NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker see here (* = any digit)"
X	(*)Run	win32API.exe	"Homepage hijacker see here (* = any digit)"
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware CoolWebSearch parasite related - detected by Kaspersky as the VB.DU TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winlog.exe	"Unidentified adware. Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads animated gifs things you don't want to see"""
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	252	winmgr.exe	"Added by the LEGMIR-AT TROJAN!"
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	@	regedit -s ..win.dll	"Added by the SEEKER.K TROJAN!"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion WinPoET is attractive to equipment providers modem suppliers RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking"
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
X	Access Control App	winsto.exe	"Detected by Kaspersky as the AGENT.DGO TROJAN! See here"
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive convenient and enjoyable"""
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
U	AMP WinOFF	winoff.exe	"WinOFF is "" a utility designed to shut down Windows computers automatically in a fully configurable way"""
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	APIMon	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam spyware dangerous or time-wasting content phishing scams hackers and intruders"""
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	Audio Device Manager	winfp.exe	"Detected by PCTools as the IRCBOT.BIV TROJAN! See here"
X	Audio Device Manager	WinNT.exe	"Added by the BANKER.BTG TROJAN!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
X	auto	win32.exe	"Added by the SMALL!SD5 TROJAN!"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	autoload	windowsupdate.exe	"Detected by Trend Micro as the POLYCRYP.DY TROJAN! See here"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	bawindo	bawindo.exe	"Added by the BEAGLE.AR or BEAGLE.AU WORMS!"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentied WORM or TROJAN!
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cftmon	WindowsUpdate.exe	"Detected by Kaspersky as the AGENT.AQK BACKDOOR! See here"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	ContentService	winservn.exe	Homepage hijacker
X	ControlPanel	twink64.exe internat.dllLoadKeyboardProfile	"Added by the DLOADER-BW TROJAN. Note - the ""twink64.exe"" file is found in %System%"
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	dvd98	windvd98.exe	"Added by the CULT.P WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
U	ELSA WINman Suite	Winmsuit.exe	Allows you to totally customize your ELSA graphics card settings including overclocking the GPU
?	encapsulated command tool	wintr.com	"??"
X	Enh Win Updt	enhupdt.exe	"Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN!"
X	erfgddfk	wind2ll2.exe	"Added by the BEAGLE.CQ WORM!"
X	erghgjhgdr	windlhhl.exe	"Added by the BEAGLE.BG WORM!"
X	erghgjhjgdr	windlhhl.exe	"Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS!"
X	erthegdr	windll2.exe	"Added by the BEAGLE.CG WORM!"
X	erthgdr	windll.exe	"Added by the BEAGLE.AO or BEAGLE.AQ WORMS!"
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Firewall auto setup	winlogon.exe	"Added by a TROJAN - see here. Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
N	Folding@home	WINFAH.EXE	Folding@Home is a distributed computing project which studies protein folding misfolding aggregation and related diseases - must be running in order to access the internet to upload to the servers. Available via Start -> Programs
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture print or save the current window"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	svchost.exe	"Added by the SPYBOT.NC WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	sv?h?st.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	getwin	winB_.exe	"Added by the BANKER-HS TROJAN!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	gpmce	window.exe	"Detected by Kaspersky as the VB.CK WORM! See here"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
N	GWInkMonitor	GWInkMonitor.exe	Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink do you want to buy some!
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM! (where HKLMRun represents HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun)"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
X	HWINFO*	HWINFO*	"Added by the PUROL WORM! where * is a random character"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
U	IBWin Monitor	IBMonitor.exe	"IBackup for Windows"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
U	IE New Window Maximizer	iemaximizer.exe	"IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows"
X	IE Runtime	wini.exe	"Added by the PICRATE.B WORM!"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IExplorerService	WinSock.exe	"Detected by Kaspersky as the AGENT.KIU TROJAN! See here"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	infwin	infwin.exe	"VX2.Transponder parasite updater/installer related"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Internal	regedit.exe /s %windir%c:[month number]	"Added by the FORTNIGHT.D TROJAN!"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	Internet	wins.exe	"Detected by PCTools as the RBOT.AAYF WORM! See here"
X	Internet Security Service	mysqlwin32.exe	"Detected by Trend Micro as the RBOT.UX TROJAN! See here"
X	INTERNET SERVISES	winz32.exe	"Added by the KWBOT.Z WORM!"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	INTERNET_SERVISES	winz32.exe	"Added by the SDBOT.Q TROJAN!"
X	InterU	WINDRV.EXE	"Added by the IRCINTER.A TROJAN!"
N	Intervideo Win Cinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo Win Cinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card you will need it. Available via Start -> Programs"
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card you will need it. Available via Start -> Programs"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	IpWins	ipwins.exe	"IPWins adware"
N	iRis Active Monitor	winmon32.exe	Iris Antivirus - discontinued replace with good alternative
X	ISPSERVICE	wintmp.exe	"Detected by Trend Micro as the FLOOD.BC BACKDOOR! See here"
X	jkdfj94kgdftdf	winlogan.exe	"Added by the ZLOB.BZ TROJAN!"
X	Jufualt	winxp2.exe	"Added by the SDBOT-AAB WORM!"
X	KAVFOX	win1ogoin.exe	"Added by the GWGHOST-M TROJAN!"
X	KavRuns	Windll.exe	"Added by the TRYNOMA TROJAN!"
X	Kernel32	Kernel32.win	"Added by the GAGGLE.D or GAGGLE.E WORMS!"
X	KernelCheck	winser.exe	"Added by the TSPY_LMIR.SL TROJAN!"
X	key	winxp.exe	"Added by the BEAGLE.AG WORM!"
X	key2	winlog.exe	"Added by the BAGLEDI-AL TROJAN!"
