handler part of Novell Netware that displays server, printer and other messages - can cause crashes Sp0.exe Added by the SpyOutside surveillance software. Uninstall this software unless you put it there yourself nwtray.exe Novell Netware. Displays the red "N" tray icon which can be disabled (by right-click on the icon) but is also needed by the client oadaemon.exe Background process that establishes connection with a C3-1000 scanner and watch general status of the device and for scanner button presses. Can it be started manually? oahstifr.exe Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K a OAKSTART.EXE Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. OAKTASK.EXE Taskbar utility for a "control panel" for a CD-RW oasclnt.exe McAfee VirusScan On-Access Scan Client service osserver.exe Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K a objtjprx.exe ?? obsver.exe Part of LingoWare translating software - what does it do and is it required? OCAudioIni.exe One-click Audio Converter - allows you to convert files of multiple audio formats right from Windows Explorer ocraware.exe Optical Character Recognition software as part of OmniPage Limited Edition - supplied with some scanners. Scan directly into most word processor applications, such as Word, WordPerfect, etc. Availabl ocx32.exe Added by the ASTEF or RESPAN WORMS! ocxupdt32.exe Added by the AGOBOT-IF WORM! SYSCNTR.EXE HotVideo dialler od-matrxx.exe Adult dialler - xx can be any number od-stndxx.exe Adult dialler - xx can be any number od-teenxx.exe Adult dialler - xx can be any number fdxxl.exe G Data "PC Spion" - monitoring and surveillance software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! oddworldz.exe Added by the MULTIDR-EG TROJAN! Odometer.EXE Mouse odometer - tracks how far your pointer/arrow has traveled on the screen. Shortcut available ODSPConfig.exe DsktopSurveil surveillance software - get rid of it unless you installed it yourself!

X X X N U U U ? U U N X Y X X U U N X N X X X X X Y X ? X X Y Y X X N Y N ? U X X X X X X U X X X N U N U U U U X N N N Y N N N N N N N X ?

Oeloader OEM Tools 32 OEM32 Tools OEMCLEANUP OEMRESET OEMRUNONCE oeplugin OEPowerPlugs oepsrv OESpamTest OEXCheck oe_drop_spam OE_OEM Offer Companion Offers Office Mail Office Mail Alerter Office Startup Office Startup Office Startup OfficeAgent OfficeAgent OfficeAgent OfficeAgent OfficeDeamon OfficeGuard RegChecker OfficeGuardUI officejet 6100 OfficeQuickAccess Offices OfficeScan95 OfficeScanNT Monitor OFFICEXP office_update OfotoNow USB Detection ogrc Oil Change OIM OKI LPR Utility OLE OLE Automation Server oleaccrc OLEDb Service olehelp OleLoader olesvr Olive System Olympic Omf4 OmgStartup OmniHTTPd OmniPage OmniPass OM_Monitor OM_Monitor On Screen Display once One Touch Monitor One Touch Monitor One Touch Monitor OneCareUI OneTouch Monitor OneTouchMonitor OneTouchMonitor OneTouchMonitor ONETOU~2 ONETOU~2 ONETOU~2 Onflow online cdrom

Oeloader.exe Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here tres32.exe Added by the RBOT.QB WORM! sres32.exe Added by a variant of the SPYBOT WORM! oemreset.exe Resets OEM installation settings at bootup. Not required unless you're new to PC's oemreset.exe Resets OEM installation settings at bootup. Not required unless you're new to PC's oemrun.exe Windows Millennium file - used by setup when installing the OEM 'express' version of the operating system. Uncheck after setup has finished bxOEPlugin.exe noHTML for Outlook Express is an add-on that protects Outlook Express from email viruses and email scripts by converting incoming email messages from HTML format to simple text winoeinit.exe ?? oepsrv.exe Outlook Express Protector is designed for controlling access to Outlook Express and its e-mail and address data bases OESpamTest.ExE Kaspersky Anti-Spam EA2Check.exe Express Assist from AJSystems.com. Utility for use with Outlook Express to backup, restore, synchronize amongst others oesrv.exe Added by DropSpam ADWARE! TMAS_OEMon.exe Related to Trend Micro PC-cillin - Internet Security 12 offers.exe Adware offers.exe Adware off_mail.exe Office Mail from Burrotech Ltd - "complete email solution for small/medium businesses, homes, schools and colleges. It is a small email server which forms the perfect gateway between your internal an om_Alerter.exe Office Mail Alerter - "alert Office Mail users when they receive new emails" via a System Tray icon Osa.exe Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without Exploer.exe Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries Osa9.exe Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without expIorer.exe Added by the TACTSLAY.A TROJAN! outIook.exe Added by the TACTSLAY.A TROJAN! svcrhost.exe Added by the TACTSLAY.A TROJAN! svcshost.exe Added by the TACTSLAY.A TROJAN! msorunner.exe Added by a variant of the TACTSLAY TROJAN! ogrc.exe Kaspersky Labs anti-virus svcss.exe Added by the DEDLER-C TROJAN! hposol08.exe Associated with a HP PSC2110 (and maybe others) all-in-one machine OfficeHost.vbs Added by the PEXMOR WORM! msnmgd32.exe Added by the FORBOT-DV WORM! pccwin97.exe Trend Micro antivirus OfficeScan pccntmon.exe Trend Micro OfficeScan Antivirus real-time scan monitor OFFICEXP.exe Added by the WOOTBOT.HE WORM! [path to trojan] Added by the DLOADER-ZB TROJAN! Rundll32.exe OFUSBS.DLL, WatchForConnection Autodetects when OfotoNow a digital camera is attached to a USB port and launches OfotoNow image software. Available via Start -> Programs ogrc.exe Kaspersky Labs anti-virus OCTray32.exe From CyberMedia/Network Associates. Checks for updates to software installed on your PC. Available via Start -> Programs oim.exe Related to the O2 (was "genie") mobile phone service. What does it do and is it required? okilpr.exe OKI printer utility [filename] Added by the STAWIN or TARNO.D TROJANS! ole32aut.vbe CoolWebSearch parasite variant oleaccrc.exe Adware downloader - recognized by Kaspersky antivirus as TrojanDownloader.Agent.am runoledb32.exe Added by a variant of the SPYRE.B TROJAN! olehelp.exe Added by the BOOKMARKER.D or BOOKMARKER.G TROJANS! ole32.exe Added by the DELF.BR TROJAN! olesvr.exe Salfeld Child Control 2003 - parental control software Szchost.exe Added by the MERCURYCAS.A TROJAN! IE4321.exe Adult content premium rate dialer - also detected as SMALL.CZ OMF4.EXE Added by the FREEMEGA TROJAN! omgstartup.exe Sony program called OpenMG Jukebox - player and music organizer ohttpd.exe OmniHTTPd web server from Omnicron Opware32.exe Part of OmniPage Pro from Scansoft (was Caere) - "the fastest, easiest way to turn paper documents into digital files you can edit." Opware32.exe links Word, via OLE, with OmniPage. If running, a user scureapp.exe OmniPass from Softex Inc. - secure password management software FirstStart.exe Olympus Master - digital camera management tools MONITOR.EXE Olympus Master - digital camera management tools OSD.EXE By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume, etc. Nice but n help.exe Identified as the DELF.LF by Ewido Security Suite OneTouchMonitor.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner 1tou~2.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner ONETOU~2.EXE For Visioneer OneTouch scanners. System tray access to the control panel for the scanner winssnotify.exe Related to Windows OneCare Live from Microsoft OneTouchMon.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner OneTouchMonitor.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner 1tou~2.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner ONETOU~2.EXE For Visioneer OneTouch scanners. System tray access to the control panel for the scanner OneTouchMonitor.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner 1tou~2.exe For Visioneer OneTouch scanners. System tray access to the control panel for the scanner ONETOU~2.EXE For Visioneer OneTouch scanners. System tray access to the control panel for the scanner onflow.exe Onflow is a internet company that offers an online advertising program. Not required - uninstall Active acid.exe ??

X U N X X X ? N U X X X X X X X X X N N U U N N U N X X U X X N X U U U N N N N X X X X ? X U U X X X U X X X X U X X X X X X X X X X Y X X

Online Service svchost.exe Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! OnlinePCfix SmoothSurfer SS.exe Smooth-Surfer - blocks banners, ads, popups, and cleans MRU and Recent file lists OnlineTime onlinetime.exe OnlineTimer - monitors your Windows dial-up network and logs the time you spend online as well as the resulting costs online_party online_party.exe Adult content dialler OnSrvr OnSrvr.exe OnWebMedia adware oo4 RunDLL32.EXE [path] oo4.dll, DllRun BookedSpace parasite OOLHELPT OOLHELPT.exe ?? OP12 Reminder Ereg.exe Registration reminder for OmniPage Pro 12 from ScanSoft OpAgent OpAgent.exe Part of Nuance (was Scansoft) OmniPage Pro document conversion software Open Service Drivers opiater.exe Added by a variant of the RBOT WORM! Open Site opnste.exe Adware - see here Open Site opensite.exe OpenSite adware Open2Enter runme.exe Adult content dialler Open2Enter runme2.exe Adult content dialler OpenGL Drivers 0penGLD.exe Added by the YIMP-A WORM! OpenMstart mcmgr32.exe Switch adult content dialler OpenMstart mmgr32.exe Switch adult content dialler OpenMstart Snt.exe Switch premium rate adult content dialler OpenOffice.org *.*.* quickstart.exe OpenOffice.org office suite quick start (where "*.*.*" is the version number) OpenOffice.org x QUICKS~1.EXE Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be sta openvpn-gui openvpn-gui.exe OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including remote access, site-to-site VPNs, WiFi security, and enterprise-scale remote access solutions Openwares LiveUpdate LiveUpdate.exe Web-update utility as used by various types of software - see here Operations Typhoon Rising Registration NOVG.EXE Joint Operations registration reminder Operator ?? Media Pilot operator, in Win.ini. Locks port open Operator xtmop.exe Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported OpiStat OPISTAT.EXE OpiStat is a European Research Institute whose goal is to understand consumer needs and opinions better OPQFile regedit.exe /s ...rad03FA6.tmp Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit opr opr.exe Added by MediaMotor ADWARE! OpScheduler OpScheduler.exe Part of Nuance (was Scansoft) OmniPage Pro document conversion software opsql update check opsql.exe Added by the RBOT-ACJ WORM! OPTIMIZER iexplore.exe Added by the EVEVINC TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure Optimum Online Netsurf.exe Optimum Online ISP software. Not required, just window dressing & advertising from Optimum Optional Web Drivers For WIN32 phqghume.exe Added by a variant of the RBOT WORM! OPTMOUSEMOUSE optmouse.exe Related to a Samsung optical mouse Optus Cable Data Monitor datamonitor.exe Allows Optus customers to monitor their actual data usage against Optus' "data allowance limits" OptusNetUsage OptusNet Usage Meter.exe Designed specifically for OptusNet users who wish to have their connection monitored on a frequent basis. It can also estimate when you are going to hit your usage limit, and how far over your suggest Opware12 Opware12.exe OmniPage Pro 12 from ScanSoft Opware14 Opware14.exe ScanSoft's OmniPage Pro 14 - If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are acce Opware15 Opware15.exe Nuance (was ScanSoft) OmniPage Pro 15 document conversion software. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OpwareSE2 OpwareSE2.exe ScanSoft's OmniPage_Pro_14 - If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are acce OrbitUpdate update.exe Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here OrbitView view.exe Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here orderShell order****.exe [* = random char] Added by the DLOADR-UN TROJAN! order_Shell order_smey.exe Added by the BANKSNIF-H TROJAN! org5.exe org5.exe Lotus Organizer 5 application file, Lotus Organizer software. What does it do and is it required? OrgyCam OrgyCam.exe Adult content dialler OrigRage128Tweaker RAGE128TWEAK.EXE Third party tweaker for ATI Rage 128 Video cards from http://www.rageunderground.com ORiNOCO Cmluc.exe Client Manager software for an ORiNOCO wireless LAN card OS Security mswind32.pif Added by the RBOT-ASU WORM! OSA winword.exe Added by the KANGAROO-A TROJAN! Osa32 NTOSA32.exe Added by the ANIG WORM! OSD OSD.exe By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume, etc. Nice but n OSS ossproxy.exe MarketScore parasite - ActiveX control used to download premium-rate dialers OSS rk.exe MarketScore parasite - ActiveX control used to download premium-rate dialers OSS rlvknlg.exe MarketScore parasite - ActiveX control used to download premium-rate dialers OSSProxy OSSPROXY.EXE MarketScore parasite - ActiveX control used to download premium-rate dialers OStivityInvAgt ostivity.exe OStivity - "a desktop and server hardware and software asset/inventory solution for small to enterprise sized organizations that need to quickly gain knowledge of 'what's installed' without having to ma Osus acao.exe PurityScan/Clickspring adware Osus rrup.exe PurityScan/Clickspring adware. The executable is located in the user's "Application Data" folder or the Program Fileshtwu folder otcx otcxxh.exe Added by the CAROOL TROJAN! outlook outlook.exe Added by the SDBOT-RU WORM! outlook outlook.exe Added by the ALCRA.F WORM! Note - this is not the valid MS Office program which is found in Program FilesMicrosoft OfficeOffice. This file is found in Program FilesOutlook Outlook Express Config *****.exe [* = random char] Added by a variant of the RBOT WORM! Outlook Express Protocol look.exe Added by the RBOT-ACS WORM! Outlook Mail Services express.exe Added by the RBOT.CJN WORM! Outlook Mail Services outlook.exe Added by the RBOT-BKA TROJAN! Note that the valid MS Outlook executeable is located in the Program FilesMicrosoft OfficeOffice directory wheras this one is found in the System (9x/Me) or System32 ( OutLooks InSane.exe Added by the SWOOP TROJAN! Outpost Firewall outpost.exe Outpost personal firewall outpostupdate outpostupdate.exe Added by the COSIAM-C TROJAN! Outwar syslaunch.exe Outwar adware downloader

? N X U U X X X ? N N X N X X X X X ? N U U X N ? N X X X N ? N N X N U U U Y Y U X X U X N N N X U U N X X ? X ? X Y Y Y Y Y Y Y X U U U U

OVCJ ovcj.exe Overnet Overnet.exe ovyriwi telace.exe OWCCardbusTray ocbtray.exe OWCWebCamDV wcdvtray.exe OWMngr OWMngr.exe oz2 oz2.exe P0w3rF1Y svchost.exe P17Helper Rundll32 P17.dll, P17Helper P2P NETWORKING P2P Networking.exe P2P Networking P2P P2P Networking2 P2P Networking2.exe P2P Networking3 P2P Networking3.exe p2pnetwork p2pnetwork.exe p2pnetworking p2pnetworking.exe P3p4chk P3p4chk.exe p4mx4 p4mx4.exe PaciSoft pacis.exe Packard Bell EverSafe Tray Control TrayControl.exe PadTouch PadExe.exe Pagekeeper Jobs pkjobs.exe Pagekeeper Lite pkjobs.exe PAgent PAgent.exe Pagis Scheduler Monitor.exe pagmstart client.exe Pagoo PAGOO.EXE paint.exe shnlog.exe PaintingRoom evidence monitor paintingroom.exe PaintingRoom smile monitor paintingroom.exe PAL Evidence Eliminator Cleaner.exe Palm MultiUser Config Configtool.exe Palm.exe Palm.exe palmOne Registration register.exe PalNetaware pnetaware.exe PaltalkNetaware.exe PALNETAW~1.EXE pamela.exe pamela.exe Panasonic Communications Utility Mfpscdl.exe Panda Antispam Server Service PasSrv.exe Panda Cleaner pavdr.exe Panda Preventium+ Service PREVSRV.EXE Panda Scheduler pavsched.exe Panda Software Intrenet panda.pif PandaAVEngine PandaAVEngine.exe PandaScheduler pavsched.exe Pantera pantera.exe Paperport runppdrv.exe PaperPort PTD pptd40nt.exe PaperQuote System Tray Icon PQTRAY.EXE Parallel Tasking ptask.exe PartSeal PartSeal.exe Password Door Loader PDMonitor.exe PasteLister plister.exe Patch patch.exe Patches Value WinGamed.exe Path lide.exe pathname pathname.exe PathNvidiaTV patchnvidiaTVout.exe PAV.EXE %Number% PAV.EXE PAV.EXE PAVFIRES PavFires.exe PAVFNSVR PavFnSvr.exe Pavkre9x pavkre9x.exe PavProc PavPrS9x.exe PavProt PavProt.exe Pavprot9 Pavprot9.exe PayTime paytime.exe pbagent pbagent.exe PBKScheduler PBKScheduler.exe PC Alert III alert.exe PC Booster pcbooster.exe

?? Overnet peer-to-peer (P2P) file sharing program Added by the SDBOT.BVS WORM! Icon in the system tray for safely removing PCMCIA cards. Only required if you have a laptop or desktop which includes a PCMCIA card interface WebCamDV from Orange Micro, Inc - enables the user to use a DV camera connected via Firewire as a Webcam OnWebMedia advertising foistware - see here for exactly what to look for Added by the MYDOOM.W WORM! Added by the MM TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/S ASIO driver for the Sound Blaster Audigy & Audigy 2 series sound card - is it required in startup? Peer to Peer (P2P) sharing of files on the internet Peer to Peer (P2P) sharing of files on the internet P2P Networking2.exe is an advertising program by Joltid. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising pop P2P Networking, a component bundled with Kazaa that enables other applications to use Peer-to-Peer functionality. Not required - see here Added by the ALCAN.A WORM! Added by the RBOT-AFL WORM! Added by the GEMA TROJAN! Added by the CRYPTER.A TROJAN! PacerD Media/Pacimedia.com adware installer Packard Bell EverSafe software. What does it do, and is it required? Toshiba Touch and Launch - offers easy movement and freedom of programs navigation with TouchPad PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bu PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bu Scans your hard drive for the popular P2P file-sharing applications BearShare, Grokster, Kazaa, Limewire and Morpheus. After searching the entire local filesystem for any files with those names it conne Scheduler for the Pagis scanning suite from Scansoft. Possibly related to this? Pagoo - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem Added by the PUPER-A TROJAN! Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you... Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you... PAL Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis MultiUser configuration for a Palm PDA device?. Is it required? Palm Desktop Software for use with Palm handheld devices. Available via Start -> Programs Registration reminder for Palm products PalTalk adware - as included in Morpheus, see here towards the bottom of the page Voice chat program. This program stores all buddy list info apparently on the server itself so you never lose your buddy list should you need to reinstall the program due for whatever reason or even ref Pamela is a plug-in or add-on that adds features to Skype peer to peer voice service Port manager for Panasonic Panafax fax_machines AntiSpam software, part of Panda Platinum Internet Security Panda Antivirus related - possibly Panda ActiveScan Panda Titanium Antivirus Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you te Added by the RBOT-ATZ WORM! Added by the NETSKY.R WORM! Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you te Added by the SDBOT.AYN WORM! Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here PaperPort software associated with scanners PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation Added by the SMALL-CJ TROJAN! System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the fac Password Door - password protection software PasteLister - clipboard extender. Start manually when required Added by the NETBUS WORM! Added by the SDBOT.BR WORM! ?? Added by the IRCCONTACT TROJAN! Appears to be related to Nvidia Gigabyte Video card. Typical file location is the Program FilesGigabyteNvidia folder Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number PER Antivirus Panda Antivirus Panda Titanium Antivirus Panda Titanium Antivirus Panda Titanium Antivirus Panda Titanium Antivirus Panda Titanium Antivirus Added by the STARTPA-YR TROJAN! Probot keystroke logger/monitoring program - remove unless you installed it yourself! Scheduler for CyberLink PowerBackup - archiving/backup utility MSI PC Alert III - allows you to view your system and cpu temperature, fan rpm and more. Only required if you overclock PC Booster from inKline Global - "easy-to-use computer system optimizer that gives your system the extra speed and stability you want while ensuring that your computer is kept clean and in tip-top co

U U X U Y Y U Y Y Y Y Y Y N X N N X ? U X ? U U X ? U X X N N N X N X Y U U U U X X U N ? U N N N U U U N X ? N U U X Y N X U X X X Y N X X

PC Dynamics SdwMon32 sdwmon32.exe SafeHouse "Personal Privacy" protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encrypted PC Spy Keylogger ToolKeylogger.exe PCSpyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! PC-Config32 corona.exe Added by the CORONEX.A WORM! pcAnywhere Agent pcamgt.exe Part of pcAnywhere 9.0 or later. This process listens for incoming PC Anywhere connections if your PC is configured as a PC Anywhere host PCBG PCBODYGUARD.EXE PC Bodyguard from Calluna - protects system files and settings from being deleted, modified, etc PCBODYGUARD PCBODYGUARD.EXE PC Bodyguard from Calluna - protects system files and settings from being deleted, modified, etc PcBoost PcBoost.exe PCBoost from PGWARE, LLC increases computer performance by allocating higher portions of CPU power to active applications and games PCCClient.exe PCCClient.exe PC-Cillin 2002 antivirus software pccguide.exe pccguide.exe PC-Cillin 2002 antivirus software PCCIOMON.EXE PCCIOMON.EXE PC-Cillin 2000 antivirus software. This is the actual virus-scanner PCClient.exe PCClient.exe Trend Micro PC-Cillin Internet Security PccPfw PccPfw.exe Trend Micro PC-Cillin personal firewall PcCtlCom Pcctlcom.exe Trend Micro PC-cillin Internet Security PCDRealtime realtime.exe Apparently the monitoring device for PC Doctor Online. It provides a "free" examination on system files (i.e. registry), reports the number of errors it finds, and invites you to "order" the fee-based fixes PcEXPLODE specialfile.exe Added by the RBOT.RH WORM! PCHbutton PCHbutton.exe Used by HP Instant Support PCHealth pchschd.exe This is a "scheduler" and does not turn off PC Health. For more information refer here PCHEasySearch STUpdate.exe PCH EasySearch bar PCIMODEM pcimodem.exe Associated with Lucent based Aztech MDP7800-U PCI modems. Is it required? PCLEPCI ppe.exe Pinnacle Systems PCI Performance Enhancer. "This tool helps to increase the PCI Busmaster performance of all Pinnacle PCI boards." PClK PClK.exe Added by the LEGMIR-BL TROJAN! PCMCIA Resource Monitor nvp2pmon.exe NVIDIA nForce P2P Driver. What does it do and is it required? PCMMRealtime pcmm.exe PC MightyMax - diagnostic program that identifies and fixes problems. However, some users report it does the opposite and messes up their systems (see here) and they also have problems removing it PCMService PCMService.exe Part of Cyberlink's Power Cinema. Commonly distributed with the Dell MultiMedia software suite. It is used to watch movies, play music and even watch TV in a central location PCprot crcss.exe Added by an unidentified WORM! pcqmqgn.exe pcqmqgn.exe ?? PCRecSA PCRecSA.exe Part of the IBM/XPoint Rapid Restore backup utility. If you choose, you can use it to create a "clean" backup of your hard drive. The process involves the software partitioning your hard drive, making a c pcServer server.exe Ssppyy spyware PCShield regsvr32 /s [path] sfg_****.dll [* = random SafeguardProtect/Veevo char] malware PCStart Pcm25.exe Runs as part of PCMonitor which is a program for monitoring your activity on your system. It makes screen dumps and key logging. It can hang-up your system because the screen dump page gets VERY PCSuiteTrayApplication TrayApplication.exe System Tray icon for Nokia PC Suite. PC Suite lets you synchronize, edit, and back up many of your phone's files on a compatible PC through a wireless or cable connection. PC Suite can also be launche PCSuiteTrayApplication LaunchApplication.exe System Tray icon for Nokia PC Suite. PC Suite lets you synchronize, edit, and back up many of your phone's files on a compatible PC through a wireless or cable connection. PC Suite can also be launche Pcsv pcsvc.exe Delfin Media Viewer or "Promulgate" adware PcSync PcSync.exe If a Nokia phone has been connected, synchronises the phone with MS Outlook or other organiser software. It is installed by the Nokia PC Suite, and the tray icon shows if a phone has been connected. A PcSync PcSync.exe Added by the RBOT-XJ WORM! Note - do not confuse with the Nokia application described here PCTAVApp PCTAV.exe Related to PC TOOLS Antivirus software PcThrust PcThrust.exe PCThrust from SwiftDog - "increases computer performance by allocating higher portions of CPU power to active applications and games" pctspk pctspk.exe Used for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use an PCTVOICE pctvoice.exe The program PCTVoice is used by the modem to interface with your computer and also used for some V.80 functions for Video Conferencing. if you uncheck it, it comes back. It's better to leave it PCWatch pcwatch.exe Added by PCWatch surveillance software. Uninstall this software if you did not install it yourself PDA Commander stisvc32.exe Added by the AGOBOT-TX WORM! PDASCAN pdascan.exe Added by the AGOBOT-QY WORM! PDEngine PDEngine.exe PerfectDisk from Raxco - disk defragmenter. Only required if you schedule disk defragmenting at re-boot pdexplo PDEXPLO.EXE PowerDesk Pro by Ontrack. Enhanced desktop and file manager. Available via Start -> Programs PDF Converter Registry Controller RegistryController.exe ScanSoft PDF_Converter related - what does it do and is it required? pdfFactory Dispatcher v2 fppdis2a.exe pdfFactory - create PDF documents from any program printing to the virtual PDF printer. Available via a desktop shortcut or Start -> Programs pdfFactory Pro Dispatcher v1 fppdis1.exe pdfFactory - create PDF documents from any program printing to the virtual PDF printer. Available via a desktop shortcut or Start -> Programs pdfSaver3 pdfSaver3.exe PDF-XChange - create Adobe compatible PDF files from virtually any Windows software such as MS Word, Excel, AutoCAD, MS Publisher etc PDirect PDirect.exe IBM Presentation Director software pdp Server ctpdpsrvr.exe Included and setup with the drivers for my Compaq A3000 all-in-one printer/scanner - maybe for networking. Works fine without it - but may be needed when used over a network PDService.exe pdservice.exe Related to Utimaco Safeware Easy. "Your electronic safe for protecting confidential data" PDVDServ PDVDServ.exe Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't ha Pe2ckfnt SE chkfont.exe Used to check whether the fonts are installed properly on your computer or not for a scanner. If you don't want to execute it, you can uncheck it in the startup menu PECarlin PECarlin.exe Adware - see here Peeramid PService.exe In a "Koptimizer" folder in Program Files. What does it do and is it required? PeerGuardian PeerGuardian_1.99b_pr14.exe PeerGuardian "is a tiny firewall program especially designed for P2P software users, but also for anyone who is concerned about the investigations that corporations and authorities perform on the inter PeerGuardian pg2.exe PeerGuardian - IP blocker for Windows. Used to protect privacy on P2P networks by blocking IP addresses specified in blocklists. Features support for multiple lists, a list editor, automatic blocklist updat Pent@VALUE 3.2 [email protected] Pent@VALUE Digital Satellite Internet PC Receiver PeqBL100 PEQBL100.exe Added by the ENVID.D WORM! PER Email Protection pavmail.exe PER Antivirus PerfectPrint pfppop70.exe Print engine used by Corel WordPerfect 7 and Presentations 7 PerfFont (Performance True Type Font) perfont.exe Added by the MUTECH-E TROJAN! perfmon perfmon.vbs MindStorm AnalyzerPro from Secure Associates. "A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices" Perfomance Monitor davcsync.exe Added by the LAMUD-A WORM! Perfomance Settings svchost.exe Added by the TOFGER-AP TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Performance MyHeart.exe Added by the PESIN-D WORM! PersFw PersFw.exe Kerio or Tiny Personal Firewall Persistence igfxpers.exe Associated with the Common User Interface module for Intel graphics cards Personal Computer scvhost.exe Added by the RBOT-AJE WORM! Personal Firwall ptmedsrv.exe Added by the SDBOT.XY WORM!

U U ? X U X X ? ? X Y U N X X N N X U N N X N N X N N N N X N U U X N X Y N X N N X X X U X X U U X U ? N U ? X X U ? X X U N X X X X X ? X

Pervasive.SQL Workgroup Engine W3dbsmgr.exe PestPatrol Control Center PPControl.exe PestPatrolCL PestPatrolCL.exe PestTrap PestTrap.exe Petit Larousse 2001 HIPL2000Popup.exe Pex Sound Driver Today's Results.vbs pex Sound driver 2 Today's Results.vbs PFW_CfgEngine PFWCFG~1.EXE PFW_PullSrv PULL.EXE PgMonitr PgMonitr.exe PGPSDKSVC pgpsdkserv.exe PGPSERVICE pgpservice.exe PGPtray pgptray.exe PGStub.exe [various filenames] pgtaff pgtaff.exe Phime2002a TINTSETP.EXE PHIME2002ASync TINTSETP.EXE PHIME2OO2ASyst [path to trojan] PhoneFree version 6.2 PHONEF??.EXE Photo Express Calendar Checker SECALCHECK.EXE Photo Loader supervisory Plauto.exe Photoshop svchost.exe PhotoShow Deluxe Media Manager mssysmgr.exe PhotoWise QuickLink quicklnk.exe PIC SYSTEM picx.exe Picasa Media Detector PicasaMediaDetector.exe PicasaNet Hello.exe Pickatag pickatag.exe PICPRTR PICPRTR.EXE picsvr picsvr.exe pictureBUZZTray swtray.exe PiDunHK PIDUNHK.EXE piiserviceOE N/A pilif pilif.exe Pinger pinger.exe PingTimeout Institution pingchek.exe PinnacleDriverCheck PSDrvCheck.exe Piolet piolet.exe PIPE SYSTEM pipe.exe Piracy SysUtil.exe PivotSoftware wpctrl.exe Pixel32 Pixel32.exe Pixelpwr32 Pixelpwr32.exe Pixelsvr Pixelsvr.exe pjWebCam pjWebCam.exe PK Guard pkguard32.exe PK Services pksvc.exe PktAnything PocketCompanion.exe Planlægningsagent mstask.exe Playboy playavi.exe PLEAPCPUCPL pleapu.exe PLFFAP HotfixQ0306270.exe Plguni Plguni.exe plmg.exe plmg.exe PLoader umsd.exe Plob kernel.com Plook plook.exe Pluck Tray PluckTray.exe PluckSvr PluckUpdater.exe Plug And Play msnmsg.exe Pluto! Pager srvhandle.exe PLXSTART PLXSTART.EXE PLXTASK PLXTASK.EXE pm32ctrl pwr32crtl.exe pm32info pm32info.exe pmc 764.exe pmcqt pmcqt.exe PMedia winsrvc.exe PmProxy PmProxy.exe pmr pmr.exe

Database Service Manager for Pervasive SQL 2000 Workgroup edition. Required if you use Pervasive SQL but it's recommended you start it manually before using it as it has a tendancy to crash/freeze PestPatrol Control Terminal - launches PestPatrol features such as PPMemCheck and CookiePatrol PestPatrol's command line scanner, combines with the Windows Task scheduler and is required in cases where schedules for regular scanning are set Spyware remover - not recommended, see here Popup dictionary tool Added by the TRODE-A WORM! Added by the TRODE-A WORM! Personal Firewall related? Personal Firewall related? Delfin Promulgate adware variant PGPsdkServ.exe is the new SDK service which is responsible for performing all PGP key management and cryptographic functions. This functionality was moved into a service to allow multiple modules s PGPservice.exe has two main purposes: (1) it handles a large part of the PGPnet functionality (along with the PGPnet driver) and (2) it allows efficient access to the PGP preferences database. The indivi PGP 7.x. Provides icon tray shortcuts to PGP programs from Network Associates. Available via Start -> Programs Unidentified adware AdRotator adware variant Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Added by the DBDOOR-B TROJAN! An Internet telephony application. Complicated registration and ad banners tailored to your profile - see here If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper, Photo Express will replace the wallpaper automatically. Photo Express 2.0 has a calendar checker which checks the date Casio's Photo Loader software. Hook up your camera to the USB port, and it pops up and asks you if you want to load your pictures Added by the CDOPEN-E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Simple Star PhotoShow Deluxe photo editing and organizing software, makes it easy to send and share digital photos. Bundled with software from Nero, ComCast, SnapFish, MacroMedia and others Agfa PhotoWise - "PhotoWise QuickLinkTM lets you drag and drop photos right from the camera into your document (applications must be OLE-compliant). Use PhotoWise to print contact sheets and pho Added by the MYTOB.LL WORM! Media detector for Picasa's automatic photo organizer Hello is an application that allows Blogger users to post digital photos and captions directly to their personal weblogs, or blogs Pick-a-tag - "Freeware utility for random selection of your taglines. This utility randomly picks a tagline out of a list of taglines. It will create a signature file which your mailer can use to place under your Program for viewing and measuring a variety of 3D CAD data formats Delfin Promulgate adware System Tray access to PictureBUZZ on-line printing software from Streetwise Software. If you use the software set the page you use as a favourite in your browser and run it manually Part of the Prodigy Internet software - part of the dialer/DUN. Presumably needed for users of that service otherwise you may not be able to connect, although you may try creating your own shortcut an Spam Inspector (nee Postal Inspector) from The Giant Company or iHateSpam from Sunbelt Software - spam filter add-ons for OE Added by the FILI WORM! Pinger is the resident program for Toshiba updates. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification Added by the SDBOT-VY WORM! Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Piolet - peer-to-peer file sharing client Added by the MYTOB-FF WORM! Software Piracy Alert feature bundled with PGWare software. Cries foul when it detects an 'illegal' version. The alerts are reported to disappear as soon as the software is correctly registered. There are PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Added by the GEMA TROJAN! Added by the GEMA TROJAN! Added by the GEMA TROJAN! Webcam automation software that saves regular photos from webcam and can also act as HTTP server Added by the GUAPIM WORM! Added by the FORBOT-BW WORM! PocketAnything lets you save anything on your computer to your mobile, with one click Windows Task Scheduler (on Danish language versions of Windows) - displayed as a box with a stopwatch in the System Tray. Required if you have regularly scheduled tasks like defragmenting, ScanDi Added by the GAMANLOCK TROJAN! CPU Control Panel for the Powerleap CPU upgrade Prolific Technology Inc. USB Flash Disk driver - is it required in startup? McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Paragon Last Minute Bidder - auction assistant software USB Mass Storage Disk related tray icon. Is it required? Added by the OPTIXPRO.12 TROJAN! AffiliateTarget.com alias PLook adware RSS (XML TAGS) reader program Pluck Toolbar updater Added by the RBOT-ID WORM! Added by the REDPLUT VIRUS! Sets the spindown timeout and access speeds at startup and displays the "Plextor Manager 2000" splash screen for Plextor CD-RW. Taskbar utility for a "control panel" for a Plextor CD-RW. Has MVP 2000 (audio CD player), DiscDupe 2000 (self explanatory CD copying program) and AudioCapture 2000 (rips audio CDs into MP3 or WA Added by the CRYPTER.A TROJAN! Added by the CRYPTER.A TROJAN! Adult content dialler Added by the DLUCA-V TROJAN! Internet marketing sofware from Permissioned Media Inc. as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM! Associated with Analog Devices "SoundMAX" audio chipset - often built-in to motherboards. What does it do and is it required? PowerStrip foistware

U N U N X X X U X X U X U X X U U X X X X X U U U U X Y X X U U U Y X U U X X X X N X U U U U X X X U U U U U U ? N U X U N Y X U N U X X Y

PMT personalmoneytree.exe According to the web site Personal Money Tree is an automatic cash rebate program. Note: Not recommended PMTSHOOT pmtshoot.exe MS tool for troubleshooting power management problems PMXInit pmxinit.exe Restores user display preferences Kyro2 based graphics cards. Not required unless you change the default settings - such as gamma PNAgent PNAgent.exe PhatNoise Music Manager - manages WMA, MP3, WAV, etc music files PNP wuaaclt.exe Added by the LILBRE-A WORM! PnP Driver playboy.exe Added by the FORBOT-FR WORM! PNP FIX [worm filename] Added by the RBOT-AKQ WORM! Pnpchk Pnpchk.exe Aztech Labs Sound 3 PnP driver pnpsvc_lock ******.exe [* = random digit] Browser hijacker pnpsvc_lock startsvs.exe Browser hijacker PNSetup PNSetup.exe PopNot - pop-up killer PNtask Services pntask.exe Added by the LALA.C TROJAN! Pocket Sheet Sync PSXLTRAY.EXE Casio Pocket Sheet synchronization software Poet Poet.exe Added by the DOEP.A WORM! Pofatch nstrue.exe Added by the RANDEX.Z WORM! point32 point32.exe Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features POINTER point32.exe Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Points Manager points manager.exe Altnet TopSearch adware Points Manager points manager.exe Altnet TopSearch adware Pollon pollone.exe Added by the SPYBOT.FW WORM! polo.exe polo.exe Added by the AGENT-PE TROJAN! POP PopSrv***.exe PeopleonPage foistware, bundled with Grokster where *** are random digits Pop-Up Smasher PopupSmasher.exe Pop-Up Smasher - pop-up killer Pop-Up Stopper dpps2.exe Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause pro Pop-Up_Blocker Popup.exe A Tweak-XP component, blocks advertisement pop-up windows in Internet Explorer. Can be enabled/disabled via Tweak-XP -> Internet Tweaks Pop-Up_Scanner Popupscn.exe Panicware popup blocker pop06ap pop06ap2.exe Added by MediaMotor ADWARE! pop3trap.exe pop3trap.exe PC-Cillin 2000 antivirus software -> E-mail scanner PopeSvr PopeSvr.exe Added by the LEGMIR-AJ TROJAN! PopMark WinTask.exe Pop Marketing adware PopNot PopNot.exe PopNot - pop-up killer PopOops PopOops.exe PopOops - pop-up killer Popopen popopen.exe PopOpen makes your windows spring open with animation effects Poproxy POPROXY.EXE Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads t popsrv146 popsrv146.exe AproposMedia adware PopSubtract PopSub.exe PopSubtract - pop-up killer Popup Ad Filter PopFilter.exe Popup Ad Filter - pop-up killer Popup Blocker System PopUpBlocker.exe Added by a variant of the RBOT WORM! Popup Blocker System326a Monitoring PopUpBlocker6a.exe Added by the RBOT.AUH WORM! Popup Blocker System8 Monitoring PopUpBlocker8.exe Added by a variant of the RBOT WORM! Popup Blocker Updater regsvr32 veev****.dll [**** = random SafeguardProtect/Veevo char] hijacker PopUp Buster+ popupbuster.exe PopUp Buster - free Pop-up blocker Popup Defence Updater regsvr32 /s [path] pdf****.dll [* = random SafeguardProtect/Veevo char/digit] hijacker Popup Defender PD.exe Popup Defender - pop-up killer Popup Terminator GLADManager.exe Popup Terminator - pop-up killer PopupEliminator Popup Eliminator.exe Popup Eliminator - pop-up killer PopUpKiller PopUpKiller.exe PopUpKiller - pop-up killer popuppers newpop63.exe Added by Medload ADWARE! popuppers64 a64sddd.exe Popuppers adware, also detected as the LOWZONE-AA TROJAN! popuppers65 [path to file] Added by Medload ADWARE! PopUpStopperCompanion PSComp.exe PopupStopper Companion popup blocker PopUpStopperFreeEdition PSFREE.EXE Panicware's Pop-Up Stopper - free limited features version PopUpStopperProfessional PopUpStopperProfessional.exe Panicware's Pop-Up Stopper - paid for version PopupVanish PopupVanish.exe Pop-up blocker PopUpWasher PopUpWasher.exe PopUpWasher pop-up killer PopUpWatch PopUpWatch.exe Part of BPS Trace Remover - made by the folks who "developed" BPS Spyware Remover which reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! POS-Partnerbatchprocessor BATCH.EXE VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut? Post-It(r) Software Psnotes.exe Pop-up "yellow" notes on screen. Available via Start -> Programs POW! pow.exe Pop-up killer Power Scan powerscan.exe Foistware by Integrated Search Technologies - the people behind ISTBaradware Power2GoExpress Power2GoExpress.exe Power2GoExpress - all media disc burning software PowerBar Powerbar.exe Part of Cyberlink's PowerDVD software. Not sure what exactly it does, but not required in startup PowerChute Pwrchute.exe During a power outage, if you're not available to save your files & close down Windows....PowerChute will do that for you. PowerChute will save your application files, close your applications and shut do PowerChute Pwrchute.exe Added by the LAZAR-A TROJAN! Note - this is located in the Program FilesAPC_Power directory PowerDOCSAPIHost papihost.exe Hummingbird PowerDOCS - "delivers powerful enterprise document management functionality via a tightly integrated Microsoft WinNT/98/2K environment" PowerDVD PowerDVD.exe Launches Cyberlink's PowerDVD software and creates a system tray icon. If enabled, PowerDVD will open automatically when a DVD movie is inserted. Launch manually PowerKey PowerKey.exe Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 PowerManagement Rundlll.exe Added by the SURDUX TROJAN! PowerManager Svchost.exe Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ PowerPanel POWPANEL.EXE Power management utility on notebooks/laptops - automatically switches modes when running on battery

X U X X N N N N ? ? ? N N U U U U N U Y Y N U U U U U X N ? U N U N X U U U X ? N X X X Y ? X X X Y Y Y X N ? U ? X N N X X X X X X X X X N

PowerPrifile PowerPro PowerProf PowerProfile PowerQuest Startup Utility PowerReg Scheduler PowerReg SchedulerV2 PowerReg SchedulerV3 POWERR~1 PowerS PowerSet PowerStrip PowerStrip PowerTools Tray Icon Powertweak Powertweak Power_Gear PP****usb PP2000 Instaupdate PP2000 Real Time Scan PP2000 Taskbar Control PP3100b ppass PPControl PPHIDPAD PPK Setup(Server) PPMemCheck PPPOEO PProTray PPScheduler PPSVC pptd40nt PPUpdate PPWWebCap pqhelper PractiSearch Praize Messenger Prayer prdtect PreAnnotate Precision Time Clock Checker PrecisionTime precpop2 Prein Preload PreloadApp Premeter Premeter Preview AdService PrevxHome PrevxOne PrevxPro prgtect Price Patrol PrimaLauncher Primax 3D Mouse Primsta Print Driver Helper Service Print Master Event Reminder Print Screen Deluxe Print Services print sharing print sharing Print Spooler Print Spooler Print Spooler Print Spooler Print Spooler Printer Printer

rundl132 kenel.dll, PowerProfileEnable Added by the INMOTA WORM! powerpro.exe Part of the power professional program that loads the floating menu bar. Can be accessed from Start -> Programs, but I'd leave it alone if you use this program PowerProf.exe Added by the LOREX.B TROJAN! mfcp30.exe Added by the RINDAS-A TROJAN! PQINIT.EXE From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set PowerReg Scheduler.exe PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others PowerReg SchedulerV2.exe PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others PowerReg SchedulerV3.exe PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others POWERR~1.exe Power monitoring? PowerS.exe ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required? Regedit.exe /s ...PowerSet_8100_CU.REG Appears to be Toshiba power management related powerstrip.exe PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings PSTRIP.EXE PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings pttray.exe PowerTools - add-on for AOL PT2.EXE Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the s PTCTRL.EXE Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the s BatteryLife.exe Power management for all Asus notebook. Useful but not critical FBDirect.exe Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort De PPInupdt.exe Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually PPVstop.exe Protector Plus anti-virus software - real time scanner PPTbc.exe Protector Plus anti-virus software - system tray access flatbed.exe Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop Antispy.exe AntiSpy firewall - "program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide" PPControl.exe PestPatrol Control Terminal - launches PestPatrol features such as PPMemCheck and CookiePatrol pphidpad.exe PenPower Chinese handwriting recognition software SEServe.exe Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button, collect your e-mail automatically with one key stroke. You can also program your PPK to turn on your ppmemcheck.exe PPMemCheck - "extends PestPatrol's power so that the most dangerous Pests -- those that are about to execute -- are found, terminated, and cleaned from a user's system" pingppac.exe Added by the SPYBOT.KHC WORM! pprotray.exe Part of the power professional program. Loads the System Tray control PPScheduler.exe ScanSoft PaperPort Scheduler - what does it do and is it required? [path to file] PC Police is surveillance software that logs keystrokes, files looked at, applications used, and chats on either MSN, Yahoo, ICQ or AOL. This information can then be transmitted to a remote user. If you d pptd40nt.exe PaperPort software associated with scanners ppupdater.exe PPUpdater - "is the update program that ships with PestPatrol. It is able to update licensed and evaluation versions, and presents a visual display of what it is doing". Run manually unless you think you' PPWebCap.exe PaperPort software associated with scanners pqhelper.exe Searchcentrix hijacker PSearch.exe PractiSearch web search software itLoad.exe Praize IM Christian chat instant messenger PTW.EXE Islamic Adhan program (call fpr daily prayers) prdtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec PreAnntt.exe Genius Wizard Pen Tablet driver related. Is it required? PrecisionTime.exe Precision Time 2.0. Checks your computer clock time against the Naval Observatory or some other source to assure accurate time PrecisionTime.exe PrecisionTime - clock synchronizing software containg spyware by Claria/GAIN starter.exe PrecisionPop adware APP****.tmp [* = random char or digit] Unidentified adware Preload.exe Millenium Multi-Function Keyboard driver hphprld.exe HP PhotoSmart printers related. What does it do and is it required? nrpr.exe NetRatings Premeter spyware prmt.exe NetRatings Premeter spyware PrevAdServ.exe Windupdates adware variant SAGUI.exe PrevX Home intrusion prevention software PXConsole.exe Prevx intrusion prevention software SAGUI.exe PrevX Home intrusion prevention software prgtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prxte neo.exe Price Patrol by Half.com - internet shopping companion for finding the best on-line prices Launcher.exe Associated with PrimaScan scanners. Is it required? 3dmoused.exe Enables the scroll button on the Primax 3-D Scroll mouse Primsta.exe Linksys Wireless CompactFlash Card driver related. Is it required? crsrr.exe Added by the AGENT-BC TROJAN! PMremind.exe Print Master Gold - calander feature that pops up reminders, such as birthdays psdeluxe.exe Utility allows "Print Scrn" or "Print Screen" key to capture, print or save the current window spolserv32.exe Added by the RBOT.ZP WORM! start.bat Added by the ZCREW TROJAN! [path] hidden32.exe [path] explorer.exe Added by the ZCREW.B TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it Spoolsv.exe Added by the CIADOOR.B TROJAN! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file spoolsvc32.exe Added by the SDBOT.BB TROJAN! spools.exe Added by the RBOT-LD WORM! spool.exe Added by the IS TROJAN! spoolsv32.exe Added by the RBOT.SW WORM! Spyassault.exe Spyware remover - not recommended, see here [path to file] Added by the LOWTAPER TROJAN!

X U N X X X X X ? X X N X N N N N X U N U X X U X X X X X X U X X U ? X X X U U X N N X N X X X X X X U ? N N X N U U U X X U X X X X X X X

Printer printer printer Printer Monitor Printer Spool Printer spool Service printer spooler Printer Spooler Subsystem Printer Update PrinterSpool Printing Driver Printkey2000 PrintMngr printnow PrinTray PrintScreen Printscreen 95 PrintSpoolSv PRISMSTA.EXE Privacy Eraser Pro PrivacyKeyboard PrivacyScanner PrivateNet Privoxy PrizeSurfer prjtect prktect prltect prmt prmtect PrnSys Executable pro pro Pro PCL Status Monitor ProArt Proc992 Proc993 process.exe ProcessGovernor ProcessSupervisorGUI procmon ProdikeysAutorun ProDsl Profile Profiler profiler profiler Prog Prog Program File Program in Windows Program Neighborhood Agent ProgramWindow projselector Promon.exe PromulGate PRONoMgr.exe PRONoMgrWired Propel Accelerator ProPort Startup ProSiteFinder Proteção de tela Protect protect Protected Storage Protection Protection Protection Protection Protection

dipset.exe Added by a variant of the FBSR TROJAN! SpyAssaultScanner.exe SpyAssault keystroke logger/monitoring program - remove unless you installed it yourself! SpyAssaultScanner.exe Spyware remover - not recommended, see here webprinter.exe Added by the IRCBOT-Z TROJAN! updater.exe Added by a variant of the RBOT WORM! spool.exe Added by the RBOT-ACP WORM! commonaccess.exe Added by the DELF-LB TROJAN! spoolss.exe Added by a variant of the RBOT WORM! - Note - this is NOT the legitimate Windows spoolss.exe process, located in the Winnt/System32 or WindowsSystem32 folder, and which should NOT figure in Msc CFGREG.EXE Maybe a registration reminder or automatically updates drivers or application software for a printer? [path] RESTORE.EXE [path] SPOOL.EXE Added by the ALADINZ.K TROJAN! msprint.exe Added by the RBOT.JH WORM! printkey2000.exe Screen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required system.exe Added by an unidentified TROJAN! printnow.exe PrintNow - a utility that primarily allows "Print Srceen" or "Alt+Print Screen" screenshots to be sent directly to a printer Printray.exe Lexmark/Compaq printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. See also LexmarkPrintray and CompaqPrinTray UNWISE.EXE Gadwin PrintScreen - utility to capture, print or save the current window PRT95MIN.EXE Printscreen 95 - utility to capture, print or save the current window System.exe Added by the BDOOR-S TROJAN! PRISMSTA.EXE Creates a system tray icon for accessing information about Intersil Prism Wireless Settings. Intersil silicon is used by Trendware/Trendnet for example PrivacyEraser.exe Privacy Eraser Pro - protects your Internet privacy by cleaning up all Internet history tracks and past computer activities PrivacyKeyboard.exe PrivacyKeyboard is a product "that can provide every computer with strong protection against ALL types of keylogging programs and keylogging hardware devices, both known and unknown, currently i pscan.exe Privacy Champion, a stealth installed 'Privacy Scanner'. It purportedly scans your PC for links to adult content websites, and then offers to "clean" them. Produces loads of False Positives as goad to purc [various filenames] Premium rate adult content dialler privoxy.exe Privoxy - web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxiou prizesurfer.exe PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online! Stealth installed malware prjtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prktect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prltect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prmt.exe NetRatings Premeter spyware prmtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prxte PrnSys.exe Print screen utility bundled with some HP printer software - not required, but your choice if you like that feature [path to file] Added by the SPYWAD-F TROJAN! SpySheriff.exe Added by the SPYWAD-I TROJAN! PENGSS.EXE Xerox printer/fax/copier status monitor (PCL = printer control language) ProArt.exe ?? [path to file] Added by the IXBOT-C WORM! wqxfne.exe Added by the IXBOT-D WORM! process.exe Added by the BANCOS.P TROJAN! processgovernor.exe Process Supervisor "is a technology designed to automatically configure and manage processes on one or more computers for the goal of maintaining system stability and responsiveness, restricting ex ProcessSupervisor.exe Process Supervisor "is a technology designed to automatically configure and manage processes on one or more computers for the goal of maintaining system stability and responsiveness, restricting ex procmon.exe Added by the BIONET.40A TROJAN! Prodload.exe Creative Prodikeys software. "an interactive music entertainment device which not only functions as a full-featured, ergonomic "QWERTY" keyboard but also comes equipped with 37 touch-sensitive mu ProDsl.exe Intel Pro/DSL 2100 modem connection manager. Available via Start -> Programs Profile.vbs Added by the WHITEHO VIRUS or TRAPPY WORM! Profiler.exe Enables the "Profiler" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs liteout.exe Added by the ZAPCHAS-G WORM! prof.exe Added by the ZAPCHAS-G WORM! csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Progmon.exe Added by the PEEPER TROJAN! iexplore.exe Added by the LOVGATE-W WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally f pnagent.exe Citrix Program Neighborhood Agent more comp.exe ?? projselector.exe Roxio Project Selector - can be started manually promon.exe System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features PgMonitr.exe Delfin Promulgate adware variant PRONoMgr.exe System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features PRONoMgr.exe Intel's Pro 100 Ethernet card manager PropelAC.exe Propel Internet Accelerator ProPort.exe Proport is a port monitor/protector. Monitors an infinite amount of ports for trojans and nukes. Some additional features are auto connection-kill, and IP resolving prositefinder.exe 180Solutions adware ssmaze.scr Added by the BANCBAN-FB TROJAN! SHVRTF.EXE PC Angel takes a 5-second snapshot of the current system registry each time the PC boots up. In the event of a crash, PC ANGEL will retrieve everything up to the minute before the crash or the last kno protect.scr Added by the DLOADER-TQ TROJAN! RUNDLL32.EXE MSSIGN30.DLL ondll_reg Added by the LOVGATE-W WORM! [path] runtask.exe [path] protection.exe Added by a variant of the AGENT.3.AU TROJAN! Protection.exe Added by the FEBELNECK-A WORM! Firewall.exe Added by the ELIPTER.A WORM! IExplore .exe Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the ".exe" Norton Internet Security.exe Added by the ELITPER.E WORM!

X X X N N U U X X X X X X X X X X X X X X X U X X Y X U X X Y N U U Y X X Y U U ? N ? U X U U N U N U X U N U X N N N X X X U N U X X X Y Y

ProtocolDiskChk ProtocolEventTsk Provan Security PROXOMITRON PROXOMITRON ProxyWay PRPCMonitor prrtect prstect prtcct prttect prutcct prutdct prutgct pruthct prutict prutlct prutpct prutsct prvtect prxtect ps1 PS2 psaload32 PSD Tools Channel PSDrvCheck PService PSFree PSGuard pshower PSIMSVC PSIWin2.3 Connection Server pskl PsMFCard PSNotify PSof1 PSoft1 PsPCCard PspContr PsSound PSTORES ptfb Ptipbmf PtiuPbmd PTRGMYGK ptrun32 PTRUN32 Ptsnoop pttrun PtUDFApp PUAC v2.0.7 Public Microsoft ODBC pumcfgp Pure Networks Port Magic Purgative Purgatory Push Client Push The Freakin' Button PUSH6599 PutA!! PutAS! putil PV92TRAY PVR PVUnInst1 Pwr32ctr Pwr32ctrl Pwr32mgt PWRMGRTR Pwrmonit

ssrms.exe Added by the ML TROJAN! csrwjd.exe Added by STINX-N TROJAN! psecure.exe Added by the RBOT.BRV WORM! PROXOMITRON.EXE HTML proxy PROXOM~1.EXE HTML proxy proxyway.exe ProxyWay anonymous proxy surfing software PRPCUI.exe Intel(r) SpeedStep(tm) interface. This automatically detects whether a mobile PC is using battery or AC power. When using battery power, SpeedStep scales the processor clock frequency and voltage to prrtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prstect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prtcct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prttect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prxte prutcct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prutdct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prutgct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec pruthct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prutict.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prutlct.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttec prutpct.exe Prutect malware from e2Give - attempts to tamper with a number of anti-spyware applications, like Ad-Aware and SpyBot S&D. Note - routinely uses alternative file names like prdtect.exe, prtcct.exe an prutsct.exe Prutect malware from e2Give - attempts to tamper with a number of anti-spyware applications, like Ad-Aware and SpyBot S&D. Note - routinely uses alternative file names like prdtect.exe, prtcct.exe an prvtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prdte prxtect.exe Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prdte ps1.exe PacerD Media/Pacimedia.com adware ps2.exe Multimedia Keyboard companion on HP computers. If this is prevented from starting, then some keyboard functionality will be lost. psaload32.exe Added by the RBOT-ADL WORM! ChannelUp.exe BuddyLinks adware PSDrvCheck.exe Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled svcnow32.exe Added by the SPYBOT-DJ TROJAN! PSFree.exe Pop-Up Stopper Free from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems PSGuard.exe Variant of the SmitFraud alias FAKEALE-C TROJAN! pshwr.exe SafeSurfing adware variant PSIMSVC.exe Panda Titanium Antivirus Psconsv.exe Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs keyspy.exe KeyboardLogger keystroke logger/monitoring program - remove unless you installed it yourself! PsMFCard.exe Component of the Toshiba Controls. Provides power-saving functions for the PCMCIA slots. Through the Power Save Mode Properties dialogue, the user can select from 3 PCMCIA power options - On, Aut psnotify.exe Pharos SignUp Vx - "PC reservation and management application that addresses the PC scheduling needs of public libraries and higher education labs and libraries" PSof1.exe PacerD Media/Pacimedia.com adware installer psoft1.exe PacerD Media/Pacimedia.com adware installer PsPCCard.EXE Background Power Saving task found on Toshiba laptops and which handles turning Power Saving ON and OFF on any inserted PC Card (PCMCIA card). Only ever disable if you do not use any power sav pspcontr.exe Driver/controller for the Philips SpeechMike 6174. As the Philips FreeSpeech application is no longer supported it can be disabled but the Mike can still be used for certain functions using this driver PsSound.exe On a Toshiba laptop. Operates your sound in one of 4 modes, off, on , on only with powerr, same as #3 but longer delay PSTORES.EXE Part of Windows Services Protected Storage? ptfb.exe Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" rundll32.exe ptipbmf.dll, SetWriteCacheMode Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to t Rundll32.exe ptipbm.dll, SetWriteBack Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Tells the drivers that the connected Drives should use the "Write Back" Caching. You can dis rundll32.exe ptmg1v.dll, DllRunMain Added by an unidentified TROJAN, WORM or other malware! ptrun32.exe Parent Tools for AIM ptr32w.exe Added by ParentTools surveillance software. Remove unless you installed it yourself Ptsnoop.exe These descriptions I've come across - all valid as far as I can see :- (1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may n pttrun.exe Transmeta Crusoe processor related. Reduces application launch times and makes the computer "more responsive" PtUDFApp.exe Sony abCD program, included on the CD Xtreme install CD, used to format CD-RWs for packet writing (similar to DirectCD). Available via Start -> Programs. Note that you must add a /T switch to the com Puac.exe Peter's Ultimate Alarm Clock ODBC32*.exe [* = random char] Added by the MASLAN.D WORM! proxycfg.exe GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser PortAOL.exe Pure Networks Port Magic, as available in the latest version of the AOL(r) 9.0 Optimized SE software; automatically configures most in-home Internet gateways, improving access and performance for ap PURGATIVE100.EXE AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack Purga.exe Added by the PORGORY-B WORM! pull.exe Client software from Interwise that MS use for their webcasts ptfb.exe Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" PUSH6599.EXE Scan button monitor for Relysis Episode MF6599 USB scanner as you can start scanning manually via the scanning software PutA!!.exe Added by the OPASERV.L WORM! PutA!!.com Added by the OPASERV.Z WORM! [filename] Added by the LDPINCH TROJAN! PV92Tray.exe PCtel HSP V.92 modem configuration utility PVR.exe Pocket Voice Recorder - freeware sound recorder that records from microphone and any other input line available with your sound card PVUnInst1.exe Privacy View - privacy software that ensures that all your private computer files, photos, documents, and websites remain secure from prying eyes Pwr32ctr.exe Added by the GEMA TROJAN! Pwr32ctrl.exe Added by the GEMA TROJAN! Pwr32mgt.exe Added by the GEMA TROJAN! PWRMGRTR.DLL Power Manager - background monitor module for IBM ThinkPad laptops. Leave it alone to ensure proper power management functions Rundll32 PwrMonit.dll IBM's proprietary 'battery maximiser' and power monitoring software for laptops

X U ? U U N N X N X N X X ? X U U U N U U ? ? X Y Y ? N U U X X X N U U X N X X X X N X ? ? U U Y Y N Y N N N N U X X X N N N N N Y N N U N

Pwroff Pwrsave Pwruplogin PwrupTweakMe PWS Tray p_981116 Q152404 q36i36O QAGENT qappsrvc32.exe QBCD autorun qbkupdbs qbotd qBrowse QBRSR Qchex Tray Icon QCTRAY QCWLICON QD FastAndSafe QDM QDMStart Qdsafe Qexplo qgqqft QH Live Update Scheduler QH Office 2K Check QMusic QNPlus Qoeloader QPService QQ QQServer qservices QSort2000 QT4HPOT QTaskStartup QTime QTSTUB.EXE QTSvc QTSvc QTSvc QTSvc qttask Quantifier Security QUBCity Queensla Quick Controls Quick Heal Messenger Quick Heal On-Line Protection Quick Heal Startup Scan Quick Shelf xx Quick Startup Quick Time Task Quick View Plus QuickBooks Delivery Agent Quickbooks Update Agent QuickCamPro quicken quicken quicken Quicken Scheduled Updates Quicken Startup QuickenSEMessage QuickFinder Scheduler QuickFinder Scheduler QuickLaunchEr Quicklink III Quicknote QuickPassword QuickRes

Pwroff.exe Pwrsave.exe pulogin.exe PUPXPTWK.EXE PwsTray.exe p_981116.exe wsript.exe Q152404.VBS lms2cenu.exe qagent.exe qappsrvc32.exe autorun.exe mqbkup.exe [random filename] qbrowse.exe QuickBrowser.exe Qchex.exe Qctray.exe Qcwlicon.exe QDCSFS.exe QdmStart.exe QdmStart.exe ?? Qexplo.exe [path to Trojan] UPSCHD.EXE O2KCHECK.EXE QMAgent.exe QNPlus.exe Qoeloader.exe QPService.exe sendmess.exe QQ.exe qservice.exe QSORT.EXE OneTouch.exe qtask.exe nrchk.exe Qtstub.exe msocfg.exe navchk.exe shman.exe ssvr.exe Qttask.exe qsecue.exe qtp.exe Queensla.exe Astrotoolbar.exe QHM32.EXE Cateye.exe QHSTRT32.EXE qushelfxx.exe Fquick32.exe qttask.exe QVP32.EXE QBDAGENT.EXE qbupdate.exe QuickCamPro.exe quicken.exe Winrar.exe Waol.exe bagent.exe QWDLLS.EXE Qsemsg.exe QFSCHD100.exe QFSched.exe QuickLaunchEr.Exe QL.EXE quicknote.exe agquickp.exe QUICKRES.EXE

Added by the GEMA TROJAN! Toshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power ?? Ashampoo PowerUp XP is a convenient tool for fine-tuning your Windows(r) NT4, 2000 and XP configuration to suit your precise needs and wishes. It gives you direct access to many frequently-required Microsoft's Personal Web Server, an application which allows PCs to behave as web servers (allows you to test your .asp pages on your own PC without having to load them onto the internet). Available Win32 cabinet self extractor. More info here Appears to run Scandisk at bootup on NEC PCs Added by the SECONDTHOUGHT VIRUS! Quicken program is controlled by a separate utility program called the Quicken Download Manager (also known as Qagent). When Quicken Download Manager option is enabled, background downloadin Added by a Proxy Trojan variant - identified by Kaspersky antivirus as Trojan-Proxy.Win32.Webber.m Quick Books CD Added by the OPASERV.K WORM! Added by the BOTTEN TROJAN! ?? top-banners.com adware Related to G7 Productivity Systems Check Software System Tray icon providing access to the "IBM Access Connections" wizard on ThinkPad laptops and also allows to change the network environment. Not the same as QCWLIcon, which is pertinent only Used by IBM Thinkpad laptops with built-in wireless card (802.11). System Tray icon that provides a shortcut to "Wireless Connection Status" and allows to turn WL on and off Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU, temperatures, BIOS information, etc. Only required if you overclock system components and QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU, temperatures, BIOS information, etc. Only required if you overclock system components and ?? ?? Added by the RANKY.T TROJAN! Quick Heal Anti-Virus Quick Heal Anti-Virus MS Office documents virus checker ?? Quick Notes Plus by Conceptworld - sticky notes tool Qurb 2.0 anti-spam tool for Outlook/Outlook Express. Required when supporting OE but not for Outlook. Shortcut available via Start -> Programs HP QuickPlay - "brings your favorite music and movies to life with the touch of a button" Added by the SEMES TROJAN! Added by the DOWNLDR-AN TROJAN! Added by the PROGENT-A TROJAN! Utility that sorts your Start menu and Favourites in alphanumerical order. Not required - at any time you can right-click on these lists and choose "Sort by Name" Hewlett Packard One Touch keyboard driver. Required if you use the additional keys Feature of Quicken.com Brokerage to customize and display Desktop Alerts and icon. It is not required for the Quicken Program to run correctly, it is only required for the Desktop Alerts feature Premium rate adult content dialler Part of an old version of the Quick Tax application. It enables Quick Tax Calendar Popup to show tax calendar reminders Premium rate adult content dialler Premium rate adult content dialler Premium rate adult content dialler Premium rate adult content dialler System Tray access to Apple's "Quick Time" viewer from version 5 onwards Added by the SPYBOT.UOL WORM! ?? ?? Gateway Astro Screen and Sound Controls tray icon Quick Heal Anti-Virus Messenger - keeps you informed about the latest threats, hoaxes etc Quick Heal - virus scanner Quick Heal - virus scanner Places an icon in the system tray for launching MS Bookshelf. Available via Start -> Programs"xx" represents the version number - ie, 98, 99 For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone System Tray access to Apple's "Quick Time" viewer from version 5 onwards Quick View Plus from Inso Corporation. Multiple file type viewer. Available via Start -> Programs As far QAGENT but for QuickBooks. Can also have the version number in the name Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not System Tray for Picture Capture utility that can run unattended. Pictures every 30 seconds for example, auto FTP Upload, etc CoolWebSearch Therealsearch parasite variant CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR! CoolWebSearch Therealsearch parasite variant Quicken background downloading module Quicken option to load DLLs at startup Quicken option Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products) Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products) QuickLaunchEr - allows you to quickly launch programs from an icon in the system tray HP fax program and only needs to be in the start-up group if you allow your phone to automatically answer your phone in fax mode, that is, to receive faxes after a certain number of rings. Available via JC&MB Quicknote Virtual Scrapbook Smart card-based authentication and digital signature client software Utility to quickly change desktop resolution - left over from Win95 Power Toys. In Win98 and above incorporated via Control Panel -> Display. Not required unless you have to change resolutions on a re

N X X X X N X X N X X X U X X N N X ? U X X Y N N U U U U U X U U U U X X X X Y Y X X U X X X Y X X X X X Y X Y X X X X X X X X X ? X N U X

quickset quickset.exe Quicktime qttasks.exe Quicktime shch.exe Quicktime Mediaplayer winmplyer32.exe Quicktime Pro 3.0 winuodps.exe QuickTime Task Qttask.exe QuickTime Task qttasks.exe Quicktime Task [random filename] QuickTime Update Completion x quicktimeupdatehelper.exe QuicktimeMngr QUICKTIMEMNGR.EXE QuickTimeUpdate QuickUpdate.exe Quicktlme ru.exe QuickTV QuickTV.exe Quickzip Ls.exe QuickZip lu.exe QuikShield qkshield.exe QuikSync QUIKSYNC.EXE qwe qwe.exe QWERTY qwerty.exe QWS3270 Sessions sessions.exe RA Server Slave.exe RabbitWannaHome rabbit.exe Rabo Session Monitor RaboSessionMon.exe RaConfig2500 RaConfig2500.exe RadarSync RadarSync.exe RadBoot RadBoot.exe RadioSvr RadioSvr.EXE RaidTool raid_tool.exe Rainlendar Rainlendar.exe RAMASST RAMASST.exe RamBooster2 rb.exe RAMDef ramdef.exe RAMDrive RDTask.exe RamIdle ramidle.exe RAMpage RAMpage.exe Randex virus built for IRBMe irbme.exe random random.exe Random Unique ID [worm filename] RandomWin32 mgnwin32.exe rant rant.exe RapApp RAPAPP.EXE Rapdata ravsecs.exe Rapdatae rabseuser.exe Rapid Restore rrpcsb.exe RapidBlaster rb32.exe Raptelnet ravspeger.exe Raptelt ravspegtl.exe Raptor Mobile vpnservices.exe RasCon Remote Access Service Manager rasmngr.exe Rase boln.exe RasMan.exe RasMan.exe rate.exe i11r54n4.exe rate.exe ********.exe [* = random char] RAV8Tray ravtray8.exe RAVEN_VLZS.EXE RAVEN_VLZS.EXE RavMon RavMon.exe RavTime Mstray.exe RavTimer RavTimer.exe RavTimer explores.exe RavTimeXP [worm filename] RavTimeXP Virus RavTimXP [worm filename] RavUptets agetlke.exe RavUptkt agetlktz.exe RavUptpe ravsesur.exe rav_temp.exe rav_temp.exe RAX SYSTEM scrigz.exe Ray Process Killer Prkill.exe razer razerhid.exe rb32 lptt01 rb32.exe

