NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.dll	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.exe	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.js	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
U	!AVG Anti-Spyware	avgas.exe	"Part of AVG Anti-Spyware from Grisoft"
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$drv	$sys$drv.exe	"Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
U	$Volumouse$	volumouse.exe	"Volumouse from Nirsoft. ""Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse"""
X	(Default)	media_driver.exe	"Added by the TUPEG VIRUS! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	Shania.vbs	"Added by the SHANIA BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	spolsvr2.exe	"Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+	ISASS.exe	"Added by the ASSIRAL.B WORM!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.nvsvcb	smssb.exe	"Added by the BOXED.CG TROJAN!"
X	.Prog	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process which should not appear in Msconfig/Startup!"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
?	00DSKSVR00	desksaver.exe	"Related to Advanced Desktop Shield"
?	00DSKSVR01	desksaver.exe	"Related to Advanced Desktop Shield"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Detected by McAfee as the FAKEALERT-AM TROJAN! See here"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons restore after a crash"""
N	12Voip	12Voip.exe	"12Voip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	1:	hpdrv.exe	HP utility for monitoring when and how many recoveries have been done
N	1A:MacVisionTrayMonitor	TrayMonitor.exe	Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock)
Y	1A:Stardock MCP	mcpserver.exe	Master Control Program for Stardock apps in development. People should leave it running if they're using any of the Stardock applications
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
X	27	slsorve.exe	"Added by the SLSORVE-A TROJAN!"
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
X	333	svchost.exe	"Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This one is located in a ""Syswm1i"" directory"
Y	3dfxv2ps.dll	3dfxv2ps.dll	Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
U	A Verizon App	VERIZO~1.EXE	"Part of Verizon Online Support Manager"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion WinPoET is attractive to equipment providers modem suppliers RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide show restore icons that are lost in an Explorer crash remove dead tray icons minimize any window to the System Tray"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	absr	mwsvm.exe	"SeekSeek search hijacker related - see here"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
X	Ac97Sound	snddrv.exe	"Detected by Kaspersky as the VB.AXG TROJAN! See here"
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates driver updates or full product updates and automatically download and install them according to user configuration"""
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity Inc. Smart card-based strong authentication software - for photo IDs proximity badges for facility access and as digital identification and authentication"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
N	Activation	Activation.exe	Part of Microsoft Money
U	Activboard	MMKeybd.exe	Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock Caps Lock Scroll Lock keys
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
N	Active CPU	acpu.exe	"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
U	Active Desktop Calendar	ADC.EXE	"XemiComputers Active Desktop Calendar"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email serves as a SPAM filter and can also protect you from harmful items that can be sent via email"
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans spyware adware trackware dialers keyloggers and even some special kinds of viruses"""
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ACTIVEDS	ACTIVEDS.EXE	"Added by the OPASERV.T WORM!"
N	ActiveEyes	ActiveEyes.exe	ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small it's free and comes with a range of options and animations. Not needed - if unavailable via Start -> Programs create your own shortcut
U	ActiveKeys.AAB635BD7D054a37A576	akeys.exe	"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
Y	ActiveShield	MCVSSHLD.EXE	McAfee VirusScan On-line. See also the McAgentExe entry
N	ActiveSpeed	AS.exe	"Ascentive ActiveSpeed internet optimizer - not recommended see here and here"
X	ActiveSync	wcescom32.exe	"Added by the MANCSYN-E TROJAN!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems Inc. Like macro programs ActiveWords sits in the background and watches as you type. When it recognizes that you?ve typed an ActiveWord it takes the associated action such as replacing your keystrokes with the text you?ve defined"
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
U	Activity	actik.exe	"ActivityKey keystroke logger/monitoring program - remove unless you installed it yourself!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
X	ACTX1	v1201.exe	"Added by the VB.IS TROJAN!"
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast track versions across applications link files together and share them in creative collaboration without fear of overwriting someone else's work"""
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe? Creative Suite Version Cue? helps you find files fast track multiple versions of your files and share your files for creative collaboration"""
?	Adobe_ID0EYTHM	VERSIO~2.EXE	"Part of an Adobe product. What does it do and is it required?"
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	ADS Adware Remover	ADS Adware Remover.exe	"ADS Adware Remover - not recommended see here"
U	ADService	ADService.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98/ME"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
X	adstartup	automove.exe	"Adlogix adware variant"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
X	Adtools Service	AdTools.exe	"Windupdates Adware"
X	Advanced DHTML Enable	exo32.exe	"Added by the RANCK-FI TROJAN!"
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
U	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover anti spyware tool"
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect optimize clean and repair your computer and Registry."" The PRO version adds automation anti-spyware privacy protection and performance tune-ups"
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast clean and in its best shape"""
X	AdvancedCleaner Free	UADC.exe	"AdvancedCleaner misleading security software - not recommended see here"
X	AdVantage	AdVantage.exe	"MediaAdVantage adware"
X	advap32	[path to trojan]	"Detected by Trend Micro as the MUTANT.AT TROJAN! See here"
X	Advapi	Advapi.exe	"Added by the NETDEVIL.12 WORM!"
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
X	advmon32	advmon32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	AdwareRemover2007	AdwareRemover2007.exe	"AdwareRemover2007 spyware remover - not recommended see here"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
X	agentsvr	agentsvr.exe	"Detected by Kaspersky as Monker.A adware. Note - do not confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder"
?	AidemHotKey	DVMAIN.EXE	"Keyboard related"
U	AJC Active Backup	AJCActBk.exe	"AJC Active Backup from AJC Software - ""Instantly backup files you change on your PC and keep multiple versions to undo"""
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
X	Alevir	Alevir.exe	"Added by the OPASERV-A WORM!"
X	AlevirOld	[worm filename]	"Added by the OPASERV WORM!"
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	All Sea screen saver	TaskTray.exe	Free screensaver installs lots of foistware - remove it
U	Alogserv	Alogserv.exe	From McAfee VirusScan for logging scanning activities. In some cases if left running it can cause CPU % usage to go between 5-95% or go to and stay at 100%. Disabling it impacts on the reported last scan date. It is reported to cause jerky graphics response in many games. As of version 6 this is a critical component of McAfee and disabling it can cause a PC to lock up
X	alpha	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
?	ALServ	ALServ.exe	"Altec Lansing AMS speaker related. What does it do and is it required?"
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
X	amva	amvo.exe	"Added by the SILLYFDC-BR WORM!"
X	anbv32	nabv32.exe	"Added by the TITOG.C WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe kaspersky.exe nrton.exe wins.exe gah32.exe 1.tmp syste.exe alg.exe socks.exe winxpsp2.exe tek9.exe sks.exe hihi.exe s.exe xps2.exe dns2.exe ikav32.exe and more..."