X	l44sys**	winmine	"Added by the VBS.LIDO WORM - where ** is a number between 33 and 44"
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
X	Live Windows Messenger Version	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Live Windows Messenger Version	msnmsngrlive.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	lnwin.exe	lnwin.exe	"Added by the DLOADR-ATC TROJAN!"
X	Load	win32.exe	"Added by the RUBBLE-A WORM!"
X	load32	winldra.exe	"Added by the NIBU.J BACKDOOR or DUMARU-BI TROJAN! Note - also known as Srv.SSA-KeyLogger by Sunbelt Software which has developed a free removal tool for this keylogger"
?	load=	WINOSCFG.EXE	"Could it be something to do with configuring Windows on a new PC from an OEM supplier?"
X	load=	win32exec.exe	"Added by the BITTER WORM!"
X	loadwin	winset.exe	"Added by the QQPASS-I TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
U	Login	winlog.exe	"Salfeld Child Control - parental control software"
X	LogService	wincalc.exe	"Added by the PAPROXY TROJAN!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	LTM2	winscan.exe	"Added by the LITMUS-B TROJAN!"
X	LTM2	winvers16.exe	"Added by the SMALL.ND TROJAN!"
Y	LTWinModem1	ltmsg.exe	"One of the ""popular"" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
X	main drive Loader	wininfo.exe	"Suspected malware as it appears in 3 different registry locations - see here"
X	Major Microsoft Windows Driver Boot loader	bpool.exe	"Added by the MYTOB.AJ WORM!"
N	Mania Win Restore	RESWIN.EXE	Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs
X	MC	wintrims.exe	"Added by the WINTRIM TROJAN!"
X	MC	WINTRIM.EXE	"Added by the WINTRIM.A TROJAN!"
X	mcafee	Win32.dll.vbs	"Added by the CATCHER-B WORM!"
X	McAfee Windows Protection	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
N	McAfee Winguage	??	Part of McAfee Nuts & Bolts. "WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs
X	MD IE Plugin	winy.exe	Adware
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Detected by Kaspersky as the SMALL.HIT TROJAN! See here"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Windows Host	svhost32.exe	"Added by the RBOT.ADY WORM!"
X	Microsof Winlog Host	wilogon32.exe	"Added by the RBOT.XC WORM!"
X	Microsoft	win32.exe	"Added by the DARKMOON TROJAN!"
X	Microsoft	windl32.exe	"Added by the SDBOT-DCZ WORM!"
X	Microsoft	WinSecUp.exe	"Added by the RBOT-GPL WORM!"
X	Microsoft	winampaa.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft	winline.exe	"Detected by Kaspersky as the AGENT.KT TROJAN! See here"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in either a ""config"" ""mapping"" or ""security"" subfolder of the Winnt or Windows folder"
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process which is found in %Windir% (98ME) or %System% (NT2000XP). This one is located in %Windir%\dll"
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft (R) Windows Protocol Deployment Manager	[random].tmp	Added by an unidentified WORM or TROJAN!
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows TCP/IP Socket Layer	services.exe	"Added by the RBOT.ARM WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\winsock"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process which should not appear in Msconfig/Startup!"
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft Command Line	wincmd.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Corp SSL Certificates	windowz.exe	"Added by the RBOT-GCZ WORM!"
X	Microsoft Crs Fix Serv	wincrs.exe	"Added by the SDBOT.BWF WORM!"
X	Microsoft Device Manager	svcswin.exe	"Added by the IRCBOT-YH TROJAN!"
X	Microsoft DirktorWin	[random filename]	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft DLL Library	winlib32.exe	"Added by the ATNAS.A WORM!"
X	Microsoft Dll Management	windll.exe	"Added by the RBOT-MT WORM!"
X	Microsoft DLL Verifier	winavguard.exe	Added by the SDBOT.AAD WORM!
X	Microsoft Driver Control	windrv.exe	"Added by the SDBOT.FW WORM!"
X	Microsoft Driver Manager	mswindrv.exe	"Added by the FORBOT-EZ WORM!"
X	Microsoft HDCP for NT and Win9x	msdhcprs.exe	"Added by a variant of the PEERBOT WORM!"
X	Microsoft Hosting Service	WINHOSTING.EXE	"Added by the RBOT.AEV WORM!"
X	Microsoft Internet	windows32.exe	"Added by the SDBOT-F WORM!"
X	Microsoft Internet	wincfg16.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft Kernel	Windows_kernel32.exe	"Added by the NETSKY.AE WORM!"
X	Microsoft Login	winlogin.exe	"Added by the RBOT-AJP WORM!"
X	Microsoft Lsass Service	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Machine	winjava.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft media	winmplayers.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft media services	winmplayer.exe	"Added by the RBOT.ZO WORM!"
X	Microsoft MediaScope	winmes.exe	"Added by the RBOT-XU WORM!"
X	Microsoft Network Daemon for Win32	Netd32.exe	"Added by the SDBOT.R TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft Problem Doctor	windr128.exe	"Added by the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr32.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr64.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Rundll	windos.exe	"Added by the SDBOT-WF WORM!"
X	Microsoft SDKP3	mswinsdq.exe	"Added by the RBOT-ARY WORM!"
X	Microsoft Security	winService.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Security Management	winnt.exe	"Added by the RBOT-MQ WORM!"
X	Microsoft Security Management	winserv.exe	"Added by the RBOT-MJ WORM!"
X	Microsoft Security Management	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Microsoft Security Manager	winamp.exe	"Added by the RBOT.TU WORM! Note - this is NOT the popular Winamp media player which is located in %ProgramFiles%\Winamp. This one is located in %System%"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	winsys32.exe	"Detected by Kaspersky as the VIRUT.N VIRUS! See here"
X	Microsoft Security Monitor Process	winsyss32.exe	"Detected by Kaspersky as the RBOT.AEU BACKDOOR! See here"
X	Microsoft Security Process	wininit.exe	"Added by the RBOT-FKM WORM!"