Dell taskbar icon allowing you to quickly change settings Added by the ADCLICK-AK TROJAN! Added by a variant of the EB TROJAN! Added by the RBOT-PM WORM! Added by the GAOBOT.BH WORM! System Tray access to Apple's "Quick Time" viewer from version 5 onwards CoolWebSearch parasite variant NetVision dialer Different numbers caused by number of launches. So if 3 updates are made separately, 3 would appear (in theory) Added by the WOOTBOT.AW WORM! Added by the BIFROSE-CW TROJAN! Adult content dialler Infra-red remote control driver for the AVerTV Studio TV tuner/personal video recoder from AVerMedia. Required if you use the remote control MsConnect browser hijacker and dialler MsConnect browser hijacker and dialler QuikShield popup blocker - reportedly stealth installed, see here Used by Iomega drives. Available via Start -> Programs Added by the LINEAGE-F TROJAN! Possibly adult content related adware QWS3270 Secure terminal emulation software Added by the RA TROJAN! Added by the MIMAIL.S WORM! Related to RaboBank electronic banking software RaLink wireless LAN configuration utility Radarsync utility comes from DFI with their latest motherboards, e.g., DFI LanParty Ultra - checks for BIOS and driver updates periodically RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings Used to configure wire less networks. Windows automatically detects the Wireless network and it configures the network VIA V-RAID Tool - hard disk striping/mirroring utility for increased performance and reliability Rainlendar is a customizable calendar that displays the current month Optionally installed with some DVD drives (LG, Panasonic, etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. It does not affect your ability to burn CDs. If you d Added by the AKAK TROJAN! Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See th Virtual Hard Drive (Ram Drive) takes a portion of your system memory (RAM) and uses it to simulate a hard disk drive. For more information see FarStone RAM Idle - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other application Small Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray icon, or by setting a threshold that activates the pr Added by the RANDEX.RH WORM! Added by the DLOADER-KM TROJAN! Added by the XROVE-A WORM! Added by the SDBOT-DV WORM! Added by the RBOT-ZB WORM! Application protection component of BlackICE PC Protection (was Defender) firewall, informing you of any modifications to programs, files or folders and detecting unknown programs trying to launch Added by the QQPASS-V TROJAN! Added by the QQPASS-S TROJAN! XPoint "Rapid Restore PC" - a "Managed Recovery(tm) solution that enables IT Administrators to protect the corporate image, while offloading personal data backup and recovery chores to the end user RapidBlaster parasite. Recommended you use RapidBlaster Killer to uninstall - see here Added by the QQPASS-AA TROJAN! Added by the QQPASS-AB TROJAN! Symantec VPN Client used to connect to corporate networks. If unchecked, must be uninstalled using Add/Remove Programs as it tightly integrates into networking Added by the SPYBOT.EM WORM! PurityScan/Clickspring adware Added by the FEUTEL-H TROJAN! Added by the BEAGLE.E or BEAGLE.F or BEAGLE.G or BEAGLE.H or BEAGLE.I WORMS! Unidentified adware RAV anti-virus related Another eAcceleration program - spyware. Read their privacy statement here RAV AntiVirus Added by the WUKILL.A WORM! RAV AntiVirus Added by the HOMEY-A TROJAN! Added by the WULLIK.B WORM! Added by the CAGER.A WORM! Added by the WULLIK.B WORM! Added by the QQPASS-AK TROJAN! Added by the QQPASS-AJ TROJAN! Added by the QQPASS-T TROJAN! ?? Added by the MYTOB.KR WORM! Ray Process Killer - clicking right mouse button produces popup menu with current active tasks. You can choose any task and click "Ok" to terminate it. Use CTRL+ALT+DEL instead Razer mouse driver RapidBlaster variant (in a "RapidBlaster" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here

X X X X X U X U X X X X X X X X X N X X X U X X X N X N N X X N X X X X X N X ? N U U Y ? N X X N Y ? N X N X N N N N N X X X N U X N X X U

rb32 ml097e rb32.exe RapidBlaster variant (in a "RapidBlaster" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here rbenh ml***e rbenh.exe RapidBlaster variant (in a "RBEnhance" folder in Program Files) where *** represents random digits. Recommended you use RapidBlaster Killer to uninstall - see here Rcf Driver rcf.exe Added by the RANDEX.BLD WORM! rCron rcron.exe Switch adult content dialler rCron dservice.exe Switch premium rate adult content dialer RCScheduleCheck RCSCHED.EXE Scheduler for VCOM's Recovery Commander - which "can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running" RCSync RCSync.exe PrizeSurfer related. "PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware RDClient RDCLIENT.EXE Remote Disconnection Utility from Twiga. Used for connecting and disconnecting dial up connections on a network - only needed if there is a shared internet connection RDLL RunDll16.exe Added by the SDBOT.F TROJAN! rdvs [worm filename] Added by the ULTIMAX WORM! Reactor3 [random name]32.exe Added by the BOFRA.A WORM! Reactor5 [random name]32.exe Added by the BOFRA.D WORM! Reactor6 [random name]32.exe Added by the BOFRA.C WORM! Reactor7 [random name]32.exe Added by the BOFRA.B WORM! Reactor8 [random name]32.exe Added by the BOFRA.E WORM! Reactor9 [random name]32.exe Added by the BOFRA.E WORM! readdb40 rundll32.exe [path] readdb40.dll, EnableRunDLL32 LZIO.com adware downloader REAL realjbox.exe Real Jukebox - MP3 and music files player Real Internet Player Reaiplay.exe Added by a variant of the SPYBOT WORM! Real player updater realupd.exe Added by the PARLAY TROJAN! real scheduler.hta RealAudio.exe Added by the CEEGAR TROJAN! Real Spy Monitor Winrsm.exe Realspy keystroke logger/monitoring program - remove unless you installed it yourself! Real Statics Agent ccreal.exe Added by a variant of the RBOT WORM! Real-Tens Real-Tens.exe DownloadWare adware RealAudio RealAudio.exe Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player RealDownload RealPlay.exe Download manager. Available via Start -> Programs RealDownload Express npnzdad.exe Advertising spyware Reality Fusion GameCam SE RFTRay.exe System Tray access for Logitech's Reality Fusion GameCam. For more details see here. Available via Start -> Programs RealJukeboxSystray tsystray.exe System Tray icon for RealJukebox realone_nt2003 moniker.exe Added by the SNONE.A WORM! RealP1ayer [path to file] Added by the RPLAY.A TROJAN! Note that the name has a number "1" in place of the second lower case "L" realplay realplay.exe System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling Sta realplay lptt01 realplay.exe RapidBlaster variant (in a "RealPlay" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name realplay ml097e realplay.exe RapidBlaster variant (in a "RealPlay" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name RealPlayer Ath Check rnathchk.exe Added by the MYTOB.AG WORM! Realplayer Codec Support realsched.exe Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Realplayer One realplay.exe Added by the RBOT-NK WORM! RealPlayer2 MsgCenterExe RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way RealPlayerUpdater realupd32.exe Added by the LOHAV-T TROJAN! Realpopup Realpopup.exe RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor" Realsched realsched.exe Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't RealSPEED RealSPEED.Exe RealSPEED - tweaking utility to speed-up your internet connection Realtime Audio Engine mmrtkrnl.exe Associated with ALCATech BPM Studio Realtime Monitor realmon.exe Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates RealTimeUpdate RealTimeUpdate.exe Product description in properties is "InternetExplorerCommunicationAgent Module" ? RealTray RealPlay.exe System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling Sta RealUpdater realupd.exe Added by the PARLAY or MITGLIEDER.I TROJANS! RebateNation0 RebateNation0.exe WebRebates adware variant Reboot Reboot.exe MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards Recguard recguard.exe On HP computers, Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled, it is possible to knock that completely out and force the customer to send the PC ba recguard recguard.exe ?? Reclip reclip.exe Reclip Popup Clipboard manager Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} RH.DLL SmartPops search hijacker Recover N/A Added during the installation of Comcast High Speed Internet software. During installation the system reboots and if the disk is removed a screen appears asking for the disk to be re-inserted to comple recover.bmp.exe Rundll.exe Added by the ANAFTP-01 TROJAN! Note - this is NOT the Windows system file of the same name as described here RecoverFromReboo RECOVE~1.EXE Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry RecoverFromReboo RecoverFromReboot.exe Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry RecoverFromReboot RECOVE~1.EXE Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry RecoverFromReboot RecoverFromReboot.exe Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry RecShe RecSche.exe Recording scheduler for WatchTV Capture Card (TV Tuner card) Recycle Bin Handler recycler.exe Added by the SHUCKBOT-A TROJAN! Recycle Bin Handler 2005 system.exe Added by the HO TROJAN! RecycleSTR msreg32.exe Added by the RBOT-TC WORM! Red Flag redflag.exe PMS prediction program with modes for guys and girls - no longer available Red Swoosh EDN Client RSEDNClient.exe Red Swoosh - mechanism used by web sites to allow you to download files from those sites quicker and more efficiently via P2P. Note from the license agreement they automatically update the software redirect redirect*.exe Dotcomtoolbar/Linksummary hijacker installer - where * is a random digit Redline Taskbar taskbar.exe Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards REEGRUN [path to file] Added by the SECDROP.AI TROJAN Reek 32 Server reek32.exe Added by the RANDEX.AL WORM! Referee referee.exe MediaComm's monitor for file association changes. Stop rogue programs from screwing your settings either on installation or whenever they run

N X ? X X X X X X X X U X X X X X X X X X X X X X X X X U X U ? X N ? U N X U X X X X X X X X X X X X X X X X X X X X U X U X X X X Y X X X

Refresh Refresh.exe (Iomega) Refresh - loads the Iomega desktop icons at startup Reg Reg.hta Homepage hi-jacker. Removal instructions here Reg Check lpt.exe Related to Supanet ISP software - what does it do and is it required? reg run Systen.exe Added by the BANCOS-BS TROJAN! Reg Service winsy.exe Added by a variant of the SPYBOT WORM! Reg Service winslogon.exe Added by the AGOBOT-SC WORM! Reg Service ipcfg.exe Added by the AGOBOT-SO WORM! Reg Service REGSRV32.EXE Added by the RBOT.ZW WORM! Reg Service WinnConfig.exe Added by the AGOBOT-PF WORM! Reg Services Winboot32.exe Added by the RBOT.PB WORM! reg1.reg vuamgard.exe Added by a variant of the IRC.BOT TROJAN! reg2.0 SVCH0ST.EXE Added by the eSpyNow surveillance software. Uninstall this software unless you put it there yourself. Note - the filename has the digit 0 rather then the uppercase "o" Reg32 Reg32.exe Hijacker - redirecting to only-virgins.com reg32 reg32.exe Added by the NOUPDATE.B TROJAN! Reg32 reg33.exe CoolWebSearch parasite variant - also detected as the STARTPA-M TROJAN! Regcheck ~CAB001.EXE Added by the CYBRSPY.13A or RegDefend is a configurable, kernel based registry protection system, designed to intercept selected changes before they occur, thus also preventing malicious software l RegDone services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! RegDone winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! RegDone Ex csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! RegDoneEx lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf regedit regedit.exe Added by the BRID.A WORM! Note - this is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in the System (9x/Me) or S REGEDIT Regsrv32.com Added by the SOUTHGHOST WORM! regedit autoexe.exe Added by a variant of the RBOT WORM! regedit svchost.exe Added by the RONA TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! regedit svchost.exe ccRegVfy Added by the HOTWORD.B TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! RegEdit32 RegEdit32.exe Added by the VOUMIT-A WORM! Note - this is not the legitimate regedit32.exe application which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Regexit runlli32.exe Added by the QQPASS-U TROJAN! Regexit Updadv.exe Added by the QQPASS-N TROJAN! RegFreeze regfreeze.exe RegFreeze anti-spyware software reggsdg spoolserv.exe Added by the SDBOT-MS WORM! RegHelp svchosts.exe SpyGraphica spy software - "Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the w reginfo32 reginfo32.exe ?? Register Manager RegistryManage.exe Added by the SDBOT.AYH WORM! Register MediaRing Talk register.exe If you don't want to register MediaRing and be reminded about it every bootup disable it Register SeqChk regsvr32.exe ..csseqchk.dll ?? RegisterDropHandler REGIST~1.EXE Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item Registration-Studio 8 RegTool.exe Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems Registry wscript.exe Added by the VBSWG.AQ WORM! Registry class0117[random].exe Blackbox captures emails and chat logs, and monitors Internet activity - remove if you didn't intentionally install it Registry Checkup winreg.exe Added by an unidentified WORM or TROJAN! Registry Checkup System326a Monitor Winregs326a.exe Added by a variant of the SDBOT WORM! Registry Integrity Checker regintmon.exe Added by a variant of the AGOBOT/GAOBOT WORM! Registry Integritycheck WCPDT.EXE Added by the AGOBOT-RF WORM! Registry Loader regloadr.exe Added by the GAOBOT.AO WORM! Registry Loader winhlpp32.exe Added by the GAOBOT.AO WORM! Registry oidet win32.exe Added by the RBOT.BMT WORM! Registry Scanner regscanr.exe Added by a variant of the OPTIX TROJAN! Registry Server regsrv32.exe Added by the RBOT-GM WORM! Registry Service REGSRV32.EXE Added by a variant of the RBOT WORM! Registry Services Registry.exe Added by the DOWNLOADER.CILE TROJAN! Registry Startup Check checkreg.exe Added by the REMLOAD-A or DANMEC-B TROJANS! Registry System16 Checkup Monitor SystemReg16.exe Added by a variant of the RBOT WORM! Registry System166 Checkup Monitor SystemReg166.exe Added by a variant of the RBOT WORM! Registry Value Name roses.exe Added by the RBOT-AFT WORM! Registry Value Name service.exe Added by the RBOT-AHT WORM! Registry Value Name winapi32.exe Added by a variant of the RBOT WORM! Registry Value Name Start MsPMSPSa.exe Added by a variant of the SDBOT WORM! RegistryCheck rundll32.exe chkreg.dll, CheckRegistry Ulubione adult content dialer RegistryChk winbackup.exe Added by the MERTIAN WORM! RegistryMechanic RegMech.exe Registry Mechanic for Windows - "you can safely clean and repair Windows registry problems with a few simple mouse clicks! Problems with the Windows registry are a common cause of Windows crash RegistryMonitor registry.pif Affilred adware REGIST~1 REGIST~1.EXE Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item Regkey for autostart winservice.exe Added by the RBOT-NU WORM! Regmonitor regmaping.exe Added by the BEAGLE.DO WORM! REGMSYS [path to file] Added by the LOWZONE-AX TROJAN! RegMutex lexplore_.exe Added by the MSNOPT-A TROJAN! RegProt Regprot.exe RegistryProt from Diamond Computer Systems - protects the system registry against changes Regptmens REGPTMENS.EXE Added by the BANCOS-ED TROJAN! Regro rundll132.exe Added by the RAGNAROK TROJAN! RegRun mActiveX.exe Added by a variant of the RBOT WORM!

X X X X U Y X X X X X ? X N X X X X X X X U X X ? U X X X Y X X X X U X X N N N N N N N U N X U X N N U U U X X X X X X X Y Y U U U N X N X

REGRUN winfix22490.exe Added by a variant of the RBOT WORM! REGRUN [path to trojan] Added by the LOWZONE-AH TROJAN! REGRUN regeditt.exe Added by the AGENT.MM Trojan dropper! REGRUN sory.exe New Purityscan variant RegRun WinBait winbait.exe Part of RegRun - used to detect unknown viruses. RegRun compares winbait.exe with the original copy called winbait.org and warns if the files are different.. Regrun2 WatchDog.exe Greatis Software's RegRun 3 Security Suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's, viruses, etc REGRUNM autoprotect.exe Added by an unidentified WORM or TROJAN! Regrx rundll32.exe Added by the WAYIC-A TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). The file is located in C:Windows Regscan regscanr.exe Added by the OPTIX-SE TROJAN! RegScan DLLSRV32.EXE Added by the AGOBOT.AEW WORM! RegScan Regscan.exe Added by the TALEX TROJAN! RegServer regserve.exe Related to XGI Technology's Volari graphics cards - what does it do and is it required? regservices.exe regservices.exe Added by an unidentified VIRUS, WORM or TROJAN! RegShave regshave.exe Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BEFORE attempting to uninstall the Fuji software or the un regsrv regsrv.exe Added by the OPTIXPRO.11 TROJAN! regsrv scvhost.exe Added by the AGOBOT.E WORM! regsrvc regsrvc.exe Added by the STOPED-A TROJAN! Regsv regsv.exe Search hijacker - redirecting to scheo.com Regsvc regsv.exe Added by an unidentified TROJAN! regsvc32 regsvc32.exe Homepage hijacker that changes your homepage to an adult content site regsvr regsvr.exe Added by the WEBMONEY-G TROJAN! REGSVR32 regsvr32.exe ctasio.dll ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality RegSvr32 msmsgs.exe Added by the ZLOB.B TROJAN! regsync regsync.exe SafeSurfing adware regtmlp N/A ?? RegTweak RegTwk.exe Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options, custom display modes, refresh rates and overclocking all through an easy to use interface RegVer REGVER.EXE Added by the LATINUS.16 TROJAN! RegVfy32 Regverif32.exe Added by the SYGYP.A WORM! RegWrite csrss.exe Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Regx10EXE atix10.exe ATI Remote Wonder(tm) - PC wireless remote control driver. Required if you use it reg_key FUKULAMER.exe Added by the BEAGLE.AH WORM! reg_key loader_name.exe Added by the BEAGLE.Y or BEAGLE.Z or BEAGLE.AA WORMS! Reg_WFT Regsysw.com Added by the WILSEF VIRUS! Reg_WFT scanreg32.com Added by the SENNASPY-F TROJAN! ReleaseRAM RRAM.exe Release RAM allows your computer to run faster and uses your computer's RAM more efficiently. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See th reload reload.vbs Added by the LOVELETTER.AS VIRUS! Reload reload.exe Added by the LAZAR TROJAN! RemHelp Remhelp.exe BT Voyager ADSL Modem Help related Reminder reminder.exe From MS Money. Reminds you of your bills Reminder Remind_XP.exe HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry Reminder-cpqXXXXX remind32.exe Compaq printer Registration Reminder-hpcXXXXX remind32.exe HP CD-Writer Registration Reminder-ranXXXXX remind32.exe Registration reminder widget for Rand Mcnally maps reminder-ScanSoft Product Registration remind32.exe Registration reminder for ScanSoft products such as PaperPort RemindMe RemindMe.exe Remind-Me - calendar software Remind_XP Remind_XP.exe HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry Remndr CsRemnd.exe CasinoOnline foistware Remote Access rnaapp.exe Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie, analogue 56K modem) and terminates after the connection is closed Remote Access Slave Synchost.exe Added by the RIPJAC TROJAN! Remote Control Rc.exe Hinet Hi-Five ISP software Remote Controller TVRMVCR.EXE ProLink PlayTVpro TV tuner software Remote Desktop Computing marspc.exe Marspc Remote Desktop Computing Remote Management Agent zenrc32.exe Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the remote master remote master.exe Required if you want your ASUS Remote control to work at all. Available via Start -> Programs Remote Procedure Call winrpc.exe Added by the RBOT-KM WORM! Remote Procedure Call winsysrpc.exe Added by the SDBOT-PS WORM! Remote Procedure Call For Windows rpc.exe 32bit Added by the RBOT-MD WORM! Remote Procedure Call Locator RUNDLL32.EXE reg678.dll ondll_regAdded by a variant of the LOVGATE WORM! Remote Procedure Calls mswinrpc.exe Added by the RBOT.KJ WORM! Remote Procedure Calls mswinc.exe Added by the RBOT-IT WORM! Remote Procedure Calls win.exe Added by the SDBOT-QI WORM! Remote Update Monitor imonitor.exe Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer RemoteAgent RAUAgent.exe Trend Micro's Office Scan Client, see here - "Its Web-based management console gives administrators transparent access to desktop and mobile clients to coordinate automatic deployment of security p RemoteCenter RcMan.exe Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats RemoteControl rmctrl.exe Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't ha RemoteControl PDVDServ.exe Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't ha Remote_Agent RemoteAgent.exe Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs REMOVE ME windos.exe Added by the SDBOT.EE WORM! Removecpl Removecpl.exe Related to a Belkin 54Mbps Wireless Utility Control Panel applet Removed.exe Removed.exe GatorCheat - adware downloader

? ? U U X X X X X X N N ? U ? Y X U U X U U N X U X X Y ? N U X U N N X U X U U ? U N ? X U X X U X X ? X X ? X N N U ? X X X X X X X X X ?

RemStart RenolB RepliGo Assistant ReproPRD requester Requester Required Service Drivers resagnt reseurce reseurce Resolution Assistant Resource Meter Restart Watch Restart WSC Setting Restart_VS RestoreIT! restory Resume Copy ResumeFixClocks retime RetrieverScheduler RevoTaskbarApp RexSyMon RF rfagent rforce RFTray rfw rfwydg RFX_auto_upgrade RH Rhino RhinoBlocker RHPTray RHSI SHS richup Ring Central Fax rIOphosIs RivaTuner RivaTunerStartupDaemon RjLyraInstaller rmctrl rmmon RMremote rn4d Rnaomflt RNBc Test RNBc Test RNBOStart RNBz Test RNDc Test rndll2 rngmf Rnudll32 rnxqh Roam04 RoboForm RoboFormWatcher Rocket.Time roketpipe rollbk rollbk rollbk rollbk romahere romahere2 romahere3 Root_Machine ROOT_Machine ROUTD

remstart.exe Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required? ib.exe ?? RepliGoMon.exe Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device" PrdUsb.exe Thrustmaster Corporation Presets application - a game controller driver, presumably necessary for certain functions to work requester.*.exe Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit, examples: requester.5.exe, requester.10.exe requester.11.exe Added by the MUQUEST TROJAN! micront.exe Added by the RBOT-ABD WORM! restun.exe Adware downloader - detected by Panda antivirus as Trj/Downloader.ALQ [path to trojan] Added by the LINEAGE-AI TROJAN! svchost.exe Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M matcli.exe Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written t rsrcmtr.exe Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes Watch.exe Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required? wscrestp.exe WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes Viewsonic.exe Could be a left-over from the installation of a Viewsonic flat panel display VBPTASK.EXE RestoreIT! from FarStone "allows you to recover instantly your files, system configuration, and even your operating system, to any point in time prior to the data loss or system failure." restory.exe Added by the RETSAM TROJAN! copyfstq.exe Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program resumefix.exe Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards retime.exe Added by the GIPMA TROJAN! retrieverscheduler.exe 80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network file systems, giving users one point of fast, accura RevoTask.exe Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available rexsymon.exe Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC EC.exe Added by the LINEAGE-U TROJAN! rfagent.exe Registry First Aid - scans the Windows registry for orphan file/folder references, finds these files or folders on your drives that may have been moved from their initial locations, and then corrects your re EXP1ORER.EXE Added by the DROPPER.KN TROJAN! Note the number "1" in the filename rather than letter "L". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN! RFTRay.exe Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Av Rfw.exe RAV AntiVirus rfwydg.exe ?? rundll32.exe npvpg005.dll A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade rh32.exe EuroFonts - adds Euro symbols to pre-Euro computers [random name]32.exe Added by the BOFRA.A WORM! RhinoBlocker.exe RhinoBlocker - pop-up stopper RHPTray.exe System tray access to Red Hot Pawn - online chess SHS.exe Rogers Hi-Speed Internet software. "Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail, the Self-Healing Software (SHS.exe) will automatically repair your settings to get richup.exe SafeSurfing adware rcenterrll.exe Only needed if you want a PC to answer faxes automatically rIOPHosIs.vBS Added by the RIOSYS MACRO! RivaTuner.exe RivaTuner for tweaking nVidia graphics cards. Required if you make any changes RivaTuner.exe RivaTuner for tweaking nVidia graphics cards. Required if you make any changes setup.exe ?? rmctrl.exe Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't ha mprmmon.exe Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card RmRemote.exe Remote control driver for REALmagic Xcard. Is it required? dirote.exe Added by the BKDR_MAROON.A TROJAN! naomf.exe Naomi internet filtering software wf32vbs.exe Added by the RBOT-AGR WORM! bvldv32.exe Added by the RBOT-AJF WORM! sentstrt.exe Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restric wf32vbc.exe Added by the RBOT-AEY WORM! wf32b.exe Added by a variant of the SDBOT WORM! rndll2.exe May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within? [path to trojan] Added by the RANKY.C TROJAN! tadxtr.exe Added by the QQPASS-O TROJAN! rnxqh.exe ?? ActiveX.exe Added by the ROAMER-A TROJAN! RoboTaskBarIcon.exe Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin RoboFormWatcher.exe AI Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs RocketTime.exe Time synchronization software from Rocket Software rpclient.exe ?? dsm.exe Added by the SERFLOG.B WORM! msmpatch.exe Added by the SERFLOG.B WORM! svosm.exe Added by the SERFLOG.B WORM! sysup.exe Added by the SERFLOG.B WORM! matrixhere.exe SuperSpider hijacker - a CoolWebSearch parasite variant ************.exe [* = random char]SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! ************.exe [* = random char]SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! [path to trojan] Added by the BANCBAN-DI TROJAN! winlogon.exe Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is place ROUTD.exe ??

N ? N N Y U X X X X X X X X X X X X X Y X X U U X X ? X X U N N Y X ? Y X X X U X X X X X U U X X X X X X X X U X X X X X X X N N N N X U ?

RoxAssist Roxio Engine RoxioAudioCentral RoxioDragToDisc RoxioEngineUtility RP32 RPC RPC Patcher rpc Win32 rpc Win32 rpcda Win32 RPCser32g RPCserr32g RPCserv32 RPCserv32g RPCserv32g RPCserv32g RPCserv32g RPCserv32g RPCSS.exe RpcxWindows Extensions RRMedic rscmpt rsMenu RSPC Driver RSPC Driver D RSRCMTZ RSS RSync rtcdll RTHDCPL RtlMon.exe RTMonitor rtos RTStartMute rtvscn95 Ruby13 Ruby14 ruin RuLaunch run run Run Run Msn Messenger Run MSupdt32 Run POPFile in background Run POPFile in background Run Services as Application Run Services as Application Run Services as Application Run Services as Application Run Services as Application Run Services as Application Run Services as Application Run Services as Application Run StartupMonitor Run TaskMrg run windows Run XP Service Pack Run05 run32dll run32dll Run32dll run= run= run= run= run= run= run=

RoxAssist.exe Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize, the applications in Easy CD & DVD Creator will not recognize your recorder. After MSMNGR32.EXE Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN! RxMon.exe Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound editor - integrated in a single application". Not requir DrgToDsc.exe Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". No EngUtil.exe Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking rp32.exe ControlIT (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems. MSschost.exe Added by a variant of the GAOBOT/AGOBOT WORM! [path to worm] Added by the BOLGI WORM! shost32.exe Added by the RBOT-ABL WORM! spoolscv.exe Added by a variant of the RBOT WORM! rpcda.exe Added by the RBOT-AE WORM! services.exe Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms winlogon.exe Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in th services.exe Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M services.exe Added by the BOBAX.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc CSRSS.EXE Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon MSDEFR.EXE Added by the BOBAX.AD WORM! NB32EXT2.EXE Added by the BOBAX.AD WORM! WINLOGON.EXE Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in th rpcss.exe Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se rpcxwinex.exe Added by the RBOT.ACP WORM! rrmedic.exe Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there rscmpt.exe Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U s rsMenu.exe Synchronizes a Casio PDA with MS Outlook [random filename].exe Added by the RBOT-SN WORM! [random filename] Added by a variant of the RBOT WORM! RSRCMTZ.exe ?? rundll32 RSSToolbar.dll, DllRunMainRelated Sites toolbar - SearchAndClick hijacker variant netsync.exe SafeSurfing adware rtcdll.exe RTCDLL is "Real Time Communication" and is associated with Windows Messenger (the IM application, not messenger service). It is only necessary if you use Windows Messenger. Most people use MSN RTHDCPL.EXE Realtek HD Audio Sound Effect Manager RtlMon.exe Monitor for RealTek network card RTMonitor.exe Cheyenne (now eTrust) antivirus rtos.exe IRC trojan N/A ?? RTVSCN95.EXE Real-time virus scanner component of Norton Anti-Virus Corporate Edition Ruby13.exe Added by the MEXER.E WORM! Ruby14.exe Added by the FIGHTRUB-A WORM! system32.exe Added by the DELF-JM TROJAN! RuLaunch.exe Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Autoexec.com Added by the HOLCAS.A WORM! inetinfo.exe Added by the BINGHE TROJAN! help.exe Identified as the DELF.LF by Ewido Security Suite msnmgr.exe Added by the AGOBOT.HA WORM! wscript MSupdt32.vbs Added by the CASER WORM! perl.exe POPFile - E-mail spam blocker wperl.exe POPFile - E-mail spam blocker localsvc.exe Added by the DLOADER-NY TROJAN! netsvc.exe Added by the DLOADER-NY TROJAN! spoolsvc.exe Added by the DLOADER-NY TROJAN! svcadmin.exe Added by the DLOADER-NY TROJAN! svcman.exe Added by the DLOADER-NY TROJAN! svcrun.exe Added by the DLOADER-NY TROJAN! tcpsvc.exe Added by the DLOADER-NY TROJAN! websvc.exe Added by the DLOADER-NY TROJAN! StartupMonitor.exe Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu csrss.exe Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco servic.bat Added by the REBOOT-AP TROJAN! xpservicepack.exe Added by the SDBOT.AQA WORM! rundll_32.exe Added by the BANCOS-DT TROJAN! WINClock.exe Added by an unidentified VIRUS, WORM or TROJAN! task32.exe Added by an unidentified VIRUS, WORM or TROJAN! ocxdll.exe Added by an unidentified VIRUS, WORM or TROJAN! cmmpu.exe MIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse so hpfsched HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not wan lxdboxcp.exe Lexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS pcfix2k.exe pcfix2k splash screen ptlseq.cpl PhoenixNet BIOS adware. See here ramsys.exe Advanced Startup Manager from Rays Lab wallflip.exe Desktop wallpaper changer?

X X Y ? X X X ? N Y X X X X X X X X X X X X X U N X X Y X X X X X X X X X X X X X X X X X X N N U X X U X ? X X U X X N ? X X X X X X X X X

run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= run= RunAlert runAP runapp Runapp32 RunCA Rund11 rund1132 Rund1132.exe Rund1l32 Rundil32 Rundil32 rundl332 rundli32 RunDLL Rundll Rundll RunDll rundll*** rundll*** rundll*** rundll*** Rundll16 Rundll32 RUNDLL32 RunDLL32 rundll32 RunDLL32 Rundll32 Rundll32 rundll32 rundll32 rundll32 rundll32 rundll32 RUNDLL32 rundll32 Rundll32 cmicnfg Rundll32 P17 Rundll32.exe Rundll32.exe Rundll32_7 Rundll32_8 rundll64 RundllSvr Rundllsystem32 Rundnm RUNGogoTools

svcinit.exe CoolWebSearch parasite variant fntldr.exe CoolWebSearch Tapicfg parasite variant smsrun16.exe Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1, Windows for Workgroups, Win95, or OS/2 to create program groups on the client an win.ini ?? RAVMOND.exe Added by a variant of the LOVGATE WORM! real.exe Added by a variant of the LOVGATE WORM! dec25.exe Added by the ATAK.F WORM! LXBTppls.exe Reportedly part of Lexmark printer software - what does it do and is it required? fmedia.exe FMedia FaxWorks related - can be run manually wswpd.exe Used with some models of Panasonic, Epson and NEC printers - required for printer to work cyxid98.exe Unidentified malware info32.exe CoolWebSearch Tapicfg parasite variant mouse_configurator.win Added by the GAGGLE.E WORM! RegistryReminder.exe Added by the APSTROJAN.OB TROJAN! sec5dec.exe Added by the ATAK.G WORM! wmplayer.exe CoolWebSearch Smartsearch parasite variant Autoexec.com Added by the HOLCAS.A WORM! htmlsync.exe Searchforfree.info browser hijacker msoffice.exe Added by the ADWARELOADER TROJAN! Note - do not confuse with the legitimate Microsoft Office file, which would typically be located in the Program FilesMicrosoft OfficeOffice folder! DRDOOM.EXE Added by the SEMAPI-A WORM! svhost.exe Added by the ADMINCASH.B TROJAN! dllreg.exe Added by the DUMARU-L TROJAN! mdm.exe Added by the PROXY-GG TROJAN! AService.exe MSI MOtherboard PC Alert III - MSI motherboard monitoring software. Only required if you "overclock" your system runAP.exe Not required but what is it? icqchk.exe Added by the BOMKA TROJAN! Runapp32.exe Added by the NEODURK TROJAN! InvokeSvc3.exe Wireless-G USB Wireless Network Adapter related - would appear to be required Rund11.EXE Added by the MARIO-C WORM! rund1132.exe Added by the DOPBOT-A WORM! Rund1132.exe Added by the STARTPA-HS TROJAN! Winfi1e32.exe Added by the MERTIAN WORM! runlli32.exe Added by the QQPASS-U TROJAN! Updadv.exe Added by the QQPASS-N TROJAN! math.exe ...pluged.exe Added by the DOOMJUICE WORM! rundli32.exe Added by the LADE WORM! rundll32.exe bridge.dll, Load Flingstone.com browser hijacker Rundll~.exe Added by the DELF-KT TROJAN! rundll32.exe [random file name].dllAdded "taskmon" by the MYTOB.IG WORM! RunDll.exe Added by the QQPASS-AH TROJAN! Note - this is NOT the Windows system file of the same name as described here die.exe [path] mdll.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 die.exe [path] secure.bat Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 die.exe [path] secure.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 die.exe [path] ttg.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 Rundll16.exe Added by a number of VIRUSES, WORMS and TROJANS! Rundll32.exe Added by the DVLDR TROJAN! Note - this is not the valid "Rundll32.exe" as it's in the WindowsFonts directory RUNDLL32.EXE NvQtwk, NvCplDaemon System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way y RunDLL32.exe NvMCTray.dll, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, setting Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings Loads default settings for Leadtek Winfast graphics cards winupdate.exe Added by an unidentified TROJAN! - possibly a BMBOT variant Windows.exe Added by the QQPASS.E TROJAN! Rundll32.exe ptipbm.dll, SetWriteBack Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Tells the drivers that the connected Drives should use the "Write Back" Caching. You can dis [path to worm] Added by the AUTEX WORM! rundll32.exe ptipbmf.dll, SetWriteCacheMode Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to t rundll32.exe Added by the SANKER WORM! Note that the valid "rundll32.exe" resides in C:WindowsSystem32 wheras this version resides in C:Windows csrss.exe Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Associated with BlueTooth software, and registers the "Infrared Port properties" Control Panel applet. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent rundl32.exe Added by the DEMOTRY-A WORM! rundll32.exe Added by the AGENT-EZ TROJAN! Note - the real rundll32.exe resides in the System (9x/Me) or System32 (NT/2K/XP) folder whereas this file is found in a "SHELLEXT" subfolder Rundll32 cmicnfg.cpl, CMICtrlWnd System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel Rundll32 P17.dll, P17Helper ASIO driver for the Sound Blaster Audigy & Audigy 2 series sound card - is it required in startup? Proyecto1.exe Added by the GRUEL WORM! Root.exe Added by the GRUEL WORM! rundll32.exe MSIEFR40.DLL, DllRunServer BrowserAid/BrowserPal foistware rundll32.exe inetp60.dll, DllRunServer BrowserAid/BrowserPal foistware [path to worm] Added by the AUTEX WORM! Rundll.exe Added by the HUAYU WORM! Note - this is NOT the Windows system file of the same name as described here Rundllsystem32.exe Added by the NETDEVIL.B TROJAN! Rundnm.exe Added by the DELF-HA TROJAN! LaunchAdware.exe GoGoTools adware

X X X X X U X X X X U X X X X X X X U X X X X X X X X X Y U ? X X X X N Y X X ? X N U ? N ? ? U X ? ? N X N X X N X X X X X X U N N X X U U

RUNGogoTools GoGoLaunch.exe GoGoTools adware RUNHYPER hyperx.exe PurityScan/Clickspring adware runing win.exe Added by the DELF-LC TROJAN! RUNLOAD l0ad.exe PurityScan/Clickspring adware RUNLOUD loud.exe PurityScan/Clickspring adware Runmarc8mManager marc8m95.exe MARC Sound System Manager for the Marc 8 MIDI sound card - allows for easy adjustment of the settings Runner lsass.exe [trojan filename] Added by the DROWSY-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Runner csrss.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Runner lsass.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Runner svchost.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M RunOnce RUNONCE.EXE Part of MS Data Access Components - only required if you use these RunOnceEx sms.exe Identified as the DELF.LF by Ewido Security Suite RunProg Server.exe Added by the OPTIX.04.A TROJAN! RunProg wini.exe Added by the OPTIX.04.D TROJAN! runreper viewer.exe Added by the REPER.A VIRUS! runs run.exe Added by the RBOT-BWF WORM! RunSearvices tread.exe Identified as the DELF.LF by Ewido Security Suite RunServices runsvc32.exe Added by the AGOBOT.QJ WORM! RunSysd32 RunSysd32.exe DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It Runtime Process Csrss.exe Added by the CIADOOR-J TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Runtt1 Internat.exe Added by the LINEAGE-R TROJAN! Runtt1 Internet.exe Added by the LINEAGE-Q TROJAN! RunWin [path to file] Added by the BANKER-ES TROJAN! runwin32 runwin32.exe Added by the ESEARCH-A TROJAN! RUNWIN32 runwin32.exe Added by the VB-AET TROJAN! RunWindowsUpdate uptodate.exe BrowserAid/BrowserPal foistware Run[0] syscnfg.exe Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside Run_cd Run_cd.exe Added by the GHOST.23 TROJAN! run_pbnext PBNext.exe PBNext is virtual phone system which offers the same functionality as expensive PBX hardware Rupsw32 Rupsw32.exe MegaTec Rups, UPS monitoring software - monitor and control DB9 UPS running on either Windows & Novell NetWare (with RUPS 2000) or Unix (with RUPS for Unix / Plus) operating systems RUSBHOLoader rundll32.exe RUSBHOLoader.dll, AutoRegister ?? RVC6Player tskdbg.exe Added by the ZAPCHAS-M TROJAN! rvde N/A Related to li-speed**** RVP bpc.exe Spyware included with the latest version of Grokster. Also see here rx rundll32.exe Added by the Lineage-BP TROJAN! Note - this is not the legitimate Windows process (Which is found in the Windows folder for 9xMe and the System32 folder for NT2KXP). This file is found in the Window RxMon rxmon9x.exe Dell Resolution Assistant r_server r_server.exe Radmin - remote admistrator server r_server service.exe Added by the MULTIDR-CP TROJAN! S0undMan svch0st.exe Added by the LOVGATE.AB WORM! Note - the filename has the digit 0 rather then the uppercase "o" S24EvMon S24EvMon.exe Event Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required? S3 Internal Chip s3serv.exe Added by the AGOBOT-DD WORM! S3apphk S3apphk.exe A tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems S3Hotkey s3hotkey.exe Hotkey system tray icon to enable switching between monitors. Found on laptops with an S3 Twister integrated graphics card S3Mon S3Mon.exe S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required? S3TRAY S3Tray.exe S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display s3tray2 s3tray2.exe Same as the s3tray entry in this table? S3TRAYHP S3trayhp.exe S3 Video driver related. What does it do and is it required? S4F S4F.exe S4F internet filtering software s4helper s4helper.exe Searchcentrix hijacker SA Sa3.exe Logitech QuickCam driver. Is it required? SA Service SAservice.exe Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required? Sa3dsrv Sa3dsrv.exe 3D sound extension for Windows saap saap.exe NCase adware Sabreserver SABSERV.EXE Airline reservation software from Sabre. Available via Start -> Programs sac sac.exe NCase adware SACC sacc.exe SurfAccuracy adware SAClient RegCon.exe AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are d Safe SafeWin.exe Added by the FOCOSENHA TROJAN! Safe [path to trojan] Added by the BANKER-DT TROJAN! SafeGuard Popup Blocker Updater regsvr32 [path] sfgupd.dll SafeguardProtect/Veevo hijacker SafeGuard Popup Blocker Updater (required) regsvr32 [path] sfg****.dll [* = ramdom SafeGuard char/digit] Protect/Veevo - hijacker SafeGuard Popup Updater (required) regsvr32 [path] sfg****.dll [* = ramdom SafeguardProtect/Veevo char/digit] hijacker SafeGuard Popup Updater (required) regsvr32 [path] PDF****.dll [* = random SafeguardProtect/Veevo char/digit] hijacker SafeHouseSystemTray SDWTRAY.EXE SafeHouse "Personal Privacy" system tray icon - PP protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encrypted SafeInstall.exe SAFEIN~1.EXE Monitors a download and ensures an newer version of a file isn't replaced by an older one SafeOFF SafeOff.exe Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation SafeSearch safesearch.exe SafeSearch.A adware SafeSurfingUpdate SSUpdate.exe MoneyTree parasite - ActiveX control used to download premium-rate dialers SafetyNet ipcTray.exe Safety.Net from Netveda - "offers Internet security, content security and advanced Internet firewall protection for all your LAN computers, and trust controls to block unwanted or harmful applications fr SafetyNet_Notifier ipcLn.exe Safety.Net from Netveda - "offers Internet security, content security and advanced Internet firewall protection for all your LAN computers, and trust controls to block unwanted or harmful applications fr

U X N U X X X X X U X X ? U X X X X U U X X N X X U X U U Y X X X X X U U N X X U U N U N X X N X U N U U ? Y X X ? X ? X X X ? ? N Y X X X

Safeworld Sagate Security Firewall SAgent2ExePath SAGENTSERVICE sagnt SAHagent SAHBundle SAHBundle saie SAIMON sain sais SaiSmart SaitekAutoConfigure Sakemsneql salm salm Sam-sung SAMcal Sametime Connect Samsong Samsung SandIcon sapp saSyncMgr SATARaid satmat SAUpdate SAutoLaunchExe SAVAgent Save SaveDate Savenow Savenow SAW Say The Time 5.0 SB SB Audigy 2 Startup Menu SB Watchdog SB13mini SBAutoUpdate SBC Self Support Tool SBC Yahoo! Connection Manager SBDrvDet sbdrvdet SBHC SBMPOP SBMX sbss Launcher SbUsb AudCtrl sc sc sc sc23exec SC3300CC ScamDisk scan Scan Detector Scan Register Scan Wizard ScanDisc ScanDisk scands32.exe ScanFile ScanInicio Scanner Detector Scanner File Utility Scanreg ScanRegistry ScanRegistry

Freedom.exe sagate.exe SAgent2.exe Sagent.exe sagnt.exe Sahagent.exe bundle.exe shop1003.exe saie.exe SaiMon.exe sain.exe sais.exe SaiSmart.exe saicnfig.exe simenu.exe salm.exe salm.exe Sam-sung.exe SAMcal.exe Connect.exe Samsong.exe Samsungs.exe SandIcon.exe sapp.exe rundll32.exe sasync.dll, SyncWait SATARaid.exe satmat.exe SAUpdate.exe SAutoLaunchExe.exe SAVAgent.exe Save.exe SaveStartDate.Exe SaveNow.exe savenow.exe saw.exe SAYTIME.EXE SB.exe /l:eng SBWatchdog.exe RYZO32.EXE sbautoupdate.exe matcli.exe ConnectionManager.exe SBDrv.exe sbdrvdet.exe sbhc.exe SBMPop.exe sbmx.exe sbss.exe RunDll32 sbusbdll.dll, RCMonitor scrubxp.exe sc.exe run.exe sc23exec.exe SC3300CC.exe SVOHOST.exe mscman.exe Pmxdetect.exe ssms.exe button.exe satan.exe ScanDisk.exe scands32.exe ?? Inicio.exe SDetect.exe NsCatCom.exe [filename] nsrvnt.exe scanregv.exe

SafeWorld Internet Security Added by the GAOBOT.BOW WORM! Seiko Epson printer status agent. Disable if printer is not used often Added by TinySpyAgent Note - this application must be manually installed Adware web downloader ShopAtHomeSelect parasite ShopAtHomeSelect parasite ShopAtHomeSelect parasite NCase adware Saitek joystick driver NCase adware NCase adware Smart Button Special Sauce - included with the latest software for Saitek game controllers. Related to the "S", "Shift" or "Smart" button and gives gamers extra features on the buttons. Only required if Configuration for Saitek game controllers Added by the SDBOT.BTO WORM! 180Search adware NCase adware Added by a variant of the SDBOT WORM! SamCal - calendar/reminder program IBM Lotus Instant Messaging and Conferencing software Added by the SDBOT.BNE WORM! Added by an IRC_TROJAN variant! SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it NCase adware Browser hijacker - redirecting to Searchant.com RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives VX2.Transponder parasite updater/installer related Big Brother from Quest Software. System and network monitor Sharp Zaurus PDA related, needed to synchronize information with a Desktop or Notebook Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly, e.g. automatically updating PCs used by dial-in home or out-of-office users WhenU.Save adware Unidentified adware WhenU.Save adware Added by the SPREDA.B VIRUS! SmartAdware adware This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularly Acer Soft Button on Acer Tablet PCs Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank. See here for more information Added by the SPYBOT-EJ WORM! SpywareBlaster auto-updater matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. The SBC Self Used to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should Detects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one Checks to see if Creative sound card driver should be updated SuperBar parasite - uninstall available here SearchByMedia adware SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only) SideBySide adware Control for Soundblaster MP3 external (USB) sound card ScrubXP - utility that deletes safe to remove files, cookies, browsing history, etc Watchdog 2.0 Software - monitoring program All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes, remembers addresses of Internet pages visited, and maint Possibly related to a digital camera SiPix digital camera Twain device driver Added by the LEWOR.D WORM! ClientMan parasite variant Associated with PrimaScan scanners. Is it required? Added by the RBOT-AT WORM! Associated with ScanWizard as supplied with Microtek scanners - see also Scanner Detector or SDetect. What does it do and is it required? Added by the GREGSTAR TROJAN! Added by the GANDA.A WORM! Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checker Added by a variant of the Adclicker TROJAN! ?? Part of Panda Anti-Virus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation Added by the QQPASS.E TROJAN! Added by the NERTE TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe

Y X X X N X N X U X X N X X X X X X U X X X X U U X U X N Y X X N N X N X U U U X N N ? ? Y Y U X X X Y X U X X X U U X X X N X X ? X X X X

ScanRegistry Scanregw.exe ScanRegistry Scanregw.exe ScanRegistry N/A ScanRegistry scanregw.exe ScanSpyware v * Scanner.exe scApp scApp.exe SCardSvr scardsvr.exe SCardSvr SCardSvr32.Exe SCDEmuApp.exe SCDEmuApp.exe scheck45 scheck45.exe ScheduIe nrchk.exe Scheduled Maintenance Scheduled_Maintenance.exe Scheduler expIorer.exe Scheduler MSMSGS.EXE Scheduler outIook.exe Scheduler svcrhost.exe Scheduler svcshost.exe Scheduler winagent.exe Scheduler Scheduler daemon.exe Scheduler Service wsass.exe SchedulerMgr navchk.exe Scheduling Agent Scheduler.exe SchedulingAgant MMTASK.EXE SchedulingAgent mstask.exe SchedulingAgent mstinit.exe SchedulingAgent N/A Schmaili Schmaili.exe schost [path to trojan] SchSvr SchSvr.exe SCHWIZEX SCHWIZEX.EXE ScManager scman.exe scopedll scopedll.exe Scotia OnLine Recovery etdirrcv.exe Scotia OnLine Security v*.* Recovery etdirrcv.exe Scr scr.scr ScrapPad Scrappad.exe scrbmk [path to trojan] Screen Calendar scrcal.exe Screen Guard launch.exe Screen Guard Message Scan sgms.exe Screen Saver scrnsaver.scr Screen Saver Control FSScrCtl.exe ScreenPrint32 ScreenPrint32.exe screxe scruser2k.exe script script.bat ScriptBlocking SBServ.exe ScriptSentry Scriptsentry.exe Scroll-In-Mouse V2.0 SCROLL.EXE scrsvc scrsvc.exe ScrSvr ScrSvr.exe ScrSvrOld [worm filename] Scsi Scsi.exe scvhost svzhost.exe scvhost scvhost.exe scvhost loader ixplore.exe scvhost.exe scvhost.exe sd32info sd32info.exe SDaemon sdaemon.exe SDAutoLiveupdate LiveUpdateSD.exe SDAv csnss.exe SDAv svhost.exe sdchosts32 vbdd.exe SDetect SDetect.exe sdfsdfsdf sp2update.exe SDIN Adapter sdin.exe SDJobCheck triggusr.exe SDK Codre Function22 sdkimddprovment2.exe SDK Core Component sdkcore.exe SDK Core Function sdkimprovment.exe SDK Core Function2 sdkimprovment2.exe

Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows direct Added by the STATOR WORM! Not to be confused with the legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%System (where %windir% Added by the DINOXI or DINOXI.B WORMS! Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found Spyware remover (where * = the version number) - not recommended, see here Added by the STANDO-E WORM! Related to SmartCard readers and sometimes uses lots of system resources Added by the MOFEI.B WORM! Related to PowerISO - CD/DVD image file processing tool Related to unknown malware - hidden installer associated with it Premium rate adult content dialler Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs Added by the TACTSLAY.A TROJAN! Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32Config or WinntSystem32Config folder, and should not be mistaken for the MSN Messenger Added by the TACTSLAY.A TROJAN! Added by the TACTSLAY.A TROJAN! Added by the TACTSLAY.A TROJAN! Added by the TACTSLAY.B TROJAN! Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleanings Added by the LIOTEN.KX WORM! Premium rate adult content dialer Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily schedu MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily schedu Added by the DINOXI or DINOXI.B WORMS! Schmaili - insert animated smilies into your e-mail Added by the TJSERV.D TROJAN! WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> P Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part ta Added by the FORBOT-CW WORM! Added by a variant of the CRYPTER.C TROJAN! Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank Added by the OPASERV.T WORM! ScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper Added by the DLOADER-VP TROJAN! Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler Part of Access Denied security and privacy software Part of Access Denied security and privacy software Added by the RBOT-AGP WORM! Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon ScreenPrint32 screen capture software - can be launched manually ?? Maybe associated with DOS on a Win9x machine Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruse Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features Added by the AGENT-DS TROJAN! Added by the OPASERV WORM! Added by the OPASERV WORM! SCSI Miniport driver Added by a variant of the SPYBOT WORM! Wiretap is a surveillance software program that monitors and records keystrokes, programs executed, Web sites visited, and Instant Messenger conversations. If you didn't install this yourself, remove i Added by the SDBOT-CY TROJAN! Added by the LOHAV-N TROJAN! Added by the CRYPTER.A TROJAN! PC Security from Tropical Software. 'PC Security(tm) 5.1 is the ultimate in computer security, offering multiple locking systems for the Windows environment and internet. Lock files, monitor programs' a Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Added by the SERFLOG.C WORM! Added by the SERFLOG.C WORM! Added by the RANKY.AG TROJAN! ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting Added by a variant of the SPYBOT WORM! Added by the FORBOT-AP WORM! Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup? Added by the SDBOT-YJ WORM! Added by the SDBOT-WC WORM! Added by the RBOT.BHL WORM! Added by the SPYBOT.OGX WORM!

X X X X X N X U U X U ? X X X X X X X X X X X X X U U X X U U X X U X X N N N U X X X X X N U X X X X X X Y X X X ? X X U X U X X X X X X X

Sdk**.exe [* = random char] Sdk**.exe [* = random char] Sdk**32.exe [* = random char] SDKcore Update Components2 sdkupdate22 SDPhotoBar.exe sdrss sds20 SDTray sdxsys32 sealmon Search Hook Search Page Search-Exe Search.vbs searchbar SearchEnhancement searchnav SearchNavVersion SearchSetter SearchSquire[number] SearchUpgrader Secboot secboot secboot Second Copy 2000 SecondChance Secret Secret-Crush SECRETMAKER SecretSmileys secserv.exe secsvc32 Secsys secure secure SecureClean4RegManager SecureClean4Tray SecureCleanIEClean SecureItPro SecureLogin Security Accounts Manager SM Security Agent Security Agent Manager Security Center Security iGuard Security Manager Security Patch Security Patch Security Patches Security Patches security service securw SECWIZ98 seekmo seeve Select server SelfHostUtil seli SemanticInsight SeMS Sen Sensiva SENTRY Sepate Security Firewall Serials SernellApp.pcx serpe serpe serpe

Sdk**.exe [* = random char] Sdk**.exe [* = random char] Sdk**32.exe [* = random char] SDKC0R3.exe SDK0mCORE.exe SDPhotoBar.exe sdrss.exe svchost.exe sdtray.exe sdxsys32.exe sealmon.exe srchhook.exe http://find.naupoint.com SE.exe vnmispoisn downloader.exe scbar.exe searchnav.exe searchnavversion.exe searchsetter[1].exe SearchSquire[number].exe SearchUpgrader.exe w32tm.exe mszx23.exe vtd 16.exe SecCopy.exe sctray.exe Secret.exe start.exe secretmaker.exe ss.exe secserv.exe secsvcnt.exe Secsys.exe secure.exe svshost.exe scregmanager4.exe sctray4.exe SCIEClean.exe Secureitpro470p.exe Mslg32.exe samsm.exe securag.exe mssams.exe AppControl.exe Security iGuard.exe SecurityManager.exe scmss.exe WinUpdate32.exe msnkn.exe WinLab32.exe syss.exe Nctrup.exe SECWIZ98.EXE seekmo.exe seeve.exe slcsvr.exe slefhost.exe [path to file] SemanticInsight.exe SeMS.exe tlii.exe Sensiva.exe SENTRY.exe sepate.exe serials.exe csrss.exe formatsys.exe msmbw.exe serbw.exe

Sdk**.exe [* = random char] CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Added by the RBOT-ABA WORM! Added by the FORBOT-DT WORM! SmartDraw Photo - "organize, enhance, print, and share your photos. It's also a powerful graphic editor for creating images and web graphics" Added by the SDBOT-SQ WORM! InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this should not be confused with the svchost.exe system process which is always located in th RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic, confidential and digitally signed Added by the BROGGER-A TROJAN! SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Email ?? Naupoint browser hijacker Search-Exe hijacker Hijacker SearchBarCash adware variant SCBar foistware SearchNav adware - IEFeatures/Popnav variant SearchNav adware - IEFeatures/Popnav variant Browser hijacker - redirecting to FindWhateverNow.com SearchSquire adware Hijacker Added by the HAXDOOR.D TROJAN! Added by a variant of the HAXDOOR.D TROJAN! Added by the HAXDOOR-AE TROJAN! Related to Second Copy(r) - a files/folders backup utility Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash Added by the DELF-LW TROJAN! Hijacker that may reset your browser's home page and/or search settings to point to undesired sites Secretmaker is a combonation of eight privacy-defending programs, including Spam Fighter Pro, Worm Hunter, Pop-Up Killer, Banner Blocker, Cookie Eraser, Privacy Protector, History Cleaner, and Garb Secret Smileys is an add-on for AIM(r) that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as Reported by Panda as an EasySearch Adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer Added by the GLOBAL PATROL TROJAN! Key Interceptor - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it DealHelper adware Added by the RBOT-AFO WORM! WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data, MRUs, temp files and more. Can be started manually WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data, MRUs, temp files and more. Can be started manually SecureClean - scans your system for hidden temporary files, deleted email messages, Internet histories and caches SecureIt Pro - lock your computer when you're not there, to stop malicious users from accessing your desktop Added by the REDZED WORM! Added by the SPYBOT.JE WORM! Added by the BANCBAN-F TROJAN! Added by the RBOT-SV WORM! Added by the SDBOT.CFT WORM! Spyware remover - not recommended, see here A ComCast Internet software suite that provides a variety of features (firewall, popup blocker, parental controls etcetera) to help ensure your computer is secure, and your information is kept private Added by the RBOT-ZW WORM! Added by the SDBOT-BM WORM! Added by the RBOT.WW WORM! Added by the SDBOT-KB WORM! Added by an unidentified WORM or TROJAN! Added by the NOPIR.A WORM! Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here Seekmo Search, a 180Solutions adware variant - also see here Added by Medload ADWARE! Added by the DLOADER-WD TROJAN! ?? Added by the LOWZONE-AS TROJAN! Added by RXToolbar ADAWARE! Software that displays pop-up/pop-under advertisements when the primary user interface is not visible PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone Reported by Kaspersky Anti-Virus as Win32.PurityScan.ah. This file is usually found in the Program Filesbama folder Symbol Commander makes the use of your PC, laptop, Tablet PC, and Pocket PC much easier and much faster. It recognizes your handwriting with unparalled performance and executes commands in a From IP Insight. Allows website owners "to instantly determine the precise geographic location, connection speed and detailed demographics of every visitor to your website". Will be detected by most f Added by a variant of the RBOT WORM! Any one of a variety of worms and trojans Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the SERFLOG.A WORM! Added by the SERFLOG.A WORM! Added by the SERFLOG.A WORM!

Y X N X X X X X X X U X X X X X X X N N X X X X X X X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X X X X U X Y X X X X X X X X

serrdctl.exe SERV PacK2 Serv-U Serv-U server server server Server Backbone SERVER.EXE serverex Service Service Service Service Service service Service Service Cleaner Service Connection Service Connection Service Controller Service Controller Service Drivers Service Drivers Service Drivers Service Drivers Service Host Service Host Service Host Service Host Service Host Service Host Driver Service Manager Service Manager Service Manager service manager Service Monitor Service Monitor Service Monitor Service Monitor Service Monitor Service Pack Service Pack DLL Runtime Service Process Service Process Service Process Service Process Service Process Service Process Service Registry NT Save Service Registry NT Save Service Registry NT Save Service Scheduler Service System Service System Service System Service System service updaer Service.exe ServiceConfig serviceconnect ServiceLayer servicemng services Services Services Services Services Services Services

serrdctl.exe nerx.exe serv-u32.exe wssdsu.exe server.exe system.exe server.exe server05.exe SERVER.EXE Server.txt.vbs service.exe [trojan filename] services.exe SYSNT.exe Service.pif wN2S.exe service.exe filen.exe sccenter.exe bwtray.exe Csrrs.exe service.exe msnpg.exe PC.EXE Compt.exe abl.exe [filename].exe spoolxx.exe svchost.exe svchost.exe svchost.exe svchost.exe sqlmangr.exe SERVICEMGR.EXE dxsound.exe service.exe msnfilen.exe javams32.exe javams64.exe msnserve.exe WinOcx.exe [various filenames] spdll32.exe SVCHOST.EXE winset.exe service.exe smss.exe smss.exe svchost.exe jdbgmgrnt.exe taskmgrnt.exe regeditnt.exe scheduler.exe kernels32.exe windowsXP.exe kgbfsm344.exe wernell87.exe qualityz.exe Service.exe ispbeg.exe serviceconnect.exe ServiceLayer.exe service.exe start.bat [path to trojan] back32.exe ...service.exe services.exe winread.exe windns.exe mshost.exe

Shared Modem Service Client Event Viewer - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems Added by the SDBOT-ACP WORM! FTP server Added by the MANIFEST TROJAN! Added by the DELTAD.A WORM! Added by the METHS-A TROJAN! Added by the SINGU-Q TROJAN! Added by the RBOT-ZM WORM! Added by the BUSHTRO122 or SMOKODOOR TROJANS! Added by the DELTAD.A WORM! Added by the ALADINZ.H TROJAN! Added by the KAITEX.E TROJAN! Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally f Added by the CHA TROJAN! Added by the ASSIRAL-C WORM! Added by a variant of the RBOT WORM! Added by the ALADINZ.H TROJAN! Added by the RBOT.BRH WORM! For Compaq PC's. Part of Backweb For Compaq PC's. Part of Backweb Added by the GAOBOT.AO WORM! Added by the PREVERT TROJAN! Added by the RBOT.BMD WORM! Added by the SDBOT-WK WORM! Added by the RBOT-ZJ WORM! Added by the SDBOT-YX WORM! Added by the TORVEL.B WORM! Added by the TORVEL WORM! Added by the DAOSER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the DAOSER-C TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf SQL Server Service Manager - provides tray access to SQL server, the server agent and MSDTC. Available via Start -> Programs Added by the PASSMAIL-D VIRUS! Added by the PROXY-GRIC TROJAN! Added by the DONBOMB.A TROJAN! Added by the RBOT-ALE WORM! Added by the DELF-NK TROJAN! Added by the SDBOT-AFO WORM! Added by the SPYBOT.YQW WORM! Added by the RBOT-AQJ WORM! Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif o Added by a variant of the RBOT WORM! Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by a variant of the SPYBOT WORM! Added by the DCMBOT-C TROJAN! Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the DCMBOT-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the BANCOS-CG TROJAN! Added by the BANCOS-BY TROJAN! Added by the BANCOS-BM TROJAN! Added by the AGOBOT-PH WORM! Added by the BANCOS-DA TROJAN! Added by the BANCOS-EL TROJAN! Added by the BANCOS-FS TROJAN! Added by the BANCOS-FJ TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! - probably a SPYBOT variant servedby.advertising popup generator Comcast Transition Wizard. On June 30th, 2003 it will migrate E-mail and web pages from AT&T Broadband Internet to Comcast High-Speed Internet. Until then it will run at startup and then terminate Added by the AGOBOT.AIR WORM! Nokia Connectivity Library support task that is needed by NCLTRAY and by the Nokia Connection Manager for either to work properly Added by the TAME-C WORM! Added by the ZCREW TROJAN! Added by the METEORSHELL TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Back32.exe is the baddie whose purpose is to HIDE the MIRC32 server in service.exe Added by a number of VIRUSES, WORMS and TROJANS! Note - this is not the legitimate services.exe process which should NOT appear in Msconfig/Startup! Added by an unidentified VIRUS, WORM or TROJAN! Added by a variant of the RBOT WORM! Added by the LANFILT-J TROJAN!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ? U X X ? N U X N N N N N N X X ? X N X X X N X ? X X X

services Services Services Services Services services services Services Services Services Services Services Administrator Services Administrator Services Administrator Services Administrator Services Administrator Services Administrator Services Administrator Services Administrator Services Controller Services Controller Services Host Services Host Services Logon Services Process Services Process Services Startup Services Startup Services.dll Services.EXE services.exe Services004 services32 services32 services32 Services32 Startup ServicesLoad ServicesLog Servicing Servicio Local servics SERVlCE ServUTrayIcon Session Client Session Manager Subsystem SESync SetDefaultMIDI setdefprt SetecCertUtil setFTPBack SetHook SETI@home seticlient SetIcon SetiQueue SetiSpy SetPoint SETPOINT Logitech Inc SetRefresh Setting setup Setup experation setupa setupdata SetupICWDesktop setupuser setuzp SetVrc Sex Teris Sexnow

Svchosts.exe csrss.exe scks32.exe sockys32.exe sys.exe windows32.exe socks.exe services.exe [path to trojan] iexplore.exe svchost.exe localsvc.exe netsvc.exe spoolsvc.exe svcadmin.exe svcman.exe svcrun.exe tcpsvc.exe websvc.exe lsassa.exe services.exe Scchost.exe svchost32.exe services.exe services.exe smss.exe services.exe svhost33.exe smss.exe services.exe Services.exe [worm filename] mc-110-12-0000079.exe mc-58-12-0000120.exe mc-58-12-0000140.exe win32dll.exe lsass.exe ccapp32.exe hostd.exe svhost.exe servics.exe SERVlCE.EXE ServUTray.exe sescli.exe smssa.exe sed.exe MIDIDef.exe setdefprt.exe Certutil.exe createsw.exe SetHook.exe [email protected] [email protected] SetIcon.exe Setiqu~1.exe SetiSpy.exe SetPoint.exe KHALMNP.exe SetRefresh.exe sysweb.exe hphprld.exe ....setup.exe svchost.exe runt32.exe rnll32.exe icwconn1.exe regedit.exe setupuser.log setuzp.exe setvrc.exe st01b.exe Sexnow.exe

Added by the SDBOT.N WORM! Added by a variant of the RANKY.U TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Added by a Proxy Trojan variant Added by the RANKY.L TROJAN! Added by a Proxy Trojan variant Added by the FLYVB-C WORM! Added by the WIN32.SMALL.N TROJAN! Added by the ZINCITE.A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the RANCK-DB TROJAN! Added by the MOGI WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in M Added by the REPER-B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the CIADOOR.122 VIRUS! Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the DONK WORM! Added by the AGOBOT-TG WORM! Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by unidentified spyware - recognized by Kaspersky antivirus as Small.X TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Added by the SMALL-EK TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by a variant of the RBOT WORM! Added by the SOBER-L WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the KAZPING WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the BUGBROS WORM! Added by the TrojanDownloader.Agent.rv TROJAN! Shorty adware - also detected as the AGENT.FD TROJAN! Shorty adware - also detected as the AGENT.FD TROJAN! Added by the SDBOT-XO WORM! Added by the DEARIS-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the RBOT-AMX WORM! Added by the SDBOT.BUI WORM! Added by a variant of the RBOT WORM! Added by the SINGU-J TROJAN! Added by the AGOBOT-UB WORM! System Tray icon for Serv-U FTP server. Is it required? SurfSpy keystroke logger/monitoring program - remove unless you installed it yourself! Added by the RBOT-AGS WORM! DownloadWare adware Related to a Soundblaster Audigy soundcards. What does it do and is it required? Setdefprt is used to set a Brother MFC printer/copiert/scanner as the default printer after installation Setec Web and Email Security. Setec PKI smart card software. The PKI technology enables secure and reliable user identification in services offered through Internet, mobile handsets and digital TV Added by the FTP_BMAIL TROJAN! Fellowes Neato CD label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and an SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and an Installed by a 6-in-1 (4 Media Card slots, a floppy drive and a USB connection) device. Constantly updates the icons for the four Media Card slots that it has and is a resource hog Provides work unit buffering for Seti@Home clients - see here for more details From the site - 'SETI Spy is a little program I wrote to "spy" on the progress and performance of the SETI@home client. I call it a "spy" because I tried to make it as unobtrusive as possible' Added by the RBOT-BWI WORM! Added by the RBOT-AAX WORM! Found on a Compaq PC. Video refresh rate utility? Is it required? Added by the SDBOT.GEN TROJAN! HP DeskJet Setup - printers function normally without it Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the QQPASS-K TROJAN! Added by the QQPASS-AC TROJAN! Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessor Regfile in disguise - another CoolWebSearch parasite variant ?? Added by the HUNTOCX WORM! Added by the REPAD WORM! Added by the SENOW-B premium rate adult content dialler

X X X N X N U X U U U N ? U X X X N N U X Y N N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X ? X N X N

Sexy_Blondes Sexy_Blondes.exe Added by the Sexy DIALER!. Related also to Hot Tarts DIALER! Sexy_sg Sexy_sg.exe Premium rate adult content dialler sf sf.exe SurfEnhance adware component SFIGUI SFIGUI.EXE Sonic Focus - "enhances music, movie and game sound by analyzing compressed audio streams in realtime, then restoring and enriching audio back to its original performance qualities" sfita sfita.exe Added by the FAVADD-H TROJAN! Also known as SurfEnhance adware SFP vzSFPWin.EXE Verizon Online Support Center - prompts for online updates sfpc sfpc.exe Spy4PC is a surveillance software program that monitors user activity, logs keystrokes, and takes screenshots. If you didn't install this yourself remove it SFtrb Service cftrb32.exe Added by the SOBIG.D WORM! SfWinStartInfo sfWinStartupInfo.exe SFIRM32 Online Banking software Sgecrypt Sgecrypt.exe SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful a Sgeecview Ecview.exe SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful a sginst sginst.exe eAcceleration Stop-Sign related - not recommended, see note SGTBox SGTBox.exe Canon scanner driver. Is it required? sgtray sgtray.exe StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - war shambl3r cnf.bat Added by the REMABL WORM! shambl3r* shambl3r.exe Added by the REMABL WORM! where * is 2 to 11 Shania Shania.vbs Added by the SHANIA VIRUS! - NOTE: this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Share-to-Web Namespace Daemonhpgs2wnd.exe HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites. In other words an application that allows users to upload scanned images to thei Shareaza Shareaza.exe Shareaza P2P client Shareaza bindata.exe Shareaza P2P client related sharedprem sharedprem.exe Added by the MAKECALL TROJAN! Sharing and Mapping Software DShmap.exe Intel AnyPoint internet sharing software SharkEject AEJCT32.exe Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded, there is a desktop icon so this isn't required Shcenter chcenter.exe IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" SheduIer svchst.exe Premium rate adult content dialler SheduIer shch.exe Added by the EB TROJAN! SheduIer winagent.exe Added by the EB TROJAN! Shedule Connection arpo412.exe Added by the PPDOOR-R WORM! Sheduler nerocheck.exe Added by the TACTSLAY.B TROJAN! Shell Shell32.exe Added by the BADSECTOR TROJAN! Shell ray.exe Homepage hijacker re-directing browsers to adult content websites Shell Tray.exe Homepage hijacker re-directing browsers to adult content websites Shell wmedia16.exe Added by the GOLDUN TROJAN! Shell Open32.exe Added by the SMALL-DL TROJAN! Shell Explorer.exe sound_drive16.exe Added by the GP TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manua Shell Explorer.exe, msmsgs.exe Added by the ZLOB TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it man Shell Explorer.exe [path] svchost.exe Added by the DOYORG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco shell explorer.exe Added by the KAKKEYS TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m Shell iexplore.exe Added by the KIPIS-U TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure i Shell ibm0000*.exe [* = digit] Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe, ibm00002.exe, ibm00005.exe and so on Shell taskmrg.exe Added by the BANCBAN-FT TROJAN! Shell Explorer.exe winupdate.exe Added by the AGENT-FD TROJAN! Shell ibm[RANDOM 5 DIGIT NUMBER].exeAdded by the ANSERIN TROJAN! Shell svchost.exe Added by the GOLDSPY-B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Shell API32 svcnet.exe Added by the TIBICK.C WORM! Shell Extension spollsv.exe Added by a variant of the LOVGATE WORM! Shell Tray Window ShellTraywnd.exe Added by the STULTDOR-A TROJAN! shell update shellexec.exe Added by the AGOBOT-TH WORM! Shell32 Shell32.vbs Added by the SCAFENE WORM! shell32 ntldrt.exe Added by the JLOK-A WORM! Shell32 iexplore.exe Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fi ShellApi SHELLMSN.EXE Added by the NETDEV.B TROJAN! Shellapi32 Shellapi32.exe Added by the NETDEVIL (or NERTE) TROJAN! Shellapi32 mcvsrte.exe Added by an unidentified WORM! Note - do not confuse with the McAfee SecurityCenter file of the same name ShellCommand [path to file] Added by the REMCON-A TROJAN! ShellEx ShellEx.exe Added by the ANAKHA TROJAN! ShellOS A+++.exe Added by the AV TROJAN! ShellRun lexplore_.exe Added by the MSNOPT-A TROJAN! ShellRun32 iexplore.exe Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fi Shellspl lsas.exe Added by the YALER-A TROJAN! Shellspl spools.exe Added by the PROXAGE-A TROJAN! shellsystem shellsystem.exe Added by the UPCHAN TROJAN! shhost shhost.exe Added by the AGENT.CE TROJAN! shicoxp shicoxp.exe Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the va Shine Shine.exe Added by the HAPPYLOW (or NISHE-A) VIRUS! SHINITV shinitv.exe ?? Shmgrate.exe ibot4.exe Added by the GASTER TROJAN! ShockmachineReminder SmReminder.exe Shockmachine is an entertainment playback device that lets you save your favorite Shockwave.com titles and play them back in full-screen mode, off-line, anytime. Could be a registration reminder for Shockwave csrss.exe Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ Shockwave Init SWINIT.EXE Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shock

