NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker see here (* = any digit)"
X	(*)Run	win32API.exe	"Homepage hijacker see here (* = any digit)"
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware CoolWebSearch parasite related - detected by Kaspersky as the VB.DU TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winlog.exe	"Unidentified adware. Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads animated gifs things you don't want to see"""
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	252	winmgr.exe	"Added by the LEGMIR-AT TROJAN!"
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	@	regedit -s ..win.dll	"Added by the SEEKER.K TROJAN!"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion WinPoET is attractive to equipment providers modem suppliers RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking"
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
X	Access Control App	winsto.exe	"Detected by Kaspersky as the AGENT.DGO TROJAN! See here"
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive convenient and enjoyable"""
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
U	AMP WinOFF	winoff.exe	"WinOFF is "" a utility designed to shut down Windows computers automatically in a fully configurable way"""
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	APIMon	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam spyware dangerous or time-wasting content phishing scams hackers and intruders"""
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	Audio Device Manager	winfp.exe	"Detected by PCTools as the IRCBOT.BIV TROJAN! See here"
X	Audio Device Manager	WinNT.exe	"Added by the BANKER.BTG TROJAN!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
X	auto	win32.exe	"Added by the SMALL!SD5 TROJAN!"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	autoload	windowsupdate.exe	"Detected by Trend Micro as the POLYCRYP.DY TROJAN! See here"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	bawindo	bawindo.exe	"Added by the BEAGLE.AR or BEAGLE.AU WORMS!"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentied WORM or TROJAN!
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cftmon	WindowsUpdate.exe	"Detected by Kaspersky as the AGENT.AQK BACKDOOR! See here"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	ContentService	winservn.exe	Homepage hijacker
X	ControlPanel	twink64.exe internat.dllLoadKeyboardProfile	"Added by the DLOADER-BW TROJAN. Note - the ""twink64.exe"" file is found in %System%"
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	dvd98	windvd98.exe	"Added by the CULT.P WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
U	ELSA WINman Suite	Winmsuit.exe	Allows you to totally customize your ELSA graphics card settings including overclocking the GPU
?	encapsulated command tool	wintr.com	"??"
X	Enh Win Updt	enhupdt.exe	"Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN!"
X	erfgddfk	wind2ll2.exe	"Added by the BEAGLE.CQ WORM!"
X	erghgjhgdr	windlhhl.exe	"Added by the BEAGLE.BG WORM!"
X	erghgjhjgdr	windlhhl.exe	"Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS!"
X	erthegdr	windll2.exe	"Added by the BEAGLE.CG WORM!"
X	erthgdr	windll.exe	"Added by the BEAGLE.AO or BEAGLE.AQ WORMS!"
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Firewall auto setup	winlogon.exe	"Added by a TROJAN - see here. Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
N	Folding@home	WINFAH.EXE	Folding@Home is a distributed computing project which studies protein folding misfolding aggregation and related diseases - must be running in order to access the internet to upload to the servers. Available via Start -> Programs
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture print or save the current window"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	svchost.exe	"Added by the SPYBOT.NC WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	sv?h?st.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	getwin	winB_.exe	"Added by the BANKER-HS TROJAN!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	gpmce	window.exe	"Detected by Kaspersky as the VB.CK WORM! See here"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
N	GWInkMonitor	GWInkMonitor.exe	Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink do you want to buy some!
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM! (where HKLMRun represents HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun)"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
X	HWINFO*	HWINFO*	"Added by the PUROL WORM! where * is a random character"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
U	IBWin Monitor	IBMonitor.exe	"IBackup for Windows"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
U	IE New Window Maximizer	iemaximizer.exe	"IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows"
X	IE Runtime	wini.exe	"Added by the PICRATE.B WORM!"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IExplorerService	WinSock.exe	"Detected by Kaspersky as the AGENT.KIU TROJAN! See here"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	infwin	infwin.exe	"VX2.Transponder parasite updater/installer related"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Internal	regedit.exe /s %windir%c:[month number]	"Added by the FORTNIGHT.D TROJAN!"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	Internet	wins.exe	"Detected by PCTools as the RBOT.AAYF WORM! See here"
X	Internet Security Service	mysqlwin32.exe	"Detected by Trend Micro as the RBOT.UX TROJAN! See here"
X	INTERNET SERVISES	winz32.exe	"Added by the KWBOT.Z WORM!"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	INTERNET_SERVISES	winz32.exe	"Added by the SDBOT.Q TROJAN!"
X	InterU	WINDRV.EXE	"Added by the IRCINTER.A TROJAN!"
N	Intervideo Win Cinema Manager	WinCi