X	Microsoft Service	winsvc.exe	"Added by the SPYBOT-DB WORM!"
X	Microsoft Service Login Manager	winlogin.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Manager	winsvc.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Service Pack	WindowsSP.exe	"Added by the RBOT-RF WORM!"
N	Microsoft Sidewinder Game Controller Software	SWTRAY.EXE	MS SideWinder game controller system tray icon. Available via Start -> Programs
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
X	Microsoft SpA Service	win32.exe	"Added by the RBOT.ATS WORM!"
X	Microsoft SpA Service	Winupd32.exe	"Added by the RBOT.LT WORM!"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Standard Executions Library	win32lib.exe	"Added by the RBOT-AUK WORM!"
X	Microsoft standard protector	winsocks5.exe	Added by the SMALL.CF TROJAN!
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Svchost local services	winoem.exe	"Added by the RBOT-FPE WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft TCP Protocol	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Telecoms Center	winupn.exe	"Added by a variant of the SDBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	winsys32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Updater	Winsys32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Visual SourceSafe	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Microsoft Win Corp TLS Verification	mswintls.exe	"Added by the RBOT-GCT WORM!"
X	Microsoft WIN32 DOS	MSdos32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft WIN32 Security	MSsec32.exe	"Added by the RBOT-DOQ TROJAN!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	mstask0.exe	"Added by the SDBOT.FQ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	Microsoft Windows.hta	HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
X	Microsoft Windows	explorar.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows	bootini.exe	"Added by the VANEBOT-K WORM!"
X	Microsoft Windows	Kernel.exe	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	Kernel.vbs	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	pwjbvphi.exe	"Added by the RBOT-GQK WORM!"
X	Microsoft Windows (D)	iexplore.exe	Identified as a variant of the TrojanSpy.Agent malware
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
X	Microsoft Windows 16Bit	mswinn16.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows 32Bit	mswinn32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows 64 Bit	mswin32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Adapter 5.1.3214	[worm filename].exe	"Detected by Trend Micro as the STRAT.GEN-3 WORM! See here"
X	Microsoft Windows Client Firewall	msclt.exe	"Added by the VANEBOT-F WORM!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows Config 32	win32conf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Control	mswctl32.exe	"Added by the RBOT.JP WORM!"
X	Microsoft Windows CSRSS	csrss.exe	"Added by the KALEL-A WORM! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Microsoft Windows DHCP	___r.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Windows DLL 32-BIT	msncheck32.exe	"Added by the SDBOT-XX WORM!"
X	Microsoft Windows DLL Services	mwindll.exe	"Added by the SDBOT-VX WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows DLLHandler	bitpaint.exe	"Added by the SDBOT.AHG WORM!"
X	Microsoft Windows Drivers	windrv.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows DVR	windvr.exe	"Added by the RBOT-AXD WORM!"
X	Microsoft Windows Expl0rer	expl0rer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Explorer	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Windows Explorer	explorewin.exe	"Added by the IRCBOT.WORM.212480.H WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Express	websploit.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Express	windowslogonb.exe	"Detected by PCTools as the SDBOT.ABOO WORM! See here"
X	Microsoft Windows Files Loader	cgy32win.exe	"Added by the RBOT-AXR WORM!"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows GUI	Windowz.exe	"Added by the RANDEX.AEV WORM!"
X	Microsoft Windows GUI	msmonk32.exe	"Added by the SDBOT-PE WORM!"
X	Microsoft Windows Kernel Services	winkrnl386.exe	"Added by the ZEBROXY TROJAN!"
X	Microsoft Windows Loader	wloader.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Windows Logon Process	winlogon.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Winnt or Windows folder"
X	Microsoft Windows Media Player	mediaplayer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Media Player	wimp.exe	"Added by the RBOT-FN WORM!"
X	Microsoft Windows Registry Service	wregistry.exe	"Added by the AGOBOT.AKG WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure Server	rpcxWindows.exe	"Added by the RBOT-LL WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Securety	wurguar.exe	"Added by the RBOT-KY WORM!"
X	Microsoft Windows Security	spvsper.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Security	wscndrives.exe	"Added by the RBOT-AJK WORM!"
X	Microsoft Windows Service	winsys.exe	"Added by the RBOT-ADP WORM!"
X	Microsoft Windows Service Pack	winspkn.exe	"Added by the RBOT-AYD WORM!"
X	Microsoft Windows Services	msw32.exe	"Added by the RBOT-FWQ WORM!"
X	Microsoft Windows Services Edt	ssvvcchhoosst.exe	"Added by the RBOT-FYF TROJAN!"
X	Microsoft Windows Services Edt	dllrun32.exe	"Added by the RBOT-GAF WORM!"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Microsoft Windows Socketx32 Services	winsockx32.exe	"Added by the RBOT-FWT WORM!"
X	Microsoft Windows Sound	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Sound	svshost.exe	"Detected by Kaspersky as the RBOT.ME BACKDOOR! See here"
X	Microsoft Windows Sound	svuhost.exe	"Detected by PCTools as the KOLAB.XC WORM! See here"
X	Microsoft Windows Storage Machine Service	winms.exe	"Added by the RBOT-AHK WORM!"
X	Microsoft Windows SVCHOST	SVCHOST.exe	"Detected by Kaspersky as the VB.KV WORM! See here. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Microsoft Windows System	srwhost.exe	"Added by a variant of the RBOT-ASW WORM!"
X	Microsoft Windows System	syshost.exe	"Added by the RBOT-ASW WORM!"
X	Microsoft Windows System	System.exe	"Detected by Kaspersky as the VB.KV WORM! See here"
X	Microsoft Windows System Kernel	kernel32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Task Management	mstasks.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Task Manger	Mstosk.exe	"Added by the SDBOT-WW WORM!"