N Y X X ? ? U X U U Y U U ? X U X U X N N ? ? X N U X U X N X U U Y ? N U U ? U ? ? U X X U X X X X N X U U U U X X Y X X N Y X X N U X N N

ShortKeys 99 SHORTKEY.EXE ShortKeys from Insight Software Solutions - allows you to program keys with text strings sHotKey sHotKey.exe Special function key manager for Chicony keyboards - see here Showbehind SHOWBEHIND.EXE Advertisement display which can be stopped here ShowFF ShowFF.exe Added by the Adware.FFToolBar adware toolbar ShowIcon_Justrams_USB Product Driver shwicon.exe v2.12r012 Related to Just Rams USB product driver. Is it required? ShowIcon_SmartDisk Corporation_USB shwicon.exe Card Reader v1.14e051 Card reader for memory cards from digital cameras. Is it required? ShowLOMControl Note the strange symbol in the command field. HKLMSoftwareMicrosoftWindowsCurrent VersionRunShowLOMControl Reg_DWORD 0x00000001 (1) LOM = LAN on Motherboard.It mean Show "LAN on Mo Showme Ruden.vbs Added by the HANDLE-A VIRUS! ShowWnd ShowWnd.exe Found on Gateway computers (and maybe others) - see here. "Showwnd is included with the Chicony keyboard software and is used by the software to stop the keyboard driver's taskbar entry from rea SHPC32 SHPC32.exe Port monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabled ShStatEXE SHSTAT.EXE From McAfee VirusScan NT 4.x. Handles program communication among VShield components, displays VShield icon. Can be started automatically or available via Start -> Programs Shutdownaware shutdownaware.exe Loaded by the SWEEX 6-in-1 Media Card Reader to properly manage the reader while it is connected to your system ShutDownPro ShutDownPro.exe ShutDownPro - shutdown, reboot, logoff your System with one mouse click Si Meter SIMETER.EXE ?? si91e44b rundll32.exe [path] si91e44b.dll, EnableRunDLL32 LZIO.com adware downloader SIAPRO6 sia.exe Steganos Internet Anonym privacy software Sicom Sicom.exe Added by the NETLIP WORM! SideACT SideACT.exe SideACT organizer software Sidebar Sidebar.exe Searchcentrix hijacker SIDEBAR dsidebar.exe Desktop Sidebar provides you with instant access to the information you most desire by grabbing data from your PC and the internet. The result is a dynamic visual display you configure and control SideWinderTrayV4 SWTrayV4.exe MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs SigmatelSysTrayApp stsystra.exe Related to Sigmatel. Appears to come preloaded SigX sigx.exe ?? SigXC SigX.exe SigX is a "dynamic signature image generated based on whatever data your computer sends it though our SigX program. It can display your current Mp3, current OS, Free Ram, your current time and m Simcast SimcastAlerts.exe Simcast is a free service that allows you to subscribe to information on a large variety of topics. Alerts will appear on your desktop when a channel that you have subscribed to has something to say SimpLite-MSN SimpLite-MSN.exe Required if you use the SimpLite add-on to MSN Messenger (SimpLite adds encryption to the instant messaging service) Singapore singapore.exe Adds a blue crescent to the taskbar and when double-clicked displays an adult-content web-site. Also known to drop your internet connection and dial an international telephone number. See here for m SIPPS SIPPSSIPPS.exe Web.de Internet phone utility SiS Dns dnssvc.exe Added by the DLOADER-UE TROJAN! SiS KHooker khooker.exe SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required SiS Mpc Service mpcsvc.exe Added by an unidentified WORM or TROJAN! SiS Tray sistray.exe System Tray icon for SiS based graphics. Note - this resides in C:WindowsSystem SiS Windows KeyHook keyhook.exe SIS graphics cards related: "Super VGA Keyboard Daemon" - hooks into the keyboard processing chain in order to enable hotkey settings SiS7012Utility SiSAudUt.exe SiS Corporation sound card driver SISAM10M SISAM10M.exe ?? SiSAudio MP_S3.exe WinME patch for an older SiS 961 chipset FERR bug. Enable if you have audio problems siscolor color.exe Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable th siService.exe siService.exe Spam Inspector - anti email spam software SiSPower Rundll32.exe SiSPower.dll, ModeAgent Responsible for power management for SIS chipsets - is it required? SiSRaid SRaid.exe Related to the SIS Raid system from Silicon Integrated Systems SiSSetCDfmt SiSSetCDfmt.exe Related to a Silicon Integrated Systems Corp (SiS) product? SISSoundman Soundman.exe Related to a Silicon Integrated Systems Corp (SiS) product? SiSSWLED sisswled.exe System Tray utility for SiS 900 network cards sistrai.exe sistrai.exe Added by the PROVA TROJAN! sistray sistray.exe Added by the PROVA TROJAN! sistray sistray.exe System Tray icon for SiS based graphics. Note - this resides in C:WindowsSystem Sistray32 remotehost.pif Added by the HOLCAS.A WORM! Sistray32 win.bat Added by the JUMPRED.A WORM! Sistray32 virus.exe Added by the TOMETA-C TROJAN! sistry sistry.exe Added by the CEBE WORM! SiSUSBRG SiSUSBrg.exe SiS USB Registry Patch File - fixes the undetectable problem with SiS USB controller on Windows XP sixtysix sixtypopsix.exe Added by Medload ADWARE! SK51 SK51.EXE SaveKeys keystroke logger/monitoring program - remove unless you installed it yourself! SK9910DM SK9910DM.EXE Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys SKDAEMON SKDAEMON.EXE Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys skinkers skinkers.exe Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's "Desktop Ozzy" and Arsenal's "Desktop Wenger" - see here. Leave enabled if you want to receive messages sks-32 SKS32P~1.EXE SpyKeySpy logs keystrokes and sends the stolen information to a configurable email address Skunk Skunk.exe Added by the SUNK-A WORM! Note - this file is found in the root folder (C:), (D:), etc SkyBlaster Scheduler SSFSch.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system skynetave.exe skynetave.exe Added by the SASSER.D WORM! SkynetRevenge winlogon.scr Added by the NETSKY.AA WORM! Skype Skype.exe Skype is free and simple software that will enable you to make free calls anywhere in the world in minutes SkySurfer Management Service SmaServ.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system sl4 rules rbot32.exe Added by the SDBOT-QC WORM! Slayhacker734 slay7383.exe Added by the SIKBOT-A TROJAN! SleepManager SleepMgr.exe This program locates free contiguous disk spaces and allocates them for storing BASE MEMORY, EXTENDED MEMORY, VIDEO MEMORY, and SM RAM. It helps the computer come out of hibernate mode SlickRun sr.exe SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords), so C:Progr slide Iexplore.exe Added by the GASLIDE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which should not appear in Msconfig/Startup unless you add it manually! slimp3 SliMP3 Server.exe Slimp3 Server - "presents an entirely new way of accessing and enjoying your music collection. Instead of storing your music on CDs or memory cards, the SliMP3 uses your home network to access the Slingshot SLINGS~1.EXE Atomica Slingshot - "reference tool with access to dictionary and encyclopedia terms, bios, technical terms, history, geography, and much more"

Y Y Y X X X X X X X N N N X N N U U N N N N U N N U U U N U ? Y Y Y Y X Y Y Y ? X N X U X U U X U U Y N X X X X X X X X X X X X X X X U N X

slipcore slipgui SlipStream slmss sload slvchost32 sm sm sm sm SM1BG SM1NINT Sm56acl sman Smapp Smart Card Service Smart Connect Monitor Smart Connect Setup Smart Label O Server Smart Label RFViewer Smart Start UP Smart Type Assistant Smartalec SmartBarXP sMaRTcaPs Smarthruengine SmartPCXL SmartSync Pro SMax4 SMax4PNP smbdpmi smc smc SMC Service SMC Service smcserv SmcService SmcServices SmcServices Smcsta.exe SmcSVR Smith Micro try SmoothView SMPAutoStart smres SMS Application Launcher SMS Client Service Sms System32 SMS Win9x Message Agent SMS Win9x Message Agent Smserial SMSI Loader smsm smsrv SMSS smss smss smss smss.exe smssLevel4 SMSSS SMSSS Loader SMSSU smsys smsys sms_msn sms_msn40 Smt SMToolbar SMTP32 Mailing Protocol

slipcore.exe slipgui.exe slipcore.exe slmss.exe sload.exe slvchost32.exe sa_exe.exe sf_exe.exe sm_exe.exe sr_exe.exe SM1BG.EXE SM1NINT.exe sm56hlpr.exe app***.tmp [* = digit] smtray.exe ScardSvr.exe SCMon.exe SCSetup.exe ssloserv.exe SSLFVIEW.EXE PnPDetect.exe sta.exe pcaccel.exe SmartBarXP.exe SMARTC~1.EXE QS.exe pcaccel.exe SmartSync.exe SMax4.exe SMax4PNP.exe smbdpmi.exe smc.exe spfsmc.exe smc.exe spfsmc.exe winsrv.exe smc.exe smc.exe spfsmc.exe Smcsta.exe SmcSVR.exe smiptray.exe SmoothView.exe smpdemo.exe smres.exe LAUNCH32.EXE clisvc95.exe SmsSystem32.exe ?? SMSMsg.exe sm56hlpr.exe SMLoader.exe smsm.exe smsrv.exe smss.exe [path to smss.exe] smss.exe smss.exe csrss.exe smss.exe smsss.exe smsss.exe SMSSU.EXE Explorer.exe vi.exe sms_msn.exe sms_msn40.exe SMT.exe SMToolbar.exe smtp32.exe

Core module for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to l User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to Core module for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to l SeekSeek search hijacker related - see here Win SynchroAd adware, also detected as DLOADER-QG TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Added by the OLFEB.A TROJAN! Added by the OLFEB.A TROJAN! Added by the OLFEB.A TROJAN! Added by the LUKUSPAM TROJAN! USB driver for downloading from within Napster to portable MP3 players. Only required at startup if you use it all the time - otherwise start it manually when required Cypress USB Mass Storage Driver Notification Icon Application - tray notification for Cypress base memory sticks and external storage devices for Win98 Helper utility for Motorola based SM56 software modems - resides in the System Tray Unidentified adware System Tray access for the Compaq/ADI SoundMAX integrated digital audio controller For Smart Card readers. Known to cause problems, especially for Windows 2000 users - see here. Probably not required unless you use such a device regularly Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Part of Presto! Mr.Photo - "an ideal program for creating, sharing, and manag-ing digital images and videos" Smart Type Assistant - a complex typing automation tool, intended to make your work faster and safer Smartalec PC Accelerator - system optimization utility SmartBarXP is a bar that runs down the side of your screen, and can be configured to display interactive panels known as 'panes'. These panes include media players, slideshow and image viewing pane sMaRTcaPs from Phoebus LLC - enables you to configure the time needed to depress Caps Lock, Num Lock & Insert keys Samsung smarthru software, used with Lexmark Z82 or Samsung multifunction printers Smartalec PC Accelerator - system optimization utility Related to CompanionLink Software Inc. Synchronization solutions for ACT!, GoldMine, Lotus Notes and Microsoft Outlook System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments IBM Netfinity Director and Universal Management Services related. What does it do and is it required? Sygate Firewall Sygate Firewall Sygate Firewall Sygate Firewall Added by the AGOBOT-OU WORM! Sygate Firewall Sygate Firewall Sygate Firewall SMC Networks wireless PCI card driver. Is it required? Added by the LEGMIR.JU TROJAN! Smith Micro shared files. Comes with D-Link web cam TOSHIBA Zooming Utility - allows "automatic" zoom feature in some appications, like IE, MS-Office, WMPlayer, Adobe Reader and also desktop icons Smart Phone Recorder demo from KenGolf.com. Answering Machine, Caller ID, Call Recording Added by the AGOBOT-UA WORM! Microsoft Systems Management Server - used to manage computers on a network remotely When the SMS Client service starts on a domain controller, the Client service modifies the SMSCliToknAcct & user account group membership, user rights, and account comment. The Client service then Unidentified malware This program assigns a user to a Systems Management Server site This program assigns a user to a Systems Management Server site Motorola based modem driver Smith Micro HotFax - fax software Added by the BANKER-CO TROJAN! Added by the AGOBOT-SX WORM! Added by the FLOOD.F TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfi Added by the ALADINZ.F TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Added by the AGENT-TR TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the BOROBOT-J TROJAN and variants! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Unidentified malware! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup Added by the SDBOT.ZD WORM! Added by the AGOBOT.MQ WORM! Hijacker, detected by Norton antivirus as Trojan.StartPage.O Added by the CLICKER-C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it Adult content dialler Added by an unknown WORM or TROJAN! Added by an unknown WORM or TROJAN infection Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself StartMake.com toolbar Added by a variant of the RBOT WORM!

? X X ? X X ? X X U X ? X U U X ? ? Y N X ? ? X X X X X X Y N X X U Y X N Y U U X N X N ? X X X U ? ? X X ? X X X X X ? ? X N X N X U X X X

SmWizard SN Messenger snapple snbr snbupt sncntr SNCT511 snd332 Sndcompat SNDMon Sndsaver sndsrvc SNInstall Snippet SnoopFreeUI SNP Generic Host Process snpstd SNPSTD2 snpstd3 Snsicon SNSS.EXE SO5 Integrator Pass One SO5 Integrator Pass Two Soar Social Security Agency Sock32 Socket Utility Socket Utility Socket Utility SoDA Startup soffice Soft Profile Inc softIce Update 32 SoftickPPP SOFTinst Software SoftwareStation Solo Sentry SoloSchedule SoloSysCheck somatic Sonic A3D Control Sonic RecordNow! SoniqueQuickStart SonnReg SonudMan SonudMan SonudMon SonyPowerCfg Soot sophagnt SOProc_RegSoAlertWxLiteNnAj SOS SoSyncMonitor Sound Loader Sound services Sound System soundcontrl sounddrv SoundFusion SoundFusion SoundFusion soundman SOUNDMAN Microsoft Help SoundMAX SoundMAX SoundMAXPnP SoundMixer Soundmx soundtask

SmWizard.exe SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? msnmsgr.exe Added by the RBOT-AVP WORM! snapple.exe Added by the FORBOT-EG WORM! snbr.exe ?? snbupt.exe UpSpiralBar adware sncntr.exe Added by the DLUCA-I TROJAN! vsnct511.exe Unidentified "Snapshot Viewer"- what does it do and is it required? snd332.exe Added by the B1LD0 AIM WORM! Sndcompat.exe Added by the GEMA TROJAN! SNDMon.exe Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual updates but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is dis Sndsaver.exe Added by the GEMA TROJAN! SNDSRVC.EXE Part of Norton Personal Firewall and Norton Internet Security - what does it do and is it required? [various filenames] Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, dow SnippingTool.exe The Snipping Tool (part of the Experience Pack for Tablet PC) allows you to easily "cut out" anything on screen and share it with other people. The whole screen becomes an "inkable" surface that you c SnoopFreeUI.exe Anti-keylogging software made by SnoopFree Software svchost.exe Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! vsnpstd.exe Sonix PC Camera Monitor MFC Application. What does it do and is it required? vsnpstd2.exe CameraMonitor MFC Application. Appears to be related to a USB connection to a digital camera -is it required? vsnpstd3.exe Sonix Inc. Camera Monitor MFC Application Snsicon.exe Launches a screensaver program from Second Nature SNSS.EXE Added by the Nunci premium rate dialer sointgr.exe StarOffice 5. See here for more details sointgr.exe StarOffice 5. See here for more details Rwon.exe PurityScan/Clickspring adware rpcxsocsa.exe Added by a variant of the RBOT WORM! sock32.exe Added by the SDBOT TROJAN! svchostz.exe Added by the DAEMONI-E TROJAN! socket.exe Added by the DAEMONI-E TROJAN! svchostz.exe Added by the DAEMONI-E TROJAN! SodaStartup.exe Used by the Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software SOFFICE.EXE Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started w hxdef.exe... Added by a variant of the LOVGATE WORM! wininits.exe Added by the RBOT-ANB WORM! PPPGate.exe Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer N/A For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out software.exe Added by the CRABTON-B TROJAN! station.exe eAcceleration Stop-Sign related - not recommended, see see note Solosent.exe Solo Antivirus Solocfg.exe Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis Syscheck.exe Solo antivirus System Integrity Check - Monitors system registry, system.ini, win.ini and startup to protect you from new Internet Worms and Backdoors somatic.exe Searchcentrix hijacker vrtxctrl.exe Sound related options smsc.exe Added by a variant of the SDBOT WORM! sqstart.exe Quickstart for Sonique audio player. Available via Start -> Programs SonnReg.exe Part of E-Color 3Deep for color calibration. Possibly a registration reminder? SonudMan.exe Added by the STARTPAGE.Q TROJAN! WNILOGON.exe Added by the QQROB-DC TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! SonudMon.exe Added by the LEWOR-J TROJAN! SPMgr.exe Related to Sony VAIO Power Management Module installed on laptops and provides additional configuration options for these devices. This program is non-essential process to the running of the system rcea.exe ?? sophagnt.exe Possibly related to Sophocles Screenwriting Software? rundll32 shell32.dll, ShellExec_RunDLL Advertising [path] soproc.exe by SoftwareOnline - monitors your browsing habits and distributes the data back to the author's servers for analysis SOS.exe Added by the PHILIS VIRUS! SoSyncMonitor.exe SuperOffice related. What does it do and is it required? sndloader.exe Added by the AGOBOT-BV WORM! SOUND32.EXE Added by the AGOBOT.GG WORM! WinSound1.exe Added by an unidentified VIRUS, WORM or TROJAN! soundcontrl.exe Added by the GAOBOT.AFJ WORM! sndbdrv3104.exe CoolWebSearch parasite variant rundll32 cwcprops.cpl Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? rundll32 hercplgs.cpl, BootEntryPoint Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? RunDll32 cwaprops.cpl, C25CrystalControlWnd Control panel item for a Terratec soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? soundman.exe System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel soun.pif Added by the RBOT-AIU WORM! SMax4.exe System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel SoundMAX.exe Added by the RIZON-A WORM! Note - this file is placed in the Startup folder itself, and has NO relation to SoundMax sound cards! SMax4PNP.exe SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments smvss.exe Added by the DEDLER-G TROJAN! Soundmx.exe CoolWebSearch Tapicfg parasite variant soundtask.exe Added by the AGOBOT-MD WORM!

X X X X X N X X X X U X U X X X X X X X U X U U U U N N N U X X X X N U X U U U U U U U X X X N Y N X X U X X X X U X N X X X X X X X X X X

soundtasks soundtctrls SoundView sounofts sountskmanager SourcePath sp sp sp sp SP TimeSync SP00LSV SP2 Connection Patcher SP2 Firewall/Internet Updater sp2chk.exe sp2ctr sp2fwxp sp2update Spam Blocker for Outlook Express SPAM FIREWALL Spam Sleuth SpamBlocker SPAMfighter Agent spamihilator SpamPal SpamSubtract spc_w spc_w Spdstart Speaking Clock Deluxe Special Firewall Service SpecialOffers SpecialOffers specific Speed racer Speed Tec SpeedBoss SpeedItUp Speedkey SpeedMeter SpeedOptimizer SpeedswitchXP Speedtouch USB Diagnostics SpeedUpMyPC Spees1 Spees2 Spees3 Spellex Anywhere SpIDerMail Spinner Plus SPINX SPnt SpokeSysTray spolsvr2 spoo1sv Spool Spool Spool SPOOL Configuration Spool Loader Spool LoadKIt Spool lptt01 Spool Manager Spool ml097e Spool32 spoolax Spooler Service Spooler Sub System Process Spooler Subsystem Spooler SubSystem App

soundtasks.exe Added by a variant of the CRYPTER.C TROJAN! soundtctrls.exe Added by the AGOBOT-ZV WORM! msdview32.exe Trojan downloader sounofts.exe Added by the AGOBOT-ND WORM! sountaskmgr Added by an unidentified WORM or TROJAN! gwreg.exe Used to update Gateway registry settings for System Restoration Kit and Web update programs sp.reg IE search hijacker - changes the default search to http://www.gocybersearch.com/ regedit-s .... sp.dll Malicious javascript annoyance that changes the default search engine in IE to one of many including "topsearcher". See here for more and a fix se.dll, DllInstall Added by the Startpage.M hijacker rundll32 (Path to Trojan DLL), DllInstall Added by the ABLANK-W and ABLANK-Z TROJANS! SP TimeSync.exe SP TimeSync lets you synchronize your computer's clock with any Internet atomic clock (time server) Sp00lsv.exe Added by the GRAYBIRD.E TROJAN! SP2ConnPatcher.exe Changes limit of concurrent TCP connections of Windows Service Pack 2 crssrs.exe Added by the RBOT.BJO WORM! sp2chk.exe Added by the ALUROOT.A TROJAN! sp2ctr.exe Added by the DLUCA-M TROJAN! sp2fwxp.exe Added by the SMALL.ABW TROJAN! sp2update.exe SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer SBInst.exe HotBar related mfirewall.exe Added by the SDBOT.AOU WORM! SpamSleuth.exe Spam Sleuth E-mail spam detection program SbOEAddOn.exe Related to Hotbar's Weather Forecast tool for your desktop SFAgent.exe SPAMfighter anti email spam filter spamihilator.exe Spamihilator - spam filter spampal.exe SpamPal - anti-spam tool SpamSubtract.exe Intermute SpamSubtract - junk email detection and removal program hcm.exe NetZero Search Enhancement related blspc.exe NetZero Search Enhancement related Spdstart.exe Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications, such as Word and Excel." SpClDlx.exe Speaking Clock Deluxe - turns your computer into a speaking clock with several languages. It can also keep track of up to 50 alarms that can be set to a time and a date, and be repeated daily, weekly, avguard.exe Added by the NETSKY.G WORM! SpecialOffers*.exe [* = digit] SpecialOffers adware SpecialOffers.exe SpecialOffers adware specixic.exe Added by a variant of the SDBOT WORM! CTSRReg.exe Software for a Creative sound card speedtec.exe Accel SpeedTec from Montana Software speeds up your modem. SpeedTec modifies the Internet Protocol settings in the Windows registry to speed downloads on all modems. If you find this improves y [worm filename] Added by the OPASERV.AD WORM! SPEEDITUP.EXE Speed It Up - "all in one Speed Booster designed to significantly increase the speed of your computer and boost your PC available memory" SPEEDKEY.EXE Additional keyboard shortcuts on MS programmable keyboard SpeedMeter.exe Application measuring upload and download speed spo.exe SpeedOptimizer is designed to optimize and speed-up your Internet data transmission including browsing, streaming, downloading, uploading and e-mail communication SpeedswitchXP.exe SpeedswitchXP is a CPU frequency control for notebooks running Windows XP Dragdiag.exe For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' s SpeedUpMyPC.exe SpeedUpMyPC "automatically fine-tunes all your resources including hardware, system settings and internet usage to operate at peak performance at all times" speedy.scr Added by the OPASERV.Y WORM! Speedy.bat Added by the OPASERV.AD WORM! SPEEDY.PIF Added by the OPASERV.AD WORM! sa.exe Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used spiderml.exe DrWeb antivirus Spider Mail e-mail scanner spinner.exe Spinner Plus lets you listen to over 100 channels of music broadcast from Spinner.com. Spinner Plus uses RealNetwork's G2 technology to provide high-quality online audio. The technology adjusts the a Wscript.exe OXNEY.B.VBS Added by the YENO.B and YENO.C WORMS! SPnt.exe Premium rate adult content dialler SpokeSysTray.exe Spoke Software client application. Spoke "uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private, se spolsvr2.exe Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty spoo1sv.exe Added by the SOULJET TROJAN! [path to trojan] Added by the RANKY.R TROJAN! msvc.exe Added by the RANKY.R TROJAN! wys.exe WhileUSurf adware spoolsvc.exe Added by the SDBOT-KD WORM! spool.exe Added by a variant of the RBOT WORM! spoolv.exe Added by a variant of the RBOT WORM! spool.exe RapidBlaster variant (in a "spool" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here spoolsrv.exe Added by the BANKER-FR TROJAN! spool.exe RapidBlaster variant (in a "spool" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here pool32.exe Added by the ASSASIN-F TROJAN! [path to trojan] Added by the PERDA-D TROJAN! Spoolsrv.exe Added by the JOINER.C1 TROJAN! SPOOL32.EXE Added by the YAB.A TROJAN! spoolsub.exe Added by the SDBOT-ABG TROJAN! spoolsvc.exe Added by the POEBOT-J WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ? X ? ? U ? U N U X N X U X N U U X X X U X X X N U X X N U U U X X N N U U U U U

Spooler SubSystem App Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler SubSystem Application Spooler Subsytem App SpoolerSubSystemProcess Spools Service Controller spoolserv SpoolService Spoolsv spoolsv spoolsv spoolsv manager spoolsv service SPOOLSV32 spoolsvc spoolsvr32 spoolsvr32 spoolsvs.exe SPOOLSVU spoolsvv Spoolvs Spore Spore.b SPP spp sppbridge SprintPort SPSTEALT spstore Spy Blocker Spy-Control Spy-Keylogger SpyAxe SpyBan SpyBlast SpyBlocker SpyBlocs SpyBlocs3.0 SpybotSD TeaTimer SpyBotSnD Spybott lptt01 Spybott ml097e SpyClean SpyCop ScanCheck SpyEx SpyFighterMonitor SpyFighterUpdate SpyHunter Spykiller SpyNuker SpySheriff SpySpotter SpyStopper SpySubtract SpySweeper SpyTrooper Spyware Spyware Begone Spyware Begone Spyware Doctor Spyware Doctor Spyware Guard Control Panel Spyware Nuker Spyware Nuker Installer

spooIsv.exe localsvc.exe netsvc.exe spoolsvc.exe svcadmin.exe svcman.exe svcrun.exe tcpsvc.exe websvc.exe spoolsvc.exe SpooI32.exe spools.exe spoolserv.exe spolsv.exe Spoolsv.exe scvhosts.exe svchost.exe SpoolMgr.exe spoolsv32.exe SPOOLSV32.EXE spoolsvc.exe csmss.exe csmss32.exe spoolsvs.exe SPOOLSVU.EXE spoolsvv.exe spoolvs.exe MsNews.vbs Scmhlpr.vbs run.exe regedit -s spp.reg sppbridge.exe SprintPortA.exe SmartProtectorPro.exe storesp.exe spyblocker.exe Spy-Control.exe skl.exe spyaxe.exe SpyBan.exe SpyBlast.exe spyblocker.exe SpyBlocs.exe SpyBlocs3.0.exe TeaTimer.exe Spybotsd.exe spybott.exe spybott.exe 1ClickSpyClean.exe MAIN.EXE Winllogo.exe SpyFighter.exe AutoUpdate.exe SpyHunter.exe Spykiller.exe Spynuker.exe SpySheriff.exe SpySpotter.exe spystopper.exe SpySub.exe SpySweeper.exe SpyTrooper.exe Spyware.exe SpywareBeGone.exe freescan.exe spydoctor.exe swdoctor.exe spywar~1.exe swn2.exe SpywareNukerInstaller.exe

Added by the LINKBOT.M WORM! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the SDBOT-MM WORM! Added by the EHKS.21 keylogger! Note - the "I" between "o" and "3" is a captial "i" not a lower case "L" Added by the KASSBOT-C WORM! Added by the SDBOT-PN WORM! Added by the AGOBOT-CS WORM! Added by the CIADOOR.121 VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Added by the SMALL-AW TROJAN! Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the ASSIRAL WORM! Added by the RBOT-AHP WORM! Added by the CWS-I or HAZIF-B TROJANS! Added by the DROPPER-AT TROJAN! Added by the AGENT-AU TROJAN! Added by a variant of the AGENT-AU TROJAN! Added by the DLOADER-RK TROJAN! Added by the Startpage.K hijacker Searchcentrix hijacker Added by the SDBOT.AUS WORM! Added by the SPORE.A WORM! Added by the SPORE.B WORM! ?? IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/ Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? Novatel wireless modem related. What does it do and is it required? Smart Protector Pro - internet privacy tool that erases tracks, MRU lists, etc Softprobe - program designed to provide managers with an analysis of an individuals computer use who are under their supervision. This program is NOT related to Winpup SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is importan Spyware remover - not recommended, see here SpyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself! Spyware remover - not recommended, see here. For removal instructions see here Spyware remover - not recommended, see here Spyware killer that is in effect autoinstalled foistware, targeted by SpyBot, among others SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is importan Rogue anti-spyware program Spyware remover - not recommended, see here TeaTimer is a new tool of Spybot S&D - spam filter which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giv Spybot - Search & Destroy - free multi-spyware removal tool from Patrick Kolla RapidBlaster variant (in a "Spybott" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "Spybott" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here 1 Click Spy Clean uses a database that was stolen from SpybotS&D. Not recommended, see here SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Added by the PRSKEY-A WORM! Spyware remover - not recommended, see here Spyware remover - not recommended, see here Enigma SpyHunter - not recommended, see note Shareware "Spyware remover" of questionable quality and repute. There are better alternatives that are freeware to boot A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-ma SpySheriff malware Spyware remover - not recommended, see here SpyStopper - blocks intrusive spyware, Web bugs, worms, scripts, advertisements, and cookies. Protects you from being profiled and tracked SpySubtract - multi spyware removal tool Spy Sweeper - detects and removes spyware SpyTrooper - malware posing as a spyware remover, see here BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! Spyware remover - not recommended, see here Spyware remover - not recommended, see here Spyware Doctor spyware remover Spyware Doctor spyware remover SpywareGuard provides a real-time protection solution against spyware Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here

X U U N N N U N N U U X X X X N N X X U X X N X X X X Y Y ? X X X ? ? U X U Y X X X X X X X X X U U U U X X U N ? X X N U U Y Y Y ? N X X X

Spyware remover Spyware Scanner SpyWare Shield Spyware Slayer Spyware Stormer Spyware Vanisher Spyware X-terminator Spyware-Cop SpywareBot spywarefighterguard SpywareGuard SpywareGuard Spywareguard lptt01 Spywareguard ml097e SpywareGuardPlus SpywareKilla SpywareNo SpywareQuake SpywareStrike SPYWATCH SQConfigChecker SQInstaller SQL Server SQL Server Service sqservices SQUpdatesChecker sqvynikp SR Agent Sr Agent sr1exe sr64 SrchfstUpdate sre srePostpone SRFirstRun Srmclean SRNG SRP Startup SRS Applet srshost.exe Srv RPCrom Srv32 Srv32 Srv32 spool service Srv32 spool service Srv32 spool service Srv325 Srv32Old Srv32Win Srv32Win Srv32Win srv32win Srvce Pack Updte srvexc.exe srvprc srxTray SsAAD.exe ssate.exe ssate.exe SSBkgdUpdate SSC Service Utility SSCFBTN.EXE sscRun SSC_UserPrompt Ssd ssdiag SSDPSRV ssgrate.exe ssgrate.exe ssgrate.exe

Remove_spyware.exe Unidentified, but not known to belong to any known spyware remover, and strongly suspected to be adware related! AseScanner.exe Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here Shield.exe Acronis Privacy Expert Spyware Shield prevents spyware and other suspicious programs from being installed on PCs SpywareSlayer.Exe Spyware remover - not recommended, see here SpywareStormer.Exe Spyware remover - not recommended, see here FreeScanner.exe Spyware remover - not recommended, see here SpywareX.exe Spyware X-terminator - spyware remover Spyware-Cop.exe Spyware remover - not recommended, see here SpywareBot.exe Spyware remover - not recommended, see note spfprc.exe Spyware Fighter - anti spyware program sgmain.exe SpywareGuard provides a real-time protection solution against spyware winproc32.exe Startpage adware Trojan Spywareguard.exe RapidBlaster variant (in a "Spyguard" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Spywareguard.exe RapidBlaster variant (in a "Spyguard" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here winmm64.exe StartPage.ht homepage hijacker SpywareKilla.exe Spyware remover - not recommended, see here SpywareNo.exe Spyware remover - not recommended, see here SpywareQuake.exe Spyware remover - not recommended, see here SpywareStrike.exe Spyware remover - not recommended, see here SpyWatch.exe BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! cc.exe Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here SQInstaller.exe Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here scm.exe SQL Server Service Control Manager. Available via Start -> Programs sql.exe Added by the RBOT-ADF wins32.exe Added by the PROGENT-B TROJAN! uc.exe Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here sqvynikp.exe Free_Scratch_Cards foistware AGENTSVC.EXE Related to Secure Resolutions - desktop virus protection SrLogon.exe Related to Secure Resolutions - desktop virus protection updtSup3.exe Found on a Dell computer, in a Documents and SettingsAll UsersApplication DataDellAlert2 subfolder ********. exe Adware, as yet unidentified srchupdt.exe SearchFast adware downloader rundll32.exe sre.dll, Register CoolWebSearch parasite variant - also detected by Kaspersky antivirus as Trojan.Downloader.Agent.Fc rundll32.exe [path] srescan.dll, DoSpecialAction Related to ZoneAlarm. What does it do and is it required? rundll32 srclient.dll, CreateFirstRunRp Created by execution of the Windows XP sr.inf file, which installs the Windows XP System Restore feature, needed for example when installing System Restore into Windows Server 2003. Does this inde srmclean.exe Srmclean helps in the installation and execution of the SoundMax SoftPaq for Compaq/ADI SoundMax Integrated Digital Audio. According to Compaq - "If you disable the entry from loading into startup, srng.exe ShopNavSearch.Srng search hijacker srrpro.exe System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium "features." This is enabled if you tick the "Remove unnecessary System Rest SrsTray.Exe S3 Sonic Vibes sound card drivers - if disabled you loose sound srshost.exe Added by a variant of the RBOT-ASW WORM! NClienti386.exe Added by the WATSOON.A TROJAN! Srv32.exe Added by the OPASERV.J WORM! Srv32.exe Added by the OPASERV.S WORM! runsrv32.exe Topantispyware.com malware, recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b spoolsrv32.exe Added by the SPYRE.B TROJAN! [path to trojan] Added by the DLOADER-LB TROJAN! Srv325.exe Added by the AGOBOT-PR WORM! [worm filename].PIF Added by the OPASERV.J WORM! SpyAgent4.exe SpyAgent - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Svchost.exe Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! sysdiag.exe SpyAgent.B surveillance software - uninstall this software unless you put it there yourself! win16dll.exe Screenspy captures screenshots silently. If you didn't install this yourself remove it svcpack.exe Added by a variant of the RBOT WORM! srvexc.exe Added by the SERVSAX TROJAN! srvprc.exe Added by the ActMon surveillance software. Uninstall this software unless you put it there yourself srxTray.exe Titan FTP Server - FTP server SsAAD.exe Sony SonicStage software related - "Atrac Hard Disk Monitor". What does it do and is it required? irun4.exe Added by the BEAGLE.J WORM! winsys.exe Added by the BEAGLE.K WORM! SSBkgdupdate.exe ScanSoft OmniPage auto updater. Can be disabled using the main program's options ssc_serv.exe SSC Service Utility is a printer utility for refilled Epson cartridges SSCFBTN.EXE Samsung smarthru software,used with Lexmark Z82 or Samsung multifunction printers SSCRun.exe AOL's firewall UsrPrmpt.exe Part of Symantec's AntiVirus suite and comes usually with a product update, if not on the system already. Required for essential applications to work properly Std.exe Stealthdisk - file and folder hiding/locking utility ssdiag.exe Equinox "Configuration and DOS Diagnostic for DOS and Windows platforms" ssdpsrv.exe Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plu system.exe Added by the MITGLIEDER.C TROJAN! irun.exe Added by the MITGLIEDER.D TROJAN! irun4.exe Added by the MITGLIEDER.F TROJAN!

X X X X U X X U X X X X X X N X X X N X U Y X ? X X X N X X Y Y U U X X X X X X X X X N N U Y X X X X U X X X X X X N X X X X X X U U U N X

ssgrate.exe ssgrate.exe ssgrate.exe ssgrate.exe SSh32 SSK Service SSL ssmmgr ssms.exe SSPY sssasasb32 sstata sstata SStb.exe sstray SSUpdate ssvchost SSWPlauncher Stacmon standalone.exe StarSkin Start Start start Start aThx Roll start extracting start extracting Start Getright Start Page Start Page Start RF Wireless Keyboard Start RF Wireless Mouse Start Service Start Up Cop start uploading Start Upping Start Upping Start Upping Start Upping Start Upping Start Upping Start Uppings Start Uppings Start Wingman Profiler Start Wingman Profiler Startacc StartEAK starter Starter starter starter StartFoxie startkey startkey startkey startkey startkey StartKey startl.exe StartMenu StartMenu StartMenu StartMenu StartMenu startpage STARTPAGE StartStop StartSurfing Startup Startup

sysdoor.exe winerdir.exe winsystems.exe wintems.exe SSh32.exe winssk32.exe svchost.exe ssmmgr.exe SSMS.EXE SSYTEM.EXE sssasasb32.exe dwdas.exe [path to trojan] SStb.exe sstray.exe SSUpdate.exe ssvchost.exe comet.exe Stacmon.exe standalone.exe starskin.exe Quick95.exe windows.vbs start.exe f0mered.exe spoolvse.exe spoolvs.exe getright.exe http://find.naupoint.com svcnt32.exe ktrexe.exe cm20.exe upssrv.exe startcop.exe smsss.exe taskmrg.exe SVCHOSTES.EXE taksmgr.exe mcrt32.exe windupds.exe windupdts.exe svcchosts.exe mssupdate.exe lwtest.exe lwemon.exe startacc.exe StartEAK.exe scvhosting.exe scvhosting.exe scvhostingg.exe iexplore.exe StartFoxie.exe svcmgr.exe update.exe XMCHAI.EXE explore32.exe CKOTS.exe pligde.exe startl.exe s_menu.exe deamon.exe msgaol.exe s_menu.exe browse.exe startpage.exe start1.exe STARTSTOP.EXE STARTS.exe ?? WinlogonStartup

Added by the MITGLIEDER.N TROJAN! Added by the MITGLIEDER.O TROJAN! Added by the BAGLEDL-J TROJAN! Added by the MITGLIEDER.Q TROJAN! 2Spy keystroke logger/monitoring program - remove unless you installed it yourself! Added by the SOBIG.E WORM! Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Samsung printer monitor - for checking ink levels, etc. Added by the GISMOR WORM! SurfingSpy keystroke logger/monitoring program - remove unless you installed it yourself! Added by the TACTSLAY.F TROJAN! Added by the DASDA TROJAN! Added by the RANCK-DF TROJAN! Adpowerzone.com "ServerSide" keyword hijacker nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys MoneyTree parasite - ActiveX control used to download premium-rate dialers Added by the HELIOS.B TROJAN! Comet Cursor adware Installed with the drivers for a SigmaTel C-Major Audio card (on a Dell Inspiron 600m PC for example). Appears as though it can be disabled with no ill effects Added by the AGOBOT-ADS WORM! StarSkin allows you to change the view and appearance of your Windows XP box with the use of publically available themes For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone Homepage hijacker ?? Added by the RBOT.AAV WORM! Added by the RBOT-XF WORM! Added by the RBOT.AKC WORM! See Getright Tray Icon Naupoint browser hijacker Homepage hijacker, also detected as Trojan-Downloader.Win32.Delf.ks Yuanxun Electronics RF wireless keyboard driver Yuanxun Electronics RF wireless mouse driver Cyber Power PowerPanelPlus software. "In the event of a power outage, PowerPanelPlus Software automatically saves and closes all open files, and then shuts down the computer system in an intelligen StartUp Cop - startup manager Added by a variant of the SDBOT WORM! Added by the RBOT-MA WORM! Added by the RBOT-NB WORM! Added by the RBOT-QK WORM! Added by a variant of the SPYBOT WORM! Added by the SDBOT.AFH WORM! Added by a variant of the RBOT WORM! Added by the SDBOT.VY WORM! Added by a variant of the RBOT WORM! Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer, it's best to leave it unchecked Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer, it's best to leave it unchecked Launches Webroot's Accelerate 2000 software that "speeds up your Internet connection by up to 300%". Leave enabled if you find it improves internet connection Easy Access Button Support for Compaq PCs. Required if you use these Added by the IRCBOT.E TROJAN! Added by the SDBOT.RU WORM! Added by the FORBOT-FB WORM! Added by the FORBOT-DU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fi Foxie Suite from Softonic International. "This suite of free tools comes in the form of an Internet Explorer add-on and includes a mix of powerful security enhancements" Added by the HIPPER-B TROJAN! Added by the BIFROSE-DG TROJAN! Added by the BIFROSE-AO TROJAN! Added by the MT TROJAN! Added by the BIFROSE-HM TROJAN! Added by the BIFROSE.E TROJAN! Lingocom LingoWare - translates any application into your language Added by a variant of the DELF-A TROJAN! Added by the TACTSLAY.C TROJAN! Added by the TACTSLAY.C TROJAN! Added by the TACTSLAY.C TROJAN! Added by the DROWSY-C TROJAN! Browser hijacker - redirecting to pages2start.com NoSpy.org - prevents spyware from changing your startpage and other browser properties. The start1.exe file is located in a NOSPY.ORG folder StartStop from TFI Technology - startup manager Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Related to an Iomega drive Unidentified malware

X X X ? U X X U X X N X X X N N ? ? N N U U ? N X X X X X Y X Y U X X X X X X X N X X N N N U X X X N X N N U U U ? X X X U U X X X X X X X

Startup Startup Configuration Startup Configuration Startup Launcher GUI Startup Manager Scanner Startup Update StartupBin StartupMonitor startwin startwindowskeyuser Stat 'n' Perf StatBar State Service Statistics Status Monitor Status Monitor XE StatusClient StatusClient 2.6 StatusView Stay Connected! StayAlive StayAlive STBVision STBWEBTV stcinstaller stcloader stcloader STCLOA~1 STCLOA~1 STCPO stdlib STDSB Stealth Anonymizer 2.5 stealth.dcom.exe stealth.ddos.exe stealth.exe stealth.injector.exe stealth.stat.exe stealth.wm.exe stealth.worm.exe Steam steam SteFanie Stickies Sticky Notes StickyNote StillImageMonitor stisrv stlbdist stlbupdt STManager stmha StopSignSsTsMon StopSignStatus STOPzilla STOPzilla Service StorageGuard STPMGR stratas stratas Stratas StreamZap Remote StrgSync.exe strmsnmgrs strmsnmsgr strmsnmsgrs strmsnnms strmsnnrs strmsoums Strng32

mirc.exe Added by the FLOOD-EU TROJAN! An uninstall option for mirc.exe can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as mIRC. This one puts 10 [six character filename] Added by the RBOT-ARV WORM! wztoid.exe Added by the RBOT-ASD WORM! GUI.exe Startup manager? StartupMonitor.exe Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans, adult-dialers, and other scumware Cvshost.exe Added by the GAOBOT.AO WORM! iwnujdss.exe Added by the SDBOT-XZ WORM! StartupMonitor.exe Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu startwin.exe Added by the ANTIMAN.A WORM! rundle2.exe Added by the JAVAKILLER TROJAN! StatnPerf.exe Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes STATBAR.exe StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory, CPU, uptime, and much more). Due to the sheer number of resources (over 60%) consumed by th csrss.exe Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms statslist.exe Added by the OPANKI-S WORM! BrMfcWnd.exe Brother scanner status monitor - can be started manually ENGSS.EXE The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and man StatusClient.exe Part of Hewlett Packard network printer drivers StatusClient.exe Part of Hewlett Packard network printer drivers StatusView.exe Status View intra-office messaging StayCon.exe More than just a pinger, actually simulates online activity. Supports AOL, NetZero, MSN, ATT WorldNet, CompuServe and many other ISPs as well. Available via Start -> Programs StayAlive.Exe Part of RealSPEED - tweaking utility to speed-up your internet connection. Stay connected even after a period of inactivity on the net sa.exe StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work." STBVisn.exe Related to the STB Velocity graphics card. What does it do and is it required? STBWEBTV.EXE Used to display TV on your PC id53.exe Added by the SCTHOUGHT.L TROJAN! stcloader.exe Popup adware by 2ndThought software STCLOA~1.exe Popup adware by 2ndThought software stcloader.exe Popup adware by 2ndThought software STCLOA~1.exe Popup adware by 2ndThought software STCPO.exe Sophos Sweep antivirus software [filename] Added by the PERDA-E TROJAN! STDSB.exe Scrollbar driver for notebooks. If taken out of the Startup, it will not provide scrolling stealth25.exe Now named Stealther - proxy server agent that lets you travel the Internet with maximum possible privacy stealth.dcom.exe Added by the THEALS.A WORM! stealth.ddos.exe Added by the THEALS.A WORM! stealth.exe Added by the THEALS.A WORM! stealth.injector.exe Added by the THEALS.A WORM! stealth.stat.exe Added by the THEALS.A WORM! stealth.wm.exe Added by the THEALS.A WORM! stealth.worm.exe Added by the THEALS.A WORM! steam.exe Valve Software's STEAM broadband game client. Steam is Valve's new way of getting games into your hands ASAP. Games like Half-Life, Counter-Strike, and Counter-Strike: Condition Zero are all being steam.exe Added by the RBOT-AJT WORM! Note - the file steam.exe will be found in the WindowsSystem folder and is not associated with Valve Software's game client SteFanie.vbs Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders STICKIES.EXE Stickies - utility that allows you to put yellow "Post-It" type messages on your desktop and can be used to set reminders. Available via Start -> Programs stikynot.exe Microsoft Sticky Notes - virtual sticky notes tool StickyNote.exe Utility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs Stimon.exe Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scannin stisrv.exe Added by the RBOT.BQF WORM! rundll32exe stlbdist.DLL, DllRunMain Hijacker pointing to www.searchandclick.com rundll32.exe stlbupdt.DLL, DllRunMain BrowserAid/BrowserPal foistware drst.exe Dr. SpeedTouch is some sort of diagnostics software which sends out information to a server which then relays the information back to the program to test the network to see if the SpeedTouch ADSL m wkfxi.js Added by the SPETH WORM! sstsmon.dll, VerifyStatus eAcceleration Stop-Sign related - not recommended, see note stopsinfo.dll", VerifyStatus eAcceleration Stop-Sign related - not recommended, see note Stopzilla.exe StopZilla! - pop-up killer SZNTSVC.EXE StopZilla! - pop-up killer sgtray.exe StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - war STPMGR.EXE Part of SafeTP which is transparent FTP security software. Does it need to be running permanently or can it be started manually via Start -> Programs xmconfig.exe Added by the RBOT-AHR WORM! lockx.exe Added by the SDBOT-ADD WORM! ggfig.exe Added by the OPANKI.W WORM! zremote.exe StreamZap PC Remote - control Windows Media Player, iTunes, RealPlayer, Winamp, PowerPoint, MusicMatch Jukebox, and many other multimedia applications StrgSync.exe SimpleTech Inc's StorageSync backup software - backs up an entire PC, or selected files and folders msnxmsgrsc.exe Added by the SDBOT.JDR WORM! msnmsgrs.exe Added by the RBOT-ACQ WORM! msnmsgrsc.exe Added by a variant of the RBOT WORM! msnmegrs.exe Added by the SDBOT-YU TROJAN! msnmcgrs.exe Added by the RBOT-ACT TROJAN! msnmegrse.exe Added by the SDBOT-ZK TROJAN! strngbox.exe Added by the STRANO WORM!

U X X X X X X X X X N X U X N X U X X U U X X X N X X U U U U ? N X X U U U X X U U X X X U X U X X X U U X X U X X U U U X X U X N U X X X

StrokeIt strtas strtas strtas strtas strto strto Sts Stubbish StubPath StupAssist stxrmsgms StyleXP SubAH Subtract the Ads suck Suitcase Startup Suite SULFNBJ.EXE Sunasdtserv sunasServ SunJavaSched SunJavaSched Updater SunJavaUpdate SunJavaUpdateSched SunJavaUpdateSched SunJavaUpdateSched Sunkist Sunkist2k SunKistEM SuNotification SupaDial Supastatus super super Super Popup Blocker Super X Desktop Version 3.4 SuperAdBlocker SuperBar.Component SuperBar.Component Supercleaner SuperCool Compress Backup SuperHeissSex supernews12 Supernova SuperRam superslut SuperSpamKiller Pro Supervisor.exe support-reverse-smileys supporter5 SureCleanProfessional Sureshotpopupkiller SurfAccuracy SurfBuddy SurfChoice Surfer lptt01 Surfer ml097e SurfHelper SurfinGuard Pro SurfSecret SurfSideKick 2 SurfSideKick 3 SurfStream Surs Surveysa suScheduler Susp susse Sustem

strokeit.exe lock1.exe lockx.exe l074.exe loc1.exe strto.exe [path to trojan] iwnujdss2.exe Stubbish.exe Sservice.exe StupAssist.exe mstats.exe StyleXP.exe SubAH.exe AdSub.exe l0ad.exe Suitcase.exe SuiteOffices.exe SULFNBJ.EXE Sunasdtserv.exe sunasServ.exe ccEvtMngr.exe avamx.exe smvss.exe jusched.exe scvhost.exe javamx.exe shwicon98.exe shwicon2k.exe shwiconem.exe suatshut.exe SupaDial.exe status.exe fuckbx.exe super.exe popkill.exe SXDesk.exe SAdBlock.exe [path to services.exe] services.exe Supercleaner.exe Main.exe SuperHeissSex.exe newsd32.exe [worm filename] SuperRam.exe msslut32.exe Ssk.exe Supervisor.exe [trojan filename] supporter5.exe SRClean.exe Stopthepop.exe sacc.exe rundll32 [path] sbuddy.dll SCMan.exe surfer.exe surfer.exe SurfHelp.exe winsfcm.exe ss2-full.exe Ssk.exe Ssk.exe SurfStream.exe awab.exe surveysa.exe UCLauncher.exe Susp.exe hpsw.exe explorer.exe

StrokeIt is an "advanced mouse gesture recognition engine and command processor" Added by the SDBOT-ADQ WORM! Added by the SDBOT-AEB WORM! Added by the AGENT-II TROJAN! Added by the RBOT-AZU TROJAN! Added by the KILLPROC-F TROJAN! Added by the KILLAV-AP TROJAN! Added by the SDBOT-YI WORM! Added by the STUBBOT-A WORM! Added by the PRORAT TROJAN! Associated with Nikon digital cameras Added by the IRCBOT-AE TROJAN! StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot, therefore uninstall it if you don't want it Added by the SUBAH TROJAN! Removes adverts from web pages. Although useful - not required PurityScan/Clickspring adware Suitcase. System font manager start up utility. Used for dynamic managment of fonts on your system Added by the LAZAR TROJAN! Added by the PE_MAGISTR.DAM VIRUS! CounterSpy by Sunbelt Software - adware/spyware protection CounterSpy by Sunbelt Software - adware/spyware protection Added by the SDBOT-YP WORM! Added by the RBOT-ABJ WORM! Added by the DEDLER-G TROJAN! Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel Added by the SDBOT-AVX WORM! Added by the SDBOT-WI WORM! Card reader for memory cards from digital cameras, etc Card reader for memory cards from digital cameras, etc Used by your computer to communicate with your Alcor Micro Multimedia Card Reader - necessary if you're using this software ShadowSurfer - "provides a safe computing environment by creating a virtual twin of your PC. Restore the pre-ShadowMode(tm) system state no matter what changes have occurred to your PC" SupaNet.com modem driver related - is it required? Supanet ISP software Added by the LINEAGE-H TROJAN! Added by the AGOBOT-QT WORM! Saga Super Popup Blocker - pop-up stopper Super X Desktop - virtual desktop manager SuperAdBlocker Added by the SMALL-AQ TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally fig Supercleaner - all in one disk cleaner for your computer SuperCool Zip Backup software is a data backup,restore and file synchronization program Added by the HeissSex premium rate adult content dialer! Adware, also detected as the DLOADER-JN TROJAN! Added by the SURNOVA (or SUPOVA) WORM! SuperRam memory manager. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See SuperRam article and make up your own mind Added by the SLUTER-A WORM! SuperSpamKiller Pro email spam blocker Has been reported to be associated with various antitrojan software like ATS and PC Doorguard. If so it's required in Startup - any further information is welcome Added by the LITEBOT TROJAN! Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the w SureClean PC and Internet tracks cleaner Stop-the-Pop-Up popup blocker SurfAccuracy adware SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps! SCMan is a utility that can control services on WinNT from the command line. This utility can create, start, pause, stop, delete services. Furthermore it can retrieve a service's current state, get the displ RapidBlaster variant (in a "mssurfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here RapidBlaster variant (in a "mssurfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Related to SurfHelper - a free tool to remove popup windows, clear history, control window properties of IE, and more SurfinGuard Pro - internet protection software House-cleaning utility that enables you to keep your computer usage to yourself. Runs quietly from the system tray, eliminating tell-tale files at a regular interval of your choosing. You can set it to clear SurfSideKick adware SurfSideKick adware Conceiva "SurfStream lets you surf the Web faster. It contains a fully featured proxy server that lets you surf the Web significantly faster. It also blocks all pop-up windows and banner ads from Web pag PurityScan/Clickspring adware Found on Sony laptops, it brings up a prompt to take a survey. It goes away if you fill out the survey or you choose "never prompt me again" but keeps popping if you either exit out of it or select "take Related to Lenovo ThinkVantage Technologies. ThinkVantage Technologies help make ThinkPad/ThinkCentre PCs less dependent on IT staff VX2.Transponder parasite updater/installer related Added by LinkMaker ADWARE! Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!

X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X X X

SustemUpdate explorer.exe SV00LSV SV00LSV.EXE SVA Player SVAplayer.exe Svc svc.exe SVC svchost.exe SVC Service svcinit.exe SVC Service svcinit.exe SVC Service svcpack.exe SVC Service svc32.pif SVC Socks mstaskm.exe Svced Svced.exe SvcH0st msexploren.exe SvcH0st SHCH.EXE SvcH0st SVCHST.EXE SvcH0st WINAGENT.EXE SVCH0ST spoo1sv.exe SVCH0ST SVCH0ST.EXE SVCH0TS sp00lvs.exe svchast svchast.exe SVCHOST svchost.exe svchost svchost.exe SVCHOST mrowyekdc.exe svchost Svch0st.exe svchost [path to trojan] svchost ADMAGIC.EXE Svchost winhost.exe Svchost svchost.exe SVCHOST var.txt.exe Svchost svchosl.pif svchost [path] SETUP.EXE SVCHOST scvhost.exe SVCHOST taskgmr.exe svchost olehelp.exe SVCHOST updater32.exe SVCHOST SPOOLSV.EXE SvcHost svchost32.exe svchost svchost.exe svchost [path to explorer.exe] svchost rundll16.exe Svchost svchost.exe svchost svchost.exe svchost svchost.exe SVCHOST Generic application svchost.exe svchost Netware Manager svchost.exe Svchost Windows Remote Services svhost.exe svchost.exe svchost32.exe SVCHOST.EXE SVCHOST.EXE svchost.exe [path to executeable] svchost.exe svchost.exe svchost1 svchost1.exe SvcHost32 svchost32.exe svchost64 svchost64.exe svchosta svchosta.exe svchostb svchostb.exe svchostdll.scr svchostdll.scr SvcHosto v1rg1n.exe svchostr svchostr.exe svchosts svchosts.exe svchosts.exe svchosts.exe svchosts.scr svchosts.scr SVCHOT SVCHOT.exe svcinfo svcinfo.exe Svclhost svcchost.exe svcmon svcmon.exe svcroot svcroot.exe SvcSys [path to file] Svcsys Registry Manager svcsysreg.exe svcsys32 svcsys32.exe svctask svctask.exe svcwinprocess32 [path to worm]

Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Added by the GRAYBIRD-C TROJAN! QuickFlicks Streaming Player - regarded as spyware. See here for details of how to disable or uninstall it ClientMan parasite variant ElfSpy keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! Added by the SINIT TROJAN! CoolWebSearch parasite variant CoolWebSearch Svcinit parasite variant Added by the RBOT-ASC WORM! CoolWebSearch parasite variant Added by the DELF.F TROJAN! Added by the BACKDOOR-CGZ TROJAN! Added by the EB TROJAN! Added by the EB TROJAN! Added by the EB TROJAN! Added by the HF TROJAN! Added by the IK TROJAN! Note - the filename has the digit 0 rather then the uppercase "o" Added by the LINEAGE-AZ TROJAN! Added by the LINEAGE-AV TROJAN! System1060 homepage hi-jacker. Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by many TROJANS amd WORMS, such as MORB or TARNO. Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Added by the GOTORM WORM! Added by the GRAYBIRD and GRAYBIRD.B TROJANS! Note - the filename has the digit 0 rather then the uppercase "o" Added by the HAZZER TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the SMIBAG WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the LOLAWEB.A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the MOZE-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the LDPINCH.C TROJAN! Added by the INZAE.A or INZAE.B WORMS! Added by the SETCLO WORM! Added by the MYTOB.E and MYTOB.G WORMS! Added by the MYTOB.F or MYTOB.H WORMS! Olehelp adware Added by the RANTS.A WORM! Added by the BAITAP-A WORM! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Added by the AGOBOT-TM WORM! Added by the BANCBAN-HL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the UNREAL-A TROJAN! Added by the STARTPA-PB TROJAN! Added by the ADCLICK-AX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the ES TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/St Added by the DLOADER-EV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the EXVID.A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the IRCBOT-IV WORM! CoolWebSearch Svchost32 parasite variant Added by the WRMSCAN-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the BANKER-MO TROJAN! Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the AGOBOT.ZZ WORM! Added by the MIMAIL.I or MIMAIL.J WORMS! Added by the SDBOTER.G VIRUS! Added by the SNIFFER-I TROJAN! Added by the SNIFFER-J TROJAN! Added by the BANCBAN-FM TROJAN! Added by the AGOBOT-TK WORM! Added by an unidentified WORM or TROJAN! Added by the BANCBAN-DC or BANKER-ED TROJANS! Added by the AGOBOT-JN WORM! Added by the BANCBAN-DQ TROJAN and variants! Added by the QQROB-U TROJAN! Added by the CRYPTER.A TROJAN! Added by an unidentified WORM or TROJAN! Added by PersonInspect surveillance software. Remove unless you installed it yourself Added by the KEYLOG-AC TROJAN! Added by the BANCOS.Z TROJAN! Added by a TROJAN.CLICKER - identified by Kaspersky antivirus as Trojan-Clicker.Agent.cv Added by the AGOBOT-LL WORM! Added by the CHUCKYB-A TROJAN! Added by the UPERING WORM!

X X X X X ? X X ? X X X X X X X X X X X X X U U N X X X U X N Y N X X X X U N U X U X X N N ? N ? X X X X X X X X X X X X X X X X X X X X X

SVHOST SVHOST Svhost Loader svhost updates svhost windows services SVIDC32M sVideo2 sviload32 SVM Pop svnlitup32 svnloader svphost.exe svrrun svsekin svshost Svshost Update Service svshost32 svshost32 svshostdriver svtcin svwin32 SVX Control Service SW20 SW24 Swap Nut SWCaller SWCaller Swchost SWClient swcroot SWd Sweep95 SweetIM Swf32 Swf32 SwimSuitNetwork swingsys Switch Off Switchboard.com Toolbar Switcher switp SWN2 sws.exe sws.exe SwTray SWTrayV4 SXGDSENU SxgTkBar Sxplog sxrrv SyBot v2.1 By Sky-Dancer SYDNEY syelimS-esreveR-troppuS Syga432te Pe432rsonal Firewall Sygate Peral Firewall Sygate Personal 3 Sygate Personal Block Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall

svhost.exe SVHOST.EXE svshost.exe Svhost.exe svhost8.exe SVIDC32M.exe vxdrun6.exe sviload32.exe svmpop.exe svnlitup32.exe svnload32.exe svphost.exe svrrun.exe svsekt.exe svshost.exe svcbind.exe msgrsv32.exe svshost32.exe svshost.exe n20050308.a.Stub.EXE unninst32.exe svxhost.exe sw20.exe sw24.exe javaw.exe SWcaller.exe Swcaller2.exe Swhost.exe swsys.exe swcroot.exe winwd.exe ICLOAD95.EXE SweetIM.exe AVupdate.exe _backup.exe SwimSuitNetwork.exe SWINGSYS.EXE swoff.exe AtHoc.exe Switcher.exe switpa.exe swnxt.exe [random filename] gd-dial.exe SWTRAY.EXE SWTrayV4.exe sxgdsenu.exe sxgtkbar.exe sxpstub.exe sxrrv.pif HPSV.exe [file path] [filename] MrNo4236.exe Syga.exe svrv.exe Studio.exe Win32x.exe system32.exe sysgut.exe Sygate.exe Mcafeeupdate.exe Sygate32.exe MSNSRV32.exe service.exe t1ktik.exe host32.exe sexy.exe sys.exe syserror.exe

Added by the MYDOOM.I WORM! Added by the ZORI.A VIRUS! Added by the AGOBOT.G WORM! Added by a variant of the RBOT WORM! Added by the RBOT-WQ WORM! ?? Switch premium rate adult content dialler Added by the RBOT-AAS WORM! ?? Added by the RBOT.CBJ WORM! Added by the RBOT-ACU WORM! Added by the AGENT.CS TROJAN! Adware hailing from Deskwizz.com Added by the QQPASS.G TROJAN! Added by the CHODE-H WORM! Added by the MYTOB.LH WORM! Added by the RANKY.AJ TROJAN! Added by a variant of the SDBOT WORM! Added by the SDBOT-HN TROJAN! Added by the N20050308 TROJAN! Added by the AGOBOT-NF WORM! Added by the FORBOT-K WORM! Related to MSI's Dynamic Overclocking Technology Related to MSI's Dynamic Overclocking Technology javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut, a peer-to-peer file sharing and searching utility developed and marketed by File Metrics, Inc. Users can search fo Homepage hijacker - see here Homepage hijacker - see here Added by the MP TROJAN! ActivMonAgent keyboard logger/monitoring program - remove unless you installed it yourself Added by the SOLENO-A TROJAN! PC Security from Tropical Software - lock files, password protect, etc Part of Sophos ant-virus sofware vSweetIM - send fancier smiley-faces and IM graphics to friends who are using MSN Messenger. They are only able to see these advanced smiley-faces if they also have SweetIM installed Added by the MERKUR WORM! Added by the SYMTEN WORM! Advertising spyware Added by the BANCOS-CX TROJAN! Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer, disconnect your current dialup connection, lock worksta Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN, Bluetooth, both) when turning the wireless switch on if disabled) OfferAgent adware component Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here Haldex type adult content dialler Globaldialer adult content premium rate dialer MS SideWinder game controller system tray icon. Available via Start -> Programs. May have the version number after it MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs Yamaha SXG soundcard driver Yamaha SXG soundcard utility - gives quick and easy access via the system tray bar to diagnostics and configuration Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup? Added by the VAX-A TROJAN! Added by the ZOTOB.I WORM! Added by the SYNEY WORM! Added by the LITBOT.C TROJAN! Added by the RBOT-AQY WORM! Added by the RBOT-AQK WORM! Added by the RBOT-XD WORM! Added by the RBOT-TW WORM! Added by the RBOT-KZ WORM! Added by the RBOT.VI WORM! Added by the SDBOT.WM WORM! Added by the RBOT-PN WORM! Added by the RBOT.YN WORM! Added by the SDBOT.WW WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-VP WORM! Added by the RBOT.ALD WORM! Added by the RBOT-XY WORM! Added by the RBOT-ZC WORM! Added by the RBOT.UC WORM!

X X X X X X X X X X X X U X X X X Y N U U X X X X X U X X X N U X U U X N X X X X ? X X U Y X X X X X X X X X X X U X U X U X U U X X X X X

Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Sygate Personal Firewall Start Sygate Personal Firewall Start Sygate Personal Port Sygate Personal Port Blocker Sygate Personal Port Blocker Sygate Personals Firewalls SyGateService Symantec Symantec Anti Virus Symantec Autoscan Symantec Configuration Loader Symantec Core LC Symantec Fax Starter Edition Port Symantec NetDriver Monitor Symantec NetDriver Warning Symantec Security Symantec Security Addon Symantec Security Routine Addon Symantec Service SymAV SymKeepAlive Symlcs SymRun SymRun SymTray - Norton SystemWorks Sync Data Sync Server Sync-It SyncAgent Synchronization Manage Synchronization Manager syncman SyncManager SyncMon SyncMon SynSetup Syntax Syntax Script SynTPEnh SynTPLpr sys sys Sys Ren Sys**.exe [* = random char] Sys**32.exe [* = random char] sys008 sys009 sys201 Sys29 sys32 sys32 sys32cmd sys32dll sys32sql SysA SysAgent SysAI SysBkup Sysbot syscfg syscfg34.exe Syscheck syscheck sysclx

hostserv.exe msnmsgrs.exe Sygat.exe wins.exe winxpstat.exe Syga.exe services32.exe servic.exe crss.exe volume.exe winupdate.exe ccsrn.exe sgserv95.exe ccapp.exe symantec32.exe [random filename] ccApp32.exe symlcsvc.exe OLFSNT40.EXE SNDMon.exe SNDWarn.exe symantec32.exe nvsvc.exe for navpxaw32.exe Microsoft Windows ccApp.exe SymAV.exe CKA.exe [path to file] N/A ccApps.exe SYMTRAY.EXE Hndsync.exe drwatsoon.exe Syncit.exe syncagent.exe rservers.exe mobsync.exe winsync.exe msorunner.exe adslcomdos.exe fixcomdos.exe SynTP.tmp RunOnce.exe windows32.exe systacq.exe syntpenh.exe syntplpr.exe regedit /s sys.reg regedit sysdllwm.reg SysRen.exe Sys**.exe [* = random char] Sys**32.exe [* = random char] sys008.exe sys009.exe sys209.exe win***32.exe [* = random char] sys32.exe sysx32.exe sys32win.exe sys32dll.exe sys32win.exe win***32.exe [* = random char] SysAgent.exe SysAI.exe [path to file] sysbot.exe syscfg32.exe syscfg34.exe win.hta iexplorer.exe ntldrt.exe

Added by the RBOT.BKO WORM! Added by the RBOT.XN WORM! Added by a variant of the RBOT WORM! Added by the RBOT.AOB WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AQD WORM! Added by the RBOT-MB WORM! Added by the RBOT-RY WORM! Added by the RBOT-PX WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs Added by the REATLE WORM! Note - this is not a Symantec file Added by a variant of the WOOTBOT WORM! Added by the RBOT-AJO WORM! Added by a variant of the GAOBOT WORM! Part of Norton AntiVirus 2004. What does it do? Offers a virtual printer as a fax machine. Can be run via a desktop shortcut Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual updates but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is dis Part of Symantec Live Update - displays the warning when you need to update the firewall database Added by the RANDEX.PR or RANDEX.YR WORMS! Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here Added by the AGOBOT-GJ TROJAN! Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename Added by the NETSKY.U WORM! Part of Norton SystemWorks 2003 - keeps a dial-up modem connection alive Added by the YASPY-A TROJAN! Added by the KANGAROO-A TROJAN! Added by the KAGEN-A TROJAN! Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus, Norton Utilities and Norton CleanSweep - mentioned elsewhere here. Personally Pocket Real Estate - mobile synchronization manager Added by the WATSOON.A TROJAN! Sync-It - synchronizes the system clock with time servers on the internet Ghost Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Added by the FORBOT-FM WORM! Find more information about its use here Added by the MANCSYN-A TROJAN! Added by a variant of the TACTSLAY TROJAN! Added by the CLUNKY-A TROJAN! Added by the CLUNKY-B TROJAN! Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required? Added by the SDBOT.CQ WORM! Added by the SDBOT.AI WORM! Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad comb Synaptics touchpad driver helper. Required for touchpad features to work Hijacker CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN! Part of FlashEnhancer adware CoolWebSearch/HomeSearch adware - for examples, see this log CoolWebSearch/HomeSearch adware - for examples, see this log Hijacker, also detected as the STARTPA-GK TROJAN! Added by the STARTPA-ZB TROJAN! Added by the STARTPA-ZY TROJAN! EliteBar ADWARE! Added by the FLUX.E TROJAN! Added by the KVEX-A VIRUS! Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Added by the AIMDES.B WORM! Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! EliteBar ADWARE! SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of AproposMedia adware Keyspy keystroke logger/monitoring program - remove unless you installed it yourself! Spector - spying (or monitoring) software to record internet activity Added by the KWBOT.S WORM! Added by the ELECTRON WORM! Browser hijacker Added by the AGENT.DM TROJAN! Added by the JLOK-A WORM!