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
X	antispy	ANTIVIR.exe	"IE AntiVirus rogue security software - not recommended see here"
X	antispy	ANTIVIRUS.exe	"IE AntiVirus rogue security software - not recommended see here"
X	antispy	ieav.exe	"IE AntiVirus rogue security software - not recommended see here"
X	AntiVerminser	AntiVerminser.exe	"AntiVerminser spyware remover - not recommended see here"
X	antiviirus	antiviirus.exe	Added by a variant of the AGENT.KEU TROJAN!
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
X	Antivir64	Antivir64.exe	"Antivir64 rogue security software - not recommended see here"
X	AntiVirGear *.*	AntiVirGear *.*.exe	"AntiVirGear misleading security software where *.* represents the version number - not recommended see here"
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	AntiVirus	AntiVirus.exe	"Added by the BANKER-EHB TROJAN!"
X	Antivirus	antvrs.exe	"Antivirus 2008 rogue security software - not recommended see here"
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended see "
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended see here"
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden misleading security software - not recommended see here"
X	Antivirus2008y	antvrs.exe	"Antivirus 2008 rogue security software - not recommended see here"
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold malware"
X	AntiVirusPro	AntiVirusPro.exe	"AntiVirusPro misleading security software - not recommended see here"
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirusPro misleading security software - not recommended see here"
?	AntiVirusProtection	qumk.exe	"??"
X	AntiVituS	Base.exe	"Added by the BAS.A WORM!"
Y	AnVir	AnVir.exe	"AnVir Task Manager - protects computer against viruses and manages running processes and startup files"
Y	AnVir Task Manager	AnVir.exe	"AnVir Task Manager - protects computer against viruses and manages running processes and startup files"
U	anvshell	anvshell.exe	System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar
U	AnyDVD	AnyDVD.exe	"AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts - hence the ""U"" recommendation"
U	AnyDVD	AnyDVDtray.exe	"System Tray access to AnyDVD from SlySoft - which descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts"
Y	aol	avp.exe	"AOL's Active Virus Shield (by Kaspersky) - found in an AOLActive Virus Shield sub-directory"
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
X	AOLRegKey32	AOREGSVR512.EXE	"Unidentified malware - see here"
?	AOLSAV	AOLAgent.exe	"AOL ISP related. What does it do and is it required?"
X	aouei	sysrtmvs.exe	"Chivio dialer"
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
X	apisvc.exe	apisvc.exe	"Added by a variant of the LAMEBOT TROJAN!"
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM! See here"
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Browser	apnsvc.exe	"Added by the CHECKOUT WORM! See here"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Detected by PCTools as the IRCBOT.BJJ TROJAN! See here"
X	Application Layer Services	avrsvc.exe	"Detected by PCTools as the IRCBOT.BJM TROJAN! See here"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam spyware dangerous or time-wasting content phishing scams hackers and intruders"""
?	ArabLionZ Drive	ArabLionZ.Drive.exe	"ArabLionZ Drive - part of ArabLionZ XP Tools. What does it do and is it required?"
X	Archive	archive.exe	"Adware - detected by Kaspersky as the CENTIM.A TROJAN!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
Y	ashAvast	ashAvast.exe	"Part of Avast antivirus"
Y	ashMaiSv	ashmaisv.exe	"Part of Avast! anti-virus software - E-mail scanner"
U	AsioReg	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	AsioThk32Reg	rregsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
X	asp-srvc	asp-srvc.exe	"Added by the AGOBOT-KG WORM!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe according to PREVX and InCode Solutions. Can any ASUS owners with this file confirm? File is located in %Windir%"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe according to PREVX and InCode Solutions. Can any ASUS owners with this file confirm? File is located in %Windir%"
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
N	ASUSKey	V38SHELL.EXE	System tray Icon for quickly changing video modes
X	atapidrv	atapidrv.exe	"Added by the AGOBOT-SL WORM!"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
N	ATI DeviceDetect	ATIDtct.EXE	Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
X	Ati Display Settings	atividx.exe	"Added by the RBOT-GAS WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
X	Ati2evxx	Ati2evxx.com	Added by the BACKDOOR-CPC TROJAN!
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename rather than a lower case ""L"""
U	ATIPOLAB	ati2evxx.exe	ATI External Event Utility EXE Module. This task can comsume lots of CPU resources on some computers but it can help with graphics card problems. Leave enabled unless it consumes too many CPU resources
U	ATIPOLAB	ati2evae.exe	ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks
U	ATIPOLL	ati2evxx.exe	ATI External Event Utility EXE Module. This task can comsume lots of CPU resources on some computers but it can help with graphics card problems. Leave enabled unless it consumes too many CPU resources
X	ATITech	Active.exe	"Added by the ROAMER-A TROJAN!"
X	ativopen	ativopen.exe	Premium rate adult content dialler
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Audio Device Manager	winfp.exe	"Detected by PCTools as the IRCBOT.BIV TROJAN! See here"
X	Audio Device Manager	WinNT.exe	"Added by the BANKER.BTG TROJAN!"
X	Audio Device Manager	WNDXP.exe	"Detected by Kaspersky as the IRCBOT.AJL TROJAN! See here"
X	Audiodrv	audiodrv.exe	"Added by the CRYPTER-C TROJAN!"
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system but should not be terminated unless suspected to be causing problems"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status checking ink levels etc. ""X"" represents the computer's network name ie PAULS-PC PETES-LAPTOP etc"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start -> Programs"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Detected by Kaspersky as the AGENT.FQ TROJAN!"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auto__antiav__key	antiav_exe.exe	"Added by the BAGLEDI-AA TROJAN!"
X	auxAudioDevice	aux32.exe	"Added by the AIZU WORM!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
N	AvaFind	AvaFind.exe	"AvaFind file search utility"
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
X	avast	troyan.exe	"Added by the SMALL.CZ TROJAN!"
Y	Avast!	ashserv.exe	"Part of Avast! anti-virus software"
Y	avast!	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner right-click access to other options and event notifications"
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner right-click access to other options and event notifications"
Y	avast! Web Scanner	Ashwebsv.exe	"Part of Avast! anti-virus software"
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
X	avc	avmon.exe	Added by an unidentified TROJAN!
