0

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
	Note the filename has a ""0"" rather than an upper case ""o"""
N	%FP%012-L2TP fts.exe	fts.exe	012.Net.il Israeli ISP software front-end
U	%FP%012-L2TP FWPortal.exe	FWPortal.exe	012.Net.il Israeli ISP dial-up software
N	%FP%Barak013 fts.exe	fts.exe	Barak013 Israeli ISP software front-end
U	%FP%Barak013 FWPortal.exe	FWPortal.exe	Barak013 Israeli ISP dial-up software
X	(Default)	5640.exe	"Added by the DOWNLD-ABF TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	..	ABC2007.exe	"Added by the DLOADR-ASH TROJAN!"
U	000	pit.exe	"PrivateEye surveillance software. Uninstall this software unless you put it there yourself"
X	000hpdllhos	hpdllhost.exe	"LZIO.com adware downloader"
U	000StTHK	000StTHK.exe	Toshiba Hot key functionality for the function keys (Fn-Esc Fn-F1 (lock) Fn-F2 Fn-F3 Fn-F4 Fn-F5 (switching between laptop and CRT display output) etc...)
X	0050726-007-i32-1	0050726-007-i32-1.exe	"Added by the BANCBAN-EC TROJAN!"
?	00DSKSVR00	desksaver.exe	"Related to Advanced Desktop Shield"
?	00DSKSVR01	desksaver.exe	"Related to Advanced Desktop Shield"
Y	00PCTFW	FirewallGUI.exe	"PC Tools Firewall Plus - ""powerful free personal firewall for Windows that protects your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network"""
Y	00TCrdMain	TCrdMain.exe	Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards
U	00THotkey	00THotKey.exe	For Toshiba Satellite notebook series to use the front buttons play stop next prev.
U	00THotkey	system32THotkey.exe	For Toshiba Satellite notebook series to use the front buttons play stop next prev
U	0190 Warner	WARN0190.EXE	"Anti-dialer program (Germany)"
U	0900 Warner	WARN0900.EXE	"Anti-dialer program (Germany)"
X	0mcamcap	0mcamcap.exe	"Added by the COSIAM-H TROJAN!"
X	0utlook Express	****.exe [ = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
U	101Clips	101Clips.exe	"101Clips - ""the simplest of all multi-clipboard programs. Just have it running minimized and it captures everything you cut or copy from other programs. It keeps the last 25"""
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
?	17779Proj2002	N/A	"??"
X	180adsolution	180adsolution.exe	"NCase adware"
X	180ax	180ax.exe	"NCase adware"
X	180ClientStubInstall	stubinstaller***.exe [ = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	*****.tmp [ = random digit/char]	"180Solutions adware related"
X	196_150_ni	196_150_ni.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	197_150_ni_3	197_150_ni_3.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
X	2177F056-0AA6-4D6C-A944-13F71F341C29	sysokuaw.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	"3Com WinModem driver. See here for more WinModem information"
X	4684735485910	netdll32.exe	"Added by the SDBOT-DEV WORM!"
X	756349DC-6D9E-4F2A-9B24-269661F073C3	sysoghcx.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
U	802.11b+g USB Wireless LAN Utility	ZDWlan.exe	802.11b+g USB Wireless LAN Utility
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	98D0CE0C16B1	rundll32.exe D0CE0C16B1 D0CE0C16B1	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	@	iexpl0res.exe	"Added by the RBOT.AEX WORM!"
U	A1000 Settings Utility	cpqa1000.exe	Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan print copy and fax. Only required if you use these features
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	rundll32.exe E6F1873B.DLL D9EBC318C	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AAMSFree702	sys.exe	Added by the BACKDOOR-CPC TROJAN!
N	AccessRamp Monitor01	ARMon32a.exe	From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service."
N	AccessRampLAN01	ARUpld32.exe	Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003
X	Acess2007a	access2007a.exe	"Added by the GAOBOT.PQA WORM!"
U	ActiveKeys.AAB635BD7D054a37A576	akeys.exe	"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
X	ACTX1	v1201.exe	"Added by the VB.IS TROJAN!"
X	Adaware lptt01	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
X	Adaware ml097e	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
?	Adobe_ID0EYTHM	VERSIO~2.EXE	"Part of an Adobe product. What does it do and is it required?"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
X	adtech2005	adtech2005.exe	"Detected by Kaspersky as the STARTPAGE.AW TROJAN!"
X	adtech2006	adtech2006.exe	"Detected by Kaspersky as the VB.KC WORM!"
X	AdwareRemover2007	AdwareRemover2007.exe	"AdwareRemover2007 spyware remover - not recommended see here"
X	aimaol lptt01	aimaol.exe	"RapidBlaster variant (in a ""Aimaol"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	aimaol ml097e	aimaol.exe	"RapidBlaster variant (in a ""Aimaol"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
X	AntiSpyCheck 2.1.0	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended see here"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus2008y	antvrs.exe	"Antivirus 2008 rogue security software - not recommended see here"
X	AOL 9.0 Optimized	AOLClient.exe	"Added by the SPYBOTER.A TROJAN!"
?	AS00 Gear511	Gear511.exe	"Software for Netgear wireless network cards. Unknown whether it is required for the wireless card to run but does not seem to be a resource hog. Not required for laptop to run if the wireless network card will not be used. Is it at all required?"
N	AS00_Gear511	Gear511.exe	Netgear wireless LAN configuration utility
U	AS00_WN511B	WN511B.exe	"Netgear RangeMax NEXT wireless adapter configuration utility"
?	AS00_WPN511	WPN511.exe	"NetgearRev MFC Application - software for Netgear wireless network cards - what does it do and is it required in startup?"
X	ASDPLUGIN	100171be.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100176br.exe	"AsdPlug premium rate adult content dialer"
Y	ATI Remote Control	ATIX10.exe	"ATI Remote Wonder? - PC wireless remote control driver. Required if you use it"
X	ati2f104	ati2f104.exe	"Added by the DLOADR-BBW TROJAN!"
Y	ATIX10	atix10.exe	"ATI Remote Wonder? - PC wireless remote control driver. Required if you use it"
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX3200 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status checking ink levels etc etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX5400 on X	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX6400 on X	E_S4I2L1.EXE	"Epson Status Monitor 3 for the Stylus CX6400 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX7800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I2H1.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo RX500 on X	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Photo RX600 on X	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
N	AUXXTRAY	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
X	avp	xar6000v7.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
U	BACPI10	bacpi10a.exe	Known as "PowerKey" - a minimalistic keyboard driver that allows power management keys on BTC keyboards to function properly in older OS's (i.e. Win95/98/NT4). Also adds an icon to the system tray
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives FTP servers Removable Media (such as an USB disk)"""
U	BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMBgMonitor.exe	"Associated with Nero Scout added by version 7 of the Nero digital media suite (CD & DVD burning authoring etc). Thanks to Help2Go.com if you feel this is draining more resources that necessary you can disable it by clicking here"
U	BHODemon 2.0	BHODemon.exe	"BHODemon ""protects you from unknown Browser Helper Objects (BHOs) by letting you enable/disable them individually. When running it also monitors your Registry and alerts you when a BHO is installed. Best of all BHODemon knows about the most common BHOs - the good ones and the not-so-good ones!"". If you prefer forgoing resident protection the application can also be run on demand"
N	BigDog303	VM303_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
N	BigDog305	VM305_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
Y	BitDefender 2009	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames passwords and credit card details being acquired by web-sites and E-mails masquerading as a trustworthy sources"
Y	BitDefender 2009	bdagent.exe	"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"""
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
Y	BOC-420	BOC420.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.20"
X	Bsoft lppt01	Bsoft.exe	"RapidBlaster variant (in a ""BelmontSoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
X	BT00003*	abcdefg23.exe	"Added by the VB-VT TROJAN where * = 56 or 7!"
X	BT00003*	hiklmnop27.exe	"Added by the VB-VT TROJAN where * = 23 or 4!"
N	Calendar 200X Reminder	calendar.exe	"Calendar 200X - shows holidays reminders of various anniversariestasks etc"
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
N	Card Monitor	REGCNT09.exe	For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs
X	Care20	Care20.exe	"TopMoxie adware"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
U	CHotKey	MK9805.EXE	Enables special keys on Chicony keyboards. Special combinations include Internet E-mail vol+ vol- mute etc. Only required for extended features
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	cmt101	cmt101.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information tips ideas and special offers from HP and our partners especially designed for HP and Compaq desktop computer owners"". * can be any digit"
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
N	ControlCenter2.0	brctrcen.exe	Brother scanner 'Control Center' application - can be started manually
X	ControlPanel	popcorn320.exe rundll.dll LoadMouseProfile	"Added by a variant of the DLOADER-RA TROJAN!"
