[] Number=1 Confirmed=X Filename=system32.exe Description=Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=2 Confirmed=X Filename=pathex.exe Description=Added by the MKMOOSE-A WORM! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=3 Confirmed=X Filename=svchost.exe Description=Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=4 Confirmed=X Filename=MSPF.EXE Description=Added by a variant of the SDBOT WORM! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=5 Confirmed=X Filename=dllvirtual.exe Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=6 Confirmed=X Filename=dllvirtual.dll Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=7 Confirmed=X Filename=dllvirtual.js Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [ SystemBoot] Number=8 Confirmed=X Filename=services.exe Description=Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Help\Help subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ WinCheck] Number=9 Confirmed=X Filename=services.exe Description=Added by the SOBER-S WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatus\Microsoft" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ Windows] Number=10 Confirmed=X Filename=services.exe Description=Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ WinStart] Number=11 Confirmed=X Filename=services.exe Description=Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Connection Wizard\Status subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ winsystem.sys] Number=12 Confirmed=X Filename=smss.exe Description=Added by the SOBER.K TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a msagent\win32 subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [!1_pgaccount] Number=13 Confirmed=Y Filename=pgaccount.exe Description=DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks. You will see one instant of pgaccount.exe for every active account on your system, and this is essential for PG to work properly Source=Paul Collins Startup list [!1_ProcessGuard_Startup] Number=14 Confirmed=Y Filename=procguard.exe Description=DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks Source=Paul Collins Startup list [!AVG Anti-Spyware] Number=15 Confirmed=U Filename=avgas.exe Description=Part of AVG Anti-Spyware from Grisoft Source=Paul Collins Startup list [!ewido] Number=16 Confirmed=U Filename=ewido.exe Description=Part of Ewido anti-spyware Source=Paul Collins Startup list [!NoLoad] Number=17 Confirmed=N Filename=winrecon.exe Description=WinRecon keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [$EnterNet] Number=18 Confirmed=? Filename=Enternet.exe Description=Connection manager for the EnterNet ISP. You can also use RASPPOE Source=Paul Collins Startup list [$sys$cmp] Number=19 Confirmed=X Filename=$sys$xp.exe Description=Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer Source=Paul Collins Startup list [$sys$crash] Number=20 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$crash] Number=21 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$crash] Number=22 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$drv] Number=23 Confirmed=X Filename=$sys$drv.exe Description=Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer Source=Paul Collins Startup list [$sys$momomomochin] Number=24 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$momomomochin] Number=25 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$momomomochin] Number=26 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=27 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=28 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=29 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$Volumouse$] Number=30 Confirmed=U Filename=volumouse.exe Description=Volumouse from Nirsoft. "Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse" Source=Paul Collins Startup list [$WindowsRegKey%update] Number=31 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [%cmpmixtitle%] Number=32 Confirmed=N Filename=%cmpmixstr% Description=Possibly related to C-Media Mixer Control panel? Source=Paul Collins Startup list [%FP%012-L2TP fts.exe] Number=33 Confirmed=N Filename=fts.exe Description=012.Net.il Israeli ISP software front-end Source=Paul Collins Startup list [%FP%012-L2TP FWPortal.exe] Number=34 Confirmed=U Filename=FWPortal.exe Description=012.Net.il Israeli ISP dial-up software Source=Paul Collins Startup list [%FP%1776 Internet fts.exe] Number=35 Confirmed=N Filename=fts.exe Description=1776 Internet US ISP software ISP software front-end Source=Paul Collins Startup list [%FP%1776 Internet FWPortal.exe] Number=36 Confirmed=U Filename=FWPortal.exe Description=1776 Internet US ISP dial-up software Source=Paul Collins Startup list [%FP%Barak013 fts.exe] Number=37 Confirmed=N Filename=fts.exe Description=Barak013 Israeli ISP software front-end Source=Paul Collins Startup list [%FP%Barak013 FWPortal.exe] Number=38 Confirmed=U Filename=FWPortal.exe Description=Barak013 Israeli ISP dial-up software Source=Paul Collins Startup list [%FP%Friendly fts.exe] Number=39 Confirmed=N Filename=fts.exe Description=Friendly ISP software front-end Source=Paul Collins Startup list [(*)API Machine] Number=40 Confirmed=X Filename=winSOCKS.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(*)Run] Number=41 Confirmed=X Filename=win32API.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(default)] Number=42 Confirmed=X Filename=[random filename].exe Description=Added by the BLACKMAL WORM! Source=Paul Collins Startup list [(default)] Number=43 Confirmed=X Filename=rundll32.exe [path] Zykheptd.dll Description=Added by the HESIVE.B TROJAN! Source=Paul Collins Startup list [(L4r1$$4) (4nt1) (V1ruz)] Number=44 Confirmed=X Filename=SP00Lsv32.pif Description=Added by the ASSIRAL.B WORM! Source=Paul Collins Startup list [*JanisRuckenbrodII] Number=45 Confirmed=X Filename=janis.com Description=Added by the POPS WORM! Source=Paul Collins Startup list [*Microsoft Update] Number=46 Confirmed=X Filename=ctxma.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=47 Confirmed=X Filename=cxma.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=48 Confirmed=X Filename=wstcl.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=49 Confirmed=X Filename=wucxt.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=50 Confirmed=X Filename=wuytc.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*MS Setup] Number=51 Confirmed=X Filename=[random filename] Description=Virtumondo adware, also known as the VUNDO TROJAN! Source=Paul Collins Startup list [*Security Center] Number=52 Confirmed=X Filename=secctr.exe Description=Added by the SDBOT.BRO WORM! Source=Paul Collins Startup list [*StateMgr] Number=53 Confirmed=Y Filename=statemgr.exe Description=Windows ME default for System Restore. Do NOT disable! Source=Paul Collins Startup list [*windows update] Number=54 Confirmed=X Filename=wrauclt.exe Description=Added by the RBOT-QU WORM! Source=Paul Collins Startup list [*windows update] Number=55 Confirmed=X Filename=wuanclt.exe Description=Added by the RBOT-PG WORM! Source=Paul Collins Startup list [*windows update] Number=56 Confirmed=X Filename=wuaucrlt.exe Description=Added by the SPYBOT.HUR WORM! Source=Paul Collins Startup list [*windows update] Number=57 Confirmed=X Filename=wuraclt.exe Description=Added by the RBOT-PO WORM! Source=Paul Collins Startup list [*windows update] Number=58 Confirmed=X Filename=wurauclt.exe Description=Added by the RBOT-SY WORM! Source=Paul Collins Startup list [*windows update] Number=59 Confirmed=X Filename=wsctl.exe Description=Added by the SPYBOT.PR WORM! Source=Paul Collins Startup list [*windows update] Number=60 Confirmed=X Filename=wkmst.exe Description=Added by the SDBOT.AVD WORM! Source=Paul Collins Startup list [*windows update] Number=61 Confirmed=X Filename=wscxt.exe Description=Added by the RBOT.AOS WORM! Source=Paul Collins Startup list [*windows update] Number=62 Confirmed=X Filename=waurclt.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [*Windows [filename] Checker] Number=63 Confirmed=X Filename=[filename] Description=Added by the KEDEBE-B WORM! Source=Paul Collins Startup list [*WindowsAudio] Number=64 Confirmed=X Filename=systemupd.exe Description=Added by the AGENT-TH WORM! Source=Paul Collins Startup list [*WinLogon] Number=65 Confirmed=X Filename=[trojan path] ren time:[random number] Description=Added by the VUNDO TROJAN! Source=Paul Collins Startup list [*winstats] Number=66 Confirmed=X Filename=winstats.exe Description=Added by the GARGAFX TROJAN! Source=Paul Collins Startup list [*wuauclt.exe] Number=67 Confirmed=X Filename=w****.exe [* = random char] Description=Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe, wtmsv.exe, wxmst.exe, wmsvc.exe and so on... Source=Paul Collins Startup list [,main drive Loader] Number=68 Confirmed=X Filename=wininfo.exe Description=Suspected malware as it appears in 3 different registry locations - see here Source=Paul Collins Startup list [..] Number=69 Confirmed=X Filename=ABC2007.exe Description=Added by the DLOADR-ASH TROJAN! Source=Paul Collins Startup list [.mscdr] Number=70 Confirmed=X Filename=lassa.exe Description=Added by the WEBUS.C TROJAN! Source=Paul Collins Startup list [.mscdr] Number=71 Confirmed=X Filename=lsvchost.exe Description=Added by the WEBUS.D TROJAN! Source=Paul Collins Startup list [.mscdsr] Number=72 Confirmed=X Filename=lsvchost.exe Description=Added by the CR TROJAN! Source=Paul Collins Startup list [.mscsbl] Number=73 Confirmed=X Filename=svhost.exe Description=Added by the CMQ TROJAN! Source=Paul Collins Startup list [.msfupdate] Number=74 Confirmed=X Filename=msveup.exe Description=Added by the ALLOCUP.A WORM! Source=Paul Collins Startup list [.mssecure] Number=75 Confirmed=X Filename=mssecure.exe Description=Added by the DDOS_BOXED.X TROJAN! Source=Paul Collins Startup list [.NET config] Number=76 Confirmed=? Filename=sysmon32.exe Description=?? Source=Paul Collins Startup list [.norton] Number=77 Confirmed=X Filename=rchost.exe Description=Added by a variant of the BOXED-A TROJAN! Source=Paul Collins Startup list [.nvsvc] Number=78 Confirmed=X Filename=smss.exe Description=Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [.nvsvcb] Number=79 Confirmed=X Filename=smssb.exe Description=Added by the BOXED.CG TROJAN! Source=Paul Collins Startup list [.Prog] Number=80 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.Prog] Number=81 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.protected] Number=82 Confirmed=X Filename=N/A Description=Smitfraud variant Source=Paul Collins Startup list [.svchost] Number=83 Confirmed=X Filename=CSRSS.EXE Description=Added by the WEBUS.F TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [.TEXTCONV] Number=84 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.TEXTCONV] Number=85 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [.WMAudio] Number=86 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.WMAudio] Number=87 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [/l:eng] Number=88 Confirmed=N Filename=N/A Description=Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it's easily available using the search function Source=Paul Collins Startup list [000] Number=89 Confirmed=U Filename=pit.exe Description=PrivateEye surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [000hpdllhos] Number=90 Confirmed=X Filename=hpdllhost.exe Description=LZIO.com adware downloader Source=Paul Collins Startup list [000StTHK] Number=91 Confirmed=U Filename=000StTHK.exe Description=Toshiba Hot key functionality for the function keys (Fn-Esc, Fn-F1 (lock), Fn-F2, Fn-F3, Fn-F4, Fn-F5 (switching between laptop and CRT display output), etc...) Source=Paul Collins Startup list [0050726-007-i32-1] Number=92 Confirmed=X Filename=0050726-007-i32-1.exe Description=Added by the BANCBAN-EC TROJAN! Source=Paul Collins Startup list [00DSKSVR00] Number=93 Confirmed=? Filename=desksaver.exe Description=Related to Advanced Desktop Shield Source=Paul Collins Startup list [00DSKSVR01] Number=94 Confirmed=? Filename=desksaver.exe Description=Related to Advanced Desktop Shield Source=Paul Collins Startup list [00TCrdMain] Number=95 Confirmed=Y Filename=TCrdMain.exe Description=Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards Source=Paul Collins Startup list [00THotkey] Number=96 Confirmed=U Filename=00THotKey.exe Description=For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev. Source=Paul Collins Startup list [0190 Warner] Number=97 Confirmed=U Filename=WARN0190.EXE Description=Anti-dialer program (Germany) Source=Paul Collins Startup list [0900 Warner] Number=98 Confirmed=U Filename=WARN0900.EXE Description=Anti-dialer program (Germany) Source=Paul Collins Startup list [0mcamcap] Number=99 Confirmed=X Filename=0mcamcap.exe Description=Added by the COSIAM-H TROJAN! Source=Paul Collins Startup list [0utlook Express] Number=100 Confirmed=X Filename=*****.exe [* = random char] Description=Added by the RBOT-CC WORM! Note the first letter is actually the digit "0" and not a capital "o" Source=Paul Collins Startup list [1] Number=101 Confirmed=X Filename=1.exe Description=Added by the ESTEEMS TROJAN! Source=Paul Collins Startup list [1] Number=102 Confirmed=X Filename=lsass.scr Description=Added by the BANCOS.V TROJAN! Source=Paul Collins Startup list [1] Number=103 Confirmed=X Filename=svchost.scr Description=Added by the BANCOS.X TROJAN! Source=Paul Collins Startup list [1111swapmgr.exe] Number=104 Confirmed=X Filename=1111swapmgr.exe Description=Added by the IC TROJAN! Source=Paul Collins Startup list [123456] Number=105 Confirmed=X Filename=rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl Description=Added by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number Source=Paul Collins Startup list [12Ghosts Popup-Killer] Number=106 Confirmed=U Filename=12popup.exe Description=12Ghosts Popup-Killer Source=Paul Collins Startup list [17779Proj2002] Number=107 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [180adsolution] Number=108 Confirmed=X Filename=180adsolution.exe Description=NCase adware Source=Paul Collins Startup list [180ax] Number=109 Confirmed=X Filename=180ax.exe Description=NCase adware Source=Paul Collins Startup list [180ClientStubInstall] Number=110 Confirmed=X Filename=stubinstaller****.exe [* = digit] Description=180Solutions adware related Source=Paul Collins Startup list [180ClientStubInstall] Number=111 Confirmed=X Filename=[path to trojan] Description=180Solutions adware related Source=Paul Collins Startup list [180ClientStubInstall] Number=112 Confirmed=X Filename=******.tmp [* = random digit/char] Description=180Solutions adware related Source=Paul Collins Startup list [196_150_ni] Number=113 Confirmed=X Filename=196_150_ni.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [197_150_ni_3] Number=114 Confirmed=X Filename=197_150_ni_3.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [1:] Number=115 Confirmed=N Filename=hpdrv.exe Description=HP utility for monitoring when and how many recoveries have been done Source=Paul Collins Startup list [1A:MacVisionTrayMonitor] Number=116 Confirmed=N Filename=TrayMonitor.exe Description=Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock) Source=Paul Collins Startup list [1A:Stardock MCP] Number=117 Confirmed=Y Filename=mcpserver.exe Description=Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications Source=Paul Collins Startup list [1A:Stardock TrayMonitor] Number=118 Confirmed=Y Filename=TrayServer.exe Description=For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX Source=Paul Collins Startup list [1CmailS] Number=119 Confirmed=? Filename=NETMAIL.EXE Description=?? Source=Paul Collins Startup list [1on1] Number=120 Confirmed=X Filename=1on1.exe Description=Adult content dialler Source=Paul Collins Startup list [1Srv32] Number=121 Confirmed=U Filename=SpyAgent4.exe Description=SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC." Source=Paul Collins Startup list [1u7] Number=122 Confirmed=X Filename=1u7.exe Description=Added by the MURBAC-A TROJAN! Source=Paul Collins Startup list [1Win32Cfg] Number=123 Confirmed=U Filename=SpyBuddy.exe Description=SpyBuddy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [1Win32Cfg] Number=124 Confirmed=U Filename=Keyloggerpro.exe Description=Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [1WinCfg32] Number=125 Confirmed=X Filename=WebMailSpy.exe Description=WebMailSpy spyware Source=Paul Collins Startup list [2020Downloader] Number=126 Confirmed=X Filename=mssvr.exe Description=2020Search Toolbar Source=Paul Collins Startup list [252] Number=127 Confirmed=X Filename=winmgr.exe Description=Added by the LEGMIR-AT TROJAN! Source=Paul Collins Startup list [27] Number=128 Confirmed=X Filename=slsorve.exe Description=Added by the SLSORVE-A TROJAN! Source=Paul Collins Startup list [27] Number=129 Confirmed=X Filename=csrss32.exe Description=Added by the SLSORVE-D TROJAN! Source=Paul Collins Startup list [27] Number=130 Confirmed=X Filename=msm32.exe Description=Added by the SLSORVE-E TROJAN! Source=Paul Collins Startup list [2Search] Number=131 Confirmed=X Filename=main.exe Description=2Search adware Source=Paul Collins Startup list [2thousandbuck] Number=132 Confirmed=X Filename=[path to file] Description=Added by the RANKY.L TROJAN! Source=Paul Collins Startup list [2wSysTray] Number=133 Confirmed=U Filename=2portalmon.exe Description=2Wire Homeportal user interface Source=Paul Collins Startup list [32-bit Thunking service] Number=134 Confirmed=X Filename=thunk32.exe Description=Added by the DERDERO.A WORM! Source=Paul Collins Startup list [333] Number=135 Confirmed=X Filename=svchost.exe Description=Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This one is located in a "Syswm1i" directory Source=Paul Collins Startup list [39ELTFH25Z8SKF] Number=136 Confirmed=? Filename=Ezg1q5.exe Description=Seems to be associated with software by Resplendence SP ? Source=Paul Collins Startup list [3c1807pd] Number=137 Confirmed=Y Filename=3cmlink.exe 3cpipe-3c1807pd Description=3Com WinModem driver. See here for more WinModem information Source=Paul Collins Startup list [3capplnk] Number=138 Confirmed=Y Filename=3capplnk.exe Description=US Robotics Modem driver Source=Paul Collins Startup list [3cdminic] Number=139 Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3CM Link] Number=140 Confirmed=Y Filename=3cmcnkw.exe Description=Required for a US Robotics WinModem as it provides the link to Windows - won't work without it Source=Paul Collins Startup list [3Cmlink] Number=141 Confirmed=Y Filename=3CmlinkW.exe Description=For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information Source=Paul Collins Startup list [3ComDMIAgent] Number=142 Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3cpipe-USRpdA] Number=143 Confirmed=Y Filename=USRmlnkA.exe Description=Modem driver files from US Robotics Source=Paul Collins Startup list [3D Text] Number=144 Confirmed=X Filename=3D Text.scr Description=Added by the JERMY.A WORM! Source=Paul Collins Startup list [3Deep Control Panel] Number=145 Confirmed=U Filename=3DeepCTL.EXE Description=Now superseeded by ColorWizzard - 3Deep corrected lighting, shading and color for all your 2D and 3D games Source=Paul Collins Startup list [3Dfx Acc] Number=146 Confirmed=X Filename=GFXACC.EXE Description=Added by the GIBE WORM! Source=Paul Collins Startup list [3dfx Task Manager] Number=147 Confirmed=N Filename=3dfxMan.exe Description=System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs Source=Paul Collins Startup list [3dfx Tools] Number=148 Confirmed=Y Filename=3dfxCmn.dll Description=Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards Source=Paul Collins Startup list [3dfxv2ps.dll] Number=149 Confirmed=Y Filename=3dfxv2ps.dll Description=Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards Source=Paul Collins Startup list [3Dlabs Taskbar Display Manager] Number=150 Confirmed=? Filename=3DLman.exe Description=3DLabs graphics driver related. System Tray access to display settings? Source=Paul Collins Startup list [3DLabsHelperDemon] Number=151 Confirmed=U Filename=3dldemon.exe Description=Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore), so it should take zero CPU time and virtually zero memory, since it will all be paged out to the hard drive." In most cases it can be safely disabled Source=Paul Collins Startup list [3DMouse.EXE] Number=152 Confirmed=Y Filename=3DMouse.EXE Description=Dritek System Inc. 3D Mouse driver Source=Paul Collins Startup list [3d_sound] Number=153 Confirmed=X Filename=3d_sound.exe Description=Added by the RIADOS-A TROJAN! Source=Paul Collins Startup list [3qdctl.exe] Number=154 Confirmed=U