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	Avengine	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
Y	AVG Anti-Virus system	avgcc.exe	"AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components settings and updates"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
Y	AVG7_AMSVR	Avgamsvr.exe	"AVG antivirus related"
Y	AVG7_CC	avgcc.exe	"AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components settings and updates"
Y	AVG7_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG7_Run	avgw.exe	"AVG Anti-Virus 7.0 related"
U	AVG8_TRAY	avgtray.exe	"System Tray access to AVG internet security software"
Y	avgamsvr.exe	Avgamsvr.exe	"AVG antivirus related"
Y	avgcc32	avgcc32.exe	"AVG anti-virus control center. Also enables scheduled tests Outlook E-mail plug-in and automatic updates"
Y	AVGCtrl	AVGCtrl.exe	"Part of AntiVir? PersonalEdition Classic antivirus"
Y	avgfwsrv	AVGFWSRV.EXE	"Firewall part of the AVG Plus Firewall Edition"
Y	avgmsvr.exe	avgmsvr.exe	"AVG Anti-Virus 7.0 related"
Y	AVGnt	AVGnt.exe	"AntiVir® PersonalEdition Classic antivirus. System Tray icon and control program"
Y	Avgserv9.exe	Avgserv9.exe	"AVG antivirus background monitoring"
Y	AVGuard	AVGuard.exe	"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
Y	AVG_CC	avgcc32.exe	"AVG anti-virus control center. Also enables scheduled tests Outlook E-mail plug-in and automatic updates"
Y	AVG_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG_RegCleaner	AVGREGCL.exe	"AVG Anti-Virus 7.0 Registry Cleaner - for checking the registry for virus additions and other security problems"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
X	Avimgt	Avimgt.exe	"Added by the GEMA TROJAN!"
X	Avimgt32	Avimgt32.exe	"Added by the GEMA TROJAN!"
Y	avinit	AVINIT9X.EXE	"Command Antivirus related"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
Y	AVKBar	AVKBar.exe	"GData AntiVirusKit Anti-virus"
U	AVKTray	AVKTray.exe	"System Tray access to AntiVirenKit InternetSecurity from G DATA Software AG"
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
?	AvMenu	AVMenu.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
Y	AVMWlanClient	wlangui.exe	Related to broadband products from avm.de
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
Y	avp	avp.exe	"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	avp	avp.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	avp	xar6000v7.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	AVP-SE	avp-32.exe	"Added by the AGOBOT.FS WORM!"
X	avpa	avpo.exe	"Added by the LEGMIR-ARK TROJAN!"
Y	avpcc	avpcc.exe	"Kaspersky Labs anti-virus"
Y	avpm	avpm.exe	"Kaspersky anti-virus"
X	AvpM	AvpM.exe	"Added by the STARTPAGE-ID TROJAN! Note - this is not the popular Kaspersky antivirus and this file is located in the WINDOWSpchealthUploadLBConfig directory"
X	avpms	avpms.exe	"Detected by Kaspersky as the ONLINEGAMES.CPV TROJAN! See here"
X	Avpr	avpr.exe	"Added by the MYDOOM.AF WORM!"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	AvpWx	WErcx.exe	"Detected by Kaspersky as a variant of the AGENT.A TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
Y	AVSCHED32	AVSched32.exe	"AntiVir® PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
X	AvSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	avserve.exe	avserve.exe	"Added by the SASSER WORM!"
X	avserve2.exe	avserve2.exe	"Added by the SASSER.B or SASSER.C WORMS!"
X	avserve3.exe	avserve3.exe	"Added by the SASSER.G WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music photos videos"
X	avtapi	avtapi.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD"" ""Winamp Remote"" ""Windows Media Player"" and ""Futuremark"""
N	Avtray	Avtray.exe	"Command Antivirus tray icon"
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
?	AVWLPSTA	AVWLPSTA.exe	"PRISM Status Tray Applet - but what is it for and is it required?"
Y	AVWUpd32	AVWUPD32.EXE	"AntiVir® PersonalEdition Classic - updater"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
Y	Avxlive	avxlive.exe	"Bullguard or BitDefender antivirus"
Y	avxlni	avxinit.exe	"Anti-virus part of BitDefender virus scanner/firewall"
?	Avxnews	??	"??"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery printer driver installation printing on Windows platforms. Printing is enabled by AXIS Print Monitor which is one of the components. Another component in AXIS Print System is AXIS IP Installer."" Now discontinued"
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery printer driver installation printing on Windows platforms. Printing is enabled by AXIS Print Monitor which is one of the components. Another component in AXIS Print System is AXIS IP Installer."" Now discontinued"
X	AXVenore	AXVenore.exe	"Added by an unidentified TROJAN - see here"
?	a_vpd	vpd.exe	"Located in the IBMTOOLSVPD sub-directory. What does it do and is it required?"
X	bab	svchst32.exe	"Added by the AGENT.Q TROJAN!"
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Background Intelligent Transfer Service	rundll32.exe	"Added by the VB-ZD TROJAN! Note - this file is located in the C:Windowshelp folder and is not to be confused with the legitimate rundll32.exe file!"
X	Backup Service	backup.svc	Unidentified adware
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	BaRloNdDiLhep	services.exe	"Detected by Kaspersky as the AUTORUN.DIB WORM! See here. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
X	Bcvsrv32	bcvsrv32.exe	"Added by the GAOBOT.BQJ WORM!"
X	Bcvsrv32	he3.exe	"Added by the AGOBOT.AKB WORM!"
X	Bcvsrv32	msxml22.exe	"Added by the AGOBOT.AKH WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
Y	BDOESRV	bdoesrv.exe	"Bitdefender 8 antivirus and firewall"
X	Beawver	saqevre.exe	"Added by a variant of the RANKY TROJAN!"
U	BelNotify	rundll32.exe [path] NPBelv32.dll RunDll32_BelNotify	"""BelTech from Belarc enables licensees to offer automated Web-based problem resolution to their end-users. BelTech allows the end-user to simply go to a web page and automatically resolve their problem or point them to the right solution. BelTech Manager allows non-programmers to rapidly and easily deploy and maintain this service"""
?	BELORVBI	BELORVBI.exe	"??"
X	beta	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
N	BigDog303	VM303_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
N	BigDog305	VM305_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
?	BigDogPath	VM_STI.EXE	"Bundled with some software for digital cameras that use a USB connection - what does it do and is it required?"
X	bingdian	Bingdian.vbs	"Added by the BINGD WORM!"
?	BIOVCIP	BIOVCIP.exe	"??"
X	BitDefender Antivirus	BITDEFENDERX.EXE	"Added by a variant of the SPYBOT WORM!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
Y	BitDefender Live! Init	bdinit.exe	"BitDefender antivirus"
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
Y	BitDefender Virus Shield	vsserv.exe	"BitDefender antivirus"
Y	bitdefenderlive	avxlive.exe	"Main program of BitDefender virus scanner/firewall"
U	BJPD HID Control	TVMon.exe	"Related to Canon Photo viewer"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	internet.exe	"Added by a variant of the RBOT WORM!"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	blah service	msnmsgrr.exe	"Added by the RBOT.PZ WORM!"