N	CorelCENTRAL 10	I_26dadCC.exe	"CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs"
U	CPATR10	CPATR10.EXE	Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba Compaq) to translate special hotkeys such as Play/Pause and Constrast
N	CplBTQ00	CplBTQ00.EXE	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
N	CPLDBL10	CPLDBL10.exe	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CTFM0N.exe	CTFM0N.exe	"Added by the STARTPAGE.P TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
X	CTin10	CTin10.exe	"Added by the BANCOS.E TROJAN!"
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows and make changes"""
U	Cyber-Defender 2003	uwcdsvr.exe	"Cyber Defender 2003"
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
N	D066UUtility	D066UUTY.EXE	TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software
U	DAEMON Tools-1033	Daemon.exe	"Daemon Tools - used to map an image-file (.iso .bin etc) to a virtual CD/DVD-drive"
X	DanBtR270414	DanBtR270414.exe	"Added by the VB-NIB WORM!"
U	DC300 Monitor	cmonitor.exe	Monitor for a Acer DC300 digital camera
U	Deko550	Deko550.exe	"Associated with the Deko550 entry-level SD real-time graphics system from Avid Technology"
U	Dell AIO Printer A920	dlbkbmgr.exe	System Tray application for the Dell Photo AIO Printer 920 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A940	dlbabmgr.exe	System Tray application for the Dell Photo AIO Printer 940 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A960	dlbfbmgr.exe	System Tray application for the Dell Photo AIO Printer 960 that enables scan or fax functions to run directly from the printer via the buttons
N	Desktop Plant	AZARE10S.PLT	"Vritual plant from here - this version is an Azalea there are others so the filename may be different"
U	DeviceDiscovery	hpotdd01.exe	Detection of new imaging printing and other peripherals on HP machines such as USB printers cameras and Bluetooth products
N	DigiGuide	client01.exe	TV guide and reminder
?	Disable EHCI	nousb20.exe	"??"
N	Distiller Assistant 3.01	DISTASST.EXE	From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs
X	DivX MediaPlayer 7.0	Dr.DivX.exe	"Added by the ALADINZ.G TROJAN!"
X	djtopr1150.exe	djtopr1150.exe	"WebRebates adware"
X	Dkware lptt01	dkware.exe	"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Dkware ml097e	dkware.exe	"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
N	DLF_00000B00	Vcdlf.exe	"Known to cause problems with "Out of memory" errors (see here). Otherwise it's purpose is unknown"
X	dnam	d140113.a.Stub.EXE	"Added by the STUB_A TROJAN!"
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000093.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-110-12-0000079.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended see here"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads amongst other features. Available via Start -> Programs. Note that the free version is adware based"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended see here"
N	dumprep 0 -k	dumprep 0 -k	Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
N	dumprep 0 -u	dumprep 0 -u	Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
Y	DWQueuedReporting	dwtrig20.exe	"Related to System Event Notification Services from Microsoft. Required for Efficient Mobile Network Computing"
U	E06DXLRD_7604703	EDICT.EXE	"Related to Microsoft Encarta dictionary functions"
N	EarthLink ToolBar 5.0	etoolbar.exe	EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar but you can delete these or add more buttons any time
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
U	eDonkey2000	edonkey2000.exe	File sharing network - not recommended as the free version of this application should be avoided as it installs without permission New.Net Webhancer WebSearch Toolbar and WinTools
X	EDxMC110	Isass.exe	"Added by the VB-NIA WORM!"
U	eFax DllCmd 4.0	J2GDllCmd.exe	"DLL Command Utility for version 4.0 of eFax Messenger from j2 Global Communications Inc. - which ""is powerful Internet fax software that makes it easy to create annotate sign zoom and print faxes from any computer"""
U	eFax Tray Menu 4.0	J2GTray.exe	"System Tray access to version 4.0 of eFax Messenger from j2 Global Communications Inc. - which ""is powerful Internet fax software that makes it easy to create annotate sign zoom and print faxes from any computer"""
X	efaxs lptt01	efaxs.exe	"RapidBlaster variant (in a ""efaxs"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	efaxs ml097e	efaxs.exe	"RapidBlaster variant (in a ""efaxs"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	ei10.exe	ei10.exe	"Added http://www.sophos.com/security/analyses/viruses-and-spyware/w32agobotnk.html"" target=_blank>AGOBOT-NK WORM!"
X	emoc0re	emo.exe	"Added by the AGOBOT-AGE WORM!"
X	empin	e121307.exe	"Delfin Media Viewer adware related"
X	empin	e121307.Stub.exe	"Delfin Media Viewer adware related"
N	EN4060C Taskbar	en4060ct.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF DOC HTML TXT Multi-page TIFF JPG GIF PNG and many more!"" Can be started manually"
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF DOC HTML TXT Multi-page TIFF JPG GIF PNG and many more!"" Can be started manually"
N	EPS	e_srcv02.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPS	e_srcv03.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C40 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C41 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C42 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C43 Series	E_S08IC1.EXE	Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C43 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C44 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C48 Series	E_S4I091.EXE	Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C60 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C61 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status checking ink levels etc
U	Epson Stylus C62 Series	E-S0BIC1.EXE	Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C62 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C63 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C64 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status checking ink levels etc
U	Epson Stylus C82 Series	E_S0HIC1.EXE	Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C82 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus C84 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX3200	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX5400	E_S4I2G1.EXE	Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo 2200	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Photo 2200 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo 825	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Photo 825 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo 925	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Photo 925 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status checking ink levels etc etc
U	EPSON Stylus Photo R200 Series	E_S4I0H2.EXE	Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R220 Series	E_S6I2I1.EXE	Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R300 Series	E_S4I2F1.EXE	Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R300 Series	E_S4I0F2.EXE	Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo RX500	E_S4I2K1.EXE	Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo RX600	E_S4I2M1.EXE	Epson Status Monitor 3 for the Stylus Photo RX600 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status checking ink levels etc
?	ERTS0749	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
X	exe lptt01	exe.exe	"RapidBlaster variant (in a ""Exe"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	exe ml097e	exe.exe	"RapidBlaster variant (in a ""Exe"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	EXPL0RE.EXE	EXPL0RE.EXE	"Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit ""0"" instead of the uppercase letter ""o"""
X	Expl0rer soft	expl0rer.pif	"Added by the RBOT-AQR WORM!"
X	EXPLORER	EXPL0RER.EXE	"Added by the BEASTDO-Y TROJAN! Note the ""0"" in the filename rather than upper case ""o"""
X	Explorer lptt01	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	Explorer ml097e	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
U	E_S10IC2	E_S10IC2.EXE	Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status checking ink levels etc
U	E_S23	E_SICN03.exe	Epson printer status monitor - for checking ink levels etc.
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
X	f607	f607.exe	"Added by the URAT.B TROJAN!"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark MCI Lotus My Software Broderbund Traffic Software and many others"
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark MCI Lotus My Software Broderbund Traffic Software and many others"
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File0_0	MD1.exe	"Added by the DLOADER-OR TROJAN!"
X	firewall	fw_304.exe	"Added by the BDOOR-JQ BACKDOOR!"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
X	FKS v2.0	msngr.exe	Added by an unidentified WORM or TROJAN!
U	FLMK08KB	MMKEYBD.EXE	Multimedia keyboard manager. Required if you use the additional keys
U	FLMK08KB	KbdAp32A.exe	Keyboard utility for a Medion brand (and possibly others) keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
U	FooBar 1.0	FooBar.exe	"FooBar - ""combines fifteen high-quality productivity tools in a single toolbar that floats on your desktop or runs in the Windows task bar"""
X	foobin lptt01	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	foobin ml097e	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
X	G00123	[worm filename]	"Added by the BUGBROS WORM!"
X	G0mez	G0mez.vbs	"Added by the GORMLEZ-A WORM!"
X	general lptt01	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	general ml097e	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	GetModule20	GetModule20.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule30	GetModule30.exe	"Internet Speed Monitor adware related"
X	GetPack20	GetPack20.exe	"Internet Speed Monitor adware related - see example here"
X	gf1.0.0.2	ggf.exe	"Added by the EDFON.A TROJAN!"