X	Microsoft Windows Tasks Management	taskmng.exe	"Added by the RBOT-FXK WORM!"
X	Microsoft Windows Updata	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM!"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe opera.exe taskmrg.exe aim.exe Winxdiag.exe and usnesvc.exe"
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows W32 Services	mssw32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows WinSaSS Management	winsass.exe	"Added by the RBOT-APW WORM!"
X	Microsoft Windows WKS Service	gt.exe	"Added by the SDBOT.IR WORM!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WINGS32 Protocol	WinSGR32.exe	"Added by the RBOT-APU WORM!"
X	Microsoft WinRaR	winrar.exe	"Added by the RBOT-AEC WORM!"
X	Microsoft Winsock	mswinsck.exe	"Added by the RBOT-ANK WORM!"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsoft Winsock Wrapper	ws2_32s.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Detected by Kaspersky as the SPYBOTER.FB BACKDOOR! See here"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
X	Microsoft World Service	winworld.exe	Added by an unidentified IRC worm with backdoor capability!
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
U	Microsoft® Windows® Operating System	ehTray.exe	System Tray access to Media Center for Windows Vista Home Premium and XP Media Center Edition
N	Microsoft® Windows® Operating System	RunDLL32.exe ehuihlp.dll BootMediaCenter	"Starts Windows Media Center every time Windows Vista (Home Premium or Ultimate) boots. Disable by unchecking the ""Start Windows Media Center when Windows Starts"" option via Windows Media Center -> Tasks -> Settings -> General -> Startup and Window Behaviour"
N	Microsoft® Windows® Operating System	rundll32.exe oobefldr.dll ShowWelcomeCenter	Shows the Welcome Center every time you boot into Windows Vista
X	Microsoft32	win32sys.exe	Added by an unidentified WORM or TROJAN!
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	MicrosoftNetwork Daemon for Win32	NETD32.EXE	"Added by the RANDEX.F WORM!"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	Wintsk32.exe	"Added by the YAHA.U WORM!"
X	MicrosoftUpdate	WinUp32.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	MicrosoftWindows	a@26m.exe	"Added by the KILLPAR-B TROJAN!"
X	Micrsoft Driver	windrive.exe	"Added by the SDBOT.AF TROJAN!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
X	Mismo	win32x.exe	"Added by the RBOT-JP WORM!"
N	MMCWINMGMT	winmgmt.exe	"Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth ""scheduler"" - refer here"
X	mmxrun	mswinindex.exe	"TwoSeven spyware"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	MS Java Applets for Windows NT ME	javaapplets.exe	"Added by the VANEBOT-B WORM!"
X	Ms Java for Windows 98 NT ME & XP	msjavames.exe	"Added by the RBOT.BHJ WORM!"
X	Ms Java for Windows 98 NT XP & ME	msjavaxps.exe	"Added by the BACKDOOR.GEN TROJAN!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows NT XP & ME	xpjavams.exe	"Added by the KASSBOT-V WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper for Windows NT	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Network Control	mswin.exe	"Added by the DUMBA TROJAN!"
X	ms ownage	winPE.exe	"Added by the RBOT-AJL WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	Ms sock for Windows NT	winser.exe	"Added by a variant of the SDBOT WORM!"
X	MS Sys Security	mswin.pif	"Added by the RBOT-APJ WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	MS Unix Binary	win32ttb.exe	"Added by the SPYBOT.OQ WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	WinGuard.exe	"Added by the RBOT-ACL WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	MS Win32 Network Services	windriver.exe	"Added by the AGOBOT.ADH WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows AOL Driver	MSAOLdrv.exe	"Added by the RBOT-ASP WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Executor Process	MSEXECP32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Local Directory	MSWLD32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows procces 32	msprocces.exe	"Added by the RBOT-AEZ WORM!"
X	MS Windows Process Class	MSPRCSS32.exe	"Added by the RBOT-YQ WORM!"
X	MS Windows Process Init	MSWPI32.exe	"Added by the RBOT-ASQ WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MS Windows TASK Service	MSWTASK32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS WINS Binary	ign32.pif	"Added by the RBOT-ASB WORM!"
X	MS Winsock	msws2_32.exe	"Added by the AKBOT-A TROJAN!"
X	MS-DOS Windows Service	MS-DOS.PIF	"Added by the RBOT-AJW WORM!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Detected by Trend Micro as the AGENT.ADXH TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSDN for Windows NT	msdn.exe	"Added by a variant of the RBOT WORM!"
X	MSDN for Windows NT & WinXP	msdnxp.exe	"Added by the IRCBOT-PE WORM!"
X	MSDN for Windows with NT's	msdn-nt.exe	"Added by the RBOT-EWD WORM!"
X	MSDOS Windows Service	MSDOS.PIF	"Added by the RBOT-AKF WORM!"
X	MSIdll	winmp.exe	"Added by a variant of the RBOT WORM!"
X	MSMSGS	winlogon.exe	"Added by the RAHIWI.A WORM!"
X	MSMSGS	winlogon.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	MSN Administration For Windows	msnadp32.exe	"Added by the BROPIA.W WORM!"
X	MSN Messanger Live	winntmsn.exe	"Added by the RBOT-FSO WORM!"
X	Msn Messeng	windns.exe	"Added by a variant of the RBOT WORM!"
X	MSN Messenger Live Windows	messengerlive.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Registry loader	msmnwin.exe	"Added by the KELVIR.FK WORM!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MsnExplorer	winagent.exe	"Added by the BDOOR-EQ BACKDOOR!"
X	MSNMSGRR	swin.bat	IRC backdoor TROJAN or WORM!
X	msnnt	winampb.exe	"Chinese originated adware - detected by Kaspersky as the AGENT.TL TROJAN!"