X	blah service	tazkmgr.exe	"Added by the RBOT.UA WORM!"
X	blah service	FaLeH.exe	"Added by the RBOT-AES WORM!"
X	blah service	microsoft.exe	"Added by a variant of the RBOT WORM!"
X	blah service	evosys.exe	"Added by a variant of the RBOT WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Blah service	CCAPPS32.EXE	"Added by the RBOT.TV WORM!"
X	blah services	iczw.exe	"Added by the RBOT-GMP WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	blahx service	msnjompa.exe	"Added by the SDBOT.AML WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
?	BlazeServoTool	MediaDetector.exe	"Related to BlazeDVD from BlazeVideo - which is ""is leading powerful and easy-to-use DVD player software."" What does it do and is it required?"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
X	Boot Server	bootserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Verify	bootvfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
X	BootLoader	BootLoader.exe.vbs	"Added by the WATERWORKS WORM!"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose ""custom"" uninstall as ""automatic"" may remove other programs - see here"
X	boy lovers of bsd	ilikeboys.exe	"Added by the MYTOB.LY WORM!"
X	BPCV2	BPCV2.exe	"BroadcastPC adware"
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
N	BPServer	G6FTPSrv.exe	"BulletProof FTP Server"
X	BraveSentry	BraveSentry.exe	"BraveSentry spyware remover - not recommended see here"
X	braviax	braviax.exe	"Added by the FAKEALER.LE TROJAN!"
Y	Bredbandsbolaget	servicecenter.exe	"Related to the Brebband Swedish Broadband provider"
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	BrowseProxy	FindService.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
X	BSserver	FileKan.exe	"Added by the VB.CBW WORM!"
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
X	BTV	btv.exe	"BroadcastPC adware"
X	BtvC	btvclean.exe	"BroadcastPC adware"
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
U	bugwatcher service	bugwatcher.exe	"Bugtoaster is a service that sends reports on system/program crashes (certain types) back to Bugtoaster. They relay information to program authors and provide if available any known solutions to the crashes. It doesn't take up any room in memory just activates in the event of certain program failures"
X	BuildLab	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process which should not appear in Msconfig/Startup!"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
N	BulletProof FTP Server	bpftpserver.exe	"BulletProof FTP Server"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
Y	BullGuard XComm	XCOMMSVR.EXE	"Part of Bullguard antivirus"
Y	BullGuardInit	AVXINIT.EXE	"Part of Bullguard antivirus"
U	Button Server	bttnserv.exe	Found on a Compaq PC for the extra buttons on the keyboard for the speaker volume media player sleep and internet buttons. If the buttons aren't used on the keyboard or your's doesn't have them then it isn't required
X	BVWORSFM	bvworsfm.exe	"Added by the DLUCA-AD TROJAN!"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
Y	CaAvTray	CAVTray.exe	"eTrust? EZ Antivirus system tray application from Computer Associates"
U	Cadenza	CdzSvc.exe	"Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit integrated fax voicemail and data communications application with a simple to use interface providing fax send and receive functionality basic (single mailbox) answering machine capability and sophistcated data communications."" Main application"
U	CallCenter Printer Interface	V3faxecp.exe	"""V3 Inc. CallCenter is a free 32-bit integrated fax voicemail and data communications application with a simple to use interface providing fax send and receive functionality basic (single mailbox) answering machine capability and sophistcated data communications."" Fax printer"
U	Camera Detector	DEVDET~*.EXE	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
N	Camio Viewer x	IXApplet.exe	Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version
U	carpserv	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker allowing you to listen to the dial-up sounds for example"
X	CARPserver	CARPserver.exe	"Added by the BANKER-AN TROJAN!"
U	CARPservice	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker allowing you to listen to the dial-up sounds for example"
X	Casdvqwa	bmqnzkg.exe	"Added by the RANDEX.BE WORM!"
X	caseyvideo	caseyvideo.exe	Malware causing adult content popups
X	caseyvideo[*] [* = digit]	caseyvideo[*].exe [* = digit]	Malware causing adult content popups
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
Y	CAVRID	CAVRID.exe	"eTrust? EZ Antivirus Real Time Infection Report from Computer Associates"
Y	CAVS	CAVS.exe	"Cheyenne (now eTrust) antivirus"
X	CAZNOVAS	CAZNOVAS.exe	"Added by the CAZNO TROJAN!"
X	ccApp	gcasServ.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccApps	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process which should not appear in Msconfig/Startup!"
N	Ccdecode	rundll32.exe streamci StreamingDeviceSetup	Part of the closed caption decdoder/MS VBI codec. Should only run once
Y	CcEvtMgr	ccEvtMgr.exe	"Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via ""ccApp"" and was not required as a seperate entry but a recent update changed this"
X	ccEvtMrg.exe	ccEvtMrg.exe	"Added by the RBOT.GZ WORM!"
Y	CcPxySvc	CCPXYSVC.exe	"Part of Norton's AntiVirus 2003 Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall"
Y	CcRegVfy	ccRegVfy.exe	"Part of Norton AntiVirus 2003. ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	ccRegVfY	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	ccsvit.exe	ccsvit.exe	"Added by the STARTPA-HP TROJAN!"
N	CDANTSRV	CDANTSRV.exe	C-Dilla License Management software. Used for any program that uses C-dilla Protection example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually
X	cddrv32	cddrv32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
N	CesarFTP FTP Server	server.exe	"CesarFTPd - FTP server"
X	CEventMgr	Cell.exe	"Added by the BIFROSE-AK TROJAN!"
U	CFSServ.exe	CFSServ.exe	Belongs to Toshiba's configfree utility and searches for Wireless Devices
U	CGServer	cgserver.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X	Cgtask Services	cgtask.exe	"Added by the LALA.B TROJAN!"
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
X	che32	che.ocx.vbs	"Added by the ADENU-B VIRUS!"
Y	CheckMsgPlus	MsgPlusH.dll VerifyInstallation	"Added by MSN Messenger Plus a third party extension to MSN Messenger. This is the auto-update feature - see here for more info."