X	Google Service FR	GO0GLEFREE.EXE	"Added by a variant of the SPYBOT WORM!"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
X	Hot 8.0 Live	hot.exe	http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BANKER.EIE
U	Hot Key Kbd 2690 Daemon	SK2690DM.EXE	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	Hot Key Kbd 9910 Daemon	SK9910DM.exe	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
?	hp 1000 firmware	fwdl.exe	"HP LaserJet 1000 related. Is it a driver or automatic firmware update (based upon the filename)?"
X	HP Deskjet	HP_DeskJet_500.exe	"Added by the FORBOT-DA WORM!"
U	HP Digital Imaging Monitor	hpqtra08.exe	System Tray access to HP Director. Required if you prefer to use the all-in-one buttons to manually scan documents or transfer photos froma camera for example
N	HP Image Zone Fast Start	hpqthb08.exe	Improves the startup time of HP Image Zone. If you disable it HP Image Zone takes a long time to start up only the first time you run it. Subsequent startups are much faster than the first time
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
N	HP Photosmart Premier Fast Start	hpqthb08.exe	Improves the startup time of HP Image Zone. If you disable it HP Image Zone takes a long time to start up only the first time you run it. Subsequent startups are much faster than the first time
U	hp psc 2000 Series	hpobnz08.exe	System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start
N	hpaiodevice	hpodev07.exe	Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled and the icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related reportedly lets file transfers from an HP device pass files through Windows firewall. Is it required?"
N	HPAiODevice(hp psc 900 series) -1	hpobrt07.exe	Installed with a Hewlett Packard 900 series colour printer scanner fax photo card slot printer copier. Assumed to perform an identical function to the hpaiodevice entry
N	HPAIO_PrintFolderMgr	hpoopm07.exe	Directly from HP: "This process has one purpose - detects if the device moves to a different port and notifies other processes to look on the new port." For various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled and the HP icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner
U	HPDJ Taskbar Utility	hpztsb01.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb06.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb08.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb03.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb10.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPHmon03	hphmon03.exe	Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. Known to cause 100% CPU load in some cases. Only needed if you use this feature
U	HPHmon04	hphmon04.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 4.0 to 4.2 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	hphmon05	hphmon05.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 5.0 to 5.3 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	HPHmon06	hphmon06.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 6.0 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
N	HPHUPD04	hphupd04.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	HPHUPD05	hphupd05.exe	HP software update checker and wizard launcher. Available via Start -> Programs
U	HPHUPD06	hphupd06.exe	HP software update checker and wizard launcher. Available via Start → Programs
N	HPHUPD07	hphupd07.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	HPHUPD08	hphupd08.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	hpoddt01.exe	N/A	"Installed by the ""HP Photo and Imaging Director"" software. If you ask for the imaging software this program will be started"
U	hpoddt01.exe	hpotdd01.exe	Detection of new imaging printing and other peripherals on HP machines such as USB printers cameras and Bluetooth products
N	hpodlb08	hpodlb08.exe	HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually
N	HPZTS04	hpzts04.exe	Hewlett Packard printer toolbox shortcut that resides in the system tray
U	hpztsb02	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb04	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb05	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb07	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb09	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
X	Icon lptt01	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Icon ml097e	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	ICQ Messenger 2002	ICQ2002.exe	"Added by the SDBOT-ABL WORM!"
X	iedwa104	iedwa104.exe	"Added by the DLOADR-BBW TROJAN!"
X	IEXPL0RER	IEXPL0RER.EXE	"Added by the AGOBOT-QL WORM!
X	iexplorer lptt01	iexplorer.exe	"RapidBlaster variant (in a ""iexplorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	iexplorer ml097e	iexplorer.exe	"RapidBlaster variant (in a ""iexplorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
?	iHP-100	iHPDetect.exe	"Drive Letter Searcher iRiver iHP-100 iHP and H Series player related - does it need to start with Windows every time?"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
U	IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMIndexStoreSvr.exe	"Indexing service that catalogs all the media on your computer so that the files are available to all of the programs in the Nero suite of applications"
X	InstallProvider	newsoftware2007install.exe	"WinAntiVirus Pro 2007 and Privacy Protector misleading security software - not recommended see here"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
X	Instant Access	rundll32.exe EGDHTML_1023.dll InstantAccess	"InstantAccess premium rate adult content dialler variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	intdctrr	idctup20.exe	"SafeSurfing adware variant"
X	Intel Audio Studio V2.0	fmideploy.exe	Detected by VBA32 as the BIFROSE.ADR TROJAN!
X	internet service	svho0st98.exe	"Added by the RBOT.EAT WORM!"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
X	IPInSightLAN 0*	ipclient.exe	"Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly ""phones home"" and wastes resources. * represents 1 or 2"
N	IPInSightMonitor 0*	ipmon32.exe	"Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. * represents 1 or 2"
N	IPO3	IP Operator 2005.exe	"IP Operator 2005 - found on LG Electronics Notebook. The applet makes network connections easier to view and manage than does the standard Windows Network Connections tool. The WLAN module is easy to turn on or off with the press of a single button"
X	IPOT USB Service DRIVER	hpsebc087.exe	"Added by the SDBOT-WA WORM!"
X	IPOT USB Service DRV32	hpsebc08.exe	"Added by the SDBOT-WH WORM!"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JVM0	JVM0.exe	"Added by the BANLOA-AX TROJAN!"
X	JVM0.12	[random filename]	"Added by the TEADOOR-A TROJAN!"
X	JVM0.14	[random filename]	"Added by the TEADOOR-B TROJAN!"
X	jxef1104	jxef1104.exe	"Added by the XIPI-A WORM!"
Y	KAVPersonal50	Kav.exe	"Kaspersky Anti-Virus Personal 5.0"
X	KAVPersonal90	wscntfy.exe	"Added by the BANKER-FZ TROJAN!"
X	Kazaa lptt01	kazaa.exe	"RapidBlaster variant (in a ""kazaa"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same executable name"
X	Kazaa ml097e	kazaa.exe	"RapidBlaster variant (in a ""kazaa"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same executable name"
U	KE9801	DriBat32.exe	KE9801 multimedia keyboard driver - required if you use the multimedia keys
X	Kerne0223	Kerne0223.exe	"Added by the LEGMIR-ZA TROJAN!"
X	kernel system daemon	ACTIVAT0R.exe	"Added by the RANDEX.AW WORM!"
X	kernel44.dll	"taskkill /f /fi ""PID ge 0"" /im *"	"Added by the VBS.LIDO WORM!"
N	kernelfaultcheck	dumprep 0 -k	Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
N	kernelfaultcheck	dumprep 0 -u	Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
X	Kiamat Sudah Dekat_16_04	ISASS.exe	"Added by the PAHATIA.B WORM!"
U	KM9801U	MMHotKey.exe	Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen
U	KONICA MINOLTA magicolor 2400W STD	MSTMON_S.EXE	Konica Minolta Magicolor 2400W colour printer monitor
X	Kr0n1C	Kr0n1C.exe	"Added by the BRONTOK-BO WORM!"
X	KV2005	word.EXE	"Added by the IW TROJAN!"
X	kv3000	lover.vbe	"Added by the ZSYANG.B WORM!"
U	KX509	kx509_kfwk5.exe	"Kerberos Secure Authentication for Windows"
X	L0aders	faxneti.exe	"Added by a variant of the SDBOT TROJAN!"
X	laltin	L90112201.Stub.exe	"Delfin Media Viewer adware related"
U	LanguageMonitor	Oplmsb01.exe	OKI Printer language support monitor
?	LanzarL2007	[path] setup.exe	"??"
U	Laplink PDASync 3.0 - LtNts4	NtsAgnt.exe	"Laplink PDASync for (IBM) Lotus Notes 4 - PDA synchronisation utility"
N	Launch Context 5.0	Launch.exe	"Context - electronic dictionary"
X	Launch Norton AntiVirus 2000	jorgf.exe	"Added by the RBOT-AUI WORM!"
N	LDM	backweb-8876480.exe	Installed with the software for Logitech products. Automatically checks for software upgrades AND new products services and special offerings from Logitech
U	Lexmark 1200 Series	lxczbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 1200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark 2200 Series	lxbvbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 2200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark 3100 Series	lxbrbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 3100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark 4200 Series	lxbmbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 4200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark 5000 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark 5200 series	lxbtbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 5200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark 5400 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark 6500 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark 7600 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark 9300 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark X1100 Series	lxbkbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X1100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark X5100 Series	lxbabmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X5100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
U	Lexmark X5400 Series Fax Server	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software"
U	Lexmark X6100 Series	lxbfbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X6100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan scan to E-mail copy etc"
X	li-rcash00001	vldial.exe	"Added by the Vl TROJAN!"