X ? X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X U X X X X X X X X X X X X X X X X X X X X U X X

syscm SysComp syscon syscon lptt01 syscon ml097e sysconfig SysConfig sysconfig SysConfig Sysconfig Syscpy SysCtl Sysctrls sysdat.dll SysData SysDeskqqfx SysDeskqqfx SysDesktop sysdir sysdll Sysdpt sysdxvid SysEQ sysfiler SYSfit sysflg32 sysformat sysfrcx syshelp sysin sysinfo sysinfo.exe SysInit sysinit Sysino sysint16 Syskey Syslib Syslog lptt01 Syslog ml097e syslogin.exe Sysman sysme sysmem sysmem SysMemory manager SysMetrix sysMett1 sysmngr32 sysmntrc sysmod sysmon Sysmon sysmon sysmon12 sysmonnt SysMonXP sysnate Sysnet sysnet sysobj.exe SysOps syspare syspath sysPersonalFirewall sysPersonalFirewall sysPersonalFirewall SysPilot sysPnP SysPnP

Syscm.exe Vanish adware mssdnl.com Unknown but suspect as *.com are not usually run at start up and the name isn't recognized syscon.exe Added by the APRILCONE.A WORM! syscon.exe RapidBlaster variant (in a "Syscon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here syscon.exe RapidBlaster variant (in a "Syscon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here iexplorer.exe Added by the CULT.C WORM! syscfg35.exe Added by the KAZMOR.C WORM! iexplorer.exe Added by the CULT.H WORM! wincfg32.exe Added by the SDBOT.ZD WORM! Stealth KeySpy.exe StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself! Syscpy.exe Firewall-bypassing, proxied spam relayer. Detected by Symantec as the HOGLE TROJAN! sysctl.exe Added by the AOK TROJAN! procdll.exe Added by the WEEDBOTZ.14 TROJAN! sysdat.dll.exe Added by the NISHICA 1.1 TROJAN! [path to file] Added by the RANCK-BA TROJAN! qqfx.exe Added by the QQPASS.H TROJAN! Runddll32.exe Added by the CHANGGAME TROJAN! fswanQQ.exe Added by the QQSEND-A TROJAN! winrun.exe Added by the WINBUR.B WORM! [trojan filename] Added by the HUGESOT TROJAN! sysdpt.exe Win32.Crypt trojan downloader sysdxvid.exe Added by the DLUCA-S TROJAN! svclgx32.exe Added by the IRCBOT-AC TROJAN! sysfiler.exe Added by the RETSAM TROJAN! SYSfit.exe AdShooter adware variant sysflg32.exe Added by a variant of the CRYPTER.C TROJAN! sysformat.exe Added by the BAGLE-BK WORM! sysfrcx.exe Added by the KEYLOG-SCLOG TROJAN! syshelp.exe Added by a variant of the LOVGATE WORM! [path to file] Added by the DSRC-A TROJAN! sysinfo.exe Added by the BEDRILL TROJAN! sysinfo.exe Added by the BEAGLE.V WORM! wininit32.exe Added by the XABOT WORM! services.exe Added by the NEWLFRM-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M lsess.exe Added by the FORBOT-BF WORM! sysint16.exe Added by the CRYPTER.A TROJAN! sysinit.exe Added by the BEAGLE.AX WORM! Syslib.exe Adult content related downloader trojan Syslog.exe RapidBlaster variant (in a "Syslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Syslog.exe RapidBlaster variant (in a "Syslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here syslogin.exe Added by the BAGZ-B WORM! Sysman KeyTrap is a surveillance software program that records all keyboard activities. If you didn't install it yourself remove it sysme.exe Added by the PSW_STEALER_C TROJAN! mmsete.exe Added by the NOPIR.C WORM! outlookrem.exe Added by the NOPIR-C WORM! mdms.exe Added by the CIMUZ-D TROJAN! SysMetrix.exe SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics explorer.exe Added by the LEGMIR-Y TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it sys64mnger.exe Added by a variant of the RBOT WORM! sysmntrc.exe Added by the BANCOS-FX TROJAN! sysmod.exe Added by the SPYBOT-DU WORM! sysmon.exe Added by the BIZEX WORM! rpcmon.exe Added by the RANDEX.ATX WORM! sysmon44.exe Added by a variant of the BACKDOOR-CBA TROJAN! [various filenames] Wareout - malware masquerading as a spyware and dialer remover sysmonnt.exe SearchPounder sends keywords typed into HTML forms and popular Internet search engines to a remote server SysMonXP.exe Added by the NETSKY.Q WORM! sysnate.exe Added by the MEDIAS TROJAN! snuninst.exe Unidentified adware sysnet.exe CasClient adware - also detected as the CMAPP TROJAN! sysobj.exe Wareout - malware masquerading as a spyware and dialer remover SysOps Added by the MSNCORRUPT TROJAN! syspare.exe Added by the BIFROSE-AN TROJAN! drv.exe Added by the SOBER WORM! msnmssgr.exe Added by a variant of the RBOT WORM! system.exe Added by the WOOTBOT.FH WORM! tskm0nitor.exe Added by a variant of the RBOT WORM! fdxxl.exe G Data "PC Spion" - monitoring and surveillance software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! bootconf.exe Homepage hijacker, redirecting to coolwwwsearch.com; see for example here rundll32 setupapi, InstallHinfSection.... Search oemsyspnp.inf hijacker - see here

X Y X X X X X X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U

syspol SysPool SysPool SysProtect SysProtect syspw32.exe Sysqq SysR SysReg SysReg Sysres SysRes SysRes SysRes SysScan SysSearch SysSearch sysser SysService SysService SysService32 SysService32 SysService32l SYSsfitb SysStart SysStart SysStart SysStrt syst System System system system System system System system System SYSTEM System System System System system System System System System System System System System System System System SYSTEM System system SYSTEM SYSTEM System system System 64 Driver for Games System Applications Profile System Backup System backup System Backup Services System Buffer Application System Cache System Check

syspol.exe Added by the DREMN-B TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Mssvc.exe StealthDisk - hides folders, files and applications. Will also encrypt them for better protection MSSVC32.EXE Added by the BANCBAN-IO TROJAN! System.exe Added by the NETSPY TROJAN! syp.exe SysProtect is detected as a "potentially unwanted program". It purports to be an system repair/maintenance application, but requires paid registration before any issues found can be fixed. Many of the syspw32.exe Added by the APPFLET.A WORM! LSESS.exe Added by the FORBOT-BF WORM! sysmd.exe Ulubione adult content dialer SysReg.exe Added by the CHEKIN TROJAN! SysReg.exe SearchSeekFind textual marketing foistware Sysres.exe Added by the LOGMOD TROJAN! TASKMANAGER.exe Added by the ELIPTER.A WORM! WWE DIVAS.exe Added by the ELIPTER.D WORM! IExpIore .exe Added by the ELITPER.E WORM! bvt.exe Added by the AUTOUPDER TROJAN! Regedit.exe -s [path] pcsearch.reg Added by the StartPage-FN browser hijacker REGEDIT.EXE -s [path] sysreg.reg Added by the STARTPA-ME TROJAN! [path to file] Added by the RAHACK WORM! SysService.exe Added by the DELF family of TROJANS! SERVICES.EXE NSKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! SysService32.exe Added by the KINDAL VIRUS! ln32k.dll Added by the KINDAL VIRUS! systask32l.exe Added by the THEUG WORM! SYSsfitb.exe Searchforit browser hijacker ***sysi6.exe [* = random char] Added by ZenoSearch adware - filenames spotted include jdisysi6.exe, hjisysi6.exe, ffgsysi6.exe and more 1.exe Added by ZenoSearch adware [adware filename] Added by ZenoSearch ADWARE! systemc.exe Added by the AGOBOT-QA TROJAN! syst.exe Added by the DUMB.A "Joke" virus run322.exe Added by the LANFILT TROJAN! system.exe Added by various WORMS and TROJANS! regedit -s system.dll Homepage hijacker systemsearch.hta Jetseeker.com hijacker dcomx.exe Added by the CIREBOT TROJAN! Explorer.exe Added by the GRAYBIRD TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it YPager.exe Added by the JUNTADOR.K TROJAN! Note - this is not Yahoo! Messenger outlook.exe Added by the MIMAIL.Q WORM! Note that the valid MS Outlook executeable is located in the Program FilesMicrosoft OfficeOffice directory wheras this one is found in the Windows or Winnt directory Atira.exe Added by the KOTIRA VIRUS! lsas.exe Added by the SPYBOT.CJ WORM! kernels32.exe Added by the DLOADER-FC TROJAN! sysctrl.exe Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance, those copies will be identified as spyware csrss.exe Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon svchost.exe Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M lsasse.exe Added by the RBOT-YL WORM! systray.exe Added by the PISABOY-A TROJAN! Note - this is not the legitimate systray.exe process abcdefg.exe Added by the HARWIG-B WORM! cber.exe Added by an unidentified TROJAN! serwin.exe Added by the LDPINCH-BN TROJAN! svchîst.exe Added by the LDPINCH-BF TROJAN! system.exe (74295303) Added by the IU WORM! WINL0G0N.EXE Added by the BANCOS-DB TROJAN! wumgrd32.exe Added by a variant of the RBOT WORM! SPOOLSU.EXE Added by the BANKER-FC TROJAN! system23.exe Added by the LEBREAT-D WORM! windowsps.exe Added by a variant of the RBOT WORM! d.exe Added by the MYTOB.LP WORM! inetinfo.exe Added by the PARDROP-A TROJAN! services.exe Added by the DELF-LQ TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco VSSMON.exe Added by the RBOT-AWW TROJAN! wiinlogon.exe Added by the RBOT-AVG WORM! kernels64.exe Added by the VIXUP-S TROJAN! lsass.exe Added by the SATILOLER.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc sys64dvr.exe Added by the SDBOT TROJAN! sap.exe Added by the RBOT-QF WORM! msystem.exe Adult content dialler [random filename] Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted, examples: web.exe, soft.exe, msxmidi.exe, wmplayer.exe, as well as completely random ones such as 9a2d backups32.exe Added by a variant of the RBOT WORM! buffer32.exe Added by the SDBOT-UD WORM! SysCache.exe Added by an unidentified VIRUS, WORM or TROJAN! Rundll32.exe SysDll32.dll, SystemCheck XPCSpy Pro keystroke logger/monitoring program - remove unless you installed it yourself!

X X X X X X X X X X X X X N U X X X X X X X X X X X X X X X X X X U X X X X X X X U U X X X U X X X X X X X X X X X X X X X X X X X X X X X

system check updater.exe Unidentified adware downloader System Checking wasul.exe Added by the RBOT.BHM WORM! System Config BF3.EXE Added by the SPYBOT-DT WORM! System Config Manager crss.exe Added by the AGOBOT.GH WORM! System Config Manager smssl.exe Added by the AGOBOT-ZJ WORM! System Configuration iexplore.exe Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figu System Configuration syscfg32.exe Added by the MYTOB.EA WORM! system configure svchost.exe Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! System CPL manager [random filename] Added by the RBOT-SR WORM! System CSRSS Patch scrtkfg.exe Added by the RBOT-ADA WORM! System Database administration systemDA.exe Added by the DERDERO.B WORM! System Database Administration Support sysdasp.exe Process Added by the DERDERO.C WORM! System Diagnostics sysdiag32.exe Added by the SDBOT.GEN TROJAN! System DLF cpqdiaga.exe Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs System DLL Resources sysdll.exe Added by the SnapKey is a surveillance software program that records all keyboard activities. If you didn't install it yourself remove it System Document Application nmod.exe Added by the SDBOT-ABB WORM! System Document Application msdocument.exe Added by the RANDEX.COX WORM! System Document Application wins.exe Added by the SDBOT.AUB WORM! System driver Messenger.exe Added by a variant of the SMALL.BJ TROJAN! System Drivers wingmt.exe Added by the SDBOT-MG WORM! System Drivers cpsq32.exe Added by the SDBOT.AXH WORM! System Efficiency Monitor mscedit32.exe Added by the SDBOT.P TROJAN! System Efficiency Monitor mscommand.exe Added by the KWBOT.P WORM! System Event Manager secsvc.exe Added by the RBOT.BMY WORM! System Executable DLL Library EXECDLL32.exe Added by the RANDEX.AZ WORM! System Failure Statistic cnstat.exe Added by the RBOT-LF WORM! System File Drivers nvsysvc32.exe Added by the AGOBOT.WJ WORM! system firewall makeini32.exe Added by the AGOBOT-PS WORM! System Guard mhguard.exe Added by the RBOT-AGU WORM! System Handler LSASS.EXE Added by the NIMOS WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/S system handler srvhandle.exe Added by the REDPLUT VIRUS! System Host Service svchost.exe Added by the SDBOT.BWV WORM! System Kernel lsass.exe Added by the VBBOT-G TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf System LifeGuard Scheduler Slsched.exe System LifeGuard scheduler System Log Event csrss32.exe Added by the AGOBOT-JI WORM! System Management Service smsc.exe Added by the RBOT-ANN WORM! System Manager svchost.exe Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms system manager System.exe Added by the FORBOT-BO WORM! System Manager winsrv32.exe Added by an unidentified WORM or TROJAN! System Manager sysmng.exe Added by the TAME-C WORM! System Manager Updates winsvc.exe Added by the AGOBOT.AEM WORM! System Mechanic Popup Blocker PopupBlocker.exe Related to System Mechanic utility suite from iolo Technologies System Mechanic Popup Stopper Popupstopper.exe Iolo "System Mechanic" popup stopper SYSTEM MESSAGER wmisg.exe Added by the MYTOB.ES WORM! System Messaging Queue SMCSS.EXE Added by a variant of the RBOT WORM! System Messenger SYSMSG32.EXE Added by the SPYBOT-DK WORM! System Monitor SYSMON.EXE Comes with some Aopen motherboards. Monitors CPU temp, voltage and fan speed. Warns if any become abnormal System Monitor Sysmon16.exe Added by the SDBOT TROJAN! System MScvb mscvb32.exe Added by the SOBIG.C WORM! System Net sys32.exe Added by the FORBOT-FX WORM! System Net Database sysnd.exe Added by the RBOT-AAW WORM! System Networking sysnet.exe Added by the RBOT.API WORM! System Power Managment svcnost.exe Added by the DREF-I WORM! System Process csrss.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc System Process lsass.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc System Process svchost.exe Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M System Process CSRSR.exe Added by the AGOBOT-SQ WORM! System Profile Regsrv.exe Added by a variant of the OPTIX TROJAN! System Reboot rebootsys.exe Added by the RBOT-WU WORM! System Redirect sysbho.exe Downloader trojan, "Melkosoft" adware related System Restore svcnet.exe Added by the TIBICK WORM! System Restore Data [path] repcale.exe [path] beird.exeAdded by the RANDON.AN WORM! System Service MSREXE.EXE Added by the AML TROJAN! system service spoolcrv.cpl Added by the INSPIR.11 TROJAN! System Service systems.exe Added by the AGOBOT.VZ WORM! System Service coderxt.exe Added by the RBOT-ALD WORM! System Service exp0lrer.exe Added by a variant of the RBOT WORM! System Service servicent.exe Added by the RBOT-AJI WORM! System service system.exe Added by the BANCOS.AA TROJAN! System Service msnwindows.exe Added by the SPYBOT.YCL WORM!

X X X X X X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X X

System Service System Service System Service SYSTEM service helper SYSTEM service helper System service** System service62 System service78 System service79 System Services System Services System Services System Services System Session Manager System settings System Setup System Soap Pro System startup System Startup System Startup System Startup Manager System Stats System Support System Support System Support System Terminal System time updator System Toolkit System Tray System Tray System Tray Services System Tray32 System Unix system updata System Update System Update System Update System Update System Update System Update System Update Service System Update Service System Update Service System Update Service System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Update2 System Updater Service System Updates System Updates System Updates System Updates System Updates 4 System Updates Manager System Updates Service System Uptime Server System Uptime Server system xp System-Config System-Service system.

servicez.exe msnxpexe.exe teskmangr.exe svchelper.exe syshelp.exe pokapoka**.exe System service62 [path to file] [path to file] [random file name] connection.exe svcsenes.exe svcsenes32a.exe smss.exe burndl32.exe rpcxcmod.exe soap.exe charmapx.exe Voltio.exe kimochi.exe smcss.exe SystemStats.exe syscfg.exe system32.exe syssql.exe SYSTEM2.EXE CSysTime.exe Systools.exe msccn32.exe systray.exe spooles32.exe SysTray32.exe syscfg32.exe updata.exe [filename].exe [random filename] wupdmgr.exe [random filename] wauluclt.exe [path to trojan] wmiprvsa.exe winupd32.exe system.pif update.pif explorer.exe services.exe svchost.exe system.exe taskman.exe taskmon.exe update.exe webcheck.exe wininet.exe winlogon.exe winspool.exe wupdmgr.exe wmiprvsw.exe winsci.exe szwi.exe unve.exe wmkl.exe mssysfix.exe winserv32.exe updates.pif SYSENTRY.EXE SYSENTRY32.EXE acdsee demo.exe msptmf32.com EXPLORER.SCR system..exe

Added by the RBOT-AOY WORM! Added by the RBOT-AUA WORM! Added by the RBOT-AUV WORM! Added by the MONKBD-A WORM! Added by a variant of the MONKBD-A WORM! EliteBar adware - where ** represents the numbers 61 to 79 pokapoka62.exe Added by the ELITEBAR-T and ELITEBAR-U TROJANS! Added by the ELITEBAR-V TROJAN! Added by a variant of the RBOT WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the RBOT WORM! Added by the RBOT-AFG WORM! Added by the KALEL-E WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Added by the SDBOT-ZO WORM! Added by an unidentified WORM or TROJAN! System Soap Pro internet cleaning software. Bundles foistware like Httper and Zipclix - best avoided Only required if using an oriental language Added by the RBOT.NJ WORM! Added by a variant of the RBOT WORM! Added by the RBOT.AMD WORM! Added by a variant of the WOOTBOT WORM! Added by the RBOT-AGQ WORM! Added by the RBOT-AHA WORM! Added by the RBOT-AUH WORM! Added by the SPYBOT-BZ TROJAN! Added by the RANDEX.S WORM! Added by the RONOPER-G WORM! Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as [email protected]! Note - this is not the legitimate systray.exe process Added by the FAN-A WORM! Added by the AGOBOT.ZH WORM! Added by the REPAD WORM! Added by the RBOT-ZD WORM! Added by the LINEAGE-C TROJAN! CoolWebSearch parasite variant Added by the KORGO.W or KORGO.X WORMS! Added by the SOROMO-A TROJAN! Added by the SOROMO-A TROJAN! Added by the SDBOT.EF WORM! Added by the AUTOTROJ-D TROJAN! Added by the AGOBOT-RG TROJAN! Added by the ADTODA-A TROJAN! Added by the RBOT-ALL WORM! Added by the SPYBOT.WOE WORM! Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Added by the AUTOTROJ-C TROJAN!Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Added by the AUTOTROJ-C TROJAN! Added by the AUTOTROJ-C TROJAN! Added by the GAOBOT.AFC WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AXE WORM! Added by the RBOT-AWG TROJAN! Added by the RBOT-AYJ WORM! Added by the RBOT-ADU WORM! Added by the AGOBOT-AGA WORM! Added by the RBOT-AMA WORM! Added by the RBOT.LK WORM! Added by the RBOT.LK WORM! Added by the SALGA.A WORM! Added by the LIOTEN.FA WORM! Added by the BENJAMIN WORM! KaZaA file-sharing users beware! Added by the OPTIXPRO.13.C TROJAN!

X X X X X X U X X X X X X X X X X X X X X X X X U X X X X U X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ? X

system... System.exe System132 system23 System32 System32 System32 System32 system32 System32 System32 system32 System32 PCI Manager System32 PCI Manager System32 TCP Manager System32 TCP Manager System32 Temp Service system32.dll system32.dll system32.exe system32.exe System32Check System32Dll System32Ex System32kfvwÆ System33 System4224411 System4224411 SystemAdministration SystemAgent SystemB SystemBackup SystemBackup SystemBoot SystemBoot Systemboot SystemCheck SystemCheck SystemCheck SystemCheck SystemChecker SystemCONF98i SystemDebug SystemDll systemdll32.exe SystemDriver SystemDriverCheck SystemDriverLoad systemdrv SystemEmergency SystemExplorer SystemFile SystemFTP SystemGent SystemInit Systemiom Updater SystemKey SystemLoad32 SystemManager SystemMap32 SystemMD SystemMonitor SystemNetwork SystemNetwork SystemNT SystemProcEvent systemr systemr SystemReg SystemReg

system...exe System.exe Csrtss.exe notPad.exe system.exe System32.exe sysdiag.exe system32,1.exe NeT-BoT.exe lsasss.exe crsvvc.exe QQGame.exe syspci32.exe syspci32.exe systcpm.exe systerm.exe systmp.exe systeminit.exe sysdll32.exe services32.exe system32.exe [random].exe DLL32SYS.EXE System32Ex.exe sysdiag.exe FB_PNU.EXE Virus Systemdll.exe Wincmp32.exe Sage.exe MessengerStopper.exe mtx.exe MicroLog.exe ladies.htm Mshta.exe ...filename.hta msnsngr.exe Systemcheck.exe services.exe svchost.exe SysCheckBop32.exe Syschk.exe SystemCONF98i.exe Sysdeb32.exe SystemDll.exe systemdll32.exe csrss.exe svchost.exe svchost.exe ms32sys.exe [various filenames] explore.exe SystemFile.exe VSENMB.exe CVT.exe iservc.exe Systemiom.exe rundll32.exe [path] SystemKey.dll sysload32.exe Sysman32.exe Netisp32.vbs md.exe Sysmon32.exe NETSERV.EXE sysnet.exe SystemNT.exe csrwnd.exe d11host.exe gedit.exe PROCES.EXE svchost.exe

Added by the OPTIXPRO.13.C TROJAN! Added by various WORMS and TROJANS! Added by the LANFILT-I TROJAN! Added by the ESTEEMS.D TROJAN! Added by the BUSHTRO122 TROJAN! Added by any number of WORMS or TROJANS! SpyAgent.B surveillance software - uninstall this software unless you put it there yourself! Added by an unidentified VIRUS, WORM or TROJAN! Added by the AGOBOT-LJ WORM! Added by the RBOT-XW WORM! Added by the RBOT.BLY WORM! Added by the QQPASS-AC TROJAN! Added by the RBOT-AFR WORM! Added by the RBOT-AFR WORM! Added by a variant of the RBOT WORM! Added by the RBOT.AFD WORM! Added by the RBOT-AET WORM! CoolWebSearch parasite variant - re-directing to your-search.info CoolWebSearch parasite variant. Redirecting to wholeworldmarket.com, most likely other domains as well Added by a variant of the BACKDOOR.IRC.BOT TROJAN! Added by the GRAYBIRD.P TROJAN! Added by the CHAST-A TROJAN! Added by the SPYBOT-CZ WORM! Added by the IRCCONTACT TROJAN! SpyAgent.B surveillance software - uninstall this software unless you put it there yourself! Added by the NICHELLO-A WORM! Added by the CAGER.A WORM! Added by the YUSUFALI-B WORM! Added by the ASYLUM TROJAN! Microsoft Plus! System Agent automatically tunes your system, performing tasks such as disk optimization and error correction. It can also run any application at prescheduled times MessStopper adware Added by the MTX VIRUS/WORM! Added by the MICROLOG.A TROJAN! Unknown but sounds very suspicious?? Adult content dialler Added by a variant of the RBOT WORM! Added by the LAVITS WORM! Added by the SOBER-M WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco WINBO adware Added by the GALIL.F WORM! Added by the GLITCH BOT TROJAN! Added by the SYSBUG TROJAN! Added by the LOXOSCAM TROJAN! Added by the FEUTEL-F TROJAN! Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by an unidentified WORM or TROJAN - most likely GAOBOT variant CoolWebSearch Smartsearch parasite variant Homepage hijacker - file located in the "Services" folder in Common Files Added by the DULLDOOR-A TROJAN! Malware (ie, malicious software). Also changes the system.ini Shell line to read Shell=Explorer.exe VSENMB.exe, and it hacks the Winstart.bat as well Added by the BRONTOK-H WORM! Added by the FIZZER WORM! Added by the SPYBOT.TY WORM! rdl Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Added by the MIMAIL.E WORM! Added by the DOWNLOADER-BW.B TROJAN! Added by the REDIST.C WORM! Homepage hijacker Added by the AIDID.A WORM! Added by the NETCONTROL VIRUS! Added by a variant of the RBOT WORM! Added by the PWSVB-EG TROJAN! Added by the IRCBOT.I TROJAN! Added by the GX TROJAN! Added by the ADCLICK-AQ TROJAN! ?? Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco

X X X X X X X X X X U U U X X X X X X X X U X U X X X X X X U X X U U N X U X X U X X N X X X X ? X ? X X X U X X X X X X X X X X X U X X X

SystemReg WINREG.EXE Added by the DEWIN.A TROJAN! Systems scchost.exe Added by the DAEMOZ.A TROJAN! Systems svch0st.exe Added by the MYDOOM.BI WORM! Systems Systems.exe Added by the BANKBOA-A TROJAN! Systems itDDD.exe Added by the DLOADER-PP TROJAN! Systems Backups windrives.exe Added by the AGOBOT-RB WORM! Systems Restart slchost.exe Added by the MULTIDROP.C TROJAN! Systems Restart spchost.exe Added by an unidentified WORM or TROJAN! Systems Restart Rundll32.exe beem.dll, DllRegisterServer Browser hijacker - the file serves to register a dll implemented as a browser plugin Systems Restart Rundll32.exe snim.dll, DllRegisterServer Added by the Startpage.I hijacker Systems.exe Systems.exe Keyboard Spectator - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it systems.exe systems.exe KGBSpy is a commercial surveillance software program. It logs keystrokes, Web sites visited, and clipboard activity. It also has a screen capture logger and can be run automatically in a silent, undetect SystemSafe Syssafe.exe System Safety Monitor - system monitoring tool with additional application firewalling SYSTEMSars32 csrss.exe Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig SystemSAS System32.exe Added by the KWBOT.C WORM! SystemSearch regedit.exe -s c:ie.reg Installs a Seachxl.com browser page hijack SystemSearch regedit.exe -s c:sys.reg Installs a i--search.com browser page hijack SystemService msocfg.exe Premium rate adult content dialler SystemService navchk.exe Premium rate adult content dialler SystemService qservice.exe Premium rate adult content dialler SystemService shman.exe Premium rate adult content dialler SystemService nsserver.exe NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself! SystemSettingf TRUG.vbs Added by the TRUG.B MACRO! SystemSuite Task Manager MXTASK.EXE vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro SystemTasks filez.exe Adult content dialler SystemTasks sexypicz.exe Adult content dialler SystemTasks loaded.exe Adult content dialler SystemTools kernels32.exe Added by the DLOADER-FC TROJAN! Systemtra Systra.exe Added by the LOVGATE-W WORM! SystemTra CDPlay.EXE Added by a variant of the LOVGATE WORM! SystemTray SysTray.Exe SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none SystemTray SystemTray.exe Added by the BIGFOOT TROJAN! Note - this is not the legitimate systray.exe process SystemTray SysTray.exe Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the "Properties" reveal it to be a Microsoft file SystemTraySD SDSystemTray.exe Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here SystemTraySR SRSystemTray.exe Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here SystemUpd SystemUpd.exe Updater for Swapoo.com, a kind of Napster for games SystemWideHook for Windows NT %WinHook32.exe Added by the MYDOOM.AC WORM! SystemWizard Sniffer Sniffer.exe SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC systemyom Updater systemyom.exe Added by a variant of the BACKDOOR.IRC.BOT TROJAN! SYSTEMZ Patch SYSZ.exe Added by the ALADINZ.P TROJAN! System_Messages pprsen.exe TerminatorX - "offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA, messenger programs, chat rooms and the like" Systes jrdtifkkxbbsa.exe Added by the RBOT-ADC WORM! Systesms.exe systesms.exe Added by the RBOT-HI WORM! Systest Systest.exe Clean Space temp files cleaner systhread winkernal.exe Added by the LIAMED WORM! SysTime systime.exe CoolWebSearch parasite variant - also detected as the STARTPA-FL TROJAN! Systmesy Systmesy.exe Added by the RBOT-KQ WORM! Systoan32 systoan.exe Added by an unidentified VIRUS, WORM or TROJAN! systr32 systr32.exe ?? systrans [path to trojan] Added by the STARTPA-GZ TROJAN! systrax systrax.exe ?? Systray Systray_.Exe Added by the KERGEZ.A WORM! Systray [filename.exe] Winfavorites adware SYSTRAY UNMT.EXE Added by the DLOADER-LQ TROJAN! SysTray SysTray.Exe SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none SysTray Snnpapi.exe Added by an unidentified TROJAN! Systray w32explorer.exe Added by the RBOT-AJY WORM! Systray SteFanie.vbs Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders Systray driver systray.exe Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process SystrayServices Msxpw.exe Added by the CITOR WORM! systree systree Added by the BANCOS.L TROJAN! Systrsy Systrsy.exe Added by the CDTRAY TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Systry [path to worm] Added by the AUTEX WORM! SYStry spoolsvr.exe Added by the SDBOT.GN WORM! Systryt [path to worm] Added by the AUTEX WORM! SystUphes algesetp.exe Added by the QQPASS-AM TROJAN! Systweak Memory Optimizer memtuneup.exe Part of SysTweak Advanced System Optimizer sysu sysu.exe Dynamic Desktop Media adware - see here sysug32.exe sysug32.exe Added by an unidentified TROJAN or WORM! SysUpd Sysupd.exe VirtuMonde adware

X U U X X X X X X X X U X N U U X N Y X U U Y ? N X ? N X N ? ? ? X X X U U X X ? ? U U X X X X X X X X X X X X X X N N N X X X X X X X X X

Sysvupex SysW8 SYSWB6 SysWin syswin32 Syswindow SysWy sysX3 SYS_CLEAN Sys_Run sys_Runtt1 SZMsgSvc.exe t T-DSL SpeedMgr T3Console Taakcontrole Taba Tablet tablet s Tablet Task TabletTip TabletWizard TabUserW TAcelMgr Tad Taesk managers TAG Tahni Deskmate TAKSMGN TalkingReminder talknow Tango TangoManager TANG_INA_MO Tapicfg Tapisys TapiTNA Tardis Task Task Bar Task BarClient Task BarSvr Task Catcher Task Catcher Real-Time Detector Task Commander Task Debugger Task Help Task Manager Task Manager Task Manager Task manager Task manager Task manager Task Monitoring Service Task Scheduler Engine task service Task service TASK SETUP Taskbar TaskBar Taskbar Display Controls Taskbar Service Taskbar System Taskbell.exe taskdir TaskList TaskMan taskmanager taskmanager TaskManager

Sysvupex.exe Added by the MEDIAS TROJAN! csta.exe Clean Space - privacy and perfomance enhancer SYSWB6.exe We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content, while filtering out sites that contain adult content SysWin.exe Added by the IRCCONTACT TROJAN! syswin32.exe Added by a variant of the SPYBOT WORM! Syswindow.exe Added by the COW TROJAN! rundll32.exe Added by the LINEAGE-JH TROJAN! Note - this file is found in the C:WindowsSystem folder, and is not to be confused with the legitimate rundll32.exe file, always located in the Windows folder on Win98/ sys22.exe Added by the RANTS.C WORM! Service.exe Added by the FLOPCOPY WORM! ghost.exe Added by the LINEAGE-N TROJAN! explorer.exe Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added i SZMsgSvc.exe StopZilla! - pop-up killer xclean.exe Flashtrack.B adware speedmgr.exe T-Online ISP SpeedManager - shows upload and download speed. Also checks for updates automatically T3Console.exe Related to T3 Security Suite - prevents unauthorized or inappropriate access to your PC and data taskmon.exe Task Monitor (on Dutch language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also stte.exe PurityScan/Clickspring adware Tablet.exe Loads the tablet drivers for the Wacom Graphics Tablet. This can be unchecked in msconfig without problems if you don't need the tablet functional all the time. Create your own shortcut if you need to tablet s Starts the Wacom Penabled driver on Acer Tablet PCs (tablet icon with a green check appears during startup if successful) tabletsk32.exe Added by the RBOT-AJB WORM! tabtip.exe The Microsoft Tablet PC Input Panel converts handwriting to text dynamically, and you can make corrections quickly and easily before inserting text SPLSHWRP.EXE Microsoft Tablet PC Component TabUserW.exe Wacom pen tablet driver TAcelMgr.exe TOSHIBA Acceleration Utilities related. What does it do and is it required? tad.exe From Turtle Beach's Santa Cruz on a Dell WinME system. Not required - works fine without it including keyboard hot controls for volume and mute tase.pif Added by the RBOT-AYK TROJAN! tag.exe ?? Tahni.exe Tahni Deskmate - "Interactive cartoon character that lives on your Windows desktop" taskmr.exe Added by the RBOT-AHS WORM! TALKINGREMINDER.EXE Talking Reminder from Software River Solutions - talking calendar reminder talknow.exe Could it be related to this or something similar? Setup.exe Tango Broadband access software. Is it required? TangoManager.exe Tango Broadband access software. Is it required? AutoRun.bat Added by the FILUKIN.A WORM! Tapicfg.exe CoolWebSearch Tapicfg parasite variant tss.exe Added by the SMALL TROJAN! TapiTNA.exe Telephony Location Selector allowing mobile users to change dialling locations - part of the Win95 Power Toys Tardis.exe Tardis - time synchronization software tasker.exe Added by the MYDOOM.R WORM! TASKBAR.EXE Added by the FRETHEM.J WORM! TaskBarClient.exe Responsible for creating the System Tray icon and associated display system for the Starband satellite always on internet service TaskBarSvr.exe Part of the Starband satellite always on internet service. Not included on the current system. What does it do and is it needed? tasktrap.exe Task Catcher - utility that will block unwanted programs from running tasktrap.exe Task Catcher - utility that will block unwanted programs from running regsvc32.exe Added by the AGOBOT-RX WORM! sysdll.exe Added by the RBOT-CQ WORM! wualcts.exe Added by a variant of the RBOT WORM! taskmngr.exe Added by the RBOT.Y WORM! taskman.exe Added by the FORBOT-T WORM! prcview.exe Added by the AGOBOT-RT WORM! taskemngr.exe Added by the RBOT-AGA WORM! TikTo.exe Added by the RBOT.LV WORM! taskmngr.exe Added by the RBOT-AYZ WORM! svchost.exe Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf schedsvc32.exe Added by the RBOT-ASJ WORM! taskservices.exe Added by a variant of the RBOT WORM! taskmgs.exe Added by a variant of the RBOT WORM! tasksetup.exe Added by the RBOT-YR WORM! Taskbar.exe Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards CTLTask.exe Creative SoundBlaster Audigy Taskbar - used to choose between different types of EAX Effects, not required in startup. NOTE: if you get a ctltask.exe error message while installing the Audigy drivers, s RunDLL deskcp16.dll, QUICKRES_RUNDLLENTRY Only appears in MSCONFIG if you have a Display Settings icon in the System Tray allowing resolution changes on the fly. Can also be disabled under Control Panel -> Display -> Settings -> Advanced -> taskbar.svc Unidentified adware tasksys.exe Added by a variant of the SDBOT WORM! Rund1.exe Added by the YIPID TROJAN! taskdir.exe Added by the LAGER.AQ TROJAN! tasklist32.exe Added by the BANCOS-DX TROJAN! rundll32.exe Added by the DVLDR TROJAN! Note - this is not the valid "rundll32.exe" as it's in the WindowsFonts directory taskmgr.com Added by the BEREB WORM! taskmanager.exe Added by the AGOBOT-TF WORM! [path to trojan] Added by the LDPINCH-CF TROJAN!

X X X X X X X N X X X X X X X X X X U X X X N N X X X U N X N X X Y ? U U U N Y X U X N ? X Y N N N ? ? U U U U X X X X X X X X X X X X X X

taskmanger Taskmgo Taskmgr Taskmgr taskmgr Taskmgr taskmgr taskmgr.exe taskmgr.exe taskmgr.exe taskmgr.exe TASKMGRU taskmngr taskmngr lptt01 taskmngr ml097e TaskMon Taskmon driver taskmone TaskMonitor TaskMrg taskmrg.exe taskopen.exe TaskPlus TaskPlus TaskReg TaskS manager Taskschd TaskScheduler taskswitch tasksys Tasktray Tasmgr tat Tau monitor TAudEffect TB2PROEXE TBC Pro TBC.exe tbctray TBLFUNC tbon TBPanel TBPS TBTray TB_setup TB_setup tcactive TCASUTIEXE TCASUTIEXE TCAUDIAG -off TCDPbtn TCDPlay TClock TClockEx tcmonitor TCOYFReminder Tcp Application Manager Tcp Application Manager Tcp Application Manager Tcp Application Manager Tcp Application Manager Tcp Application Manager Tcp Application Manager Tcp Application Manager tcp checker TCP Monitoring tcpippui tcpippui32 TCPXP Update tcupdater

taskmanger.exe Added by a variant of the RBOT WORM! [path to file] Added by the BANCBAN-T TROJAN! Taskmgr.exe System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory tskmgr32.exe Homepage hi-jacker taskmgr.exe Added by the Startpage.G hijacker. Note - this is NOT the Windows Task Manager file! system.exe Added by the PAKES.G TROJAN! explorer.exe Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added taskmgr.exe Windows Task Manager in Windows XP. If run from the Startup folder, the tray icon will be put to the system tray after boot. Useful to check if XP has finished running the delayed services after boot. Av paint.exe Added by a variant of the AGENT.AH downloader TROJAN! mirc.exe Added by a variant of the AGENT.AH TROJAN! paintms.exe Added by a variant of the AGENT.AH TROJAN! TASKMGRU.EXE Added by the CWS-M TROJAN! [path] msnve.exe [path] task.exe Added by the FLOOD-EK TROJAN! taskmngr.exe RapidBlaster variant (in a "Taskmngr" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here taskmngr.exe RapidBlaster variant (in a "Taskmngr" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here taskmon.exe Added by the MYDOOM.A or MYDOOM.J WORMS! Note - this is not the legitimate Win9x/Me file of the same name which resides in C:Windows as this version resides in C:WindowsSystem (Win9x/Me), C: winampa.exe Added by the LOONY-I TROJAN! Note - this is NOT the popular Winamp media player which has the same filename taskmone.exe Added by the SINGU-S TROJAN! taskmon.exe The Task Monitor checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a csrss.exe Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco taskimg.exe Added by the DLOADER-QZ TROJAN! taskopen.exe Added by the HIDD.C TROJAN! TASKPLUS0.EXE Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN TASKPL~1.EXE Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN [random filename] Added by the CBLAD WORM! taskmgrs.exe Added by the AGOBOT.QU WORM! TRAYWND.EXE Added by the LITMUS.002 TROJAN! TaskSch.exe ProSeries accounting software related taskswitch.exe ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen tasksys.vbs Added by the BYRON WORM! CTLTray.exe Installed with the Sound Blaster Audigy range of soundcards. Allows you to set EAX effects or equalizer settings for the Sound Blaster Audigy from a systray icon. Also allows you to launch the Taskbar v Taskmgr.bat Added by the YPSAN.G WORM! tatss.exe Delfin Promulgate adware variant Taumon.exe Tauscan is a powerful Trojan Horse detection and removal engine capable of catching every known type of backdoor that can threaten your system. TAudEff.exe TOSHIBA Notebook related. What does it do and is it required? tb2start.exe Timbuktu Pro - remote desktop access software tbcpro.exe TitleBarClock Pro - displays Day, Time, Date, Month, Year, FreeMem, and FreeDriveSpace on the right side of the title bar in any main window that has the mouse or keyboard focus TBC.exe TitleBarClock software tbctray.exe Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel tblmouse.exe Aiptek HyperPen driver tbon.exe BestOffers adware TBPanel.exe Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel TBPS.exe WebSearch Toolbar - HuntBar hijacker, toolbar installer variant tbtray.exe VLSI/QSound ThunderBird PCI Control Panel. System Tray access to the settings for this and related soundcards. Available via Start -> Settings -> Control Panel TB_ANI~1.EXE ?? tb_setup.exe HuntBar hijacker, toolbar installer tca.exe Part of The Cleaner from MooSoft - stops virus trojans before they can do any damage tcaudiag.exe 3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs TCASUTI.exe Associated with the 3COM diagnostic module (3COM NIC Doctor). No further information is available tcaudiag.exe 3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs TCDPbtn.exe Found on a Toshiba laptop TCDPlay.drv Found on a Toshiba laptop - sounds like the driver for the CD-ROM but why doesn't it use the standard Windows drivers - any comments? TCLOCK.EXE Kazubon TClock. Utility that amongst other things synchronizes your system clock with Internet time servers. Available via Start -> Programs TCLOCKEX.EXE Puts a configurable time/date display in the tray (and other features). Freeware by Dale Nurden and is popular on cover disks tcm.exe Part of The Cleaner from MooSoft - warns of changes to the registry tcoyftray.exe My ParenTime Fertility Planner Reminder. The calendar provides a quick overview of the status of your fertility localsvc.exe Added by the DLOADER-NY TROJAN! netsvc.exe Added by the DLOADER-NY TROJAN! spoolsvc.exe Added by the DLOADER-NY TROJAN! svcadmin.exe Added by the DLOADER-NY TROJAN! svcman.exe Added by the DLOADER-NY TROJAN! svcrun.exe Added by the DLOADER-NY TROJAN! tcpsvc.exe Added by the DLOADER-NY TROJAN! websvc.exe Added by the DLOADER-NY TROJAN! tcpcheck.exe Added by the VBBOT-A TROJAN! LanNSvc.exe Added by the RANDEX.AAS WORM! tcpippui.exe Added by the RBOT-APS WORM! tcpippui32.exe Added by the RBOT-ART WORM! tcpxp.exe Added by the RBOT-UL WORM! tcupdater.exe Topconverting.com/180Search adware updater

U U N ? U ? N Y U N Y X X Y X X X X X X U N ? X X X ? N N X X U U Y X U N X U U N X X U N X U X X ? X U U X U Y X U X U X X X U X X U N U U

TDispVol TDKSTART TDKTASK TDockNUndock TDS3 TDspOff Teach In Box Tech-In-A-Box Telechips,Mass Telemeter 3.0 Telepath Telnet Telnet24 TELUS Security service TempCom tempx Tencent QQ Terminal Update Terminate Popup Terminate Popup TEscKey Tesco.net Tesla test Testing 123 testit.exe TExBUtil Registry TextAloud Textbridge Instant Access OCR TEXTCONV TEXTCONV TFncKy TFNF5 tfswctrl TFTP*** TFunckey TgAddServer tgbcde Tgcmd tgcmdprovidersbc TGCMG TGDC IE Plugin tgkill Tgsetsite Thdetrf ThE The Easy Bee's Hive The Ethernet The Intranet TheMainStart TheMonitor THGuard THGuard This is a virus, please delete it THOTKEY ThpSrv Threaded ThrustTSR Thumbs Plus *.* TI WLAN tibs3 tibs5 Tiger TiKL Time Manager Time Zone Synchronization TimeCalendar Timed Backups Manager Startup TimeLeft Timemanager.exe

TDispVol.exe Used on Toshiba computers to make the Fn key have control over the volume on/off TDKSTART.EXE Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. TDKTASK.EXE Taskbar utility for a "control panel" for a CD-RW N/A Found on a Toshiba laptop - for use with a docking station? TDS-3.exe DiamondCS TDS3 antitrojan. Can be used to scan on demand, but required in startup if you prefer real time protection Tdspoff.exe Found on a Toshiba laptop teachbox.exe Tutoring program that comes with a SystemAX Computer techbox.exe Tech-in-a-Box "provides easy-to-use tools for various system maintenance tasks. From backup and restore to diagnostics and repairs, Tech-in-a-Box is your tool to stay up and running" patch.exe Removable disk driver for the Muro MP3 player telemeter3.exe Internet connection bandwidth meter from a user ISP telepath.exe Drivers for the WinModem versions of the US Robotics "Telepath" series - as supplied to Gateway for instance. WinModems use software rather than hardware - hence putting a load on the CPU. Needed Telnet.exe Added by the VOUMIT-A WORM! Note - this is not the legitimate telnet.exe application which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc [random filename] Added by the RBOT-ARD WORM! freedom.exe Freedom Internet Security, provided by TELUS Communications Inc [randomname].com Added by the TRAXG WORM! tempx.exe Added by the TEMPEX.A TROJAN! Rund1132.exe qq.dll, Rundll32 Added by the QQPASS.F TROJAN! biosefui.exe Added by the PPDOOR-O TROJAN! ZPU.exe Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here FPUK.exe Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here TEscKey.exe Toshiba Escape Key handler. Enables you to program and use the <Esc> key combination to perform a specific function rundll32 [path] RyDial.dll, QuickStart Tesco.net dial-up ISP software - not required TESLA.EXE ?? i love you.exe Added by the SINGU-T TROJAN! msdata.dat Added by the NITS.A WORM! testit.exe ISTBar adware TExBUtil.exe ?? TextAloudMP3.exe TextAloud MP3 - convert text into spoken words and MP3s telepath.exe TextBridge from Scansoft. OCR (optical character recognition) software for scanning documents into popular editing applications. Available via Start -> Programs services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! TFncky.exe Deals with the - key combinations on a Toshiba laptop TFNF5.exe Toshiba Hotkey Utility for Display Devices. By pressing + , a window appears showing the displays that can be chosen - LCD, LCD + CRT, CRT, TV tfswctrl.exe Drive letter access to a UDF packet writer for CD-RW - from HP, Veritas an others. Similar to Roxio's DirectCD and does the same thing. From HP - "This is a needed file as it controles the readability of th tftp*** Added by a variant of the SPYBOT WORM! where *** can be any number TFuncKey.exe Deals with the - key combinations on a Toshiba laptop tgfix.exe Software from SupportSoft (aka Support.com) provided to manufacturers (such as Sony (Vaio Support Agent) and Toshiba (Virtual Tech)) and ISPs (such as Comcast, Cox and Charter (Pipeline Support A module32.exe Added by the REIGN.R TROJAN! tgcmd.exe See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user inform tgcmd.exe See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user inform ?? Related to Rogers@Home, causes errors in WinSock32.dll. Not required for connection to work tgdc.exe ShopForGood spyware - see here tgkill.exe Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was m tgfix.exe See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user inform thdetr32.exe Appears to be related to Lycos advertising wind0s.exe Added by an unidentified WORM or TROJAN! ATCEgSvr.exe The Easy Bee is a software that allows you to record Internet navigation sequences, which can include form filling and button clicking and to attach a replay schedule to each sequence ethernet.exe Added by a variant of the SDBOT WORM! intranet.exe Added by a variant of the SDBOT WORM! N/A ?? [path to trojan] Added by the DLOADR-LO TROJAN! TH_Guard.exe Resident memory scanning for TrojanHunter THGuard.exe Resident memory scanning for TrojanHunter bigbadvirus.exe Added by the RANDEX.F WORM! THotkey.exe Associated with the Fn+ keys on Toshiba laptops. When disabled some keys still worked, like the one that regulates the volume of the system beep, but others didn't, like the one that immediately blac thpsrv.exe Toshiba Hard Drive Protection Utility - moves the Hard Drive head to a safe position in case of shock or vibration to reduce the risk of damage that could be caused by head-to-disk contact intcp32.exe Added by the RANDEX.UG WORM! TMTMTSR.exe Thrustmaster Thrustmapper. "The Thrustmapper - t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly" thmbplus**.exe Added by the AGOBOT-AAF WORM! ** is a combination of a random digits and characters TIWLANCu.exe Texas Instruments TI wireless LAN products tibs3.exe Premium rate adult content dialler - see here tibs5.exe Premium rate adult content dialer - see here Shine.exe Added by the HAPPYLOW (or NISHE-A) VIRUS! tikl.exe TinyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself! TimeManager.exe Added by the MYTOB-BV WORM! wscript zshell.js Added by the NETDEX-A TROJAN! tc.exe TimeCalendar digital planner BACKTIME.EXE Backup Plus - backup software TimeLeft.exe TimeLeft is a countdown, reminder, clock, alarm clock, stopwatch, timer, sticker and time synchronization utility which uses Winamp skins to show digits and text Timemanager.exe Time Manager will let you track billable and non-billable time by customer, by category and by associate and then integrate directly to our custom billing package

N X X X X X X X N U N X Y U U N U U N U U U N X N N N N N N X N X ? U U U U X X ? ? U ? U U ? X X U Y N U U U X X X X X X X X ? ? ? X ? U X

TimeOnline TIMER Timer Timer TimeService TimeSink Add Client timessquare TimeSyncApp TimeUp Timezone TINTSETP Tiny AV Tiny Personal Firewall tinySpell TiomanExe Tips TiTleBarClock TitleTime Tivoli TivoServer TivoTransfer TIxDSL TizzleTalk tjstartup TkBell.Exe TkBell.Exe TkBell.Exe TkBellExe TkBellExe TkBellExe TkNetDriver Monitor tkonnect tlc TlcR tlntsvr TLogonPath TM Outbreak Agent TMA distribution tmax tmchook TMEEJME TMERzCtl TMESBS TMESBS32 TMESRV31 TMExLogon Tmmkb TmNetDriver Monitor Tmntsrv32 TMOUSE tmproxy TMTMTSR TNTClk ToADiMon.exe Toggler Tok-Cirrhatus Tok-Cirrhatus Tok-Cirrhatus Tok-Cirrhatus-1959 Tok-Cirrhatus-1959sarc Tok-Cirrhatus-2784 Tok-Cirrhatus-2784 Tok-Cirrhatus-[4 random digits] TomcatStartup TomcatStartup 2.5 Tommorrow ToP ToPassSrv TopDesk ToPicks Starter

TIMEONLINE.EXE TIMER.EXE comm.exe timed.exe trun.exe TSADBOT.EXE timessquare.exe TimeSynchronize.exe Timeup.exe TimeZone.exe TINTSETP.EXE fooding.exe persfw.exe tinyspell.exe Tioman.Exe mousetips.exe TiTleBarClock.exe TiTime.exe LCFEP.EXE TiVoServer.exe TivoTransfer.exe tidslmon.exe TizzleTalk.exe [path to file] evntsvc.exe realsched.exe tkbell.exe evntsvc.exe realsched.exe tkbell.exe lexbce.exe TKONNECT.EXE update911.js avp.exe tlntsvr.exe tb2logon.exe TMOAgent.exe cfinst.exe pupdate.exe tmchook.exe TMEEJME.EXE TMERzCtl.EXE TMESBS21.exe TMESBS32.EXE TMESRV31.EXE TMESRV.EXE Tmmkysvr.exe exbce.exe Tmntsrv32.exe tmouse.exe tmproxy.exe TMTMTST.exe TNTCLK.exe ToADiMon.exe toggler.exe IDTemplate.exe smss.exe [path to file] br4941on.exe sv711224030r.exe br6591on.exe smss.exe br[4 random digits]on.exe hpbpsttp.exe hpbpsttp.exe tomorrow.exe LSASS.exe Pktopass.exe TopDesk.exe Idhost.exe

Lightman Groups's TimeOnline monitor. For dial-up users to monitor time spent on the net. Available via Start -> Programs Added by the TIMESE.AG WORM! Added by the IP TROJAN! Added by the LV TROJAN! TlfLic-A premium rate adult content dialler Advertising spyware Reported as Trojan.Win32.StartPage.aw by Kaspersky Anti-Virus DealHelper adware TimeUp - internet online timer Microsoft Daylight Saving Time Update Utility - see here Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Added by the NETSKY.I WORM! Tiny Personal Firewall Tinyspell - "allows you to easily and quickly check the spelling of words in any Windows application. Monitors your typing on the fly, alerts you whenever it detects a misspelled word, and checks the spe Agate Tioman - warm and hot swap removable bay device manager for IBM laptops Suggests tips on using your mouse TitleBarClock displays the day/month/time and free physical RAM on the right hand side of an open window, replacing the system tray clock at startup TitleTime adds the current date and/or time to the Caption of the currently active application window. Additional options are a second clock (with a different time), week number, GMT/UTC time, Swatch Tivoli 'TME' System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to fu Tivo Server - installed with the TiVo Home Media Option. It streams audio files to your television/home theater from your PC Tivo Transfer Service. TiVo Desktop is an easy-to-use application that lets you publish and share digital music, photos and TiVo recordings between your networked TiVo Series2 DVR and your computer Actiontec DSL modem. Associated with High Speed AOL DSL. Used to get line sync with the Actiontec DSL USB Modem. Available via Start -> Programs TizzeTalk is a dialect translator for Yahoo, MSN, AOL Instant Messengers. Bundles adware, hence not recommended. From their EULA : "As a result of installing the Company's Software, you will see occa Added by the TJSERV.C TROJAN! Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Reals Added by the SDBOT-ADF WORM! Dialer for the Tiscali internet service provider. Available as a desktop shortcut Hijacker installer ?? Microsoft program associated with Telnet Timbuktu Pro - remote desktop access software Trend Micro Internet Security anti-virus software virus outbreak warnings. Notifies users of virus outbreaks and offers to update the scanner Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Adware pop-up generator Detected by Kaspersky as the TrojanDownloader.Win32.VB.aa VIRUS! Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Toshiba Mobile Extension Selectable Bay Service for WinXP - support for docking stations. Not required if you don't use a docking station Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station Toshiba multi-media keyboard software - possibly including creating keyboard shortcuts? Added by the SDBOT-ABR WORM! Hijacker, detected by Norton antivirus as Trojan.StartPage.O Component of the Toshiba Mouse Control that allows users with an AccuPoint mouse to scroll MS-scroll-compatible documents by holding CTRL + ALT and moving the AccuPoint up or down. It also allow Trend Micro PC-cillin 2003 antivirus software Installed with Thrustmaster game controllers. It launches the Thrustmapper utility. Not required if you install the "driver only" from Thrustmaster website Overclocking program for TNT, TNT2, and other graphics cards. This program can overclock the graphics card manually after startup when needed, especially before starting a gaming session. However T-Online ISP software connection assistant Toggler allows you to gain control over your Caps Lock, Num Lock, and Insert keys. It prevents you from writing in ALL CAPS when your finger has slipped to accidentally hit the Caps Lock key Added by the RONTOKBRO.A WORM! Added by the BRONTOK-A WORM and variants! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally f Added by the BRONTOK-F WORM! Added by the BRONTOK-J WORM! Added by the BRONTOK-R WORM! Added by the BRONTOK-L WORM! Added by the BRONTOK-S WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the BRONTOK-M WORM! Apache Tomcat web server, part of HP LaserJet "Printer Tools" software. What does it do and is it required? Apache Tomcat web server, part of HP LaserJet "Printer Tools" software. What does it do and is it required? ?? Added by the WOWCRAFT.C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Related to Caere Pagekeeper scanning software (now taken over by Scansoft), Disabling is known to cause problems TopDesk - puts an icon in your system tray that when clicked upon, opens a pop-up menu that gives instant access to all of your desktop programs without having to minimize, resize, move or close oth TOPicks adware

X X U X X X N Y U N U U Y U U Y U U N N N U U U ? N X U U U U U U U U Y U N ? ? Y U N U ? U U U U U U U U U U U U U N X U U U N N X N U Y Y

topmoxie TopSearch Tor tor anonymous proxy Torjan Program Torjan Program TOSCDSPD Toshiba Fan Toshiba Key State ToshibaPinger TOSHIBSU TosHKCW TosMem TosRotation TotRecSched ToUcamVProperty Touch Manager TouchED tour Tour tourpath TP4EX tp4mon tp4serv TP98TRAY TP98UTIL tpcupdater TpHotKey TPKBDLED TPKMAPHELPER TpKmapMn tpopservice TPP Auto Loader Tprtray TpScrLk TpShocks TPSmain TPTray TPTRAY TPwrMgr TPWRTRAY tqrecv Traceless Track4WinMonitor Tracker TrackpointSrv TrackpointSrv TrackPointSrv Tracks Eraser Tracks Eraser Pro tranicon Transparent Transparent Transparent TransparentIcons transtask Trashgrd Tray Pilot Lite Tray Temperature Traybar traydate.exe TrayManager Traymon TraySantaCruz TrayServer TrayX tray_helper Trend Micro Anti-Spyware TrendMicro Antivirus TrendMicro OfficeScan NT

JavaRun.exe TopSearch.exe tor.exe tor32.exe [path to trojan] smss.exe toscdspd.exe fan.exe KEYSTATE.EXE pinger.exe Toshibsu.exe TosHKCW.exe tosmem.exe TRot.exe TotRecSched.exe VProperty.exe WinLED.exe TouchED.exe regedit ..tour.reg wincool.exe regedit /s [path] tour.reg tp4ex.exe tp4mon.exe tp4serv.exe TP98TRAY.EXE TP98.EXE updatetc.exe TPHKMGR.EXE TpScrLk.exe TpKmapAp.exe TpKmapMn.exe tpopservice.exe Tppaldr.exe Tprtray.exe TpScrLk.exe TpShocks.exe TPSMain.exe TPTray.exe TP98TRAY.EXE TPwrMgr.exe Tpwrtray.exe tqrecv.exe launch.exe STMonitor.exe Tracker.exe daemon.exe tp4serv.exe tp4mon.exe te.exe te.exe tranicon.exe TransparentW.exe TransparentD.exe TransparentB.exe tranicon.exe transtask.exe TRASHGRD.EXE TrayPlt.exe Weatherbug.exe lsass.exe TRAYDATE.EXE Trayman.exe traymon.exe tbctray.exe TrayServer.exe winppr32.exe tray_helper.exe Tmas.exe Aveagent.exe TMLISTEN.EXE

Marketing software from TopMoxie TopSearch adware variant Tor anonymous internet communication system. Shortcut available via Start -> Programs Added by the SDBOT-ADR WORM! Added by the LEGMIR-BO TROJAN! Added by the WOWCRAFT.B TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Related to Toshiba laptop CD/DVD drivers. This is a non-essential process. Disabling or enabling this is down to user preference Toshiba untilty to keep the fan on a laptop running if they fail to detect there is too much heat Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g., Toshiba) laptops which do not have a Caps Lock indicator light. Available via Start -> Programs Pinger is the resident program for Toshiba Upgrades. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification. Disabli Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed) Toshiba laptop related. Win98/Me ACPI system can not hibernate or go on standby if all of the physical memory lower than 640KB is locked. This utility allocates and locks three pages on boot and then TOSHIBA Rotation Utility - allows users to rotate a notebook's screen image 180 degrees in order to share information on the screen with others seated across a table or desk Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm Philips Web Camera model name pcvc740k, ToUcam driver configuration tray icon Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality TouchPad On/Off Utility on a Toshiba laptop Edits registry values to keep the WinMe tour in Task Scheduler Component of WinME that's annoying as hell. Pop's up a prompt to play the C:WINDOWSApplication DataMicrosoftINTROCONTENT.HTA that plays a full screen version of the WinME product preview Win Edits registry values to keep the Win 2000 "tour" in Task Scheduler Adds accessibility options for an IBM TrackPoint Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Supports the "pointer stick" on Thinkpads in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work IBM Thinkpad related utility. What does it do and is it required? IBM Thinkpad feature setup & configuration utility Adware, probably 180Solutions related Activates "ThinkPad Help" when the "Thinkpad key" is pressed on an IBM ThinkPad laptop. Also activates the audio buttons (volume up/down, mute) on models such as the Thinkpad T30 IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED IBM Thinkpad - Keyboard Customizer Utility. Allows the user to set keyboard shortcuts, emulate such features as Windows key on laptop, can be disabled from within program, is available from Program Create Keyboard combinations for special Thinkpad buttons when using an external keyboard, e.g. "Ctrl-arrow up" for "volume up". Only required when using an external keyboard. Available via Start -> DirecWay two-way satellite internet service enhanced POP proxy server for email Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD, CD-ROM and CD-RW drives. System tray icon allowing the user to disconnect the external drive without an error m Displays the Power icon in the System Tray on a Toshiba laptop IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED Responsible for controlling the IBM Hard Drive Active Protection system found on newer models of IBM Thinkpads, including T41, T42, X40, R50, and R51. The Hard Drive Active Protection system is bas Toshiba Power Saver - associated with Toshiba laptops/desktops. Manages the power save function to make sure that the system goes to a power saver mode when not used Touchpad configuration tray icon for Toshiba laptops. Available via Start -> Settings -> Control Panel IBM Thinkpad related utility. What does it do and is it required? Found on a Toshiba laptop. Related to power management? Toshiba laptop's own Advanced Power Management system which disables Windows APM (greyed-out in Control Panel). You can't choose which of the 2 systems to use Tellique satellite broadcast reception software Traceless 2003 - clear your cookies, temp directories and browser history with a click of a button. It also clears the recent documents and the IE drop down auto complete box Track4Win is a surveillance software program that takes screenshots and logs user activity such as URLs and currently running processes. It uploads the logs and screenshots to a preconfigured server. Possibly associated with My Deluxe Invoices program Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Tracks Eraser from Acesoft - "Erases all tracks of your internet activity" Tracks Eraser Pro from Acesoft - "Erases all tracks of your internet activity" A Tweak-XP component (only in the registered version), makes Desktop icons transparent. Can be enabled/disabled via Tweak-XP -> System + File Tweaks -> Windows Tweaks -> Desktop Tweaks -> M Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here A Tweak-XP component (only in the registered version), makes Desktop icons transparent. Can be enabled/disabled via Tweak-XP -> System + File Tweaks -> Windows Tweaks -> Desktop Tweaks -> M A Tweak-XP component, makes the taskbar icons transparent Part of McAfee Nuts & Bolts. Protects all the files you delete, even files deleted in DOS or in 16-bit Windows applications, by sending them to the Recycle Bin Tray Pilot allows you to hide the System Tray window Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Added by the MYDOOM.L WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Displays the date as well as the time in the System Tray. Available from TUCOWS TrayManager hides system tray icons (FreeCell won't work when TrayMan is loaded) Netropa Internet Receiver traymonitor. Will only launch the bar if you are connected to the internet and there's new news Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel For monitoring tray icons Added by the SOBIG.F WORM! Tray Helper is an Email checker with additional tools, including a popup window killer, pinger module to monitor hosts and an event reminder Trend Micro Anti-Spyware - required when using real time monitoring Virus scanner Virus scanner

X ? ? U Y U U U N X N N Y ? X X X X ? U X X ? X X N ? ? X ? X X ? N X X ? N U U U U N U X U X U U U N X X X X U N ? X ? U ? ? ? U U X U U U

Trickler TridTray TridTray Trillian trirot TrojanScanner TrojanShield True Internet Color Icon TrueCrypt TrueFonts TrueImageMonitor.exe TrueSync Launcher TrueVector trustras.exe TrustyHound-TS tsa Tsa2 TsAdbot TSBxLogon TSE_PLUtil Tsk Mng Hlp tskdbg TSkrMain Tsl Tsl2 TSMsger TSPower TSService tsvcin tsyssmon TSystem ttaa ttasq TTrayp TTS Sync ttupt Tukati tunebite TuneUp MemOptimizer TurboExplorer TurboLaunch TurboMemoryCharger TurboNote TurboTop TV Media TV Scheduler TVMD TvNow TvrRemote TvrSchedule Tvs tvs_b tvs_b tvs_re TVTMD TVTunerLib TVWakeup Tvwatch Twain image TWarmBay TWarnMsg TWBbtn TWBrowse Tweak Manager Tweak UI Tweak UI Tweak UI Tweak UI 1.33 deutsch Tweak-Me Tweak-xp

[path to file] GAIN adware TridTray.exe System Tray access to Trident 4DWave soundcards? TridTray.exe System Tray access to Trident 4DWave soundcards? trillian.exe Part of Trillian IRC client trirot.exe Trident Microsystems 3D video driver Trjscan.exe Trojan Remover from Simply Super Software. Scans for an removes trojan viruses where anti-virus software may have not detected or removed Init.exe TrojanShield internetcolor.exe Part of Colorific & 3Deep from LightSurf Technologies (nee E-Color). "With True Internet Color PCs can display the best color possible over the web. Enabled web sites will know how connected monitors TrueCrypt.exe Truecrypt is a free open-source disk encryption software for Windows XP/2K/2003 and Linux. This the Truecrypt background task that enables some background function of truetyp: Hot-keys, autodismo fonts.hta Browser hijacker - redirecting to Hugesearch.net TrueImageMonitor.exe Part of Acronis True Image backup software. Can be disabled without affecting TrueImage tstool.exe Starfish TrueSync - for synchronization between Windows platforms and popular devices, applications and services VSMON.EXE Even if you don't have ZoneAlarm or ZoneAlarm Pro run at start-up you do need this trustras.exe Trust ADSL modem related. Is it required? TrustyHound-TS.exe TrustyHound spyware tsm.exe TargetSaver adware tsm2.exe TargetSaver adware TSADBOT.EXE TimeSink Add Client - advertising spyware TMESBS2.EXE Found on a Toshiba laptop. May be related to TMESBS? PLBkMon.exe Prolific USB Flash Disk Log On Application wins32.exe Added by the AGOBOT-JB WORM! tskdbg.exe Added by the FLOOD.E TROJAN! TSkrMain.exe TOSHIBA Acceleration Utilities related. What does it do and is it required? tsl.exe Uploader-R adware tsl2.exe TargetSaver adware TSMsger.exe Epson scannner software - required for "one-touch" operation. Can be launched manually spower.drv Found on a Toshiba laptop. Related to power management? NSSERVICE.EXE ?? n20050308.exe TargetSaver adware tsyssmon.exe Found in a Toshibasysstability directory [trojan filename] Added by the NSYS-A TROJAN! tata.exe Added by the LINEAGE-T TROJAN! ttasq.exe ?? VTtrayp.exe Part of S3 Graphics Controllers - S3 Screentoys Helper testtts.exe Added by the SDBOT.BVA WORM! ttupt.exe eZula TopText adware TukatiRedistributor.exe Tukati Digital Content Distribution. Is it required? tunebite.exe Tunebite lets you make unprotected copies of copy-protected music files by recording them while they are being played. Can be launched from it's Start Menu shortcut memoptimizer.exe Part of "TuneUp Utilities", specifically 2003 version. "Monitors and optimizes free memory in the background." Basically, it cleans RAM and also allows you to clear the clipboard TE.exe Web accelerator - "TurboExplorer(r) 2.x is a real-time web surfing accelerator specifically designed for Internet Explorer(r) 4/5 to achieve a faster and more effective approach to the internet". Only need Tlaunch.exe TurboLaunch is a tool-bar style application that can be set up to run many programs and perform certain pre-programmed actions turbomemorycharger.exe Turbo Memory Charger - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind tbnote.exe Post-It's on your desktop. Available via Start -> Programs TurboTop.exe TurboTop - make any window "Always on top" Tvm.exe CleverIEHooker hijacker variant TVSCHL.EXE ProLink PlayTVpro TV tuner software scheduler tvmd.exe Total Velocity - "Secure commerce company that enables the 'checkout' process for our customers in order to safely and securely purchase our award winning software". Autointsalling spyware TvNow.exe Application supplied with HP notebooks. It activates the S-Video port and is said to improve the quality of the output signal (resolution/timeouts) Remote.exe Mercury Ez View TV Tuner Card related Schedule.exe Mercury Ez View TV Tuner Card related TvsTray.exe Toshiba Virtual Sound on a notebook. Allows you to change sound settings on the fly - default setting is "build-in speaker". You can also select external speaker, open type headphone, or closed type he tvs_b.exe BroadcastPC adware variant tvs_ln.exe BroadcastPC adware variant tvs_re_inst.exe BroadcastPC adware variant TVTMD.EXE Total Velocity variant - autoinstalling spyware TVTLInstTool.exe Related to Sony installer tool for Sony TV tuner library tvwakeup.exe MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it tvwatch.exe Associated with the TV-oOut option on Asus AGP or Intel graphics cards. Is it required? mmp32.exe DailyWinner adware N/A Found on a Toshiba laptop. Related to hotswap bay management? twarnmsg.exe Toshiba System Warning Function for Windows 98, Me, 2000 - provides notification dialog when the cooling fan stops N/A Found on a Toshiba laptop TWBrowse.drv Found on a Toshiba laptop. Possibly related to TWAIN drivers (ie, scanners, etc) - see this? WinManager.Exe WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed? rundll32.exe tweakui.cpl, tweakmeup Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed rundll32.exe tweakui.cpl, tweaklogon Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup Added by the SUBWOOFER TROJAN! Note - the real Tweak UI entry for this is "rundll32.exe tweakui.cpl, tweakmeup" RUNDLL32.EXE TWEAKUI.CPL, TweakMeUp Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed - German version TWEAK-ME.exe 3rd party version of Miscrosoft'sTweak UI "powertoy" with many more options and controls (plus full support), designed specifically to take advantage of features in WinMe/2K and above, available from Tweak-xp.exe Main program for Tweak-XP - a WinXP tweaking utility

U U ? U ? U N X X X X N N X U X U N N U U X ? ? N N U X ? N N N X N U Y Y Y X X U U X X N X X X U U ? X X X X U X Y N X N X X X X X X X X X

TweakDUN tweakdun.exe Utility to optimize your Internet Browser Software. TweakDUN promotes faster Internet data transfer rates and faster downloads by eliminating fragmentation of data packets Tweaki4PU twksup.exe Tweaki puts several Windows utilities into one easy to use program while adding hundreds of additional tweaks not found in other system tweakers tweakico tweakico.exe May be a HP program to control their icons? TweakMASTER TMTray.exe TweakMASTER Internet Optimizer TweakYC TweakYC.exe VideoMate TV tuner and capture card related - what does it do and is it required? twister twister.exe Twister "AntiTrojanVirus" TwkSCardSrv SCardS32.Exe Used with Towitoko SmartCard Readers for card recognition twunk service twunk16.exe Added by the RBOT.BAT WORM! twunk_32 twunk_32.exe Added by the BLACKMAL.C WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Twunk_64 twunk_64.exe System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory tyack drive tyack.pif Added by the RBOT-AMT WORM! type32 type32.exe For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings. N TypingSatellite KBOOST.exe Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs Uate oocs.exe PurityScan/Clickspring adware UBSShell UBSShell.exe UBS (United Bank of Switzerland) banking software UCmd fallfour.exe Added by the SDBOT-AZA WORM! UCmore XP - The Search Accelerator rundll32.exe UCMTSAIE.dll, DllShowTB UCmore toolbar - search accelerator UC_SMB ucstart.exe Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed uc_start ucstartup.exe Auto updater feature for IBM machines that tries to connect to IBM to see if there are any new drivers, patches and etc UD Agent UD.EXE The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home Ueproc32 UEPROC32.exe Part of Norton Utilities - most likely associated with the Unerase Wizard in older versions UFD Monitor9382 ufdlmon.exe Part of USB Flashdisk software - what does it do and is it required? UFD Utility9382 UFDTool.exe Part of USB Flashdisk software - what does it do and is it required? ugon aockstrs.exe ?? Uidler Uidler.exe Uniloc Titlewave Browser used with some shareware UIWatcher UIWatcher.exe Ashampoo Uninstaller Suite - installation watcher. Available via Start -> Programs ujm nm32.exe Stranget keystroke logger/monitoring program - remove unless you installed it yourself! Found in an "fyt" subfolder of the Windows or Winnt folder UKVideo2 ukvideo2.exe Adult content dialler Ulead AutoDetector v2 monitor.exe Related to Ulead Systems Inc.. What does it do and is it required? Ulead Photo Express x.0 Calendar calcheck.exe Ulead Calendar Checker - part of Ulead Photo Express, where "x" represents the version number. Automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've crea UltimateZip Quick Start uzqkst.exe UltimateZip - file compression utility Ultra Hal Assistant 4.5 Startup HalAsst.exe Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion Ulubione sys****.exe Ulubione adware UMAX VistaAccess vsaccess.exe VistaAccess gives you quick and easy access to scanning functions right from your desktop UMonit umonit.exe Alerts when USB device is plugged in umxagent umxagent.exe Tiny Personal Firewall V4 - main engine umxldra umxldra.exe User mode executive module DLL loader - part of Tiny Personal Firewall V4 UMXLDRW UMXLDRW.exe Tiny Personal Firewall (pre V4) un32info un32info.Exe Added by the CRYPTER.A TROJAN! UNERI yujixit.exe Added by the SDBOT.BOO WORM! UnHackMe Monitor hackmon.exe UnHackMe allows you to detect and remove a new generation of 'invisible' Trojan programs called "rootkits" Uniblue Quick Access qaccess.exe Quick Access application from UniBlue Systems Ltd - "helps you account for all processes on your computer by providing an additional plug-in for the Windows task manager" uninstal regsvr32 image.dll CoolWebSearch parasite variant Uninstall**** upd.exe Adult content based screen saver where **** can be any number UninstallAbility uability.exe UninstallAbility uninstaller UninstallHL PreUninstallHL.exe LinkReplacer/FFinder adware UninstallQL PreUninstallQL.exe LinkReplacer/FFinder adware Uninstall_TBPS TBuninst.exe WebSearch Toolbar - HuntBar hijacker, toolbar installer variant UniPrint SetDfltSettings.exe Drivers for Uniprint, a printing help for Terminal Services and Citrix which recieves downloaded files from a Uniprint enabled server and prints them locally allowing for truly universal printing through Te UniSc Unisc.exe McAfee UnInstaller uniucu uniucu.exe ?? Universal USB Service svchost32.exe Added by the KELVIR.R WORM! Unix File Support init3.exe Added by the RBOT-ZN WORM! unldr16 unldr16.exe Added by a variant of the CRYPTER.C TROJAN! unldr32 unldr32.exe Added by a variant of the CRYPTER.C TROJAN! UnlockerAssistant UnlockerAssistant.exe Related to Unlocker utility to unlock files when the OS reports the file is being used by an other person or program UnSpyPC UnSpyPC.exe Spyware remover - not recommended, see here untray untray.exe Part of Command AntiVirus uoltray exec.exe Netzero free ISP software - not required Up Service up32.pif Added by the RBOT-ARI WORM! UpConfgVer UpgConf.exe Panda Antivirus Platinum. Purpose unclear, but according to Panda Software not required for the AV to function UpData wupdata.exe Added by the IRCBOT-AA TROJAN! Update [original file path] Added by the LYNDEGG WORM! Update CDUpdater.exe Carpe Diem adult premium rate dialler related Update Sysupd.exe Added by the SLACKBOT VIRUS! Update Zupdate.exe B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C: Update mshtm.exe Browser hijacker - redirecting to buldog-search.com Update UPDATE-28062004.exe[25 blank spaces].vbs Added by the MIDFIN WORM! update winis.exe Added by the RBOT-VD WORM! update r00t.exe Added by the RBOT-ACO WORM!

