v

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
U	!AVG Anti-Spyware	avgas.exe	"Part of AVG Anti-Spyware from Grisoft"
ME & XP	"MS Java Applets for Windows NT	U	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
please	"This is a virus	X	bigbadvirus.exe
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$drv	$sys$drv.exe	"Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
U	$Volumouse$	volumouse.exe	"Volumouse from Nirsoft. ""Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse"""
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
U	)Start Service	upssrv.exe	"Cyber Power PowerPanelPlus software. ""In the event of a power outage
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the CR TROJAN!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.Prog	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
?	00DSKSVR00	desksaver.exe	"Related to Advanced Desktop Shield"
?	00DSKSVR01	desksaver.exe	"Related to Advanced Desktop Shield"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
N	1:	hpdrv.exe	HP utility for monitoring when and how many recoveries have been done
N	1A:MacVisionTrayMonitor	TrayMonitor.exe	Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock)
Y	1A:Stardock MCP	mcpserver.exe	"Master Control Program for Stardock apps
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
X	27	slsorve.exe	"Added by the SLSORVE-A TROJAN!"
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
Y	3dfxv2ps.dll	3dfxv2ps.dll	Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
X	absr	mwsvm.exe	"SeekSeek search hijacker related - see here"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" servuce to perform backup/restore tasks correctly. Required if you want to use TrueImage to do some real backup/restore tasks - not if you only want to explore/mount images"
N	Activation	Activation.exe	Part of Microsoft Money
U	Activboard	MMKeybd.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ACTIVEDS	ACTIVEDS.EXE	"Added by the OPASERV.T WORM!"
N	ActiveEyes	ActiveEyes.exe	"ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
Y	ActiveShield	MCVSSHLD.EXE	McAfee VirusScan On-line. See also the McAgentExe entry
U	ActiveSpeed	AS.exe	"Ascentive ActiveSpeed Internet Optimizer"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
U	Activity	actik.exe	"ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
X	ACTX1	v1201.exe	"Added by the VB.IS TROJAN!"
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe� Creative Suite
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	AdRotator.Application	services.exe	"Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an ""Inetsrv"" subfolder"
U	ADService	ADService.exe	"Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
X	adstartup	automove.exe	"Adlogix adware variant"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
X	Adtools Service	AdTools.exe	"Windupdates Adware"
X	Advanced DHTML Enable	exo32.exe	Added by an unidentified TROJAN!
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
U	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover anti spyware tool"
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	Advapi	Advapi.exe	"Added by the NETDEVIL.12 WORM!"
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
X	advmon32	advmon32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
X	agentsvr	agentsvr.exe	"Malware
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
X	Alevir	Alevir.exe	"Added by the OPASERV-A WORM!"
X	AlevirOld	[worm filename]	"Added by the OPASERV WORM!"
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	All Sea screen saver	TaskTray.exe	"""Free screensaver""
U	Alogserv	Alogserv.exe	"From McAfee VirusScan for logging scanning activities. In some cases
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
?	ALServ	ALServ.exe	"Altec Lansing AMS speaker related. What does it do and is it required?"
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	anbv32	nabv32.exe	"Added by the TITOG.C WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - recognized by Kaspersky antivirus as TrojanProxy.Agent.fp - A Proxy Trojan is a backdoor which allows a remote hacker to connect to other systems via the compromised system"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
Y	AntiVir XP	AVwin.exe	"AntiVir� PersonalEdition Classic - antivirus"
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold malware"
?	AntiVirusProtection	qumk.exe	"??"
Y	AnVir	AnVir.exe	"AnVir Task Manager - protects computer against viruses and manages running processes and startup files"
Y	AnVir Task Manager	AnVir.exe	"AnVir Task Manager - protects computer against viruses and manages running processes and startup files"
U	anvshell	anvshell.exe	System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar
U	AnyDVD	AnyDVD.exe	"AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts - hence the ""U"" recommendation"
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
X	AOLRegKey32	AOREGSVR512.EXE	"Unidentified malware - see here"
U	APC_SERVICE	mainserv.exe	"PowerChute� Personal Edition - ""safe system shutdown software with sophisticated power management functions"""
X	apisvc.exe	apisvc.exe	"Added by a variant of the LAMEBOT TROJAN!"