X	li01f948	rundll32.exe li01f948.dll EnableRunDLL32	"LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""li01f948.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
N	Line Speed Meter V3.0	LineSpeedMeter.exe	"LineSpeedMeter - detect the download and upload speed of your internet connection"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
N	load=	adw30.exe	After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95
Y	load=	01comm32.exe	"Related to Elsa CommPro (Communicate Pro) access software for Microlink modems - this software contains answering machine and fax functions plus a terminal program a WWW-browser launch function Internet telephony and address management. Required if you use those"
X	loadMecq0	explorer.exe	"Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
N	Logitech Desktop Messenger	backweb-8876480.exe	Installed with the software for Logitech products. Automatically checks for software upgrades AND new products services and special offerings from Logitech
N	LogitechQuickCamRibbon	quickcam10.exe	Installed with a Logitech Quickcam Messenger. Camera's software which is non-essential. When you open it it allows you to open the quick capture camera settings etc
N	LS120 Superdisk	??	Supposed to accelerate transfer rate on LS-120 contributes to system lockups
X	LTM2	MSGSRV320.EXE	"Added by the LITMUS.C TROJAN!"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
X	M1cr0s0ft Upd4t4zS	update32.exe	"Added by the RBOT-MI WORM!"
?	MacDrive7.0.4TimeOutPatch	TimeOutPatch.EXE	"Part of MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista XP and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types including CDs DVDs hard drives floppy Zip Jaz and more!"" Interim patch for an older version? Is it no longer required?"
?	Main Executable (HP)	HP05T0R5.exe	"HP (Hewlett-Packard) related. Maybe related to printers. Now - what does it do?"
X	maskrider	maskrider2001.vbs	"Added by the SOLOW-G WORM!"
X	Mi7sft sdce	b0yz.exe	"Added by the RBOT.CWG WORM!"
X	Micr0s0ft Ms D0s	msdx.exe	"Added by the RBOT-AON WORM!"
X	Micr0s0ft Upd4t4z	svchost32.exe	"Added by the RBOT.ALF WORM!"
X	MicroCQ0	explorer.exe	"Added by the LINEAGE-AK TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	Microfinder lptt01	mcf.exe	"RapidBlaster variant (in a ""mcf"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Microfinder ml097e	mcf.exe	"RapidBlaster variant (in a ""mcf"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	Microsft Corporation Version 2001.12.4414	comrel.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsft Corporation Version 2002.12.2414	comserv.exe	"Added by a variant of the SLAPER TROJAN!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Detected by Kaspersky as the SMALL.HIT TROJAN! See here"
X	Microsoft Agent	svch0st.exe	"Added by the VB-DRO WORM!"
X	Microsoft AntiSpyware	KT06.pif	"Added by the IRCBOT.GEN WORM!"
X	Microsoft Help	svh0st.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Internet	expl0rer.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Keyboard Enhance 2.0.	iasrecst.exe	"Added by the BCKDR-QIL TROJAN!"
X	Microsoft Keyboard Enhance V2.0	iasrecst.exe	"Detected by F-Prot as the DOWNLOADER2.AILI TROJAN!"
X	Microsoft Network Host	svc0host.exe	"Added by the SDBOT-AEN WORM!"
U	Microsoft Office OneNote 2003 Quick Launch	ONENOTEM.EXE	ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2003. It's required for the side note windows to work
X	Microsoft System Firewall 2006.2	msmsgr.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Firewall 2006.2	msnmsgr.exe	"Added by a variant of the SDBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility"
X	Microsoft System Firewall 2006.2	reg32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Init	mtmnr0.exe	"Added by the SDBOT.BR TROJAN!"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	mstask0.exe	"Added by the SDBOT.FQ WORM!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows Expl0rer	expl0rer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	microsoft xdaemon 2.0	xdaemon.exe	"Added by the DELF.D TROJAN!"
X	microsoft420	microsoft420.exe	"Added by the MENACE.B WORM!"
X	Micrsoft Internet Explorer	IEXPL0RE.EXE	"Added by the RBOT-AQV WORM! Note the number ""0"" in the filename"
X	ml00!.exe	ml00!.exe	"Malware detected by Panda as the BWD TROJAN!"
X	Mlcr0s0ftf DDEs C0ntr0i	WAed.pif	"Added by the RBOT-BJW WORM!"
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	motoin	mm15201518.Stub.exe	"Delfin Promulgate adware variant"
X	Mozilla Firebird v0.8 Internet Browser	netstats.exe	"Added by the IRCBOT.MC TROJAN!"
X	Mozilla Firefox	F1REF0X.EXE	"Added by a variant of the SDBOT WORM!"
X	MS MSN Menssenger 7.0	MSMSN7.exe	"Added by the RBOT-ACA WORM!"
X	MS MSN Menssenger 7.0	MSEXPORT.exe	"Added by a variant of the SDBOT WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Detected by Trend Micro as the AGENT.ADXH TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	Msconfig lptt01	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	Msconfig ml097e	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	msig	disk10.exe	"Added by the BANBRA-KF TROJAN!"
X	MSkernel32	System.exe 4820	"Added by the TUXDER BACKDOOR!"
X	Mslogon lptt01	mslogon.exe	"RapidBlaster variant (in a ""Mslogon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Mslogon ml097e	mslogon.exe	"RapidBlaster variant (in a ""Mslogon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Msn 8.0 Live	msn.exe	http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BANKER.EIE
X	MSN 9.0 Plus	[random letters].exe	"Added by the RBOT-ALY WORM!"
X	MSN MESSENGER 9.0	messengerr.exe	"Added by a variant of the RBOT WORM!"
N	MSPY2002	ImScInst.exe	Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE Outlook and Word
X	MsServer	msfun80.exe	"Added by the VB-CYG WORM!"
X	MSService_v1.0	realsched.exe	"EHU adware. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	MSService_v1.0	vfp02.exe	"NewWeb adware"
X	mssurfer lptt01	mssurfer.exe	"RapidBlaster variant (in a ""surfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	mssurfer ml097e	mssurfer.exe	"RapidBlaster variant (in a ""surfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	mssync20	mssync20.exe	"Added by the LDPINC-QC TROJAN!"
X	MSVBVM60	MSVBVBM60.pif	"Added by the SCOLD-B WORM!"
X	MSVersion	clrschp038.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msys lptt01	msys.exe	"RapidBlaster variant (in a ""Msyss"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
X	mule_st_key	flec006.exe	"Added by the BAGLE.AV TROJAN!"
N	Music01 Server	Music01 Server.exe	"J River Media Jukebox"
?	Mustek MDC 3000	Mounter.exe	"Related to software for the Mustek MDC 3000 digital camera - what does it do and is it required?"
X	myMh2	iexpl0re.exe	"Added by the DELF.FAI TROJAN!"
X	Name	Iexplorer0.exe	"Added by the THREADSYS TROJAN!"
X	navman_20	sysnav32.exe	"Hijacker possibly a CoolWebSearch parasite variant"
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
?	NetFxUpdate_v1.0.3705	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
Y	NettGain2000	WgwMngr.exe	Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so
Y	NettGain2000 Verifier	NettGain2000 Verifier.exe	Part of the Starband satellite client that attempts to optimize your satellite connection to increase speed
X	Newsgroup lptt01	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Newsgroup ml097e	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	NI.UERSM_0001_N68M1602	UERSM_0001_N68M1602NetInstaller.exe	"ErrorSafe misleading security software - not recommended see here"
N	NI.UGDC_0002_N108M1007	installer_en.exe	"MyContentAssistant security program not recommend - see here"
N	NI.UGES_0001_N108M2006	setup_en.exe	"MyContentAssistant security program not recommend - see here"
X	NI.UGES_0001_N122M2111	mofugclq.exe	Added by an unidentified misleading security program - not recommended
X	NI.UWA6P_0001_N56M1001	WinAntiVirusPro2006Installer.exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N69M0303	WinAntiVirusPro2006Installer[1].exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N73M1004	WinAntiVirusPro2006FreeInstall.exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N91M1807	winantiviruspro2006freeinstall[1].exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA7P_0001_N91M0809	winantiviruspro2007freeinstall[1].exe	"WinAntiVirus Pro 2007 misleading virus software - not recommended see here"
X	NI.UWAS5LP_0001_0811	UWAS5LP_0001_0811NetInstaller.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	NI.UWAS6_0001_N57M1312	WinAntiSpyware2006FreeInstall.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended see here"
X	NI.UWAS6_0001_N68M2301	UWAS6_0001_N68M2301NetInstaller.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	NI.UWFX6_0001_N68M2301	UWFX6_0001_N68M2301NetInstaller.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	NJG40	NJG40.EXE	"Added by the BANCOS.D TROJAN!"