X	msnnt	winampf.exe	Added by the SMALL.DTS TROJAN!
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	MSSQL for Windows NT & XP	mssqlsnt.exe	"Added by a variant of the SDBOT WORM!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	MSWin	mswin.exe	"Added by the BANKER-CU TROJAN!"
X	Mswincfg	Mswincfg32.exe	"Added by the CYBRSPY.D TROJAN!"
X	MsWindows DRT Drivers	wsdrt32.exe	"Added by the RBOT.ALT WORM!"
X	MsWindows SSL Drivers	mssl32.exe	"Added by the SPYBOT.API WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindows Syspg	mspg32.exe	"Added by the RBOT-TB WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinlogon	SynCor.exe	"Added by the AGENT-FZL TROJAN!"
X	MSWinlogon	winlogon.exe	"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Mswinpid32	mswinpid32.exe	Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
X	MSWinSrv32	MSWinSrv32.exe	"Added by the MTRON-B TROJAN!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MsWinVgr	msvgr.exe	"Added by the MYTOB.LE WORM!"
X	MS_NETD_WIN32	netd32.EXE	"Added by the RANDEX.F WORM!"
X	mvsyswina	acsysiom.exe	"Added by a variant of the SDBOT WORM!"
X	mysoft	winexplor.exe	"Browser hijacker also detected as the STARTPA-JR TROJAN!"
X	Name Server	mswins.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Agent	winsnav.vbs	"Added by the ANPES WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
N	NB Windows Patterns	WINDBKGND.EXE	Part of McAfee Nuts & Bolts. With Background Patterns you can change background patterns of wizard and dialog windows
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
X	NDIS Adapter	windows.exe	"Added by the FORBOT-BR WORM!"
X	NDIS Adapter	Winman.exe	"Added by the WOOTBOT.AG WORM!"
X	NDplDeamon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
X	Net	WINREG.EXE	"Added by the ASSASIN.D TROJAN!"
X	NetApp	winserv.exe	"Added by the SHADOWTHIEF TROJAN!"
U	NetPatrol	winclient.exe	"NetPatrol network monitoring software"
X	Network Access	winssh.exe	"Added by a variant of the SDBOT WORM!"
X	Network protocol service	wintcp.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Network Provisioning Service	WinNPS.exe	Added by an unidentified WORM/TROJAN!
X	NI.UWA6P_0001_N56M1001	WinAntiVirusPro2006Installer.exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N69M0303	WinAntiVirusPro2006Installer[1].exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N73M1004	WinAntiVirusPro2006FreeInstall.exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA6P_0001_N91M1807	winantiviruspro2006freeinstall[1].exe	"WinAntiVirus Pro 2006 misleading virus software - not recommended see here"
X	NI.UWA7P_0001_N91M0809	winantiviruspro2007freeinstall[1].exe	"WinAntiVirus Pro 2007 misleading virus software - not recommended see here"
X	NI.UWAS6_0001_N57M1312	WinAntiSpyware2006FreeInstall.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended see here"
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	nsdcmd vid process	nsdcmdwin.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	NT LM Security Support Provider	WinNTLM.exe	"Added by a variant of the SDBOT WORM!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTsocket	NoeWinnt.exe	"Added by the ATAKA-E TROJAN!"
X	nvc Win32	nvcvc.exe	"Added by the RBOT-ADD WORM!"
X	nvchost	winlogon.exe	"Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NvCpl	windowsp.exe	"Added by a variant of the SDBOT WORM!"
X	NvCplScan	winasp.exe	"Added by the FORBOT.BZ WORM!"
?	OEPowerPlugs	winoeinit.exe	"??"
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
Y	OfficeScan95	pccwin97.exe	"Trend Micro antivirus OfficeScan"
X	OKGO	winutade.exe	"Added by the BANKER-EHZ TROJAN!"
Y	OneCareUI	winssnotify.exe	"Related to Windows OneCare Live from Microsoft"
X	Optional Web Drivers For WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	OS Security	mswind32.pif	"Added by the RBOT-ASU WORM!"
X	OSA	winword.exe	"Added by the KANGAROO-A TROJAN!"
X	Pag Windows Monitor	pag.exe	"Added by the AGENT-EOT TROJAN!"
X	PaRaY_VM	winlogon.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Patches Value	WinGamed.exe	"Added by the SDBOT.BR WORM!"
X	Performs peer to peer connection	WinPTTP.exe	"Added by the RBOT-GMI WORM!"
X	Pmedia	winsrvc.exe	"Internet marketing sofware from Permissioned Media Inc as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM!"
X	PopMark	WinTask.exe	"""Pop Marketing"" adware"
X	Program in Windows	IEXPLORE.exe	"Added by the LOVGATE.AB WORM!"
?	ProgramWindow	more comp.exe	"??"
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
U	Quick Hide Windows	qhw.exe	"Quick Hide Windows from CronoSoft - ""provides a quick and easy way for home and office PC users to quickly get sensitive materials off the screen without closing programs or losing documents"""
X	quicken	Winrar.exe	"CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR!"
X	Quicktime Mediaplayer	winmplyer32.exe	"Added by the RBOT-PM WORM!"
X	Quicktime Pro 3.0	winuodps.exe	"Added by the GAOBOT.BH WORM!"
X	RandomWin32	mgnwin32.exe	"Added by the SDBOT-DV WORM!"
U	Real Spy Monitor	Winrsm.exe	"Realspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	RealTimeProtector	winlogon.exe	"Detected by Kaspersky as the AUTORUN.DIB WORM! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Reg Service	winsy.exe	"Added by a variant of the SPYBOT WORM!"
X	Reg Service	winslogon.exe	"Added by the AGOBOT-SC WORM!"
X	Reg Service	WinnConfig.exe	"Added by the AGOBOT-PF WORM!"