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. What does it do and is it required?"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Anti-Virus. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Anti-Virus. Required to enable permanent virus protection"
X	Archive	archive.exe	"Adware - recognized by Kaspersky antivirus as Trojan-Downloader.Centim.a"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
Y	ashAvast	ashAvast.exe	"Part of Avast antivirus"
Y	ashMaiSv	ashmaisv.exe	"Part of Avast! anti-virus software - E-mail scanner"
U	AsioReg	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
N	ASUSKey	V38SHELL.EXE	System tray Icon for quickly changing video modes
X	atapidrv	atapidrv.exe	"Added by the AGOBOT-SL WORM!"
N	ATI DeviceDetect	ATIDtct.EXE	Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
U	ATIPOLAB	ati2evxx.exe	"ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers
U	ATIPOLAB	ati2evae.exe	ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks
U	ATIPOLL	ati2evxx.exe	"ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers
X	ATITech	Active.exe	"Added by the ROAMER-A TROJAN!"
X	ativopen	ativopen.exe	Premium rate adult content dialler
X	AttuneDiscovery	attune_di.exe	Spyware - part of an automated helpdesk software called Aveo Attune
X	Audiodrv	audiodrv.exe	"Added by the CRYPTER-C TROJAN!"
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start -> Programs"
	automatically installed when you run their optical disk drive cleaning utility - to remind
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Recognized by Kaspersky antivirus as Clicker.Win32.Agent.fq"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auto__antiav__key	antiav_exe.exe	"Added by the BAGLEDI-AA TROJAN!"
X	auxAudioDevice	aux32.exe	"Added by the AIZU WORM!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
N	AvaFind	AvaFind.exe	"AvaFind file search utility"
Y	Avast!	ashserv.exe	"Part of Avast! anti-virus software"
Y	avast!	ashDisp.exe	"Part of Avast! anti-virus software"
Y	avast! Web Scanner	Ashwebsv.exe	"Part of Avast! anti-virus software"
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
X	avc	avmon.exe	Added by an unidentified TROJAN!
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	AveoAttune	atmdlusr.exe	Spyware - part of an automated helpdesk software
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
Y	AVG7_AMSVR	Avgamsvr.exe	"AVG antivirus related"
Y	AVG7_CC	AVGCC.exe	"AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components
Y	AVG7_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG7_Run	avgw.exe	"AVG Anti-Virus 7.0 related"
Y	avgamsvr.exe	Avgamsvr.exe	"AVG antivirus related"
Y	avgcc32	avgcc32.exe	"AVG anti-virus control center. Also enables scheduled tests
Y	AVGCtrl	AVGCtrl.exe	"Part of AntiVir� PersonalEdition Classic antivirus"
Y	avgfwsrv	AVGFWSRV.EXE	"Firewall from Grisoft AVG Plus Firewall Edition"
Y	avgmsvr.exe	avgmsvr.exe	"AVG Anti-Virus 7.0 related"
Y	AVGnt	AVGnt.exe	"AntiVir� PersonalEdition Classic antivirus. System Tray icon and control program"
Y	Avgserv9.exe	Avgserv9.exe	"AVG antivirus background monitoring"
Y	AVGuard	AVGuard.exe	"AntiVir� PersonalEdition Classic antivirus. Background task which scans files transparently"
Y	AVG_CC	avgcc32.exe	"AVG anti-virus control center. Also enables scheduled tests
Y	AVG_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG_RegCleaner	AVGREGCL.exe	"AVG Anti-Virus 7.0 Registry Cleaner - for checking the registry for virus additions and other security problems"
X	avidrv	drvsc.exe	"Recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Agent.ph"
X	Avimgt	Avimgt.exe	"Added by the GEMA TROJAN!"
X	Avimgt32	Avimgt32.exe	"Added by the GEMA TROJAN!"
Y	avinit	AVINIT9X.EXE	"Command antivirus related"
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
Y	AVKBar	AVKBar.exe	"GData AntiVirusKit Anti-virus"
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
Y	avpcc	avpcc.exe	"Kaspersky Labs anti-virus"
Y	avpm	avpm.exe	"Kaspersky anti-virus"
X	Avpr	avpr.exe	"Added by the MYDOOM.AF WORM!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
Y	AVSCHED32	AVSched32.exe	"AntiVir� PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command antivirus related"
X	AvSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	avserve.exe	avserve.exe	"Added by the SASSER WORM!"
X	avserve2.exe	avserve2.exe	"Added by th