Y	CheckVCR	IOMagic.exe	"Driver for the I/OMagic Personal Video Recorder (DR-PCTV100)"
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
X	Ci Svr	cisvr.exe	"Detected by Trend Micro as the IRCBOT.AWN BACKDOOR! See here"
N	CIJxP2PSERVER	CIJxP2PS.EXE	Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model ie for IJ300 x=3 for IJ700 x=7
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
N	CitiVAN	CitiVAN.exe	"Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again"
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
U	CleverKeys	CK.exe	"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com synonyms at Thesaurus.com facts at Reference.com and more ? from almost all Windows programs including word processors Web browsers and most e-mail programs"""
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources"
N	Client Access Service	CwbSvStr.Exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources"
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
X	Clip Service Manager	clipmg.exe	"Detected by Kaspersky as the DELF.DXJ TROJAN! See here"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Clipbook Service	Clipsrv.exe	Supports Windows XP ClipBook Viewer which allows pages to be seen by remote ClipBooks
N	Clipsrv	Clipsrv.exe	Supports Windows XP ClipBook Viewer which allows pages to be seen by remote ClipBooks
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe kstatus.exe spoolsv.exe sptsupd.exe osk.exe msswchx.exe netdde.exe msbkup.exe"
X	cmds	vtsqn.dll	"Added by a variant of the VUNDO TROJAN!"
N	CmFlywaveName	CmFlywav.exe	"Driver for Linksys Wireless-G Music Bridge"
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys Inc.). ""Printer Driver Plus seamlessly integrates all the necessary components of a printer driver plus more"". Installed with some Compaq and Lexmark printers"
X	Cmpnt	Devices2.exe	"Added by the TOMPAI-D TROJAN!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	cms	iserver.exe	"Added by the DLOADER-WK TROJAN!"
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
Y	cnfgCav	CMain.exe	"Part of Comodo Antivirus"
Y	CnwiDeviceAgent	cnwida.exe	"Part of the Canon imagePROGRAF W8400 printer management software"
U	CognizanceTS	rundll32.exe [path] AsTsVcc.dll RegisterModule	"Cognizance Corp Identity And Access Management suite"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM Service	msjclh.com	"Added by the BEASTY.E TROJAN!"
X	COM Service	msdrce.com	"Added by the BEASTY.I TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
U	com.codeode.privacymantra	privacymantra.exe	"""Privacy Mantra keeps your computer clean from online and offline tracks"""
X	Comcast Network	ribiva.exe	"Added by a variant of the IRC TROJAN!"
U	COMDRV32	svdhost.exe	"Orvell Monitoring 2003 surveillance software. Uninstall this software unless you put it there yourself. Note - asks for permission to contact the IP address of http://www.protectcom.com/"
U	Comm Driver	commh32.exe	"G Data ""PC Spion"". PC monitoring and surveilling software captures all users activity on the PC see here. Disable/remove if you didn't install it yourself!"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
?	Compaq Computer Security	Rundll32.exe SECURE32.CPL Service	"??"
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
N	Compaq Message Server	COMPAQ-RBA.EXE	"Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans but fairly harmless. They send information on the ""Compaq Advisor/Compaq Message Screener"" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the ""advanced"" tab. Not required and can cause problems"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compaq.exe	"Added by the SDBOT-AFU WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Service Drivers 32	compq32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivrs	copq.exe	"Added by a variant of the RBOT WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
N	Compaq Video CD Watcher	??	For Compaq PC's. MPEG viewer
X	Compaq32 Service Drivers	ms32.exe	"Added by the SDBOT.BWH WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
X	Compaqs Service Driver	copypad32.exe	"Added by the SDBOT.CSO WORM!"
X	Compaqs Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	Compd Service Drivrs	codq.exe	"Added by a variant of the SDBOT WORM!"
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-AI WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	ContentService	winservn.exe	Homepage hijacker
X	ContraVirus	ContraVirusPro.exe	"ContraVirus misleading security software - not recommended see here"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	ControlPanel	svcc.exe	"WorldSearch adware - re-directing searches to ""world-search.biz"""
X	ControlPanel	private.exe internat.dllLoadMouseCarpetProfile	"Detected by Norman Virus Control as W32/Downloader. Creates the files sdfff fdsf and zxczxc. In the C:\WINDOWS\SYSTEM32 directory creates the files d.exe s.exe and r.exe. Note - the ""private.exe"" file is found in %System%"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
U	Copernic Desktop Search 2	DesktopSearchService.exe	"Copernic Desktop Search - search agent"
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
?	CPA9P2PSERVER	CPA9P2PS.exe	"Found on a Compaq Presario but what is it?"
X	cpntmgc	navpmc.exe	"Added by the SIMCSS TROJAN!"
U	CPQEASYACC	STARTDRV.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	Cpusave	Cpusave.exe	"Added by the GEMA TROJAN!"
X	Cpusave32	Cpusave32.exe	"Added by the GEMA TROJAN!"
X	CPVHOST Settings	cpvhost.exe	"Added by a variant of the SDBOT TROJAN!"
?	CQSCP2P SERVER	??	""Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed"
N	CrazyTalk Serve	rundll32.exe CrazyTalk.dll DIIServeMediaFile	"CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express"
N	Creative AGP Wizard	agpwiz.exe	Part of Creative's BlasterControl
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Detector	CTDetect.exe	Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player selecting Tools then uncheck the Auto Start box. It should not start up automatically again
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Service for CDROM Access	Ctsvccda.exe	Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Creative.exe	Creative.exe	"Added by the PROLIN WORM!"
N	CreativeDiscNotifier	CTNOTIFY.EXE	For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM DVD-ROM etc. Available via Start -> Settings -> Control Panel
U	CreativeMixer	CTMIX32.EXE	Creative soundcard System Tray access to for example volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	Cryptographic Service	******.exe [* = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
U	CSS Server	CSSServer.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P26	CSV7P26.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CSV7P91	CSV7P91.exe	"ClearSearch adware"
U	csvdea	csvdea.exe	"SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
N	CTAVTray	CTAvTray.exe	For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
X	CTDrive	rundll32.exe drvmod.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
N	CTDVDDet	CTDVDDet.exe	Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player selecting Tools then uncheck the Auto Start box. It should not start up automatically again
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ctfnom.exe	SVOHOST.exe	"Added by the DIGIDOR-A TROJAN!"
?	CTPDPSRV	CTPDPSRV.EXE	"Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required?"
U	CtrlVol	CtrlVol.exe	Volume control key on Acer Fujitsu and other laptops
U	CTSVolFE	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
U	CTSVolFE.exe	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
?	cttdpsrv	cttdpsrv.exe	"??"
X	CU1	VCClient.exe	Associated with the Surf Sidekick adware and should be removed
X	CU2	VCMain.exe	Associated with the Surf Sidekick adware and should be removed
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
X	Cvfjx	ANACON.EXE	"Added by the NACO.A WORM!"
X	cvmonitor.exe	cvmonitor.exe	"Added by the SDBOT.BV WORM!"
X	cvmsyslpd	sdservss.exe	"Added by the MAILBOT-BY TROJAN!"
Y	CVPND	cvpnd.exe	Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
N	cwbckver	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources"
N	cwbsvstr	cwbsvstr.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources"
U	Cyber-Defender 2003	uwcdsvr.exe	"Cyber Defender 2003"
?	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cybershot digital cameras. What does it do and is it required?"