U	No-IP DUC	DUC20.exe	"Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available"
X	Nod3d2 Free antivirus	N0D32KRN.EXE	"Added by the RBOT-ABQ WORM!"
X	Norton Antivirus 2004	SYMANTECAV2.EXE	"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
X	Norton Antivirus 7.0a	[path to file]	"Added by the PERDA-B or RANCK-CT TROJANS!"
N	Norton Ghost 10.0	GhostTray.exe	"Norton Ghost tray icon - the application can be launched manually"
N	Norton Ghost 9.0	GhostTray.exe	"Norton Ghost tray icon - the application can be launched manually"
X	Notepad lptt01	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	Notepad ml097e	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	nsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	ntechin	n20050308.exe	"Delfin Media Viewer adware related"
X	Numerical Xterm Agent	0x32.exe	"Added by the RBOT-FWP WORM!"
X	nvd32 lptt01	nvd32.exe	"RapidBlaster variant (in a ""nvd32"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	nvd32 ml097e	nvd32.exe	"RapidBlaster variant (in a ""nvd32"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
U	nwss	Sp0.exe	"SpyOutside surveillance software. Uninstall this software unless you put it there yourself"
U	OEM02Mon.exe	OEM02Mon.exe	"Creative Live! Cam Console Auto Launcher"
?	OEM07Mon.exe	OEM07Mon.exe	"Related to Live Camera Console Auto Launcher by Creative Technology LTD. What does it do and is it required?"
X	OESET	setup60.exe	"Added by the WAREZDL.28672 TROJAN!"
?	officejet 6100	hposol08.exe	Associated with a HP PSC2110 (and maybe others) all-in-one machine
U	OneNote 2007 Screen Clipper and Launcher	ONENOTEM.EXE	ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2007. It's required for the side note windows to work
X	OpenGL Drivers	0penGLD.exe	"Added by the YIMP-A WORM!"
X	OPQFile	regedit.exe /s ...rad03FA6.tmp	Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit
X	P0w3rF1Y	svchost.exe	"Added by the BDOOR-MM BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally fi"
U	P3000x_S2P	ScanToPc.exe	Dell Laser MFP 1600N network application for scanning files to the PC
U	PAC7302_Monitor	Monitor.exe	"Related to PixArt CMOS image sensors from PixArt Imaging Inc"
N	PaperPort PTD	pptd40nt.exe	"PaperPort" software associated with scanners
X	PCMM2007RT	pcmm2007.exe	"PC MightyMax 2007 rogue security software - not recommended see here"
U	PD0620 STISvc	P0620Pin.dll	Creative Technology Ltd installation plug-in related
U	pduip6000dmon	PDUiP6000DMon.exe	"Canon PIXMA iP6000D printer memory card utility"
U	PDUiP6000DTskbr	PDUiP6000DTskbr.exe	"Canon PIXMA iP6000D printer memory card utility"
X	PeqBL100	PEQBL100.exe	"Added by the ENVID.D WORM!"
N	PerfectPrint	pfppop70.exe	Print engine used by Corel WordPerfect 7 and Presentations 7
U	Petit Larousse 2001	HIPL2000Popup.exe	Popup dictionary tool
U	PFM3.0	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device transfer photos from a PC by drag and drop and on this wireless model you can also use it to download RSS feeds to and display Internet photos on the device. Only required if you use the wireless features - otherwise it can be started when you manually connect the device. May also be included with other models but currently only available for this one"
U	PFM30	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device transfer photos from a PC by drag and drop and on this wireless model you can also use it to download RSS feeds to and display Internet photos on the device. Only required if you use the wireless features - otherwise it can be started when you manually connect the device. May also be included with other models but currently only available for this one"
U	phc700	vphc700.exe	"Related to the Philips SPC700NC web camera"
U	Philips PhotoFrame Manager	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device transfer photos from a PC by drag and drop and on this wireless model you can also use it to download RSS feeds to and display Internet photos on the device. Only required if you use the wireless features - otherwise it can be started when you manually connect the device. May also be included with other models but currently only available for this one"
N	Phime2002a	TINTSETP.EXE	Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE Outlook and Word
N	PHIME2002ASync	TINTSETP.EXE	Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE Outlook and Word
X	PHIME2004C	CTFMDN.exe	"Added by the DLOADR-AMV TROJAN!"
?	PLFFAP	HotfixQ0306270.exe	"Prolific Technology Inc. USB Flash Disk driver - is it required in startup?"
X	pop06ap	pop06ap2.exe	"MediaMotor adware"
X	pop06apelt	thiselt.exe	"ZenoSearch adware"
X	Power-Antivirus-2009	Power-Antivirus-2009.exe	"Power Antivirus 2009 rogue security software - not recommended see here"
X	PowerProfile	mfcp30.exe	"Added by the RINDAS-A TROJAN!"
?	PowerSet	Regedit.exe /s ...PowerSet_8100_CU.REG	"Appears to be Toshiba power management related"
U	PP2000 Instaupdate	PPInupdt.exe	Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
Y	PP2000 Real Time Scan	PPVstop.exe	Protector Plus anti-virus software - real time scanner
Y	PP2000 Taskbar Control	PPTbc.exe	Protector Plus anti-virus software - system tray access
N	PP3100b	flatbed.exe	Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan fax copy print and easily communicate by simply dragging and dropping scans on your PaperPort Desktop
N	pptd40nt	pptd40nt.exe	"PaperPort" software associated with scanners
N	Printkey2000	printkey2000.exe	Screen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required
X	Program Access Service	[10 random letters].exe	"Detected by Trend Micro as the RBOT.GJJ WORM! See here"
X	Protected Storage	RUNDLL32.EXE MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	PUAC v2.0.7	Puac.exe	"""Peter's Ultimate Alarm Clock"""
U	Purgative	PURGATIVE100.EXE	AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack
N	Q152404	wsript.exe Q152404.VBS	Appears to run Scandisk at bootup on NEC PCs
X	QdrModule10	QdrModule10.exe	"Internet Speed Monitor adware"
X	QdrPack10	QdrPack10.exe	"Internet Speed Monitor H adware"
N	QSort2000	QSORT.EXE	Utility that sorts your Start menu and Favourites in alphanumerical order. Not required - at any time you can right-click on these lists and choose "Sort by Name"
N	QuickFinder Scheduler	QFSCHD100.exe	Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N	QuickFinder Scheduler	QFSCHD110.EXE	"Used in Corel WordPerfect Office 11 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
N	QuickFinder Scheduler	QFSCHD130.EXE	"Used in Corel WordPerfect Office X3 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
X	Quicktime Pro 3.0	winuodps.exe	"Added by the GAOBOT.BH WORM!"
U	QWS3270 Sessions	sessions.exe	QWS3270 Secure terminal emulation software
N	RaConfig2500	RaConfig2500.exe	"RaLink wireless LAN configuration utility"
X	ravshell	expl0rer.exe	"Added by the DLOADER.MAR TROJAN!"
X	Ravshell	svch0st.exe	"Added by the NSPM.PU TROJAN! Notice the digit ""0"" in the filename rather than the lower case ""O"""
X	ravtask	svch0st.exe	"Added by the LINEAG-AIN TROJAN!"
X	rb32 lptt01	rb32.exe	"RapidBlaster variant (in a ""RapidBlaster"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	rb32 ml097e	rb32.exe	"RapidBlaster variant (in a ""RapidBlaster"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	readdb40	rundll32.exe readdb40.dll EnableRunDLL32	"LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""readdb40.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	realone_nt2003	moniker.exe	"Added by the SNONE.A WORM!"
X	realplay lptt01	realplay.exe	"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
X	realplay ml097e	realplay.exe	"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
X	RebateNation0	RebateNation0.exe	"RebateNation adware"
X	Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B}	RH.DLL	"SmartPops search hijacker"
X	Recycle Bin Handler 2005	system.exe	"Added by the BDOOR-HO BACKDOOR!"