Filename=3qdctl.exe Description=Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup, restoring volume and other audio settings to a pre-determined default. Similar to Creative Lab's AudioHQ Source=Paul Collins Startup list [3ware 3DM] Number=155 Confirmed=Y Filename=3dm.exe Description=Monitors status of the disk array on 3ware IDE RAID controllers Source=Paul Collins Startup list [456655] Number=156 Confirmed=X Filename=explorer.exe Description=Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System folder Source=Paul Collins Startup list [4da92ad5.exe] Number=157 Confirmed=X Filename=4da92ad5.exe Description=Added by the DLOADR-WZ TROJAN! Source=Paul Collins Startup list [4wd!!!] Number=158 Confirmed=X Filename=Natal!.pif Description=Added by the OPASERV.AI WORM! Source=Paul Collins Startup list [5-1-61-96] Number=159 Confirmed=X Filename=members-area.exe Description=Adult content dialler Source=Paul Collins Startup list [5-2-46-112] Number=160 Confirmed=X Filename=5-2-46-112.exe Description=Adult content pop-up dialler. Removal instructions here Source=Paul Collins Startup list [55278] Number=161 Confirmed=X Filename=grepclient1.exe Description=Added by the LINEAGE-S TROJAN! Source=Paul Collins Startup list [5p4m] Number=162 Confirmed=X Filename=[path to trojan] Description=Added by the LITEBOT-C TROJAN! Source=Paul Collins Startup list [5whgue21] Number=163 Confirmed=X Filename=5whgue21.exe Description=ClearSearch adware Source=Paul Collins Startup list [666] Number=164 Confirmed=X Filename=Ska.exe Description=Added by the PIPES TROJAN! Source=Paul Collins Startup list [678] Number=165 Confirmed=X Filename=lsas32.exe Description=Added by the SLSORVE-B TROJAN! Source=Paul Collins Startup list [98D0CE0C16B1] Number=166 Confirmed=X Filename=rundll32.exe D0CE0C16B1, D0CE0C16B1 Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [9m] Number=167 Confirmed=X Filename=winlog0n.exe Description=Added by the LEGMIR-AQK TROJAN! Source=Paul Collins Startup list [9xadiras] Number=168 Confirmed=Y Filename=9xadiras.exe Description=Allied Telesyn AT series router/modem related - apparently required Source=Paul Collins Startup list [9xHtProtect] Number=169 Confirmed=X Filename=AVprotect9x.exe Description=Added by the NETSKY.M WORM! Source=Paul Collins Startup list [;Rundll] Number=170 Confirmed=X Filename=[filename] Description=Added by the PWSLEGMIR.E TROJAN! Source=Paul Collins Startup list [?ekio Startups] Number=171 Confirmed=X Filename=?nksvc32.exe Description=Added by the AGOBOT-OV WORM where ? is a random character Source=Paul Collins Startup list [@] Number=172 Confirmed=X Filename=regedit -s ..win.dll Description=Added by the SEEKER.K TROJAN! Source=Paul Collins Startup list [@Hoc Toolbar] Number=173 Confirmed=N Filename=AtHoc.exe Description=One-click activated browsing toolbar used by various web-sites. See here for more info Source=Paul Collins Startup list [@loha] Number=174 Confirmed=N Filename=reminder.exe Description=Registration reminder for @loha@home E-mail utility Source=Paul Collins Startup list [@tour_ww] Number=175 Confirmed=X Filename=@tour_ww[1].exe Description=Adult content dialler Source=Paul Collins Startup list [a] Number=176 Confirmed=X Filename=a.exe Description=Commercials file that registers itself in the system registry and redirects IE to a certain commercial website Source=Paul Collins Startup list [a] Number=177 Confirmed=X Filename=jesse.exe Description=Added by the MELO-A WORM! Source=Paul Collins Startup list [A New Windows Updater] Number=178 Confirmed=X Filename=w32NTupdt.exe Description=Added by MYTOB.BM WORM! Source=Paul Collins Startup list [A Verizon App] Number=179 Confirmed=U Filename=VERIZO~1.EXE Description=Part of Verizon Online Support Manager Source=Paul Collins Startup list [a-squared] Number=180 Confirmed=U Filename=a2guard.exe Description=a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a� 'Background Guard' real time protection feature Source=Paul Collins Startup list [a-winpoet-service] Number=181 Confirmed=Y Filename=winpppoverethernet.exe Description=WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking Source=Paul Collins Startup list [A1000 Settings Utility] Number=182 Confirmed=U Filename=cpqa1000.exe Description=Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan, print, copy and fax. Only required if you use these features Source=Paul Collins Startup list [A4Proxy] Number=183 Confirmed=U Filename=A4Proxy.exe Description=Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites Source=Paul Collins Startup list [AAACLEAN] Number=184 Confirmed=? Filename=AAACLEAN.INF Description=?? Source=Paul Collins Startup list [AAAKeyboard] Number=185 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [AAATraySaver] Number=186 Confirmed=N Filename=TraySaver.exe Description=System Tray management utility from Mike Lin which allows you to hide, show, restore icons that are lost in an Explorer crash, remove dead tray icons, minimize any window to the System Tray Source=Paul Collins Startup list [AAK] Number=187 Confirmed=U Filename=aak.exe Description=Advanced Anti-Keylogger - "Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere" Source=Paul Collins Startup list [Aaou] Number=188 Confirmed=X Filename=amee.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Aapp] Number=189 Confirmed=X Filename=adprot.exe Description=AdBlaster adware Source=Paul Collins Startup list [aauclient] Number=190 Confirmed=? Filename=ACNUpdater.exe Description=Appears to be related to software from Accenture.com Source=Paul Collins Startup list [ab EazyScheduler] Number=191 Confirmed=? Filename=ezsched.exe Description=?? Source=Paul Collins Startup list [ABBYY Community Agent] Number=192 Confirmed=N Filename=CAGENT.EXE Description=Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software Source=Paul Collins Startup list [ABC] Number=193 Confirmed=U Filename=keylogger.exe Description=Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [abcdefgh] Number=194 Confirmed=X Filename=abcdefgh.exe Description=EPJ TROJAN! Source=Paul Collins Startup list [ABIT uGuru] Number=195 Confirmed=U Filename=uGuru.exe Description=ABIT �Guru - on motherboards incorporating the �Guru processor this provides quick access to "hardware monitoring, overclocking, BIOS flashing and audio tweakin Source=Paul Collins Startup list [ABITEQ] Number=196 Confirmed=N Filename=abiteq.exe Description=Monitoring utility for ABIT Motherboards. Displays system voltages, temperatures and fan speeds Source=Paul Collins Startup list [Abrada WIN32] Number=197 Confirmed=X Filename=abrada.exe Description=Added by the DERMON-G TROJAN! Source=Paul Collins Startup list [Absolute Shield] Number=198 Confirmed=U Filename=dseraser.exe Description=Absolute Shield Evidence Eliminator - internet history eraser Source=Paul Collins Startup list [Absolute StartUp monitor] Number=199 Confirmed=U Filename=ASMon.exe Description=Absolute Startup - startup monitor from F-Group Software Source=Paul Collins Startup list [AbsoluteShield Internet Eraser] Number=200 Confirmed=U Filename=cseraser.exe Description=AbsoluteShield Internet Eraser - "protects your privacy by cleaning up all the tracks of your Internet and computer activities" Source=Paul Collins Startup list [ABsr] Number=201 Confirmed=X Filename=absr.exe Description=Added by the AUTOUPDER TROJAN! Source=Paul Collins Startup list [absr] Number=202 Confirmed=X Filename=mwsvm.exe Description=SeekSeek search hijacker related - see here Source=Paul Collins Startup list [abtu] Number=203 Confirmed=X Filename=mp3serch.exe Description=Loads the executable for Lop.com. mp3serch.exe is the final version Source=Paul Collins Startup list [abtu] Number=204 Confirmed=X Filename=lopsearch.exe Description=Loads the executable for Lop.com. lopsearch.exe is the beta version Source=Paul Collins Startup list [AbyssWebServer] Number=205 Confirmed=U Filename=abyssws.exe Description=Abyss web server Source=Paul Collins Startup list [AcBtnMgr_Xxx] Number=206 Confirmed=Y Filename=AcBtnMgr_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [acc] Number=207 Confirmed=U Filename=acc.exe Description=Advanced Call Center - "full-featured yet easy-to-use answering machine software for your voice modem" Source=Paul Collins Startup list [ACCDEFRAGINFO] Number=208 Confirmed=X Filename=[path to worm] Description=Added by the DARBY-O WORM! Source=Paul Collins Startup list [Accelerate] Number=209 Confirmed=U Filename=accelerate.exe Description=Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection Source=Paul Collins Startup list [Access Ramp Monitor] Number=210 Confirmed=N Filename=armon32.exe Description=Monitors your progress on the internet; hang-ups, connection speeds, internet congestion and traffic flow. It prevents some games from running also. To disable the Access Ramp Monitor (1) Open Windows Explorer (2) Open the Program Files folder (3) Open the MindSpring folder (4) Open the AccessRamp folder (5) Double-click on the ARMCfg32.exe file (6) Uncheck Enable Dialup Monitor and click OK (7) Restart the computer and try again Source=Paul Collins Startup list [Access WebControl] Number=211 Confirmed=X Filename=[path to file] Description=Added by the PPDOOR-M TROJAN! Source=Paul Collins Startup list [AccessManager] Number=212 Confirmed=U Filename=AccessMgr.exe Description=Part of SmartPipes SecureSite software. "SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management, access control management, and key management" Source=Paul Collins Startup list [AccessMedia P2P Loader] Number=213 Confirmed=X Filename=amp2pl.exe Description=My AccessMedia toolbar related, stealth installed! Source=Paul Collins Startup list [AccessoriesPlus] Number=214 Confirmed=U Filename=clockplus.exe Description=Clock Plus, part of Accessories Plus allows you to select from dozens of alternatives for the Windows clock Source=Paul Collins Startup list [AccessRamp Monitor01] Number=215 Confirmed=N Filename=ARMon32a.exe Description=From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup, or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS, but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service." Source=Paul Collins Startup list [AccessRampLAN01] Number=216 Confirmed=N Filename=ARUpld32.exe Description=Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file, you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003 Source=Paul Collins Startup list [AcctMgr] Number=217 Confirmed=U Filename=AcctMgr.exe Description=Norton� Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information, and retrieves the data needed for email logins, shopping orders, banking, and other online activities - all from the safety of your own PC Source=Paul Collins Startup list [AccuWeather.com� Desktop] Number=218 Confirmed=N Filename=AccuWeatherDesktop.exe Description=Desktop weather from AccuWeather Source=Paul Collins Startup list [accwizz.exe] Number=219 Confirmed=X Filename=accwizz.exe Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [accwizzz.exe] Number=220 Confirmed=X Filename=accwizzz.exe Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [acdllib3] Number=221 Confirmed=X Filename=bcdlmem.exe Description=Added by the MAILBOT-BA TROJAN! Source=Paul Collins Startup list [ACDSee] Number=222 Confirmed=N Filename=ACDSee8Pro.exe Description=ACDSee 8 photo software. Organize, manage, enhance, and share all your valued photo memories Source=Paul Collins Startup list [Ace bows] Number=223 Confirmed=? Filename=Ace bows.exe Description=?? Source=Paul Collins Startup list [AceGain LiveUpdate] Number=224 Confirmed=N Filename=LiveUpdate.exe Description="AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates, driver updates or full product updates and automatically download and install them according to user configuration" Source=Paul Collins Startup list [Acer ePower Management] Number=225 Confirmed=U Filename=Acer ePower Management.exe Description=Part of Acer Empowering Technology. "Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles, or to create their own customized profiles" Source=Paul Collins Startup list [AcerGoto] Number=226 Confirmed=U Filename=AcerGoto.exe Description=Acer Computer "Goto Drive" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files, or easy importation of data from user's previous computer Source=Paul Collins Startup list [AcerNotebookManager] Number=227 Confirmed=U Filename=almxptray.exe Description=System Tray access on some Acer Notebooks to give faster access to system settings Source=Paul Collins Startup list [AcerPowerkey] Number=228 Confirmed=U Filename=Powerkey.exe Description=PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3 Source=Paul Collins Startup list [Aceu] Number=229 Confirmed=X Filename=[random filename] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [AClntUsr] Number=230 Confirmed=U Filename=AClntUsr.exe Description=Altiris AClient Service Windows Tray Icon Source=Paul Collins Startup list [Acme.PCHButton] Number=231 Confirmed=N Filename=pchbutton.exe Description=Used by HP Instant Support Source=Paul Collins Startup list [ACMonitor_Xxx] Number=232 Confirmed=Y Filename=ACMonitor_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [acocash] Number=233 Confirmed=X Filename=fastdown.exe Description=Adult content dialler Source=Paul Collins Startup list [acocash] Number=234 Confirmed=X Filename=fastdown.exe Description=Adult content dialler Source=Paul Collins Startup list [Acombo3dmouse] Number=235 Confirmed=U Filename=Acombo3d.exe Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Aconti] Number=236 Confirmed=X Filename=aconti.exe Description=Adult content dialler Source=Paul Collins Startup list [acoustic] Number=237 Confirmed=U Filename=acoustic.exe Description=Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained Source=Paul Collins Startup list [acpart] Number=238 Confirmed=N Filename=agpart11.exe Description=Program for finding trucks on-line Source=Paul Collins Startup list [Acrobat] Number=239 Confirmed=X Filename=acrmon32.exe Description=Added by the SMALL-ECT TROJAN! Source=Paul Collins Startup list [Acrobat Assistant *.*] Number=240 Confirmed=U Filename=ACROTRAY.EXE Description=Used to create PDF files with Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the "U" recommendation. *.* represents the version Source=Paul Collins Startup list [Acrobat Read] Number=241 Confirmed=X Filename=acroup32.exe Description=Added by the VANBOT-BQ TROJAN! Source=Paul Collins Startup list [Acronis Popup Blocker] Number=242 Confirmed=U Filename=RunDll32.exe [path] Blocker.dll, Run Description=Part of Acronis Privacy Expert - anti-spyware and security suite Source=Paul Collins Startup list [Acronis Scheduler2 Service] Number=243 Confirmed=U Filename=schedhlp.exe Description=Part of Acronis True Image - backup software. Co-operates with the "schedul2.exe" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images Source=Paul Collins Startup list [Acronis True Image] Number=244 Confirmed=U Filename=TimounterMonitor.exe Description=Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive Source=Paul Collins Startup list [Acronis True Image Monitor] Number=245 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [Acronis TrueImage Monitor] Number=246 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [AcronisTimounterMonitor] Number=247 Confirmed=U Filename=TimounterMonitor.exe Description=Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive Source=Paul Collins Startup list [AcronisTrueImage Monitor] Number=248 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [Act! Preloader] Number=249 Confirmed=U Filename=Act8.exe Description=Sage Software's ACT! "enables individuals and small business customers to instantly access key contact and customer information, manage and prioritize activities, and track all contact-related communications so you can grow productive business relationships" Source=Paul Collins Startup list [Action Manager 32] Number=250 Confirmed=N Filename=am32.exe Description=Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs Source=Paul Collins Startup list [ActionAgent] Number=251 Confirmed=? Filename=actionagent.exe Description="A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client". Is it required? Source=Paul Collins Startup list [Activation] Number=252 Confirmed=N Filename=Activation.exe Description=Part of Microsoft Money Source=Paul Collins Startup list [Activboard] Number=253 Confirmed=U Filename=MMKeybd.exe Description=Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock, Caps Lock, Scroll Lock keys Source=Paul Collins Startup list [Active Bit Station] Number=254 Confirmed=X Filename=abs.exe Description=Added by the MYTOB.BZ WORM! Source=Paul Collins Startup list [Active Email Monitor] Number=255 Confirmed=U Filename=aem25.exe Description=Active Email Monitor checks multiple accounts for email, serves as a SPAM filter and can also protect you from harmful items that can be sent via email Source=Paul Collins Startup list [Active shield] Number=256 Confirmed=U Filename=Activeshield.exe Description=Active Shield is "an heuristic screen that actively protects your computer from trojans, spyware, adware, trackware, dialers, keyloggers, and even some special kinds of viruses" Source=Paul Collins Startup list [ActiveDesktop] Number=257 Confirmed=X Filename=systray32.exe Description=Added by the DABOOM WORM! Source=Paul Collins Startup list [ACTIVEDS] Number=258 Confirmed=X Filename=ACTIVEDS.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [ActiveEyes] Number=259 Confirmed=N Filename=ActiveEyes.exe Description=ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small, it's free and comes with a range of options and animations. Not needed - if unavailable via Start -> Programs, create your own shortcut Source=Paul Collins Startup list [ActiveKeys.AAB635BD7D054a37A576] Number=260 Confirmed=U Filename=akeys.exe Description="Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action" Source=Paul Collins Startup list [ActiveMenu] Number=261 Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [ActivePlus] Number=262 Confirmed=U Filename=activeplus.exe Description=Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on) Source=Paul Collins Startup list [ActiveScan Antivirus] Number=263 Confirmed=X Filename=ActiveScan.exe Description=Added by the RBOT-FKQ WORM! Source=Paul Collins Startup list [ActiveShield] Number=264 Confirmed=Y Filename=MCVSSHLD.EXE Description=McAfee VirusScan On-line. See also the McAgentExe entry Source=Paul Collins Startup list [ActiveSpeed] Number=265 Confirmed=U Filename=AS.exe Description=Ascentive ActiveSpeed Internet Optimizer Source=Paul Collins Startup list [ActiveSync] Number=266 Confirmed=X Filename=wcescom32.exe Description=Added by the MANCSYN-E TROJAN! Source=Paul Collins Startup list [ActiveWords] Number=267 Confirmed=N Filename=AWMonitor.exe Description=ActiveWords from ActiveWord Systems, Inc. Like macro programs, ActiveWords sits in the background and watches as you type. When it recognizes that you�ve typed an ActiveWord, it takes the associated action, such as replacing your keystrokes with the text you�ve defined Source=Paul Collins Startup list [ActiveX Streamer] Number=268 Confirmed=X Filename=msgfix.exe Description=Added by the SDBOT.NQ WORM! Source=Paul Collins Startup list [ActiveXUpdate] Number=269 Confirmed=X Filename=svcss.exe Description=Added by a variant of the DEDLER.C TROJAN! Source=Paul Collins Startup list [Activity] Number=270 Confirmed=U Filename=actik.exe Description=ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [ActivSurf] Number=271 Confirmed=N Filename=backweb*****.exe Description=Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [ActMaker] Number=272 Confirmed=U Filename=ActMak25.exe Description="ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding, nor are you required to know a lot about the computer" Source=Paul Collins Startup list [ActMaker] Number=273 Confirmed=U Filename=ActMaker25.exe Description=ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload Source=Paul Collins Startup list [ACTray] Number=274 Confirmed=U Filename=ACTray.exe Description=System Tray icon for ThinkVantage Access Connections - "allowing users to seamlessly switch between wired and wireless environments, managing security settings, printers, home page and other location-specific settings automatically" Source=Paul Collins Startup list [Actual Window Minimizer] Number=275 Confirmed=U Filename=ActualWindowMinimizerCenter.exe Description=Actual Window Minimizer - "allows minimizing any window to task tray notification area or to the edge of the screen" Source=Paul Collins Startup list [ACTX1] Number=276 Confirmed=X Filename=v1201.exe Description=Added by the VB.IS TROJAN! Source=Paul Collins Startup list [ACU] Number=277 Confirmed=U Filename=ACU.exe Description=Atheros wireless Client Utility Source=Paul Collins Startup list [ACU_QSB] Number=278 Confirmed=U Filename=ACU.exe Description=Atheros wireless Client Utility Source=Paul Collins Startup list [ACWLIcon] Number=279 Confirmed=U Filename=ACWLIcon.exe Description=Related to IBM ThinkVantage Connectivity Solution Source=Paul Collins Startup list [Ad Blocker] Number=280 Confirmed=U Filename=blocker.exe Description=Ad Blocker - blocks popups, and also removes banners, image ads and flash ads Source=Paul Collins Startup list [Ad Blocker Pro] Number=281 Confirmed=U Filename=Ad Blocker Pro.exe Description=Ad Away popup and banner remover Source=Paul Collins Startup list [Ad Muncher] Number=282 Confirmed=U Filename=AdMunch.exe Description=Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications Source=Paul Collins Startup list [Ad Online Guide] Number=283 Confirmed=? Filename=adonlineguide.exe Description=?? Source=Paul Collins Startup list [Ad-aware] Number=284 Confirmed=N Filename=Ad-aware.exe Description=Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs Source=Paul Collins Startup list [Ad-Aware] Number=285 Confirmed=X Filename=Ad-Aware.exe Description=Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-aware spware/adware removal tool and is located in the Winnt\System32 or Windows\System32 directory Source=Paul Collins Startup list [Ad-Eliminator] Number=286 Confirmed=N Filename=ad-eliminator.