X	Reg Services	Winboot32.exe	"Added by the RBOT.PB WORM!"
X	RegDone	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Registry Checkup	winreg.exe	Added by an unidentified WORM or TROJAN!
X	Registry Checkup System326a Monitor	Winregs326a.exe	"Added by a variant of the SDBOT WORM!"
X	Registry Loader	winhlpp32.exe	"Added by the GAOBOT.AO WORM!"
X	Registry oidet	win32.exe	"Added by the RBOT.BMT WORM!"
X	Registry Value Name	winapi32.exe	"Added by a variant of the RBOT WORM!"
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	RegistryChk	winbackup.exe	"Added by the MERTIAN WORM!"
X	Regkey for autostart	winservice.exe	"Added by the RBOT-NU WORM!"
X	REGRUN	winfix22490.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
U	RegRun WinBait	winbait.exe	"Part of RegRun - used to detect unknown viruses. RegRun compares winbait.exe with the original copy called winbait.org and warns if the files are different.."
X	Remote Desktop Help Session Manager	WinRDH.exe	"Added by a variant of the SDBOT WORM!"
X	Remote Procedure Call	winrpc.exe	"Added by the RBOT-KM WORM!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	Remote Procedure Calls	mswinrpc.exe	"Added by the RBOT.KJ WORM!"
X	Remote Procedure Calls	mswinc.exe	"Added by the RBOT-IT WORM!"
X	Remote Procedure Calls	win.exe	"Added by the SDBOT-QI WORM!"
X	REMOVE ME	windos.exe	"Added by the SDBOT.EE WORM!"
X	RichMedia	rundll32.exe [path] hbcast.dll WaitWindows	"Henbang adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Windowsinf or Winntinf folder"
X	rpc Win32	shost32.exe	"Added by the RBOT-ABL WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
X	RPCall_WIN2K	Kurawas.exe	"Added by the BHARAT.A WORM!"
X	rpcda Win32	rpcda.exe	"Added by the RBOT-AEE WORM!"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	RsWin	lsass.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	run windows	servic.bat	"Added by the REBOOT-AP TROJAN!"
X	run32dll	WINClock.exe	Added by an unidentified VIRUS WORM or TROJAN!
?	run=	win.ini	"??"
X	run=	mouse_configurator.win	"Added by the GAGGLE.E WORM!"
X	Rund1l32	Winfi1e32.exe	"Added by the MERTIAN WORM!"
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	Rundll32	Windows.exe	"Added by the QQPASS.E TROJAN!"
X	runing	win.exe	"Added by the DELF-LC TROJAN!"
X	RunProg	wini.exe	"Added by the OPTIX.04.D TROJAN!"
X	RunWin	[path to file]	"Added by the BANKER-ES TROJAN!"
X	runwin32	runwin32.exe	"Added by the ESEARCH-A TROJAN!"
X	RUNWIN32	runwin32.exe	"Added by the VB-AET TROJAN!"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	runwinlogon	winlogon.exe	"Detected by Trend Micro as the AGENT.TQY TROJAN! See here. Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Safe	SafeWin.exe	"Added by the FOCOSENHA TROJAN!"
X	ScheduIr	winagent.exe	"Added by a variant of the SDBOT WORM!"
X	Scheduler	winagent.exe	"Added by the TACTSLAY.B TROJAN!"
X	secure socket layer	wins32a.exe	"Added by an IRCBOT TROJAN!"
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Patches	WinLab32.exe	"Added by the SDBOT-KB WORM!"
X	Service Client	winsvcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Service Monitor	WinOcx.exe	"Added by the RBOT-AQJ WORM!"
X	Service Process	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Services	winread.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	Services	windns.exe	"Added by a variant of the RBOT WORM!"
X	services	windows32.exe	"Added by the FLYVB-C WORM!"
X	Services Start2	odcwinst.exe	"Added by the PYSKE-D WORM!"
X	Services32 Startup	win32dll.exe	"Added by the SDBOT-XO WORM!"
X	Servicewin	Hide32.exe	"Added by the MSNVB-D WORM!"
X	Sevice	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
N	SFP	vzSFPWin.EXE	Verizon Online Support Center - prompts for online updates
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
X	SheduIer	winagent.exe	"Added by the BDOOR-EB BACKDOOR!"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN!"
X	Shell Tray Window	ShellTraywnd.exe	"Added by the STULTDOR-A TROJAN!"
N	Shockwave Init	SWINIT.EXE	Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
N	SideWinderTrayV4	SWTrayV4.exe	MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
U	SiS Windows KeyHook	keyhook.exe	"SIS graphics cards related: ""Super VGA Keyboard Daemon"" - hooks into the keyboard processing chain in order to enable hotkey settings"
X	sis32	winsos.exe	"Added by the QQPASS.IA WORM!"
X	Sistray32	win.bat	"Added by the JUMPRED.A WORM!"
X	SkynetRevenge	winlogon.scr	"Added by the NETSKY.AA WORM!"
N	SM56 Helper Win32 Utility	sm56hlpr.exe	Helper utility for Motorola based SM56 software modems - resides in the System Tray
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
U	SMS Win9x Message Agent	SMSMsg.exe	This program assigns a user to a Systems Management Server site
X	SMSERIALSTARTER	win32st.exe	"Detected by McAfee as the FAKEALERT-AH TROJAN! See here. Installed with the SpyBurner spyware remover - which is not recommended see here"
X	SMSERIALWORKERSTARTER	winstrse.exe	"Added by an unidentified WORM or TROJAN! See here. Installed with the SpyBurner spyware remover - which is not recommended see here"
X	smsger	Win.exe	"Added by a variant of the SDBOT WORM!"
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
X	Sound System	WinSound1.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	spoolsvs	wintre.exe	"Added by the SDBOT.EGQ WORM!"