U	reg2.0	SVCH0ST.EXE	"eSpyNow surveillance software. Uninstall this software unless you put it there yourself. Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Regcheck	~CAB001.EXE	"Added by the CYBRSPY.13A or CYBRSPY.13B TROJANS!"
U	Registry	class0117[random].exe	"Blackbox captures emails and chat logs and monitors Internet activity - remove if you didn't intentionally install it"
X	REGRUN	winfix22490.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
Y	Regx10EXE	atix10.exe	"ATI Remote Wonder? - PC wireless remote control driver. Required if you use it"
X	Remove 54tr10	smss.exe	"Added by the BRONTOK-CH WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data"
U	ResChanger2004	ResChanger2004.exe	EVGA graphic card utility providing easy access to display settings
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
U	rmoc3260.dll OCX	regsvr32.exe rmoc3260.dll	"A module that contains COM components for media playback used by both RealPlayer and Windows Media Player - see here. The ""rmoc3260.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	Roam04	ActiveX.exe	"Added by the ROAMER-A TROJAN!"
X	Run05	rundll_32.exe	"Added by the BANCOS-DT TROJAN!"
X	Rundll32_7	rundll32.exe MSIEFR40.DLL DllRunServer	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Rundll32_8	rundll32.exe inetp60.dll DllRunServer	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	RUNLOAD	l0ad.exe	"PurityScan/Clickspring adware"
X	Run[0]	syscnfg.exe	"Added by an unidentified VIRUS WORM or TROJAN! ""syscnfg.exe"" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside"
X	S0undMan	svch0st.exe	"Added by the LOVGATE.AB WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	s9201	av2008xp.exe	"Antivirus 2008 XP rogue security software - not recommended see here"
X	SAHBundle	shop1003.exe	"ShopAtHomeSelect parasite"
U	Say The Time 5.0	SAYTIME.EXE	This program has audio cues for the system clock in male and female voices customizes the appearance of the system clock and can synchronize it to a time server regularly
Y	SC3300CC	SC3300CC.exe	SiPix digital camera Twain device driver
X	scain	s030109.Stub.exe	"Delfin Media Viewer adware related"
N	ScreenHunter 4.0 Free	ScreenHunter.exe	"""ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"""
U	Scroll-In-Mouse V2.0	SCROLL.EXE	"Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features"
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
X	sdkupdate22	SDK0mCORE.exe	"Added by the FORBOT-DT WORM!"
U	sds20	svchost.exe	"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20"
U	Second Copy 2000	SecCopy.exe	"Related to Second Copy? - a files/folders backup utility"
U	SecureItPro	Secureitpro470p.exe	"SecureIt Pro - lock your computer when you're not there to stop malicious users from accessing your desktop"
X	septpop06apsept	septpop06apsept.exe	"MediaMotor.Popupwithcast adware"
X	Server Backbone	server05.exe	"Added by the RBOT-ZM WORM!"
X	ServiceHost	svch0st.exe	"Detected by Kaspersky as the VB.HE VIRUS! See here"
X	Services004	[worm filename]	"Added by the BUGBROS WORM!"
X	services32	mc-110-12-0000079.exe	Added by the TrojanDownloader.Agent.rv TROJAN!
X	services32	mc-58-12-0000120.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
X	services32	mc-58-12-0000140.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
X	Sex Teris	st01b.exe	"Added by the REPAD WORM!"
X	Shell	ibm0000.exe [ = digit]	"Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe ibm00002.exe ibm00005.exe and so on"
X	Shell	ibm00001.dll	"Added by the TORPIG-Q TROJAN!"
?	ShowIcon_Justrams_USB Product Driver v2.12r012	shwicon.exe	"Related to Just Rams USB product driver. Is it required?"
?	ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051	shwicon.exe	"Card reader for memory cards from digital cameras. Is it required? "
U	SIA2006	SIA2006.exe	"Part of Steganos Internet Anonym privacy software"
U	Sinus 1054 data WLAN Manager	Wifiusb.exe	Wireless management utility for the T-Com Sinus 1054 Data WLAN adapter
Y	SiS7012Utility	SiSAudUt.exe	SiS Corporation sound card driver
?	SISAM10M	SISAM10M.exe	"??"
U	SK60	SK60.EXE	"SaveKeys keystroke logger/monitoring program - remove unless you installed it yourself!"
U	SK9910DM	SK9910DM.EXE	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
X	sms_msn40	sms_msn40.exe	Added by an unknown WORM or TROJAN infection
X	sounddrv	sndbdrv3104.exe	"CoolWebSearch parasite variant"
X	SP00LSV	Sp00lsv.exe	"Added by the GRAYBIRD.E TROJAN!"
?	SPC610NC_Monitor	Monitor.exe	"Related to the Philips SPC610NC webcam. What does it do and is it required?"
U	Speedport W 100 Stick WLAN Manager	Wifiusb.exe	Wireless management utility for the Speedport W 100 Stick WLAN USB stick
X	Spool lptt01	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spool ml097e	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SpyBlocs3.0	SpyBlocs3.0.exe	"SpyBlocs spyware remover - not recommended see herea>"
X	Spybott lptt01	spybott.exe	"RapidBlaster variant (in a ""Spybott"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spybott ml097e	spybott.exe	"RapidBlaster variant (in a ""Spybott"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SpywareGuard	deinst_qfe001.exe	"Added by a variant of the Win32.Small TROJAN! - Do NOT confuse with the legitimate SpywareGuard application"
X	Spywareguard lptt01	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spywareguard ml097e	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Start aThx Roll	f0mered.exe	"Added by the RBOT.AAV WORM!"
Y	Start RF Wireless Mouse	cm20.exe	Yuanxun Electronics RF wireless mouse driver
X	Startwd	rundll32.exe wd081025.dllHook	"Detected by Kaspersky as the AGENT.DE TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wd081025.dll"" file is found in %System%"
U	Status Monitor CLJ1500	HPPOUMUI.exe	Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status checking ink levels etc
X	strtas	l074.exe	"Added by the AGENT-II TROJAN!"
X	stup1db0t	_win.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	suck	l0ad.exe	"PurityScan/Clickspring adware"
X	Surfer lptt01	surfer.exe	"RapidBlaster variant (in a ""mssurfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Surfer ml097e	surfer.exe	"RapidBlaster variant (in a ""mssurfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SV00LSV	SV00LSV.EXE	"Added by the GRAYBIRD-C TROJAN!"
X	SvcH0st	msexploren.exe	"Added by the BACKDOOR-CGZ TROJAN!"
X	SvcH0st	SHCH.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SvcH0st	SVCHST.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SvcH0st	WINAGENT.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SVCH0ST	spoo1sv.exe	"Added by the VB-HF TROJAN!"
X	SVCH0ST	SVCH0ST.EXE	"Added by the VB-IK TROJAN! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	SvcH0st	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	SvcH0st	sdhch.exe	"Added by the TACTSLAY.B TROJAN!"
X	SVCH0TS	sp00lvs.exe	"Added by the LINEAGE-AZ TROJAN!"
X	svchost	Svch0st.exe	"Added by the GRAYBIRD and GRAYBIRD.B TROJANS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	svtcin	n20050308.a.Stub.EXE	"Added by the N20050308 TROJAN!"
U	SW20	sw20.exe	"Related to MSI's Dynamic Overclocking Technology"
X	Symantec Antivirus professional	f0dns.exe	"Added by the FORBOT-GT WORM!"
N	Symantec Fax Starter Edition Port	OLFSNT40.EXE	Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
X	sys008	sys008.exe	"Hijacker also detected as the STARTPA-GK TROJAN!"
X	sys009	sys009.exe	"Added by the STARTPA-ZB TROJAN!"
X	sys201	sys209.exe	"Added by the STARTPA-ZY TROJAN!"
X	syscon lptt01	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syscon ml097e	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Syslog lptt01	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Syslog ml097e	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	sysPersonalFirewall	tskm0nitor.exe	"Added by a variant of the RBOT WORM!"
X	System	system.exe (74295303)	"Added by the VB-IU WORM!"
X	System	WINL0G0N.EXE	"Added by the BANCOS-DB TROJAN!"
X	System Service	exp0lrer.exe	"Added by a variant of the RBOT WORM!"