X	DamedWare Services	dwdrce.exe	"Added by the RBOT-AOJ WORM!"
X	DarkDevil.Grasiele.BR	Grasiele.VBS	"Added by the LEMBRA WORM!"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word Excel and PowerPoint files on your handheld anywhere anytime. In addition it now synchronizes e-mail with attachments PDF files pictures and Excel-like charts""
U	DAZEL Delivery Agent	DcDaemon.exe	Control and send documents etc to any destination. The Dazel Corporation has now been taken over by HP
N	dbserv	dbserv.exe	Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled
X	dc2k5	SVIQ.EXE	"Added by the COIDUNG-A WORM!"
U	DCfssvc	dcfssvc.exe	Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup your camera will not cause your computer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example
U	dcfssve	dcfssvc.exe	Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup your camera will not cause your computer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example
N	DDCActiveMenu	DDCActiveMenu.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	ddoctorv2	sprtcmd.exe /P ddoctorv2	"Comcast Desktop Doctor (provided by SupportSoft Inc) is a free self-help tool for Comcast broadband users. Identifies and automatically fixes typical problems that may occur with your high-speed internet service"
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
X	Default	explore.vbs	"Added by the ALLEM WORM!"
X	Default	mtask.vbe	"Added by the ALLEM WORM!"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	delsubmit	rundll32.exe advpack.dll DelNodeRunDLL32 submit.exe	"CoolWebSearch parasite variant"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
?	desk-top-service	desk-top-service.exe	"??"
X	DeskAd Service	DeskAdServ.exe	"DeskAd.Service adware"
X	desktop	desktop.ini.vbs	"IE-Title malware"
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Development Environment	devenv.exe	"Added by the DELBOT-AH WORM!"
U	DEventAgent	eventagt.exe	DEvent Agent Module client - part of Dell OpenManage and used for server management. Only required if you use this
X	devenv	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Device Detector	DevDetect.exe	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
N	Device Detector 2	DevDtct2.exe	"Installed by various Olympus products this program detects the active connection of a speech device (voice recorder etc) to a USB port then runs specific client software used to access that device. The DevDtct2 process has a ""high"" priority level which can negatively impact system resources"
X	Device Hardware	devicehnd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device IO System	deviceio.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Manager	wfxmgr.exe	"Added by the RBOT.AJU WORM!"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Driver	devicesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	DeviceDiscovery	hpotdd01.exe	Detection of new imaging printing and other peripherals on HP machines such as USB printers cameras and Bluetooth products
X	DevicePath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	DevicePath	Root.exe	"Added by the GRUEL WORM!"
U	Devices	olesvr.exe	"Salfeld Child Control - parental control software"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
U	devldr16	devldr16.exe	Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start → Settings → Control Panel → System → Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices
U	devldr16.exe	devldr16.exe	"Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use ""Sound Play Control"" and ""Sound Recorder"". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable ""Creative SB16 Emulation"" under Creative Miscellaneous Devices"
?	Devlog	devlog.exe	"Apparently mainboard/chipset related by a French company called AS Media - what exactly is it and is it required"
X	DHCP Server	regsvr.exe	"Added by the RBOT-PR WORM!"
X	DHCP32	services.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
?	Diamondview	Diamondview.exe	"Manulife Financial Insurance program. Is it required at startup?"
U	DigiSrv	DigiSrv.exe	"Related to camera software from DigitalDreams"
N	Digital Dashboard	devgulp.exe	For Compaq PC's. Loads Digital Dashboard options
N	Digital River eBot	downlo~1.exe	"Digital River Systems EBOT for downloading software from their site. In some cases if you purchase software online for a download from a software manufacturer you will be sent to this online company's site for the download after the purchase is complete. Read more here"
U	DIGServices	DIGServices	Created by Disney but licensed to ESPN for watching videos
N	DIGServices	DIGServices.exe	Created by Disney but licensed to ESPN for watching videos
U	DIRECTVDSL	Directvdsl.exe	Starts DirectTV DSL modem at boot up. Can also be started manually
X	DirectX Driver	stdhost.exe	"Added by a variant of the RBOT WORM! See here"
X	DirectX Driver	stdhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
X	Directx Startup Drivers	direct.exe	"Detected by PCTools as the RBOT.UXL WORM! See here"
X	DirectX Video Driver	dxterm5.exe	"Added by the WILAB-A TROJAN!"
?	discoveg	discoveg.exe	"??"
?	DISCover	DISCover.exe	"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Manager	diskver.exe	"Added by the RBOT.AQT WORM!"
X	Disk Panel Configuration	dpcsvc.exe	"Detected by PCTools as the IRCBOT.BSQ TROJAN! See here"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
?	Divamon.exe	Divamon.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem - what does it do and is it required?"
X	divx	divxenc.exe	"Added by the SPBOT.B TROJAN!"
X	Divx	codll.exe	"Added by the GRAVEBOT-A TROJAN!"
X	DivX MediaPlayer 7.0	Dr.DivX.exe	"Added by the ALADINZ.G TROJAN!"
X	DivX Player	DivXPlayer.exe	"Added by a variant of the RBOT WORM!"
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
X	DIVX Video Player	DIVXPloyer.exe	Added by an unidentified WORM or TROJAN!
X	Divx4 codec	devldr32.exe	"Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file"
Y	DkService	DkService.exe	From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled otherwise you could have problems starting it manually.
N	dlbcserv	dlbcserv.exe	Related to Dell Photo Printers and provides additional configuration options for these devices
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
N	DLF_00000B00	Vcdlf.exe	"Known to cause problems with "Out of memory" errors (see here). Otherwise it's purpose is unknown"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	Dll Link	svchoist.exe	"Added by the AUTOSKY WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	DllCacherv2	dllcachev2.exe	"Added by the LATEDA TROJAN!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DLLService32	dllsvc32.exe	"Added by the AGOBOT.VX WORM!"
X	Dmsvc32	Dmsvc32.exe	"Added by the AGOBOT.ABU WORM!"
X	DM_server	dmserver.exe	"Comet Cursor adware"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
X	Dns Resolver	dnsrslve.exe	"Added by the RBOT-WS WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
?	DNXVC	dnxvc.exe	"??"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended see here"
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	DomPlayer Service	wakeservice.exe	"DomPlayer adware"
N	DoroServer	DoroServer.exe	"Doro PDF Writer from The SZ Development. All what you need for creating pdf files"
X	Dowmingzu	Dowmingzu.dll.vbs	"Added by the SOLOW-E WORM!"
Y	Dpcnav	dpcnav.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	dpnsvr32	dpnsvr32.exe	"Added by the AOLPASS-B TROJAN!"