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Ad-Muncher] Number=287 Confirmed=U Filename=ADMUNCH.EXE Description=Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications Source=Paul Collins Startup list [Ad-Protect] Number=288 Confirmed=U Filename=ad-protect.exe Description=Ad-Protect spyware and spam monitoring tool Source=Paul Collins Startup list [Ad-watch] Number=289 Confirmed=U Filename=Ad-watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [AD2KClient] Number=290 Confirmed=U Filename=AD2KClient.exe Description=Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [Adaptec DirectCD] Number=291 Confirmed=N Filename=Directcd.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [AdaptecDirectCD] Number=292 Confirmed=N Filename=Directcd.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [AdAware] Number=293 Confirmed=X Filename=wini.exe Description=Added by the RBOT-XN WORM! Source=Paul Collins Startup list [Adaware Bootup] Number=294 Confirmed=N Filename=ad-aware.exe Description=Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs Source=Paul Collins Startup list [Adaware lptt01] Number=295 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [Adaware ml097e] Number=296 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [Add**.exe [* = random char]] Number=297 Confirmed=X Filename=Add**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Add**32.exe [* = random char]] Number=298 Confirmed=X Filename=Add**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [AddClass] Number=299 Confirmed=X Filename=AddClass.exe Description=CoolWebSearch Addclass parasite variant Source=Paul Collins Startup list [AddClass] Number=300 Confirmed=X Filename=[Installation_Path] Description=Added by the STARTPAGE.F hijacker Source=Paul Collins Startup list [AddClass] Number=301 Confirmed=X Filename=[path to trojan] Description=Added by the SECDL-A TROJAN! Source=Paul Collins Startup list [AdDelete] Number=302 Confirmed=U Filename=AdDelete.exe Description=Banner advertisment blocker Source=Paul Collins Startup list [AdDestroyer] Number=303 Confirmed=X Filename=AdDestroyer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [addproxy] Number=304 Confirmed=? Filename=addproxy.exe Description=Related to Adobe Photoshop Source=Paul Collins Startup list [ADG] Number=305 Confirmed=? Filename=ADG.exe Description= SoundBlaster Audigy related? Source=Paul Collins Startup list [ADGJdet] Number=306 Confirmed=N Filename=ADGJDet.exe Description=Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Source=Paul Collins Startup list [aDir] Number=307 Confirmed=X Filename=adirss.exe Description=Added by the SPAMSRV-E TROJAN! Source=Paul Collins Startup list [Adiras] Number=308 Confirmed=Y Filename=Adiras.exe Description=ADSL USB modem related Source=Paul Collins Startup list [adirka] Number=309 Confirmed=X Filename=adirka.exe Description=Added by the TIBS-QT TROJAN! Source=Paul Collins Startup list [AdKiller] Number=310 Confirmed=U Filename=AD Defender.exe Description=Part of Advanced Spyware Remover anti-spyware tool Source=Paul Collins Startup list [ADM Library Loader] Number=311 Confirmed=X Filename=admlib32.exe Description=Added by a variant of the SDBOT TROJAN! Source=Paul Collins Startup list [Admanager Controller] Number=312 Confirmed=X Filename=AdManCtl.exe Description=Adware, probably a Windupdates variant Source=Paul Collins Startup list [Admilli Service] Number=313 Confirmed=X Filename=AdmilliServ.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Administrator] Number=314 Confirmed=X Filename=svchost.scr Description=Added by the NOVACAL TROJAN! Source=Paul Collins Startup list [AdminSoft] Number=315 Confirmed=X Filename=sysfile.vbs Description=Added by the STARGRUB-A WORM! Source=Paul Collins Startup list [admtray.exe] Number=316 Confirmed=U Filename=admtray.exe Description=Related to Acer Inc. destop tray Source=Paul Collins Startup list [Adobe] Number=317 Confirmed=X Filename=Adobe.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Adobe] Number=318 Confirmed=X Filename=sysconfig.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [adobe] Number=319 Confirmed=X Filename=gam.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Adobe] Number=320 Confirmed=X Filename=sysbat32.exe Description=Added by the LOWZONES.T TROJAN! Source=Paul Collins Startup list [Adobe] Number=321 Confirmed=X Filename=zteam.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Adobe Acrobat] Number=322 Confirmed=N Filename=READER~1.EXE Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Acrobat Distiller Application] Number=323 Confirmed=X Filename=acrotray.exe Description=Added by the RANDEX.DFJ WORM! Source=Paul Collins Startup list [Adobe Acrobat Reader CFG] Number=324 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Adobe Filter Platform] Number=325 Confirmed=X Filename=afilterplatform.exe Description=Added by the RBOT-OP WORM! Source=Paul Collins Startup list [Adobe Gamma Loader] Number=326 Confirmed=U Filename=Adobe Gamma Loader.exe Description=Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine Source=Paul Collins Startup list [Adobe Photo Downloader] Number=327 Confirmed=N Filename=apdproxy.exe Description=Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here) Source=Paul Collins Startup list [Adobe Reader Speed Lauch] Number=328 Confirmed=N Filename=reader_sl.exe Description=Speeds up the launch of Adobe (Acrobat) Reader 7 Source=Paul Collins Startup list [Adobe Reader Speed Launch] Number=329 Confirmed=N Filename=reader_sl.exe Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Reader Speed Launch] Number=330 Confirmed=N Filename=READER~1.EXE Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Version Cue CS2] Number=331 Confirmed=U Filename=VersionCueCS2Tray.exe Description=File manager that's part of Adobe Creative Suite 2 - "find files fast, track versions across applications, link files together, and share them in creative collaboration without fear of overwriting someone else's work" Source=Paul Collins Startup list [AdobeA] Number=332 Confirmed=X Filename=adobes.exe Description=Added by the FLOOD.BA TROJAN! Source=Paul Collins Startup list [AdobeFonts] Number=333 Confirmed=X Filename=fonts.hta Description=Browser hijacker - redirecting to Hugesearch.net Source=Paul Collins Startup list [adobemgr] Number=334 Confirmed=X Filename=adobemgr.exe Description=Added by the ADCLICKER TROJAN! Source=Paul Collins Startup list [AdobeReader] Number=335 Confirmed=X Filename=msni.exe Description=Added by the RBOT.DAO TROJAN! Source=Paul Collins Startup list [AdobeReaderPro] Number=336 Confirmed=X Filename=msnxpsp.exe Description=Added by the RBOT-ASK or RBOT-AUS WORMS! Source=Paul Collins Startup list [AdobeReaderPro] Number=337 Confirmed=X Filename=ntkernell32.exe Description=Added by the RBOT-ATY WORM! Source=Paul Collins Startup list [AdobeReaderPro] Number=338 Confirmed=X Filename=msnserve.exe Description=Added by the SDBOT-AKH WORM! Source=Paul Collins Startup list [AdobeReaderPro] Number=339 Confirmed=X Filename=updt.exe Description=Added by the IRCBOT-VQ WORM! Source=Paul Collins Startup list [AdobeReaderProfessional] Number=340 Confirmed=X Filename=msx64.exe Description=Added by the RBOT-GAT WORM! Source=Paul Collins Startup list [AdobeReaderPros] Number=341 Confirmed=X Filename=sysmsn.exe Description=Added by the RBOT-BGH WORM! Source=Paul Collins Startup list [AdobeVersionCue] Number=342 Confirmed=N Filename=VersionCueTray.exe Description="An exclusive feature of the Adobe� Creative Suite, Version Cue� helps you find files fast, track multiple versions of your files, and share your files for creative collaboration" Source=Paul Collins Startup list [Adope File Manager] Number=343 Confirmed=X Filename=lsasv.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [adp] Number=344 Confirmed=X Filename=adp.exe Description=Spyware installed by Net2Phone, Limewire, Cydoor, Grokster, KaZaa, etc Source=Paul Collins Startup list [AdPopup] Number=345 Confirmed=X Filename=dcf5678.exe Description=Added by the AGENT-FZ TROJAN! Source=Paul Collins Startup list [adprot] Number=346 Confirmed=X Filename=adprot.exe Description=AdBlaster adware Source=Paul Collins Startup list [ADQuickAccess] Number=347 Confirmed=N Filename=Adtray.exe Description=After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95 Source=Paul Collins Startup list [ADriver] Number=348 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [AdRoarUpdate] Number=349 Confirmed=X Filename=ARUpdate.exe Description=AdRoar adware updater Source=Paul Collins Startup list [AdRotator.Application] Number=350 Confirmed=X Filename=[path to csrss.exe] Description=Added by the SMALL-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [AdRotator.Application] Number=351 Confirmed=X Filename=services.exe Description=Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder Source=Paul Collins Startup list [ADS Adware Remover] Number=352 Confirmed=N Filename=ADS Adware Remover.exe Description=Adware remover - not recommended, see here Source=Paul Collins Startup list [AdsBlocker] Number=353 Confirmed=X Filename=stopAds.exe Description=Reported as DILAER.DW by NOD32 Source=Paul Collins Startup list [ADService] Number=354 Confirmed=U Filename=ADService.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [AdsGone] Number=355 Confirmed=U Filename=Adsgone.exe Description=AdsGone - pop-up stopper Source=Paul Collins Startup list [ADSL Diagnostic Tools] Number=356 Confirmed=N Filename=mapiicon.exe Description=System tray access to ADSL modem diagnostic tools. Available via Start -> Programs Source=Paul Collins Startup list [ADSLSYSTEMTRAY] Number=357 Confirmed=? Filename=SystemtrayV100B.exe Description=Apparently Annex A ADSL modem related. What does it do and is it required? Source=Paul Collins Startup list [AdslTaskBar] Number=358 Confirmed=Y Filename=rundll32.exe stmctrl.dll, TaskBar Description=ISP software, initializes DSL modem Source=Paul Collins Startup list [AdslTaskBars] Number=359 Confirmed=X Filename=taskmng.exe Description=Added by the RBOT-AXZ WORM! Source=Paul Collins Startup list [ADSL_A2] Number=360 Confirmed=? Filename=A2Installed Description=Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required? Source=Paul Collins Startup list [ADSS] Number=361 Confirmed=Y Filename=ADSS.exe Description=ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied Source=Paul Collins Startup list [adstartup] Number=362 Confirmed=X Filename=automove.exe Description=Adlogix adware variant Source=Paul Collins Startup list [adstartup] Number=363 Confirmed=X Filename=Adstartup.exe Description=Adlogix adware variant Source=Paul Collins Startup list [AdStatus Service] Number=364 Confirmed=X Filename=AdStatServ.exe Description=WindUpdates AdStatus Service adware Source=Paul Collins Startup list [AdSubtract] Number=365 Confirmed=U Filename=adsub.exe Description=AdSubtract blocks ads, cookies, pop-up windows, animations, music, and more. Can be disabled from within AdSubtract. Available via Start -> Programs. Now superseeded by Trend Micro AntiSpyware Source=Paul Collins Startup list [adtech2005] Number=366 Confirmed=X Filename=adtech2005.exe Description=Recognized by Kaspersky antivirus as Trojan.Win32.StartPage.aw Source=Paul Collins Startup list [adtech2006] Number=367 Confirmed=X Filename=adtech2006.exe Description=Recognized by Kaspersky antivirus as Clicker.Win32.VB.kc Source=Paul Collins Startup list [Adtools Service] Number=368 Confirmed=X Filename=AdTools.exe Description=Windupdates Adware Source=Paul Collins Startup list [ADU] Number=369 Confirmed=? Filename=adu.exe Description=Related to Cisco Aironet wireless products. What does it do and is it required? Source=Paul Collins Startup list [AdultX] Number=370 Confirmed=X Filename=AdultX.exe Description=Adult content dialler and hijacker Source=Paul Collins Startup list [Adult_Chat] Number=371 Confirmed=X Filename=Adult_Chat.exe Description=Adult content dialler Source=Paul Collins Startup list [Adult_Chat1] Number=372 Confirmed=X Filename=Adult_Chat1.exe Description=Adult content dialler Source=Paul Collins Startup list [AdUpdater] Number=373 Confirmed=X Filename=sysupudt.exe Description=Unidentified adware downloader/updater Source=Paul Collins Startup list [ADUserMon] Number=374 Confirmed=U Filename=ADUserMon.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [Advanced DHTML Enable] Number=375 Confirmed=X Filename=exo32.exe Description=Added by the RANCK-FI TROJAN! Source=Paul Collins Startup list [Advanced Internet Protocol] Number=376 Confirmed=X Filename=cerf.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Advanced Protection System] Number=377 Confirmed=X Filename=advpsys.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Advanced Spyware Remover] Number=378 Confirmed=U Filename=Asr.exe Description=Advanced Spyware Remover anti spyware tool Source=Paul Collins Startup list [Advanced Tool Checks] Number=379 Confirmed=X Filename=advchks.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Advanced Tools Check] Number=380 Confirmed=N Filename=ADVCHK.EXE Description=Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Source=Paul Collins Startup list [Advanced Uninstaller PRO Installation Monitor] Number=381 Confirmed=U Filename=monitor.exe Description=Innovative Solutions Advanced Uninstaller PRO - "easy-to-use suite for uninstalling applications and keeping your computer fast, clean, and in its best shape" Source=Paul Collins Startup list [Advapi] Number=382 Confirmed=X Filename=Advapi.exe Description=Added by the NETDEVIL.12 WORM! Source=Paul Collins Startup list [ADVCHK] Number=383 Confirmed=N Filename=ADVCHK.EXE Description=Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Source=Paul Collins Startup list [Advertising Killer] Number=384 Confirmed=U Filename=Akiller.exe Description=Advertising Killer - popup stopper Source=Paul Collins Startup list [advmon32] Number=385 Confirmed=X Filename=advmon32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [Adware Agent] Number=386 Confirmed=U Filename=adware agent.exe Description=Adware Agent popup blocker Source=Paul Collins Startup list [Adware Spy] Number=387 Confirmed=N Filename=AdwareSpy.exe Description=Adware remover - not recommended, see here Source=Paul Collins Startup list [AdwareAlert] Number=388 Confirmed=U Filename=AdwareAlert.Exe Description=Adware program, previously not recommended (see here). It has now been delisted, so make sure you have the latest version Source=Paul Collins Startup list [AdwareDelete] Number=389 Confirmed=N Filename=adwaredelete.exe Description=Adware remover - not recommended, see here Source=Paul Collins Startup list [Aeiwlsta.exe] Number=390 Confirmed=? Filename=Aeiwlsta.exe Description=IBM High Rate Wireless LAN Adapter driver. Is it required? Source=Paul Collins Startup list [AELaunch] Number=391 Confirmed=N Filename=AELaunch.exe Description=Audio Applications Launcher for the Philips Acoustic Edge soundcard Source=Paul Collins Startup list [AERVICESN] Number=392 Confirmed=X Filename=AERVICESN.exe Description=Added by the RANDON-AO WORM! Source=Paul Collins Startup list [AeXAgentLogon] Number=393 Confirmed=N Filename=AeXAgentActivate.exe Description=Altiris Agent transmits information about your machine for the purpose of asset management and deployment Source=Paul Collins Startup list [AeXSWDUsr] Number=394 Confirmed=? Filename=AeXSWDUsr.exe Description=Altiris Express NS Client Manager software. Is it required? Source=Paul Collins Startup list [AEZBProc] Number=395 Confirmed=U Filename=aptezbp.exe Description=IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation, volume control, and few quickstart buttons. Keyboard will work without it but you lose the special functions Source=Paul Collins Startup list [AFAFilter] Number=396 Confirmed=U Filename=windefault.exe Description=AFAFilter - internet filter software Source=Paul Collins Startup list [Agent] Number=397 Confirmed=N Filename=Agent.exe Description=Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs Source=Paul Collins Startup list [Agent] Number=398 Confirmed=X Filename=alsys.exe Description=Added by the DREF-V VIRUS! Source=Paul Collins Startup list [agent] Number=399 Confirmed=X Filename=ppl.exe Description=Added by the DREF-U VIRUS! Source=Paul Collins Startup list [Agent Browser] Number=400 Confirmed=X Filename=[random filename] Description=Added by the PPdoor.M-bdr backdoor TROJAN! Source=Paul Collins Startup list [Agent Explorer] Number=401 Confirmed=X Filename=[random filename] Description=Unidentified adware Source=Paul Collins Startup list [Agente] Number=402 Confirmed=? Filename=Remupd.exe Description=Part of Panda Antivirus . Is this an update reminder (guess because of the name), virus definition update reminder or something similar? Source=Paul Collins Startup list [agentsvr] Number=403 Confirmed=X Filename=agentsvr.exe Description=Malware, detected by Kaspersky antivirus as AdWare.Monker.a. NOTE: do NOT confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder Source=Paul Collins Startup list [AgfaCLnk] Number=404 Confirmed=U Filename=AgfaCLnk.exe Description=For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive Source=Paul Collins Startup list [agp] Number=405 Confirmed=X Filename=agp32.exe Description=Added by the GAOBOT.SY WORM! Source=Paul Collins Startup list [AGRSMMSG] Number=406 Confirmed=Y Filename=AGRSMMSG.exe Description=IBM AMR modem driver Source=Paul Collins Startup list [AGSatellite] Number=407 Confirmed=N Filename=AGSatellite.exe Description=Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs Source=Paul Collins Startup list [ahfp] Number=408 Confirmed=U Filename=ahfp.exe Description=Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either" Source=Paul Collins Startup list [ahfprog] Number=409 Confirmed=U Filename=ahfp.exe Description=Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either" Source=Paul Collins Startup list [AHNSD] Number=410 Confirmed=Y Filename=AhnSD.exe Description=AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis Source=Paul Collins Startup list [AHNUE] Number=411 Confirmed=? Filename=AHNUE.exe Description=?? Source=Paul Collins Startup list [ahost] Number=412 Confirmed=X Filename=ahost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [AHQInit] Number=413 Confirmed=N Filename=ahqinit.exe Description=Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required Source=Paul Collins Startup list [Ahst] Number=414 Confirmed=X Filename=iebs.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [AHU] Number=415 Confirmed=X Filename=[path to worm] Description=Added by the ANACON-B WORM! Source=Paul Collins Startup list [ahui32.exe] Number=416 Confirmed=X Filename=ahui32.exe Description=Added by the CERTIF-M TROJAN! Source=Paul Collins Startup list [Aica] Number=417 Confirmed=X Filename=tuaa.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Aida] Number=418 Confirmed=X Filename=ttuh.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Aida] Number=419 Confirmed=X Filename=eetu.