X	SystemDoctor 2006 Free	sd2006.exe	"SystemDoctor misleading security software - not recommended see here"
X	Systems	svch0st.exe	"Added by the MYDOOM.BI WORM!"
X	taskmngr lptt01	taskmngr.exe	"RapidBlaster variant (in a ""Taskmngr"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	taskmngr ml097e	taskmngr.exe	"RapidBlaster variant (in a ""Taskmngr"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
N	TaskPlus	TASKPLUS0.EXE	Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN
N	Telemeter 3.0	telemeter3.exe	Internet connection bandwidth meter from a user ISP
X	ThE	wind0s.exe	Added by an unidentified WORM or TROJAN!
X	Tok-Cirrhatus-1959sarc	sv711224030r.exe	"Added by the BRONTOK-R WORM!"
X	trackerx90.th.gs	anti_data_exe_by_trackerx90.exe	"Added by the BCKDR-QIT BACKDOOR!"
N	Transcode360	Transcode360Tray.exe	"Designed for WinXP Media Center Edition 2005 and the Xbox 360 Transcode360 aims to broaden the support for a wide range of video media including DivX and XviD"
U	Traymin900	Tray900.exe	Related to the Philips SPC webcam - System Tray manager for Personal 900 series camera
Y	Trend Micro AntiVirus 2007	tavui.exe	"Trend Micro AntiVirus"
Y	TrueMobile 1150 Client Manager	cmdel.exe	"Client Manager for the Dell TrueMobile 1150 Series PC Card - ""a wireless network PC Card that fits into any standard PC Card Type II slot. It has two LED indicators and an integrated antenna"""
X	tsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	UADC_3240389055	UADCcw.exe	"Advanced Cleaner misleading security program - not recommended see here"
N	Ulead Photo Express x.0 Calendar	calcheck.exe	"Ulead Calendar Checker - part of Ulead Photo Express where "x" represents the version number. Automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually"
X	Update	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	update	r00t.exe	"Added by the RBOT-ACO WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
N	updatev01	updatev01.exe	Ultra-networks.com software updater/downloader
X	UpdateXpSp	MS045-XP2.exe	"Added by the IRCBOT.NY TROJAN!"
U	Upromise0	Upromise0.exe	"Upromise college savings program"
Y	UPSentry 2000	upsd.exe	Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss
X	USB 2.0 Driver	updateXPSPC.exe	"Added by the AGOBOT-RJ WORM!"
X	USB 2.0 Driver	Winsys32.exe	"Added by the AGOBOT-QM WORM!"
X	USB 2.0 Driver	updateXP.exe	"Added by the AGOBOT-QP WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
X	USB 2.0 Driver	UpdateXPSP.exe	"Added by the AGOBOT-QD WORM!"
N	UserFaultCheck	dumprep 0 -u	Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
X	userinit	choo_003956f4	"Added by the PEED.16896 TROJAN!"
X	USERINTERFACE REPORT3R	M0USE.exe	"Added by the MYTOB.HS WORM!"
N	USRobotics 802.11g Wireless Network Utility	USRWLANG.exe	"USRobotics Wireless Network Utility - used to configure security settings for connecting to WEP encrypted Access Point through the USR Wireless adapter. You must uncheck ""Use Windows to configure my wireless settings"" for the program to work properly. Has Site Survey capabilities and reports link quality and signal strength. Not required for proper operation of the device as the features given are accessible in the network connection properties"
U	UVS10 Preload	uvPL.exe	"Related to Ulead VideoStudio video editing and DVD authoring software"
U	V0220Mon.exe	V0220Mon.exe	"Creative Live! Cam Console Auto Launcher"
U	V0230Mon.exe	V0230Mon.exe	"Creative Live! Cam Console Auto Launcher"
Y	V0250Mon.exe	V0250Mon.exe	Part of Creative Webcam Launcher
U	va10key	va10key.exe	Only required if you use the 10 kay bay unit with a Sony Vaio laptop
X	ValueS0ft	[random filename]	"Added by a variant of the SPYBOT WORM! See here"
X	VBS_AUTO_UPDATE	0548656X.vbs	"Added by the GORMLEZ-A WORM!"
?	VDI Manager (HP)	HPO0VDX05.exe	"HP (Hewlett-Packard) related. Now - what does it do?"
X	VFW Encoder/Decoder Settings	RUNDLL32.exe MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	VirusResponseLab2009	VirusResponseLab2009.exe	"VirusResponse Lab 2009 rogue security software - not recommended see here"
X	VirusRL2009	VirusRL2009.exe	"VirusResponse Lab 2009 rogue security software - not recommended see here"
X	VnrBlock20	VnrBlock20.exe	"Berlinads adware"
X	VnrPack20	VnrPack20.exe	"Internet Speed Monitor adware related - see example here"
N	VortexTray	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
?	VX1000	vVX1000.exe	"Associated with Microsoft's VX-1000 LifeCam webcams. What does it do and is it required?"
?	VX3000	vVX3000.exe	"Associated with Microsoft's VX-3000 LifeCam webcams. What does it do and is it required?"
?	VX6000	vVX6000.exe	"Associated with Microsoft's VX-6000 LifeCam webcams. What does it do and is it required?"
X	w02db700.dll	[random filename]	"ZenoSearch adware"
X	W32PluginsDownloaderXMLHTTPSelfClearing7520	wiper.exe	"Added by the PROXYSER-M TROJAN!"
U	Watch	1200UBWATCH.EXE	Button press monitor for the Mustek 1200 UB Scanner
X	wblogon	ubpr01.exe	"Added by the AGENT-HFI TROJAN!"
X	WebCpr0	WebCpr0.exe	"WebRebates adware"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	Web Savings From Ebates Software a shopping tool that opens pop-up windows
N	wextract_cleanup0	advpack.dll DelNodeRunDLL32 [path] [filename].TMP	Wextract Cleanup0 is valid and legal software included or sold to help clean up temporary or cab files created by the installer software for a wide variety of software. It should disapear after a restart of the system. If not fix it
Y	wfxsnt40	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application
?	WildTangent CDA	RUNDLL32.exe cdaEngine0400.dll cdaEngineMain	"Part of the WildTangent on-line games system. What does it do and is it required?"
X	Win Antivir 2008	Win Antivir 2008.exe	"Win Antivir 2008 rogue security software - not recommended see here"
X	Win Antivirus 2008	Win Antivirus 2008.exe	"Win Antivirus 2008 rogue security software - not recommended see here"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN USB 2.0	usbsystem.exe	Added by an unidentified WORM of TROJAN!
X	WIN USB 2.0	winusb.exe	"Added by a variant of the RBOT WORM!"
X	Win USB 2.0 USB Driver	HPPrint.exe	"Added by the SPYBOT.DNB WORM!"
X	Win32 USB2.0 Driver	386.exe	"Added by the IRCBOT.D WORM!"
X	Win32 USB2.0 Driver	rundll16.exe	"Added by the WOOTBOT.H WORM!"
X	Win32 USB2.0 Driver	w32usb2.exe	"Added by the SPYBOT.DN WORM!"
X	Win32 USB2.0 Driver	service.exe	"Added by the SDBOT-QF WORM!"
X	win32_i lptt01	win32_i.exe	"RapidBlaster variant (in a ""win32_i"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	win32_i ml097e	win32_i.exe	"RapidBlaster variant (in a ""win32_i"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	WinAntiSpyware 2005	was5.exe	"WinAntiSpyware 2005 spyware remover - not recommended see here"
X	WinAntiSpyware 2006 Scanner	was6.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended see here"
X	WinAntiSpyware 2007	was7.exe	"WinAntiSpyware 2007 spyware remover - not recommended see here"
X	WinAntispyware2008	WinAntispyware2008.exe	"WinAntispyware2008 rogue spyware remover - not recommended see here"
X	WinAntiVirus Pro 2007	WinAV.exe	"WinAntiVirus Pro 2007 rogue anti-virus software - not recommended see here"
X	WinAntiVirusPro2006	WinAV.exe	"WinAntiVirus Pro 2006 rogue virus software - not recommended see here"
X	WIND0WS	WIND0WS.exe	"Added by the SPYBOT.DQ WORM!"
X	WIND0WS	mella.bat	"Added by the ALLEM WORM!"
X	Wind0ws	wordpad.exe	"Added by the AGOBOT-TL WORM! Note - this is not the legitimate Windows application wordpad.exe (which is found in the Program FilesAccessories folder) which should not normally be seen in Msconfig or as a Startup item. This file is loacted in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	Wind0ws Ser7ice Agent	colwindos.exe	"Added by the RBOT-GQO TROJAN!"