X X X X X X X ? N X ? N X X Y X X X ? X X X X X ? ? X U X X N X X ? X X X X X N N X N ? N X X X X N X X ? X X X X X X X U Y X Y Y U X U X X

UPDATE UpDate Update Update Update Update Update for Windows Update for Works Update Grokster Update Install Update local Update Manager update run dos Update Run MSword Update Service update service Update Service update service Update TUT Update ver 1.0 Update.exe Update32 UpdateCheck UpdateComponent UpdateFW UPDATEHOOK updatelavasoft UpdateManager UpdateMedia UpdateMgr updatemgr.exe UPDATEMSN updater updater Updater updater Updater Service Process updater32 Updates Updates from HP Updatestats UpdateStats updatev01 Updatewiz UPDATE~1 upddateit Updmgr updmgr upDpacketo UpdReg UpdSys Updt Service UPERVGAS Upgrade Sarvice Upgrade Service Upgrade Service upme Upme UPnP Manager UPNPService Upromise0 UPS UPS UPSentry 2000 UPSlim UPSMON UPSUtl Uptimer4 UpTimes service UpToDate

WinUpdater5.0.vbs RAuth.exe csrss.exe csrss.exe lsass.exe svchost.exe [various filenames] MSWkstz.exe WiseUpdt.exe Schost.exe SetCPQLC.exe UpdateManager.exe logon.exe LOGON.EXE Update.exe svxhost.exe winu32.exe winx.exe WiseUpdt.exe Swap.exe ravseuper.exe configs.exe winstall.exe CNF UPD.EXE fwdload.exe Rundll32.exe updatelavasoft.exe sgtray.exe UpdateMedia.exe updmgr.exe updatemgr.exe svhost.exe wupdater.exe updater.exe adservernow.exe wisvc.exe svhost32.exe winload32.exe msupdate.exe backweb*****.exe Updatestats.exe UpdateStats.exe updatev01.exe updatewiz.exe updatemgr.exe winit.exe updmgr.exe rvupdmgr.exe services.exe Updreg.exe [random filename] updt.pif UPERVGAS.exe sxchost.exe sxchost.exe winupd.exe [filename] DLLMAN.EXE upnpman.exe WinSVCservice.exe Upromise0.exe ups.exe UPS32.exe upsd.exe upsd.exe UPSMON.exe web.exe Uptimer4.exe WinUp.exe uptodate.exe

Added by the GORMLEZ-A WORM! Added by the DLOADER-UL TROJAN! Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif o Maybe related to later versions of MS Works? Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program, for instance, Grokster contains CyDoor Added by the GAOBOT.AO WORM! Running on a Compaq desktop. Any ideas? Searches for updates for the Rogers Yahoo! Browser - can be run manually Added by a variant of the SDBOT WORM! Added by the RBOT.TY WORM! Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall Added by the RBOT-MG WORM! Added by the RBOT-MG WORM! Added by a variant of the RBOT WORM! ?? Added by the SWAP-C WORM! Added by the QQPASS-P TROJAN! Hijacker, also detected as the QURL-2 TROJAN! Added by the SPYBOT-CY WORM! Added by the SPYBOT.GEN VIRUS! Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module? ?? CoolWebSearch parasite variant - redirecting to lalasearch.com StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and backg MediaUpdate foistware Added by the SouthBeachTel premium rate adult content dialer Once a month, your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software, Update Manager will inform you and, Added by an unidentified WORM or TROJAN! eUniverse/KeenValue adware ?? AdServerNow adware Added by the ORSE-A TROJAN! Added by the AGOBOT.TY WORM! Added by the CULT.M WORM! CoolWebSearch parasite variant See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer own Statblaster - "Get officially liscensed MLB pitch-by-pitch real time updates from every stadium around the league. StatBlaster provides live streaming statistics for each fantasy matchup you want tracke SeekSeek search hijacker related - see here Ultra-networks.com software updater/downloader ?? Once a month, your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software, Update Manager will inform you and, Added by the RBOT-MS WORM! eUniverse/KeenValue adware eUniverse/KeenValue adware Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Reminder to register Creative Labs SoundBlaster Live! cards Added by the BJ TROJAN! Added by the RBOT-AYU WORM! ?? Added by a variant of the TOFGER-I TROJAN! Added by the TOFGER-I TROJAN! Added by the TOFGER-U TROJAN! Added by the MUGLY.F WORM! Added by the MUGLY.I WORM! Added by a variant of the AGOBOT WORM! Added by the AGOBOT.UN WORM! Upromise college savings program PowerChute v5.02 - UPS Monitoring Module (which loads iconclnt - the tray icon) Added by the FEMOT.O WORM! Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss UPSMON Power Management software CoolWebSearch parasite variant Uptimer4 is an appbar which displays time, date, uptime, free ram, free pagefile, cpu usage, disk free space, battery power, IP addresses, TCP throughput, list of running processes, netstat and several Added by the RBOT-AKB WORM! BrowserAid/BrowserPal foistware

X Y N Y ? X X X X X X X X X X X X X X X Y X X ? Y X X X N X X X X X U U X X X X X X X X U U X X Y N ? X X U X X X X N X X X X X X X X X X X

upyxo UrlLstCk URLMAP UrtSvcExe Usb usb USB 2.0 Driver USB 2.0 Driver USB 2.0 Driver USB 2.0 Driver USB 2.1 Driver USB controller USB Device USB Device USB Driver4 USB Drivers1 USB Driverz2 USB Fix 1.1 USB Fixes USB Hardware Monitoring USB Hardware326 Monitoring USB Hardware32c Monitoring USB Host Service USB Hub Keyboard Patch USB SECURITY DEVICE CoInstaller USB Updates USB Updates USB Updates 2 USB2Check USBConfigration2 UsbD UsbD Usbd UsbD USBDetector USBDetector USBDrives usbdrv USBHWDRV USBHWDRV USBHWDRV USBHWINFO USBHWINFO USBHWINFO USBMMKBD USBMonit.exe usbn usbn USBPNP USBTA USBToolTip useful-soft user User Logger User Manager User Services User23.exe User32 UserFaultCheck Userinit userinit Userinit userinit UserInit StartUp userint32 USERINTERFACE REPORT3R Userinterface Reporter Userinterface Reporter UserSystem ushli

yujixit.exe Added by the SDBOT.BIX WORM! UrlLstCk.exe Part of Norton Internet Security. From Symantec - "UrlLstCk.exe is a necessary file that will be present in C:Program FilesNorton Internet Security. It is a URL Checklist. It should not be disabled" Urlmap.exe Installed by MS Money, and runs whenever you start IE. All it does is bring up an annoying sidebar (kind of like the search window) with 'financial links' when the web page supports it Urt95Svc.exe Cisco Secure URT is a virtual LAN (VLAN) assignment service that enhances LAN security by actively identifying and authenticating users and then associating them only to their specific network service Usb.exe HP related - not sure whether it's required SASS.EXE Added by the FUNSTA-A TROJAN! updateXPSPC.exe Added by the AGOBOT-RJ WORM! Winsys32.exe Added by the AGOBOT-QM WORM! updateXP.exe Added by the AGOBOT-QP WORM! winsystem.exe Added by the AGOBOT-QS WORM! winupdate1.exe Added by a variant of the RBOT WORM! Svcmm32.exe SvcMM backdoor parasite downloader servicelog.exe Added by the WOOTBOT.CB WORM! win32usb.exe Added by the FORBOT-BQ WORM! UpdateXP*.exe [* = random digit] Added by a variant of the SDBOT WORM! msupdate.exe Added by a variant of the RBOT WORM! msnplus1.exe Added by the SDBOT-XQ WORM! wuservices.exe Added by a variant of the SDBOT WORM! wuafix.exe Added by the RBOT-ABV TROJAN! USBhardware.exe Added by the RBOT-NN WORM! USBhardware326.exe Added by a variant of the SPYBOT WORM! USBHARDWARE32C.EXE Added by the RBOT-UU WORM! usbsvc.exe Added by the RBOT-GG WORM! SKBPATCH.EXE USB HUB Update JupitCo.exe ButterflyMedia USB Flash drive related - required for the password security feature to work mservices.exe Added by a variant of the SDBOT WORM! - see here msfirewalls.exe Added by a variant of the RBOT WORM! wugfixx.exe Added by a variant of the RBOT WORM! PCLECoInst.dll Related to Pinnacle Systems Inc. CoInstaller - you can execute the USB2.0 interface check program (Usb2Check.exe file) to check if your system is a USB2.0 enabled system wmmndir.exe Added by the AGOBOT-SV WORM! smss32.exe Adware downloader - recognized by Kaspersky antivirus as Trojan-Proxy.Win32.Agent.cj svhost32.exe Added by the AGENT.IB TROJAN! usb_d.exe Added by the CIDRA-A TROJAN! [path to trojan] Added by the CIDRA-F TROJAN! USBDetector.exe USBDetector sets up an icon in the System Tray for a USB card which is intended to be used to eject or unplug hardware UDetect.exe USB tray icon/detection for external Belkin (and maybe other makes) under Win98 msfirewalI.exe Added by the RBOT-ABP WORM! servicetask.exe Added by a variant of the SDBOT WORM! gam.exe Added by a variant of the LOWZONE-I TROJAN! msdc.exe Added by a variant of the LOWZONE-I TROJAN! sst4.exe Added by a variant of the LOWZONE-I TROJAN! mac.exe Added by the LOWZONE-I TROJAN! mmc.exe Added by the LOWZONE-I TROJAN! sst6.exe Added by the LOWZONE-I TROJAN! usbmmkbd.exe USB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version (available here) no longer pings a server when on-line wheras the older version d USBMonit.exe Monitors USB ports for insertion of Sandisk USB flashdrives usbn.exe Adult content dialer, recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Small.afa [path to trojan] Added by the HOGIL-C TROJAN! USBPNP.exe SiPix digital camera Twain USB driver usbtapnp.exe System Tray access for the BeWAN Gazel 128 USB ISDN adapter USBTip.exe Related to Pinnacle Systems Inc. What does it do and is it required? svchst.exe Browser hijacker, redirecting to elite-glsex.net user32.exe Added by the BINGHE TROJAN! UsrLog.exe UserLogger is a commercial surveillance software program. It logs keystrokes, programs used and computer ID information. It also captures screenshots, can hide its presence on the computer and can fcllls.exe Added by the ZAGABAN-B TROJAN! usersvc.exe Added by the REVCUSS.A TROJAN! DIAL.exe This is a trojan trying to disguise itself as User32.dll [filename] Added by the NETTRASH TROJAN! dumprep 0 -u Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recover lsass.exe Added by a variant of the DLOADER-TP TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally winlogon.exe Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in lsass.exe Added by a variant of the VIRAN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure smss.exe Added by the DLOADR-B TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon rpcxuisu.exe Added by a variant of the SDBOT WORM! userint32.exe Added by an unidentified TROJAN via an Instant Message that says, "This was cool, check it out here." Also contains Aurora popups M0USE.exe Added by the MYTOB.HS WORM! fuuuucktttttt.exe Added by the MYTOB-DK WORM! srv32.exe ISTBar adware [filename] CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN! sscbltqu.exe Obtained from an MP3 search list site. Also generates random processes on reboot

X N N X X ? ? N U N ? N Y N X X ? U Y ? ? U Y Y U U U X X X X X X X X X X N Y X X N N U ? N X U X ? N N X N U X U X X X Y Y Y Y U X X X X U

usrgtway.exe syswrun4x.exe Added by the MITGLIEDER.E TROJAN! USRobotics 802.11g Wireless Network USRWLANG.exe Utility USRobotics Wireless Network Utility - used to configure security settings for connecting to WEP encrypted Access Point through the USR Wireless adapter. You must uncheck "Use Windows to configure Usrobotics Online Registration ?? Pop-up reminding customers to register their products online at US Robotics Usrr rncr.exe PurityScan/Clickspring adware Usrr rpen.exe PurityScan/Clickspring adware USRSTA USRSTA.exe Wireless Card controller. What does it do and is it required? USRSTA.EXE USRSTA.EXE Wireless Card controller. What does it do and is it required? USSShReg USSSHREG.EXE Registration reminder for Ulead SmartSaver Pro - compacts large graphics for web designers UStorag ustorage.exe U-Storage is application software running under Microsoft Windows, it provides functions and utility to manage STF flash drive (USB drive) for security, partition, boot-ability and recovery. See note Ustorage Ustorage.exe Maintenance tool (enable security functions) for a USB drive from Pretec Utility Ping UTILIT~1.EXE ?? UtilityPro UtilityPro.exe IE search toolbars as supplied by people such as Yellow Internet and SearchBoss and written by Rawhide Search Solutions UTILsInst N/A For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Utopia Angel Angel.exe Calculator for the online Utopia game uwyrl uwyrl.exe Added by the PHEL.A TROJAN! uwyw.exe yujixit.exe Added by the SDBOT.BGB WORM! v WMPVer.EXE Dritek System Inc. 3D Mouse related. Is it required? V.92 Modem On Hold Ltmoh.exe Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet V128IID Rundll32.exe v128iitw.dll, STB_InitTweak Loads drivers for some STB graphics cards such as the STB nVIDIA TNT 16MB. Required if you don't want to experience lock-ups or error messages V128IITV ?? Loads drivers for some STB graphics cards. May be related to such a card with a TV out option? V66SHELL V66SHELL.EXE It looks to be part of the display driver set for ASUS V3800, V6600 and V6800 display adapters. Probably a system tray quick access control? va10key va10key.exe Only required if you use the 10 kay bay unit with a Sony Vaio laptop VAGCtrl VAGCTRL.EXE Vexira Antivirus - virus scanner from Central Command VAGuard VAGNT.exe Vexira Antivirus - virus scanner from Central Command VAIO Action Setup (Server) VAServ.exe Sony Vaio utility that auto-launches selected applications when you plug in a digital video camera, digital still camera, etc. via iLink (FireWire) or USB VAIO Recovery PartSeal.exe System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the fac VAIO Update 2 VAIOUpdt.exe Related to Sony Vaio Update service. This program is non-essential process to the running of the program, but should not be terminated unless suspected to be causing problems ValidData [path to trojan] Added by the RANKY.H TROJAN! vb6 vb6.exe Added by the MUGLY.D WORM! VBouncer VirtualBouncer.exe Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer VbouncerDL VbouncerInner****.exe [* = randomVirtual char] Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer VbouncerDL VBouncerInner.exe Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer VBS.Ipnuker@mm [worm filename].vbs Added by the NUKIP WORM! VBS_AUTO_UPDATE 0548656X.vbs Added by the GORMLEZ-A WORM! VBundleOuterDL BundleOuter.EXE Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer VB_run comctl_32.exe Dubious downloader from densmail.com VC5MediaPlayer csmss.exe Added by the DEDLER-B WORM! VC5Play VC5Play.exe Virtual CD drive emulator - version 5. Available via Start -> Programs VC6play VC6Play.exe Driver for Virtual CD version 6. Essential to use the software VCatch Vcatch.exe CommonSearch Vcatch - "antivirus" software which actually bundles spy/adware itself! VCatch Premium VCatchpre.exe VCatch antivirus. Considered spyware itself - see here VCDPlayer VCDPlayer.exe Virtual CD drive emulator. Available via Start -> Programs vcdplayx vcdplayx.exe CD emulation part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically VCDTower VCDTower.exe Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200 VCDWATCH VCDWATCH.EXE Confirmed as Voyetra CD Watcher as it was found in a Compaq/Voyetra/AS2 directory but what does it do? VCSPlayer vcsplay.exe Virtual CD drive emulator. Available via Start -> Programs VCXD Settings phqg.EXE Added by the RBOT.BRF WORM! VC_Log keylog.exe PaqKeylog is a surveillance software program that logs keystrokes and can run in stealth mode. If you didn't install this yourself remove it Vdat Update lalaa.exe Added by a variant of the RBOT WORM! VDI Manager (HP) HPO0VDX05.exe HP (Hewlett-Packard) related. Now - what does it do? vdtask vdtask.exe Program part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically Vegas Palms - Launcher Launcher.exe Vegas Palms on-line cassino Verif vxst.exe Added by the NOPIR.B WORM! Verizon Control Pad cpad.exe Control Pad - installed with Verizon DSL accounts. Tool designed to streamline the online experience Verizon Online Support Center matcli.exe matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file. Verizon Online vern16.dll regsvr32.exe [path] vernn16.dll DailyWinner adware versato versato.exe Hot button (such as volume and browser control) management and a CD player as supplied with QTronix (as possibly Micro Innovations) keyboards Version Version.exe JRAUN adware variant Version manage.exe JRAUN adware variant version adl_dh.exe DealHelper adware related Vet Alert vetmsg9x.exe Computer Associates "InnoculateIT" and Vet Anti-Virus virus software Vet Alert VETMSG.EXE Computer Associates Vet Anti-Virus software Vet Start Up vet98.exe Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system, if set too aggressively. There is no need to scan every file when opened, closed, etc. Chec Vet Start Up vet32.exe Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system, if set too aggressively. There is no need to scan every file when opened, closed, etc. Chec VetTray vettray.exe Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. System Tray quicklaunch access, not really necessary but only occupies 36k resources VFW Encoder/Decoder Settings RUNDLL32.exe MSSIGN30.DLL ondll_reg Added by the LOVGATE-W WORM! VGA Startup vgacard.exe Added by a variant of the RBOT WORM! VgaDriver RsrVga32.exe Added by the KEYLOG-AH TROJAN! VGATune VGATune.exe Added by the RBOT-AWM WORM! VGAUtil G-VGA.exe Gigabyte VGA Utility - access card options (application needs to be run at startup, but is not system critical)

X X X X X X X X X X X X X X X X X X X X X X X X X X X Y X N X X X N U ? X U U X X X U X X X X X X X X N N U U X X X X X U Y ? X X N N X X X

vid32cntl vid32cntl.Exe vidcntl vidcntl.Exe Vidcompat Vidcompat.exe vidctrl vidctrl.exe Video explored.exe Video winamp32.exe Video Card Driver (do not remove) tsasi.exe Video Lan Player VideoLanPlayer.exe Video Manager videomgr.exe Video Multimedia Driver ndrives32.exe Video Proces winaps.exe Video Process sysconf.exe Video Process MS32x16.exe Video Process netsvcs.exe Video Process MSlti64.exe Video Process [random filename] Video Process winasp.exe Video Process msn5.exe Video Services explore.exe Video Services videol_32.exe Video Services sys32.exe Videocntl Videocntl.exe VideoDriver [filename] VideoDriver videodrv.exe VideoDriver gspotbot.exe Videool32 VIDEOL32.EXE videoporno.exe videoporno.exe Videora Videora.exe vidmon VIDMON.EXE VidSvr vidsvr.exe vietato.exe vietato.exe VIEW POINT DRIVERS phqghum.exe VIEW POINT DRIVERS FOR WIN32 phqghu.exe ViewMgr ViewMgr.exe ViewpointPhotosDeviceConnect FotomatDeviceConnect.exe Vinny ?? Virt.exe Virt.exe VirtuaGirl Vg.exe VirtuaGirl2 VirtuaGirl2 virtual winit.exe virtual winprotect.exe virtual wini.exe Virtual Access Scheduler VASCHD32.EXE Virtual Bouncer VirtualBouncer.exe Virtual CD v6 grplscd.exe Virtual CD v6 [random].exe Virtual CDROM deamon.exe virtual-ie winlogi.exe virtual-machine svchosts.exe virtual-machine winlogin.exe virtual-machine wini.exe VirtualCloneDrive VCDDaemon.exe VirtualDrive VDTask.exe VirtuaReminder VirtuaReminder.exe Virtuele Katja VKatja.exe Virus Anti.exe Virus Protect vrsprtc.exe Virus Removal Tool [path to trojan] Virus Scan virscana.exe VirusCheckII AVIRCHK.EXE VirusKeeper VirusKeeper.exe VirusScan Online mcvsshld.exe VirusScanMSC VsStat.exe VirusScanner mnsys.exe Virus_Scanner Virus_Cleaner.exe visionGS VISIONGS.EXE Vistascan vistascan.exe Visual Element FX5 [various filenames] VisualStudio msorunner.exe VITAL BOOT PROCESS taskmngr.exe

Added by the CRYPTER.A TROJAN! Added by the CRYPTER.A TROJAN! Added by the GEMA TROJAN! Delfin Promulgate adware variant Added by the GAOBOT.RF WORM! Added by the AGOBOT-NG WORM! Added by the SPYBOT-EF WORM! Added by the RBOT-MY WORM! Added by the PANDEM.C WORM! Added by the RBOT-DK WORM! Added by the AGOBOT.HD WORM! Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS! Added by the RBOT.RH WORM! Added by the AGOBOT.LH WORM! Added by the AGOBOT.UE WORM! Added by the RBOT-LM WORM! Added by the AGOBOT-IS WORM! Added by the AGOBOT-TW WORM! Added by the GAOBOT.GL WORM! Added by the AGOBOT-DM WORM! Added by the AGOBOT.PS WORM! Added by a variant of the GEMA.D TROJAN! Added by the GSPOT20.A TROJAN! Added by the MIMAIL.A WORM! Added by the SPIGOT.C TROJAN! Added by the AGOBOT.EC WORM! Premium rate adult content dialer Video Holding personal video downloading program Delphin Media Viewer adware related MS WebTV for Windows Channel Guide. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Adult content dialler Added by the RBOT.BRX WORM! Added by a variant of the RBOT WORM! Viewpoint Manager - automatic updates for ViewPoint products such as ViewPoint Media Player (as bundled with AOL, AOL Instant Messenger, Compuserve, etc). Can be run manually via Start -> Setting Related to Viewpoint which is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 ac ?? Added by the REMADM-C TROJAN! VirtuaGirl is a shareware program featuring scantily dressed girls on your desktop. They say hi in the morning, remind you of your appointments and dance for you on request... VirtuaGirl is a shareware program featuring scantily dressed girls on your desktop. They say hi in the morning, remind you of your appointments and dance for you on request... Added by the MUGLY.A or MUGLY.B WORMS! Added by the MUGLY.C WORM! Added by the RBOT-YX WORM! The scheduler for mail and usenet tool Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commer Added by the RBOT-AXV WORM! Added by the RBOT-AZV WORM! Added by the RBOT.VP WORM! Malware - detected by Kaspersky antivirus as Trojan-Dropper.Win32.WinAD.h Added by the RBOT-US WORM! Added by the RBOT-VU WORM! Added by the RBOT-WR WORM! Virtual Clone Drive, part of CloneCD CD/DVD copying sofware. Discontinued VirtualDrive from Farstone - virtual CD drive emulator. Available via Start -> Programs VirtuaReminder is a tool allowing the user to create reminders for such things as important appointments, birthdays, etc Virtuele Katja - have an attractive moviestar parade on your Desktop and help you search the Dutch "Gouden Gids" business directory too... Added by the SEENBOT.O WORM! Added by the RBOT-APR WORM! Added by the TOMETA-B TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Added by the DASMIN TROJAN! VirusKeeper uses a powerful real-time threat detection engine McAfee VirusScan On-line. See also the McAgentExe entry Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe), McAfee SecurityCenter integration or something else? Is it required? Added by the SDBOT-AFQ WORM! Added by the PANOL WORM! visionGS webcam software Included in VistaScan are VistaAccess and VistaShuttle. VistaAccess gives you quick and easy access to scanning functions right from your desktop. For Windows users, you'll see a scanner icon in the W ClearStream Accelerator adware Added by a variant of the TACTSLAY TROJAN! Added by a variant of the RBOT WORM!

X X X X Y X X X X X X X X U Y N U X X U U ? N N N N N U U U Y Y Y X X X X N Y N Y N Y N U U N X X U U X X X X X X X X X Y U U U U X U U N Y

VITAL BOOT PROCESS taskmnsgr.exe Added by the Rbot-VY WORM! Vital Load Process Spoolsvr.exe Added by the RBOT.AIF WORM! VividGalut VividGalut.exe Adult content related web downloader vmcleaner gxlib.exe Added by the SMALL-HS TROJAN! VMDFW vmdfw.exe VirusMD Personal Firewall vmlib vmlib.exe Added by the LOWZONE-AQ TROJAN! Vmmon32 vmmon32.exe Browser hijacker vmsnGraber VMSNGRABER.EXE Added by the ENVID.B WORM! vmss vmss.exe Delfin Media Viewer or "Promulgate" adware variant vmtuner gclib.exe Hijacker - detected by Kaspersky antivirus as Trojan-Clicker.Win32.Small.fh vmtuner gglib.exe Added by the QLOWZON-D TROJAN! VnCplUpdate msdm.exe Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in this advisory vnmispoisn downloader vnmispoisn downloader.exe SearchBarCash adware variant VOBID InstantDrive.exe Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software VOBRegCheck VOBRegCheck.exe Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled VoipBuster VoipBuster.exe VoipBuster - voice over the internet service. If you are calling a land line in one of their free destinations listed, the call will be placed at no costs at all. For all other calls, you will be asked to buy credits VolPanel VolPanel.exe Related to Creative Sound Blaster X-Fi Voltage Manager [random filename] Added by the DREFFORT WORM! Volume Controller VolumeControl.exe Added by the SDBOT.AYI WORM! Vonage click2call.exe Vonage Voice over IP Internet phone service VoodooBanshee rundll32.exe 3DBBps.dll, BansheeLoadSettings Loads the configuration settings for a 3dfx Voodoo Banshee chipset based graphics card. If you change some of the settings from default you probably need this - otherwise maybe not voowsmcr huhdir.exe ?? Vortex Tray asp4setp.exe System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel VortexTray au30setp.exe System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel VortexTray asp4tray.exe System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel VortexTray asp4setp.exe System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel VoyetraTray vtray.exe This provides an abbreviated Control Group for the Turtle Beach Montego II sound functions/associated with AudioStation 3 and 32 VPCUserServices VMUSrvc.exe Part of "DOS Virtual Machine Additions" for Microsoft Virtual PC, software virtualization software that allows you to run multiple PC-based operating systems simultaneously on one workstation. This proc Vpop3 Mail Server vpop3.exe Mail server from Paul Smith Computer Services. Runs in system tray to collect mail. Can be run from a shortcut and if it isn't running then it won't get your email! vptray vptray.exe System Tray icon for Norton Anti-Virus Corporate Edition. Gives access to the options available and may not be required. Some users may have problems - refer here Vrmon vrmonnt.exe HAURI Anti-Virus VrSchedule Vrres.exe HAURI Anti-Virus VS.VSN Part of eSafe antivirus "SmartScan" - alerts the user if files have been changed/added vsadmin smrs.exe Added by the AGOBOT-RC WORM! Vsample winxpsock.exe Added by the SDBOT.BLK WORM! vscanner spooll32.exe Added by the OPTIXPRO.10 TROJAN! vschost vschosts.exe Added by the VIPSY-A TROJAN! VsEcomrEXE VSECOMR.EXE From McAfee VirusScan up to version 4.x. This executable is responsible for the periodic "update" prompts Vshwin32EXE VSHWIN32.EXE From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> VSN VSN.exe Software to share photographs across the internet VSOCheckTask MCMNHDLR.EXE Part of McAfee's SecurityCenter and Virusscan Online. Must be enabled for scanning to work vspdfprsrv.exe vspdfprsrv.exe Visage PDF Printer VsStatEXE VSSTAT.EXE From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> vTPass vtpassld.exe Part of vTrails - a live media delivery solution. vTPass is the driver enabling the system to work. If unavailable via Start -> Programs, create your own shortcut for the "vtpass.exe" file VTPreset VTPreset.exe Savage Pro S3 graphics software VTTimer VTTimer.exe Driver file for the on-board VIA/S3G KM400/KN400 graphics which enables TV in/out communication vTunerStartUp vTuner.exe vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet" vuaaa reg.exe Added by a variant of the RBOT WORM! VVSN VVSN.exe WhenU.Save adware VZAccess Manager VZAccess Manager.exe Verizon Access manager for enterprises VZRemoteCommander AvRmtCtr.exe Related to Sony's VAIO Zone Remote Commander. A non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems w32 w32.exe Added by the SOKEVEN TROJAN! W32.Scran Scran.exe Added by the NARCS WORM! w32alanis mope.scr Added by the SINALA WORM! W32data eworo.exe Added by a variant of the RBOT WORM! W32Load [random filename].scr Added by the CASPID WORM! W32PluginsDownloaderXMLHTTPSelfClearing7520 wiper.exe Added by the PROXYSER-M TROJAN! w32sup w32sup.exe Adult content dialler W32Tc WTC32.scr Added by the VOTE.D or VOTE.K WORMS! W3KNetwork rundll32.exe w3knet.dll, dllinitrun Advertising spyware. Check here for more info on this particular one W75P2PSERVER W75P2PS.EXE Printer utility which is required in order to make the printer work correctly W815DM W815DM.exe Enuff Parental Control Software by Akrontech w98Eject w98Eject.exe Related to USB support for Sigmatel MP3 audio palyer (and others such as SanDisk). It's intent is to "put away" the "disk" before you unplug it from the USB port, ostensibly to avoid "losing" data wait4IP wait4IP.exe Packard Bell net2Plug allows you to network PCs anywhere in your house wallchgr.exe wstart Wallchgr.exe WallChanger - wallpaper changer from Blue Tree Software WallPaper taskimgr.exe Added by the BANKER-GX TROJAN! WallPaper WALLPA~1.EXE Wallpaper Changer - wallpaper manager that can change your background images on every startup WallpaperChanger Wallpaper.exe A wallpaper changer and manager utility. There is the Freeware version and the Pro version. The freeware version is completely free. The Pro version is 30-day trialware, and after the 30 days some of t Wanadoo Messenger.exe Wanadoo Messenger.exe Wanadoo ISP instant messenger client WanMPSvc WanMPSvc.exe An AOL component, the Wan miniport (ATW) service. If you delete this and logon, AOL reports a problem with your internet connection, and reinstalling AOL doesn't help

X N N X X N U U U Y N U U N U X N U N N ? ? N N N N N U N X X U N U U ? X X X X U X X X X X X N N X X N N X X X X X X ? X X X U Y X N X X ?

WAPI wts**.exe [* = random char] War FTPD Tray Icon wartray.exe war-ftpd.exe WAR-FTPD.EXE Wardo syslaunch.exe WareOut WareOut.exe warez warez.exe Warner warner.exe Warnet warnet.exe Warning: do not remove it! fpplock.exe Warning: do not remove it! (system) cfpsys.exe WARSVR war-ftpd.exe WashAndGo - Cleanup of old Backupfiles checker.exe Washer washer.exe Washerie.exe washerie.exe washindex washidx.exe Wast wast.exe Watch watch.exe Watch 1200UBWATCH.EXE Watch Dog Program watchdog.exe Watchdog Watchdog.exe WatchDog watchdog.exe WatchDog DVDCheck.exe WaveTop Launcher WaveTop.exe WaveTop Receiver 1 N/A WaveTop Receiver 2 N/A WaveTop Upload Manager N/A Wbiff Wbiff.exe Wbutton Wbutton.exe WCESCOMM WCESCOMM.EXE WCESMngr spoolsb.exe WCESMngr WCEMNGR.EXE wcmdmgr wcmdmgrl.exe wcmdmgr.exe wcmdmgr.exe wcmdmgrl wcmdmgrl.exe WCOLOREAL coloreal.exe WCPC wintsvcc.exe WCPI wintsvit.exe WCPS Wint**.exe [* = random char] WCPT wintsvtr.exe wcsys wcsys.exe WD Button Manager WDBtnMgr.exe WDInfo wdinfo.exe WDNS SYSTEM nibie.exe WDNS SYSTEM skybotx.exe WDNS SYSTEM wdns33.exe wdskctl wdskctl.exe wdwctrl wdwctrl.exe WEATHER WEATHER.EXE WeatherCast Weather.exe WeatherOnTray WeatherOnTray.exe WeatherOnTray SbWeatherOnTray.exe Weatherscope Weatherscope.exe WeatherWatcher ww.exe web ******.exe [* = random char] WEB DRIVERS FOR WIN32 phqgh.exe Web Offer ezPopStub.exe Web Offer ezStub.exe Web Offer EZSTUB22.EXE Web Offer vl_ezstub.exe Web Search ?? Web Service [random filename].exe Web Service sm.exe Web Service MSXMIDI.EXE Web2Pop Web2Pop.exe web3trap web3trap.exe webalize webalize.exe WebArmyKnife WAK.exe webassist webassist.exe webcam webcam.exe Webcam Go Sti Service Applicationwbcgosvc.exe

PurityScan/Clickspring adware War-ftpd - FTP server War FTP Daemon from JGAA's Internet - FTP client Added by the ADLCICKER.G TROJAN! Wareout - malware masquerading as a spyware and dialer remover Warez P2P client Also known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files Warnet - system cleanup software Part of Folder Password Expert by ZQS Software Team - "a software program to restrict access to the folders that contain your sensitive data" Folder Password Protect - a program that lets you set a password on folders of your choice War FTP Daemon - the original free FTP server for windows WashAndGo - temp file cleaner Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherw Cookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer, specific for cleaning the IE cache and cookies. Available via Start -> Programs Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherw Grokster ads updater Found to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted Button press monitor for the Mustek 1200 UB Scanner For Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do Definitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others), launches from the Startup folder in the Start Menu, but not required as they give instructions on remov Part of Motorola "Mobile Phone Tools" v3 - in a "Mobiile Phone Tools" sub-directory of Program Files Related to an Intervideo program. What does it do and is it required in startup? WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Wbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received Turns on and off the integrated WiFi on Acer (and other laptops) Active sync for use with Windows CE based palm PC Added by the AGOBOT-QZ WORM! Added by the AGOBOT-QX WORM! Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that Makes colours sharper and brighter, but will only work with coloreal capable monitors ?? PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware Added by the KEYLOG-AP TROJAN! Button manager installed with a western digital external disk drive. Allows you to back up your system with one click Added by the DLUCA.B TROJAN! Added by the MYTOB-BY WORM! Added by the MYTOB-BY WORM! Added by the MYTOB-BY WORM! IEPlugin spyware Added by the DLUCA.E TROJAN! Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Weather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight Hotbar's Weather Forecast tool for your desktop - adware Related to Hotbar's Weather Forecast tool for your desktop WeatherScope - "displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!" Not recommended as it bundles GAIN adware. You can get the a WeatherWatcher - weather reporting in the System Tray Added by a variant of the EASTO.A TROJAN! Added by a variant of the RBOT WORM! eZula TopText adware eZula TopText adware eZula TopText adware eZula TopText adware ?? Added by the ADMINCASH TROJAN! Added by the BUBE-F VIRUS! CoolWebSearch parasite variant, identified by Kaspersky as TrojanDropper.Win32.Small.cw Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client PC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs, etc Searchcentrix hijacker Web Army Knife - a suite of web site developer's tools Adware popup generator Added by the MONAD-A TROJAN! Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be Control software for the portable Creative Video Blaster Webcam Go digital camera/PC web cam. What does it do and is it required?

N X X X X U X X X X N N N N X X U X X N N Y X N ? N N X X X Y Y U X N ? X X X N N N U N Y ? Y U X U U U X X X X X X X N X X X ? U N N X X X

WebcamRT.exe Webcelerator WebCheck WebCpr0 Webdav.exe WebExRemoteAccessAgent WebHancer Agent webHancer Survey Companion WebInstall WebInstall2 WebKey WebLink WebOutfitterTray Webposition Gold 2 WebRebates0 WebRun websaverlive WebSavingsfromEbates WebSavingsFromEbates0 WebScan webscan WebScanX websearch WebSecureAlert WebServer Webshots Webshots Website Administrator Info WebSpecials Websx Webtrap WebTrapNT.exe WebWasher WeirdOnTheWeb Welcome WEPstat wersds wersds.exe wesumu WetSock wextract_cleanup0 WFGStartup wfips WFXCTL32.EXE wfxsnt40 WFXSwtch WG511WLU WGWLocalManager whagent WhatPulse WheelMouse WheelMouse WheelsMouse WhenUSave WhenUSearch WhenUSearchWHSE Whistler Whitechix Whvlxd WIAWizardMenu Widnows Xp Web scan wifeman WildFlics WildTangent CDA WildTangent Web Driver updater Wildwire Monitor Willow Road win win win

WEBCAMRT.exe For Logitech Web Cams. Not required - camera works fine without it webcel.exe Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Spyware WebCheck.pif Added by the CONE.C or CONE.F WORMS! WebCpr0.exe Web_CPR/TopMoxie adware webdav.exe IRC DDoS bot which gives the hacker full control over your system raagtapp.exe Related to Web Meetings from WebEx Communications, Inc. Share and present online with anyone, anywhere whagent.exe System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here whSurvey.exe WebHancertrackware - traffic measurement service that uses a client agent that is stealth installed on user machines, gathering detailed data about sites visited, their performance and, most important WebInstall.exe ClipGenie adware downloader WebInstall.exe ClipGenie adware downloader WebKey.exe WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet WebLink.exe Softex WebLink is a "cost-effective way to provide software updates, technical support or new product information to specific end-users - it can silently provide end-users with software updates, technic sttray.exe Intel WebOutfitter service System Tray icon wpsche~1.exe Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines WebRebates0.exe WebRebates adware [random filename] Added by the ADWARELOADER TROJAN! websaverlive.exe WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle WebSavingsfromEbatesrun.exe Web Savings From Ebates Software, a shopping tool that opens pop-up windows WebSavingsFromEbates0.exe Web Savings From Ebates Software, a shopping tool that opens pop-up windows DEFSCANGUI.EXE eAcceleration Stop-Sign related - not recommended, see note stopsignav.exe eAcceleration Stop-Sign related - not recommended, see note WebScanX.exe From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc wjview ...websearch.exe Web Savings From Ebates Software, a shopping tool that opens pop-up windows WebSecureAlert.exe WebSecureAlert - "helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings, and can help to protect your privacy by deleting your web s VBI_SE~1.EXE Related to a Pinnacle sound card. What does it do and is it needed? Webshots Tray.exe Screensaver program that automatically downloads from the webshots web site websho~1.exe Screensaver program that automatically downloads from the webshots web site webadmin.exe Added by the FORBOT-FY WORM! rundll32 [path] webspec.dll WebSpecials spyware Int*****.exe Adult content dialler - where ***** are random webtrap.exe Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating WebTrapNT.exe Part of PC-Cillin Anti-Virus software. Checks visited web-sites for malicious Java and ActiveX elements wwasher.exe Free Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs WeirdOnTheWeb.exe Added by the WeirdOnTheWeb adware Welcome.exe Launches the Welcome to Windows tutorial on boot up Wepstat.exe Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be "U". Can anybody confirm this? doriot.exe Added by the JECT.C TROJAN! doriot.exe Added by the BAGLEDI-A TROJAN! wiustv.exe Added by the QQPASS-L TROJAN! wetsock.exe RoboMagic Wetsock - weather reporting in the System Tray advpack.dll, DelNodeRunDLL32 [path] Wextract [filename].TMP Cleanup0 is valid and legal software included or sold to help clean up temporary or cab files created by the installer software for a wide variety of software. It should disapear after a restart of WFGStartup.exe World Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones" iphider.exe ICQ (messaging/chat program) anti-bomb software. "WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed." WFXCTL32.EXE From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start wfxsnt40.exe WinFax 10.0 and maybe earlier versions. The program that opens the port for WinFax and not normally in the start menu. Needed if you want to run WinFax WFXSWTCH.exe Related to WinFax. What does it do and is it required? WG511WLU.exe Netgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card WGWLocalManager.exe Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data tr whagent.exe System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here WHATPU~1.EXE WhatPulse keeps track of your keystrokes, allowing you to find out just how much you type a day 4DMAIN.EXE Mouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide AMOUMAIN.EXE A4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features [path to trojan] Added by the SOCKSPR-D TROJAN! Save.exe WhenU.Save adware Search.exe WhenU.Save adware whse.exe WhenU.Save adware whismng.exe Added by the WHISTLER-F TROJAN! brightx.exe Added by a variant of the SDBOT WORM! Whvlxd.exe Added by the W32.LXD.MIRC TROJAN! RUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenu Still Image Class Installer - installed with a webcam xpscan.exe Added by a variant of the SDBOT WORM! wifeman.exe Unidentified malware WildFlics.exe Added by the Direct-B premium rate adult content dialler RUNDLL32.exe cdaEngine0400.dll, Part cdaEngineMain of the WildTangent on-line games system. What does it do and is it required? wcmdmgrl.exe Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that WWMon.exe This places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem WillowRoad.exe Willow Road Screen Saver regedit -s ..win.dll Added by the SEEKER.K TROJAN! xwinxrpc32.exe Added by the AGOBOT-MV WORM! xwinxrpc.exe Added by the AGOBOT-MV WORM!

X X U X X X X X X X X X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X

WIN WIN Win Chimes Win Comm Win Command Win Command Win CPU win ctl app Win Drivers SSL Win Drivers SSL Win Drivers SSL Win Drivers SSL32 WIN HOST PROCESS Win l5oahder Win Login Win Microsoft 98 win name Win Patch Win Secure Update Win Security Win Server Win Server Updt Win Server Updt Win Server Updt Win TaskLoader win update win update Win Update Win Update Win Updater Win Updator Services WIN USB 2.0 WIN USB 2.0 Win USB 2.0 USB Driver WIN USB SUPPORT Win Validation Application Win WinAmp WIN-BUGSFIX win-xp win-xp win-xp win-xp win.exe win16.dll Win2Drv WIN32 win32 win32 Win32 win32 win32 Win32 Win32 Win32 win32 Win32 Bios Win32 Configuration Win32 Configuration Win32 Configuration WIN32 DDOSSER Win32 Debug Manager Win32 Debug Manager Win32 Device Loader Win32 Driver Win32 Drivers Win32 DRK Driver Win32 exe file Win32 Explorer Win32 Firewall Driver Win32 FRT Driver

ehshell.exe windows.exe winchi~1.exe WinComm.exe command32.exe command32.exe sysin.pif wuctl.exe hpws.exe TASKMAN4.exe hpws.exe hpwsnnsbc.exe WIN HOST PROCESS.EXE winampa.exe winlogin.exe win14.exe stat.exe ntldr.exe [random filename] msw32.pif winserv.exe wupdt.exe winserver.exe pxckdla.exe msgmr.exe wupda32.exe wapdate.exe SysUpdate.exe oleupdate.exe WINUPDATER.EXE ctfnom.exe usbsystem.exe winusb.exe HPPrint.exe grxsrv.exe DBExecCom.exe winamp.exe WIN-BUGSFIX.EXE nvsc32.exe winis.exe winis.exe nvsc32.exe win.exe win16dll.exe [worm filename] WIN32.EXE Shakira_1997_Part_1_.Mpeg_.scr Setup_32.exe Win32.exe winsrv32.exe WinSetup.exe system32.vbs Game.exe.vbs arsetup.exe winhost.exe Winbios.exe videosd32.exe dllhelp.exe mplayer.exe dos.exe Win32Debug.exe microsoftupd.exe Win32ldr.exe svchosts.exe winlogons.exe wdrk32.exe winstr32.exe Explorer32.exe winfw.exe msfr32.exe

Added by the MYTOB-CQ WORM! Added by the REATLE.C WORM! WinChimes - enhancement software for the system clock that runs in the system tray WebRebates related adware Added by the AGOBOT.XQ WORM! Added by the AGOBOT.XQ WORM! Added by the RBOT-AXL WORM! Added by a variant of the SDBOT WORM! Added by the IRCBOT.67098 WORM! Added by a variant of the RBOT WORM! Added by the IRCBOT.67098 WORM! Added by the SPYBOT.MAR WORM! Added by the KEYLOGGER.CLONE TROJAN! Added by a variant of the AGOBOT/GAOBOT WORM! Note - this is NOT the popular Winamp media player which has the same filename Added by the RBOT-AWE WORM! Note - this trojan file is found in the System (95/98/ME) or System32 (NT/2000/XP) folder Added by the RBOT-AKX WORM! ?? Added by the SDBOT-GS WORM! Added by the RBOT-AGI WORM! Added by the RBOT-AQT WORM! Added by the IMISERV.A TROJAN! Added by the IMISERV.A TROJAN! Added by a variant of the IMISERV TROJAN! IEPlugin adware Added by the MYTOB.L WORM! Added by the SDBOT.J WORM! Added by a variant of the RBOT WORM! Added by the AGOBOT-TN WORM! Added by the AGENT-UY TROJAN! Added by the RBOT.IP WORM! Added by a variant of the WOOTBOT WORM! Added by an unidentified WORM of TROJAN! Added by a variant of the RBOT WORM! Added by the SPYBOT.DNB WORM! Added by a variant of the RBOT WORM! Added by the VBSILLY-A WORM! Added by the RBOT.AGF WORM! Note - this is not the Winamp media player executable (WinAmpa.exe) Added by the LOVELETTER (I LOVE YOU) VIRUS! Added by the BROPIA.N WORM! Added by the BROPIA.N WORM! Added by the BROPIA.N WORM! Added by the BROPIA.N WORM! Added by the PODROP-C TROJAN! Screenspy captures screenshots silently. If you didn't install this yourself, remove it Added by the WINTOO WORM! Added by the RATEGA TROJAN! Added by the MYLIFE.N WORM! Added by the EVILBOT.B TROJAN! Added by the ISRAZ.A WORM! Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites Added by the EVILBOT.B TROJAN! Added by the SWERUN VIRUS! Added by the SCAFENE WORM! Added by the SPAZBOX.A TROJAN! Added by the BROPIA.J WORM! Added by the SEMAPI-A WORM! Added by the SDBOT.TT WORM! Added by the SDBOT.UL WORM! Added by the FORBOT-BZ WORM! Added by the KELVIR.F WORM! Added by a variant of the WOOTBOT WORM! Added by a variant of the WOOTBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the FORBOT-FD WORM! Added by the FORBOT-FG WORM! Added by the WOOTBOT.CY WORM! Added by a variant of the SPYBOT WORM! StartPa-MN homepage hijacker Added by a variant of the RBOT WORM! Added by a variant of the FORBOT WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X Y X X

win32 internet server Win32 Kernel core component Win32 LSA Driver Win32 Ms Auto Updater Win32 Network Driver Win32 NT Adv Services Win32 nvc Win32 NVIDIA Driver win32 regedit Win32 Rundll Loader Win32 Secure Win32 Service Win32 Services Win32 Services Config Win32 Services1 Win32 Src Service Win32 SSL Driver Win32 Svchosts Driver win32 system server Win32 System Spool Win32 Test Win32 USB Driver Win32 USB Driver Win32 Usb Driver Win32 Usb Driver Win32 Usb Driver Win32 USB2 Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2 Driver Win32 USB2.0 Driver Win32 USB2.0 Driver Win32 USB2.0 Driver Win32 USB2.0 Driver Win32 USB3 Driver Win32 Wmls Driver Win32 Word Services win32.exe Win32.exe Win32.Exploit.mzH Win32.Trojan.Downloader Win32BaseServiceMOD win32beta win32clf win32debug Win32DLL Win32dll WIN32DS Win32G Win32G win32gb Win32Host Process win32info win32ini WIN32io Win32R WIn32S Java DLL win32servv win32servv WIN32SL WIN32SNDS Win32system

winserver.exe Kernel32.pif lsa.exe AutomsUPD.exe crss.exe taskmngr.exe nvcva.exe MSPMSPSU.EXE msn32.exe Rundll32.exe msconfigsvc.exe bazzi.exe odbc32.exe winwkys.exe wuamngr1.exe win32src.exe winssv.exe svchosts.exe winserver.exe spoolsvc.exe bleatest.exe winxpinit.exe mvsecn.exe svhosint32.exe usb32.exe AvpG.exe wins32.exe win32usb.exe smsc.exe svchosting.exe sys32.exe sys32snd.exe wind32.exe winupdate.exe updatemgr.exe winsnd32.exe msn.exe syscfg32.exe 386.exe rundll16.exe w32usb2.exe service.exe win32tool.exe winitr32.exe msword32.exe win32.exe Win32.exe mzrun.exe netstat2.exe Wintask.exe win32sys4.exe win32clf.exe win32debug.exe Win32DLL.vbs Win32dll.exe clienttimer.exe Kernel32.com Scandisk.com win32gb.exe webemir.exe win32info.exe systroy.exe clienttimer.exe Server.com kavsvx.exe load.exe ms1.exe Win32sl.exe banc.exe [random filename]

Added by the DERMON-D TROJAN! Added by the MOKS VIRUS! Added by the FORBOT-FJ WORM! Added by a variant of the RBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the RBOT-ADE WORM! Added by the RBOT-ABF WORM! Added by a variant of the WOOTBOT.Y WORM! Added by an unidentified WORM or TROJAN! Added by the SDBOT.A TROJAN! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:Windows directory. The version created by this virus is saved in the C Added by a variant of the SDBOT WORM! Added by the AHKER.E WORM! Added by the SPYBOT-EK WORM! Added by the RBOT.BKY WORM! Added by the SDBOT-PV WORM! Added by the RBOT-SX WORM! Added by the FORBOT-BH WORM! Added by the FORBOT-FO WORM! Added by the DERMON-A TROJAN! Added by the SDBOT.UK WORM! Added by a variant of the RBOT WORM! Added by the SDBOT.AA TROJAN! Added by the FORBOT-BK WORM! Added by the FORBOT-BE or FORBOT-J WORMS! Added by the SDBOT-OV WORM! Added by the FORBOT-BX WORM! Added by a variant of the RBOT WORM! Added by the SPYBOT.DHV WORM! Added by the SDBOT.FO WORM! Added by the FORBOT.J or SDBOT.HU WORM! Added by the WOOTBOT.X WORM! Added by the FORBOT-AN WORM! Added by the FORBOT-AH WORM! Added by the AGOBOT.YE WORM! Added by a variant of the FORBOT WORM! Added by a variant of the SDBOT WORM! Added by the FORBOT-EX WORM! Added by the FORBOT-R WORM! Added by the IRCBOT.D WORM! Added by the WOOTBOT.H WORM! Added by the SPYBOT.DN WORM! Added by the SDBOT-QF WORM! Added by a variant of the RBOT WORM! Added by the WOOTBOT.B WORM! Added by a variant of the RBOT WORM! Added by the STARTPAGE TROJAN! Added by the AWQ.A TROJAN! Added by the PAINTER TROJAN! Added by the PAINTER TROJAN! Added by the NAVIDAD WORM! Added by the BANKER-DA TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Added by the GUDEB WORM! Added by the LOVELETTER (I LOVE YOU) VIRUS! Added by the BANPAES TROJAN! Added by Eziin adware Added by the ESTRELLA TROJAN! Added by the ESTRELLA TROJAN All-In-One-Telcom (adult content dialler) variant Added by the TURGEN -A TROJAN! Adult content dialler Added by the IRC.ALADINZ.C TROJAN! Added by Eziin adware Added by the ESTRELLA TROJAN! Added by the AGOBOT-RZ WORM! Added by an unidentified TROJAN or adware Added by an unidentified trojan or adware Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client com Added by an unidentified WORM or TROJAN! Added by the DDV.B WORM!

X X X X X X X X X X X X X X X X X X U X X X X X ? X X X X X X X X X U X U X X U X X X X X X X X X U X X U U X X X X X X X X N N X X X X X X

Win32System Win32SystemMonitor Win32SysV win32us win32usbd WIN32WN win32_i lptt01 win32_i ml097e Win386 Win386 WIN3S2SNDS WIN3S2SNDS Win64 Compatibility Check WIN95DEFVIEW WIN95DEFVIEW win98 DNS winabc WinAC v4 Winacsr winactive WinActiveJ Winad Client WinAdCnt.exe winadm WinAgent Winahlp.exe winallap winallapu Winamp Winamp WinAMP Winamp Agent Winamp media player WinAmp Player Winamp to Google Talk Winamp Update Winampa Winampa Winampa Agent WinampAgent WinAmpAgent WinAmpAgent WinAmpAgent WinAmpAgent WinAntiSpyware 2005 WinApi WINAPLOGUPD Winapp WinApp32 WinAppLog WinAuth WinAwk WinBackup Scheduler WinBar winbar.pif winbas12 Winbed Winbin winbin32 WinCheck WinCheck winchost WINCINEMAMGR WinCinemaMgr wincmap wincms WinCRT32 WinCSRSS WINCX Wind Logd File

win32s.exe Added by the MYDOOM.V WORM! ***.exe [* = random char] Browser hijacker xin.exe Added by the FORBOT-EO WORM! win32us.exe All-In-One-Telcom (adult content dialler) variant ssrs.exe Added by the RBOT-RA WORM! system_wc.exe Added by Eziin adware win32_i.exe RapidBlaster variant (in a "win32_i" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here win32_i.exe RapidBlaster variant (in a "win32_i" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Win386.exe Added by the GOSUSUB VIRUS! sp32.dll Homepage hijacker. Not a dll but a regfile in disguise winabsmod.exe Added by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well" winiprtx.exe Added by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well" load win64.drv CoolWebSearch parasite variant [path to file] Added by the DEDLER-D TROJAN! csmss.exe Added by the DEDLER-D TROJAN! wingrd.exe Added by a variant of the RBOT WORM! rundll32.exe [Temp][ORIGFILENAME].DLL, Added by InstallLaunchEv the LINEAGE-PN TROJAN! klsuicbn.exe Added by the FORBOT-CS WORM! Winacsr.exe AceScreenSpy keystroke logger/monitoring program - remove unless you installed it yourself! WINACTIVE.EXE WinActive of the LOP.com hijacker WinActiveJ.exe Added by the ROTARRAN VIRUS! Winad.exe WinAd adware by eXact Advertising WinAdCnt.exe Added by the BANKER-BU TROJAN! winadm.exe Browser hijacker - redirecting to Search-World.net. Related to the SMALL.LR TROJAN! WinAgent.exe Standard Life Insurance program. Is it required at startup? Winahlp.exe Added by a variant of the VAGRNOCKER TROJAN! winallap.exe Added by the DELF.E TROJAN! winallapu.exe Added by the DELF.E TROJAN! winamp.hta Hijacker - re-directing to adult content sites. Note - this isn't the real Winamp winamp.exe Added by the AGOBOT-MC WORM! Note - this is NOT the popular Winamp media player which has the filename "winampa.exe" winamp62.exe Added by the SDBOT-WN WORM! winamp.exe Added by the POEBOT-I WORM! Note - this is NOT the popular Winamp media player which has the filename "winampa.exe" winapa.exe Added by an unidentified VIRUS, WORM or TROJAN! winampp.exe Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename winamptogoogletalk.exe Winamp to Google Talk, available here shows your current Winamp track in your Google Talk status yhn.exe Added by the SDBOT-ACR WORM! WINAMPa.exe Loads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. winampa.exe Added by the AGOBOT-GS WORM! Note - this is NOT the popular Winamp media player which has the same filename WINAMPA.EXE Added by the SPYBOT-BR WORM! Note - this is NOT the popular Winamp media player which has the same filename WINAMPa.exe Loads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Msexploren.exe Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Shch.exe Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename svchst.exe Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Winagent.exe Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename was5.exe Spyware remover - not recommended, see here winapix.exe Added by a variant of the TIBSER.A downloader TROJAN! WINAPLOGUPD.EXE Added by the CAPSIDE-C WORM! winpup32.exe Produces popup ads to adult content sites msapp.exe Added by the RSBOT TROJAN! svchost.exe StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! winlogon.exe Hijacker, also indentified as the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. WinAwk.exe Added by the SDBOT-AYF WORM! Wbsched.exe LIUtilities WinBackup scheduler - backup software WinBar.exe WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls packe.pif Added by the RBOT-AVI WORM! winbas12.exe Adware, CoolWebSearch parasite related - recognized by Kaspersky antivirus as TrojanDownloader.Win32.VB.du - Note - this malware actually changes the default value data of the Registry "Run" key i winbed.exe Hijacker swchost.exe Added by the RBOT.CLS WORM! win32exe.exe Added by the RBOT-ZL WORM! WinCheck.exe Added by the PWS-CY TROJAN! services.exe Added by the SOBER.S WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco winchost.exe Added by the DLOADER-PO TROJAN! WINCIN~1.EXE WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs WinCinemaMgr.exe WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs wincmapp.exe CasClient adware variant - also detected as the CMAPP TROJAN! wincms.exe Added by the RBOT.CBR WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty wincrt32.exe Added by the DOGBOT-D WORM! MSGRT32.EXE Added by the REWINDO-A TROJAN! wincore332.exe Added by the AGOBOT-MG WORM! servicelogd.exe Added by a variant of the RBOT WORM!