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [aiepk] Number=420 Confirmed=U Filename=aiepk2.exe Description=Another IE Popup Killer - pop-up stopper Source=Paul Collins Startup list [AIM] Number=421 Confirmed=N Filename=aim.exe Description=AOL Instant Messenger. If connected to the internet, automatically runs up AIM. Convenience more than anything. Available via Start -> Programs Source=Paul Collins Startup list [AIM] Number=422 Confirmed=U Filename=AIM+.exe Description=AIM plus - a free add-on to AOL's Instant Messenger for Windows from Big-O Software Source=Paul Collins Startup list [AIM Instant Message Cookies] Number=423 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AFV WORM! Source=Paul Collins Startup list [Aim Plugin] Number=424 Confirmed=X Filename=aimplugin.exe Description=Added by the GUAP-F WORM! Source=Paul Collins Startup list [AIM reminder] Number=425 Confirmed=X Filename=AIM reminder.exe Description=Added by the BUDDY TROJAN! Source=Paul Collins Startup list [Aim6] Number=426 Confirmed=N Filename=AOLLaunch.exe Description=AOL Instant Messenger - start it when you want to use it Source=Paul Collins Startup list [AIM95 Startup] Number=427 Confirmed=X Filename=aim95.exe Description=Added by the AGOBOT.AEE WORM! Source=Paul Collins Startup list [aimaol lptt01] Number=428 Confirmed=X Filename=aimaol.exe Description=RapidBlaster variant (in a "Aimaol" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [aimaol ml097e] Number=429 Confirmed=X Filename=aimaol.exe Description=RapidBlaster variant (in a "Aimaol" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [aimb.exe] Number=430 Confirmed=U Filename=aimb.exe Description=IMSufSentinel is a spy program which can record IM conversations, log keystrokes, record URLs visited, and take screenshots. If you didn't install this yourself remove it Source=Paul Collins Startup list [AimingClick] Number=431 Confirmed=N Filename=AimingClick.exe Description=AimingClick from AimingTech. Web searching tool. Available via Start -> Programs Source=Paul Collins Startup list [AIMPro] Number=432 Confirmed=U Filename=aimpro.exe Description=AIM Pro - secure instant messaging, video conferencing, on-line meetings and desktop and file sharing Source=Paul Collins Startup list [AIMster] Number=433 Confirmed=N Filename=?? Description=Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs Source=Paul Collins Startup list [AIMWDInstall] Number=434 Confirmed=N Filename=AIMWDInstall.exe Description=Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [Aiptek Graphics Tablet (USB)] Number=435 Confirmed=Y Filename=atwtusb.exe Description=USB interface for Aiptek Graphics Tablet (USB) Source=Paul Collins Startup list [aircity] Number=436 Confirmed=X Filename=aircity.exe Description=Related to "Prutect" malware from e2Give Source=Paul Collins Startup list [AKEYNAME] Number=437 Confirmed=X Filename=WinServ.exe Description=Added by the EVILBOT.C TROJAN! Source=Paul Collins Startup list [akeys] Number=438 Confirmed=U Filename=akeys.exe Description="Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action" Source=Paul Collins Startup list [AKiller] Number=439 Confirmed=U Filename=akiller.exe Description=Advertising Killer - popup stopper Source=Paul Collins Startup list [ala.exe] Number=440 Confirmed=X Filename=ala.exe Description=Access Lock is a system-tray security utility you can use to secure your desktop when you are away from your computer Source=Paul Collins Startup list [Alarm Manager] Number=441 Confirmed=U Filename=Alarm.app.exe Description=Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop Source=Paul Collins Startup list [AlarmWatcher] Number=442 Confirmed=? Filename=AlarmWatcher.exe Description=Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required? Source=Paul Collins Startup list [Album Fast Start] Number=443 Confirmed=N Filename=ABMTSR.EXE Description=Scanner software, not required for scanner to work Source=Paul Collins Startup list [AlcFDMonitor] Number=444 Confirmed=? Filename=ALCFDRTM.EXE Description=RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup? Source=Paul Collins Startup list [ALCFDRTM16] Number=445 Confirmed=? Filename=ALCFDRTM16.com Description=RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup? Source=Paul Collins Startup list [Alchem] Number=446 Confirmed=X Filename=Alchem.exe Description=ClickAlchemy adware Source=Paul Collins Startup list [Alcmtr] Number=447 Confirmed=U Filename=Alcmtr.exe Description=Installed with hardware drivers for a Realtek AC97 audio device. It's believed that Realtek uses this file in order to data about the customer. Some users report problems with their on-board sound if this is disabled - hence the "U" recommendation Source=Paul Collins Startup list [Alcohol] Number=448 Confirmed=U Filename=Alcohol.exe Description=Alcohol 120% - CD/DVD emulation/writing/copying software Source=Paul Collins Startup list [Alcohol Autorun] Number=449 Confirmed=U Filename=Alcohol.exe Description=Alcohol 120% - CD/DVD emulation/writing/copying software Source=Paul Collins Startup list [Alcom PCL Capture] Number=450 Confirmed=? Filename=FMW_PCAP.EXE Description=?? Source=Paul Collins Startup list [AlcWzrd] Number=451 Confirmed=N Filename=ALCWZRD.EXE Description=RealTek High Definition audio driver related - detects new devices when plugged in, then pops up a dialog box. If everything works as expected you should be able to disable this one Source=Paul Collins Startup list [AlcxMonitor] Number=452 Confirmed=U Filename=Alcxmntr.exe Description=Installed with hardware drivers for a Realtek AC97 audio device. It's believed that Realtek uses this file in order to gather data about the customer. Some users report problems with their on-board sound if this is disabled - hence the "U" recommendation Source=Paul Collins Startup list [aldefr ere service] Number=453 Confirmed=X Filename=tay0x.exe Description=Added by the RBOT-XS WORM! Source=Paul Collins Startup list [Alevir] Number=454 Confirmed=X Filename=Alevir.exe Description=Added by the OPASERV-A WORM! Source=Paul Collins Startup list [AlevirOld] Number=455 Confirmed=X Filename=[worm filename] Description=Added by the OPASERV WORM! Source=Paul Collins Startup list [Alexa] Number=456 Confirmed=N Filename=alexa.exe Description=Related to Alexa. Note - collects and stores information about the web pages you view, the data you enter in online forms and search programs and, with versions 5.0 and higher, the products you purchase online whilst using the toolbar. Although Alexa state's they do not attempt to analyze the data it may collect about you to determine who you are, some of your information collected by the software is personally identifiable. Please read the Privacy Policy. Not Recommended Source=Paul Collins Startup list [AlexaToolbar] Number=457 Confirmed=X Filename=alt.exe Description=Reported as the DELF.EB hijacker by Ewido Security Suite Source=Paul Collins Startup list [AlfaCleaner] Number=458 Confirmed=X Filename=AlfaCleaner.exe Description=AlphaCleaner is now a stealth install using exploits on unpatched systems. Seen alongside RazeSpyware Source=Paul Collins Startup list [AlfaClock Classic] Number=459 Confirmed=U Filename=AlfaClock.exe Description=AlfaClock from AlfaSoft Research Labs - "enhances your taskbar clock (tray clock) with fully customizable clock display, alarms, time synchronization and more" Source=Paul Collins Startup list [ALFY Accellerator] Number=460 Confirmed=? Filename=AlfyAC~1.exe Description=?? Source=Paul Collins Startup list [ALG.EXE] Number=461 Confirmed=X Filename=iexplorer .exe Description=Added by the DEMOTRY-B WORM! Source=Paul Collins Startup list [ALG32] Number=462 Confirmed=X Filename=ALG32.EXE Description=Added by the STARTPAGE.K hijacker Source=Paul Collins Startup list [ALGU] Number=463 Confirmed=X Filename=ALGU.EXE Description=Added by the CWS-I TROJAN! Source=Paul Collins Startup list [ALi5289] Number=464 Confirmed=U Filename=ALi5289.exe Description=Related to Uli Integrated Drivers from Uli Electronics Inc Source=Paul Collins Startup list [Alias SketchBook Snapshot] Number=465 Confirmed=N Filename=ALIASS~2.EXE Description=Screen-capture utility for Alias Sketchbook Source=Paul Collins Startup list [AlienAutopsy] Number=466 Confirmed=N Filename=Test_BS.exe Description=Alienware computer technical support software Source=Paul Collins Startup list [ALiSndMgr] Number=467 Confirmed=Y Filename=ALiSndMg.exe Description=ALi AC97 Sound driver Source=Paul Collins Startup list [AliUSBfix] Number=468 Confirmed=? Filename=GREENMK.exe Description=May be realted to a USB 2.0 PCI card - the IOgear GIC220OU? Source=Paul Collins Startup list [Alive SYstem] Number=469 Confirmed=X Filename=scchost.exe Description=Added by the TOFDROP-B TROJAN! Source=Paul Collins Startup list [Alive SYstem] Number=470 Confirmed=X Filename=scchostc.exe Description=Added by the TOFDROP-B TROJAN! Source=Paul Collins Startup list [alkasr] Number=471 Confirmed=X Filename=��.exe Description=Added by the BALKART TROJAN! Source=Paul Collins Startup list [All Aboard Status] Number=472 Confirmed=U Filename=stswin.exe Description=All Aboard! Internet Connection Sharing status icon Source=Paul Collins Startup list [All Sea screen saver] Number=473 Confirmed=X Filename=TaskTray.exe Description="Free screensaver", installs lots of foistware. See here. Get rid of it Source=Paul Collins Startup list [All Sea web link] Number=474 Confirmed=X Filename=FWLink.exe Description="Free screensaver", installs lots of foistware. See here. Get rid of it Source=Paul Collins Startup list [AllerCalc] Number=475 Confirmed=N Filename=AllerCalc.exe Description=AllerCalc is an expression calculator which allows you to directly enter an expression to be evaluated. Can be started manually Source=Paul Collins Startup list [Allopassw] Number=476 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.CU TROJAN! Source=Paul Collins Startup list [AllSeeingEye] Number=477 Confirmed=U Filename=ase.exe Description=All-Seeing_Eye security software - "monitors everything that takes place on your computer, and alerts the user as soon as anything suspicious or out-of-the-ordinary is happening, providing the user with alternatives for possible actions" Source=Paul Collins Startup list [allSnap] Number=478 Confirmed=U Filename=allSnap.exe Description="allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop" Source=Paul Collins Startup list [AllToTray] Number=479 Confirmed=U Filename=ALLTOTRAY.EXE Description=AlltoTray from DNTSoft - minimize any program to your System Tray Source=Paul Collins Startup list [Alogrithm Link Queue] Number=480 Confirmed=X Filename=alq.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Alogserv] Number=481 Confirmed=U Filename=Alogserv.exe Description=From McAfee VirusScan for logging scanning activities. In some cases, if left running it can cause CPU % usage to go between 5-95% or go to and stay at 100%. Disabling it impacts on the reported last scan date. It is reported to cause jerky graphics response in many games. As of version 6, this is a critical component of McAfee and disabling it can cause a PC to lock up Source=Paul Collins Startup list [ALPass] Number=482 Confirmed=U Filename=ALPass.exe Description=ALPass password manager Source=Paul Collins Startup list [Alps Electric USB Server] Number=483 Confirmed=Y Filename=Monserv.exe Description=Alps Electric USB Server - required according to this article Source=Paul Collins Startup list [AlpsPoint] Number=484 Confirmed=U Filename=Apoint.exe Description=Touchpad software for laptop PC's. For instance it is found on the Panasonic and Sony Vaio machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work Source=Paul Collins Startup list [ALServ] Number=485 Confirmed=? Filename=ALServ.exe Description=Altec Lansing AMS speaker related. What does it do and is it required? Source=Paul Collins Startup list [Altnet] Number=486 Confirmed=X Filename=points manager.exe Description=Altnet TopSearch adware Source=Paul Collins Startup list [AltnetPointsManager] Number=487 Confirmed=X Filename=points manager.exe Description=Altnet TopSearch adware Source=Paul Collins Startup list [AltoMB_service] Number=488 Confirmed=U Filename=AltoMBsrv.exe Description=Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [ALTOOLS] Number=489 Confirmed=U Filename=AccessL.exe Description=ALTools family of PC utilities Source=Paul Collins Startup list [AltPayments] Number=490 Confirmed=X Filename=AltPayments.exe Description=WeirdOnTheWeb adware Source=Paul Collins Startup list [ALU Scheduler Service] Number=491 Confirmed=N Filename=ALUSchedulerSvc.exe Description=Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security Source=Paul Collins Startup list [ALUAlert] Number=492 Confirmed=U Filename=ALUNotify.exe Description=Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis Source=Paul Collins Startup list [Aluria Security Center] Number=493 Confirmed=N Filename=SecurityCenter.exe Description=Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here Source=Paul Collins Startup list [Aluria's Pop-Up Stopper] Number=494 Confirmed=U Filename=eps.exe Description=Aluria Pop-Stopper Source=Paul Collins Startup list [Aluria's Spyware Eliminator] Number=495 Confirmed=N Filename=ASE.exe Description=Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here Source=Paul Collins Startup list [AlwaysOnTopMaker] Number=496 Confirmed=U Filename=AlwaysOnTopMaker.exe Description=Always On Top Maker - utilty to enable an application to always be displayed "on top" of others on the desktop Source=Paul Collins Startup list [AlwaysReady Power Message APP] Number=497 Confirmed=N Filename=ARPWRMSG.EXE Description=Related to HP and Compaq Desktop PCs. Read this article Source=Paul Collins Startup list [AmazingTens] Number=498 Confirmed=X Filename=AmazingTens.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [AMD PowerNow!] Number=499 Confirmed=U Filename=GemBack.exe Description=AMD PowerNow! - "an innovative solution available on all AMD mobile processor-based notebooks that can effectively increase notebook battery life, while delivering performance on demand" Source=Paul Collins Startup list [amd_dc_opt] Number=500 Confirmed=Y Filename=amd_dc_opt.exe Description=AMD Dual-Core Optimizer - "can help improve some PC gaming video performance by compensating for those applications that bypass the Windows API for timing by directly using the RDTSC (Read Time Stamp Counter) instruction" Source=Paul Collins Startup list [America Online *.* Tray Icon] Number=501 Confirmed=N Filename=aoltray.exe Description=Puts AOL icon in System Tray (*.* denotes version if present). Connect to AOL via the desktop shortcut or Start -> Programs Source=Paul Collins Startup list [AME_CSA] Number=502 Confirmed=N Filename=rundll32 amecsa.cpl, RUN_DLL Description=Loads ADSL modem Control Panel applet Source=Paul Collins Startup list [AModemLockDown] Number=503 Confirmed=U Filename=ModemLockDown.exe Description=ModemLockDown - allows you to supervise internet access by disabling the modem, protects againt dialers accessing dial-up connections, etc Source=Paul Collins Startup list [Amon] Number=504 Confirmed=Y Filename=AMON.EXE Description=Monitoring part of Eset's NOD32 virus-scanner Source=Paul Collins Startup list [Amonitor] Number=505 Confirmed=Y Filename=amon.exe Description=Tiny Personal Firewall Source=Paul Collins Startup list [AMP WinOFF] Number=506 Confirmed=U Filename=winoff.exe Description=WinOFF is " a utility designed to shut down Windows computers automatically, in a fully configurable way" Source=Paul Collins Startup list [AMSG] Number=507 Confirmed=U Filename=Amsg.exe Description=Part of the IBM ThinkVantage Productivity Center. "The Message Center sends automatic notification on ThinkVantage Technologies integrated with your system. Once you're online" Source=Paul Collins Startup list [AMSN] Number=508 Confirmed=N Filename=amsn.exe Description=aMSN Messenger is a multiplatform MSN messenger clone Source=Paul Collins Startup list [amsn] Number=509 Confirmed=X Filename=amsn.exe Description=Added by the BANKER-BNZ TROJAN! Source=Paul Collins Startup list [Anapod Manager] Number=510 Confirmed=N Filename=anamgr.exe Description=Anapod Explorer "is the most advanced Windows iPod software available, offering iPod management through full Windows Explorer integration under My Computer" Source=Paul Collins Startup list [anbv32] Number=511 Confirmed=X Filename=nabv32.exe Description=Added by the TITOG.C WORM! Source=Paul Collins Startup list [ANIWZCS2Service] Number=512 Confirmed=Y Filename=WZCSLDR2.exe Description=ALPHA Networks wireless driver Source=Paul Collins Startup list [ANIWZCSService] Number=513 Confirmed=? Filename=WZCSLDR.exe Description=D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity Source=Paul Collins Startup list [AnnotateCheck] Number=514 Confirmed=? Filename=AnnCheck.exe Description=Genius Wizard Pen Tablet driver related. Is it required? Source=Paul Collins Startup list [Announcements] Number=515 Confirmed=N Filename=Annclist.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Anntext] Number=516 Confirmed=N Filename=Anntext.exe Description=Caere Pagekeeper text annotation server Source=Paul Collins Startup list [Anonymizer Total Net Shield] Number=517 Confirmed=U Filename=AnonTns.exe Description=Anonymizer Total Net Shield - ID protection and privacy software Source=Paul Collins Startup list [ANONYMIZER_SPYWAREKILLER] Number=518 Confirmed=U Filename=SpyWareKiller.exe Description=Anonymizer Spyware Killer - now Anti-Spyware Source=Paul Collins Startup list [ANONYMIZER_SPYWAREKILLER] Number=519 Confirmed=U Filename=AnonAntiSpyware.exe Description=Anonymizer Spyware Killer - now Anti-Spyware Source=Paul Collins Startup list [Another Internet Explorer Popup Killer] Number=520 Confirmed=U Filename=aiepk2.exe Description=Another IE Popup Killer - pop-up stopper Source=Paul Collins Startup list [ansjava] Number=521 Confirmed=X Filename=[path to worm] Description=Added by the RANDON-AN WORM! Source=Paul Collins Startup list [Anskya] Number=522 Confirmed=X Filename=PYSKY.NET.exe Description=Added by the DLOADER-MW TROJAN! Source=Paul Collins Startup list [Answer Problem] Number=523 Confirmed=X Filename=dSAFsqs.exe Description=Added by the SDBOT-SC WORM! Source=Paul Collins Startup list [AnswerTool] Number=524 Confirmed=U Filename=AnswerTool.exe Description=AnswerTool - save your E-mail replies in AnswerTool, then reuse them again and again Source=Paul Collins Startup list [Anti Spam Service] Number=525 Confirmed=X Filename=spamsvc.exe Description=Added by the MYTOB-BK WORM! Source=Paul Collins Startup list [Anti-Blaxx Manager] Number=526 Confirmed=N Filename=Anti-Blaxx.exe Description=Anti-Blaxx - bypass blacklistings from different copy protections bypassing methods like virtual CD or DVD drives Source=Paul Collins Startup list [Anti-keylogger check] Number=527 Confirmed=U Filename=antikey.exe Description=Anti-keylogger - protects against keylogger programs monitoring your keystrokes Source=Paul Collins Startup list [Anti-Trojan-Watch] Number=528 Confirmed=U Filename=ATWatch.exe Description=Anti-Trojan Watch - trojan detector Source=Paul Collins Startup list [Anti-Virus] Number=529 Confirmed=X Filename=vpms.exe Description=Added by the SDBOT.GV WORM! Source=Paul Collins Startup list [Anti-Virus] Number=530 Confirmed=X Filename=[random filename].exe Description=Added by the CAPROBAD-A TROJAN! Source=Paul Collins Startup list [Anti-Virus Product Sync] Number=531 Confirmed=X Filename=[unprintable character][3 characters]log.exe Description=Added by the KEDEBE.D WORM! Source=Paul Collins Startup list [Anti-Virus Update Scheduler] Number=532 Confirmed=X Filename=[path to trojan] Description=Added by the SPAMMIT-A TROJAN! Source=Paul Collins Startup list [Anti-Virus Update Scheduler] Number=533 Confirmed=X Filename=winsp3.exe Description=Malware - recognized by Kaspersky antivirus as TrojanProxy.Agent.fp - A Proxy Trojan is a backdoor which allows a remote hacker to connect to other systems via the compromised system Source=Paul Collins Startup list [Anti-Virus Update Scheduler V1.39.12R] Number=534 Confirmed=X Filename=[path to trojan] Description=Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe, kaspersky.exe, nrton.exe, wins.exe, gah32.exe, 1.tmp, syste.exe, alg.exe, socks.exe, winxpsp2.exe, tek9.exe, sks.exe, hihi.exe, s.exe, xps2.exe, dns2.exe, ikav32.exe and more... Source=Paul Collins Startup list [AntiClicker] Number=535 Confirmed=X Filename=SVCHST32.EXE Description=Added by the CBH TROJAN! Source=Paul Collins Startup list [antidialer.co.uk] Number=536 Confirmed=U Filename=Dialer_Watcher.exe Description=Dialer_Watcher is an application that allows you to detect dialers on your computer Source=Paul Collins Startup list [AntiPopUp] Number=537 Confirmed=U Filename=AntiPopUp.exe Description=AntiPopUp for IE - pop-up stopper Source=Paul Collins Startup list [AntiVerminser] Number=538 Confirmed=N Filename=AntiVerminser.