X	Wind0ws Sharing	ssprotecter.exe	"Added by the RBOT-AHW WORM!"
X	WinDLL (start0s.exe)	rundll32.exe start0s.exestart	"Added by a variant of the IRCBOT BACKDOOR! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""start0s.exe"" file is found in %System%"
X	Windows 2004	csrss.exe	"Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows 2004\Tools"
X	Windows Internet Protocol	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Media Player	50cent.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	winl0g0z.exe	"Added by the RBOT-FNB WORM!"
X	Windows NT Update Manager	WINL0G0N.exe	"Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital ""o"""
X	Windows Serv Patch	Mcaffe2005.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Agent	co0l.exe	"Added by the RBOT-GQY WORM!"
X	Windows Services Aganters	[10 random letters].exe	"Detected by Trend Micro as the RBOT.CUN WORM! See here for an example"
X	Windows Services Layer	winl0g0.exe	"Added by the RBOT-FZQ WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
?	Windows shell	win70.exe	"??"
X	Windows Start Server 2000	traficy.exe	"Added by the RBOT-AHM WORM!"
X	Windows svchost	happy2008.exe	"Detected by Kaspersky as the IRCBOT.AYA BACKDOOR! See here"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows USB 2.0 Driver	usbtskmgr.exe	"Added by the RBOT-BKG WORM!"
X	Windows USB 2.0 Driver	usb2ctrl.exe	"Added by the RBOT-BIW WORM!"
X	WindowsFZ	A5281300.so	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windowz Update V2.0	updater.exe	"Added by the YODO-C WORM!"
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	WinFixer 2005	wfx5.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	WinFixer2006	uwfx6.exe	"WinFixer web installer. Winfixer is ""Foistware"" pretending to be system optimization protection and recovery software - stealth installed see here"
X	wingerver2.0.exe	wingerver2.0.exe	"Added by the GRAYBRD-AE TROJAN!"
X	WINLOG0N	WINLOG0N.EXE	"Added by the MYDOOM.BI WORM!"
X	winreg_32	Vc030405.exe	"Added by the BANCOS-CT TROJAN!"
X	winsock	svch0st.exe	"Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Winsock32driver	ZoneAlarmPr0.exe	"Added by the HACKARMY-B TROJAN!"
X	WinSrv	kn0x.exe	"Added by the HOBBIT.F WORM!"
X	WinStart001	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words with this installed typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge"
X	WinStart001.EXE	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words with this installed typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge"
X	winsyslog lptt01	winsyslog.exe	"RapidBlaster variant (in a ""Winsyslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	winwan lptt01	winwan.exe	"RapidBlaster variant (in a ""Winwan"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	winwan ml097e	winwan.exe	"RapidBlaster variant (in a ""Winwan"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	win_supp00.exe	Win Const.exe	"Added by the ASSASIN-H TROJAN!"
U	WorkPace 3.0	workpace.exe	"WorkPace - stress injury prevention software"
X	Workstation Ver 5.0	vmware.exe	"Added by the RBOT-AHB WORM!"
X	WUpdate	1037v.exe	"Added by the CLAGGER-AR TROJAN!"
U	X10 Device Network Service	x10nets.exe	Belongs to X10 video streaming device(s)
X	X10Weax	WTHRTRAY.EXE	"WeatherCheck - ""bring the latest local weather to your desktop"". Not recommended as it reportedly pops ads and contains no uninstaller"
Y	XircWinModem4	ltcm000c.exe	"WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	XMLmedia 10.0	wmsdkns.exe	"Added by the FAKEALERT TROJAN!"
X	Xordate	wuauclt10.exe	"Added by the RBOT-GKN WORM!"
X	xp32win	xpupdater02.exe	"Added by the MOSUCK-A TROJAN!"
X	xupiterstartup2003	xupiterstartup2003.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D Adware or similar to detect and remove and to prevent it re-installing in the future see here"
X	xzkadsfk10	afslkfasl10.exe	"Added by the ONLINEG-R TROJAN!"
X	y1959sar	sv711224030r.exe	"Added by the BRONTOK-AK WORM and variants!"
X	Yahoo2000	Anti.exe	"Added by the RBOT.ATK WORM!"
X	Yahoo2000	Anti.exe	"Added by an unknown Malware possibly a variant of the RBOT-RAM WORM!"
X	yahoo_toolbar lptt01	yahoo_toolbar.exe	"RapidBlaster variant (in a ""yahoo_toolbar"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	yahoo_toolbar ml097e	yahoo_toolbar.exe	"RapidBlaster variant (in a ""yahoo_toolbar"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
U	ZeroAds	0	"ZeroAds - culls ads cookies and pop-ups. Tells ZeroAds not to run at startup - needed to start it manually"
U	ZeroAds	LAS0Ads.exe	"ZeroAds - culls ads cookies and pop-ups. Required for the cookie interception to work"
X	Zonavirus	0	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	zsmscc	rundll32.exe zsmscc071001.dll mymain	"Added by the GENETIK.KQ TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""zsmscc071001.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	[12 random characters]	atl91036.exe	"IeDriver adware variant"
X	[32 random numbers]	av2009.exe	"Antivirus 2009 rogue security software - not recommended see here"
X	[random name]	iexpl0ra.exe	"Added by the ULPM.BD TROJAN!"
X	[various names]	10010.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	321102.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	br0ken.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	defect08.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	Dest068.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	prgsys0984.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	80d0.exe	"MediaMotor adware"
U	{0228e555-4f9c-4e35-a3ec-b109a192b4c2}	gnotify.exe	"Google Gmail Notifier. Alerts you when you have new Gmail messages"
X	{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}	sysqyzwud.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
U	{1290A33C-85F5-4164-A1BE-7DD299D4986A}	PBKScheduler.exe	"Scheduler for CyberLink PowerBackup - archiving/backup utility"
X	{12EE7A5E-0674-42f9-A76B-000000004D00}	rundll32.exe stlb2.dll DllRunMain	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	{157627A6-2A10-4aa1-B97F-90B8DC6F24AC}	sysqkmwfedz.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{29123221-3AF8-488c-85DE-6B3EC59E8074}	netmedia.exe	"NetMedia adware"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sxpgknrwva.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysavxjgdu.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysawpbkvnq.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysxhtcwbse.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{2CF0B992-5EEB-4143-99C0-5297EF71F444}	rundll32.exe stlbdist.dll DllRunMain	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""stlbdist.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	{2CF0B992-5EEB-4143-99C2-5297EF71F44B}	rundll32.exe stlbupdt.DLL DllRunMain	"BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""stlbupdt.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	{357AA41A-B7A8-4632-A27D-5B980B25CF43}	[path to svchost.exe]	"Added by the SMALL-AQ TROJAN!"
X	{357AA41A-B7A8-4632-A27D-5B980B25CF43}	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	{357AA41A-B7A8-4632-A27D-5B980B25CF43}	[path to trojan]	"Added by the SMALL-EP TROJAN!"
X	{42562052-EE17-4197-82C7-91CB2E4B0666}	sysrswva.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{7DD4A7AC-A3F1-4495-884A-7947C5B89108}	sysahbecjh.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{9754B85A-3B34-4969-BE1F-CD03227E9470}	syszweuas.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{9754B85A-3B34-4969-BE1F-CD03227E9470}	sysatjsicj.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}	sxnwhbvrzc.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}	sysqrnxstju.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}	syssngbeh.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
U	{B179023B-6238-4499-8F26-CD73E9D90E0A}	MacDrive.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista XP and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types including CDs DVDs hard drives floppy Zip Jaz and more!"""
X	{B3B48B54-C0EC-4705-8EE8-1981AEF656A7}	sysjcyrq.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}	sysawechod.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{C2220120-1C24-4a79-BA7A-DDCBFC209DB3}	sysfbdgv.exe	"Detected by Trend Micro as the CLICKERAGS TROJAN! See here"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysutrnez.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysabmpmfr.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysnxcphmgy.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{E4785213-3EFE-4c26-A9B4-332440E31F6F}	sysrxmfdksp.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here"
X	{F758F78B-0885-490e-AA3C-4A38D28B0240}	sxpjbwvahn.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	{F758F78B-0885-490e-AA3C-4A38D28B0240}	sysyeabdgfp.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.