X	dreams	server.exe	"Added by a variant of the SDBOT WORM!"
X	DrefIW	SysDrefIWv2.exe	"Added by the DREF-C WORM!"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended see here"
X	DriveCleaner Free	UDC.exe	"DriveCleaner misleading security program - not recommended see here"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
U	DriveLED	OODLed.exe	"O&O DriveLED - hard disk monitoring and crash prevention"
X	Driver	gbot.exe	"Added by the JUNTADOR.K TROJAN!"
X	Driver32	Scam32.exe	"Added by the SIRCAM WORM!"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder"
X	DriverDB	svcmdx32.exe	"Added by the BERPI TROJAN!"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:DriverLoad folder"
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
N	DriverMax	devices.exe	"DriverMax from Innovative Solutions - ""a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	Added by freewebs.com hijacker!
N	DriveSelect	driveselect.exe	"DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs"
U	drkly16j	rundll32.exe drkly16j.dll ServiceCheck	"KidsWatch Time Control parental control software"
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	drvddll.exe	drvddll.exe	"Added by the BEAGLE.AP WORM!"
X	Drvddll_exe	drvddll.exe	"Added by the BEAGLE.X WORM!"
U	DrvIcon	DrvIcon.exe	"""Vista Drive Icon changes the drive icons shown in Windows ""My Computer"" to a nearly Vista drive icon showing the drive's free space with a smooth colored horizontal bar"""
?	DrvListnr	DrvListnr.exe	"Analog Devices SoundMAX soundcard related. What does it do and is it required?"
U	drvlsnr	drvlsnr.exe	Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly
U	DrvMon.exe	DrvMon.exe	"Alcor drive monitor software"
X	drvnetw	drvnetw.exe	"Added by the BROGGER-B TROJAN!"
X	drvr32h	drvr32h.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	drvrmanager	drvrquery32.exe	"Added by the BOOHOO WORM!"
X	drvsys.exe	drvsys.exe	"Added by the BEAGLE.W WORM!"
X	drvsyskit	hidr.exe	"Added by the BAGLE.HR WORM!"
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	drv_st_key	hidn.exe	"Added by the BEAGLE.FF WORM!"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	DsmSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	DSService	dmrss.exe	"Added by the AGOBOT-XX WORM!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Dumeter Services	dumeter.exe	"Added by the SDBOT-AEQ WORM!"
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	DVD Upgrade	dvdupgd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	dvd43	DVD43_Tray.exe	"DVD43 is ""a small tool that integrates into Windows and overrides CSS copy-protection found on DVD movies"""
U	DVD43	DVD43.exe	"DVD43 is a small tool that overrides CSS copy-protection found on DVD movies"
X	dvd98	windvd98.exe	"Added by the CULT.P WORM!"
N	DVD@ccess	DVDAccess.exe	"Part of DVD Studio Pro from Apple Inc. - ""The DVD@CCESS feature allows you to add additional interactivity to your DVD title when it is played on a computer"""
U	DVDBitSet	DVDBitSet.exe	DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used
?	DVDCheck	DVDCheck.exe	"Related to an Intervideo program. What does it do and is it required in startup?"
X	Dvdcompat	Dvdcompat.exe	"Added by the GEMA TROJAN!"
N	DVDLauncher	DVDLauncher.exe	"Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion"
N	DVDSentry	DSentry.exe	Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching they decided to implement an anti-spyware service. Run manually before installation starts
N	DVDTray	DVDTray.exe	HP CD/DVD Tray icon installed with the DVD writer software. Periodically checks for new drive firmware
N	DVDUpgrade	DVDUpgrd.exe	"Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs"
N	DVDXGhost	DVDGhost.EXE	"DVD Ghost - ""utility to make your software DVD players and DVD copy/backup softwares restriction-free and copy/backup DVD to hard disk"""
U	dvHighMem	cfgmng32.exe	"Related to PureSight PC - designed to offer maximum flexibility and choice as families manage their internet use"
Y	Dvp95	Dvp95.exe	"Scan engine for F-Secure and Command antivirus software based on the F-Prot AntiVirus engine"
Y	dvpapi9x	DVPAPI9X.exe	Command AntiVirus for Windows 95/98/Me
Y	DvpInitExe	Dvpinit.exe	"Command Antivirus related"
Y	dvprpt	Dvprpt.exe	"Command Antivirus related"
X	dvraudio	dvraudio.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	dvsfss	fbsfsdrs.exe	"Added by the SDBOT-QA WORM!"
U	DVSync	dvsync.exe	DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC
X	DvVideo32	dvvid32.exe	"Detected by Trend Micro as the TINY.FD TROJAN! See here"
X	Dvx	wsxsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware variant"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
X	dxvid	dxvid.exe	"Added by the DLUCA-Y TROJAN!"
X	DyFuCA Active Alert	actalert.exe	"Adult content dialler - see here"
?	DZKillMe	DZSAVEME.EXE	"??"
U	D_V_T	dvt.exe	"DICOM Validation Tool - ""DICOM is increasingly being used as the standard communication mechanism when integrating various medical products in a hospital environment"""
?	D_V_T	dvt.exe	"Installation could be a crack/hack to NOD32 here. Seen and removed in many logs. Investigate it further and if this file is present C:d_v_t.reg then it should be fixed. Not to be confused with the DICOM entry here. Both files are located in the Windows/Windir directory"
X	e-Surveiller Station	estation.exe	"ESurveiller spyware. Note - ESurveiller is spyware that monitors and records keystrokes and mouse clicks instant message conversations Internet activity and applications used must be manually installed"
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
X	EasyAV	EasyAV.exe	"Added by the NETSKY.S or NETSKY.T WORMS!"
U	EasyLinkAdvisor	LinksysAgent.exe	"Linksys EasyLink Advisor - ""the free application that provides and easy way to setup view manage and repair your network"""
X	easyServ	Server.exe	"Added by the EASYSERV TROJAN!"