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Antivir] Number=539 Confirmed=X Filename=svchst.exe Description=Added by the RAGRUK-A TROJAN! Source=Paul Collins Startup list [AntiVir] Number=540 Confirmed=X Filename=scvhost.exe Description=Added by the AGENT-DSF TROJAN! Source=Paul Collins Startup list [AntiVir] Number=541 Confirmed=X Filename=winlog.exe Description=Added by the IRCBOT-TJ TROJAN! Source=Paul Collins Startup list [AntiVir XP] Number=542 Confirmed=Y Filename=AVwin.exe Description=AntiVir� PersonalEdition Classic - antivirus Source=Paul Collins Startup list [Antivirus] Number=543 Confirmed=X Filename=av.exe Description=Added by the SINKIN TROJAN! Resets IE start page to realphx.com Source=Paul Collins Startup list [Antivirus] Number=544 Confirmed=X Filename=maja.exe Description=Added by the NETSKY.H WORM! Source=Paul Collins Startup list [Antivirus] Number=545 Confirmed=X Filename=iexpl0res.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [AntiVirus] Number=546 Confirmed=X Filename=kaspery.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Antivirus Installer] Number=547 Confirmed=X Filename=[path to trojan] Description=Added by the BADGENT-A TROJAN! Source=Paul Collins Startup list [Antivirus-Golden] Number=548 Confirmed=N Filename=Antivirus-Golden.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [antivirus32] Number=549 Confirmed=X Filename=antivirus.exe Description=Added by the SPYBOT.KAI WORM! Source=Paul Collins Startup list [AntivirusGold] Number=550 Confirmed=X Filename=AntivirusGold.exe Description=AntivirusGold malware Source=Paul Collins Startup list [AntiVirusProtection] Number=551 Confirmed=? Filename=qumk.exe Description=?? Source=Paul Collins Startup list [antiware] Number=552 Confirmed=X Filename=elite***32.exe [*** = random char] Description=Added by the DLOADER-HW TROJAN! Source=Paul Collins Startup list [AntiWindowsMessenger] Number=553 Confirmed=U Filename=AntiMsMsg.exe Description=Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory Source=Paul Collins Startup list [anti_troj] Number=554 Confirmed=X Filename=anti_troj.exe Description=Added by the LODEAR.D TROJAN! Source=Paul Collins Startup list [AnVir] Number=555 Confirmed=Y Filename=AnVir.exe Description=AnVir Task Manager - protects computer against viruses and manages running processes and startup files Source=Paul Collins Startup list [AnVir Task Manager] Number=556 Confirmed=Y Filename=AnVir.exe Description=AnVir Task Manager - protects computer against viruses and manages running processes and startup files Source=Paul Collins Startup list [anvshell] Number=557 Confirmed=U Filename=anvshell.exe Description=System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar Source=Paul Collins Startup list [Any To-Do List] Number=558 Confirmed=U Filename=anytodo.exe Description=Any To-Do List "the ultimate software solution to keep yourself organized and reminded" Source=Paul Collins Startup list [anycom bluetooth] Number=559 Confirmed=? Filename=ftflauncher.exe Description=Associated with an Anycom bluetooth wireless card. What does it do and is it required? Source=Paul Collins Startup list [AnyDVD] Number=560 Confirmed=U Filename=AnyDVD.exe Description=AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts - hence the "U" recommendation Source=Paul Collins Startup list [AO Tray] Number=561 Confirmed=N Filename=AOTray.Exe Description=System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [aol] Number=562 Confirmed=Y Filename=avp.exe Description=AOL's Active Virus Shield Source=Paul Collins Startup list [AOL 9.0 Optimized] Number=563 Confirmed=X Filename=AOLClient.exe Description=Added by the SPYBOTER.A TROJAN! Source=Paul Collins Startup list [AOL Broadband Check-Up] Number=564 Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". The AOL Self Support Tool is required to run with the Help and Support program. If you uncheck AOL and and then run Help and Support it will add another AOL entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [AOL Companion] Number=565 Confirmed=N Filename=companion.exe Description=Part of the AOL Connection Suite and installs an icon on the system tray offering easy access to AOL's additional utilities and functions. This program is a non-essential process, and is installed for ease of use Source=Paul Collins Startup list [Aol Configuration Loader] Number=566 Confirmed=X Filename=aimsng.exe Description=Added by the SDBOT-XE WORM! Source=Paul Collins Startup list [AOL Fast Start] Number=567 Confirmed=? Filename=AOL.exe Description=AOL ISP software related. What does it do and is it required? Source=Paul Collins Startup list [AOL Instant Messanger] Number=568 Confirmed=X Filename=aim.exe Description=Added by the SDBOT-YT WORM! Source=Paul Collins Startup list [AOL Instant Messengar] Number=569 Confirmed=X Filename=aol.exe Description=Added by the AGOBOT-FN WORM! Source=Paul Collins Startup list [AOL Instant Messenger] Number=570 Confirmed=? Filename=AlM.EXE Description=That is an L between the A and M, the start up location is wrong for AIM. What does this relate to? Source=Paul Collins Startup list [Aol Instant Messenger] Number=571 Confirmed=X Filename=aolmsg.exe Description=Added by the KELVIR.AL WORM! Source=Paul Collins Startup list [AOL Instant Messenger 7.213] Number=572 Confirmed=X Filename=aim9283.exe Description=Added by the SDBOT-ZF WORM! Source=Paul Collins Startup list [Aol Instant Messenger Fix] Number=573 Confirmed=X Filename=aolfix.exe Description=Added by the SDBOT-ABJ WORM! Source=Paul Collins Startup list [AOL Messenger] Number=574 Confirmed=X Filename=[random filename] Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [AOL Messenger] Number=575 Confirmed=X Filename=aolmsngr.exe Description=Added by the SDBOT-JF WORM! Source=Paul Collins Startup list [AOL Messenger Optimized] Number=576 Confirmed=X Filename=AOLOpt.exe Description=Added by the AOLOPT TROJAN! Source=Paul Collins Startup list [AOL Services Hosts] Number=577 Confirmed=X Filename=aolserviceshosts.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [AOL Spyware Protection] Number=578 Confirmed=U Filename=AOLSP Scheduler.exe Description=AOL's spyware protection program Source=Paul Collins Startup list [AOL TopSpeedMonitor] Number=579 Confirmed=U Filename=aoltsmon.exe Description=AOL's TopSpeed web acceleration technology supposedly helps to make web browsing faster. Most important for those users who still access AOL via dial-up Source=Paul Collins Startup list [AolAcsDaemon1] Number=580 Confirmed=Y Filename=Acsd.exe Description=AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually Source=Paul Collins Startup list [AolAcsDaemon1] Number=581 Confirmed=Y Filename=AOLACSD.EXE Description=AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually Source=Paul Collins Startup list [AOLCC] Number=582 Confirmed=? Filename=ACCAgnt.exe Description=AOL ISP software related, file located in a "AOL Computer Check-Up" folder. What does it do and is it required? Source=Paul Collins Startup list [AolCon] Number=583 Confirmed=X Filename=config.com Description=Added by the TAPLAK WORM! Source=Paul Collins Startup list [AOLDialer] Number=584 Confirmed=N Filename=AOLDial.exe Description=AOL ISP software dialer - can be activated through a desktop shortcut Source=Paul Collins Startup list [AolFix] Number=585 Confirmed=N Filename=AolFix.exe Description=Run on Gateway Astra computers, and maybe a few others. Designed to repair a bad registry key in Gateway computers that would not allow AOL to run correctly. Not seen much any more and should only run once Source=Paul Collins Startup list [AOLRegKey32] Number=586 Confirmed=X Filename=AOREGSVR512.EXE Description=Unidentified malware - see here Source=Paul Collins Startup list [AOLStart] Number=587 Confirmed=X Filename=AOLStart.exe Description=Added by the KRAIMER.12 TROJAN! Source=Paul Collins Startup list [Aornum] Number=588 Confirmed=X Filename=aornum.exe Description=Installed along with iWon Prize Machine. Based upon their privacy statement this can be regarded as spyware Source=Paul Collins Startup list [AOTray] Number=589 Confirmed=N Filename=AOTray.Exe Description=System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [APC UPS Status] Number=590 Confirmed=Y Filename=Display.exe Description=APC PowerChute Personal Edition status icon Source=Paul Collins Startup list [APC_SERVICE] Number=591 Confirmed=U Filename=mainserv.exe Description=PowerChute� Personal Edition - "safe system shutdown software with sophisticated power management functions" Source=Paul Collins Startup list [apc_tray] Number=592 Confirmed=Y Filename=apc_tray.exe Description=Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure Source=Paul Collins Startup list [APD123] Number=593 Confirmed=X Filename=APD123.exe Description=PacerD Media/Pacimedia.com adware Source=Paul Collins Startup list [Api**.exe [* = random char]] Number=594 Confirmed=X Filename=Api**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Api**32.exe [* = random char]] Number=595 Confirmed=X Filename=Api**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [API32] Number=596 Confirmed=X Filename=api32.exe Description=Added by the IRCBOT-B TROJAN! Source=Paul Collins Startup list [APIClass] Number=597 Confirmed=X Filename=lexplore_.exe Description=Added by the MSNOPT-A TROJAN! Source=Paul Collins Startup list [APIMon] Number=598 Confirmed=X Filename=apimonx.exe Description=Added by the TIBSER.A downloader TROJAN! Source=Paul Collins Startup list [APIMon] Number=599 Confirmed=X Filename=winapix.exe Description=Added by a variant of the TIBSER.A downloader TROJAN! Source=Paul Collins Startup list [APIMon] Number=600 Confirmed=X Filename=msreg.exe Description=Added by the DROPPER.Z TROJAN! Source=Paul Collins Startup list [apisvc.exe] Number=601 Confirmed=X Filename=apisvc.exe Description=Added by a variant of the LAMEBOT TROJAN! Source=Paul Collins Startup list [APL] Number=602 Confirmed=U Filename=APL.exe Description=Sage Software's ACT! The application pre-loader (apl.exe) is a self contained executable that pre-loads the necessary .NET framework and ACT! 2005 assemblies. This pre-loading of assemblies enhances ACT! startup, view load and dialog load times in some areas of the application Source=Paul Collins Startup list [Apmsrv9x] Number=603 Confirmed=? Filename=APMSRV9X.EXE Description=Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required? Source=Paul Collins Startup list [Apoint] Number=604 Confirmed=U Filename=Apoint.exe Description=Touchpad software for laptop PC's. For instance it is found on the Panasonic and Sony Vaio machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work Source=Paul Collins Startup list [App**32.exe [* = random char]] Number=605 Confirmed=X Filename=App**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [App.EXEName] Number=606 Confirmed=X Filename=[path to worm]\.exe Description=Added by the BODIRU WORM! Source=Paul Collins Startup list [Appcon] Number=607 Confirmed=U Filename=vAppCon.exe Description=Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established Source=Paul Collins Startup list [appconn] Number=608 Confirmed=X Filename=appconn.exe Description=Added by the CARGAO WORM! Source=Paul Collins Startup list [AppExtender] Number=609 Confirmed=U Filename=AppExtCB.exe Description=Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received Source=Paul Collins Startup list [appis.exe] Number=610 Confirmed=X Filename=appis.exe Description=Added by the AGENT-BC TROJAN! Source=Paul Collins Startup list [Application] Number=611 Confirmed=Y Filename=mdmsetsp.exe Description=Aztech Labs modem driver Source=Paul Collins Startup list [Application Explorer] Number=612 Confirmed=U Filename=Naldesk.exe Description=Novell Zenworks Application Explorer Executable. "For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components." Source=Paul Collins Startup list [Application Explorer] Number=613 Confirmed=U Filename=NalView.exe Description=Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications Source=Paul Collins Startup list [Application Layer Gateway Service] Number=614 Confirmed=X Filename=algs.exe Description=Added by the LINKBOT.M WORM! Source=Paul Collins Startup list [ApplicationProtocolRun] Number=615 Confirmed=X Filename=smsbvl32.exe Description=Added by the IRCBOT-CX TROJAN! Source=Paul Collins Startup list [AppPlus] Number=616 Confirmed=U Filename=AppPlus.exe Description=AppPlus - "menu bar or tray launcher that docks to your desktop, floats or sits in your System Tray. Create graphic/text-based buttons that launch any number of programs, Websites, e-mail addresses or folders (which open in the AppPlus Menu System)" Source=Paul Collins Startup list [Apvxd] Number=617 Confirmed=Y Filename=APVXDWIN.EXE Description=Part of Panda Antivirus . Required to enable permanent virus protection Source=Paul Collins Startup list [Apvxdwin] Number=618 Confirmed=Y Filename=APVXDWIN.EXE Description=Part of Panda Antivirus . Required to enable permanent virus protection Source=Paul Collins Startup list [Apwheel] Number=619 Confirmed=Y Filename=Apwheel.exe Description=Wheel support for an Alps mouse Source=Paul Collins Startup list [apyginapygin] Number=620 Confirmed=X Filename=simenu.exe Description=Added by the SDBOT.BTR WORM! Source=Paul Collins Startup list [AQ3HelperStartUp] Number=621 Confirmed=U Filename=AQ3HEL~1.EXE Description=ScreenScenes "Aquatica Water Worlds" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [aqadcup.exe] Number=622 Confirmed=X Filename=aqadcup.exe Description=Added by the AGENT.BG WORM! Source=Paul Collins Startup list [Aqujyjax] Number=623 Confirmed=X Filename=[path to file] Description=Added by the RANCK-CQ TROJAN! Source=Paul Collins Startup list [Aqujyjax] Number=624 Confirmed=X Filename=aqujyjax.exe Description=Added by the SDBOT-YC WORM! Source=Paul Collins Startup list [ara-key] Number=625 Confirmed=X Filename=[random filename] Description=Added by the ANTINNY WORM! Source=Paul Collins Startup list [arcaderockstar] Number=626 Confirmed=X Filename=arcaderockstar32.exe Description=Arcade Rockstar (now Gamevance) - free arcade games and prize tournaments. The program itself is clean, but the TOS and privacy statement say that you agree to allow the program to track/report your surfing and put popup advertising on your computer Source=Paul Collins Startup list [Archive] Number=627 Confirmed=X Filename=archive.exe Description=Adware - recognized by Kaspersky antivirus as Trojan-Downloader.Centim.a Source=Paul Collins Startup list [ARCHIVE CONTROL] Number=628 Confirmed=X Filename=fixupdattr.exe Description=Added by the MYTOB.GU WORM! Source=Paul Collins Startup list [ARCSolo Recovery] Number=629 Confirmed=N Filename=N/A Description=Backup software by Computer Associates - no longer supported Source=Paul Collins Startup list [Ardamax Keylogger] Number=630 Confirmed=U Filename=akl.exe Description=Ardakey B keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [ares] Number=631 Confirmed=N Filename=ares.exe Description="Ares is a free open source file sharing program that enables users to share any digital file including images, audio, video, software, documents, etc" Source=Paul Collins Startup list [areslite] Number=632 Confirmed=N Filename=AresLite.exe Description="Ares is a free open source file sharing program that enables users to share any digital file including images, audio, video, software, documents, etc" Source=Paul Collins Startup list [Argentum Backup] Number=633 Confirmed=U Filename=ab.exe Description=Argentum Backup - a small backup program that lets you easily back up your documents and folders Source=Paul Collins Startup list [Aritima] Number=634 Confirmed=X Filename=aritima.exe Description=Added by the ARITIM WORM! Source=Paul Collins Startup list [ARMOR2NET] Number=635 Confirmed=N Filename=Armor2net.exe Description=Related to Armor2net personal firewall (possibly contains or is related to an anti-spyware product known as ArmorWall, which is a spyware remover - not recommended, see here Source=Paul Collins Startup list [ARPWRMSG] Number=636 Confirmed=N Filename=ARPWRMSG.EXE Description=Related to HP and Compaq Desktop PCs. Read this article Source=Paul Collins Startup list [Artera] Number=637 Confirmed=U Filename=arteraui.exe Description=Artera Turbo Internet Accelerator - "surf faster, boost download speed". Only required if you find it helps improve your performance Source=Paul Collins Startup list [AS00 Gear511] Number=638 Confirmed=? Filename=Gear511.exe Description=Software for Netgear wireless network cards. Unknown whether it is required for the wireless card to run but does not seem to be a resource hog. Not required for laptop to run if the wireless network card will not be used. Is it at all required? Source=Paul Collins Startup list [AS00_WN511B] Number=639 Confirmed=U Filename=WN511B.exe Description=Netgear RangeMax NEXT wireless adapter configuration utility Source=Paul Collins Startup list [AS00_WPN511] Number=640 Confirmed=? Filename=WPN511.exe Description=NetgearRev MFC Application - software for Netgear wireless network cards - what does it do and is it required in startup? Source=Paul Collins Startup list [ASDPLUGIN] Number=641 Confirmed=X Filename=dsldbaccess.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=642 Confirmed=X Filename=canada.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=643 Confirmed=X Filename=france.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=644 Confirmed=X Filename=fullgames.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=645 Confirmed=X Filename=100171be.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=646 Confirmed=X Filename=100176br.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=647 Confirmed=X Filename=adult1.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=648 Confirmed=X Filename=Austria.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=649 Confirmed=X Filename=belgium nm.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=650 Confirmed=X Filename=czech.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=651 Confirmed=X Filename=dbaccess.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=652 Confirmed=X Filename=dslgeaccess.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=653 Confirmed=X Filename=Finland.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=654 Confirmed=X Filename=geaccess.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=655 Confirmed=X Filename=mexico.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=656 Confirmed=X Filename=netherlands.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=657 Confirmed=X Filename=turkey.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=658 Confirmed=X Filename=uk nm.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=659 Confirmed=X Filename=Xadult1.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [ASDPLUGIN] Number=660 Confirmed=X Filename=temp532.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [asdx] Number=661 Confirmed=X Filename=xwinrpc32.exe Description=Added by the AGOBOT.VO WORM! Source=Paul Collins Startup list [ASE Scheduler] Number=662 Confirmed=N Filename=ASE Scheduler.exe Description=Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here Source=Paul Collins Startup list [Ashampoo PopUpBlocker] Number=663 Confirmed=U Filename=PopUpKiller.exe Description=Ashampoo popup blocker, part of Magical Security (was Privacy Protector Plus) Source=Paul Collins Startup list [ashAvast] Number=664 Confirmed=Y Filename=ashAvast.exe Description=Part of Avast antivirus Source=Paul Collins Startup list [ASHLT] Number=665 Confirmed=X Filename=Ashlt.exe Description=Ashlt adware Source=Paul Collins Startup list [ashMaiSv] Number=666 Confirmed=Y Filename=ashmaisv.exe Description=Part of Avast! anti-virus software - E-mail scanner Source=Paul Collins Startup list [AsioReg] Number=667 Confirmed=U Filename=regsvr32.exe ctasio.dll Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [ASK] Number=668 Confirmed=U Filename=rundll32.exe [path] ASK.dll rdl Description=Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [asl] Number=669 Confirmed=X Filename=Aslru.exe Description=Added by the BANCOS-CU TROJAN! Source=Paul Collins Startup list [Asmw Soft Popups Burner] Number=670 Confirmed=U Filename=popups burner.exe Description=Popup blocker, part of Asmw Soft PC Optimizer Source=Paul Collins Startup list [asnconsole] Number=671 Confirmed=X Filename=msasn.exe Description=Added by the RBOT.EVU TROJAN! Source=Paul Collins Startup list [ASocksrv] Number=672 Confirmed=X Filename=SocksA.exe Description=Added by the VB.CBW WORM! Source=Paul Collins Startup list [ASP.NET State Service] Number=673 Confirmed=X Filename=csrss.exe Description=Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [ASP.NET State Service] Number=674 Confirmed=X Filename=crsass.exe Description=Added by the BANLOAD-M TROJAN! Source=Paul Collins Startup list [ASP.NET State Service] Number=675 Confirmed=X Filename=servicos..exe Description=Added by the DADOBRA-I TROJAN! Source=Paul Collins Startup list [asp4tray] Number=676 Confirmed=N Filename=asp4tray.