X X X X X X N X X X X X X X X X X U X X X X X X X X X X X U X X U X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X

Wind Security wind.exe WIND0WS WIND0WS Wind0ws Wind0ws Sharing WinDates windbs Winde windef windef Windeows NetStart Service2 windhost.exe windhost.exe windhost.exe windir Windll WINDLL windll Windll.exe Windll32 WinDll32 windllsys32.exe WinDNS Windoes Kernel Window Window Loader Window Monitor Window service Window Washer window.exe window2 WindowBlinds WindowEnhancer WindowFX windown WindowRegKey update Windows Windows Windows Windows windows windows windows Windows Windows Windows WINDOWS Windows WINDOWS windows Windows Windows windows Windows (random character) Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows .Net Manager Windows 128 Module Windows 2004 Windows 32 Editor Windows 32 Rescue Windows 32 Update Windows Accelerators Windows AdControl

mswi32.pif wind.exe WIND0WS.exe mella.bat wordpad.exe ssprotecter.exe windates.exe winxtc.exe winde.exe Win32sp.vbs windef.exe tesakrmger.exe osrwin32.exe windhost.exe winos.exe winrun.exe Windll.exe WSYS.EXE windll32.exe Windll.exe Windll32.exe _WIN32.EXE windllsys32.exe windns32.exe kernel32.exe explore.exe Dos32.exe winmon32.exe [random filename] wwDisp.exe window.exe ssvchost.exe wbload.exe Winex.exe wfxload.exe wiusyt.exe wins.exe Kernel32.exe msdos98.exe Windows.exe explorer.exe [path to trojan] hkey.exe system copy.exe gearsec.exe run.exe system.exe windows.exe services.exe jif.exe iexplore.exe services.exe smss.exe svchost.exe diskcheck.exe localsvc.exe netsvc.exe spoolsvc.exe svcadmin.exe svcman.exe svcrun.exe tcpsvc.exe websvc.exe win128.exe csrss.exe Win32edit.exe win32resc.exe Windows-Update.exe setup.exe WinAdCtl.exe

Added by the RBOT-ARH WORM! Added by the MITGLIEDER.BD TROJAN! Added by the SPYBOT.DQ WORM! Added by the ALLEM WORM! Added by the AGOBOT-TL WORM! Note - this is not the legitimate Windows application wordpad.exe (which is found in the Program FilesAccessories folder) which should not normally be seen in Msconfi Added by the RBOT-AHW WORM! WinDates is a calendar, date organizer and event reminder program from Rockin' Software Added by the AGOBOT-WD WORM! Added by the DLUCA TROJAN! Added by the ANPES WORM! Added by the WURMARK-O WORM! Added by the RBOT-AMY WORM! Added by the BANKER-CB TROJAN! Added by the BANKER-BV TROJAN! Added by the PWSAGENT-A WORM! Added by the WINBUR.B WORM! Added by the TRYNOMA TROJAN! STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes, all passwords transacted even if they weren't keyed in, all web sites visited, every program launched inclu Added by the ASTEF or RESPAN WORMS! Added by the STEALER TROJAN! Added by the MSNPWS TROJAN! Added by the LEGMIR.AQ TROJAN! Added by a variant of the MITGLIEDER.BY TROJAN! Added by the GAOBOT.WX WORM! Added by the KICKIN.A (or CYDOG.C) WORM! Added by the GAOBOT.ADW WORM! Added by the GAOBOT.AO WORM! Added by the SDBOT.RT WORM! Added by the RBOT-ACH WORM! Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherw Added by the MITGLIEDER.H or MITGLIEDER.J TROJANS! Added by the IRCBOT.H TROJAN! WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use i SCBar foistware variant Stardock WindowFX - "Allows you to add an unprecedented number of special effects to windows" Added by the QQPASS-M TROJAN! Added by the SPYBOT.I WORM! Added by the TENDOOLF WORM! Added by the PWSTEAL TROJAN! Added by the KAZMOR, BOBBINS & ALADINZ.D TROJANS! Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m Added by the AIMWIN TROJAN! Added by the GAOBOT.AFW WORM! Added by the SALGA.A WORM! Added by the STUBBOT-B TROJAN! Added by the SPYBOT.OFN WORM! Added by the SPYBOT.OBB WORM! Added by the MONBOT-A TROJAN! Added by the SOBER-Z WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the MYTOB.MK WORM! Added by the RBOT-UM WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the DLOADR-GW TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the BANCBAN-QF TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the SINGU.B TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the FORBOT-ES WORM! Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the WOOTBOT.GQ WORM! Added by the FORBOT-EU WORM! Added by a variant of the RBOT WORM! KeySpy keystroke logger/monitoring program - remove unless you installed it yourself! Windupdates adware variant

X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X Y X X X X X X X X X X

Windows AdService WinAdServ.exe Windows AdStatus WinStat.exe Windows AdTools WinAdTools.exe Windows Anti-Virus Built 32 AntiVirus32.exe Windows API Control Task apitsk32.exe Windows Application Layer walg32.exe Windows Application Layer Gateway walg32.exe Windows ASN Service rge.exe Windows Authority Service lsass.exe windows auto update penis32.exe Windows Auto Update winupdater.exe Windows auto update bazzi.exe Windows auto update LSASS.exe windows auto update msblast.exe Windows Automatic Update wuamgrder.exe Windows Automatic Updates dvldr.exe Windows Automatical Updater dcz.exe Windows AutomaticUpdater runddls.exe windows automation mslaugh.exe Windows Automation msdspr.exe Windows Autostart Loader notepad32.exe Windows backup systemss.exe Windows Backup Configuration IEXPLORER.exe Windows Baþlangýç Dosyasý sistem.exe Windows Bootup ms-wks32.exe Windows Bootup Systemwks32.exe Windows Bootup task-mngr.exe Windows Clean-Up Pro WINDOWS CLEAN-UP PRO.Exe Windows Client Service 32 csrss.exe Windows Client/Server Runtime Server csrs.exe Windows Command wincmd.exe Windows Communicator wincomm.exe Windows Compliant [random filename] Windows Config SSYS.EXE Windows Config wins.exe Windows Config RUNDLL.EXE Windows Config Loader Wincfg32.exe Windows Configuration wsys32.exe Windows Configuration wincfg32.exe Windows connection manager Internet.exe Windows Console Monitor [path to worm] Windows Console Monitor gcasAV32.exe Windows Control Control.exe Windows ControlAd WinCtlAd.exe Windows CPU host winbog32.exe Windows Custom Services CSRCS.EXE Windows Data Server autodisc.exe Windows Data Server [random name].exe Windows Database WinDat.exe Windows Database wiinsvc.exe Windows Dcom2 Fix mscom32.exe Windows DDE Loader windde32.exe Windows debug logging winlogg.exe Windows debug logging winloggs.exe Windows Debugger windbg.exe Windows Debugger msdbg32.exe Windows Debugger windbg32.exe Windows Debugging Tools updatecfg.exe Windows Default Configuration svchost.exe Windows Defender MSASCui.exe WINDOWS DENEME deneme.exe Windows Desktop Controler windesktop.exe Windows Desktop Daemon winpadg.exe Windows Dialup Service dialup.exe Windows DLL host winupd32.exe Windows DLL Host dllhost32.exe Windows DLL Loader RUNDLL16.EXE Windows DLL Loader defragfat32z.exe Windows DLL Loader rundll32.exe Windows DLL Loader defragfat32pi.exe

Windupdates adware variant Added by the BLESHARE!DR VIRUS! Windupdates adware variant Added by the SDBOT-BG WORM! Added by the MYTOB.HI WORM! Added by the AGOBOT.ATN WORM! Added by the AGOBOT-AAZ WORM! Added by the RBOT-AOK WORM! Added by the KALEL-E WORM! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup! Added by the BLASTER (or MSBLAST.A) WORM! Added by the SDBOT.TF WORM! Added by the AHKER.E WORM! Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Added by the BLASTER.B WORM! Added by a variant of the RBOT WORM! Added by the RBOT.MF WORM! Added by the RBOT.CXS WORM! Added by a variant of the RBOT WORM! Added by the BLASTER.E WORM! Added by the SOLAME.A WORM! Added by a variant of the RBOT WORM! Added by a variant of the SPYBOT WORM! Added by the GAOBOT.AZ WORM! Added by the MUZK WORM! Added by the RBOT-AFM WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AWP WORM! Spyware remover - not recommended, see note Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the RBOT.KD WORM! Added by the RBOT.ANV WORM! Added by the AGOBOT-BH WORM! Added by the RBOT-IR WORM! Added by the SPYBOT-DA WORM! Added by the SPYBOT.JR WORM! Added by the SPYBOT-DX WORM! Note - this is not the Windows system file of the same name as described here Added by the SILVERFTP TROJAN! Added by the GAOBOT.FB WORM! Added by the MYTOB.ED WORM! Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one, it copies it's self under three other file names and folder locations Added by KEDEBE WORM! Added by the KEDEBE-A WORM! Browser hijacker. NOTE - On Win9x systems it will overwrite the Windows file of the same name in the Windows directory, so therefore it will be necessary to extract a fresh copy of the file from the Win Windupdates adware variant Added by a variant of the RBOT WORM! Added by the SPYBOT-EI WORM! Added by the SPYBOT-CB WORM! Added by the SPYBOT-DS WORM! Added by an unidentified WORM or TROJAN! Added by the AGOBOT-RU WORM! Added by the RBOT-QT WORM! Added by the SDBOT-UZ WORM! Added by the RBOT-OY WORM! Added by the RBOT-QN WORM! Added by an unidentified VIRUS, WORM or TROJAN! Added by a variant of the RBOT WORM! Added by the ZOTOB.L WORM! Added by the RBOT-AXU WORM! Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Related to Windows Defender Microsoft (anti-spyware) tool Added by the MYTOB-CR WORM! Added by the SDBOT-XH WORM! Added by a variant of the SPYBOT WORM! Added by the AGOBOT.AAH WORM! Added by a variant of the SPYBOT WORM! Added by an unidentified WORM or TROJAN! Added by the DOMWIS TROJAN! Added by the LINKBOT.A WORM! Added by the WHIPSER-B WORM! Note - rundll32.exe file is placed in the WindowsSystem folder, wheras the legitimate rundll32.exe is located in the C:WindowsSystem (Win9x/Me), C:WinntSystem32 (W Added by the RBOT-QQ WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X X X X X X X X X X X X X U U X X X X X ? X X X X X X

Windows DLL Loader defragfat39.exe Windows DLL Loader defragfatz.exe Windows DLL Loader defragfat32.exe Windows DLL Loader defragfat32abc.exe Windows DLL Loader wdevice.exe Windows DLL Loader SYSCFG16.EXE Windows DLL Loader WINCFG32.EXE Windows DLL Services winsvc32.exe Windows DLL Services svchost.exe Windows DLL Services system.exe Windows DLL Tracker spoolsrv.exe Windows DLL Verifier xptl.exe Windows DLL Verifier windlls.exe Windows DNS windns.exe Windows DNS Daemon windnsd.exe Windows Domain Name Drivers windns.exe Windows DOS dosw.exe Windows Download Manager windlmngr.exe Windows Drive Compatibility System32Driver32.exe Windows Driver winxpdriver.exe Windows Driver Adapter svchost.exe Windows Driver Services msdrvs32.exe Windows drivers update windowsupdate.exe Windows Dynamic Loading Header winDLL32.exe Windows Executable winmys.exe Windows ExpIorer [random filename] Windows Explorer [filename].exe Windows Explorer Lsas.exe Windows Explorer olecom32.exe Windows Explorer EEXPLORER.EXE Windows Explorer explorer.exe Windows Explorer explorer.pif Windows Explorer system32.exe Windows Explorer Shell Winexec32.exe Windows Explorer SP2 csrss.exe Windows Explorer Update Build 1142 EXPLORER32.EXE Windows Explorer-3212 WINRE16.EXE Windows Eyes ?? Windows FAT 32 WINFAT32B.exe Windows File Protection winprotect.exe Windows Firewal Lsess.exe Windows Firewall WindowsFirewall.exe Windows Firewall Log winlog.exe Windows Firewall Manager msfw.exe Windows Firewalll scvhost.exe Windows Firewalll sphost.exe Windows Firewalll svvhost.exe Windows Firewalll winmu.exe Windows Fix integator.exe Windows Fixes Systems elite.exe Windows FormatAd WinForm.exe Windows Frame Works frmwrks32.exe WINDOWS FUCK BY CLASIC fuck.exe Windows Generic Proc procmsg.exe Windows GMT32 wingmt32.exe Windows Graphics Loaders wingraphics.exe Windows Guardian thehel1iawgrd32.exe Windows Guardian Fawgrd32.exe Windows Help mailinfo.exe Windows Help File winhelper32.exe Windows Help Manager svchost32.exe Windows Help Service winhelpsv.exe Windows Help Service winhlp.pif Windows Help System Help.pif Windows Host hosts.exe Windows Host winhost.exe Windows Host Device hostsvc.exe Windows Host Name lmass.exe Windows Host Service scvhosts.exe Windows Host Service host.exe

Added by the POEBOT-C WORM! Added by the LINKBOT.H WORM! Added by the SDBOT-SS WORM! Added by the RBOT-RG WORM! Added by a variant of the SDBOT WORM! Added by the DOMWIS-N WORM! Added by the AGOBOT-TE WORM! Added by the RBOT-ZF WORM! Added by the AGENT.H spyware! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the AGENT.H spyware Added by a variant of the WOOTBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AZQ WORM! Added by the SDBOT-XU WORM! Added by the WOOTBOT.AS WORM! Added by the FORBOT-EP WORM! Added by the SALAY-A WORM! Added by an unidentified TROJAN! Added by the SUPOVA.Z WORM! Added by the WOOTBOT.EE WORM! Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the WOOTBOT.L WORM! Added by the RBOT-ACE WORM! Added by a variant of the SDBOT WORM! Added by the RBOT-ABO WORM! Added by the RBOT-AKO WORM! Added by the SDBOT TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Added by the GAOBOT.AO WORM! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Added by an unidentified WORM or TROJAN! Added by a variant of the SPYBOT WORM! Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m Added by the RBOT-AID WORM! Added by the RBOT-AJH WORM! Added by the REDIST.B WORM! Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the KaZaA based KWBOT or KWBOT.Y WORMS! Added by the HARDOC WORM! For blind people, gives a voice description of items on the screen. Windows application which gives you total control over what you hear, when you hear it, and how you hear it. Available via Start -> Pro Added by the SPYBOT-AGT WORM! Added by the AGOBOT.JB WORM! Added by a variant of the RBOT WORM! Added by the MYTOB.AO WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT.WR WORM! Added by the RBOT-EK WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the SDBOT.ZAB WORM! Added by the MYTOB.EG WORM! Windupdates adware variant Added by a variant of the RBOT WORM! Added by the ZOTOB.H or ZOTOB.J WORMS! Added by the ALLIM.B WORM! Added by the MYTOB.KM WORM! Added by the SPYBOT.JG WORM! Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes Added by the MYTOB.JX WORM! Added by the SDBOT-QK TROJAN! Added by the RBOT-OZ WORM! Added by the RBOT-LP WORM! Added by the RBOT-AKW WORM! ?? Added by the KELVIR.U WORM! Added by the PRYSAT TROJAN! Added by the ZOOTY-A WORM! Added by the GAOBOT.O WORM! Added by the SPYBOT.NLI WORM! Added by KELVIR.AN WORM!

X X X X X X X X X X X X X X U X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X X X X X

Windows Host Service svchoste.exe Windows Host Service svchosts32.exe Windows Host32 Starter hostserv.exe Windows Hosts hosts.exe Windows HP Drivers hpdmws.exe Windows HTML file reader Sysconf32.exe Windows Icons Manager wicomgr.exe WINDOWS ID SYSTEM wID32.exe Windows iMessenger Messenger winimsg.exe Windows Incontext InSearch.exe Windows installer winstall.exe Windows Installer ntdll.exe Windows Internet Protocol winproc32.exe Windows Internet Service wininet.exe Windows IP Security ipsec.exe Windows IPv6 Drivers wipv6.exe Windows Java Update weatherBug32.exe Windows JavaScript Daemon Winjsd.exe Windows Kernel 64 kernal64.exe Windows kev Messenger mskev.exe Windows Load windows.com Windows Loader wstart32.exe Windows Loader winServices.pif Windows Loader Service civsc.exe windows Loadxm Win_.exe Windows Local Services localsvc.exe Windows Local Services netsvc.exe Windows Local Services spoolsvc.exe Windows Local Services svcadmin.exe Windows Local Services svcman.exe Windows Local Services svcrun.exe Windows Local Services tcpsvc.exe Windows Local Services websvc.exe Windows Logger winlog.exe Windows logging winlogd.exe Windows Login explored.exe Windows Login winlog.exe Windows Login Folder winzep.exe Windows Login Security winlogin.pif Windows Login Service winlog.exe Windows Login Service winlogin.pif Windows Logon winlogin.exe Windows Logon Application WinIogon.exe Windows Logon Application logon.exe Windows Logon Application services.exe Windows Logon Manager logon.exe Windows Logon Procedure Svchoste.exe Windows Logon Procedure Svchosta.exe windows logon procedure winlogonpc.exe Windows Logon Service winlogon.pif Windows Management Instrumentation mwd.exe Windows Management Instrumentation [path to file] WINDOWS MANAGEMENT SYSTEM wm1exe.exe Windows Manager winmants.exe Windows Manager winsrv.exe Windows Manager Update Inc tgb.exe Windows mangement winlogonn.exe Windows Media AP winmapp.exe Windows Media APP wmapp.exe Windows Media Connect 2 WMCCFG.exe Windows Media Driver msnger.exe Windows Media Loader wmloader.exe Windows Media Loader wmloader.exe Windows Media Player wmediaplayer.exe Windows Media Player MediaPIayer.exe Windows Media Player [random filename] Windows Media Player msa.exe Windows Media Player mcafe32.exe Windows Media Player wmplayer.exe Windows Media Player 50cent.exe

Added by the KELVIR.BF WORM! Added by the KELVIR.AW WORM! Added by the SDBOT-WU WORM! Added by the KELVIR-O TROJAN! Added by the SDBOT.AQU WORM! Added by the NOOMY.A WORM! Added by the RBOT-AIF WORM! Added by the MYTOB.LN WORM! Added by the ALLIM.A WORM! PacerD_Media/Pacimedia.com/Z-Quest adware installer SpySheriff malware. For more information on registry key changes see SPYWAD-E Added by an unidentified WORM or TROJAN! CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN! Added by the RBOT-AUX WORM! Related to the VPN IPSec utility - used to create Security Policy (SP) entries and Security Association (SA) entries in the kernel Added by the SDBOT-VJ WORM! Added by a variant of the RBOT WORM! Added by the WOOTBOT.AF WORM! Added by the YIMP-B WORM! Added by the SDBOT-XV WORM! ?? Added by the GAOBOT.CA WORM! Reported by Kaspersky Anti-Virus as the CARDSPY.D TROJAN! Added by a variant of the RBOT WORM! Added by the FODDER-A TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the NSHADOW-B TROJAN! Added by the RBOT-ON WORM! Added by the GAOBOT.SY WORM! Added by the AGOBOT.MG WORM! Added by the AGOBOT-TZ WORM! Added by an unidentified WORM or TROJAN! Added by the RBOT-AFN WORM! Added by the SDBOT-ACU WORM! Added by the SPYBOT-C TROJAN! Added by the LINKBOT.M WORM! Added by the POEBOT-J WORM! Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by a variant of the RBOT WORM! Added by a variant of the SPYBOT WORM! Added by a variant of the SPYBOT WORM! Added by the WINLOGON TROJAN! Added by the RBOT-AOU WORM! Added by the GRAPS WORM! Added by the QEDS-A VIRUS! Added by the RBOT-VT WORM! Added by the MANTAS WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the SDBOT-ACM WORM! Added by the RANDEX.FC WORM! Added by an unidentified WORM or TROJAN! Added by an unidentified WORM or TROJAN! Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network Added by a variant of the RBOT WORM! Added by the GAOBOT.GEN WORM! Identified as GAOBOT.GEN WORM! Added by the AGOBOT-NQ WORM! Added by the SDBOT-QO TROJAN! - note, the executable is called 'MediapIayer', with an 'i' !) Added by a variant of the RBOT WORM! Added by the RBOT-SI WORM! Added by the RBOT-YO WORM! Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the executeable resides is C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSys Added by a variant of the RBOT WORM!

X X X X X X X N X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ? X X X X X X X X X

Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows Windows

Media Player mpwe.exe Media Player msams.exe Media Player 3.6 wmpa36.exe Media Player 3.6b WMPA36B.EXE Media Player 3.6d wmpa36d.exe Media Player 3.9 wmpa36.exe Media Player Update [random filename] Media Powerpoint Helper NSPPTHLP.EXE media service crvss.exe media service crsss.exe media services cvrsss.exe Media SP.2.37 [random filename] Media Updater crease.exe Media Utility wmediautil.exe messenger messengers.exe Messenger msnsmgs.exe Messenger Messenger winmsg.exe Messenger Service winsmsgr.exe Messenger Service kaspersky.exe MeTaLRoCk service metalrock.exe Micro Drivers wupdates32.exe Monitor winmon.exe Monitor arsetup.exe Monitor Services winmonitor.exe Monitoring Service winmon.exe More Choice TopContext.exe Mouse Utilities mouseutils.exe ms Drivers msnup32.exe MSConfig Startup Logger winlog.exe MSX drivers winmsx.exe NetDDe wrmana32.exe Nets WinNET.exe NetStart Service winsN2S.exe NetStart Service2 winsN2S.exe NetStart Service2 winsN2SD.exe Network Controller Mqguard.exe Network Controller WinxPupd.exe Network Controller winmms32.exe Network Controller wingmt.exe Network Controller Win9x.exe Network Firewall firewall.exe Network Service winvc32.exe Networking winsys32.exe Networks netcog.exe Nivedia Driver sysMGT.exe NNT [path to trojan] NT 32 ntlogin32.exe NT Login ntlogin32.exe NT Login Session ManagerWNSM.EXE NT Logon Application winlogon.scr NT Service Name winshock.exe NT Update Manager WINL0G0N.exe OEM Tools winres32.exe OLE Automation Server ole32aut.vbe Online Updater dllman.exe Pc winmgr.exe PDG winpdg.exe Performance Monitor wmscupd.exe PNP winpnp.exe PNP Server pnpsrv.exe Print Spooler SCVHOSTS.EXE Print Spooler NavAgent32.exe Print Spooler SVEHOST.EXE Process Manager winproc.exe Processe Manager mspn32.exe Protectot boxide.exe Reg Services ffservice.exe Reg Services dservice.exe Reg Services fservice.exe Reg Services ssservice.exe

Added by the RBOT-TT WORM! Added by the RBOT.AHR WORM! Added by a variant of the RBOT WORM! Added by the RBOT-VV WORM! Added by the RBOT-YA WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ET WORM! German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs Added by the SDBOT.VP WORM! Added by the RBOT.ACY WORM! Added by the RBOT-MW WORM! Added by the LEMIR.C TROJAN! Added by the RBOT-ATI WORM! Added by a variant of the SPYBOT WORM! Added by the MYTOB.EI WORM! Added by the RBOT-ANJ WORM! Added by VELKBOT.A WORM! Added by the RBOT-VW WORM! Added by the MYTOB.HY WORM! Added by the TASTYRED TROJAN! Added by the RBOT-AEH WORM! Added by the SDBOT.VB WORM! Added by the SPAZBOX.A TROJAN! Added by the RBOT-XX WORM! Added by a variant of the SDBOT WORM! ZQuest adware Added by the RBOT-ABU WORM! Added by the SDBOT-AAL WORM! Added by the RBOT.BCU WORM! Added by the RBOT-AYG TROJAN! Added by the MYTOB.IM WORM! Added by the RBOT-MO WORM! Added by the RBOT-ZX WORM! Added by the RBOT-ABN WORM! Added by a variant of the RBOT WORM! Added by the FORBOT-CL WORM! Added by the FORBOT-DK WORM! Added by the FORBOT-ED WORM! Added by a variant of the SDBOT WORM! Added by the WOOTBOT.I WORM! Added by the POEBOT-J WORM! Added by the RBOT.RY WORM! Added by the GAOBOT.FL WORM! Added by the MYTOB.FH WORM! Added by a variant of the RBOT WORM! Added by the RANKY.E TROJAN! Added by the RANDEX.BRD WORM! Added by the SDBOT.WG WORM! Added by the RBOT.BIV WORM! Added by the RBOT-ALP WORM! Added by the RBOT-PK WORM! Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital "o" Added by the SPYBOT.FD WORM! CoolWebSearch parasite variant Added by the RBOT-TE WORM! Added by the BIBOT-A WORM! Added by the RBOT-ADW WORM! Added by the IRCBOT_GEN WORM! Added by the RBOT-AKN WORM! Added by this variant of the SDBOT WORM! Suspicious due to the similarity to the valid "svchost.exe" file Added by an unidentified VIRUS, WORM or TROJAN! Added by the SPYBOT.H WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the RBOT WORM! Added by a variant of the WOOTBOT WORM! Added by the DLOADER-PL or DLOADER-XM TROJANS! Added by the PRORAT-D TROJAN! Added by the PRORAT-D TROJAN! Added by the PRORAT-D TROJAN!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

WINDOWS REGISTER EDIT registr32.exe Windows Register Settings svmhost.exe Windows Registry msnmsg.exe Windows Registry winhost.exe Windows Registry Cleaner winclean.exe Windows Registry Express Loader regexpress.exe Windows Registry Manager tasksmanagers.exe Windows Registry Name [random filename] Windows Registry Name winses.exe Windows Registry Scan regscan32.exe Windows Registry Scan timeupdate.exe Windows Registry Scan svcdll.exe Windows Registry Scan regscan23.exe Windows Registry Security crss.exe Windows Registry Startup wind32.exe Windows Repair toxikx.exe Windows report swchost.exe windows run system.exe Windows Run-Time 64bit win64rt.exe Windows Runtime Help win32hlp.exe Windows Runtime Help WinRunHelp.wrh Windows Runtime Proccess 32RUNdll.exe Windows SA omniscient.exe Windows Screensaver Service.exe WINDOWS SCREENSAVER ssaver.scr Windows secure setver32.exe Windows Secure Connection winsc.exe Windows Secure Messaging Systemmsnmsgrsrvc.exe WINDOWS SECURITY wingrd.exe Windows Security win.pif Windows Security ms32.pif Windows Security winscure.exe Windows Security Assistant rundll32.vbe Windows Security Assistant winsec.exe Windows Security Authority Servicelsass.exe Windows Security Manager winsecurity.exe Windows Security Manager winsecure.exe Windows Security Manager svchost.exe Windows Security Module module.exe Windows Security Service [random file name] Windows Security Service arrdt.exe Windows Security Update security32.exe Windows Serv Patch Mcaffe2005.exe Windows ServeAd WinServAd.exe Windows Server Information servinfo.exe Windows Servic2 winsy.exe Windows service wuamgrd.exe Windows Service dddd.exe Windows Service prvdi.exe Windows Service video.exe Windows Service svvhost.exe Windows Service private-zone.exe Windows Service pd7.exe Windows Service dstart4.exe Windows Service pd14.exe Windows Service video2.exe Windows Service services.exe Windows Service WINSVC.EXE Windows Service Controller services.exe Windows Service Host scvhost.exe Windows Service Host svchost.exe Windows Service Host svchost.exe Windows Service Host schost.exe Windows Service Host Process [path to file] Windows Service Hosting USERINIT.exe Windows Service Loader Window.exe Windows Service Manager userint32.exe Windows Service Manager localsvc.exe Windows Service Manager msgs.exe Windows Service Manager msnmrg.exe

Added by an unidentified WORM or TROJAN! Added by a variant of the FORBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the SPYBOT WORM! Added by the FORBOT-CJ WORM! Added by the MYTOB.ER WORM! Added by the RBOT-AEB WORM! Added by the RBOT-ADB WORM! Added by the RBOT.KE WORM! Added by the SPYBOT.JE WORM! Added by the RBOT-TP WORM! Added by a variant of the RBOT WORM! Added by a variant of the IRC.BOT TROJAN! Added by the AGOBOT-BZ WORM! Added by the SDBOT-ADL WORM! Added by the SMALL-BD TROJAN! Added by the ICPASS-A WORM! Added by a variant of the RBOT WORM! Added by a variant of the AIMVISION TROJAN! Added by a variant of the AIMVISION TROJAN! Added by the SDBOT.QW WORM! BLAZEFIND adware Added by the KELVIR.P WORM! Added by the SDBOT-YZ WORM! Added by the SPYBOT.EP WORM! Added by a variant of the RBOT WORM! Added by the RBOT-RE WORM! Added by a variant of the RBOT WORM! Added by the RBOT-APT WORM! Added by the RBOT-ARN WORM! Added by the RBOT-BAF WORM! CoolWebSearch Alfasearch parasite variant - also detected as the STARTPA-U TROJAN! CoolWebSearch parasite variant Added by the KALEL-A WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Added by the AGOBOT-KI WORM! Affilred.B adware Added by the ANTINNY.AX WORM!! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by a variant of the RBOT WORM! Added by the RBOT-ALV WORM! Added by a variant of the RBOT WORM! Affilred.B adware Added by a variant of the RBOT WORM! Windupdates adware variant Added by the FORBOT-EN WORM! Added by the RBOT-AIA WORM! Added by the RBOT-QW WORM! Identified by Kaspersky Labs as Dialer.Salc, also known to come with the Bube family trojans Malware, recognized by Kaspersky antivirus as Trojan-Dropper.Win32.Small.rd Added by an unidentified TROJAN! Added by the AGOBOT-HL WORM! Added by an unidentified TROJAN.CLICKER! Added by the SMALL.VZ TROJAN! Added by an unidentified TROJAN! Adware, detected by TDS-3 as "TrojanDownloader.Win32.Delf.dg" Added by the DOWNLOADER.SMALL.MY TROJAN! Added by the KALEL-A WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Added by the SDBOT.CL WORM! Added by the KALEL-B WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Added by the SDBOT.N TROJAN! Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the GAOBOT.AO WORM! Added by the EZIO-A WORM! Added by the GOMMER-A WORM! Added by the RBOT-XO WORM! Added by the OSCABOT-C WORM! Added by the DLOADER-NY TROJAN! Added by the OSCABOT-E WORM! Added by the OSCABOT-G WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Windows Service Manager netsvc.exe Windows Service Manager spoolsvc.exe Windows Service Manager svcadmin.exe Windows Service Manager svcman.exe Windows Service Manager svcmgr32.exe Windows Service Manager svcrun.exe Windows Service Manager tcpsvc.exe Windows Service Manager websvc.exe Windows Service Pack Auto Updatewinworks.exe Windows Service Pack Auto Updatefiggaz.exe Windows Service Pack Auto Updateballin.exe Windows Service Pack Auto Updatedel-me.exe Windows Service Pack2 svchhost.exe Windows Service Support Call SVSS32.EXE Windows Service Utitity winsrvc.exe Windows Service XP XpFirewall.exe Windows Services service.exe Windows Services svchosts.exe Windows Services Explorer.exe Windows Services NetworkDriver32.exe Windows Services scmsg.exe Windows Services scvhoste.exe Windows Services winsvc32.exe Windows Services NetworkDrivers.exe Windows Services smsc.exe Windows Services spoolsvc.exe Windows Services iexplore.exe Windows Services Host svchost.exe Windows Services Hosts svhosts.exe Windows Services Ink Platform Tablet wsiptis.exe Input Subsystem Windows Services Update svch0st.exe Windows Session Manager smss32.exe Windows Session Manager Subsystem smss.exe Windows shell win70.exe Windows Shell shell.exe Windows Shell taskgmr.exe Windows Shell Library Loader load shell.dll windows shellext.32 mschost.exe WINDOWS SKY sky.exe Windows Smart Manager smart.exe Windows Sound Driver SndMon32.exe Windows Sound Manager SndMon32.exe Windows Sound Manager SndMon16.exe Windows SP2 Firewall wfirewall7.exe Windows SP2 Update Sp2update.exe Windows SP2 Version Load wuauclt32.exe Windows SP4 directCC.exe Windows Spool Server spoolsrv.exe Windows SpoolaPrint Service spoolasrv.exe Windows Spooler SPOOLSRV.EXE Windows Spooler spoolsv32.exe Windows Spooler Services spool.exe Windows SpoolPrint Service spoolersrv.exe Windows Spools SV winsv.exe Windows spoolservr Service spoolservr.exe Windows Spoolsre Service spoolsre.exe Windows Spoolsrv Service spoolmsv.exe windows spoolsrv service spoolssv.exe Windows Spoolsurf Service spoolsurf.exe Windows SpooltPrint Service spooltsrv.exe Windows sq Drivers winmsn32.exe Windows Sql Service For Windows 32 winsql32.exe Bit Windows SSH Client winssh.exe Windows SSL File winssv.exe Windows SSL Secondary Drivers SSL32Dr.exe Windows Stand Sound Drivers Sounddrv.exe Windows Standard Securty [random 3-letter filename] Windows Start Server 2000 traficy.exe Windows Startup winsta~1.exe Windows Startup winstartup.exe

Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the OSCABOT-D WORM! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Adware downloader, identified by eScan antivirus as Trojan-Clicker.Agent.bt Added by a TROJAN.CLICKER - identified by Kaspersky antivirus as Trojan-Clicker.Agent.bt Added by an unidentified WORM or TROJAN! Adware, also detected as the LOWZONES.BH TROJAN! Added by a variant of the RBOT WORM! Added by the RBOT-XQ WORM! Added by the RBOT-ASI WORM! Added by the MYTOB.AM WORM! Added by the RANDEX.R WORM! Added by the AGOBOT-KL TROJAN! Added by the SDBOT-WT WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it Added by the RBOT-ACR WORM! Added by a variant of the SDBOT WORM! Added by SPYBOT.OBZ WORM! Added by the MYTOB-CB WORM! Added by the SDBOT-YO WORM! Added by a variant of the SDBOT WORM! Added by the SDBOT.CPZ WORM! Added by the RBOT-WE WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally figu Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the SDBOT-YH TROJAN! Added by the RBOT.APC WORM! Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase "o" Added by a variant of the RBOT WORM! Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! ?? Added by the MYTOB-CA WORM! Added by the MYTOB.BV WORM! CoolWebSearch parasite variant Added by the BLASTER.K WORM! Added by the MYTOB.CH WORM! Added by the RBOT-SL WORM! Added by a variant of the SPYBOT WORM! Added by the FORBOT-BU WORM! Added by a variant of the FORBOT WORM! Added by a variant of the RBOT WORM! Added by the WOOTBOT.BS WORM! Added by the GAOBOT.CX WORM! Added by the RBOT-ACX WORM! Added by the SDBOT-ACT WORM! Added by the SDBOT-AYD WORM! Added by the SPYBOT.P WORM! Added by an unidentified WORM or TROJAN! Added by the AGOBOT-AMO WORM! Added by the SDBOT-ZT WORM! Added by the RBOT-AUQ WORM! Added by the SDBOT-AAN WORM! Added by the SDBOT-AAE WORM! Added by the SDBOT-ZS WORM! Added by the SDBOT-AWV WORM! Added by the SDBOT-ZZ WORM! Added by the SDBOT-AYE WORM! Added by the RBOT-ADI WORM! Added by the FORBOT-FC WORM! Added by the RBOT-AXC WORM! Added by the WOOTBOT.CA WORM! Added by the SDBOT.ASQ WORM! Added by the SDBOT-XF WORM! Added by the RBOT-ALF WORM! Added by the RBOT-AHM WORM! GoHip foistware GoHip foistware

X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Windows Startup Windows Startup Windows Startup 32 Bits Windows Stortup Windows Streams Server WINDOWS SVC Windows Svshost Service Update Windows SyncroAd WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM Windows System WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM WINDOWS SYSTEM Windows System 32-Bat Service Windows System Backup WINDOWS SYSTEM By FEnR WINDOWS SYSTEM Cleaner WINDOWS SYSTEM CLEANER Windows System Configuration Windows System Configuration Windows System Configuration Windows System Configuration Windows System Configuration Windows System Configuration Windows System Configuration WINDOWS SYSTEM Dns WINDOWS SYSTEM DNSPOOL Windows System File Windows System Gateway Windows System Init Windows System Manager Windows System Manager Windows System Manager Windows System Manager WINDOWS SYSTEM MANAGER

Wdrun32.exe services21.exe sysrun32.exe svchost.exe localsrv.exe winsvc.exe 32 svcsshost32.exe SyncroAd.exe beta.exe dcomuser.exe lf66prc.exe msdev32.exe nec.exe nibie.exe ninfoie.exe skybot.exe skybotx.exe smoc.exe smsc.exe test.exe test2.exe test3.exe wdns33.exe win.exe.exe winaup.exe winligon.exe winmon.exe winNTsys32.exe winsvc32.exe WINSYS.exe winsys33.exe winvnc.exe winxpserv.exe xxx.exe skybot.exe botzor.exe gothica.exe msnl.exe per.exe twunk_65.exe servce.exe servises.exe xpupdate.exe expI0rer.exe msn32.exe sky.exe Win32IMAPSVR.exe winsvc.exe win32bat.exe SysBackup.exe windasz-updote.exe h3.exe iexplore.exe SYSCFG16.EXE Passcfg16.exe Winfrw.exe wincfg.exe WINCFG32.EXE WinNeth.exe nether.exe windsns.exe hbmail.exe cmxp.exe SPOOLER.EXE winit32.exe winsystem.exe sysconf.exe smsc.exe crssm.exe spoolsvc.exe

Added by the GAOBOT.AO WORM! Added by the AGOBOT-MX WORM! Added by a variant of the DARKSUN TROJAN! Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the SDBOT.LN WORM! Added by the MYTOB-EY WORM! Added by the FORBOT-GD WORM! Windupdates adware variant Added by the MYTOB.DF WORM! Added by the MYTOB.EO WORM! Added by the MYTOB.GC WORM! Added by the MYTOB.EH WORM! Added by the MYTOB-L WORM or variants! Added by the MYTOB-BY WORM! Added by the MYTOB-EP WORM! Added by the MYTOB-CX WORM! Added by the MYTOB-BY WORM! Added by the MYTOB.FU WORM! Added by the MYTOB-BR WORM! Added by the MYTOB.DJ WORM! Added by the MYTOB.DJ WORM! Added by the MYTOB.DV WORM! Added by the MYTOB-BY WORM! Added by the MYTOB.FA WORM! Added by the MYTOB-DN WORM! Added by the MYTOB.EP WORM! Added by the MYTOB.GB WORM! Added by the MYTOB-DM WORM! Added by the MYTOB.HH WORM! Added by the RBOT-AEF WORM! Added by the MYTOB.EK WORM! Added by the MYTOB.EU WORM! Added by the MYTOB-BQ WORM! Added by the MYTOB.CZ WORM! Added by the MYTOB.JU WORM! Added by the ZOTOB WORM! Added by the MYTOB.HU WORM! Added by the MYTOB.IK WORM! Added by the ZOTOB.C WORM! Added by the MYTOB-EG WORM! Added by the MYTOB-EI WORM! Added by the ZOTOB-I WORM! Added by the ZOTOB-G WORM! Added by the MYTOB-FI WORM! Note the upper case "i" and number "0" in the filename Added by the MYTOB-FX WORM! Added by the MYTOB.LB WORM! Added by the MYTOB-FQ or MYTOB-FU WORMS! Added by the MYTOB.LM WORM! Added by the MYTOB.FI WORM! Unidentified malware Added by the MYTOB.LR WORM! Added by the MYTOB.EQ WORM! Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure Added by the WISDOOR.Z TROJAN! Added by the DOMWIS-E TROJAN! Added by the BACKDOOR.SOLUFINA TROJAN or the DOMWIS-J WORM! Added by the AGOBOT.OP WORM! Added by the AGOBOT-TE WORM! Added by the RETHE-A WORM! Added by the Opanki-AB WORM! Added by the MYTOB.EY WORM! Added by the MYTOB.FW WORM! Added by the SPYBOT.KHO WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AN WORM! Added by the MYTOB.AL WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AFH WORM! Added by the MYTOB-LY WORM!

X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Windows System Manager Loader smsls.exe Windows System Manager Proc winsmc.exe WINDOWS SYSTEM mscdvvs mscdvvs.exe windows system notepad wnpsm.exe Windows System Restore Configuration Sblhost.exe Windows System Restorer SystemRestorer.exe WINDOWS SYSTEM SCALPE scalpe91.exe Windows System Security winmp.exe Windows System Security sys32.pif Windows System Security Monitor [4 random letters].exe Windows System Serivce winserv.exe windows system service winsock.exe Windows System Tray msni.exe Windows System Tray swhost.exe WINDOWS SYSTEM UPDATE xDcc.exe Windows System32 windowsp.exe Windows System32 winsys32.exe Windows System32 clsas32.exe Windows System32 explorer.exe WINDOWS SYSTEMn servicces.exe Windows Systemnmg stagmr.exe Windows Sz Host winshvc.exe Windows Task Manager ACCOUNT_DETAILS.DOC.exe Windows Task Manager taskmgn.exe Windows Task Manager taskmrg.exe Windows Task Manager taskgmr.exe Windows Task Manager taskmg.exe Windows Task Manager taskmngr.exe Windows Task Manager Emulator kennewr.exe Windows Task Service (32-bits) tasksys.exe Windows TaskAd Wintaskad.exe Windows Taskbar Manager internat.exe Windows Taskbar Manager [path to file] Windows Taskbar System tasksys.exe Windows Taskmanager lsassx.exe Windows TCP/IP wintcp.exe Windows Telnet Server wintel.exe Windows Time tmservice.exe Windows Time winmgr.exe Windows Time Server TimeSRV.exe Windows TM SVPHOST.exe Windows TM rundlI32.exe Windows TM windowssys32.exe Windows TM WinxSys.exe Windows Upate rundll.exe Windows Update [filename] Windows Update iexplorere.exe windows update uddater.exe Windows Update wudate.exe Windows Update wupdate.exe windows update sychost.exe Windows Update Wuamgrd.exe Windows Update inetinf.exe Windows Update host32.exe windows update wuraclt.exe windows update Wuanclt.exe Windows Update ebay.exe Windows Update windows.exe windows update wuaurlt.exe Windows Update Update.exe Windows Update winmguard.exe Windows Update wuampd.exe windows update wuarclt.exe Windows Update winupdate.exe Windows Update msnwinsb.exe Windows Update scvhost.exe windows update Microsoft.exe Windows Update mplupdate.exe windows update msnsever.exe Windows Update taskmr.exe

Added by the AGOBOT.TF WORM! Added by the RBOT.JH WORM! Added by the MYTOB.MD WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the SPYBOT WORM! Added by the DULOAD.C WORM! Added by the MYTOB_HI WORM! Added by the RBOT.IV WORM! Added by the RBOT-AOL WORM! Added by the PINKTON.A WORM! Added by a variant of the RBOT WORM! Added by the RBOT-MR WORM! Iambigbrother monitoring software Added by an unidentified VIRUS, WORM or TROJAN! Added by the MYOTB-EH WORM! Added by the MYTOB.GD WORM! Added by the SDBOT-AHS WORM! Added by the RBOT-AZO WORM! Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it m Added by the MYTOB-EL WORM! Added by the MYTOB.S WORM! Added by a variant of the SDBOT WORM! Added by the QUATERS.A WORM! Unidentified malware, either a variant of the WIN32.RBOT WORM, or part of a Casino Palazzo foistware install Added by the MYTOB.AV WORM! Added by the MYTOB.BJ WORM! Browser hijacker - identified by DrWeb antivirus as "Trojan.StartPage.601" Added by the RBOT-ANM WORM! Added by the SPYBOT-FA WORM! Added by the DREFIR.D WORM! Windupdates adware variant Added by the PROTORIDE-H WORM! Added by the PROTORIDE.B WORM! Added by a variant of the SDBOT WORM! Added by the KELVIR.E WORM! Added by the AGOBOT-ZH WORM! Added by the AGOBOT-MW WORM! Added by a variant of the RBOT-YK WORM! Added by the RBOT-XC WORM! Added by the SPYBOT.DNC WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the HAKO TROJAN! Note - this is NOT the Windows system file of the same name as described here Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites Added by the GAOBOT.AP WORM! Added by the LEOX TROJAN! Added by the AGOBOT.ML WORM! Wengs adware Added by the LEOX.B WORM! Added by a variant of the SPYBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the RBOT-GU WORM! Added by the RBOT-PO WORM! Added by the RBOT.XZ WORM! Added by the GAOBOT.BUU WORM! Added by the RBOT-RB WORM! Added by the RBOT.ADG WORM! Added by the DELF-FN TROJAN! Added by the RBOT-EM WORM! Added by the RBOT.UM WORM! Added by the RBOT-OF WORM! Added by the SDBOT-WS WORM! Added by the RBOT-AAH WORM! Added by the SDBOT-XT WORM! Added by the LMIR.A TROJAN! Added by the MOEGA WORM! Added by the RBOT-AHN WORM! Added by the MYTOB-GZ WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N

Windows Update update32.exe Windows Update wininfo.exe Windows Update winlogin.exe Windows Update msnupdates.exe Windows Update qtask.exe windows update real.exe Windows Update windowsx.exe Windows update wudupdate.exe Windows Update wupdmgr.exe Windows Update csrss.exe Windows Update msnsupdate.exe Windows Update XPLoogNT.exe Windows Update install.exe Windows Update msi.exe Windows Update Sqltob.exe Windows Update 32 winlogons.exe Windows Update 32 rempss.exe Windows Update 32 slsys.exe Windows Update 63 shupd64.exe Windows Update 64 nbupd64.exe Windows Update 64 WinV.exe Windows Update Auto Update wuaumgr.exe Windows Update AutoUpdate Clientwuauct.exe Product Windows Update Center svthx.exe Windows Update Center W32RSA.exe Windows Update Checker [random filename] Windows Update Checker msupdte32.exe Windows Update Client wuclient.exe Windows Update Client Service windrvl32.exe Windows update config svhost.exe windows update configurator svghost.exe Windows Update Controller mwoffice.exe Windows Update Files dnetc.exe Windows update loader xpupdate.exe Windows Update Manager wupdmngr.exe Windows Update Manager Winlog0n.exe Windows Update Manager wupdate.exe Windows Update Manager for NT wupdmgr32.exe Windows Update Monitoring Servicewinupdt.exe Windows Update Process wmiprvsc.exe Windows Update Service csrs.exe Windows Update Service smcg.exe Windows Update Service SP00ISS.exe Windows Update Service update32.pif Windows Update Service 2004/2005 systemupdate.exe Windows Update services wins32svcs.exe Windows Update Software system.exe Windows Update System Shell svhostcs32.exe Windows Update V6 [random filename] Windows Update.exe N/A Windows Updated spoolsae.exe Windows Updated updatr.exe Windows Updater wupdmgr32.exe Windows Updater iexplorerrs.exe Windows Updater svigost.exe Windows Updater wupdate.exe Windows Updater sdsys.exe Windows Updates lsassx.exe Windows Updates winupd32.exe Windows Updates w32dns.exe Windows Updating Service updating.pif Windows Updtee Mgnr W1NT45K.exe Windows USB 2.0 Driver usbtskmgr.exe Windows USB controler winusb.exe Windows USB Driver Support Windowsusb.exe Windows USB Service 666.exe Windows USBD msifirewall.exe Windows User Mode Driver Manager wdfmrg.exe Windows User Starter winuser32.exe Windows Version Check ver_chk.exe

Added by a variant of the RBOT WORM! Added by the MYTOB.GA WORM! Added by the BANKER-DV TROJAN! Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here Added by the LEGMIR-AU WORM! Added by the BANCD-A TROJAN! Adware downloader - Istbar related Added by the BANCBAN-FC TROJAN and variants! Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc Added by the RBOT-AXS WORM! Added by the BANCD-B TROJAN! Added by the BANKER-IB TROJAN! Added by the BANKER-XB TROJAN! Added by the DASHER.A WORM! Added by the FORBOT-FI WORM! Added by the FORBOT-FW WORM! Added by a variant of the FORBOT WORM! Added by the FORBOT-GA WORM! Added by a variant of the FORBOT WORM! Added by the FORBOT-FP WORM! Added by a variant of the SPYBOT WORM! Added by the AGOBOT.ACL WORM! Added by the STUBBOT.A WORM! Added by an unidentified WORM or TROJAN! Adware downloader trojan Added by the SDBOT-AEF WORM! Added by the SMALL-RN TROJAN! Added by the AGOBOT-MM TROJAN! Added by the SDBOT-PF WORM! Added by a variant of the SPYBOT WORM! Added by the BATTRY-A TROJAN! Added by an unidentified VIRUS, WORM or TROJAN! Note - wupdmgr.exe is the real Windows Update Added by the BRAVE-A TROJAN! Added by the RANDEX.BTB WORM! Added by the AGENT-BO TROJAN! Added by a variant of the RBOT WORM! Added by the SDBOT.AH WORM! Added by the RBOT-PL WORM! Added by the SDBOT-CB WORM! Added by the AGOBOT-NI WORM! Added by the SDBOT.QY WORM! Added by the SDBOT-ZH WORM! Added by the RBOT-ALC WORM! Added by the RBOT-JE WORM! Added by a variant of the RBOT WORM! Added by the TOFGER.BX TROJAN! Added by the RBOT-AAZ WORM! Added by the RBOT-KT WORM! Homepage hijacker, see here Added by the RBOT-APM WORM! Added by the RBOT-AYB WORM! Added by a variant of the DOS.AUTOCAT TROJAN! Added by the RBOT-TN WORM! Added by the RBOT-VS WORM! Added by the WOOTBOT.AJ WORM! Added by the FORBOT-JG WORM! Added by a variant of the SDBOT WORM! Added by the MYTOB.CE WORM! Added by the SDBOT-BFW WORM! Added by the RBOT-ALW WORM! Added by the MYTOB.DC WORM! Added by the RBOT-BKG WORM! Added by the RBOT-HR WORM! Added by a variant of the SPYBOT WORM! Added by the MYTOB.AR WORM! Added by an unidentified WORM or TROJAN! Added by SDBOT-ZN WORM! Added by the RBOT.SN WORM! Version checker for CyberAudioLibrary ("A new way to exchange information through the Internet")

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Windows video vide_32.exe Windows Video Acquisition (WVA) wvsvc.exe Windows Video Drivers videons32.exe Windows Virus Control plou.exe Windows Web Services localsvc.exe Windows Web Services netsvc.exe Windows Web Services spoolsvc.exe Windows Web Services svcadmin.exe Windows Web Services svcman.exe Windows Web Services svcrun.exe Windows Web Services tcpsvc.exe Windows Web Services websvc.exe Windows Workstation mpci.exe Windows Workstation msup32a.exe Windows Workstation Service (32-bits) wkssvc32.exe Windows Workstation Start Servicemslanmgr.exe Windows Xp nortonguard.exe Windows XP Automatic Update wXPupdate.exe Windows Xp Service Pack 2 svchost.exe Windows XP SP2 KeyGen Windows XP SP2 KeyGen.exe Windows-System System32.exe Windows-TCP-IP rfkampig.exe Windows-XP-Service-Pack xpspz.exe windows16 windows16.exe Windows32 rundll.exe windows32 windows32.exe Windows32 wuuaclt.exe Windows32 Configuration Loader msrf32.exe Windows32 Messenger Service msmsgv.exe Windows32 Net Database msnd32.exe Windows32 Serivces winser32.exe WindowsAgent WindowsAgent.exe WindowsAgent sysexhook.exe WindowsAPI.DLL Server5.exe WindowsAudio systemupd.exe WindowsBackup WINDOWSBACKUP.EXE WindowsCRC wscrc.exe WindowsCriticalUpdate windows_critical_update.exe WindowsDiskEvt svcsvh32.exe WindowsDiskLog cstsm.exe WINDOWSflashbrg sqldata1.exe WindowsFY wp.exe WindowsFY bsw.exe WindowsFY [path to trojan] WindowsFZ [path to file] WindowsFZ A5281300.so WindowsFZ zloader3.exe WindowsKeyUpdate master.exe WindowsMGM Winmgm32.exe WindowsProtocolLog lsadst.exe WindowsReg% update [random filename].exe WindowsRegistration [random filename] WindowsRegKey Autoupdate [random filename] WindowsRegKey upd4te2d4te *********.exe [* = random char] WindowsRegKey update [random filename] WindowsRegKey update winupdate.exe WindowsRegKey update windns.exe WindowsRegKey update 16winupdate32.exe WindowsRegKey update WinUpdate32.exe WindowsRegKey update winupdatexx.exe WindowsRegKey update [random filename] WindowsRegKey update svchoosts.exe WindowsRegKey update svchostc.exe WindowsRegKey update wdnupdate.exe WindowsRegKey update Windowsup.exe WindowsRegKey update WINUPDATES.EXE WindowsRegKey update XP windexv1.exe WindowsRegKey%$ update msi332.exe WindowsRegKey%update ethernet32m.exe WindowsRegKeys update winsysi.exe

Added by a variant of the AGOBOT/GAOBOT WORM! Added by the AGOBOT.YM WORM! Added by the GAOBOT.AZT WORM! Added by the SDBOT-ACZ WORM! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by the DLOADER-NY TROJAN! Added by a variant of the RBOT WORM! Added by a variant of the SDBOT WORM! Added by a variant of the SDBOT WORM! Added by a variant of the RBOT WORM! Added by the MYTOB-DZ WORM! Added by the RBOT-AFC WORM! Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Added by the TIBICK-C WORM! Added by the LOGPOLE.C WORM! Added by the GIPMA TROJAN! Added by the SDBOT-AAC WORM! Added by the XU TROJAN! Added by the AGOBOT-LK or AGOBOT-ND WORMS! Note - this is NOT the Windows system file of the same name as described here Added by the XU TROJAN! Added by the BRATLE.B WORM! Added by the SDBOT-ABX WORM! Added by the RBOT.ANS WORM! Added by the RBOT-AAL WORM! Added by the SPYBOT.AAF WORM! Added by the GOP.G WORM! Added by the GOP keyboard logger/TROJAN! Added by the "Fear and Hope" TROJAN! Added by the AGENT-TH WORM! Added by the STANG WORM! Added by the SDBOT-VU WORM! Added by the ASTEF or RESPAN WORMS! Added by the NANINF.D TROJAN! Added by the STINX-C or STINX-D TROJANS! Added by a variant of the AGENT-IC TROJAN! Part of a "Security IGuard" parasite infestation - also detected as DESKTOPHIJACK Added by a variant of the DESKTOPHIJACK TROJAN! For removal see here Added by the FAKEALE-E TROJAN! Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN! Variant of the SmitFraud alias FAKEALE-C TROJAN! Variant of the SmitFraud alias FAKEALE-C TROJAN! Added by the JOSAM WORM! Added by the SOBIG WORM and LALA.C TROJAN! Added by the NANINF.C TROJAN! Added by the RBOT-HH WORM! Added by the RBOT-NO WORM! Added by a variant of the RBOT WORM! Added by the RBOT.XQ WORM! Added by a variant of the RBOT WORM! Added by the RBOT-QJ WORM! Added by the RBOT.IE WORM! Added by a variant of the RBOT WORM! Added by the RBOT-AGW WORM! Added by the RBOT.LW WORM! Added by the RBOT.QT WORM! Added by the RBOT.ADB WORM! Added by the RBOT.IF WORM! Added by the SDBOT.QX WORM! Added by the SDBOT.PU WORM! Added by the RBOT-MM WORM! Added by the RBOT-ABM WORM! Added by the RBOT-IX WORM! Added by the RBOT-EN WORM! Added by the SDBOT.WE WORM!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U ? X X X U N N X X X X X X X X U U U U U X N N Y X X X X X U

WindowsRegKeys update WindowsSetup WindowsUpd WindowsUpd1 WindowsUpd2 WindowsUpdate WindowsUpdate windowsupdate WindowsUpdate windowsupdate WindowsUpdate WindowsUpdate WindowsUpdate WindowsUpdate WindowsUpdate Service Windowsupdate Service WindowsUpdateDirect WindowsUpdatem1 WindowsUpdateNT WindowsXP Module WindowsXP Update WindowsXPserv Windows_LowLevel_Security_Core Windows_Protect Windows_Protect Windows_Protect Windows_Protect Windows_Serivce Windows_Updates Windows_VXD Windowz Windowz Update V2.0 Windoxs Update Center WinDrg32 WinDriv32 WinDriver Configuration WINDRUN windrv WinDrv WinDSL MTU-Adjust WinDSL_MTU WinDSNX WindUpdates WindUpdates WINDVDpatch WinDVR SchSvr WinDVRCtrl Windws Configuration Loader WinEssential WinEssential WinEx WinExec WinExec WinExec WinExec32 WinFast Schedule Winfast2KLoadDefault Winfast_2K WinFast_Gamma WinFast_Taskbar WinFavorites WinFax PRO WinFax PRO Controller WinFaxAppPortStarter WinFire WinFixer 2005 WinFixer helper WinFixer2006 winfont WinFoxV2

windup.exe Added by a variant of the RBOT WORM! [path to trojan] Added by the EZBOT TROJAN! WindowsUpd4.exe VirtuMonde adware WindowsUpd1.exe VirtuMonde adware WindowsUpd2.exe VirtuMonde adware windows_update.exe Added by the LOFNI WORM! svchost.exe Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! RPCX1sQ3.exe Added by the IRCBOT.B TROJAN! USRINIT.EXE Added by the MADDIS.B WORM! winupdate.exe Added by the WARPI WORM! svchost.exe Added by the IK TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! winnnint.exe Added by an unidentified WORM or TROJAN! [path to file] Added by the DUPA-B TROJAN! dupadupam2.exe Added by the DUPA-B TROJAN! wuautlc.exe Added by the RBOT-NR WORM! csrss.exe Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ dupadirect.exe Added by the DUPA-C TROJAN! [path to file] Added by the AGENT-AAJ TROJAN! svwhost.exe Added by the SHELLOT-B TROJAN! DirectX3D.exe Malware, reportedly a keylogger - see here windowsxpupdate.exe Added by the RBOT-PB WORM! svcnxp32.exe Addee by the NANINF-A TROJAN! lsass.exe Added by the PADMIN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon winsystem.exe Added by a variant of the RBOT WORM! winregal.exe Added by a variant of the RBOT WORM! lsas.exe Added by the RBOT.ARO WORM! wincontrol32.exe Added by the RBOT-ADK WORM! SERVICE.exe Added by the WOOTBOT.AH WORM! svthost.exe Added by a variant of the SPYBOT WORM! user32.exe Added by the PWSTEAL.PPORT TROJAN! [original worm filename].vbs Added by the NUKIP WORM! Explorer.exe Added by the YODO WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it man W32RfSA.exe Added by a variant of the SDBOT WORM! windrg32.exe Added by the DRUDGEBOT.A WORM! WinDriv32.exe Added by the SMALL-BA TROJAN! windrvconf.exe Added by the AGOBOT-LX TROJAN! taskgmrs.exe Added by the MYTOB-BT WORM! windrv32.exe Added by an unidentified VIRUS, WORM or TROJAN! - possibly a strain of OBLIVION or BIONET windrvx.exe Added by a variant of the TIBSER.A downloader TROJAN! WinDSL_MTU.exe Adjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung WinDSL_MTU.exe May be realted to Tiscali broadband, if so is it required? Win????.exe Added by the DNSX TROJAN! [path to trojan] Added by the AGENT.BF TROJAN! WinUpdt.exe Windupdates adware variant CTHELPER.EXE CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, an SchSvr.exe WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs WinDVRCtrl.exe Control center software for an AOpen VA1000 TV tuner card LEXPLORE.exe Added by the SODABOT WORM! Keyhost.exe Hijacker - hailing from jraun.com keyword.exe Jraun.com hijacker lexplore_.exe Added by the MSNOPT-A TROJAN! Winexec.exe.vbs Added by the AINESEY.A WORM! WinExec.exe Added by the FALUS-A WORM! Lsass.exe Added by the CRUTLE-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfi WinExec32.exe Added by the KAZWIN WORM! Wfwiz.exe Leadtek WinFast TV tuner scheduler Rundll32.exe Wf2kcpl.dll, DllLoadDefaultSettings Loads default settings for Leadtek Winfast graphics cards WF2k.exe System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if y Rundll32.exe wfcpl.dll, DllLoadGammaRampSettings Loads if you change the gamma settings on Leadtek WinFast graphics cards rundll32.exe wftask.dll, WFDllLoadDefaultSettings Loads default settings for Leadtek WinFast graphics cards WinFavorites.exe1 Loudmarketing.com adware downloader FAXMNG32.EXE WinFax PRO from Symantec - fax management software WFXCTL32.EXE From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start wfxsnt40.exe WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application. WF.exe Added by the DELF-SY TROJAN! wfx5.exe WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here wfxcwr.exe WinAntiSpyware 2005 by Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here uwfx6.exe WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here winfont.exe Added by the DEATH TROJAN! WF2k.exe System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if y

X X U X X X X N Y U N X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X U X X X X X X U X X X X X X X X X X X X X X X X X X X X

WinFX WinGate WinGate Engine Monitor WinGate initialize wingerver2.0.exe wingo wingo WinGuage Pro Winguard WinGuard Pro WinHacker Winhelp WinHelp WinHelp Winhelp winhelp winhelp winhelp winhlp.exe winhlp3.exe Winhlp32 winhlp32.exe winhlpp32.exe Winhost Winhost Winhost Winhost winhost.exe winhost32.exe WinIeRun winimage WinINet wininet wininet32 wininetd wininit WinInit winint winipsec WinIRXHelper winis Wink*.exe Winkb6 WinKernel WinKernel WinLibUpdate32 WinLibUpdte Winlink Winlme WinLoad WinLoader winlocatorupdate winlog winlog winlog manager WINLOG0N WinLogin winlogin Winlogin.exe winlogin.exe winlogin.exe Winlogin.exe winlogoff winlogon winlogon winlogon winlogon winlogon winlogon WINLOGON

cssrs.exe Added by the AGOBOT.FX WORM! WinGate.exe Added by a variant of the LOVGATE WORM! wgengmon.exe WinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine, and appears in the system tray of each workstation on the network rea WinGate.exe Added by a variant of the LOVGATE WORM! wingerver2.0.exe Added by the GRAYBRD-AE TROJAN! wingo.exe Added by the BEAGLE.AW or BEAGLE.AV WORMS! [various filenames] Added by the BAGLE-AU WORM! WGPRO32.EXE Part of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". WGFE95.EXE Dr Solomon's Virex antivirus wgp.exe Winguard Pro rundll32.exe wh95.dll, HackMe Tweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free winhe1p.exe Added by the QQPASS.E TROJAN! WinHelp.exe Added by a variant of the LOVGATE WORM! Note - "winhelp.exe" resides in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP) whereas the valid "winhelp.ex realsched.exe Added by a variant of the LOVGATE WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name TkBellExe.exe... Added by a variant of the LOVGATE WORM! winhelp.exe Added by the BLACKMAL.C WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty dns32.exe Added by a variant of the RBOT WORM! Updadv.exe Added by the QQPASS-N TROJAN! winhlp.exe Added by the FORMGLIEDER TROJAN! winhlp3.exe Added by a variant of the EASTO.A TROJAN! Wscript.exe ..Msexec32.vbs Added by the GANT.B WORM! winhlp32.exe Added by a variant of the EASTO.A TROJAN! winhlpp32.exe Added by the GAOBOT.SY WORM! wintt.exe Added by the LOLAWEB.B TROJAN! win.exe Added by the DLOADER-AP TROJAN! yahoo.exe Added by the DELF-KM TROJAN! winhost.exe Added by the REATLE.F WORM! winhost.exe Added by the LOHAV-R TROJAN! winhost32.exe Added by the TABDIM TROJAN! winierun.exe Added by the RNWATCH-A WORM! wvsvc.exe Added by the RBOT.TX WORM! services.exe Added by the SOBER-P WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco wininet.exe Added by the STUBBOT-C WORM! wininet32.exe Added by the RAZNEW-A TROJAN! wininetd.exe Added by the WINET TROJAN! wininit.exe Added by the WOLLF.16 TROJAN! Win86.exe Added by the SMALL-PB TROJAN! winint.exe Added by the SDBOT-ADA WORM! winipsec.exe Unidentified malware WinIRXHelper.exe MSI(tm) Media Center Deluxe software - see here winis.exe Added by the RBOT-WI WORM! Wink*.exe [* = random char] Added by a variant of the KLEZ WORM! winkb6.exe Part of We-Blocker, works in tandem with syswb6. Both files are needed to run WeBlocker. Required if We-Blocker is installed WinKer.exe Added by the MIRAB or SERVIDOR TROJANS! [path to worm] Added by the BIONET.31 or BIONET.310 libupdate32.exe Added by the BIONET.405 TROJAN! libupdte.exe Added by the BIONET.318 TROJAN! winlink32.exe Added by the GAOBOT.AAY WORM! windll.exe Added by the GOP.F WORM! Winload.exe PCTattletale is a surveillance software program that monitors user activity, logs keystrokes, and takes screenshots. If you didn't install this yourself remove it [random filename] Added by variants of the SUBSEVEN TROJAN! updatewinlocator.exe Locator adult content toolbar related winlog.exe Unidentified adware. Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty winlog.exe Added by the GAOBOT_DF WORM! winlog.exe Added by the DONBOMB.A TROJAN! WINLOG0N.EXE Added by the MYDOOM.BI WORM! winlogin.exe Added by the AGOBOT-IX WORM! win32x.exe Browser hijacker, also detetected as the STARTPA-DF TROJAN! log.exe Added by a variant of the AGENT.AH downloader TROJAN! logfile.exe Added by the AGENT.AH TROJAN! mspaint.exe Added by a variant of the AGENT.AH TROJAN! steam.exe Added by a variant of the AGENT.AH TROJAN! winlogoff.exe Added by the AGOBOT-TR WORM! winlogon.exe Hijacker or adult content dialler! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the winlogin.exe Added by the RANDEX.E WORM! winlogon.exe Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the msreg32.exe Added by the SDBOT.EO WORM! winlogon32.exe Added by the MASLAN.C WORM! wpwlogon.exe Added by an unidentified WORM or TROJAN! wscript.exe [System or System32]WINLOGON.vbs Added by the YPSAN.F WORM!

X X X X X X X X X X X X X X ? U X U X X N X X X X Y X X N N N X X X ? ? ? X X X X X X X X X X X X X X X U X X U Y N X X X X X X X X X X X U

Winlogon Winlogon winlogon service Winlogon Shell Winlogon.exe winlogon.exe winlogon.exe winlogon32_ Winlogun WinLsass WinLsass winltmpv winltmpv Winmain WinManager winmatrix.exe WinMedia WinMem WinMenssage WinMessenger WinMgmt WINMGR Winmgr.exe WinMgr32 WinMine winmodem WinMoviePlugIn WinMsrv32 WinMX winmysqladmin WinMySQLadmin Tool winnet WinNetDDE WinNite Winnov Menu Winnov Remote Winnov Status winnt DNS ident winnt DNS ident winnt DNS ident winnt DNS ident winnt DNS ident winnt DNS ident winnt DNS ident Winnt DNS ident winNT updatc WinNtBB Winnup winocx32 WINOWS SYSTEM WINP Winpack WinPatrol winphonics7536 winpipe WinPLOSION WinPoet WinPopup winpopup Winprocer32 Update winprocessor Update WinProfile WinProfile winprofile WinProfile WinProt WinProt winprotect winprotect WinProxy

lsass.exe lsass.exe urx.exe Explorer.exe [path] svchost.exe N/A helper.exe msole32.exe [path to file] winlogin.exe servicec.exe [path to trojan] winln.exe wutop.exe winmain.exe schost.exe WinMatrixXP.exe [path to trojan] WinMem.exe winmax.exe syshost.exe WinMgmt.exe taskgmgr.exe scvhost.exe winmgr32.exe D4NG3.vbs wmexe.exe WinMoviePlugIn.exe WinMsrv32.exe WinMX.exe winmysqladmin.exe winmysqladmin.exe winnet.exe [random characters].exe niteaim.exe WnvMenu.Exe WnvRsvr.Exe WvStatus.Exe wuamgrd32.exe iexplorer.exe pidchk32.exe windowxp.exe Winupd32.exe winupdate32.exe wuamgrd33.exe windowsp.exe wupgrd.exe WinntBB.exe win32nls.exe winocx32.exe winnt.exe winmic.exe winpack.exe WinPatrol.exe vbsystem35.exe setups.exe vb.vb winpipe.exe WinPlosion.exe WinPPPoverEthernet.exe WINPOPUP.EXE winupie.exe winprocer32.exe winprocessor.exe Command.exe sndcfg16.exe iexpiore.exe iexpIore.exe Winprot.exe server.exe win32.exe winprotect.exe WinProxy.EXE

Added by the VB-EJ TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/S Added by the FLOPPY-B VIRUS! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig Added by the SPYBOT.EN WORM! Added by the KIPIS.M WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it ma CoolWebSearch parasite variant - resets home page to an adult content site Added by the FAKESPY-A TROJAN! Adware, also detected as the FAKESPY-B TROJAN! Added by the RULAND.A WORM! Added by the P2LOAD-C WORM! Added by the SCANE WORM! Added by the SCANE WORM! Added by the TCXMEDI-C TROJAN! Added by the TCXMEDI-C TROJAN! One of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EX ?? WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop Added by the ZEROBE-A TROJAN! WinMem Cleaner - part of Ultra WinCleaner Utility Suite. Makes more memory available for your programs and the Operating System. It also defragments your system Added by the BANCOS.B TROJAN! Added by the OPANKI-E WORM! Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here Added by the MYTOB.AN WORM! Added by the AGOBOT.AFG WORM! Added by the MIMAIL.P WORM! Added by the BISCUIT.A WORM! Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. Sfonditalia adult content premium rate dialer Added by the GAOBOT.AFJ WORM! WinMX file sharing application Starts the MySQL database admin tool Starts the MySQL database admin tool CommonName Toolbar spyware. To uninstall see here Added by the NETDEPIX.B TROJAN! Added by the OPANKI.B WORM! Winnov Video Capture Card related. What does it do and is it required? Winnov Video Capture Card related. What does it do and is it required? Winnov Video Capture Card related. What does it do and is it required? Added by the RBOT-BAU WORM! Added by a variant of the RBOT WORM! Added by the RBOT-ACY WORM! Added by a variant of the RBOT WORM! Added by the RBOT.AVU WORM! Added by a variant of the RBOT WORM! Added by a variant of the RBOT WORM! Added by the RBOT.BAL WORM! Added by a variant of the RBOT WORM! Added by the DULOAD.C WORM! Added by a variant of the SPYBOT WORM! Added by the PROTORIDE.I WORM! Added by the MYTOB.ID WORM! Added by the SPYBOT-EB WORM! Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Agent.gg WinPatrol - "Manage Startup programs, tasks, cookies; will sniff out Worms, Trojan horses, Cookies, Adware, Spyware, Klez, Assumption and other malicious programs" Added by a variant of the MUTIN-C TROJAN! Browser hijacker redirecting to wow-access.com WinPLOSION allows you to immediately view and select from all the windows running on your computer, just those of the active application, or to minimise all windows and display a clear desktop WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95, and maybe in WFWG 3.11. Normally it won't set itself Adware by Tradeexit.com Added by the RBOT.GW WORM! Added by the RBOT.IO WORM! Added by the BUDDY TROJAN! Added by the SNDC.A WORM! Added by a variant of the MONCHER WORM! Added by CHUM-C TROJAN! Added by the CHUPACABRA TROJAN! Added by the CHUPACABRA TROJAN! Added by the MUGLY.E WORM! Added by the SDBOT-SB WORM! WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP

X X X X X X X X X X X X U X X X N X X X X X X X X X X X X X X X X X X X X U U X X X X X X X ? X X X X X X X X X X X X X X X X X X X X X X X

Winproxy Personal winpsd WinPWD Manager winrapid winrar winrarshell winReg winregsrv winreg_32 winreg_32 winreg_32 winreg_32 WINREMOTE Winres32vis winrestore1 winreups winroute winrun winrun WINRUN WINRUN WINRUN WINRUN z WinRunners Wins Service Driver Wins Update 32 Wins32 Online WinScMngr WinSec winsecure WinSecure Winsecure Antivirus WinSecured32 Winserv winserver Winservice winservice WinService32 WinService32 WinServices winservit winservn winservs WinSetBrowse winsfc Winshell Winshoe winshost.exe WinShowUpdate WinSig winskype winsock Winsock driver Winsock driver winsock2 Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver Winsock2 driver

WINPROXY.EXE Added by the SDBOT.BMF WORM! winpsd.exe Added by the MYDOOM.Q WORM! wpwdmgr.exe Added by the RBOT-AUT WORM! winrapid.exe Added by a variant of the RBOT WORM! winrar.exe CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR! winrarshell32.exe Added by the SALIRA TROJAN! winReg.exe Added by the YAHA.H or YAHA.J WORMS! winregsrv.exe Added by the SYNRG TROJAN! svchosst.exe Added by the BANCOS-CE TROJAN! [path to trojan] Added by the BANKER-DB TROJAN! sysdll.exe Added by the DLOADER-IJ TROJAN! Vc030405.exe Added by the BANCOS-CT TROJAN! WinRemote.exe InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control [path to worm] Added by the THRAX.A WORM! winrestore.exe Added by the KILLFIL-Q TROJAN! winreups.exe Added by a variant of the RBOT WORM! winroute.exe Win-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process, also to log in to the console to view logs and change settings. Can be unchecked and the engine still runs and func msconfig.exe Added by the WINUR.A WORM! Note - this is not the real msconfig.exe as it's located in C:winrun winrun.exe Added by the WINBUR.B WORM! taskgmr32.exe Added by the MYTOB.AP WORM! svchost32.exe Added by the MYTOB-AI WORM! taskgmr.exe Added by the MYTOB-BX WORM! W1NT45K.exe Added by MYTOB.BL WORM! WinDrivers.exe Added by the DULOAD.C WORM! winet.exe Added by the RBOT-APV WORM! services32.exe Added by the FORBOT-FN WORM! cfgpwnz.exe Added by the BROPIA.R WORM! winsmc.exe Added by the SDBOT-BPZ WORM! winsec16.exe Added by the AGOBOT.ZF WORM! winsecure.exe Browser hijacker, redirecting to specificsearches.com [random].exe Added by the AGENT-LR TROJAN! Secureantivirus.exe Added by a variant of the SPYBOT WORM! ssmr.exe Added by a variant of the FORBOT WORM! Winserv.ila Added by the NODMIN WORM! Server.txt.vbs Added by the DELTAD.A WORM! winmain.exe Adult content related malware svchost.exe Added by the CVK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/ ssmgr.exe 007 Spy Software - "stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP" svchost.exe 007 Spy Software keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! WinServices.exe Added by the YAHA.K or YAHA.M WORMS! cassl.exe Added by the RBOT.ASG WORM! winservn.exe PurityScan/Clickspring adware winservs.exe PurityScan/Clickspring adware BasicUpdate.dll.vbs Added by the BISCUIT.A WORM! winsfc.exe Added by the WISFC/a> VIRUS! remote.exe Added by the MYTOB.LJ WORM! wuadfdqr.exe Probably an unidentified VIRUS! Adds itself to 3 registry "Run" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed winshost.exe Added by the TOOSO WORM and variants! copy C:WINDOWSwinshow.new C:WINDOWSwinshow.dll Winshow parasiate related - from the "RunOnce" keys it replaces "winshow.dll" with a new version NetXP.exe Added by the BANKER-FN TROJAN! winskype.exe Added by the BROGGER-C TROJAN! svch0st.exe Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase "o" winnt update.exe Added by the SPYBOT-DM TROJAN! winnt64.exe Added by the SPYBOT-DR WORM! netsvr.exe Added by the AGOBOT.LY WORM! SDJOIJE.EXE Added by the SPYBOT.DR TROJAN! MIRC32.exe Added by the SPYBUZZ TROJAN! kgzgjkpcw.exe Added by the SDBOT.T TROJAN! ZONEALARM.EXE Added by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program WINCFG.SCR Added by a variant of the SPYBOT WORM! winupdate.exe Added by the SPYBOT-BX WORM! SPOLSV.EXE Added by the SPYBOT-CM WORM! Zonealarmupdate.exe Added by a variant of the SPYBOT WORM! sysreq.exe Added by the SPYBOT-CC WORM! AMSNMGR.EXE Added by a variant of the SPYBOT WORM! WUAUMQR.EXE Added by the SPYBOT-DP WORM! wincfg.exe Added by the SPYBOT.CO WORM! ntsys32.exe Added by the SPYBOT-DD WORM! svchorsst.exe Added by the SPYBOT-EE WORM! SYSTEM32.EXE Added by the SPYBOT-EG WORM!