U	EasyTuneIV	ET4Tray.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneV	GUI.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	ebmmm	ebatesmmmv.exe	"Ebates adware"
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
N	EEventManager	EEventManager.exe	"Part of the Epson Creativity Suite supplied with their multi-function printer/scanners Event Manager launches File Manager or PageManager for EPSON automatically when you press the B&W Start or Color Start button on the control panel in Scan mode"
U	eFax Live Menu 3.3	J2GDllCmd.exe	"DLL Command Utility for version 3.3 of eFax Messenger from j2 Global Communications Inc. - which ""is powerful Internet fax software that makes it easy to create annotate sign zoom and print faxes from any computer"""
N	elm	Elmenv.exe	ViaTech eLicense for securing distributing and selling music online
U	ELSAChipGuard	elsavect.exe	ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed and will halt the system if either are at dangerous levels and restore the default clock speeds upon reboot. Leave enabled if overclocking
Y	EmailScan	mcvsescn.exe	Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails
X	eMakeSV	EMAKESV.EXE	"""Switch"" adult content dialer"
X	eMakeSV	EMAKE2B.EXE	"""Switch"" adult content dialer"
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
Y	EnvyHFCPL	EnMixCPL.exe	"VIA Envy24 PCI Audio Controller driver"
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF DOC HTML TXT Multi-page TIFF JPG GIF PNG and many more!"" Can be started manually"
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF DOC HTML TXT Multi-page TIFF JPG GIF PNG and many more!"" Can be started manually"
N	EPS	e_srcv02.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPS	e_srcv03.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
X	Epsilon Squared	vmmreg32.exe	"Added by the AGENT.MVC TROJAN!"
U	EPSON Status Monitor 3	E_[various].EXE	Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status checking ink levels etc
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status checking ink levels etc
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status checking ink levels etc
X	EQAdvice	EQAdvice.exe	"NewAds1 adware"
U	eRecoveryService	check.exe	Acer Notebook related. Acer eRecovery allows the user to restore the operating system or backup the current system profile thus ensuring system integrity
U	eRecoveryService	Monitor.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer and also acts as a versatile standalone backup and recovery manager"""
U	eRecoveryService	eRAgent.exe	Acer's eRecovery Management program. This program allows you to create and restore backups of your computer
X	erthgdr	svc.exe	"Added by the BEAGLE.BN or BEAGLE.BP WORM!"
X	erthgdr2	svc23.exe	"Added by the BAGLE.CG WORM!"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
?	Event Log	eventlog.exe	"??"
N	Event Planner Reminders	PLNRnote.exe	Sierra Event Planner tray icon
N	Event Reminder	pmremind.exe	A calendar/alarm program that installs with Br?derbund Printmaster
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
U	EVENTLISTENER	EvLstnr.exe	Used with a Nikon digital camera to recognize when the camera is plugged in
N	eventmgr	eventmgr.exe	Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs
X	eventwvr	eventwvr.exe	"Added by the COSIAM_G TROJAN!"
?	EverioService	EverioService.exe	"Related to the Cyberlink software supplied with JVC's Everio camcorders. What does it do and is it required?"
U	Evidence Cleaner	ecleaner.exe	"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
X	Evil	Evil.exe	"Added by the MYTOB.JM WORM!"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed it runs independently of RealOne Player. See here for more information including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable ""tkbell.exe"" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK"
U	EVOLOSTA	EVOLOSTA.EXE	Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID peer-to-peer mode channel link speed WEP encryption options and has enable/disable and rescan buttons. It is not needed if using Windows XP or higher as they have this built-in to the control panel. Also if the user is very sure that there is ONLY ONE network available to connect to then they can remove this. If it is not in startup and the user needs to run it they can simply type EVOLOSTA in the Start -> Run dialog to run it
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
X	EvtHtm	evthtm.exe	"Added by the DLUCA-EJ TROJAN!"
U	EW Message Server	msg32.exe	Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
X	ExpertAntivirus	ExpertAntivirus.EXE	"ExpertAntiVirus misleading antivirus program - not recommended see here"
X	expler	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Explorer	drv.exe	"Added by the SMALL-FD TROJAN!"
X	Explorer	explorar.vbs	"Added by the DESKTO-A WORM!"
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status checking ink levels etc
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Located in %System%\CTF"
X	Fast Home	svcnvt.exe	"Detected by Kaspersky as the DELF.KS TROJAN! This file may be found in the System folder on 9x machines however as of this writing it has only been seen in the System32 folder"
X	Fast Search	svcnv.exe	Homepage Startpage hijacker. Possible variant of Trojan-Downloader.Win32.Delf
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FASTTRACKNETVISION	NETVISION.exe	"DialCar-Z premium rate dialer"
U	FastTVSync	FastTVSync.exe	"Part of InterVideo (now Corel) DVD Copy - ""fast DVD copying and file conversion software. In just three steps you can copy videos to most DVD formats or convert them for smooth flawless viewing on your PSP® or iPod®. With broad format support and unique CopyLater™ technology DVD Copy saves you time and ensures high-quality output like no other copying software"""
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark MCI Lotus My Software Broderbund Traffic Software and many others"
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark MCI Lotus My Software Broderbund Traffic Software and many others"
U	FaxCtrl.exe	ASMediaProxyServer.exe	"Part of Avaya's Contact Center Express - ""a multi-channel high-volume software solution from Avaya designed specifically for the intelligent routing and computer telephony integration (CTI) needs of medium-sized contact centers"""
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	FEELitDeviceManager	feelitdm.exe	Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals)
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run on a wide range of mobile devices. Supports Microsoft Access databases and provides for synchronization of other data as well"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in the Winnt or Windows folder"
U	FilmLoop	FilmLoopService.exe	"Related to FilmLoop - a photocasting network. Share your pictures with your family and friends"
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink paper time and money by controlling and enhancing printed output"""
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink paper time and money by controlling and enhancing printed output"""
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink paper time and money by controlling and enhancing printed output"""
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
X	FirewallSvr	FirewallSvr.exe	"Added by the NETSKY.X or NETSKY.Y WORMS!"
X	FireWire Driver	samx.exe	"Added by the SDBOT.AE WORM!"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
Y	Fix-it AV	memcheck.exe	Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
X	Fixnice	vcvw.exe	"Added by the SDBOT TROJAN!"
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FKS v2.0	msngr.exe	Added by an unidentified WORM or TROJAN!
X	Flash Driver	[path to trojan]	"Detected by PCTools as the AGENT.CWVT TROJAN! See here"
X	Flash Media	services.exe	"Added by a variant of the IRCBOT TROJAN! See here. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
?	Flow Go TV	flogotv.exe	"??"
X	flps	flps.vbs	"Added by the BYRON WORM!"
?	FLSVCI	FLSVCI.exe	"??"
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	Folder View	folderview.exe	"Folder View enhances the Windows file Explorer by making all folders you need available in a single click"
U	FolderClone v*.*.*	folderclone.exe	"Folderclone backup and synchronization software"
X	Font Viewer	fontviewer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	fontnav	FontNav.exe	"Font Navigator from Bitstream Inc. - a font management utility"
X	FONTVIEW	FONTVIEW.EXE	"Added by the OPASERV.T WORM!"
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
N	Free DVD Direct	FreeDVDDirect.exe	"Free DVD Direct - provides a program to access a peer–to–peer (P2P) file–sharing network (see here)"
U	FreeMemVn2	FreeMem.exe	"FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process which should not appear in Msconfig/Startup!"
X	FS6519	FS