X	spoolsvs	wincfy.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	SpyEx	Winllogo.exe	"Added by the PRSKEY-A WORM!"
X	SpywareGuard	winproc32.exe	"Startpage adware Trojan"
X	SpywareGuardPlus	winmm64.exe	StartPage.ht homepage hijacker
X	sqservices	wins32.exe	"Added by the PROGENT-B TROJAN!"
U	Srv32Win	SpyAgent4.exe	"SpyAgent - monitoring software that creates records of everything people do on a computer ie spying or monitoring depending upon how you call it"
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
U	srv32win	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself remove it"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
X	ssgrate.exe	winerdir.exe	"Added by the MITGLIEDER.O TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
X	ssgrate.exe	wintems.exe	"Added by the MITGLIEDER.Q TROJAN!"
X	SSK Service	winssk32.exe	"Added by the SOBIG.E WORM!"
X	Start	windows.vbs	Homepage hijacker
X	Start Upping	windupds.exe	"Added by the SDBOT.AFH WORM!"
X	Start Upping	windupdts.exe	"Added by a variant of the RBOT WORM!"
N	Start Wingman Profiler	lwtest.exe	Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer it's best to leave it unchecked
N	Start Wingman Profiler	lwemon.exe	Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer it's best to leave it unchecked
X	startkey	RunWinRaR.exe	Added by a variant of the BIFROSE-LV TROJAN!
X	startkey	win32i.exe	"Added by the BIFROSE-R TROJAN!"
X	startkey	winampXP.exe	"Added by the BIFROSE-OY TROJAN!"
X	startkey	winlogin.exe	"Added by the BIFROSE-PM TROJAN!"
X	Startup	WinlogonStartup	Unidentified malware
X	startwin	startwin.exe	"Added by the ANTIMAN.A WORM!"
X	startwindowskeyuser	rundle2.exe	"Added by the JAVAKILLER TROJAN!"
X	stup1db0t	_win.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	STV	winscrne.exe	"Added by a variant of the SDBOT WORM!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
U	SurfinGuard Pro	winsfcm.exe	"SurfinGuard Pro from Finjan - internet protection software protects against all malicious code delivered through executables scripting files ActiveX and Java"
X	SvcH0st	WINAGENT.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	Svchost	winhost.exe	"Added by the LOLAWEB.A TROJAN!"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	svhost windows services	svhost8.exe	"Added by the RBOT-WQ WORM!"
X	svwin32	unninst32.exe	"Added by the AGOBOT-NF WORM!"
N	SWd	winwd.exe	"PC Security from Tropical Software - lock files password protect etc"
X	swingsys	SWINGSYS.EXE	"Added by the BANCOS-CX TROJAN!"
X	Sygate Personal Firewall	Win32x.exe	"Added by the RBOT-KZ WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	win31243.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Symantec Antivirus professional	windows .exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	Winhp32.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	winudp.exe	"Added by a variant of the WOOTBOT WORM! See here"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	syncman	winsync.exe	"Added by the MANCSYN-A TROJAN!"
X	Syntax	windows32.exe	"Added by the SDBOT.CQ WORM!"
X	Sys29	win***32.exe [* = random char]	"EliteBar adware"
U	sys32cmd	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	sys32sql	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysA	win***32.exe [* = random char]	"EliteBar adware"
X	Syscheck	win.hta	Browser hijacker
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	Sysctrls	win32dll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	sysdir	winrun.exe	"Added by the WINBUR.B WORM!"
X	SysInit	wininit32.exe	"Added by the XABOT WORM!"
X	SysStart	syswin.exe 1	"Added by the AUTORUN-EY WORM!"
X	System	serwin.exe	"Added by the LDPINCH-BN TROJAN!"
X	System	WINL0G0N.EXE	"Added by the BANCOS-DB TROJAN!"
X	System	windowsps.exe	"Added by a variant of the RBOT WORM!"
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	SYSTEM	windmupdr.exe	"Added by a variant of the RBOT WORM!"
X	System	kernelwind32.exe	"Added by the VXIDL.FT TROJAN!"
X	System	kernelwind64.exe	"Added by the DLOADER.DJD TROJAN!"
X	System Check	win_klr32.exe	"Added by the DELF-DRA WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Drivers	wingmt.exe	"Added by the SDBOT-MG WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
X	System Service	msnwindows.exe	"Added by the SPYBOT.YCL WORM!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System32	winds32.exe	"Added by the DWNLDR-HFY TROJAN!"
X	SystemAdministration	Wincmp32.exe	"Added by the ASYLUM TROJAN!"
X	SystemMigration	WinMedia.exe	"Added by the KELVIR.EI WORM!"
X	SystemReg	WINREG.EXE	"Added by the DEWIN.A TROJAN!"
X	Systems Backups	windrives.exe	"Added by the AGOBOT-RB WORM!"
X	systems usb driver	Windows2.exe	"Added by a variant of the RBOT WORM!"
X	SystemTray	lsvhostwinlk.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
X	SysWin	SysWin.exe	"Added by the IRCCONTACT TROJAN!"
X	syswin	v6.exe	"Added by the AGENT-ECM TROJAN!"
X	syswin.txt	[3 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	syswin32	syswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Syswindow	Syswindow.exe	"Added by the COW TROJAN!"
X	sysygm64	winrxd64.exe	"Added by the IRCBOT-RK TROJAN!"
X	T4skM4n4g3r	Wink3sk9.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Task manager	UPDATEWIN.exe	"Added by the RBOT.BBS WORM!"
X	Taskmon driver	winampa.exe	"Added by the LOONY-I TROJAN! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of the Program Files directory whereas this file is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	TEXTCONV	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ThE	wind0s.exe	Added by an unidentified WORM or TROJAN!