X X X X X X X X X X X X X X X X X X U X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X U X X X X U X X X X X X U X X X X X X X X

Winsock2.dll Winsock32 driver Winsock32 driver Winsock32 driver Winsock32driver Winsock32driver Winsock32driver Winsock32driver Winsock32driver Winsock32driver Winsock32driver Winsock32driver winsockdriver winsockdriver winsockdriver winsockdriver winsockdriver WinSocketComponent WINSOS VERIFY winspd32dll WinSPF WinSPF Winspl Winspool WinSrv WinSrv Winsrv winsrv winsrv3 WinsSystem WinStabilizer WinStart WinStart WinStart WinStart winstart WinStart001 WinStart001.EXE winstats Winsta~1 WinSth16 winstro winsupdatesysmngr64 WinSvc16.exe Winsvc32 winsvc32.exe Winsvr manager winsy32.exe winsync Winsys WINSYS winsys WinSys32 winsys32 Driver WinSysAppMon winsysban winsyslog lptt01 WinSysStartUpWKbLw WinSyst32 WinSystem Winsystem WinSystem winsysupd WINT WINT WINT WinTask WINTASK WINTASK WINTASK

WINLODR.SCR Added by an unidentified VIRUS, WORM or TROJAN! Testing.exe Added by the SPYBOT.B WORM! lcd.exe Added by the SPYBOT.B WORM! Sdjoije.exe Added by the SPYBOT.B WORM! win32server.scr Added by the HACARMY TROJAN! sp2XPupdate.exe Added by the HACKARMY.S TROJAN! win32server.exe Added by the BACKDOOR-AZV TROJAN! ZoneAlarmPr0.exe Added by the HACKARMY-B TROJAN! ZoneLockup.exe Added by the HACARMY.D TROJAN! win32server.exe Added by the HACARMY.F TROJAN! winXPupdate.exe Added by the HACKARMY.9728 TROJAN! svchhost.exe Added by the HACKARMY.I TROJAN! tskmg.exe Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM! winsock2.2.exe Added by a variant of the SPYBOT WORM! iexplor.exe Added by the BLATIC.A WORM! winsock3.exe Added by the SPYBOT-DO WORM! bot.exe Added by the WARPIGS-D TROJAN! nthost.exe Added by an unidentified VIRUS, WORM or TROJAN! WINSOS.EXE WinSOS - "deletes spyware, optimizes your computer - backs up selected data" winspd32.exe Added by a variant of the AGOBOT/GAOBOT WORM! windrv32.exe Added by the MYDOOM.T WORM! winspf32.exe Added by the MYDOOM.S WORM! winsplx.exe Added by a variant of the TROLL-A TROJAN! spoolsvr.exe Added by a variant of the SDBOT WORM! kn0x.exe Added by the HOBBIT.F WORM! SHIZZLE.EXE Added by the HOBBIT.C WORM! winsrv.exe Added by the OPASERV.T WORM! winsrv.exe Added by the NETSNAK-B TROJAN! services.exe Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms syssmss.exe Added by the DELF.IG TROJAN! WinStabilizer.exe Added by the AGOBOT-SW WORM! WinStart.exe From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistw Wscript.exe WinStart.vbs Added by the CIAN.C WORM! winstart32.exe Added by the PUROL WORM! WinStart.pif Added by the CONE.E WORM! winstart.exe Added by the SCKEYLO-AB TROJAN! WinStart001.exe From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistw WinStart001.exe From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistw winstats.exe Added by the GARGAFX TROJAN! winsta~1.exe GoHip foistware WinSth16.exe Added by the CAKE WORM! RUN32DLL.exe Added by the FTP_ANA TROJAN! winsys64mnger.exe Added by the RBOT-BAG WORM! WinSvc16.exe Added by the SDBOT.FQ TROJAN! Winsvc32.exe Homepage hijacker winsvc32.exe Added by the GREPAGE TROJAN! DDEsvr.exe Added by the TIRBOT-C WORM! winsy32.exe CoolWebSearch parasite variant ******.exe reg_run [* = random char] Added by a variant of the QOOLOGIC TROJAN! Winsys.exe Win-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it [path to trojan] Added by the GOLDPLAY TROJAN! syschost.exe Added by an unidentified TROJAN! Winsys32.exe Added by the CIGIVIP TROJAN or RECKUS WORM! winsys32.exe Added by the LOONY-O TROJAN! WinSysRM.exe Home & Family Content Filter related. See here [path to trojan] Added by the CLICKER-CD TROJAN! winsyslog.exe RapidBlaster variant (in a "Winsyslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here TaskSystemDll.Exe Added by the BACKZAT.G WORM! winsyst32.exe Added by the MORB WORM! winsystem.exe Added by the WHITEBAIT WORM! winsystem.exe Added by the BANCOS.CR TROJAN! WinSystems.exe CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! [path to trojan] Added by the STARTPA-NI TROJAN! wcp****.exe [* = random char] PurityScan/Clickspring adware wcpcc.exe PurityScan/Clickspring adware wcpsvit.exe PurityScan/Clickspring adware Wintask.exe Added by the HIPO or LEMIR.F TROJANS! taskgmr.exe Added by the MYTOB.I WORM and variants! taskgamr.exe Added by the MYTOB.AU WORM! sys32.exe Added by the MYTOB.K WORM!

X X X X X X X X X X X X X X X X X X X U X X X U X N N X U N X X X X X X N X X X X X X X X X X X X X X X X X X X X X X U X X X X X X X X X X

WINTASK WINTASK WINTASK WINTASK WINTASK WINTASK WINTASK WINTASK WINTASK DLL WINTASK DLL32 WinTask driver WINTASK32 WINTASK32 wintask32 WINTASKMANAGER WINTASKMGR WINTASKS WINTASKS WinTasks DLL Library (32-bits) WinTasks Traybar wintasks.exe Wintbp.exe Wintbpx.exe wintective winter Wintercooler Pro WinTidy Wintime WinTime Wintime Wtxpload WinTimer wintnask32.exe wintnl wintnl.exe wintnpx.exe WinTools WinTOTAL Scheduler WinTray wintsk32dll winudll.exe winui winupated.exe winupd winupd winupd.exe WinUPD32 winupdat WinUpdate WinUpdate WinUpdate winupdate WinUpdate Loader winupdate.exe winupdate.reg winupdate2846 WinUpdateB winupdateconn winupdateconn_ winupdatefiv_ WinUpdateProtection winupdates winupdate_ WinUpdsv winupdt winupdtl WinUpgrader winur winusb.dll WinUser32K WinUsr

msmgrxp.exe Added by the MYTOB.AQ WORM! iexplorer.exe Added by the MYTOB-CH WORM! taskgmr32.exe Added by the MYTOB.BU WORM! msvhost.exe Added by the MYTOB-AR WORM! t4skmgr.exe Added by the MYTOB-AK WORM! taskfile.exe Added by the MYTOB.EF WORM! taskgm.exe Added by the MYTOB-AO WORM! taskgmrs.exe Added by the MYTOB.DH WORM! jusched32.exe Added by the MYTOB.AI WORM! smsrss.exe Added by the MYTOB.BS WORM! wintask.exe Added by the DLOADER-NA TROJAN! taskgmr32.exe Added by the MYTOB.BN WORM! taskgmrr.exe Added by the MYTOB.FX WORM! Jwintask.com Added by the NAFBOT-A WORM! taskgmr.exe Added by the MYTOB-AF WORM! ccsrs.exe Added by the MYTOB.Q WORM! taskgmr.exe Added by the MYTOB.BO WORM! winxpro.exe Added by the MYTOB.EZ WORM! winkll.exe Added by the RBOT-AJZ WORM! wintasks.exe WinTasks - "Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task, but wintasks.exe Added by the EVAMAN WORM! wintbp.exe Added by the ZOTOB.E WORM! wintbpx.exe Added by the ZOTOB.F WORM! wintective.exe Wintective logs keystrokes, captures screenshots, and monitors Internet activity. The gathered information can be sent to a predetermined email address. If you didn't install this yourself remove it happy.exe Added by the SDBOT-YF WORM! WINCOOL.EXE Wintercooler Pro - utility that monitors CPU usage, RAM consumption and Internet connection speed WinTidy.exe Desktop icon manager from PC Magazine (Ziff-Davis) for Win95. Available via Start -> Programs Wintime.exe Added by the HARNIG TROJAN! wintime.exe Added by WinTime - change desktop icons' color and font Wxpload.exe Wintime Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet, if it's not already running. It then star msupdate.cmd Hijacker, detected by Kaspersky antivirus as Trojan.Win32.StartPage.tj wintnask32.exe Added by the RBOT-AFP WORM! wintnl.exe Added by a variant of the ZOTOB.K WORM! wintnl.exe Added by the ZOTOB.K WORM! wintnpx.exe Added by the ZOTOB.H WORM! WToolsA.exe Wintools adware guru.exe WinTOTAL Real estate appraisal software related wintray.exe Added by the LEGUARDIEN.B TROJAN! wintsk32dll.exe Added by the RBOT-AAJ WORM! winudll.exe Added by the MITGLIE-CE TROJAN! z.exe Added by the KONDELI TROJAN! winupated.exe Added by a variant of the SDBOT WORM! RUNDLL32.EXE [random value].dll, Added _mainRD by the MOTA.A WORM! winupd.exe Added by SearchNew ADWARE! winupd.exe Added by the BEAGLE.M or BEAGLE.N WORMS! explorer.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! winupdat.exe Added by the CANBOT.A WORM! RBSKQQBO.EXE Added by the VBSWG2B.A WORM! wmbem.exe Added by the REVCUSS.B TROJAN! updsys.exe Added by a variant of the RBOT WORM! winupdate.exe Added by the ALCAN.B WORM! msnnm.exe Added by the REVCUSS.C TROJAN! winupdate.exe Added by the RADO TROJAN! winupdate.exe Added by the SPYBOT.EAS WORM! vbsystem35.exe msvbrun.exe Added by a variant of the MUTIN-C TROJAN! breatle.exe Added by the BRATLE.AWORM! [path to file] Added by the COMBRA-A WORM! Explorer.EXE Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it [path to file] Added by the COMBRA.C WORM! csrss.exe EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer winupdates.exe Added by the ALCRA-B WORM! [path to file] Added by the CONDOR.A WORM! winupdsv.exe Added by the DROPO MACRO! RUNDLL32.EXE [random.dll] Added by the MABUT.A WORM! winupdtl.exe SecondThought adware variant [path to trojan] Added by the AGENT-DZ TROJAN! winrun.exe Added by the WINBUR.B WORM! winguard.exe Added by the FORBOT-CN WORM! usr32wink.exe Added by the HK TROJAN! WinUsr.exe K1S2 Added by the CLUNK.A WORM!

X X U X X X X X X X X X X X X X X X U X X X X N X X X X X X X X X X U X U U X X N N N N N X N X X N U Y N Y N N N Y X X X N X X U X X X X Y

Winux Piriax Service PH32.EXE Added by the RANDEX.G WORM! winversion winversion.exe Browser hijacker, redirecting to specificsearches.com WinVNC WinVNC.exe WinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet WinVNC iexplorer.exe Added by the EVIVINC VIRUS! winvxd32 winvxd32.exe Added by the GABLOLIZ.A WORM! winwan lptt01 winwan.exe RapidBlaster variant (in a "Winwan" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here winwan ml097e winwan.exe RapidBlaster variant (in a "Winwan" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here winword winword.exe Added by the TORPID-C TROJAN! WINWORD.exe WINWORD.exe Added by the DRIVUS TROJAN! Note - this is not the legitimate MS Word process of the same name, which is always located in the Program Files folder. This one is found in System (9x/Me) or System32 winwsl.exe winwsl.exe Added by the ZOTOB-J WORM! winXP 33.exe Added by the ANPES WORM! WinXP plugin1.exe Added by the Downloader-JW TROJAN! WinXP csrss.exe Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc WinXP fix [path to file] Added by the RANKY.P TROJAN! WinXp Updater winxp32.exe Added by the RBOT-HG WORM! WinXP-98 CSRSS.exe Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco winxpdll32.exe winxpdll32.exe Added by a variant of the SMALL downloader TROJAN! WinXPHome plugin2.exe Added by the malicious INOR.T script! WinXPLoad Rundll32 LoadDll, LoadExe WinXPLoad.exe Compaq hotkey related - required if you use the hotkeys winxpusbd winxp64.exe Added by a variant of the RBOT WORM! WinZap Check winzbp.exe Added by the RBOT-AWZ WORM! winzip [path to trojan] Added by the BANCOS.G or BANCOS.K TROJANS! Note - this is not part of the popular WinZip file compression utility Winzip [various filenames] Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif o WinZip Quick Pick WZQKPICK.EXE Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reop WinZip Update WinZip.exe Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility Win_api_driver system.exe Added by the REVIRD TROJAN! Win_BooT [path to file] Added by the BANKER-GI TROJAN! Win_Library INISvc.exe Added by the ANARCH WORM! win_spool2 win_spool2.exe Added by the SCKEYLOG.B TROJAN! win_supp00.exe Win Const.exe Added by the ASSASIN-H TROJAN! win_upd.exe WINdirect.exe Added by the MITGLIEDER.M TROJAN! win_upd2.exe WINdirect.exe Added by the BEAGLE.AO WORM! Win_vader Win_vader.vbs Added by the INVASION.A VIRUS! WIP Config GUI Winipcfgs.exe Added by the RBOT-CN WORM! Wireless PCI Card Configuration Utility WMP11Cfg.exe Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Wireless Provider Server wpsvr.exe Added by the FORBOT-AD WORM! Wireless Switching Setting Utility Switcher.exe On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN, Bluetooth, both) when turning the wireless switch on if disabled) Wireless-G Notebook Adapter UtilityWPC54CFG.EXE Utility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G) wise clockwise.exe Added by the LAZAR-A TROJAN! WIZZ dazzler.exe Reported by Kaspersky Anti-Virus as DIALER.IS TROJAN! wjview wjview.exe MS tool used to view window-based Java applications from the command line wkcalrem wkcalrem.exe Produces a pop-up reminder of events scheduled using the MS Works Calendar WkDetect WkDetect.exe Checks for updates to MS Works wkfud wkfud.exe A marketing program for MS Works WksSb WksSb.exe The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put in WksSVC EXPLORER.exe Added by the MYTOB-BW WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it WkUFind WkUFind.exe MS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries Wlan Drier Winusb2.exe Added by the WOOTBOT.DC WORM! Wlan Driver avscan.exe Added by the WOOTBOT.DH WORM! WLAN Status Tray Applet WLANSTA.EXE System Tray icon for checking the status of a Wireless LAN wlancfg wlancfg.exe Inventel wireless router related - required in order to automatically connect to the Net at bootup wlancfg5 wlancfg5.exe NetGear WG311v3 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which WLANSTA.EXE WLANSTA.EXE System Tray icon for checking the status of a Wireless LAN WLAN_Cfg.exe WLAN_Cfg.exe Linksys Instant Wireless USB Network Adapter driver WLTRAY wltray.exe Installed alongside Dell Wireless WLAN Card and provides additional configuration options for these devices wltray wltray.exe System tray access to wireless LAN card configuration options WM VCR WMVCR.exe WM_Recorder allows you to record Windows Media(tm) streaming Video or Audio content. Can be accessed via Start Menu -> Programs Wm24Pan Wm24Pan.Exe ESI external sound card driver wm41a398 rundll32.exe [path] wm41a398.dll, LZIO.com EnableRunDLL32 adware downloader WMAudio services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! WMAudio winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! WMBoot N/A Associated with Logitech Wingman game controllers. Not required but what does it do? wmcbaaca rundll32.exe [path] wmcbaaca.dll, EnableRunDLL32 LZIO.com adware downloader WMI Application Interface wmiapi.exe Added by the SPYBOT.RBY WORM! WMIEXE.exe wmiexe.exe NT component, used by Windows Millennium to detect Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these Wminf Wminf.exe Added by the GEMA TROJAN! Wminfo Wminfo.exe Added by the GEMA TROJAN! wmiprv wmiprv.exe Added by the RBOT-WM WORM! wmon jusched.exe Added by the AGOBOT-OW WORM! WMP54Gv4 WMP54Gv4.exe Linksys WMP54Gv4 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which

X X X ? X X X X X X X X X X X X U N X N N X Y N ? X X U N N U X X X U X X X X N N N N Y X X X X ? ? N X ? ? U ? U X X X X X X X X X X X ? U

wmplayer.exe wmsys32 wmv WM_LOGIN WN Services WNAD wnddrv WNILOGON WNSC Wnsck2 driver WNSI WNST wntlgns wnxpupdate wnxupdate won update WonderFrog WooCnxMon Woods Inc WOOTASKBARICON Woowatch word pair WordQ carat flag WordWeb Workflo Working System Analyzer worknote1 WorkPace 3.0 Works Calendar Reminder WorksFUD Workstation Scheduler Workstation Services Workstation Ver 5.0 WorldAntiSpy Worm Detector wormexe wovax wow wow Wpctrl Wpctrl wpctrl95 wpctrl95 WPCycle.exe wpds.exe wpds.exe wpwmgrs WQK wr WR Command WrCtrl WRDialer WRECK GUARD WregBios wrexec wriste Write DVD-R! ws2 32 ws2help WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration WSAConfiguration1 wsbklite WScheduler

wmplayer.exe wmsys32.exe winmonv.exe MSGLOGIN.EXE wnsvc.exe WNAD.EXE svchost.exe WNILOGON.exe wns*****.exe [* = random char] wlogf.exe wnscp**.exe [* = random char] wns*****.exe [* = random char] wntlgns.exe spvspool.exe updatexp.exe WAPDATE.EXE WonderFrog.exe CnxMon.exe wcmd.exe TaskbarIcon.exe Watch.exe bopotsvr.exe WordQcrs.exe wweb32.exe workflow.exe syswork.exe [filename] workpace.exe wkcalrem.exe wkfud.exe wm95.exe wrkstn.exe vmware.exe worldantispy.exe wd.exe winstart.exe wovax.exe bar.exe wwf.exe wpctrlnt.exe wpctrl95.exe wpctrlnt.exe wpctrl95.exe WpCycleWin.exe doriot.exe wwnrot.exe wpwmgrs.exe WQK.exe WR.EXE wr.exe WrCtrl.exe WrDialer.exe ?? wregbios.exe wrexec.exe wriste.exe saimon.exe svchst.exe ws2help.exe wmon32.exe svchostt.exe rpcxmn32.exe win32upd.exe drrss.exe winlogon32.exe ntguard32.exe csrsvcs.exe csass.exe wsbklite.exe WScheduler.exe

Added by the BANCBAN-CZ TROJAN! Added by the BANPAES.B TROJAN! Added by the AGENT-DG TROJAN! Part of McAfee Firewall. What is it for and is it needed? Added by the KBBOT-A TROJAN! Spyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system, and it will man Added by an unidentified TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms Added by the LEWOR-M TROJAN! PurityScan/Clickspring adware Added by the SPYBOT-AF WORM! PurityScan/Clickspring adware PurityScan/Clickspring adware CoolWebSearch parasite variant Added by the DABORA.B WORM! Added by the COMBRA-G WORM! Added by the RBOT.N WORM! Wonder Frog typing monitor Wanadoo ISP software related - not required - here's how to bypass it Added by the KILLFIL-O TROJAN! Wanadoo ISP taskbar icon - not required Wanadoo ISP software, not required Added by the SHED-A TROJAN! Related to WordQ Writing Aid Software WordWeb - free theasaurus and dictionary. Start manually Related to BroadJump Client Foundation - broadband troubleshooting software installed by various companies. Is it required? Added by the FORBOT-FZ WORM! Added by the MEETOT WORM! WorkPace - stress injury prevention software Produces a pop-up reminder of events scheduled using the MS Works Calendar A marketing program for MS Works Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled, it is required, otherwise, it is useless and a memory hog Added by the RBOT-OJ WORM! Added by the RBOT-AHB WORM! WorldAntiSpy, "rogue" spyware remover, installed as part of this scam Worm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam Added by the EARLYBIRD WORM! Added by the DAQA.A TROJAN! PurityScan/Clickspring adware Added by the LINEAGE-Y TROJAN! WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Added when selecting Mplayer2 to open media files. Forces other codes to Wait for Previous instructions to end, preventing instability of your CPU (freezing) Added by the SMALL-KY TROJAN! Added by the BAGLEDI-D TROJAN! Added by the MYTOB-DH WORM! Added by a variant of the KLEZ WORM! ?? ?? Win-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not wo WinPoet DSL dialler ?? Desktop Management BIOS (DMI BIOS) related. Apparently invokes the DosBios.exe file. Is it required? Watch Right - monitoring program, part of the PowerTools add-on for AOL. Records instant messages, E-mail, chat. Watch Right appears to be, and functions as an online clock updater which connects w ?? Saimon's WriteDVD! "gives total support for DVD-RAM drives. It provides many functions such as setting partitions on DVD-RAM disks and FixDVD! can diagnose and repair UDF formatted disks" Added by the VOKEN-A TROJAN! Added by a variant of the SMALL.AN TROJAN! Added by the GAOBOT.BAJ WORM! Added by the AGOBOT.ZT WORM! Added by the AGOBOT.ABG WORM! Added by a variant of the RBOT WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the AGOBOT-WC WORM! Added by a variant of the AGOBOT/GAOBOT WORM! Added by the AGOBOT.VI WORM! Added by the AGOBOT.WH WORM! Related to the Acer Soft Button on Acer Tablet PCs. Appears to do nothing so is it required? Windows Scheduler - "schedule unattended running of applications, batch files, scripts and much more. Also, you can schedule popup reminders so you'll never forget reminders, tasks and other events

X X X X U U U X X X U X Y U Y U X N N N N X U X X X X Y X X X X X X X X X X X Y Y X ? X X X X X X N X X U U U N U X U X N ? U X X U X U N X

wscript.exe wscsvc.exe Wsdata service wserver WService wsg32 wskrnl wsock32 wsrv32 WSSAConfiguration wssys Wstat32 driver wstimeb WSVCS wswpd wsys.exe ws_d WT Game Channel WT Game Channel WT GameChannel WT GameChannel WTF Test WTIndicator WTSI WTSS WTST wuanguard WUOLService wuosdial WUPD wupd wupd wupdate wupdate Wupdate driver WUpdates Wupdm32 wupdmgr32.exe wupdt WUSB11B.exe WUSB54Gv4 wuviewer WUx_RegSvr wvsvc WWKS www.hidro.4t.com www.symantec.com WXcmeinst Wxp4 WXProcMgr Module wzhelper wzservice X Server X-Cleaner Deluxe X-Cleaner Freeware X-Grabber X10 Device Network Service X10Weax x3watch x3yy Xanadu xBrotherMeCom xbtl Xcpy1 xdxqa XE 8x LM Status Xecuter.bat XemiCo Xfire xflash

vabian.vbs wscsvc.exe WSconf.exe wserver.exe WService.exe wsg32.exe wskrnl.exe svchost.exe wsrv32.exe wmmon32.exe wssys.exe Wstat32.exe wstimeb.exe SERVICES.EXE wswpd.exe wsys.exe ws32.exe GameChannel.exe wtgamechannel.exe GameChannel.exe wtgamechannel.exe wtftest.exe SchedInd.exe wapisvit.exe wap***.exe [* = random char] wapisvtr.exe wuanguard32.exe WUOLService9x.exe wuosdial.exe iglmtray.exe symcsvc.exe win32.exe wisvccz.exe wi32.exe [various filenames] WUpdates.exe Wupdm32.exe wupdmgr32.exe wupdt.exe WUSB11B.exe WUSB54Gv4.exe wuviewer.exe RegSvr32.exe wvsvc.exe wsass.exe enbiei.exe oz11111.exe [path to file] Norton Update.exe WXprocMgr.exe wzhelper.exe hess.exe X.exe xcleaner.exe XCLEAN~1.EXE sswizard.exe x10nets.exe WTHRTRAY.EXE x3watch.exe [path to trojan] Xanadu.exe BrMeCom.exe bootldr.exe Xcpy1.exe dewa.exe lmsxxe.exe psexec.bat ADC.EXE Xfire.exe xflash.exe

Added by the VABI VIRUS! Added by a password stealing BANKER TROJAN! Added by the SDBOT.ZU WORM! Added by the NETSKY.AC or SASSER.G WORMS! Tablet client Driver for UC-Logic Pen/Graphics Tablet GoldenKeylog keystroke logger/monitoring program - remove unless you installed it yourself! Added by the ActMon surveillance software. Uninstall this software unless you put it there yourself Added by the HORST-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon Added by a CLICKER TROJAN! Identified by Kaspersky antivirus as Win32.Agent.ep Added by the AGOBOT-KC WORM! WebPI logs keystrokes and captures screenshots. If you didn't install this yourself remove it Added by the LOONBOT TROJAN! Used with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it WSLogger keystroke logger/monitoring program - remove unless you installed it yourself! Used with some models of Panasonic, Epson and NEC printers. Some older drivers known to have a "memory leak". Needed for printing to work SpyloPCMonitor is a surviellance software program that monitors user activity, logs keystrokes, and takes screenshots. It ends the processes of anti-spyware programs. If you didn't install this yourself r Added by the LEGMIR-RL TROJAN! WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share in WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share in WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share in WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share in Added by the RBOT-ACM WORM! WinTask - software that automates a variety of routine tasks quickly and simply PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware Added by the RBOT-AAF WORM! Remote wakeup status agent. Part of Novell's ZenWorks. Processes Wake-up on LAN requests (turn on a computer remotely on LAN) Added by a variant of the RBOT WORM! Added by the TZET WORM! CoolWebSearch parasite variant Added by the ORSE-C TROJAN! Added by the ORSE-B TROJAN! Downloader trojan, detected by Panda antivirus as Adware/Trustbid Added by a variant of the SPYBOT WORM! Added by the SWEPDATM TROJAN! Added by the MIDLAK WORM! Added by the CERTIF-I TROJAN! Added by the IMISERV.A TROJAN! Linksys WUSB11 WLAN USB adapter Wireless-G USB Wireless Network Adapter related - would appear to be required Added by a Proxy Trojan variant x is any number?? Added by the AGOBOT.YM WORM! Added by the SDBOT-BT WORM! Added by the BLASTER.F WORM! Added by the MYDOOM.W WORM Added by the RANCK-CD TROJAN! Added by the ERKEZ.D WORM! TVTonic from Wavexpress - "enjoy 3 full-screen, DVD-quality video channels for FREE". Allows data content to be downloaded and synchronized on your system Searchcentrix hijacker Added by the HACKARMY.W TROJAN! XoftWare for Windows enables you to run network-based UNIX programs ("X programs" or "clients") side-by-side with Windows applications on your personal computer. You can also share programs and X-Cleaner Deluxe - privacy and anti-spy application X-Cleaner Freeware - "cookie cleaning, Internet cache cleaning, scans for many popular spy software packages and performs permanent file shredding" ScreenShot Wizard Belongs to X10 video streaming device(s) WeatherCheck - "bring the latest local weather to your desktop". Not recommended as it reportedly pops ads, and contains no uninstaller program helping with online integrity. Whenever you browse the internet and accesses a site which may contain questionable material, the program will save the site name on your computer. Approxim Added by the TANNICK TROJAN! Xanadu - free language and translation wizard from Foreignword Related to Brother MFC-9200c printer. What does it do and is it required? Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! BroadcastPC adware variant Added by the SDBOT-YB WORM! Xerox XE8 series laser printer status monitor Added by the BOOHOO WORM! XemiComputers Active Desktop Calendar Terratec DMXFire 1024 soundcard control panel Added by the BANCJ-A TROJAN!

X ? X X ? X Y U ? X X X U X X X U X ? X ? ? X X U X X X X X X X X X X X X X X U N ? X U U U U X U U X X ? X X X X X U X ? X X X X X U U X X

xftpGraber XGIWatchDog xhi xhrmy xicon XiD XircWinModem4 xitami xkstartup xload32 XML Service XNSearchAssistant XoftSpy xor xp xp service pack 2 XP Tools xp32win Xpagent XPAgent xpcfg Xpclient XPCPHOST Settings xpiupdate xPlanetControl XPSoft XPSP2 Firewall xpstart xpstat XPsys xpsystem Xpsystem xpsystem xpsystem xpupdate xp_system xp_system xp_system xserv XStop95 xswin XTCsgloader XTN Service Drivers XTNDConnect PC - 3CmPlm XTNDConnect PC - ErPhn2 XTNDConnect PC - ErTray XTNDConnect PC - LtNts4 Xtray XtreamLok License Manager Xtrem parental control XTServiceUpdate XtTb.exe xuio.exe Xupiter Startup XupiterCfgLoader XupiterCfgLoader xupiterstartup2003 XupiterToolbarLoader xv_ctrl xware XWMSUSBAPI xxcm xxsrSrv32 XXXmpeg xxxvideo x[Number from 1 to 7] Y!TunnelPro Y!TunnelPro Ya Salam yaemu.exe

Xftpgraber.exe Added by the ENVID.C WORM! XWatDog.exe Related to XGI Technology's Volari graphics cards - what does it do and is it required? xhi.exe Added by the SCLOG-A TROJAN! Xhrmy.exe HyperLinker adware xicon.exe Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? mmx.exe Added by the ANALOGX TROJAN! ltcm000c.exe WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Xiwin32.exe Xitami Multiplatform Open Source web server RunDll32 InstZ82.dll, SetUsbPrinterPort On a system with a Lexmark printer netdd.exe Added by the NETSPY TROJAN! msxml.exe Added by the RBOT-HD WORM! SrchAsst.exe iWon Search Assistant - spyware XoftSpy.exe XoftSpy antispyware software svchost.exe Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc winis.exe Added by the RBOT-WO WORM! xpsp2.exe Added by the RBOT-KW WORM! xptools.exe XPTools - "integrated suite of powerful PC Utilities to fix, speed up, maintain and protect your computer" xpupdater02.exe Added by the MOSUCK-A TROJAN! xpagent.exe Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? XPAgent.exe Reported as the CLICKER.LE TROJAN by Panda Anti-Virus. Do not confuse this with the IBM/XPoint Rapid Restore file which is generally located in the PROGRAM FILESXPOINTAGENT folder xpcfg.exe ?? xpclient.exe Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? xpcphost.exe Added by a variant of the RBOT WORM! xpiupdate.exe Added by the RBOT-AAB WORM! xPlanetControl.exe Tool that displays a globe with current day/night zones and clouds on users desktop. CVDAsDW.exe Added by the SDBOT-SY WORM! xpsp2fw.exe Added by the SMALL-RN TROJAN! wini.exe Added by the PICRATE.A WORM! winlogins.exe Added by the RBOT-AAR WORM! XPsys.exe Added by the DELF-KQ TROJAN! y.exe CoolWebSearch parasite variant SERVICES.EXE Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Ms services.exe CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! MSXMIDI.EXE CoolWebSearch parasite variant, identified by Kaspersky antivirus as TrojanDropper.Win32.Small.cw updates.exe Added by the BROPIA.L WORM! [filename] Added by the BOOKMARKER.J TROJAN! This file is located in a Windowsinet20004 or Winntinet20004 folder winlogon.exe Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe, which should not figure in Msconfig/Startup! services.exe Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normal [path to trojan] Added by the STUMPY-A TROJAN! XStop95.exe XStop - internet filter xswin.exe Installed with a Xerox Work Centre Pro 555. Unchecking it removes an "out of system memory" error XTCsgloader.exe Another Xupiter toolbar variant?? winxtn.exe Added by the SDBOT-YK WORM! Autodet.exe Component of EasySync Pro. Synchronisation between Palm PDAs and Microsoft Outlook ErPhn2.exe Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook ErTray.exe Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook NtsAgnt.exe Component of EasySync Pro xtray_link.exe Added by the VB.JL TROJAN! xl.exe License manager for xLok (XtreamLok) - prevents software being reverse engineered pcx.exe Added by the ParentXtreme is a surviellance software program that monitors user activity, logs keystrokes, and takes screenshots. It ends the processes of anti-spyware programs. If you didn't install th XTServiceUpdate.exe hahame.net adware downloader XtTb.exe Top-banners.com adware xuio.exe ?? XupiterStartup.exe Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here XTCfgLoader.exe Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here BWCfgLoader.exe Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here xupiterstartup2003.exe Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here XupiterToolbarLoader.exe Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here v_ctrl.exe 3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter" xware.exe Malware downloader from xxsware.com, causes adult content popups XWMSAPI.EXE Part of the installation of a Xerox WorkCentre printer/scanner. Is it required? sys.exe Added by the KRISWORM-A WORM! xxsrsrv.exe Added by the BANCSDE-E TROJAN! XXXmpeg.exe Adult content dialler xxxvideo.exe AccessPlugin premium rate adult content dialler x[Number from 1 to 7].exe Added by the DADOBRA-A TROJAN! YTunnelPro.exe Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia YTPro.exe Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia NancyAjram.exe Added by the JALABED WORM! yaemu.exe Added by the WIN32.DNSCHANGER.S TROJAN!

X ? X X X X X N X X X X X X ? N N N U X N N U ? N U Y U X X X X X X X U X X X X X X Y U U ? U X ? N N X X X X Y Y Y U U U U X ? X U X U N N

yahoo groups Yahoo HP Reminder 1.1 Yahoo Instant Messengar Yahoo Messenger Yahoo Messenger Yahoo Update Yahoo Updater Yahoo! Pager Yahoo2000 Yahoo2000 YahooStock YahooStock yahoo_toolbar lptt01 yahoo_toolbar ml097e YAMAHA AC-XG Power Utility YAMAHA DS-XG Launcher Yankee Clipper III YBrowser YCentral yeahdude.exe ymetray YOP You've Got Pictures Screensaver YOW tuner ypager YPC YTrayMagic Lite 1 Yumgo's Homepage Protector V1 ywwvc.exe ywzizdon yx yyyyyyyy yz.exe YZH YZH.SYS z-WrDialer ZaCker Zacker zango Zango SiteFinder Zango TvTimes zanu Zapro zBrowser Launcher zBrowser Launcher zcb Zcfgsvc zcproo ZDConfig zdnet Zebus Zekio Startups Zen.A Zenet Zeno ZENRC ZENRC Tray Icon ZENworks Imaging Service Zero PoPup Killer XP ZeroAds ZeroAds ZeroSpyware zervpack2 ZGNUBI Zi5 ZIBMACC ZincgrubInc ZingSpooler Zinio DLM Zinio DLM

upgrdmgr.exe Added by a variant of the RBOT WORM! yr.exe ?? YahooMsgr.exe Added by the SDBOT.GEN TROJAN! Yahoomsg.exe Added by an unidentified WORM or TROJAN! YPager.exe Added by the RBOT-QO WORM! Yahoo.exe Added by the YAHOO! TROJAN! Messenger.exe Added by the FORBOT-FE WORM! ypager.exe Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs Anti.exe Added by the RBOT.ATK WORM! Anti.exe Added by an unknown Malware, possibly a variant of the RBOT-RAM WORM! Prmvr.exe Adtomi adware ystckAO32.exe Adtomi adware yahoo_toolbar.exe RapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here yahoo_toolbar.exe RapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here yacpower.exe YAMAHA AC-XG Power Utility. What does it do and is it required? dslaunch.exe System Tray access for the features of the Yamaha DS-XG soundcard unless you regularly change set-ups YankClip.exe Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures, Richtext, URLS, etc - any size. Features printing, drag and drop, optional perma ybrwicon.exe SBC Yahoo! Browser system tray icon YahooCentral.exe Yahoo! Central - "alerts you if your default home page, search, or email is changed or if updates are available for your Yahoo! software. You can manage your default Internet settings and get updates t hallowelt.exe Added by the GAOBOT.RS or GAOBOT.SA WORMS! ymetray.exe Yahoo! Music system tray icon yop.exe Dashboard Module for SBC Yahoo! Online Protection ygpsstra.exe AOL You've Got Pictures(r) Screensaver WatchPNM.exe ?? ypager.exe Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs ypc.exe Yahoo Parental controls - "Let you decide what type of sites and Yahoo! services your kids can access" YTRAYMAGIC.EXE YTrayMagic from YoconSoft automatically restores your tray icons after an Explorer(the windows shell) crash. Leave to run at startup since only those icons that are in the taskbar after YTrayMagic has i YumgoHomepageProtector.exe Yumgo's Homepage Protector ywwvc.exe Added by the STARTPA-HR TROJAN! ywzizdon.exe Free_Scratch_Cards foistware uu.exe Added by the AGOBOT-YX WORM! [path to trojan] Added by the MUMUBOY.B TROJAN! yz.exe Added by the VARDO TROJAN! YZH.exe Added by the LEGMIR-BM VIRUS! YZH.exe Added by the SOPHILY VIRUS! WrDialer.exe WinPoet DSL dialer [filename].PIF Added by the HOLAR.A WORM! Zacker.exe Added by the GEMEL WORM! zango.exe NCase adware ZangoSiteFinder.exe 180Solutions ZangoSearch adware variant ZANGOT~1.EXE ZangoSearch adware zanu.exe NCase adware Zapro.exe Firewall program from Zonelabs - paid for version iTouch.exe For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Also used to display your keyboard LEDs on-screen to indicate Caps Lock, etc if it doesn't have them Commandr.exe For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Also used to display your keyboard LEDs on-screen to indicate Caps Lock, etc if it doesn't have them zcb.exe ?? ZCfgSvc.exe Zero Config MFC Application, part of Intel's ProSET utilities and installed by the drivers for many of Intel wireless network cards - essential to the proper functioning of many of the Intel ProSET utilities (b qssstiej.exe Possible homepage hijacker installing a toolbar: http://tdko.com/ ,Lop.com in disguise. see this thread ZDConfig.exe Related to various brands of Wireless USB LAN Adapter - what does it do and is it required? kontiki.exe Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops msdc32.exe Runs a HTML tutorial on the Zebus web-site znksvc32.exe Added by the AGOBOT-AGI WORM! [path to trojan] Added by the ZOOMEN-A TROJAN! rundll32 CNBabe.dll, DllStartup CommonName Toolbar spyware. To uninstall see here *sys****.exe [* = random char/digit] Added by ZenoSearch adware - filenames spotted include rsyssx2d.exe, rsyssx2d.exe, rsystu2d.exe, ysysyz2d.exe and so on zenrc32.exe The main component of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Leave well alone zentray.exe Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Best left alone ZISWin.exe Imaging Agent. Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management" zpk_xp.exe Intelligent anti-pop-up software product by Ax-Soft 0 ZeroAds - culls ads, cookies and pop-ups. Tells ZeroAds not to run at startup - needed to start it manually LAS0Ads.exe ZeroAds - culls ads, cookies and pop-ups. Required for the cookie interception to work ZeroSpyware.exe FBM Software ZeroSpyware 2004 spyware detector and remover update2.exe Added by the SDBOT.WD WORM! ZGNUBI.exe ?? AntiVirus Update.exe Added by the ERKEZ.G WORM! rundll.exe ZIBMACC.INF ZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Techn Lsass.exe Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconf ZingSpooler.exe Was used for a drag and drop program to upload pictures to www.zing.com but Zing has gone out of business. Now used for Sony ImageStation's upload photos to online albums ZDLM.EXE Zinio - used to read magazines in digital rather than paper format ZinioDeliveryManager.exe Related to Zinio used to read magazines in digital rather than paper format

X X U N X N Y U X X Y X X Y X X X Y Y U U X Y X X X X U X X X X X X X X ? ? ? X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Zip Driver Loader Zip Driver Loader ZipDisk Icons ZipGenius Clean ziphelp ZipMagic zlclient ZLH Zonavirus Zone Alarm Zone Labs Client Zone Labs Client Ex Zone system ZoneAlarm zonealarm Zonealarm Zonealarm ZoneAlarm Plus ZoneAlarm Pro Zoom ZoomingHook ZPoint ZPOINT32 zSearch zsms zsmsgs zsmss zSPGuard ZStart Zstart ZtgServerSwitch Zupdate zzb zzb zzgshp zztp zzz-hpi-boot zzzCamlnSuitelll zzzhpsetup [3-4 random letters]Srv32 [decimal number] [default] [default] [Entry name] [Ephemeral 2.5] by TreeHugger, [Ephemeral 2.x] by TreeHugger, [executed file name] [executed file name] [filename] [original filename] [original filename] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random 12 digit number] [random characters] [random filename] [random names] [random name]

ZipLoader32.exe msload32.exe IMGICON.EXE zg.exe ziphelp.exe zm32.exe zlclient.exe ZLH.EXE vsmon.exe zlclient.exe svchost.exe szchost.exe zonealarm.exe [random filename] Removeme.exe iexplore.exe zaplus.exe Zapro.exe zoom.exe ZoomingHook.exe winmuse.exe ZPOINT32.exe Zstb.exe smss.exe iservice.exe smss.exe Spguard.exe [various filenames] cxdxregt.exe server.vbs Zupdate.exe zzb.exe zzb.exe gshp.vbs svchost.exe hpi-boot.exe setup.exe 46*** setup.exe [path to file] [path to worm] DrWatson32.exe llsass.exe System.exe [path to worm] [path to worm] App.exe Regsrv32.com svchost.scr svchost.scr xphost.scr avifile5.exe bootvid4.exe browser8.exe atitvo32.exe autodisc.exe cabview1.exe advpack1.exe batmeter.exe bidispl2.exe asferror.exe catsrvps.exe admparse.exe audiosrv.exe bootvid2.exe cmpbk321.exe securewinload32x.exe slk8x2peu.exe eee2.exe Svchosts.exe

Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If y ZipGenius file compression utility CoolWebSearch parasite variant Zip utility by Ontrack. Preloading ZipMagic allows you to access files within a zip archive without unzipping them first Firewall program from Zonelabs. Pro version inlcudes other online security options System Tray icon for Norman Antivirus 0 Added by the KITRO.D (or ARGEN.A) WORM! Added by the RBOT.BO WORM! If this was the ZoneAlarm firewall the name column would be TrueVector Firewall program from Zonelabs. Pro version inlcudes other online security options Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the MULTIDR-AC TROJAN! Firewall program from Zonelabs - free version Added by an unidentified VIRUS, WORM or TROJAN! The only exception is if you have an older version of the ZoneAlarm firewall running Added by the FORBOT-BG WORM! Added by the FORBOT-CP WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program FilesInternet Explorer folder and should not normally fi Firewall program from Zonelabs - paid for version Firewall program from Zonelabs - paid for version Zoom - speeds up Windows startup and manages startup applications Toshiba Zooming Utility - found on Toshiba laptops. It allows users to zoom in (or magnify) text Added by the VJ TROJAN! USB graphics/writing tablet driver TotalVelocity zSearch parasite Added by the BANCOS-CK TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco Added by the BANCOS-BU TROJAN! Added by the BANCOS-DD TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc StartPage Guard (SPG) protects your PC from cyberscam, by detecting and preventing any unauthorized changes to your internet browser's Start and Search pages. It is also capable of removing autom VX2.Transponder parasite updater/installer related ZenoSearch adware ZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spyware B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C: IAGold adware downloader IAGold adware downloader Homepage hi-jacker that re-defines your IE or Netscape start page Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Associated with HP Photosmart printers ?? ?? Added by the BANCSADE-A TROJAN! Added by the OPOSSUM-A WORM! The decimal number can be anything, eg, 0.12345678 Added by the DREMN TROJAN! Added by the PROXY-GG TROJAN! Added by the NETHIEF-N TROJAN! Added by the LEMOOR-C WORM! Added by the LEMOOR.A WORM! where "x" represents 3 or 4 Added by the WAXPOW WORM! Added by the SOUTHGHOST WORM! Added by the BANKER-CC TROJAN! Added by the BANCBAN-CX TROJAN! Added by the BANCBAN-HM TROJAN! Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Adsrv.com/IeDriver adware variant Added by the OPTIXP-N TROJAN! Note - this trojan file is found in the System (9x/Me) or System32 (NT/2K/XP) folder. The file system32dir2a.exe will also be found in the same folder and should be delet Added by QuickLinks ADWARE! Added by MediaMotor ADWARE! Added by the SDBOT.N TROJAN!

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X N X X X X X X X X X X X X X X X X

[random name] wincpu.exe [random name] m?dtc.exe [random name] ping.exe [random name] CXTPLS_LOADER.EXE [random name] ??plorer.exe [random name] ?hkdsk.exe [random name] ?hkntfs.exe [random name] l?gonui.exe [random name] m?iexec.exe [random name] r?gsvr32.exe [random name] t?skmgr.exe [random name] w?auboot.exe [random name] w?auclt.exe [random name] w?crtupd.exe [random name] w?wexec.exe [random name] ??erinit.exe [random name] d?dplay.exe [random name] n?tepad.exe [random name] ??chost.exe [random name] ??oolsv.exe [random name] ??xplore.exe [random name] r?ndll32.exe [random name] se?vices.exe [random name] w?nlogon.exe [random name] w?nword.exe [random name] ??anregw.exe [random name] ?ttrib.exe [random name] j?vaw.exe [random name] l?ass.exe [random name] m?config.exe [random name] n?lookup.exe [random name] n?pdb.exe [random name] ??ool32.exe [random name] ??rss.exe [random name] ??rvices.exe [random name] ?ti2evxx.exe [random name] chkdsk.exe [random name] d?xplore.exe [random name] dvdplay.exe [random name] spoolsv.exe [random name] w?aclt.exe [random name] wucrtupd.exe [random name] charmapnt.exe [random name] n?tdde.exe [random name] r?gedit.exe [random name] r?ndll.exe [random name] scanregw.exe [random name] wuauboot.exe [random name] w?nspool.exe [random name] svchost.exe [random number] explorer.exe [random] lsass.scr [random] svchost.scr [System Mechanic Professional Update REREG: [Incinerator.dll] [path] Incinerator.dll [trojan filename] Install.exe [trojan name] svchost.exe [username] config [path to trojan] [various filenames] qtsks.exe [various names] elf.exe [various names] crsrs.exe [various names] Windows32.exe [various names] bling.exe [various names] mediaplayer32.exe [various names] winlogon32.exe [various names] svchostss.exe [various names] win32snd.exe [various names] shch.exe [various names] PasswdMon.exe [various names] runload32.exe [various names] dstart2.exe

Added by an unidentified VIRUS, WORM or TROJAN! PurityScan/Clickspring adware PurityScan/Clickspring adware. Note - do not confuse with the Microsoft utility of the same name as described here AproposMedia adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware - unlike this file, the legitimate Windows chkdisk.exe will in Windows XP/2K/NT always be located in the WinntSystem32 or WindowsSystem32 folder, and ought moreover PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware - do not confuse with the legitimate Microsoft Printer Spooler Service (spoolsv.exe) PurityScan/Clickspring adware PurityScan/Clickspring adware - do not confuse with the legitimate Windows Critical Update Notification (wucrtupd.exe) Added by the BANCOS-DR TROJAN! PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware PurityScan/Clickspring adware. Note - do not confuse with the legitimate wuauboot.exe file, which should not figure in Msconfig/Startup! PurityScan/Clickspring adware Added by the BANCBAN-JC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M Added by the KEYLOG-AN TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added Added by the BANCBAN-CW TROJAN! Added by the BANCBAN-CY TROJAN! System_Mechanic's "Incinerator" feature securely deletes files and folders from your PC so they can never be recovered again Added by the BANCBAN-FS TROJAN! Added by the BANCBAN-CL TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Added by the MOSUCK-H TROJAN! Added by the WEBDOR.Y TROJAN Elf is a hacker program, tied to a trojan server Added by the FORBOT-AK WORM! Added by any of a number of WORM or TROJAN variants Added by the RBOT-NI WORM! Added by a variant of the RBOT WORM! Added by an unidentified WORM or TROJAN! Added by a variant of the RBOT WORM! Added by the RBOT-DQ WORM! Premium rate adult content dialler Wareout - malware masquerading as a spyware and dialer remover Wareout - malware masquerading as a spyware and dialer remover Adware - recognized by Kaspersky antivirus as Trojan-Downloader.Small.alw

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

[various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various

names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names]

msdos32.exe sitebar.exe backorif.exe bhoserv.exe driver32.exe hyandex.exe Uint32.exe Uint32.exe _ctcp.exe 10010.exe 321102.exe 34763.exe abrek.exe ActionScr.exe AliceSD.exe AppMasterCenter.exe atl_helper.exe ATLIEHELPER.exe avpmondll.exe awinrar.exe backd.exe backorif.exe barint.exe bhoserv.exe bingo9.exe bnui.exe Bogobot.exe borlandg.exe BoundRec.exe br0ken.exe Brong32.exe clamav.exe cmon14.exe cnftips.exe control64.exe corrida.exe CToolBar.exe DCC_send.exe defect08.exe Dest068.exe dialer423.exe diskserv.exe driver64.exe DTOURS.exe ERTYDF.exe ExchangeMaster.exe EXE32EXE.exe expoler.exe FLKPT.exe forces_elite.exe ftbar.exe gabber.exe hyandex.exe iehelper.exe iesetupdll.exe init32.exe InpriseMon.exe install2.exe jopplerg.exe Kargo.exe keybdll.exe KeywordFinder.exe killall.exe LOPTCON.exe media64.exe MNTP.exe MON76234.exe moniter.exe mozilla-text.exe msag.exe

Added by a variant of the AGENT.AH TROJAN! Added by an unidentified TROJAN! Added by a NTROOTKIT TROJAN variant! Added by a NTROOTKIT TROJAN variant! Added by a variant of the SDBOT WORM! Added by a NTROOTKIT TROJAN variant! Added by a NTROOTKIT TROJAN variant! Added by a NTROOTKIT TROJAN variant! Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware Wareout - malware masquerading as a spyware

and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and

dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer

remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

[various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various [various

names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names] names]

ms-its.exe MsNetHelper.exe new32.exe newbreed.exe nmdllw.exe NopeZ.exe NsCplTray.exe NSYSCPLSTR.exe NukeSpan.exe openstre.exe panel_its.exe ParisM.exe pizda.exe powerdll.exe PrcIdle.exe prcmon.exe Preliminary.exe prgsys0984.exe progmen.exe qwe.exe RtlFindVal.exe SAPSTR.exe sbin.exe scanSYS.exe Serviceprocess.exe SetupExeDll.exe Shaitan1678.exe slamm.exe sound64.exe SpyElim.exe srbho.exe ssweeper.exe StartCpl.exe startman.exe StatusCheck.exe stuffmon.exe sysconf16.exe SysEntry.exe sysmon12.exe syspanel.exe SysSupport.exe SYSTRAV.exe TemplateDongle.exe teqq32.exe Testimonials.exe TForm1.exe TorontoMail.exe Trayz.exe TRPT.exe trycrt.exe typeconf.exe Uint32.exe uio.exe UserSp1.exe utsgmon.exe vxdman.exe WhatsNewBot.exe WinInitDll.exe wormexe.exe WTFCTF.exe XTermInit.exe xwiz.exe xxtoolbar.exe zantu.exe zxc.exe ABCXYZ.exe dePloy.exe JAguAr.exe 80d0.exe exe81.exe

Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Wareout - malware masquerading Added by MediaMotor ADWARE! Added by MediaMotor ADWARE!

as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as as

a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a

spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware spyware

and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and and

dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer dialer

remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover remover

X X X X X X X X U U X X X X X X X X X X X X X U X X X X X X U U X X X X X X X X X

[various names] exe82.exe Added by MediaMotor ADWARE! [various names] MSTCPDLL.exe Wareout - malware masquerading as a spyware and dialer remover [various names] seli.exe Added by MediaMotor ADWARE! \IEService.exe IEService.exe FastFind parasite variant \Pribi.exe Pribi.exe FastFind adware variant \SysInit svchost.exe Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in M \\TOOLS.exe tools.exe Lycos SideSearch/Fastfind.org adware ^`d}qZxu ~`d}qzxu3zYF Added by the GAOBOT.GEN!POLY WORM! _AntiSpyware MssCli.exe McAfee AntiSpyware _AntiSpyware masalert.exe Part of McAfee AntiSpyware _Cat1 nmmst.exe Added by the SMALL.SD TROJAN! _Cat2 nmstt.exe Added by the SMALL-DT TROJAN! _Cat3 msmsgrxp.exe Added by a variant of the SMALL-DT downloader TROJAN _Cat4 msmsgr2.exe Added by the SMALL-EB TROJAN! _Hazafibb [path to file] Added by the ZAFI.B WORM! _ntrdlhost _Ntrdlhost.exe Added by the DLOADER-JV TROJAN! _ntrRescueService _ntrrs.exe Added by the DLOADER-JV TROJAN! _Setv Setv.com Added by the BESAM WORM! _svchost.con svchost.com Added by the ERKEZ.C WORM! _SystemBoot services.exe Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msc _SystemDriver csrss.exe Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Mscon _System_Run _svchost_.exe Added by the LINEAGE-Z TROJAN! _tdiserv_ _tdicli_.exe Added by the TDISERV.A WORM! _winadm winadm.exe Parents Friend - "Log any activity and protect programs with a password. Further more you can lock the pc any hour in the week you want with the main password. You can also give users allowed progr _WinCheck services.exe Added by the SOBER.V WORM! _Windows services.exe Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco _WinMain winexec.exe Added by the DLOADER-XX TROJAN! _WinStart services.exe Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msco _winsystem.sys smss.exe Added by the SOBER.K TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfi _x-Finder _x-Finder.exe Disconnects and redials an ISP modem to an adult content site {0228e555-4f9c-4e35-a3ec-b109a192b4c2} gnotify.exe Google Gmail_notifier. Alerts you when you have new Gmail messages {1290A33C-85F5-4164-A1BE-7DD299D4986A} PBKScheduler.exe Scheduler for CyberLink PowerBackup - archiving/backup utility {12EE7A5E-0674-42f9-A76B-000000004D00} rundll32.exe [path] stlb2.dll, DllRunMain BrowserAid/BrowserPal foistware {1C-CC-C5-54-ZN} dwdsregt.exe Added by ZenoSearch ADWARE! {2CF0B992-5EEB-4143-99C0-5297EF71F444} rundll32.exe stlbdist.dll, DllRunMainBrowserAid/BrowserPal foistware {2CF0B992-5EEB-4143-99C2-5297EF71F44B} rundll32.exe stlbupdt.DLL, DllRunMain BrowserAid/BrowserPal foistware {357AA41A-B7A8-4632-A27D-5B980B25CF43} [path to svchost.exe] Added by the SMALL-AQ TROJAN! {357AA41A-B7A8-4632-A27D-5B980B25CF43} [path to trojan] Added by the SMALL-EP TROJAN! {8C-C4-4A-A4-ZN} dwdsregt.exe Added by ZenoSearch ADWARE! {A70F6A1D-0195-42a2-934C-D8AC0F7C08EB} rundll32.exe E6F1873B.DLL, D9EBC318C BrowserAid/BrowserPal foistware (r)Windows Update svchosts.exe Added by the FRUCTA TROJAN!

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder r and should not normally figure in Msconfig/Startup! This file is located in a HelpHelp subfolder of the Windows or Winnt folder and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatusMicrosoft" subfolder of the Windows or Winnt folder and should not normally figure in Msconfig/Startup! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder and should not normally figure in Msconfig/Startup! This file is located in a Connection WizardStatus subfolder of the Windows or Winnt folder nd should not normally figure in Msconfig/Startup! This file is located in a msagentwin32 subfolder of the Winnt or Windows folder cks. You will see one instant of pgaccount.exe for every active account on your system, and this is essential for PG to work properly

r folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

wn the computer system in an intelligent and orderly manner"

nd should not normally figure in Msconfig/Startup! This file is located in the System folder

nd should not normally figure in Msconfig/Startup! This file is located in the System folder

nd should not normally figure in Msconfig/Startup! This file is located in the System folder tartup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it

K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder

ound doing nothing at all (sleeping on a semaphore), so it should take zero CPU time and virtually zero memory, since it will all be paged out to the hard drive." In most cases it can be safely disabled

Similar to Creative Lab's AudioHQ

r in Msconfig/Startup unless you added it manually! This one is located in the System folder

BOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking

any window to the System Tray

link you to the internet in an attempt to buy the 5.0 version of the software

he Access Ramp Monitor (1) Open Windows Explorer (2) Open the Program Files folder (3) Open the MindSpring folder (4) Open the AccessRamp folder (5) Double-click on the ARMCfg32.exe file (6) Uncheck Enable Dialup Monitor and click OK (7) Restart the computer and try again

and policy management, access control management, and key management"

E software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup, or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you xe) does not show up in the startup process. If you have this file, you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone A ins, shopping orders, banking, and other online activities-all from the safety of your own PC

n update is made available, AceGain manages the alert, download and installation as well as version control and user network preferences."

ence the "U" recommendation. *.* represents the version TrueImage to do some real backup/restore tasks - not if you only want to explore/mount images

perform actions on the instrumented client. Is it required?

ck, Scroll Lock keys

nds of viruses"

olicy used to state that they also collect and share individuals information but this is no longer the case

quired to know a lot about the computer

and web-building applications

and web-building applications

aunch on insertion of a disk via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later

efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here

s will not need it. In my case I can verify this as Photoshop loads fine

without fear of overwriting someone else's work"

and should not normally figure in Msconfig/Startup! K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder

een Guard. Important to keep its running while using Access Denied

ithout it but you lose the special functions

away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either" away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either"

y also collect and share individuals information but this is no longer the case

used by Realtek to gather data about customers

e to disable this one altek to gather data about customers

s 5.0 and higher, the products you purchase online whilst using the toolbar. Although Alexa state's they do not attempt to analyze the data it may collect about you to determine who you are, some of your information collected by the software is personally identifiable. Please read the Privacy Policy

isabling it impacts on the reported last scan date. It is reported to cause jerky graphics response in many games. As of version 6, this is a critical component of McAfee and disabling it can cause a PC to lock up

lling. Required for proper functioning of the pointing software but not required for the laptop to work

ssional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind

see here and here see here and here

he compromised system tmp, syste.exe, alg.exe, socks.exe, winxpsp2.exe, tek9.exe, sks.exe, hihi.exe, s.exe, xps2.exe, dns2.exe, ikav32.exe and more...

he System Tray shortcuts toolbar

from the DVD such as skipping adverts - hence the "U" recommendation

gets written to a log file. The AOL Self Support Tool is required to run with the Help and Support program. If you uncheck AOL and and then run Help and Support it will add another AOL entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and ential process, and is installed for ease of use

of signing back on manually of signing back on manually

y. Not seen much any more and should only run once

This pre-loading of assemblies enhances ACT! startup, view load and dialog load times in some areas of the application

lling. Required for proper functioning of the pointing software but not required for the laptop to work

S starts" option. Required for a connection to be established

n via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."

programs, Websites, e-mail addresses or folders (which open in the AppPlus Menu System)"

y file shared by other users. You can meet new friends in Ares chatrooms while you download" ownload any file shared by other users. You can meet new friends in Ares chatrooms while you download"

ended, see here laptop to run if the wireless network card will not be used. Is it at all required?

see here and here

er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

rking state with minimal re-entry

required to run the control center - which is available via a right-click on the desktop

up in the menu

-> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see

ET framework installed. Note that this has "runtime" appended to cli.exe in the "Command" column of MSCONFIG. Recommend that start the program manually via Start -> Programs -> ATI Catalyst Control Center -> Advanced -> Restart Runtime as it can casue problems when starting Windows

s to Catalyst Environment (MACE) component

bled unless it consumes too many CPU resources

bled unless it consumes too many CPU resources anel -> Display. Some users may need it if they have anel -> Display. Some users may need it if they have anel -> Display. Some users may need it if they have anel -> Display. Some users may need it if they have anel -> Display. Some users may need it if they have anel -> Display. Some users may need it if they have

optimised optimised optimised optimised optimised optimised

their their their their their their

settings settings settings settings settings settings

ays located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "ComRoot" subfolder

n one while holding down the Alt key information about events as they happen. This way, when a rule has been triggered or an access to the Internet made, you know about it immediately rather than finding out about it when you check your logs or notice that the NIS icon indicates a security alert

installing updates. Leave it unless you plan to regularly run it to check for updates

process a new logon

causing problems

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

tput. Available via AudioHQ

computer use - similar to SETI@home but for medical research. Available via Start -> Programs

file, so system administrators can access the machine. Can cause a 10% reduction in speed and not recommended

DEsecureinstall.exe if still present in C:\Windows\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents DEsecureinstall.exe if still present in C:\Windows\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents r e-mail. "Benign neutralizes or strips out the code that makes viruses, worms, scripts and other potentially harmful things run"

see a new tab which allowed him to enable a "Desktop Slide Show." This would automatically change the Windows Desktop at an interval specified by the user. Available here matted CD-RW disk

og and often causes malfunctions. Available via Start -> Programs

4). Also adds an icon to the system tray

and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

ndicates an unsuccessful installation, as that key should be deleted automatically. See here

hoice - try it and see

un manually when needed

omatically resolve their problem or point them to the right solution. BelTech Manager allows non-programmers to rapidly and easily deploy and maintain this service

k version, and more

istry and alerts you when a BHO is installed. Best of all, BHODemon knows about the most common BHOs - the good ones, and the not-so-good ones!". If you prefer forgoing resident protection, the application can also be run on demand on of doing away with the ads by purchasing the screensaver for a whopping $30...

(published in the form of Fixlet(r) Messages) and can automatically check your computer for bugs, configuration conflicts, and security holes. Should only be started manually as it's a resource hog ernet account a whole lot easier"

nd adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' See also LoadBlackD nd adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' See also LoadBlackD

o the Bluetooth USB adapter. Shortcut available via Start -> Programs essary for the computer and the PDA to communicate. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Mscon ets written to a log file. Blueyonder Instant Support is required to run with the Help and Support program. If you uncheck it and and then run Help and Support it will add another Blueyonder Instant Support in the startup menu. If you remove Blueyonder Instant Support in add/remove programs so ate this but the newer versions do not

on of doing away with the ads by purchasing the screensaver for a whopping $30...

ions along the lines listed here, where # is a number and X is a letter. Shortcut available via Start -> Programs

any browser". Only installed with the users explicit permission and generally only remains running if the user decides to subscribe to the service. If it is no longer required it should be uninstalled to prevent a large number of clients 'checking in' to the server that have no chance of synchronizing any browser". Only installed with the users explicit permission and generally only remains running if the user decides to subscribe to the service. If it is no longer required it should be uninstalled to prevent a large number of clients 'checking in' to the server that have no chance of synchronizing

effect on resources Update which updates Norton AntiVirus significantly enough that a reboot is needed to complete the installation. We believe its purpose to be to warn the end-user that he must reboot his PC before using Norton AntiVirus in those cases when a reboot did not happen with the result that Norton Ant

efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here

-Wonder). If you don't use it - uninstall it

rtcut to start manually

are). Performs the following tasks [un]installation, web software autoupdate, notification windows, interprocess communication, tray bar icons & menus, alarms (brinotes), and common web launching from the mentioned applications. Can be stopped safely once run if so desired

ITE! The Actual Names technology can do this for you"

gets written to a log file. BT Broadband Help is required to run with the Help and Support program. If you uncheck BT Broadband Help and and then run Help and Support it will add another BT Broadband Help in the startup menu. If you remove the BT Broadband Help in the add/remove program

ray icon changes from blue/white to blue/red when the module is turned off. Allows access to explore bluetooth places, setup wizard, advanced configuration, quick connect and shutdown device

if available, any known solutions to the crashes. It doesn't take up any room in memory, just activates in the event of certain program failures

rtcut to start manually keyboard or your's doesn't have them, then it isn't required our scanners software or run it manually by creating a shortcut en you're on-line and via dial-up modem

ble via Start -> Settings -> Control Panel or Start -> Programs aunch your browser

gh automated discovery, hardware inventory, network inventory, software inventory, configuration management, software usage monitoring, license management and extensive cross-platform reporting

backed up to an archive location"

generate detailed reports and statistics

works by generating one-off transaction numbers as a substitute for your real cahoot credit card details. Run manually when needed

nctionality, basic (single mailbox) answering machine capability, and sophistcated data communications. Main application nctionality, basic (single mailbox) answering machine capability, and sophistcated data communications. Fax printer When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows

200 company profiles from Coop America. Saves 1 square foot of rainforest every day you use it. If it works and you like it, keep it

artup! This version resides in a "mduu" subfolder, which may change

re are a lot of system-related things that can cause it grief. If you run ClearCase you should not disable this as it provides a valuable service, but technically it isn't required to use the ClearCase product

quired as a seperate entry but a recent update changed this

nd should not normally figure in Msconfig/Startup! This file is located in the System folder Reported to cause excessive CPU usage

Msconfig/Startup unless you added it manually! This one is located in the System subfolder hanged by a malicious threat or a hack"

aded program files for IE, Netscape and AOL

t needed unless you run said program. Can be started and stopped manually

Off, Hard Drive Shut-Off, Monitor Brightness, System Stand-by and System Hibernate times

ard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs

blogs, personal websites, Friendster profiles, and your visitors will be able to contact you instantly, without downloading anything, or registering. Alo use it to send email to your friends, allowing them to respond to you in real time!." The 'MessageCatcher' icon in the System Tray notifies you when

rms a check on various system parameters at intervals you specify

ersion on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources vers. What does it do and is it required? ccess to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources

m, so it's advised to replace it with one of may spyware free alternatives available me by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync

ve in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it

river, plus more." Installed with some Compaq and Lexmark printers

xplorer folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

eas this version resides in %windir%

s through which C.D. allows you to have any information you want, on your desktop, all the time"

omain.com instead of atdt 5551212)

ool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs

it. Note - asks for permission to contact the IP address of http://www.protectcom.com/

moved if installed but not wanted, rather than disabled at startup. See here for more information

HP and Compaq desktop computer owners" HP and Compaq desktop computer owners". * can be any digit

ets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in t ns, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on t

mpaq Print Fax) used by this worm

es a restore function. Your choice es a restore function. Your choice

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

connection manager via Add/Remove Programs and it won't affect the service

not normally figure in Msconfig/Startup! This file is located in a SystemLevel4 subfolder er and should not normally figure in Msconfig/Startup! This file is located in a "Central de Segurança" subfolder

ow fax/telephone icon. Available via Start -> Programs

o have different windows on each of them". Not required but may be of use to you

e, restart, and cancel during the copying and moving processes

parate card. Once you've set the modem up to the chosen country it's not required parate card. Once you've set the modem up to the chosen country it's not required

moved if installed but not wanted, rather than disabled at startup. See here for more information

ee from viruses by McAfree/Norton

with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS

page. Similar to EnsoniqMixer ly support them. Available via Start -> Programs

ttings otherwise available via the standard icon

me name as described here

nstallations and properly track registry changes."

om folder name older and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder d should not normally figure in Msconfig/Startup! This file is located in a random subfolder

hould not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder ways located in the WinntSystem32 or WindowsSystem32 folder and should NOT figure in Msconfig/Startup!

provides a restore function. This part takes a snapshot of your system following a healthy re-boot

anage and maintain the anti-virus strategy from a centralized console."

g directly from MS Office, it is not required D Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again D Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again

apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. Ctfmon can be disabled from Control Panel, Text & Speech Services. Note - the file will always be located in the System32 folder

nitoring program - remove unless you installed it yourself! Found in the SystemCTF (9x/Me) or System32CTF (NT/2K/XP) folder

, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see CIADOOR-Jhere. Ctfmon can be disabled from Control Panel, Text & Speech Services. Note - the file will always be located in the Syste

to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative's sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control

MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected

en settings in Windows, and make changes"

ersion on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources ccess to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources vers. What does it do and is it required?

er "x" amount of time has passed damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs

make up your own mind Bridge to crash everything if this is disabled

ways restore functionality to those buttons once unchecked and rechecked - direct from Dell

e version is adware based

ou can also use it to browse your phone, edit the phone list and so on with attachments, PDF files, pictures and Excel-like charts"

mputer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example mputer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example

ollect and share individuals information but this is no longer the case ollect and share individuals information but this is no longer the case ollect and share individuals information but this is no longer the case

manually on a regular basis

he status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards?

ettings -> Control Panel

t required for most users - more likely to be used by system administrators, for example 5 is actually Works Calender Reminder (found via a registry search)

. It is not required at all, since you can use the scan software from almost any photo editing software

software used to access that device. The DevDtct2 process has a "high" priority level which can negatively impact system resources process, but should not be terminated unless suspected to be causing problems"

ay Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices y Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices

r-ID, Wave Playback, Wave Recording, Digit Monitoring, POP3 e-mail Manipulation, Speech Recognition and Synthesis"

tart -> Programs

d peripherals of the system, such as audio program, power management, MP3 files management and communication / 802.11g WLAN settings. Moreover, with this unique utility, you will be able to activate the MSI well-known features, Live Update and Core Center"

all Connexant V.92 and Broadcom modems , you will be sent to this online company's site for the download after the purchase is complete. Read more here

arting ESPN Motion/Disney Motion starts digstream automatically er), and allows viewing and interacting with the raw MSN protocol

via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later

r this the Ctrl+1..9 shortcut keys can be used in the same or another window to go to any of the 9 bookmarked folders

are to be recognised as soon as they are inserted into the reader

@Home. Also prone to being distributed by viruses

ll). Available via Start -> Programs

jor problems. This "utility" adds the functionality and compatibility HP forgot to add in its WinME drivers

ou could have problems starting it manually.

d file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"

ontroles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"

aZaA" amongst other file-sharing utilities (see here). Reported in the past as a virus

ilable updates

of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. Available via Start -> Programs esktop Management Interface. See here for more information esktop Management Interface. See here for more information

all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work

should not normally figure in Msconfig/Startup! This file is found in the Common Files folder

signed IP address. Is it required?

nternet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group

e version is adware based

e version is adware based

can be launched from the Start Menu programs group when needed

nternet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group

d burning will happen automatically". Not required for Roxio to work properly

and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder

and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder

watching, they decided to implement an anti-spyware service. Run manually before installation starts

nent ADSL connection

Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out

drive write mode which is always used

watching, they decided to implement an anti-spyware service. Run manually before installation starts

er preference

ws monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program h some system information is sent to a remote site vity and applications used, must be manually installed

hese or add more buttons any time

software such as Net Nanny internet filtering software. Available via Start -> Programs

manually when starting the browser

rch Toolbar and WinTools

d hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks"

see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually

ve in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it s and give you the details about each client's progress as the FAH client runs. EM will also show you what each change in the protein looks like as the process continues

not bring up the dialog box which is sometimes needed to reset the modem ous levels and restore the default clock speeds upon reboot. Leave enabled if overclocking

need it leave it disabled

ixer which can no longer be used". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility

i-page TIFF, JPG, GIF, PNG and many more!" Can be started manually DOC, HTML, TXT , Multi-page TIFF, JPG, GIF, PNG and many more!" Can be started manually

d when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check d when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check

d d d d

when when when when

about about about about

to to to to

print print print print

as as as as

follows: follows: follows: follows:

File File File File

menu menu menu menu

> > > >

Print Print Print Print

to to to to

bring bring bring bring

up up up up

the the the the

print print print print

dialog dialog dialog dialog

box. box. box. box.