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [AspireTimeMachine] Number=677 Confirmed=Y Filename=acertmb.exe Description=System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP, allowing you to restore a PC back to a working state with minimal re-entry Source=Paul Collins Startup list [asrupdate.exe] Number=678 Confirmed=X Filename=asrupdate.exe Description=Added by the VB.ATZ TROJAN! Source=Paul Collins Startup list [assistse] Number=679 Confirmed=X Filename=ASSISTSE.EXE Description=CnsMin (Chinese Keywords) hijacker related Source=Paul Collins Startup list [AST] Number=680 Confirmed=X Filename=AST Description=Added by the TROJANDOWNLOADER.WIN32.VB.AH VIRUS! Source=Paul Collins Startup list [AST] Number=681 Confirmed=X Filename=AST Description=Added by the VB.AH TROJAN! Source=Paul Collins Startup list [AST] Number=682 Confirmed=X Filename=AST.exe Description=AutoStarter parasite Source=Paul Collins Startup list [ASTART] Number=683 Confirmed=U Filename=astart.exe Description=ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings Source=Paul Collins Startup list [AStart] Number=684 Confirmed=X Filename=AStart Description=Added by the VB.AH TROJAN! Source=Paul Collins Startup list [asTray] Number=685 Confirmed=N Filename=Astray.exe Description=Voyetra Audio Station - part of Voyetra's Ultimate MP3 & CD Manager. MP3 and digital music jukebox/organizer Source=Paul Collins Startup list [Astro] Number=686 Confirmed=N Filename=Astro.exe Description=Checks for updates to Quicken on a system reboot Source=Paul Collins Startup list [ASUS Live Update] Number=687 Confirmed=N Filename=ALU.exe Description=ASUS Live Update utility for their motherboards Source=Paul Collins Startup list [ASUS Probe] Number=688 Confirmed=N Filename=AsusProb.exe Description=ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area Source=Paul Collins Startup list [ASUS SmartDoctor] Number=689 Confirmed=U Filename=VGAProbe.exe Description=ASUS video card fan/thermal monitor Source=Paul Collins Startup list [ASUS TweakEnable] Number=690 Confirmed=U Filename=astart.exe Description=Restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings Source=Paul Collins Startup list [ASUSKey] Number=691 Confirmed=N Filename=V38SHELL.EXE Description=System tray Icon for quickly changing video modes Source=Paul Collins Startup list [asustweakenable] Number=692 Confirmed=U Filename=ATweak.exe Description=Asus tweaking utility - for fine tuning the settings of your ASUS display card Source=Paul Collins Startup list [ASWDP] Number=693 Confirmed=N Filename=ASWDP.exe Description=MLS Pulse - real estate software. Keeps the home buyer/seller continually informed on the status of his/her local/regional real estate market Source=Paul Collins Startup list [ASWnk] Number=694 Confirmed=X Filename=aswnk.exe Description=Adult content dialler Source=Paul Collins Startup list [AT-Watch] Number=695 Confirmed=U Filename=ATWatch.exe Description=Anti-Trojan Watch - trojan detector Source=Paul Collins Startup list [atapidrv] Number=696 Confirmed=X Filename=atapidrv.exe Description=Added by the AGOBOT-SL WORM! Source=Paul Collins Startup list [Athan] Number=697 Confirmed=U Filename=Athan.exe Description=Athan - an application that calculates and reminds the five daily Islamic prayer times for anywhere in the world Source=Paul Collins Startup list [ATI Active Graphics Card Monitor] Number=698 Confirmed=X Filename=atievx.exe Description=Added by the IRCBOT-TL WORM! Source=Paul Collins Startup list [ATI AS Filter] Number=699 Confirmed=X Filename=msnse.exe Description=Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines, preventing access to the virus cleaning websites Source=Paul Collins Startup list [ATI CATALYST System Tray] Number=700 Confirmed=N Filename=CLI.exe SystemTray Description=System Tray access to ATI's CATALYST� CONTROL CENTER. Note that this has "SystemTray" appended to CLI.exe in the "Command" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop Source=Paul Collins Startup list [ATI DeviceDetect] Number=701 Confirmed=N Filename=ATIDtct.EXE Description=Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled Source=Paul Collins Startup list [ATI Display Driver] Number=702 Confirmed=X Filename=atixd.exe Description=Added by the RBOT-FOV WORM! Source=Paul Collins Startup list [Ati Display Settings] Number=703 Confirmed=X Filename=atividx.exe Description=Added by the RBOT-GAS WORM! Source=Paul Collins Startup list [ATI GART Set-up Utility] Number=704 Confirmed=N Filename=Atigart.exe Description=Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one, once installed it shouldn't be needed Source=Paul Collins Startup list [ATI Launchpad] Number=705 Confirmed=U Filename=launchpd.exe Description=Convenient way to start all your Multimedia Center applications (DVD, Video CD, CD Audio, File Player). You can right-click LaunchPad, and uncheck Load on Startup in the menu Source=Paul Collins Startup list [ATI Rage3d Pro] Number=706 Confirmed=X Filename=AtiRage4dPro.exe Description=Added by the AGOBOT-OG WORM! Source=Paul Collins Startup list [ATI Remote Control] Number=707 Confirmed=Y Filename=ATIRW.exe Description=Driver for the ATI REMOTE WONDER� RF remote control for ATI's All-In-Wonder graphic cards and other products. Required if you use it Source=Paul Collins Startup list [ATI Remote Control] Number=708 Confirmed=Y Filename=ATIX10.exe Description=ATI Remote Wonder� - PC wireless remote control driver. Required if you use it Source=Paul Collins Startup list [ATI Scheduler] Number=709 Confirmed=N Filename=Atisched.exe Description=Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see Source=Paul Collins Startup list [ATI Task Application] Number=710 Confirmed=N Filename=Atitkad.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [ATI Task Application (Atikey)] Number=711 Confirmed=N Filename=Atitask.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [ATI Technology Startup] Number=712 Confirmed=X Filename=techstart.exe Description=Added by the RBOT-AEU WORM! Source=Paul Collins Startup list [ATI Video Driver Control] Number=713 Confirmed=X Filename=atigfx.exe Description=Added by the RBOT-FWL WORM! Source=Paul Collins Startup list [ATI VIDEO REGKEY] Number=714 Confirmed=X Filename=ati2vid.exe Description=Added by the SDBOT.UR WORM! Source=Paul Collins Startup list [Ati2cwxx] Number=715 Confirmed=? Filename=Ati2cwxx.exe Description=For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it Source=Paul Collins Startup list [Ati2mdxx] Number=716 Confirmed=U Filename=Ati2mdxx.exe Description=System Tray icon to access ATI graphics card settings and the Hydravision Desktop Manager Source=Paul Collins Startup list [ATICCC] Number=717 Confirmed=N Filename=cli.exe runtime Description=ATI's CATALYST� CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has "runtime" appended to cli.exe in the "Command" column of MSCONFIG. Recommend that start the program manually via Start -> Programs -> ATI Catalyst Control Center -> Advanced -> Restart Runtime as it can casue problems when starting Windows Source=Paul Collins Startup list [ATICCC] Number=718 Confirmed=N Filename=CLIStart.exe Description=Puts the ATI Catalyst� Control Center Icon/Shortcut on the System Tray - available via Start -> Programs Source=Paul Collins Startup list [aticpaxx.exe] Number=719 Confirmed=X Filename=aticpaxx.exe Description=Added by the RBOT-XP WORM! Source=Paul Collins Startup list [AtiCwd] Number=720 Confirmed=U Filename=AtiCwd.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiCwd] Number=721 Confirmed=U Filename=AtiCwd32.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiCwd] Number=722 Confirmed=U Filename=Ati2cwad.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiCwd32] Number=723 Confirmed=U Filename=AtiCwd.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiCwd32] Number=724 Confirmed=U Filename=AtiCwd32.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiCwd32] Number=725 Confirmed=U Filename=Ati2cwad.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiDisplayDrv] Number=726 Confirmed=X Filename=atidrvxx.exe Description=Added by the RBOT-VZ WORM! Source=Paul Collins Startup list [atidriver] Number=727 Confirmed=X Filename=reaIplayer.exe Description=Added by the WARPIGS-E WORM! Note the uppercase "I" in the filename, rather than a lower case "L" Source=Paul Collins Startup list [AtiKey] Number=728 Confirmed=N Filename=AtiKey32.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [AtiKey] Number=729 Confirmed=? Filename=atiptkad.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [Atikey] Number=730 Confirmed=N Filename=Atitask.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [ATIMACE] Number=731 Confirmed=U Filename=MACE.exe Description=ATI Technologies Control Centre - installed alongside ATI graphics hardware and provides additional configuration options for these devices in the Managed Access to Catalyst Environment (MACE) component Source=Paul Collins Startup list [ATIModeChange] Number=732 Confirmed=U Filename=Ati2mdxx.exe Description=System Tray icon to access ATI graphics card settings and the Hydravision Desktop Manager Source=Paul Collins Startup list [AtiPanel] Number=733 Confirmed=X Filename=atip.exe Description=Added by the TACTSLAY.U TROJAN! Source=Paul Collins Startup list [atipatxx] Number=734 Confirmed=X Filename=atipatxx.exe Description=Added by the SMALL-ED TROJAN! Source=Paul Collins Startup list [ATIPOLAB] Number=735 Confirmed=U Filename=ati2evxx.exe Description=ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers, but it can help with graphics card problems. Leave enabled unless it consumes too many CPU resources Source=Paul Collins Startup list [ATIPOLAB] Number=736 Confirmed=U Filename=ati2evae.exe Description=ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks Source=Paul Collins Startup list [ATIPOLL] Number=737 Confirmed=U Filename=ati2evxx.exe Description=ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers, but it can help with graphics card problems. Leave enabled unless it consumes too many CPU resources Source=Paul Collins Startup list [AtiPTA] Number=738 Confirmed=U Filename=Ati2ptxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [AtiPTA] Number=739 Confirmed=U Filename=Atiptaxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [AtiPTAAA] Number=740 Confirmed=U Filename=Ati2ptxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [AtiPTAAA] Number=741 Confirmed=U Filename=Atiptaxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [atiptaxx] Number=742 Confirmed=U Filename=Ati2ptxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [atiptaxx] Number=743 Confirmed=U Filename=Atiptaxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [atiptext] Number=744 Confirmed=X Filename=atiptext.exe Description=Added by the COSIAM-A TROJAN! Source=Paul Collins Startup list [AtiQiPcl] Number=745 Confirmed=U Filename=AtiQiPcl.exe Description=Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's Source=Paul Collins Startup list [ATISmart] Number=746 Confirmed=U Filename=ati2s9ag.exe Description=ATI's "SMARTGART", which is included with the "Catalyst" drivers. When the system boots, it runs a couple of bus tests & tries to apply the most stable settings Source=Paul Collins Startup list [AtiSound] Number=747 Confirmed=U Filename=csrss.exe Description=WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "ComRoot" subfolder Source=Paul Collins Startup list [atisrc2] Number=748 Confirmed=X Filename=windfind.exe Description=Added by the WINDFIND-A TROJAN! Source=Paul Collins Startup list [ATITech] Number=749 Confirmed=X Filename=Active.exe Description=Added by the ROAMER-A TROJAN! Source=Paul Collins Startup list [atitray] Number=750 Confirmed=U Filename=atitray.exe Description=ATI Tray Tools - allows quick access to ATI graphics card settings Source=Paul Collins Startup list [AtiTrayTools] Number=751 Confirmed=U Filename=atitray.exe Description=ATI Tray Tools - allows quick access to ATI graphics card settings Source=Paul Collins Startup list [atiupdate] Number=752 Confirmed=X Filename=ATIUPDATE5.EXE Description=Added by the DEBESKI.A TROJAN! Source=Paul Collins Startup list [atiupdate] Number=753 Confirmed=X Filename=msshed32.exe Description=Added by the DELF.EP downloader TROJAN! Source=Paul Collins Startup list [ATIUpdater] Number=754 Confirmed=X Filename=atiupdxx.exe Description=Added by the RBOT-ABX WORM! Source=Paul Collins Startup list [Atiupdpl] Number=755 Confirmed=X Filename=atiupdpl.exe Description=Added by the SMALL.AOS TROJAN! Source=Paul Collins Startup list [ativopen] Number=756 Confirmed=X Filename=ativopen.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [ATIX10] Number=757 Confirmed=Y Filename=atix10.exe Description=ATI Remote Wonder� - PC wireless remote control driver. Required if you use it Source=Paul Collins Startup list [Atl**.exe [* = random char]] Number=758 Confirmed=X Filename=Atl**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Atl**32.exe [* = random char]] Number=759 Confirmed=X Filename=Atl**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [ATM Control] Number=760 Confirmed=X Filename=adpn.exe Description=Added by the MMS.A WORM! Source=Paul Collins Startup list [ATnotes] Number=761 Confirmed=N Filename=atnotes.exe Description=Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs Source=Paul Collins Startup list [Atomic Time Synchronizer] Number=762 Confirmed=U Filename=TimeSync.exe Description=TimeSync - lets you synchronize your computer's clock with any internet atomic clock Source=Paul Collins Startup list [Atomic-x27] Number=763 Confirmed=X Filename=Atomic-x27.exe Description=Added by the KATOMIK-A WORM! Source=Paul Collins Startup list [Atomic-x27C] Number=764 Confirmed=X Filename=AtomicpartC.exe Description=Added by the KATOMIK-A WORM! Source=Paul Collins Startup list [Atomic.exe] Number=765 Confirmed=U Filename=Atomic.exe Description=Atomic Clock Sync - synchronizes your computer's time with the NIST time server Source=Paul Collins Startup list [Atomica] Number=766 Confirmed=N Filename=atomica.exe Description=Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key Source=Paul Collins Startup list [AtomicTime] Number=767 Confirmed=U Filename=ATOMICTIME.EXE Description=AtomicTime - utility that synchronizes your PC clock to an atomic clock Source=Paul Collins Startup list [Atrack] Number=768 Confirmed=U Filename=atrack.exe Description=New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker, an instant notification feature. The Alert Tracker displays information about events as they happen. This way, when a rule has been triggered or an access to the Internet made, you know about it immediately rather than finding out about it when you check your logs or notice that the NIS icon indicates a security alert Source=Paul Collins Startup list [Atray] Number=769 Confirmed=U Filename=Atray.exe Description=Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons Source=Paul Collins Startup list [ATSpooler] Number=770 Confirmed=U Filename=AppsTraka.exe Description=DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [ATTBroadbandUpdate] Number=771 Confirmed=U Filename=SAUpdate.exe Description=Big Brother from Quest Software. System and network monitor Source=Paul Collins Startup list [ATTRedUpdate] Number=772 Confirmed=U Filename=AutoUpdate.exe Description=Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates Source=Paul Collins Startup list [AttuneClientEngine] Number=773 Confirmed=X Filename=attune_ce.exe Description=Spyware - part of an automated helpdesk software called Aveo Attune Source=Paul Collins Startup list [AttuneContentUpdater] Number=774 Confirmed=X Filename=attune_cu.exe Description=Spyware - part of an automated helpdesk software called Aveo Attune Source=Paul Collins Startup list [AttuneDiscovery] Number=775 Confirmed=X Filename=attune_di.exe Description=Spyware - part of an automated helpdesk software called Aveo Attune Source=Paul Collins Startup list [Attunel] Number=776 Confirmed=X Filename=Attunel.exe Description=Spyware - part of an automated helpdesk software called Aveo Attune Source=Paul Collins Startup list [AttuneSystray] Number=777 Confirmed=X Filename=attune_st.exe Description=Spyware - part of an automated helpdesk software called Aveo Attune Source=Paul Collins Startup list [aTuner] Number=778 Confirmed=N Filename=atuner.exe Description=aTuner - tweak tool for GeForce based graphics cards Source=Paul Collins Startup list [atwtusb] Number=779 Confirmed=Y Filename=atwtusb.exe Description=USB interface for Aiptek Graphics Tablet (USB) Source=Paul Collins Startup list [AtxBrw] Number=780 Confirmed=X Filename=Iexplor.exe Description="Pop Marketing" adware Source=Paul Collins Startup list [au] Number=781 Confirmed=U Filename=DealioAu.exe Description=Dealio Toolbar is a free shopping comparison toolbar that allows users to search for a wide range of consumer products Source=Paul Collins Startup list [AU Agent] Number=782 Confirmed=U Filename=AUagent.exe Description=Au Agent from Zilab Software. Win2K/NT enhancement tool. Allows you to run applications under any security context without closing the whole logon session to process a new logon Source=Paul Collins Startup list [au.exe] Number=783 Confirmed=X Filename=au.exe Description=Added by the BEAGLE.B WORM! Source=Paul Collins Startup list [AUCBPNP] Number=784 Confirmed=Y Filename=aucbnpn.exe Description=Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot Source=Paul Collins Startup list [Aucompat] Number=785 Confirmed=X Filename=Aucompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Audcntr] Number=786 Confirmed=X Filename=audcntr.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [AudCtrl] Number=787 Confirmed=? Filename=RunDll32 AudCtrl.dll, RCMonitor Description=Audio control panel? Source=Paul Collins Startup list [audi32] Number=788 Confirmed=X Filename=audi32.exe Description=Added by the RANCK-FL TROJAN! Source=Paul Collins Startup list [AUDIO] Number=789 Confirmed=X Filename=SOUND.exe Description=Added by the PLOYB-A TROJAN! Source=Paul Collins Startup list [audiocfg.exe] Number=790 Confirmed=X Filename=audiocfg.exe Description=Added by the VB.ATE WORM! Source=Paul Collins Startup list [Audiocntl] Number=791 Confirmed=X Filename=audiocntl.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [AudioDeck] Number=792 Confirmed=N Filename=ADeck.exe Description=ADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items Source=Paul Collins Startup list [Audiodrv] Number=793 Confirmed=X Filename=audiodrv.exe Description=Added by the CRYPTER-C TROJAN! Source=Paul Collins Startup list [AudioDrvEmulator] Number=794 Confirmed=U Filename=DLLML.exe AudDrvEm.dll Description=Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [AudioHQ] Number=795 Confirmed=N Filename=Ahqtb.exe Description=For Creative Soundblaster Live! series soundcards. System tray application for SB Live! functions. Available via Start -> Programs Source=Paul Collins Startup list [AudioHQU] Number=796 Confirmed=N Filename=AHQTBU.EXE Description=System Tray application installed with the drivers for Creative Labs SoundBlaster Live! Can be run from Start -> Programs Source=Paul Collins Startup list [audioinf] Number=797 Confirmed=X Filename=audioinf.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [auloadplx] Number=798 Confirmed=X Filename=mplprogsm.exe Description=Added by the SLAPER.K TROJAN! Source=Paul Collins Startup list [AUNPS2] Number=799 Confirmed=X Filename=RUNDLL32 AUNPS2.DLL, _Run@16 Description=AUNPS adware Source=Paul Collins Startup list [aupd] Number=800 Confirmed=X Filename=symcsvc.exe Description=Added by the ABWIZ.D TROJAN! Source=Paul Collins Startup list [aupd] Number=801 Confirmed=X Filename=sysvcs.exe Description=Added by the ABWIZ.C TROJAN! Source=Paul Collins Startup list [aupd] Number=802 Confirmed=X Filename=sywsvcs.exe Description=Added by the ORSE-M TROJAN! Source=Paul Collins Startup list [Aureal A3D Interactive Audio] Number=803 Confirmed=Y Filename=sa3dsrv.exe Description=For Aureal based 3D soundcards. A3D sound features won't work with this disabled Source=Paul Collins Startup list [Aureal A3D Interactive Audio Init] Number=804 Confirmed=Y Filename=A3dInit.exe Description=For Aureal based 3D soundcards. A3D sound features won't work with this disabled Source=Paul Collins Startup list [ausvc] Number=805 Confirmed=X Filename=ausvc.exe Description=Added by the AUTOUPDER TROJAN! Source=Paul Collins Startup list [Auth Starter Ident] Number=806 Confirmed=X Filename=startauth.exe Description=Added by the RBOT-WP WORM! Source=Paul Collins Startup list [authz] Number=807 Confirmed=X Filename=authz.