X	Torjan Program	WINLOGON.EXE	"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup! This trojan file is found in the Windows or Winnt folder"
U	Touch Manager	WinLED.exe	Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality
N	Tour	wincool.exe	Component of WinME that's annoying as hell. Pop's up a prompt to play the C:WINDOWSApplication DataMicrosoftINTROCONTENT.HTA that plays a full screen version of the WinME product preview Windows Media video file that cannot be stopped to my knowledge until it finishes. That prompt will keep popping up after an install/reinstall of WinME until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 minutes and don't bother deleting that entry Windows puts it right back. Not only should you disable it from running you should delete the thing altogether as it somehow can re-enable itself. Apparently you can try setting the file to read only
U	Track4WinMonitor	STMonitor.exe	"Track4Win Monitor surveillance software. Uninstall this software unless you put it there yourself"
X	TrayX	winppr32.exe	"Added by the SOBIG.F WORM!"
X	Tsk Mng Hlp	wins32.exe	"Added by the AGOBOT-JB WORM!"
?	Tweak Manager	WinManager.Exe	"WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed?"
X	Undefined	winter.exe	"Added by the KILLAV.LW TROJAN!"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe common.pif common.scr Sexo.exe Sexo.jpg.pif ini_file__.pif load_me__.tmp msfile.pif system_load_.pif or zipped.rar.pif"
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatewin	update.exe	"Added by a variant of the SDBOT WORM!"
X	UpdateWin	[random filename]	"Detected by Kaspersky as the IRCBOT.AZW TROJAN! See here"
X	upddateit	winit.exe	"Added by the RBOT-MS WORM!"
X	Upgrade Service	winupd.exe	"Added by the TOFGER-U TROJAN!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
X	UpTimes service	WinUp.exe	"Added by the RBOT-AKB WORM!"
X	urudjeffni	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	USB 2.0 Driver	Winsys32.exe	"Added by the AGOBOT-QM WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
X	USB 2.1 Driver	winupdate1.exe	"Added by a variant of the RBOT WORM!"
X	USB Device	win32usb.exe	"Added by the FORBOT-BQ WORM!"
X	USBHWINFO	mac.exe	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	[path to trojan]	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	sst6.exe	"Added by the LOWZONE-I TROJAN!"
X	userinit	winlogon.exe	"Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Video	winamp32.exe	"Added by the AGOBOT-NG WORM!"
X	Video Proces	winaps.exe	"Added by the AGOBOT.HD WORM!"
X	Video Process	winasp.exe	"Added by the AGOBOT-IS WORM!"
X	Video Process	wincert32.exe	"Added by the AGOBOT.JT WORM!"
X	VIEW POINT DRIVERS FOR WIN32	phqghu.exe	"Added by a variant of the RBOT WORM!"
X	virtual	winit.exe	"Added by the MUGLY.A or MUGLY.B WORMS!"
X	virtual	winprotect.exe	"Added by the MUGLY.C WORM!"
X	virtual	wini.exe	"Added by the RBOT-YX WORM!"
X	virtual-ie	winlogi.exe	"Malware - detected by Kaspersky as the WINAD.H TROJAN!"
X	virtual-machine	winlogin.exe	"Added by the RBOT-VU WORM!"
X	virtual-machine	wini.exe	"Added by the RBOT-WR WORM!"
X	Vsample	winxpsock.exe	"Added by the SDBOT.BLK WORM!"
Y	Vshwin32EXE	VSHWIN32.EXE	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
X	W1N32.DLL	WINLOGON .exe	"Added by the DROPPERFL.A TROJAN!"
?	WCPC	wintsvcc.exe	"??"
X	WCPI	wintsvit.exe	"PurityScan/Clickspring adware"
X	WCPS	Wint**.exe [* = random char]	"PurityScan/Clickspring adware"
X	WCPT	wintsvtr.exe	"PurityScan/Clickspring adware"
X	WEB DRIVERS FOR WIN32	phqgh.exe	"Added by a variant of the RBOT WORM!"
X	Welcome	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	win	regedit -s ..win.dll	"Added by the SEEKER.K TROJAN!"
X	win	xwinxrpc32.exe	"Added by the AGOBOT-MV WORM!"
X	win	xwinxrpc.exe	"Added by the AGOBOT-MV WORM!"
X	WIN	ehshell.exe	"Added by the MYTOB-CQ WORM!"
X	WIN	windows.exe	"Added by the REATLE.C WORM!"
U	win	homesec.exe	"Related to the Sentry Parental Controls software"
X	Win Antivir 2008	Win Antivir 2008.exe	"Win Antivir 2008 rogue security software - not recommended see here"
X	Win Antivirus 2008	Win Antivirus 2008.exe	"Win Antivirus 2008 rogue security software - not recommended see here"
U	Win Chimes	winchi~1.exe	"WinChimes - enhancement software for the system clock that runs in the system tray"
X	Win Comm	WinComm.exe	"Added by the WINCOM TROJAN!"
X	Win Command	command32.exe	"Added by the AGOBOT.XQ WORM!"
X	Win Config	winconfig.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win CPU	sysin.pif	"Added by the RBOT-AXL WORM!"
X	win ctl app	wuctl.exe	"Added by a variant of the SDBOT WORM!"
X	Win Defrag	windfrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrag!	windefrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrags	defrag.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Win Drivers SSL	hpws.exe	"Added by the IRCBOT.67098 WORM!"
X	Win Drivers SSL	TASKMAN4.exe	"Added by a variant of the RBOT WORM!"
X	Win Drivers SSL32	hpwsnnsbc.exe	"Added by the SPYBOT.MAR WORM!"
X	WIN HOST PROCESS	WIN HOST PROCESS.EXE	"Added by the KEYLOGGER.CLONE TROJAN!"
X	Win INI 32	msrp32.exe	"Added by the RBOT-FZC WORM!"
X	Win l5oahder	winampa.exe	"Add