Click Click Click Click

on on on on

the the the the

Properties Properties Properties Properties

button button button button

which which which which

will will will will

bring bring bring bring

up up up up

a a a a

display display display display

with with with with

4 4 4 4

tabs. tabs. tabs. tabs.

Click Click Click Click

the the the the

Utility Utility Utility Utility

tab tab tab tab

to to to to

get get get get

a a a a

list list list list

of of of of

utilities utilities utilities utilities

that that that that

can can can can

be be be be

executed executed executed executed

including including including including

the the the the

Status Status Status Status

Monitor Monitor Monitor Monitor

3 3 3 3

Environment Environment Environment Environment

Check Check Check Check

less to say you don't need it

rsion of the software in order to remove the reported threats

pyware - now the web-site is dead

s long you keep the BottomLine running, you will continue to receive live scores and breaking news, and by clicking on any score or news item, you will be taken directly to the corresponding page on ESPN.com for a full break down."

o disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK options, and has enable/disable and rescan buttons. It is not needed if using Windows XP or higher, as they have this built-in to the control panel. Also, if the user is very sure that there is ONLY ONE network available to connect to, then they can remove this. If it is not in startup, and the user nee

nding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer

ar in Msconfig/Startup unless you added it manually!

OM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL

r in Msconfig/Startup unless you added it manually! This one is located in a "service" subfolder of the System folder in Msconfig/Startup unless you added it manually! This one is located in a "SHELLEXT" subfolder of the System folder in Msconfig/Startup unless you added it manually! This one is located in a "config" subfolder of the System folder

ndows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!

ndows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!

orer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder mally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder n Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

to stop more than one device at once, rather than stopping each device individually". Available via Start -> Programs

overwriting overwriting overwriting overwriting

the the the the

settings settings settings settings

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

sed or PC based organizer"

nitoring program - remove unless you installed it yourself!

y used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys

s only been seen in the System32 folder

y used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys y used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys

mark, MCI, Lotus, My Software, Broderbund, Traffic Software and many others n be started manually nd dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs

databases, and provides for synchronization of other data as well

SOS Best Defense and SOS Pro such as Internet filtering utility. You can access this menu by "right-clicking" on the icon

Y recommendation

r and should not normally figure in Msconfig/Startup! This file is located in a "3041" subfolder ur approval. Innovative StartUp Firewall will help you keep your computer clean, fast and in it's best shape"

r autoupdater. Otherwise not required r's experience. Not required but could be left without a drain on resources ontrol, sounds and audio devices, capture screen, capture window, organize favorites, power options, printers and faxes, LCD brightness MIN, LCD brightness MAX, Enable/disable Button Panel and the Fujitsu menu settings, which are customizable

y without permission, which is a pain. No need for it if you do not want these features

via via via via

Start Start Start Start

-> -> -> ->

Programs Programs Programs Programs

s the internet to upload to the servers. Available via Start -> Programs a or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required

ay be harmful to the system or relay system information not need this program loaded either

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

ory managers with Win98/ME. See this article and make up your own mind and much more your own mind

/ME. See this article and make up your own mind

startup or at specified intervals

nd should not normally figure in Msconfig/Startup! This file is located in the System folder

d/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well

e computer as you see it in real-time

are or services

modem and telephone lines or by a local-area network (with upload transfer resume and download transfer resume). Can be started manually

ontrol, sounds and audio devices, capture screen, capture window, organize favorites, power options, printers and faxes, LCD brightness MIN, LCD brightness MAX, Enable/disable Button Panel and the Fujitsu menu settings, which are customizable

nd mobile workers"

conditions following a re-boot hout switching back to the desktop

new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users

d instead using the dial-up details available here

older and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

The registered version isn't if you don't install the Aureate/Radiate software. Available via Start -> Programs

Catcher with real time scanning, you'll want to leave this file in place

System32 folder. This worm file is found in the System folder lder and should not normally figure in Msconfig/Startup! This one replaces svchost.exe in the System32 folder with a copy of Mirc on (NT/2K/XP) systems and just adds svchost.exe to the System folder on (9x/Me) systems

em goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users em goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users

irtual CD-ROM drives at a speed of 200X for true multitasking

older and should not normally figure in Msconfig/Startup! This file is located in a "golumm" subfolder making your computer searchable, Google Desktop Search puts your information easily within your reach and frees you from having to manually organize your files, emails, and bookmarks"

idle. If you want to turn it off go to your browser, click on the little double-helix on the Google Toolbar, and click "Stop Computing"

s those computers from any web browser

startup configuration utility. Similar to msconfig but can keep a list of disabled apps. Not really necessary. Only appears if you load the Gateway Startup Utility

d. Start it manually via a shortcut if not used

nks. Also see this MS Knowledge Base article

n - all this does is give an indication of connectivity and access to the diagnostic facilities

an the likes of WinOptimizer and System Mechanic

he file is known as "Smart Thru Fax Drive Spy" and is supplied by Samsung

See here for more information

et, but otherwise pointless

quired if you're concerned about your system temperature - typically for "overclocked" systems

overclocked" systems

vices of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here

round for network printer notification, detection, and Internet Connection Sharing (ICS) taskbar icon. Not required - network can be set-up manually, also has a known memory leak problem it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation

and alerts you to impending failure"

m securely from viewing and searching"

etc. Required if you run of battery regularly

Typical examples are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case th

ually updated to detect and remove new hijacks. It does not target specific programs and URLs, only the methods used by hijackers to force you onto their sites. As a result, false positives are imminent, and unless you're sure about what you're doing, you always should consult with knowledgable

ers. Available via Start -> Programs

rwise not. It can be disabled via the Display Properties in the Control Panel

ed it. Available via Start -> Programs

orts Windows icons, bitmaps and can extract icons from executables and libraries. Hook99 can also make the background of desktop icons captions transparent

Startup (it'll just load when Explorer is launched, which will extend load time a bit), but do leave it on your system".

d as "HotAction_hr" vices of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here

rwise not. It can be disabled via the Display Properties in the Control Panel

rt -> Programs

from the startup

HP and Compaq desktop computer owners". Applies to certain HP Pavilion desktop computers between Fall 2001 and Spring 2003. * can be any digit

cause hpcmpmgr.exe can't be ended"

much faster than the first time

ets written to a log file. HP Instant Support is required to run with the Help and Support program. If you uncheck HP Instant Support and and then run Help and Support it will add another HP Instant Support in the startup menu. If you remove the HP Instant Support in the add/remove program som nel --> Keyboards to change them

plus About, Help, ToolBox, Exit, etc

ion to match your display device"

remove or prevent from starting

from the startup

n "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner

s HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the HP icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner

cause hpcmpmgr.exe can't be ended" skbar. The 1st one has a yellow border around it warning that ink is low on the printer. The 2nd one is HP skbar. The 1st one has a yellow border around it warning that ink is low on the printer. The 2nd one is HP skbar. The 1st one has a yellow border around it warning that ink is low on the printer. The 2nd one is HP skbar. The 1st one has a yellow border around it warning that ink is low on the printer. The 2nd one is HP the run line in win.ini if you do not want that feature olicy used to state that they also collect and share individuals information but this is no longer the case

Device Device Device Device

Detection Detection Detection Detection

Software Software Software Software

and and and and

the the the the

3rd 3rd 3rd 3rd

one one one one

is is is is

about about about about

a a a a

card card card card

being being being being

inserted inserted inserted inserted

into into into into

the the the the

Hp Hp Hp Hp

printer printer printer printer

e system crashes in some cases. "x" can be 1, 2 or 3 and depends upon driver version. Replaced by HPHmon** (where ** is the version number) from version 4 onwards ns it the first available drive letter - which can lead to problems with drive management. ** represents the version number. Disable if you don't use the reader

g of the system. Your choice

olicy used to state that they also collect and share individuals information but this is no longer the case

process, but should not be terminated unless suspected to be causing problems"

hp.com, pick your OS option under the SUPPORT tab, follow the instructions and you will find an updated lamp control patch

startup, unless the scanner is used every day, such as in a business environment

ll sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP, if it can't tell that it is an HP it will not run. If unchecked, it can prevent the running of the Application Recovery CDs, the use of the multimedia k

and that shows the state of the radios for these wireless devices

ansmit scanner information to ACNielsen

SLOW your graphics card by around 6%

eath) if left out

o cause problems, such as this one. HydraVision can be uninstalled through Add/Remove Programs monitor setup monitor setup

that "replaces the ATA drivers that come with Windows with drivers optimized for desktop and mobile PCs." If you use the RAID version it's required to notify you if a RAID 1 disk has failed

he status of or change the state of the client computer, such as shutting it down remotely?

vailable from IBM as well as messages from IBM eSupport"

specific functions to control the standby and hibernate buttons. Not required if you don't plan to go into standy or hibernate modes

ndMAX integrated Digital Audio" (Analog Devices Inc.) devices

e line for incoming calls and handles voicemail

ddenly flips back up when playing DirectX associated games

ticular impostor is located in the Windows or WinntSystem32 directory

ystem32 folder. This file is placed in the Windows or Winnt folder

ou added it manually! r button, startup items, Favorites, typed URLs and the entire Internet Options"

n of IconEdit2

folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder plorer folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder plorer folder and should not normally figure in Msconfig/Startup! This file is located in a "Custom" subfolder xplorer folder and should not normally figure in Msconfig/Startup! This file is located in the "Arquivos de programasInternet ExplorerCustom" folder FilesInternet Explorer folder and should not normally figure in Msconfig/Startup!

ar in Msconfig/Startup unless you added it manually! This one is located in the System folder

Available via Start -> Settings -> Control Panel

Networks -> iM Radio Tuner

ve. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running

ore inserting an appropriately formatted CD-RW (CD-MRW) disk. For Nero 6.0, 6.3 or 6.6 (InCD4), it does need to start with Windows. It does not function correctly when you try to run it manually, and you will not have write access to MRW (Mount Rainier) formatted CD-RW (CD-MRW) or DVD-MRW d ilor your email experience so that it fits your mood and personality

ilor your email experience so that it fits your mood and personality ilor your email experience so that it fits your mood and personality

ble within the program options - otherwise it is re-enabled in MSCONFIG

quests and launching server daemons". Provides PCs with the full functionality of a UNIX workstation mes with PWS (Personal Web Server) or NT4 and handles ASP-, PHP code (+ more)

. What does it do and is it needed?

b site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them, as well as increasing return visits and brand awareness, and providing new e-commerce opportunities"

h if seeing high CPU useage - see here pdate signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates - see here

rganizer when you HotSync

allation that failed and "SETUP.EXE" was left to run at startup as an error?

cess from PDA or mobile phone

hecking itself when using MSCONFIG. PrintMaster 11 uses filename PMremind.exe - it has to be unchecked in startup in the same manner

ed for configuration

ems when running on a laptop if you change PCMCIA cards

erver and managed clients. Will start the dial-up if installed and enabled nformation here. System Tray icon providing the user with a visual state indication. You can find more information here

uld not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

s, defer back to their default settings unless you have changed them sing dial-up). It can also alert you if your modem line is disconnected. Furthermore, it can alert you if you have made a wrong connection with your modem line nformation here. System Tray icon providing the user with a visual state indication. You can find more information here Available via Start -> Settings -> Control Panel

, or C:WindowsSystem32 (WinXP) as this version resides in %windir%

has a "?" icon wheras this version resides in %windir% and has a ZIP icon

r folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

er without your knowledge. These files are known to be part of an infection that transmits information about your bank accounts, passwords, and other financial information. It should be deleted immediately, you should enable your firewall, and you should contact your financial services in order to

lorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

Available via Start -> Programs Available via Start -> Programs Required if audio and screen crawler alerts are desired. Also available via Start -> Programs orer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

ve. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running ve. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running op file access, access and write protection, and formatting of the disks

ogram loaded

tantly "phones home" and wastes resources. * represents 1 or 2

eath) if left out

such as the Internet

me, make and receive regular (landline) calls on your phone"

such as the Internet

bles you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon rs: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks"

sion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server

u use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation

our keyboard does not have the num lock, caps lock, and scroll lock lights on it and you use the on-screen displays for num lock, caps lock, and scroll lock

nd if it is a past or current date displays a program related tip

itimate) Apple iTunes process, always located in the Program FilesiTunes folder Tunes a few times - hence the reluctant Y recommendation Tunes a few times - hence the reluctant Y recommendation

ate feature as, whenever you are connected to the Internet, it will check for Windows updates and Toshiba updates ew directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis ew directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis

hat protect your Windows system while you are surfing the web"

r folder and should not normally figure in Msconfig/Startup! This file is located in a WinntJavaJava folder

C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP) as this resides in C:Windows or C:Winnt

s launched automatically through the registry, and remains active to control the Discovery Indicator

u startup your computer

when using a SOCKS proxy

hat be run or opened automatically, the first time

er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

tem, as described here

m that can remove it

sharing program which has the same executable name sharing program which has the same executable name

egular KaZaA searches" east until a more practical solution is found. There have however been reports of fatal exception errors in systems running Windows 98, and in such a case Microsoft advises to either uninstall the patch (Add/Remove Programs) or prevent it from running at startup

Services such as KWeb and NiftyTelnet ocuments, and other digital media. The Kontiki DMS enables enterprises to efficiently publish, secure, deliver and track digital media to employees, partners, and customers"

and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out

mally figure in Msconfig/Startup!

nd should not normally figure in Msconfig/Startup! This file is located in the root folder - normally C:

s can be serviced. Without KeyAccess, a keyed program cannot run, so license control is very secure"

fic actions during the game

e and much more completely undetected to the user."

the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is found in a SystemPALCSS subfolder a game switches to full-screen

er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

eath) if left out

o 38 keys on your PC keyboard to instantly launch Web Sites, start applications, perform custom macros, handle Windows shortcuts, store passwords, and perform loads of other customizable functions

lable via Start -> Programs

Endpoint itself which will continue to function normally"

want the reader to work

rom a desktop shortcut rom a desktop shortcut rom a desktop shortcut

used, (or should not be used) at all". It is known that firewalls can however alert you to "lexpps.exe" requesting server privileges work correctly - not in the case of a Lexmark Z42 for instance of mission-critical documents"

and execute the program and execute the program

bles you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon bles you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon

e of items that are hard to read on your monitor

anually update the files anyway anually update the files anyway

oot. Name field may be empty

ntal and vertical positions, phase, pixel clock, color and language

ar in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

terface. You can change the style of title bars, buttons, toolbars and much more". If you use it - keep it if not then uninstall it

or this keylogger

program, a WWW-browser launch function, Internet telephony, and address management. Required if you use those

in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

ar in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder 00XP). This file is located in the Windowsinf or Winntinf folder

ed power scheme. May not be required - depends upon whether you modify the default Control Panel -> Power Options settings nfected version uses "Rundll32.exe"

nternet sharing working on Win2K Pro SP2. Reports also suggest that removing it will re-enable internet access - hence the "users choice" recommendation. If you have problems leave it, otherwise I recommend you disable it

er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

d access is provided to any outside service required (Usenet News, Web browsing, IRC, Socks etc.). Setup requires installation of Perl and some modules

Panel to adjust your mouse sensitivity. This setting is maintained separately from the Windows setting, but is combined with the Windows setting to determine the final sensitivity. For this reason, KHALMNPR sets the Windows setting to 0 so it doesn't alter the one you set in SetPoint atures such as multimedia keys need it leave it disabled nner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch.

u use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation

u use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation

need it leave it disabled et or the Internet) - and on the client side all you need is a web browser, a terminal emulator or a WAP-enabled phone et or the Internet) - and on the client side all you need is a web browser, a terminal emulator or a WAP-enabled phone

y to create your own logons which can then be uploaded to websites to be used by others users"

ld not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder ready have a newer version or the patch has been applied

able via Start -> Programs screen. Uses a lot of resources. Available via Start -> Programs on". All individual components available via Start -> Programs

/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

and should not normally figure in Msconfig/Startup! This file is located in a DebugUserMode subfolder of the Winnt or Windows folder

d should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder nd should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder

rivers. See here for more WinModem information

rivers. See here for more WinModem information

ected to be causing problems

you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as MDM7. See here to disable

art of Exchange 2000 Server but does it have the same problems?. Apparently you need to leave this running but is it needed at start-up?

ou should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) ems). You should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) es downloaded by Internet Explorer, Netscape Navigator, ICQ and iMesh". Not recommended as it bundles GAIN adware

ned for viruses and cleaned

eous security devices"

aken over by IBM (see here) and the product became Workplace Forms

an the likes of WinOptimizer and System Mechanic

problems before they become serious". Resource hog. Available via Start -> Programs ate manually on a regular basis

Console (Avconsol.exe) under one application t malicious ActiveX programs, etc

't see the agent icon, VirusScan Online may not be installed

nd secure running of your computer

you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as Machine Debug Manager. See here to disable

apture periodic screen shots and may be configured so as to block access to specific Web sites and chat rooms, must be manually installed. Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figu

er is a program that indexes all the information about your media files and puts it into a database. For more information see here

Name field may be empty

ansmit scanner information to ACNielsen

your own mind memokit.exe is running. Probably loads a flash screen at startup and shutdown that stays on screen less than 5 seconds and gives you a button to push to purchase the full version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and

See this article and make up your own mind

cting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe e Privacy Policy

aying a formatted email message"

s offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"! s offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"! s offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"!

y useful, if you have a wallpaper. Available via Start -> Programs

r in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

rer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder

orer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

er folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

er and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show op Shortcuts if you want access these programs quickly

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show

op Shortcuts if you want access these programs quickly

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show

r and should not normally figure in Msconfig/Startup! This file is located in a "Help" subfolder of the Winnt or Windows folder

nd should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

essible via Start -> Settings -> Control Panel

in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

you added it manually. This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

antivirus executable as described here

n Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show

isual SourceSafe program

he System32 folder. This worm file is placed in the Winnt or Windows folder

er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

er and should not normally figure in Msconfig/Startup! This file is located in a "s1613" subfolder

and should not normally figure in Msconfig/Startup! This file is located in a "protect" subfolder and should not normally figure in Msconfig/Startup! This file is located in a "JavaVM" subfolder

nd should not normally figure in Msconfig/Startup! This file is located in the System folder

rld using a dial-up or broadband Internet connection on your computer" - is it required in startup?

er and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder

closed, but mv-ctrl does not have its own EXE file. Only needed when using the capture card, e.g. for the above actions

settings. Available via Start -> Settings -> Control Panel or Start -> Programs

on of doing away with the ads by purchasing the screensaver for a whopping $30...

lly appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

The risk can then send the logged information to a remote attacker via email, must be manually installed be running in order to use the MIDI functionality of the Digi002R

les are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case then re-enable it

a game switches to full-screen

s (which are still 16-bit on Win9x) to perform background processing. Some soundcards need this to support MIDI, etc

appings, printer settings, IP settings and much more

nd should not normally figure in Msconfig/Startup! This file is located in a "tasks" subfolder of the Winnt or Windows folder

oad. They claim they are adware free, and a visitor quotes "I have seen no instance of any since using it"

g of Office files on your computer's hard disk. As with Find Fast - a waste of resources. If it can't be disabled via MSCONFIG try here

ktop shortcut or Start -> Programs - not required ktop shortcut or Start -> Programs - not required art -> Programs - not required ve/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required ktop shortcut or Start -> Programs - not required ve/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required

be painful during system start

stay on the internet on their line and $$$ and remove the C:Program FilesMovieNetworks directory

ed test) your hard disk drives and your CPU load". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind

metimes though - see here and here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus

play/pause, next,previous) etc

should not normally figure in Msconfig/Startup! This file is located in the System folder

in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

at you are running in Selective Startup mode

ked after changing an Msconfig entry and rebooting

s Msconfig which has the same executable name

s Msconfig which has the same executable name

at you are running in Selective Startup mode

ecked after changing an Msconfig entry and rebooting

ms I don't know but I was asked to include it here. It automatically runs in the background

er, and should not be mistaken for the MSN Messenger file of the same name! the MSN Messenger file of the same name!

ces and uncheck "Run this program when Windows starts"

older and should not normally figure in Msconfig/Startup! This file is located in an "MSOffice" subfolder

, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder!

l PayPal funds in the name of the victim!

ww.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage

y useful, if you have a wallpaper. Available via Start -> Programs by the US military which will allow purchase request packages to be electronically submitted to contracting, and which also facilitates electronic receipt of items and EFT) - what does it do and is it required

l cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled

way with the ads by purchasing the screensaver for a whopping $30... ms and registry, or only scan files in a specified folder or drive

s from Google, Ask Jeeves, Yahoo and LookSmart, along with sponsored listings, primarily from Google." Older versions had security issues but the current versions do not

isabled the button on a Maxtor OneTouch External Store no longer functions isabled the button on a Maxtor OneTouch External Store no longer functions

running when your firewall is running

n problems. Available via Start -> Programs n problems. Available via Start -> Programs s from Google, Ask Jeeves, Yahoo and LookSmart, along with sponsored listings, primarily from Google." Older versions had security issues but the current versions do not

r reports disabling it has no detrimental affect - not required resource hog but required for DAT updates and if disabled can also cause random freezes and error messages

stations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan stations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

on AV processes

etwork diagnostics, and much more

ray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have

s in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in the System (9x/Me) or System32 (NT/2K/XP) folder

required if you find it helps improve your performance

browse faster, surf faster!. Only required if you find it helps improve your performance

nd hangup at predefined times and automatic redialing of dropped connections"

ad) speed limits for applications or even single connection. NetLimiter also allows you to share your internet connection bandwidth among all applications running on your PC."

ages. It has a number of other features as well

e Messenger (the new name for the embedded AIM, no doubt to make it sound like Windows Messenger, the XP version of MSN Messenger). Basically, netscape.exe can be more than just Netscape Messenger, and Messenger can be more then just AIM in disguise, depending on the version of Nets

nd should not normally figure in Msconfig/Startup! This file is located in a NETSTART subfolder

our computers' clock with a server on your local net or the internet using any of several protocols, e.g. NTP."

cation field. It also puts an icon in the system tray icon that is a circle with the letter N in the center to access the menu faster. Available via Start -> Programs

ween these network interfaces. Located in Startup folder so make own shortcut to it and disable if not really necessary

lder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

the paid-for version currently available

g, extensive input/output options, advanced filtering, batch processing and an easy-to-use interface, ProCoder 2.0 is the ideal solution for high-quality multi-format video creation"

version of the software in order to remove the reported threats

ames are UWFX5LP_0001_0802NetInstaller.exe, UWFX5V_0001_0802NetInstaller.exe, UWFX5_0001_N66M1101NETINSTALLER.EXE, 1D7C.tmp, WinFixerScannerInstall[1].exe

nect to the Internet. Made by Netintelligence Ltd

ling it means loss of internet connection until renabled - therefore required if you use it

anges so that you can run servers on computers with dynamic IP. Shortcut available

nd the tray icon shows if a phone has been connected. If you have a conflict with another program, such as TV tuner card remote control monitor, you can disable it, and run only when needed. Available via a desktop shortcut or Start -> Programs - not required ou can also use it to browse your phone, edit the phone list and so on MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected

and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder. Also, this is not part of Norton AV

ograms. Delete the shortcut in the Start -> Programs -> Startup folder as well

hat may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it

Norton Anti-Virus scans Norton Anti-Virus scans

and should not normally figure in Msconfig/Startup! This file is located in a "D5133" subfolder

t in the Start -> Programs -> Startup folder as well

d should not normally figure in Msconfig/Startup! This file is located in a "Temp" subfolder of the Winnt or Windows folder. It also has nothing to do with Norton AV

e data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty d which has the same executable name d which has the same executable name

be mistaken for the MSN Messenger file of the same name!

is valid - see here

hould not normally figure in Msconfig/Startup! This file is located in a "Qossrv" subfolder

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder about a dozen instructions before exiting"

s: C:WINDOWSSYSTEMntldr.exe, C:m.exe, C:WINDOWSSearch-For-You.url, C:n.bat, C:q.exe, C:r.bat

er and should not normally figure in Msconfig/Startup! This file is located in a "dll32" subfolder of the Windows or Winnt folder

's needs 16-bit DOS drivers. You can find a bit more about NTVDM here

sing NuTCracker or any 3rd party package that is using it. Since you might not know what is actually using it it's probably best left alone

er and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

asily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if e

nce aggressiveness and hardware voltages. Will also display a dynamic graph of CPU and system temperatures, hardware voltages, and memory bus speeds

he game "Everquest". Otherwise, settings can be changed manually via Display Properties

he game "Everquest". Otherwise, settings can be changed manually via Display Properties he game "Everquest". Otherwise, settings can be changed manually via Display Properties

he game "Everquest". Otherwise, settings can be changed manually via Display Properties erformance difference without it

untered with this service active, but no adverse side effects with it disabled. NOTE: If using drivers other than nVidia's, such as Asus, this service may have been renamed to reflect that

However, this isn't necessary for the operation of your system

in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up."

in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up."

uch as Word, WordPerfect, etc. Available via Start -> Programs

ormat to simple text

rfect gateway between your internal and external email"

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show

m there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show

OLE, with OmniPage. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs

n the screen for volume, etc. Nice but not required if you don't adjust things regularly - can also freeze

t -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number nterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls

er folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

age limit, and how far over your suggested limit you should be

niPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs g, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs mniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs

n the screen for volume, etc. Nice but not required if you don't adjust things regularly - can also freeze

'what's installed' without having to manually touch every computer in the company. The next time the computer logs into the network, a complete inventory (software and hardware) is taken of the system"

nd in the System (9x/Me) or System32 (NT/2K/XP) folder

should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

ysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately

s in PageKeeper. Pagekeeper comes bundled with scanners such has HP, Microtek, etc s in PageKeeper. Pagekeeper comes bundled with scanners such has HP, Microtek, etc for any files with those names it connects to the DownloadWare servers and tells it what, if anything, is found

d via dial-up modem

am due for whatever reason or even reformat. Available via Start -> Programs. Delete the shortcut in Start -> Programs -> StartUp as well otherwise it will be reinstated

ually so you don't need this but if you tend to forget then leave it

ually so you don't need this but if you tend to forget then leave it

e state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere

omputer is kept clean and in tip-top condition"

vites you to "order" the fee-based fixes from its web site

nd they also have problems removing it (see here) ntral location

partitioning your hard drive, making a compressed image of the working drive which will then allow you to revert to that should you need to

cause the screen dump page gets VERY big onnection. PC Suite can also be launched through Start Menu onnection. PC Suite can also be launched through Start Menu

shows if a phone has been connected. Available via a desktop shortcut or Start -> Programs

emove it you may not be able to use any of those functions omes back. It's better to leave it

d over a network

e with one. Not required if you don't have a remote control, or don't wish to use one

ns and authorities perform on the internet. PeerGurdian blocks connections for the configured IP ranges and logs the blocked connections" , a list editor, automatic blocklist updates, and blocking all of IPv4 (TCP, UDP, ICMP, etc)

eous security devices"

der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

it as it has a tendancy to crash/freeze if loaded with other applications at startup

to a service to allow multiple modules simultaneous read/write access to the keyrings, among other things. As you can imagine, it is necessary for PGPsdkServ to be running in order to perform practically any PGP functionality e PGP preferences database. The individual PGP modules normally access the preferences through PGPservice, but they are capable of a "fall-back" mode where they can handle such access on their own. Thus, if you are not running PGPnet, you may not immediately notice much of a difference if

calendar checker which checks the date on your system and updates your wallpaper accordingly

er and should not normally figure in Msconfig/Startup! This file is located in the "Program Files" folder , SnapFish, MacroMedia and others otoWise to print contact sheets and photographic prints. Create slide shows, screen savers, wallpaper and more."

your mailer can use to place under your messages"

r and run it manually u may try creating your own shortcut and see what happens

nds any, it posts a notification

an leave it enabled

tware is correctly registered. There are privacy issues though: "The Software includes a feature that assigns a unique order number to GameGain based on purchase information. The Software reports this number to us via the internet either when you run the Software or enter the registration num

duled tasks like defragmenting, ScanDisk, weekly virus scans and so on

re 2000 (rips audio CDs into MP3 or WAV files)

nternet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group

hat may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it

this. Do not support these guys!

les, close your applications and shut down your computer just like you would...otherwise, the APC UPS (Uninterruptible Power Supply) unit would go to battery until it wore down, then your computer would shutoff

should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

pp. If you don't have any mappings set up, it does nothing (except waste bytes and cycles). I disabled it using msconfig.exe with no problems"

ows between the different parts of the system) can be configured. This item is added to startup if 'Use predefined settings' is enabled in the programs options ows between the different parts of the system) can be configured. This item is added to startup if 'Configure system at logon' is enabled in the programs options

nd dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs

on your PaperPort Desktop

also program your PPK to turn on your SuperSlim Notebook at a predetermined time and perform simple tasks - completely unattended"

e transmitted to a remote user. If you didn't install this yourself remove it

g". Run manually unless you think you'll forget to check for updates on a regular basis

n using alternative file names like prttect.exe, prmtect.exe and so forth!

n using alternative file names like prxtect.exe, prdtect.exe and so forth!

n Msconfig/Startup unless you added it manually!

der, and which should NOT figure in Msconfig/Startup!

ay and CompaqPrinTray

s, both known and unknown, currently in use or presently being developed worldwide" loads of False Positives as goad to purchase

s, banners, pop-ups and other obnoxious Internet junk

n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth!

n using alternative file names like prxtect.exe, prdtect.exe and so forth!

bility and responsiveness, restricting executables from running, and logging of program executions" bility and responsiveness, restricting executables from running, and logging of program executions"

es equipped with 37 touch-sensitive music keys and accessible music controls for endless entertainment at your desktop. Coupled with the Sound Blaster audio card, you can explore a wide array of realistic instrument sounds and have non-stop fun making music right at your desktop"

nd should not normally figure in Msconfig/Startup! This file is located in the System folder

xplorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System32 folder

minute before the crash or the last known stable registry

rocessor clock frequency and voltage to reduce the power it needs by 40% n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prxtect.exe, prdtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! n using alternative file names like prttect.exe, prmtect.exe and so forth! le names like prdtect.exe, prtcct.exe and so forth! le names like prdtect.exe, prtcct.exe and so forth! n using alternative file names like prdtect.exe, prmtect.exe and so forth! n using alternative file names like prdtect.exe, prmtect.exe and so forth!

an leave it enabled

t Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group

from 3 PCMCIA power options - On, Auto1 and Auto2. Disabling this item has no adverse effects, except disabling the ability to reduce power consumption by powering-down the PCMCIA slots when not in use

disable if you do not use any power saving or hibernation settings (ie: they are all OFF) certain functions using this driver

pplied to the RAID array connected to the Promise controller e the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller

ot required from what I've read - may need a registry edit to get rid of it (2) Backdoor troja

that you must add a /T switch to the command line to get it to load to the taskbar

mproving access and performance for applications such as instant messaging, online gaming, and streaming music and video. See here

ect access to many frequently-required settings and parameters, enabling you to make your operating system behave the way you want. Boot-up options won't work if disabled oad them onto the internet). Available via Start -> Programs

tion is enabled, background downloading takes advantage of unused bandwidth to download current financial information anytime your computer is connected to the Internet

e as QCWLIcon, which is pertinent only to the Wireless LAN

ded you run it manually you overclock system components and need to monitor temperatures, etc you overclock system components and need to monitor temperatures, etc

for the Desktop Alerts feature

hether this is running or not

a certain number of rings. Available via Start -> Programs

you have to change resolutions on a regular basis

affect your ability to burn CDs. If you do not have this program running, you may have some compatibility issues with burnt DVDs

ry managers with Win98/SE/ME. See this article and make up your own mind

asted by Windows and other applications. In addition, RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows." MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make u setting a threshold that activates the program automatically, or by having it run automatically when an application exits. RAMpage is free, and open source

unknown programs trying to launch

up and recovery chores to the end user"

+ALT+DEL instead

p and running" talled malware

cking on the tray icon and disabling StartCenter via Preferences can have the same executable name can have the same executable name

ks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry

cking on the tray icon and disabling StartCenter via Preferences

d force the customer to send the PC back to HP for a re-image, possibly at the customer's expense

for the disk to be re-inserted to complete installation. Not required once installion is complete

they automatically update the software, can download other published content that it feels may interest you without your knowledge and share non-personally identifiable information with others in the network - but you must agree to this when installing the software

us also preventing malicious software like viruses, trojans and worms from using the registry to their advantage"

nd should not normally figure in Msconfig/Startup! This file is located in the System folder rsion resides in the System (9x/Me) or System32 (NT/2K/XP) folder

folder and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder

rt every 15 minutes...anywhere in the world."

text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note

are a common cause of Windows crashes and error messages"

text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note

0XP). The file is located in C:Windows

g to uninstall the Fuji software or the uninstall may not work correctly

and should not normally figure in Msconfig/Startup! This file is located in a WindowsMedia folder

ory managers with Win98/SE/ME. See this article and make up your own mind

or) to make the recovery CDs the entry will remove itself from the startup list

or) to make the recovery CDs the entry will remove itself from the startup list

rminates after the connection is closed

manage the workstation. Required if the PC is a managed workstation

on provided by their employer ate automatic deployment of security policies and software updates"

e with one. Not required if you don't have a remote control, or don't wish to use one e with one. Not required if you don't have a remote control, or don't wish to use one

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder dress, city, state, etc and gets written to a log file". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistan

downs and crashes

oss or system failure." required if your not using the program or don't care about that function

s, giving users one point of fast, accurate search for all personal information". Real-time scheduler - shortcut available eble etc) will not be available

itial locations, and then corrects your registry entries to match the located files or folders TKIT.O TROJAN! n that appears on your System Tray. Available via Start -> Programs

utomatically repair your settings to get you up and running in a flash"

e with one. Not required if you don't have a remote control, or don't wish to use one

with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools

System32 folder. This worm file is placed in the Windowsinf or Winntinf folder

will not recognize your recorder. After running this program you should receive the message "Engine initialized successfully with full recorder support". If you do not receive the message, update your Virus software and then check and clean your system for viruses. After the removal of any viruse

ated in a single application". Not required for Roxio to work properly. d burning will happen automatically". Not required for Roxio to work properly

er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder System32 folder. This file is placed in the Windows or Winnt folder der and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder nd should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

System32 folder. This file is placed in the Windows or Winnt folder ed with Win98/98se. Under Win98/98se, a program may need it to communicate with other components of itself. You could delete the program but if any abnormalities occur soon after then reinstall. Under NT, deleting this critical system component will disable the OS. For a more detailed explana

ets a lot of people panicking about there internet connection High CPU useage results - hence the U status

dows Messenger. Most people use MSN Messenger instead, so it is not required in those cases

ate manually on a regular basis

and should not normally figure in Msconfig/Startup! This file is located in the Windows folder

e software for a Guillemot Maxi Muse sound card (PCI) the run line in win.ini if you do not want that feature

create program groups on the client and then launch SMS client programs

oft OfficeOffice folder!

asily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if e he game "Everquest". Otherwise, settings can be changed manually via Display Properties

e the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller

pplied to the RAID array connected to the Promise controller

should not normally figure in Msconfig/Startup! This file is located in the Windows folder ng entry Bluetooth authentication agent", click here here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup

and should not normally figure in Msconfig/Startup! This file is located the Winnt or Windows folder r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

e program and is an optional setting. It can be disabled from within and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

x / Plus) operating systems

T2KXP). This file is found in the Windows or Winnt folder

es this perform and is it required?

in near-real time. When problems are detected, you're immediately notified by e-mail, pager, or text messaging

ock unwanted or harmful applications from accessing the network" ock unwanted or harmful applications from accessing the network"

atures on the buttons. Only required if you use this feature

he reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds, but once the software sees there's no reader, you get back the resources

out-of-office users

tartup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it oftBank. See here for more information

gets written to a log file. The SBC Self Support Tool is required to run with the Help and Support program. If you uncheck SBC and and then run Help and Support it will add another SBC entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and o become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection

ses of Internet pages visited, and maintains a log file listing all applicationsrun on the computer. It can create screenshots and record sounds from the computer's microphone to a sound file

our anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active utomatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button

e not scanregw.exe

(where %windir% is the Windows directory - C:Windows or C:Winnt) in %windir%System (where %windir% is the Windows directory - C:Windows or C:Winnt). Runs from the registry RunServices key as opposed to the Run key

9x/ME machines. This worm file is found in the System (9x/ME) or System32 (NT/2K/XP) folder

not be mistaken for the MSN Messenger file of the same name!

. Required if you have regularily scheduled events such as weekly virus scans . Required if you have regularily scheduled events such as weekly virus scans

you will need it. Available via Start -> Programs provides a restore function. This part takes a snapshot of your system following a healthy re-boot

number. Now obsolete after Scotiabank modernised their login process number. Now obsolete after Scotiabank modernised their login process

s will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information artup. It will function regardlessly

you didn't install this yourself, remove it

internet. Lock files, monitor programs' activities, even detect intruders! PC Security offers flexible and complete password protection, "Drag and Drop" support, plus many other handy features'

utomatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button

ndardized way - is it required at startup?

m process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder! This file is located in a "sds20" folder entic, confidential and digitally signed

oint and Email

cy Protector, History Cleaner, and Garbage Cleaner mileys also adds other features such as logging of IM conversations, and it gets rid of that annoying advertisement on your buddy list window

and your information is kept private

formance and executes commands in a snap. Just by using your mouse, pen, or touchpad, simply draw symbols to execute actions instantly our website". Will be detected by most firewalls and the majority of home users should disable it

r and should not normally figure in Msconfig/Startup! This file is located in a "D5133" subfolder

2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

er and should not normally figure in Msconfig/Startup! This file is located in a Services{C922CCC4-CF61-4589-A0D1-828160704853} subfolder er and should not normally figure in Msconfig/Startup! This file is located in a Services[random] subfolder nd should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder nd should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif

nd should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder and should not normally figure in Msconfig/Startup! This file is located in "config" subfolder er and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder

will run at startup and then terminate - hence the U recommendation

er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

lder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

der and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

and should not normally figure in Msconfig/Startup! By default this file is located in Documents and Settings[user name]Templates pear in Msconfig/Startup! and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder and should not normally figure in Msconfig/Startup! By default this file is located in Program FilesCommon Files

d should not normally figure in Msconfig/Startup! This file is located in a msagentsystem subfolder of the Winnt or Windows folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder der and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

nd should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

net, mobile handsets and digital TV

a free program that downloads and analyzes radio telescope data a free program that downloads and analyzes radio telescope data a resource hog

s unobtrusive as possible'

der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

e under Start -> Programs -> Accessories -> Communication (or similar) anyway

l performance qualities"

d hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" d hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks"

ccess and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups

t. Name field may be empty users to upload scanned images to their personal webpages if desired. Available via Start -> Programs

nfig/Startup unless you added it manually! This one is located in the System subfolder config/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder n Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

and loads unique drive icons for the various card slots that are displayed in Windows Explorer

me. Could be a registration reminder for the trial version should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder nd selecting Shockwave and then Shockwave Remote under Programs

Motherboard.It mean Show "LAN on Motherboard" Control.On systems where you can install an external LAN interface, it will warn you that you already have a built-in LAN interface. Appears to be a feature on certain Dell systems

eyboard driver's taskbar entry from reappearing. It is not necessary to remove the keyboard software, however if you wish it can be removed through Add or Remove Programs" Start -> Programs

al display you configure and control

OS, Free Ram, your current time and more" subscribed to has something to say

onal telephone number. See here for more information. Must be disabled in MSCONFIG before un-installing or it re-instates itself

se another graphics card and disable the on-board

f you want to receive messages

omputer come out of hibernate mode ses (known as MagicWords), so C:Program FilesOutlook Expressmsimn.exe becomes MAIL add it manually! uses your home network to access the music stored on your PC"

ion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server sion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server ion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server

networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio

yers, slideshow and image viewing panes, a virtual desktop manager, and live news, weather and stock feeds to mention but a few

count comment. The Client service then waits for the synchronization of the comment to verify that the account and user rights are properly set for this account. This account is used to obtain a token to start the SMS Client processes, such as the Software Inventory and Software Distribution agent

nd should not normally figure in Msconfig/Startup! This file is located in a "Catroot" subfolder

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

d should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder not normally figure in Msconfig/Startup! This file is located in Program FilesWindows Media PlayerSkinsWindowsMediaSkinDataLevel4 folder

in Msconfig/Startup unless you added it manually! This one is located in a "Template" subfolder

small office network and SNDMon is disabled on one of the computers - then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation

, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe ecomes an "inkable" surface that you can add comments to and mark up however you like. You can then save that annotated image to use later, or send it to someone else in an E-mail message

rt -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory).

eath) if left out

al process to the running of the system, but should not be terminated unless suspected to be causing problems

un at start-up every time? art-up every time?

a date, and be repeated daily, weekly, monthly and yearly

all modems. If you find this improves your connectivity and download speeds leave this enabled

up is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line)

ine audio. The technology adjusts the audio streaming to match your Internet connection speed, which helps eliminate sound distortion or choppiness. Available via Start -> Programs

ur enterprise. It then builds a private, secure relationship network for each user without any additional manual data entry" t boot. Name field may be empty

der and should not normally figure in Msconfig/Startup! This file is located in a "HELP" subfolder of the Winnt or Windows folder

pyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all

pyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all

anting to start and terminates them giving you some options, how to deal with this process in the future

sing. This is the same company as E-mail marketers 'TrekData' and 'Blue Haven Media', who distribute spyware through ActiveX drive-by-download on web pages

see here and here

o Windows Server 2003. Does this indeed need to run at every bootup? ble the entry from loading into startup, then you will not be able to use the features of the sound card"

the "Remove unnecessary System Restore information on startup" box. Available via Start -> Settings -> Control Panel

ar in Msconfig/Startup!

ver on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program, open Add/Remove Programs, select either Communications (Me) or Networking Services (XP), and remove the checkmark next to Universal Plug and Play

wn the computer system in an intelligent and orderly manner"

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

surfing acts as your shield from Pop Up Windows, Mouse Traps, Window Resizing, and scripts that attempt to record your personal information. Available via Start -> Programs

ware is listed as mIRC. This one puts 10 files in the Windows or Winnt folder

f resources (over 60%) consumed by this program, it is unsuitable for Windows 95/98/SE/Me er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

trol your printing environment and manage your printing operations. Available via Start -> Programs

art -> Programs

ter-Strike: Condition Zero are all being made available through Steam. Steam games are automatically kept up-to-date with the latest content and revisions. Steam also includes an instant-message client which even works while you're in-game

may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners

twork to see if the SpeedTouch ADSL modem connection is working properly. Not required if connected via Ethernet (and probably USB). Can cause a slow down in Win2K - see here

ccess and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups

nges have occurred to your PC"

er and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder

p your own mind

herefore treated as spyware - now the web-site is dead

e a service's current state, get the displayname for a service and vice versa

of your choosing. You can set it to clear your Internet cache files, cookies, history, temp folder, etc. It can also clear the history of your Run and Find menus, in addition to the AOL cache

windows and banner ads from Web pages. An intelligent tune-up tool automatically analyzes and optimizes your computer's Internet connection and TCP/IP settings" you either exit out of it or select "take survey later"

/Startup unless you added it manually!

/Startup unless you added it manually!

sconfig/Startup!

er and should not normally figure in Msconfig/Startup! This file is located in a "System1060" subfolder of the Winnt or Windows folder

nd should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

older and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder of the Winnt or Windows folder

der and should not normally figure in Msconfig/Startup! This file is located in the Program FilesInternet Explorer folder hould not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder older and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programas" folder der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder nd should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

lder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

der and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder

by File Metrics, Inc. Users can search for and find almost any type of digital file (audio, video, photos etc.) through a secure peer-to-peer network

o have SweetIM installed

current dialup connection, lock workstation, etc

reless switch on if disabled)

ndardized way - is it required at startup?

tup. Available via Start -> Programs

small office network and SNDMon is disabled on one of the computers - then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation

- mentioned elsewhere here. Personally I only have Norton eMail Protect running which doesn't need SymTray

ltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll

lder and should not normally figure in Msconfig/Startup! This file is located in an "golumm" subfolder

n Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

oot. Name field may be empty

issues found can be fixed. Many of the "invalid" items found appear suspect. This has been reported to be distributed in wild via trojan Vundo. Other incarnations of this software exist with the same model and similar web presences (for example WinFixer). For more information see here

in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder in the Windows or Winnt directory

ntified as spyware and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

and should not normally figure in Msconfig/Startup! This file is located in a "HELP" subfolder of the Windows or Winnt folder

er and should not normally figure in Msconfig/Startup! This file is located in the Program FilesCommon Filessystem folder

completely random ones such as 9a2de006.exe, 36c75e3c.exe and so on

orer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

hould not normally figure in Msconfig/Startup! This file is located in the System folder

nd should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder der and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

he legitimate systray.exe process

ar in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder der and should not normally figure in Msconfig/Startup!

prescheduled times

and should not normally figure in Msconfig/Startup! This file is located in a Configsystem subfolder of the Windows or Winnt folder and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder

and should not normally figure in Msconfig/Startup! This file is located in a addinsexplorer subfolder of the Winnt or Windows folder and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder

and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

e run automatically in a silent, undetectable mode

d should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

such as Virusscanner Pro

SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel

SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel

ot. Name field may be empty

contain adult content

ocated in the Windows folder on Win98/ME systems, and in the WinntSystem32 or WindowsSystem32 folder in WinXP/NT/2K!

in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder

s in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users

Create your own shortcut if you need to run it ad hoc. If you forget to run it before running Paint Shop Pro & Adobe Photo Shop) you may find the following: (1) Paint Shop Pro (version 7.04) - (a) Browse function will NOT work (program freezes) (b) On program exit, PSP does not terminate (you have

nd should not normally figure in Msconfig/Startup! This file is located in a "tasks" subfolder of the Winnt or Windows folder

ge while installing the Audigy drivers, see this Microsoft Knowledge Base article -> Display -> Settings -> Advanced -> General. Also appears if you have Win95 with the QuickRes "Powertoy" installed

ar in Msconfig/Startup unless you added it manually! This one is located in the System folder ning the delayed services after boot. Available via a desktop shortcut

es in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP). It is not normally on a WinXP system

o records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solv and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

Also allows you to launch the Taskbar via right-click -> Show Taskbar. The tasktray can be accessed via Start -> Programs -> Creative -> Sound Blaster Audigy -> Taskbar

or keyboard focus

gs -> Control Panel

stay up and running"

ence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information er and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder

d file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"

st, Cox and Charter (Pipeline Support Agent)) that allows them to offer on-line support - to update drivers, fix faults, etc. Can cause a deterioration in a PC's peformance (see here). This part does the protection and "self-healing". Uninstallation is recommended by most people - especially for Syste it has the ability to retrieve user information. Whether it does so depends upon the provider. "tgcmdprovidersbc" is for SBC Yahoo DSL. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation it has the ability to retrieve user information. Whether it does so depends upon the provider. "tgcmdprovidersbc" is for SBC Yahoo DSL. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation

ool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs it has the ability to retrieve user information. Whether it does so depends upon the provider. "tgcmdprovidersbc" is for SBC Yahoo DSL. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation

dule to each sequence

dn't, like the one that immediately blackens your screen d by head-to-disk contact

s a misspelled word, and checks the spelling of every word you copy to the clipboard"

, week number, GMT/UTC time, Swatch Internet Time and Sounds at each full, half or quarter hour Endpoint itself which will continue to function normally"

ed TiVo Series2 DVR and your computer

e Company's Software, you will see occasional banner ads, pop-up or pop-under ads, or other types of ads selected based on your online activities .../... Occasionally, we may automatically or through other remote means, update, upgrade, patch or uninstall the Company's Software, including the C

o o o o o o

disable disable disable disable disable disable

it. it. it. it. it. it.

Also Also Also Also Also Also

see see see see see see

evntsvc evntsvc evntsvc evntsvc evntsvc evntsvc

and and and and and and

Realsched. Realsched. Realsched. Realsched. Realsched. Realsched.

Note Note Note Note Note Note

that that that that that that

eventsvc.exe eventsvc.exe eventsvc.exe eventsvc.exe eventsvc.exe eventsvc.exe

no no no no no no

longer longer longer longer longer longer

appears appears appears appears appears appears

to to to to to to

be be be be be be

in in in in in in

a a a a a a

newer newer newer newer newer newer

version. version. version. version. version. version.

To To To To To To

disable disable disable disable disable disable

"tkbell.exe" "tkbell.exe" "tkbell.exe" "tkbell.exe" "tkbell.exe" "tkbell.exe"

in in in in in in

the the the the the the

new new new new new new

version version version version version version

(1) (1) (1) (1) (1) (1)

Start Start Start Start Start Start

RealOne RealOne RealOne RealOne RealOne RealOne

Player Player Player Player Player Player

(2) (2) (2) (2) (2) (2)

Tools Tools Tools Tools Tools Tools

-> -> -> -> -> ->

Preferences Preferences Preferences Preferences Preferences Preferences

(3) (3) (3) (3) (3) (3)

Automatic Automatic Automatic Automatic Automatic Automatic

the AccuPoint up or down. It also allows zooming by holding CTRL + SHIFT and moving the AccuPoint up or down. Disabling this item has no adverse effects, except disabling the scroll/zoom features of the AccuPoint

ore starting a gaming session. However, for simplicity, it can be left checked to let it run once at startup to automatically overclock the graphics card. In this case, it doesn't even run in the background after doing its job

entally hit the Caps Lock key

2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "Documents and Settings[User]Local SettingsApplication Data" folder

and should not normally figure in Msconfig/Startup! This file is located in the "Documents and Settings[User]Local SettingsApplication Data" folder

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

g to minimize, resize, move or close other programs or files

services services services services services services

in in in in in in

the the the the the the

Categories Categories Categories Categories Categories Categories

pane pane pane pane pane pane

(4) (4) (4) (4) (4) (4)

Uncheck Uncheck Uncheck Uncheck Uncheck Uncheck

all all all all all all

options options options options options options

and and and and and and

then then then then then then

OK OK OK OK OK OK

der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

ght. Available via Start -> Programs finds any, it posts a notification. Disabling instructions here on other laptops reduce the processor clock rate, etc. Required if you run off battery regularly

nd locks three pages on boot and then releases them on standby/hibernation for ACPI.SYS in order to solve the above problem

sion of the WinME product preview Windows Media video file that cannot be stopped to my knowledge until it finishes. That prompt will keep popping up after an install/reinstall of WinME until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 m

ch as the Thinkpad T30

hin program, is available from Programs > Access IBM. Not required external keyboard. Available via Start -> Programs

ect the external drive without an error message being displayed

d Drive Active Protection system is based on a technology similar to that used in automobiles to deploy airbags on contact: An accelorometer on the motherboard detects physical acceleration--such as when the notebook falls--and in response the system temporarily parks the hard drive's read/wr

screenshots to a preconfigured server. If you didn't install this yourself remove it

ndows Tweaks -> Desktop Tweaks -> Make Desktop Icons Transparent

ndows Tweaks -> Desktop Tweaks -> Make Desktop Icons Transparent

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

gs -> Control Panel

ites will know how connected monitors display color and will send them color corrected images" unction of truetyp: Hot-keys, autodismount, etc

r the clipboard ve approach to the internet". Only needed if you find it improves web browsing make up your own mind

tware". Autointsalling spyware

pen type headphone, or closed type headphone. Each setting has presets for Bass, Stereo, and Clarity - which can also be changed by user if desired. Can also be launched from Start -> Programs -> Toshiba -> Utilities

in WinMe/2K and above, available from here

boot. Name field may be empty

s, defer back to their default settings. Not required unless you have changed them

computer use - similar to SETI@home but for medical research. Available via Start -> Programs

ekly/monthly/yearly basis if you've created them. Not required - change them manually. See here for disabling instructions

g for truly universal printing through Terminal Services or Citrix

DEsecureinstall.exe if still present in C:\Windows\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents

r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder er and should not normally figure in Msconfig/Startup! This file is found in a "winupdate" subfolder r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder der and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif

Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups

e, Update Manager will inform you and, with your permission, download and install the update. Can go to http://www.earthlink.net and download the updates manually

HP and Compaq desktop computer owners". * can be any digit each fantasy matchup you want tracked either in one league or across all your leagues"

e, Update Manager will inform you and, with your permission, download and install the update. Can go to http://www.earthlink.net and download the updates manually

er and should not normally figure in Msconfig/Startup! This file is located in a "TEMPER" subfolder of the Windows or Winnt folder

unning processes, netstat and several more things

klist. It should not be disabled" web page supports it m only to their specific network services and resources

when on-line wheras the older version did but did not transmit any user information

its presence on the computer and can be disguised in the Windows Task list

Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out /2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program FilesCommon Files folder he System32 folder. This file is placed in the Windows or Winnt folder XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program FilesCommon FilesSystem folder and should not normally figure in Msconfig/Startup! This trojan file is found in the Windows or Winnt folder

st uncheck "Use Windows to configure my wireless settings" for the program to work properly. Has Site Survey capabilities, and reports link quality and signal strength. Not required for proper operation of the device as the features given are accessible in the network connection properties

oot-ability and recovery. See note

eath) if left out

e state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere ausing problems

efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here

efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here

irtual CD-ROM drives at a speed of 200X for true multitasking

ets written to a log file. Verizon Online Support Center is required to run with the Help and Support program. If you uncheck Verizon Online Support Center and and then run help and Support it will add another Verizon Online Support Center in the startup menu. If you remove the Verizon Online Su

ery file when opened, closed, etc. Check in InoculateIT PE options ery file when opened, closed, etc. Check in InoculateIT PE options

Can be run manually via Start -> Settings -> Control Panel by enabling auto-updates temporarily, re-booting and then disabling again. Not recommended as Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything " l change from what we know in 2006 according to this article. You can remove it via Start -> Settings -> Control Panel -> Add/Remove Programs list...

u on request... u on request...

efinitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here

users, you'll see a scanner icon in the Windows Tray of the Taskbar. Click this icon and a menu opens

an leave it enabled er calls, you will be asked to buy credits first

otherwise maybe not

taneously on one workstation. This process provides additional functionalities such as Shared Folders

automatically or available via Start -> Programs

automatically or available via Start -> Programs the "vtpass.exe" file

sing problems

ostensibly to avoid "losing" data

alware, and after the 30 days some of the more advanced features will be disabled unless you register it

ble within the program options - otherwise it is re-enabled in MSCONFIG

ble within the program options - otherwise it is re-enabled in MSCONFIG

ired as they give instructions on removing it on their webpage

nget's privacy policy used to state that they also collect and share individuals information but this is no longer the case nget's privacy policy used to state that they also collect and share individuals information but this is no longer the case nget's privacy policy used to state that they also collect and share individuals information but this is no longer the case

bundles GAIN adware. You can get the adware free version for a whopping $30..

to launch it at boot. Name field may be empty

nd it improves web browsing. Spyware and troublesome - see here

their performance and, most important, what the user actually does while there

d-users with software updates, technical support and new product information customized to their specific needs through a persistent link"

t malicious ActiveX programs, etc

ect your privacy by deleting your web surfing history on a regular basis". Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30..

d be "U". Can anybody confirm this?

are. It should disapear after a restart of the system. If not fix it

oving ICQ bomb after being exposed." For more information about ICQ bombs see here w fax/telephone icon. Available via Start -> Programs

satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creatin

nget's privacy policy used to state that they also collect and share individuals information but this is no longer the case

on created by this virus is saved in the C:WindowsSystem directory

of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. The specific function of this is to load MIF's in order for Dell OpenManage Cli

default player for various media types. Available via Start -> Programs

default player for various media types. Available via Start -> Programs

pear in Msconfig/Startup! always located in the System32 folder. This file is placed in the Windows or Winnt folder

t value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty

and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatusMicrosoft" subfolder of the Windows or Winnt folder

oot. Name field may be empty

should not normally be seen in Msconfig or as a Startup item. This file is loacted in the System (9x/Me) or System32 (NT/2K/XP) folder

s visited, every program launched including the path to that program, and more"

ble within the program options - otherwise it is re-enabled in MSCONFIG

Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins

Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

and should not normally figure in Msconfig/Startup! ! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder

orer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder older and should not normally figure in Msconfig/Startup! This file is located in a "Windows" subfolder er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder er and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programasWindows 2004Tools" folder

nd should not normally figure in Msconfig/Startup! This file is located a driverswinsdriver subfolder

le names and folder locations

act a fresh copy of the file from the Windows setup cabs!

ystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP)

r and should not normally figure in Msconfig/Startup! This file is found in a "drivers" subfolder

dded it manually! ou added it manually!

Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

r and should not normally figure in Msconfig/Startup! This file is located a JavaBeans subfolder

ow you hear it. Available via Start -> Programs

der and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

System32 (WinNT/2K) or C:WindowsSystem32 (WinXP) rather than C:Program FilesWindows Media Player

der and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder

nd should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

n Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder

orer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

er folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP)

Msconfig/Startup unless you added it manually!

r and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

should not normally figure in Msconfig/Startup! This file is located in the root folder (ie, C:)

nd should not normally figure in Msconfig/Startup! This file is located in a "Repair" subfolder of the Winnt or Windows folder

config/Startup unless you added it manually! This one is located in the System32 subfolder

to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative's sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Available via Start -> Programs

nd should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card

w fax/telephone icon. Available via Start -> Programs

> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card

of each workstation on the network reassuring clients that their workstations have connectivity with the WinGate Server

problems before they become serious". Resource hog. Available via Start -> Programs

(WinXP) whereas the valid "winhelp.exe" resides in C:Windows or C:Winnt

boot. Name field may be empty

and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatus" subfolder of the Windows or Winnt folder

at boot. Name field may be empty

ystem32 folder. This file is placed in the Windows or Winnt folder

stem32 folder. This file is placed in the Windows or Winnt folder

hould not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder d should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

sconfig/Startup unless you added it manually! This one is located in System1032 or System321032 subfolders

scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. BOClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulne

ed if you have it for loading the drivers. See here for more WinModem information

dows and display a clear desktop BOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking WFWG 3.11. Normally it won't set itself up to run unless the user specifically adds it to startup

cked and the engine still runs and functions normally. Can then use provided shortcuts for administration of the program. Loaded in SERVICES on Windows 2k

should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

appear in Msconfig/Startup!

id not have it installed

er and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder

e browser to the Lexus web site. Foistware - installs components without your knowledge

e browser to the Lexus web site. Foistware - installs components without your knowledge e browser to the Lexus web site. Foistware - installs components without your knowledge

not only help you achieve this task, but will actually make your system run faster and more smoothly than ever before"

didn't install this yourself remove it

t, if it's not already running. It then starts an application which manages the tablet messages. Since I leave the tablet unplugged unless I need to use it, I don't need this running at startup. I suspect that this program monitors a number of windows messages, so that when it's loaded, my regular m

/Startup unless you added it manually!

n Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder

s found in System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!

r and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programasWinXPTools" folder

and should not normally figure in Msconfig/Startup! This file is located a C:Arquivos de programasWinXP-98Tools folder

me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up

reless switch on if disabled)

can store items you want to later put into a document or other file in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder utomatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site. You can also turn of the automatic update feature within Picture It! - see here

ly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient

puter to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed. Check here for some details on what to do to stop it loading

tly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient

show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like er and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

nd a memory hog

ce is disabled the program does not work, but you can manually start/stop the service with a shortcut the program installs at any time

n online clock updater which connects with the U.S. National Institute of Standards and Technology. It was designed for parents who wish to keep an eye on what their children are doing online

nd repair UDF formatted disks"

rget reminders, tasks and other events."

and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

rams. If you didn't install this yourself remove it

state state state state

that that that that

they they they they

also also also also

collect collect collect collect

and and and and

share share share share

individuals individuals individuals individuals

information information information information

but but but but

this this this this

is is is is

no no no no

longer longer longer longer

the the the the

case case case case

puter. You can also share programs and computing resources with host computers connected to your PC over a network

site name on your computer. Approximately every 30 days, a person of your choice (an accountabiltiy partner) will receive an e-mail containing all possible questionable sites you may have visited within the month. This information is meant to encourage an open and honest conversation between

more WinModem information

er and should not normally figure in Msconfig/Startup! This file is found in a "xor" subfolder

LESXPOINTAGENT folder

der and should not normally figure in Msconfig/Startup! This file is located in an "SERVICES" subfolder

NT/2K/XP) folder and should not normally figure in Msconfig/Startup! The file is located in a "inet*****" subfolder of the Windows or Winnt folder - where ***** varies dependent upon the variant, examples are 20088, 20001, 10066

pyware programs. If you didn't install this yourself remove it

printing, drag and drop, optional permanent storage of clippings. Familiar "Outlook" interface'. Freeware

ault Internet settings and get updates to your software from Yahoo!"

re in the taskbar after YTrayMagic has initialized will be restored

ock, etc if it doesn't have them ock, etc if it doesn't have them

g of many of the Intel ProSET utilities (but not all) and these System Tray ProSET utilities are a must if you are using your wireless connection, if only so you know when the signal is fading or dropping. The problem is that, in some PCs, ZCFGSVC can be incredibly badly behaved : taking up to 100%

delete this file. This is as from IBM Technical Support (USA - 800-887-7435) nd should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder o online albums

ve. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running

and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder

plorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder

r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder

r and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder es. It is also capable of removing automatically most of known 'invaders'.

ed as spyware DEsecureinstall.exe if still present in C:\Windows\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents

in the same folder and should be deleted

sSystem32 folder, and ought moreover NOT to figure among the startups!

lder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder of the Winnt or Windows folder r in Msconfig/Startup unless you added it manually! This one copies it's self under 9 additional file names in the System (9x/Me) or System32 (NT/2K/XP) folder

lder and should not normally figure in Msconfig/Startup! This file is located in the Program Files/Common Files folder

r and should not normally figure in Msconfig/Startup! This file is located in a HelpHelp subfolder of the Windows or Winnt folder and should not normally figure in Msconfig/Startup! This file is located in a addinsexplorer subfolder of the Winnt or Windows folder

d. You can also give users allowed programs in their program-lists and you can limit the maximal daily hours and maximal weekly hours user spend on the PC"

and should not normally figure in Msconfig/Startup! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder

and should not normally figure in Msconfig/Startup! This file is located in a Connection WizardStatus subfolder of the Windows or Winnt folder nd should not normally figure in Msconfig/Startup! This file is located in a msagentwin32 subfolder of the Winnt or Windows folder

ere is no direct link to the file, but it's easily available using the search function

puter and try again

eally doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS, but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service." rom sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003

fiable. Please read the Privacy Policy. Not Recommended

rams" some help menus in help and support will not be available. You decide

problems when starting Windows

simply uncheck the entry in Msconfig > Startup Support in add/remove programs some help menus in help and support will not be available. You decide

t have no chance of synchronizing t have no chance of synchronizing

ppen with the result that Norton AntiVirus did not fully complete its installation or software updating. Recommendation : Start Norton AntiVirus from "Start Programs Norton AntiVirus". If Norton AntiVirus comes up without problems, then fix this entry from the Msconfig Startup tab - it was left behin

run if so desired

d Help in the add/remove program some help menus in help and support will not be available. You decide

n the System Tray notifies you when you get a message. When you get a message, a little alert pops up, which you can click on and start chatting immediately

ther Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support. You decide y and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not requi

s be located in the System32 folder, if it is located elsewhere it will likely be a worm or trojan! Can cause problems with some other programs if left enabled - see here for such an example

will always be located in the System32 folder, if it is located elsewhere it will likely be a worm or trojan! Can cause problems with some other programs if left enabled - see CIADOOR-Jhere for such an example

synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless

k all options and then OK t is not in startup, and the user needs to run it, they can simply type EVOLOSTA in the Start -> Run dialog to run it

s disabling this - if this is the case then re-enable it. Equivalent to MMHid in Win98. On HP Computers, HIDSERV is the controller for the keyboard sound controls on the USB and PS/2 keyboards should consult with knowledgable folks before deleting anything. Required if you'd like HijackThis to run a scan at startup, and show the results when new items are found (if so, check the appropriate box in the "Config" section")

ort in the add/remove program some help menus in help and support will not be available. You decide

ry CDs, the use of the multimedia keys, and the HP Instant Support. Also seen that without it running, the Riptide Sound card that was installed on some older HP computers stops working

ed CD-RW (CD-MRW) or DVD-MRW disks. To regain write access and other features, InCD 4 must start with Windows

t your financial services in order to report the issue and to have your passwords changed

e you set in SetPoint

the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images

folder and should not normally figure in Msconfig/Startup! This file is located in a "MDSA Software" subfolder of the Program Files folder

th Win98/SE/ME. See this article and make up your own mind

- if this is the case then re-enable it. Equivalent to Hidserv in Win98SE/2000/Me/XP

e, depending on the version of Netscape installed

cause extreme shutdown delays if enabled - see here)

Start -> Programs

ately notice much of a difference if you disable PGPservice. If you are running PGPnet, you will notice a big difference

tware or enter the registration number, or both. The Software may also identify and report to us your IP address, date and time of installation, registration and/or use. We use this information strictly to count the number of installations, detect unauthorized access or piracy of the Software, and dev

c right at your desktop"

8/SE/ME. See this article and make up your own mind

r "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation

r "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation

you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide

ses. After the removal of any viruses, uninstall and then reinstall Easy CD & DVD Creator (use "Add Remove Programs" in "Control Panel"). Can be run manually

the OS. For a more detailed explanation see here

cause extreme shutdown delays if enabled - see here)

ere is no direct link to the file, but it's easily available using the search function

ams" some help menus in help and support will not be available. You decide

ory and Software Distribution agents (MS Systems Management Server)

more information see here

te: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase)

t, PSP does not terminate (you have to CTRL+ALT+DEL to close it) (2) Photo Shop (version 6.01) - (a) Program functions slowdown (d) On program exit it takes noticeably longer to shut down (like 30-45 seconds)

ading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase)

y most people - especially for System Restore users (WinME/XP). If not available via Add/Remove, Charter offer some uninstallation instructions involving a registry patch that you may be able to modify for your proivder or try here

ompany's Software, including the Company's advertising-supported software, without further notice to you. These upgrades also may include installation of additional applications from the Company as well as third party applications"

k k k k k k

all all all all all all

options options options options options options

and and and and and and

then then then then then then

OK OK OK OK OK OK

run that annoying thing every 30 minutes, and don't bother deleting that entry, Windows puts it right back. Not only should you disable it from running, you should delete the thing altogether, as it, somehow can re-enable itself. Apparently you can try setting the file to read only

rarily parks the hard drive's read/write head until stability returns

twork connection properties

If you remove the Verizon Online Support Center in the add/remove program some help menus in help and support will not be available. You decide

val but doesn't spy or do anything "bad". This may change in 2006 - read this article

k or so. It could be started by creating a shortcut, running it only when connecting to the internet. If internet is used often, it's recommended to leave it in startup so it starts with the system

F's in order for Dell OpenManage Client to work

synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless

ggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled!

that when it's loaded, my regular mouse slows down - it acts like it 'sticks' entering and leaving windows. Certainly my performance returned to what I expected when I removed this item using MSCONFIG"

n Picture It! - see here

n and honest conversation between friends and help us all be more accountable

badly behaved : taking up to 100% of CPU time and therefore resulting in an extremely slow PC, preventing the installation of software or Windows updates, or causing "Not Responding" or "End this Program" shutdown problems. If you experience this, try first the very latest drivers from Intel or y

config Startup tab - it was left behind by mistake and is no longer needed now that Norton AntiVirus is fully installed and opens without error messages"

nder the "advanced" tab. Not required and can cause problems

time so it's best left disabled unless you need it

s or piracy of the Software, and develop rough statistical data regarding the geographic location of our users"

e file to read only

time so it's best left disabled unless you need it

he very latest drivers from Intel or your laptop manufacturer. If that still does not solve the problem and you have WinXP/2003, try setting the "Wireless Zero Configuration" service to disabled