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Auto CD-ROM Startup] Number=808 Confirmed=X Filename=cdaccess.exe Description=Added by the SPYBOT.BLA WORM! Source=Paul Collins Startup list [Auto EPSON Stylus CX6400 on DDLS1Z11] Number=809 Confirmed=U Filename=E_S4I2L1.EXE Description=Related to Epson Stylus CX6400 Series printer Source=Paul Collins Startup list [auto repair system] Number=810 Confirmed=X Filename=qualityx.exe Description=Added by an unidentified WORM or TROJAN - probably a SPYBOT variant Source=Paul Collins Startup list [Auto Switch] Number=811 Confirmed=U Filename=TASKBAR.exe Description=Related to 2-port Bitronics AutoSwitch kit from Belkin Source=Paul Collins Startup list [Auto T Bar] Number=812 Confirmed=N Filename=autotbar.exe Description=If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled Source=Paul Collins Startup list [Auto Updat] Number=813 Confirmed=X Filename=WindowsSys32.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Auto updat] Number=814 Confirmed=X Filename=crcss.exe Description=Added by the SDBOT.AAG WORM! Source=Paul Collins Startup list [Auto Update] Number=815 Confirmed=X Filename=AUP.exe Description=Added by an unididentified WORM or TROJAN! Source=Paul Collins Startup list [Auto Update] Number=816 Confirmed=X Filename=dma.exe Description=Added by the RBOT-AVO WORM! Source=Paul Collins Startup list [Auto Update] Number=817 Confirmed=X Filename=svchost.exe Description=Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Auto Updates] Number=818 Confirmed=X Filename=svchost.exe Description=Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Auto WinUpdate] Number=819 Confirmed=X Filename=taskmrg.exe Description=Added by the RBOT-AFA WORM! Source=Paul Collins Startup list [Autobar] Number=820 Confirmed=U Filename=autobar.exe Description=Connect buttons on the keyboard for internet direct access, etc. on HP computers Source=Paul Collins Startup list [AutoCAD Startup Accelerator] Number=821 Confirmed=U Filename=acstart16.exe Description=Preloads some libraries that are used by AutoCAD in order to make the software load faster Source=Paul Collins Startup list [autoclk] Number=822 Confirmed=U Filename=autoclk.exe Description=Autoclik is a Windows utility "that allows you to perform all mouse activity with absolutely no clicking" Source=Paul Collins Startup list [AutoEA] Number=823 Confirmed=N Filename=Ahqrun.exe Description=For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ Source=Paul Collins Startup list [AUTOEXE] Number=824 Confirmed=X Filename=AUTOEXE.exe Description=Added by the SEMAPI-A WORM! Source=Paul Collins Startup list [Autoloaderaproposclient] Number=825 Confirmed=X Filename=Apropos_Client_Loader.exe Description=AproposMedia adware Source=Paul Collins Startup list [Autoloaderaproposclient] Number=826 Confirmed=X Filename=cxtpls_loader.exe Description=AproposMedia adware Source=Paul Collins Startup list [AutoLoaderEnvoloAutoUpdater] Number=827 Confirmed=X Filename=auto_update_loader.exe Description=Envolo/AproposMedia adware updater Source=Paul Collins Startup list [AutoMate Task Service ] Number=828 Confirmed=N Filename=automate.exe Description=Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start -> Programs Source=Paul Collins Startup list [AutoMate5] Number=829 Confirmed=U Filename=Am5HkWnd.exe Description="Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes, regardless of their complexity" Source=Paul Collins Startup list [Automatic Defrag Manager] Number=830 Confirmed=X Filename=defrag.exe Description=Added by the RBOT-AKE WORM! Source=Paul Collins Startup list [Automatic Microsoft Windows Updater] Number=831 Confirmed=X Filename=suchost.exe Description=Added by the RBOT-EQ WORM! Source=Paul Collins Startup list [Automatic Windows Updater] Number=832 Confirmed=X Filename=Update.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Automatically launches the United Devices Agent when you start your computer] Number=833 Confirmed=N Filename=UD.EXE Description=The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs Source=Paul Collins Startup list [Autopdate] Number=834 Confirmed=X Filename=Autopdate.exe Description=Added by the RBOT-AGL WORM! Source=Paul Collins Startup list [AUTOPROP] Number=835 Confirmed=N Filename=REGPROP.EXE WMPADDIN.DLL Description=Both the files are in the MS Office/Bots/FP_WMP directory. Apparently, it registers the FrontPage WiMP extension Source=Paul Collins Startup list [AUTOPROTECTU] Number=836 Confirmed=X Filename=navapq32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [autorepair] Number=837 Confirmed=X Filename=dexs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Autoroute SMTP] Number=838 Confirmed=U Filename=AutoSmtp.exe Description=Autoroute SMTP - "automatic switching between SMTP servers depending on what network you are currently working in." You need to have two Internet service providers Source=Paul Collins Startup list [autorun] Number=839 Confirmed=X Filename=autorun.exe Description=Added by the AUTOM-B WORM! Source=Paul Collins Startup list [AutoShutdown] Number=840 Confirmed=? Filename=pssvc.exe Description=Utility to fix vCard Export in MS Outlook 2000 - although why are these together? Source=Paul Collins Startup list [AutoSizer] Number=841 Confirmed=U Filename=AUTOSIZER.EXE Description=AutoSizer - utility that automatically maximizes windows when they're opened Source=Paul Collins Startup list [AutoSpell] Number=842 Confirmed=N Filename=autospel.exe Description=AutoSpell - spell checker (version 6.*) Source=Paul Collins Startup list [AutoSpell 5] Number=843 Confirmed=N Filename=ASWATC32.EXE Description=AutoSpell - spell checker Source=Paul Collins Startup list [AutoSys] Number=844 Confirmed=U Filename=autosys.exe Description=Winguardian surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [autotbar] Number=845 Confirmed=N Filename=autotbar.exe Description=If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled Source=Paul Collins Startup list [AutoTKit] Number=846 Confirmed=N Filename=AUTOTKIT.EXE Description=On HP PC's. Unclear what purpose it serves - but there's a known issue with Internet Explorer Toolbar settings not being saved with it enabled Source=Paul Collins Startup list [autoupd] Number=847 Confirmed=N Filename=autoupd.exe Description=Raxco Software Auto Update utility."Used to keep your software up-to-date" Source=Paul Collins Startup list [autoupd] Number=848 Confirmed=X Filename=autoupd.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! - found in a folder of the same name Source=Paul Collins Startup list [autoupdate] Number=849 Confirmed=X Filename=WINUP2DATE.DLL, SHStart Description=Unidentified adware - detected by Panda antivirus as the CLICKER.CY TROJAN! Source=Paul Collins Startup list [autoupdate] Number=850 Confirmed=X Filename=rundll32 [path] DATADX.DLL, SHStart Description=Added by a variant of the QOOLOGIC TROJAN! Source=Paul Collins Startup list [autoupdate] Number=851 Confirmed=X Filename=rundll32 [path] SUPDATE.DLL, SHStart Description=Added by a variant of the QOOLOGIC TROJAN! Source=Paul Collins Startup list [Autoupdate Service] Number=852 Confirmed=X Filename=kaka.exe Description=Added by the SYMPE-B TROJAN! Source=Paul Collins Startup list [AutoUpdater] Number=853 Confirmed=X Filename=aupdate.exe Description=Tinybar variant Source=Paul Collins Startup list [AutoUpdater] Number=854 Confirmed=X Filename=AutoUpdate.exe Description=PeopleonPage foistware Source=Paul Collins Startup list [autoupdatev2] Number=855 Confirmed=X Filename=[path to file] Description=Added by the DROPPER-BM TROJAN! Source=Paul Collins Startup list [autoupdatev2] Number=856 Confirmed=X Filename=autoupdatev2.exe Description=Recognized by Kaspersky antivirus as Clicker.Win32.Agent.fq Source=Paul Collins Startup list [AutoVirusProtection] Number=857 Confirmed=X Filename=ciscv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [auto__antiav__key] Number=858 Confirmed=X Filename=antiav_exe.exe Description=Added by the BAGLEDI-AA TROJAN! Source=Paul Collins Startup list [auto__hloader__key] Number=859 Confirmed=X Filename=hloader_exe.exe Description=Added by the BAGLE.AB TROJAN! Source=Paul Collins Startup list [aux.exe] Number=860 Confirmed=X Filename=aux.exe Description=Added by the ZINS TROJAN! Source=Paul Collins Startup list [auxAudioDevice] Number=861 Confirmed=X Filename=aux32.exe Description=Added by the AIZU WORM! Source=Paul Collins Startup list [AUXXTRAY] Number=862 Confirmed=N Filename=au30setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [AV] Number=863 Confirmed=X Filename=UPDATE-28062004.exe[25 blank spaces].vbs Description=Added by the MIDFIN WORM! Source=Paul Collins Startup list [AV Client] Number=864 Confirmed=X Filename=patch31345.exe Description=Added by the MYDOOM.AD WORM! Source=Paul Collins Startup list [AV Industry] Number=865 Confirmed=X Filename=patch31345.exe Description=Added by the MYDOOM.AD WORM! Source=Paul Collins Startup list [AV UpDate] Number=866 Confirmed=X Filename=Update.exe Description=Added by the FUROOT-A TROJAN! Source=Paul Collins Startup list [AvaFind] Number=867 Confirmed=N Filename=AvaFind.exe Description=AvaFind file search utility Source=Paul Collins Startup list [AVantivirus] Number=868 Confirmed=X Filename=Avconsol.exe Description=Added by the MSNVB-D WORM! Source=Paul Collins Startup list [Avast!] Number=869 Confirmed=Y Filename=ashserv.exe Description=Part of Avast! anti-virus software Source=Paul Collins Startup list [avast!] Number=870 Confirmed=Y Filename=ashDisp.exe Description=Part of Avast! anti-virus software Source=Paul Collins Startup list [avast! Web Scanner] Number=871 Confirmed=Y Filename=Ashwebsv.exe Description=Part of Avast! anti-virus software Source=Paul Collins Startup list [Avast32] Number=872 Confirmed=Y Filename=Astart32.exe Description=Part of Avast! anti-virus software Source=Paul Collins Startup list [avc] Number=873 Confirmed=X Filename=avmon.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [AvconsoleEXE] Number=874 Confirmed=U Filename=Avconsol.exe Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it Source=Paul Collins Startup list [AveoAttune] Number=875 Confirmed=X Filename=atmdlusr.exe Description=Spyware - part of an automated helpdesk software Source=Paul Collins Startup list [AVFX Engine] Number=876 Confirmed=U Filename=StartFX.exe Description=Advanced Video FX - supported by a number of Creative Web Cameras. "Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX" Source=Paul Collins Startup list [AvG] Number=877 Confirmed=X Filename=svchost323.exe Description=Added by the RBOT-ZA WORM! Source=Paul Collins Startup list [AVG Anti-Virus system] Number=878 Confirmed=Y Filename=avgcc.exe Description=AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components, settings and updates Source=Paul Collins Startup list [Avg Antivirus] Number=879 Confirmed=X Filename=icpldrvx.exe Description=Added by the BANKER.BYU TROJAN! Source=Paul Collins Startup list [AVG Grisoft Updater] Number=880 Confirmed=X Filename=updater.exe Description=Added by the AGOBOT-OT WORM! Source=Paul Collins Startup list [AVG7_AMSVR] Number=881 Confirmed=Y Filename=Avgamsvr.exe Description=AVG antivirus related Source=Paul Collins Startup list [AVG7_CC] Number=882 Confirmed=Y Filename=AVGCC.exe Description=AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components, settings and updates Source=Paul Collins Startup list [AVG7_CC] Number=883 Confirmed=Y Filename=avgcc.exe Description=AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components, settings and updates Source=Paul Collins Startup list [AVG7_EMC] Number=884 Confirmed=Y Filename=AVGEMC.exe Description=AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses Source=Paul Collins Startup list [AVG7_Run] Number=885 Confirmed=Y Filename=avgw.exe Description=AVG Anti-Virus 7.0 related Source=Paul Collins Startup list [avgamsvr.exe] Number=886 Confirmed=Y Filename=Avgamsvr.exe Description=AVG antivirus related Source=Paul Collins Startup list [avgcc32] Number=887 Confirmed=Y Filename=avgcc32.exe Description=AVG anti-virus control center. Also enables scheduled tests, Outlook E-mail plug-in and automatic updates Source=Paul Collins Startup list [AVGCtrl] Number=888 Confirmed=Y Filename=AVGCtrl.exe Description=Part of AntiVir� PersonalEdition Classic antivirus Source=Paul Collins Startup list [avgfwsrv] Number=889 Confirmed=Y Filename=AVGFWSRV.EXE Description=Firewall part of the AVG Plus Firewall Edition Source=Paul Collins Startup list [avgmsvr.exe] Number=890 Confirmed=Y Filename=avgmsvr.exe Description=AVG Anti-Virus 7.0 related Source=Paul Collins Startup list [AVGnt] Number=891 Confirmed=Y Filename=AVGnt.exe Description=AntiVir� PersonalEdition Classic antivirus. System Tray icon and control program Source=Paul Collins Startup list [Avgserv9.exe] Number=892 Confirmed=Y Filename=Avgserv9.exe Description=AVG antivirus background monitoring Source=Paul Collins Startup list [AVGuard] Number=893 Confirmed=Y Filename=AVGuard.exe Description=AntiVir� PersonalEdition Classic antivirus. Background task which scans files transparently Source=Paul Collins Startup list [AVG_CC] Number=894 Confirmed=Y Filename=avgcc32.exe Description=AVG anti-virus control center. Also enables scheduled tests, Outlook E-mail plug-in and automatic updates Source=Paul Collins Startup list [AVG_EMC] Number=895 Confirmed=Y Filename=AVGEMC.exe Description=AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses Source=Paul Collins Startup list [AVG_RegCleaner] Number=896 Confirmed=Y Filename=AVGREGCL.exe Description=AVG Anti-Virus 7.0 Registry Cleaner - for checking the registry for virus additions and other security problems Source=Paul Collins Startup list [avidrv] Number=897 Confirmed=X Filename=drvsc.exe Description=Recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Agent.ph Source=Paul Collins Startup list [Avimgt] Number=898 Confirmed=X Filename=Avimgt.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Avimgt32] Number=899 Confirmed=X Filename=Avimgt32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [avinit] Number=900 Confirmed=Y Filename=AVINIT9X.EXE Description=Command Antivirus related Source=Paul Collins Startup list [AVK Mail Checker] Number=901 Confirmed=Y Filename=AVKPop.exe Description=eXtendia AVK AntiVirus email checker Source=Paul Collins Startup list [AVKBar] Number=902 Confirmed=Y Filename=AVKBar.exe Description=GData AntiVirusKit Anti-virus Source=Paul Collins Startup list [AvMaiSrv] Number=903 Confirmed=Y Filename=Avmaisrv.exe Description=Part of Avast! anti-virus software - E-mail scanner Source=Paul Collins Startup list [avnort] Number=904 Confirmed=X Filename=formatsys.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [avnort] Number=905 Confirmed=X Filename=msmbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [avnort] Number=906 Confirmed=X Filename=serbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [avp] Number=907 Confirmed=Y Filename=avp.exe Description=AOL's Active Virus Shield Source=Paul Collins Startup list [AVP] Number=908 Confirmed=X Filename=[path to trojan] Description=Added by the MUTBO-A TROJAN! Source=Paul Collins Startup list [AVP-SE] Number=909 Confirmed=X Filename=avp-32.exe Description=Added by the AGOBOT.FS WORM! Source=Paul Collins Startup list [avpcc] Number=910 Confirmed=Y Filename=avpcc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [avpm] Number=911 Confirmed=Y Filename=avpm.exe Description=Kaspersky anti-virus Source=Paul Collins Startup list [Avpr] Number=912 Confirmed=X Filename=avpr.exe Description=Added by the MYDOOM.AF WORM! Source=Paul Collins Startup list [avptask] Number=913 Confirmed=X Filename=[path to trojan] Description=Added by the NOFERE-G TROJAN! Source=Paul Collins Startup list [avptask] Number=914 Confirmed=X Filename=expl0rer.exe Description=Added by the AGENT.JJO TROJAN! Source=Paul Collins Startup list [Avptask] Number=915 Confirmed=X Filename=rund1132.exe Description=Added by the AGENT.PKZ TROJAN! Source=Paul Collins Startup list [Avril Lavigne - Muse] Number=916 Confirmed=X Filename=[random filename] Description=Added by the AVRIL-A WORM! Source=Paul Collins Startup list [AVSCHED32] Number=917 Confirmed=Y Filename=AVSched32.exe Description=AntiVir� PersonalEdition Classic - antivirus Source=Paul Collins Startup list [AVSchedScan] Number=918 Confirmed=Y Filename=SCHSC9X.EXE Description=Command Antivirus related Source=Paul Collins Startup list [AvSer] Number=919 Confirmed=X Filename=dsm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [AvSer] Number=920 Confirmed=X Filename=msmpatch.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [AvSer] Number=921 Confirmed=X Filename=svosm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [AvSer] Number=922 Confirmed=X Filename=sysup.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [avserve.exe] Number=923 Confirmed=X Filename=avserve.exe Description=Added by the SASSER WORM! Source=Paul Collins Startup list [avserve2.exe] Number=924 Confirmed=X Filename=avserve2.exe Description=Added by the SASSER.B or SASSER.C WORMS! Source=Paul Collins Startup list [avserve3.exe] Number=925 Confirmed=X Filename=avserve3.exe Description=Added by the SASSER.G WORM! Source=Paul Collins Startup list [AVStation premium] Number=926 Confirmed=U Filename=AVStation agent.exe Description=Related to Samsung AV Station - instant playback of music, photos, videos Source=Paul Collins Startup list [Avtray] Number=927 Confirmed=N Filename=Avtray.exe Description=Command Antivirus tray icon Source=Paul Collins Startup list [AVWLPSTA] Number=928 Confirmed=? Filename=AVWLPSTA.exe Description=PRISM Status Tray Applet - but what is it for and is it required? Source=Paul Collins Startup list [AVWUpd32] Number=929 Confirmed=Y Filename=AVWUPD32.EXE Description=AntiVir� PersonalEdition Classic - updater Source=Paul Collins Startup list [avx communicator] Number=930 Confirmed=Y Filename=xcommsur.exe Description=Anti-virus part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Avxlive] Number=931 Confirmed=Y Filename=avxlive.exe Description=Bullguard or BitDefender antivirus Source=Paul Collins Startup list [avxlni] Number=932 Confirmed=Y Filename=avxinit.exe Description=Anti-virus part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Avxnews] Number=933 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Awatch] Number=934 Confirmed=U Filename=Awatch.exe Description=Diagnosis tool that monitors DSL connections, installed alongside DSL drivers from AVM Fritz's range of modem products Source=Paul Collins Startup list [AwaySch] Number=935 Confirmed=U Filename=AwaySch.EXE Description=Part of the IBM ThinkVantage Productivity Center. "The Away Manager application allows you preselect and run routine tasks to maintain your system's performance" Source=Paul Collins Startup list [awhost32] Number=936 Confirmed=N Filename=awhost32.exe Description=Part of Symantec's pcAnywhere remote PC management software. Provides an automatic startup of the client PC in host mode in conjuction with a host-definition file, so system administrators can access the machine. Can cause a 10% reduction in speed and not recommended Source=Paul Collins Startup list [AWMON] Number=937 Confirmed=U Filename=Ad-Watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [AWMON] Number=938 Confirmed=U Filename=Ad-Monitor.exe Description=F-Secure Anti-Spyware Source=Paul Collins Startup list [AWUSGSTA] Number=939 Confirmed=? Filename=AWUSGSTA.exe Description=Reportedly related to a USB Wifi Adapter - is it required at startup? Source=Paul Collins Startup list [awxDTools] Number=940 Confirmed=U Filename=awxDTools.dll, awxRegisterDll Description=AwxDTools related - a Windows Shell-Extension for the Daemon-Tools. It extends the context-menu of ImageFiles supported by Daemon-Tools (i.e.: *.cue, *.iso, *.ccd ...) Source=Paul Collins Startup list [AxFilter] Number=941 Confirmed=? Filename=Rundll32 AXFILTER.DLL, Rundll32 Description=?? Source=Paul Collins Startup list [AXVenore] Number=942 Confirmed=X Filename=AXVenore.exe Description=Identified as a TROJAN! Source=Paul Collins Startup list [AzMixerSel] Number=943 Confirmed=U Filename=AzMixerSel.exe Description=Related to Realtek_Azalia Mixer Selector Source=Paul Collins Startup list [azmodem] Number=944 Confirmed=Y Filename=azexe.exe Description=Aztech Labs modem driver Source=Paul Collins Startup list [a_vpd] Number=945 Confirmed=? Filename=vpd.exe Description=Located in the IBMTOOLS\VPD sub-directory. What does it do and is it required? Source=Paul Collins Startup list [a�] Number=946 Confirmed=U Filename=a2guard.exe Description=a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a� 'Background Guard' real time protection feature Source=Paul Collins Startup list [B'sCLiP] Number=947 Confirmed=N Filename=BSCLIP.exe Description=CD recording utility that comes with a lot of CDR/CDRW drives and isn't required Source=Paul Collins Startup list [b.exe] Number=948 Confirmed=X Filename=b.exe Description=Added by the SDBOT.BND WORM! Source=Paul Collins Startup list [B.Reader] Number=949 Confirmed=N Filename=remin.exe Description=Birthday Reminder 5.0 - as the name implies Source=Paul Collins Startup list [b3d] Number=950 Confirmed=X Filename=BDEsecureinstall.exe Description=B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the "System" directory. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents Source=Paul Collins Startup list [b3dUpdate] Number=951 Confirmed=X Filename=Zupdate.exe Description=Associated with B3d Projector foistware - see here Source=Paul Collins Startup list [b9] Number=952 Confirmed=U Filename=B9.exe Description=FireTrust Benign - allows you to receive e-mail which is safe from viruses, worms, scripts, web bugs, privacy threats and other security risks, without affecting your e-mail. "Benign neutralizes or strips out the code that makes viruses, worms, scripts and other potentially harmful things run" Source=Paul Collins Startup list [b99] Number=953 Confirmed=X Filename=msmm.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [bab] Number=954 Confirmed=X Filename=svchst32.exe Description=Added by the AGENT.Q TROJAN! Source=Paul Collins Startup list [babeie] Number=955 Confirmed=X Filename=rundll32 cnbabe.dll, dllstartup Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [Babylon Client] Number=956 Confirmed=N Filename=Babylon.exe Description=Babylon-Pro is a powerful information tool that instantly provides relevant information, translations & conversions for any word or value you click on" Source=Paul Collins Startup list [Babylon Translator] Number=957 Confirmed=N Filename=Babylon.exe Description="Babylon-Pro is a powerful information tool that instantly provides relevant information, translations & conversions for any word or value you click on" Source=Paul Collins Startup list [Back Updates] Number=958 Confirmed=X Filename=Uninstall.log.vbs Description=Added by the YPSAN.D WORM! Source=Paul Collins Startup list [Backdoor.NuAgent] Number=959 Confirmed=X Filename=agent.exe Description=Added by the AGENT-DP TROJAN! Source=Paul Collins Startup list [Background Intelligent Transfer Service] Number=960 Confirmed=X Filename=rundll32.exe Description=Added by the VB-ZD TROJAN! Note - this file is located in the C:\Windows\help folder, and is not to be confused with the legitimate rundll32.exe file! Source=Paul Collins Startup list [BackgroundSwitcher] Number=961 Confirmed=U Filename=bgswitch.exe Description=Originally included with Microsoft's XP PowerToys (but now withdrawn - see here, Background Switcher allows your desktop background to periodically change Source=Paul Collins Startup list [Backpack UDF] Number=962 Confirmed=N Filename=bpudfmon.exe Description=Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk Source=Paul Collins Startup list [backup] Number=963 Confirmed=X Filename=[path to worm] Description=Added by the AGOBOT-H WORM! Source=Paul Collins Startup list [Backup Service] Number=964 Confirmed=X Filename=backup.svc Description=Unidentified adware Source=Paul Collins Startup list [Backup4all OTB Agent] Number=965 Confirmed=U Filename=B4AOTB.exe Description="Backup4all is an award-winning data backup software for Windows. This backup utility was designed to protect your valuable data from partial or total loss by automating backup tasks, password protecting and compressing it to save storage space" Source=Paul Collins Startup list [BackupExecScheduler] Number=966 Confirmed=U Filename=besch.exe Description=Veritas "Back Up My PC" software Source=Paul Collins Startup list [BackupNotify] Number=967 Confirmed=? Filename=backupnotify.exe Description=HP Digital Imaging related. What does it do and is it required? Source=Paul Collins Startup list [BackWeb] Number=968 Confirmed=N Filename=backweb.exe Description=Automatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Available via Start -> Programs Source=Paul Collins Startup list [Backwork] Number=969 Confirmed=N Filename=Backwork.exe Description=Backwork trojan detector Source=Paul Collins Startup list [BACPI10] Number=970 Confirmed=U Filename=bacpi10a.exe Description=Known as "PowerKey" - a minimalistic keyboard driver that allows power management keys on BTC keyboards to function properly in older OS's (i.e. Win95/98/NT4). Also adds an icon to the system tray Source=Paul Collins Startup list [BacsTray] Number=971 Confirmed=N Filename=BacsTray.exe Description=Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems Source=Paul Collins Startup list [BADDATE] Number=972 Confirmed=X Filename=BADDATE.EXE Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [BagleAV] Number=973 Confirmed=X Filename=csrss.exe Description=Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Bakra] Number=974 Confirmed=X Filename=IEHost.EXE Description=Added by the MULTIDR-AH TROJAN! Source=Paul Collins Startup list [bal] Number=975 Confirmed=X Filename=SYSMONMS.EXE Description=Added by the FAKEALERT TROJAN! Source=Paul Collins Startup list [Band-Aid] Number=976 Confirmed=X Filename=[path to file] Description=Added by the RANKY.O TROJAN! Source=Paul Collins Startup list [Bandook] Number=977 Confirmed=X Filename=ali.exe Description=Added by the EXEMAS-B TROJAN! Source=Paul Collins Startup list [Bandwidth Monitor Pro] Number=978 Confirmed=U Filename=Bandwidth Monitor Pro.exe Description=Bandwidth Monitor Pro - utililty to track your current download/upload limit that may be set by your ISP Source=Paul Collins Startup list [Banpopup by Pratik] Number=979 Confirmed=U Filename=Banpopup.exe Description=Banpopup - popup killer Source=Paul Collins Startup list [Bar Ding lolt] Number=980 Confirmed=X Filename=Analiz.exe Description=Added by the RBOT-RP WORM! Source=Paul Collins Startup list [bargains] Number=981 Confirmed=X Filename=bargains.exe Description=BargainBuddy foistware Source=Paul Collins Startup list [bargains] Number=982 Confirmed=X Filename=bargainbuddy.exe Description=BargainBuddy foistware Source=Paul Collins Startup list [Bart Station] Number=983 Confirmed=? Filename=station.sbrt Description=Related to PeoplePC ISP. May be a dialler for dial-up accounts? Source=Paul Collins Startup list [Bart Station] Number=984 Confirmed=U Filename=PPCOLink.exe Description=Dialer for PeoplePC ISP Source=Paul Collins Startup list [BarTheme] Number=985 Confirmed=X Filename=bartent32.exe Description=Added by the AGOBOT-UG WORM! Source=Paul Collins Startup list [bascstray] Number=986 Confirmed=N Filename=BascsTray.exe Description=Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems Source=Paul Collins Startup list [Bat] Number=987 Confirmed=X Filename=secure2.bat Description=Added by the ZCREW.C TROJAN! Source=Paul Collins Startup list [Batchreg1] Number=988 Confirmed=N Filename=N/A Description=Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation, as that key should be deleted automatically. See here Source=Paul Collins Startup list [BatInfEx] Number=989 Confirmed=U Filename=rundll32.exe Description=Displays battery status information on an IBM Thinkpad Source=Paul Collins Startup list [BatSrv] Number=990 Confirmed=X Filename=batserv2.exe Description=Recognized by Kaspersky antivirus as the Win32.Locksky.m WORM! Source=Paul Collins Startup list [Battery Scope] Number=991 Confirmed=U Filename=batmgr.exe Description=Monitors battery levels on a notebook/laptop PC Source=Paul Collins Startup list [BatteryBar] Number=992 Confirmed=U Filename=batterybar.exe Description=BatteryBar - displays battery usage, and the current percentage of battery power left Source=Paul Collins Startup list [BatzBack] Number=993 Confirmed=X Filename=BatzBack.scr Description=Added by the BACKZAT WORM! Source=Paul Collins Startup list [BAUSB] Number=994 Confirmed=U Filename=BAUSB.exe Description=Boston Acoustics Audio, USB driver Source=Paul Collins Startup list [bawindo] Number=995 Confirmed=X Filename=bawindo.exe Description=Added by the BEAGLE.AR or BEAGLE.AU WORMS! Source=Paul Collins Startup list [BayMgr] Number=996 Confirmed=U Filename=DockApp.exe Description=Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [Bayswap] Number=997 Confirmed=U Filename=bayswap.exe Description=Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [Bayswap2] Number=998 Confirmed=U Filename=TbUpdate.exe Description=Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [BBC Alerts] Number=999 Confirmed=N Filename=BBC_Alerts.exe Description=BBC Alerts - "You can now have all the latest news and sports headlines delivered straight to your desktop with the new BBC Alerts service" Source=Paul Collins Startup list [BBC News alerts] Number=1000 Confirmed=U Filename=skinkers.exe Description=BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens Source=Paul Collins Startup list [BBDial] Number=1001 Confirmed=? Filename=BT Broadband.exe Description=Part of BT Broandband - is it required? Source=Paul Collins Startup list [bbSysTray] Number=1002 Confirmed=N Filename=bbSysTray.exe Description=Philips CD-RW related - "the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions" Source=Paul Collins Startup list [bbui] Number=1003 Confirmed=U Filename=bbui.exe Description=AOL DSL status monitor displaying a red/green icon indicating if you have a connection Source=Paul Collins Startup list [bca] Number=1004 Confirmed=U Filename=bca.exe Description=BeClean Agent - registry, history, temp files, etc cleaner Source=Paul Collins Startup list [BCDetect] Number=1005 Confirmed=U Filename=bcdetect.exe Description=Bcdetect.exe searches the system to make sure Creative drivers are installed for the video card. It loads the BlasterControl when the drivers are detected. Your choice - try it and see Source=Paul Collins Startup list [BCMDMMSG] Number=1006 Confirmed=Y Filename=bcmdmmsg.exe Description=BCM voicemodem driver. Required for dial-up if you have one of these modems Source=Paul Collins Startup list [BCMHal] Number=1007 Confirmed=U Filename=rundll32.exe bcmhal9x.dll, bcinit Description=BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings Source=Paul Collins Startup list [BCMSMMSG] Number=1008 Confirmed=Y Filename=BCMSMMSG.exe Description=BCM voicemodem driver. Required for dial-up if you have one of these modems Source=Paul Collins Startup list [bcmwltry] Number=1009 Confirmed=? Filename=bcmwltry.exe Description=Broadcom Corporation Wireless Network Tray Applet. Is it required? Source=Paul Collins Startup list [BCNT] Number=1010 Confirmed=N Filename=bcnt.exe Description=AWS Weatherbug related. What does it do? Source=Paul Collins Startup list [BCPC] Number=1011 Confirmed=X Filename=bcpc.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [bcpc_c] Number=1012 Confirmed=X Filename=bcpc_c.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [BCTweak] Number=1013 Confirmed=U Filename=bctweak.exe Description=BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings Source=Paul Collins Startup list [Bcvsrv32] Number=1014 Confirmed=X Filename=bcvsrv32.exe Description=Added by the GAOBOT.BQJ WORM! Source=Paul Collins Startup list [BCWipeTM] Number=1015 Confirmed=N Filename=bcwipetm.exe Description=BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task, as well as special options for the task. Run manually when needed Source=Paul Collins Startup list [BD] Number=1016 Confirmed=X Filename=dc.exe Description=Added by the RASDOOR-A TROJAN! Source=Paul Collins Startup list [BDAgent] Number=1017 Confirmed=U Filename=bdagent.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BDMCon] Number=1018 Confirmed=Y Filename=Bdmcon.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BDNewsAgent] Number=1019 Confirmed=Y Filename=bdnagent.exe Description=BitDefender antivirus - updater Source=Paul Collins Startup list [BDOESRV] Number=1020 Confirmed=Y Filename=bdoesrv.exe Description=Bitdefender 8 antivirus and firewall Source=Paul Collins Startup list [BDSwitchAgent] Number=1021 Confirmed=Y Filename=bdswitch.exe Description=Bitdefender 8 antivirus and firewall Source=Paul Collins Startup list [BearFlix] Number=1022 Confirmed=U Filename=BearFlix.exe Description=BearFlix is optimized for the fast download of video files Source=Paul Collins Startup list [BearShare] Number=1023 Confirmed=N Filename=bearshare.exe Description=BearShare file sharing client. Versions known to include spyware - see here Source=Paul Collins Startup list [BeatNik Internet Clock] Number=1024 Confirmed=U Filename=BeatNik.exe Description=BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock Source=Paul Collins Startup list [Beawver] Number=1025 Confirmed=X Filename=saqevre.exe Description=Added by the RANKY.AGA TROJAN! Source=Paul Collins Startup list [Beegees Update] Number=1026 Confirmed=X Filename=beegees.exe Description=Added by the SDBOT-ADK WORM! Source=Paul Collins Startup list [BEEI] Number=1027 Confirmed=? Filename=beei.exe Description=?? Source=Paul Collins Startup list [BeFaster] Number=1028 Confirmed=U Filename=befaster3.exe Description=BeFaster internet connection optimization tool Source=Paul Collins Startup list [BEHL] Number=1029 Confirmed=? Filename=BEHL.exe Description=?? Source=Paul Collins Startup list [BEHLO] Number=1030 Confirmed=? Filename=BEHLO.exe Description=?? Source=Paul Collins Startup list [Belkin PCMCIA WLAN Monitor] Number=1031 Confirmed=N Filename=monitorbk.exe Description=Belkin USB Network Adapter Management utility - can be started manually Source=Paul Collins Startup list [Belkin Wireless Utility] Number=1032 Confirmed=N Filename=Belkinwcui.exe Description=Wireles configuration utility for some Belkin cards such as the Wireless G Desktop Card Source=Paul Collins Startup list [BellSouthAlertManager.exe] Number=1033 Confirmed=U Filename=BellSouthAlertManager.exe Description=Related to BellSouth Alert Manager Source=Paul Collins Startup list [BelNotify] Number=1034 Confirmed=U Filename=[path] NPBelv32.dll, RunDll32_BelNotify Description="BelTech from Belarc enables licensees to offer automated, Web-based problem resolution to their end-users. BelTech allows the end-user to simply go to a web page and automatically resolve their problem or point them to the right solution. BelTech Manager allows non-programmers to rapidly and easily deploy and maintain this service" Source=Paul Collins Startup list [BELORVBI] Number=1035 Confirmed=? Filename=BELORVBI.exe Description=?? Source=Paul Collins Startup list [Belsta.exe] Number=1036 Confirmed=? Filename=Belsta.exe Description=Configuration tool for Belkin wireless network cards. Required to change the card's configuration. Is it required for correct operation once the confuiguration is changed? Source=Paul Collins Startup list [Belt] Number=1037 Confirmed=X Filename=Belt.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [Benadril Alert Tool] Number=1038 Confirmed=X Filename=benadrilalert.exe Description=Plug-in for WeatherBug advising when pollen count in your area is high - prompting you to buy Benadril Source=Paul Collins Startup list [BestPopUpKiller] Number=1039 Confirmed=N Filename=BestPopupKiller.exe Description=Popup killer by Swanksoft - not recommended, see here Source=Paul Collins Startup list [BeSys] Number=1040 Confirmed=X Filename=[path to file] Description=BeSys adware Source=Paul Collins Startup list [BF4P] Number=1041 Confirmed=X Filename=bf4p.exe Description=Added by the IRCBOT.GEN WORM! Source=Paul Collins Startup list [bg] Number=1042 Confirmed=Y Filename=bullguard.exe Description=Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster Source=Paul Collins Startup list [BGInfo] Number=1043 Confirmed=U Filename=Bginfo.exe Description=BGinfo automatically displays relevant information about a Windows computer on the desktop's background, such as the computer name, IP address, service pack version, and more Source=Paul Collins Startup list [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] Number=1044 Confirmed=U Filename=NMBgMonitor.exe Description=Associated with Nero Scout, added by version 7 of the Nero digital media suite (CD & DVD burning, authoring, etc). Thanks to Help2Go.com, if you feel this is draining more resources that necessary you can disable it by clicking here Source=Paul Collins Startup list [BGNewsAgent] Number=1045 Confirmed=Y Filename=bgnewsag.exe Description=BullGuard antivirus updater Source=Paul Collins Startup list [bgsmsnd] Number=1046 Confirmed=N Filename=bgsmsnd.exe Description=Printer driver to generate PDF files from any program Source=Paul Collins Startup list [BHOCop] Number=1047 Confirmed=N Filename=BHOCop.exe Description=PC Magazine's BHO Cop that lets you see what browser helper objects are installed. Useful for detecting spyware Source=Paul Collins Startup list [BHODemon 2.0] Number=1048 Confirmed=U Filename=BHODemon.exe Description=BHODemon "protects you from unknown Browser Helper Objects (BHOs), by letting you enable/disable them individually. When running, it also monitors your Registry and alerts you when a BHO is installed. Best of all, BHODemon knows about the most common BHOs - the good ones, and the not-so-good ones!". If you prefer forgoing resident protection, the application can also be run on demand Source=Paul Collins Startup list [BHR] Number=1049 Confirmed=U Filename=BHR.exe Description=Browser Hijack Retaliator - recovers your browser after it has been hijacked by spyware, adware, etc Source=Paul Collins Startup list [BI1HelperStartUp] Number=1050 Confirmed=U Filename=BI1HEL~1.EXE Description=ScreenScenes "Beach Islands" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [BIE] Number=1051 Confirmed=X Filename=Rundll32.exe BDSrHook.dll, Rundll32 Description=BDplugin parasite Source=Paul Collins Startup list [BIG] Number=1052 Confirmed=X Filename=biggy.exe Description=Added by the DELBOT-AG WORM! Source=Paul Collins Startup list [BigDog303] Number=1053 Confirmed=U Filename=VM303_STI.EXE Description=Related to VIMICRO USB for PC Camera Source=Paul Collins Startup list [BigDogPath] Number=1054 Confirmed=? Filename=VM_STI.EXE Description=Bundled with some software for digital cameras that use a USB connection - what does it do and is it required? Source=Paul Collins Startup list [bigfix] Number=1055 Confirmed=N Filename=BIGFIX.EXE Description=BigFix can automatically download and read technical support information provided by computer and software manufacturers and other technical support experts (published in the form of Fixlet� Messages) and can automatically check your computer for bugs, configuration conflicts, and security holes. Should only be started manually as it's a resource hog Source=Paul Collins Startup list [BigPond Toolbar] Number=1056 Confirmed=U Filename=bpumTray.exe Description=Telstra BigPond Toolbar - "Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier" Source=Paul Collins Startup list [BigPondCable] Number=1057 Confirmed=N Filename=bpcable.exe Description=Telstra Bigpond Cable login software - can be started manually Source=Paul Collins Startup list [bikini] Number=1058 Confirmed=X Filename=bikini.exe Description=Added by the LOWZONE-CX TROJAN! Source=Paul Collins Startup list [Billminder] Number=1059 Confirmed=N Filename=Billmind.exe Description=Can be setup in Quicken to remind user of due payments. Available via Start -> Programs Source=Paul Collins Startup list [bin32hpu] Number=1060 Confirmed=X Filename=ppstub.exe Description=PrecisionPop adware Source=Paul Collins Startup list [bingdian] Number=1061 Confirmed=X Filename=Bingdian.vbs Description=Added by the BINGD WORM! Source=Paul Collins Startup list [Bingo Charm] Number=1062 Confirmed=? Filename=charms.exe Description=Some kind of screen icon kind of like desk flag, but it gives you a choice of icons? Source=Paul Collins Startup list [Biomenu] Number=1063 Confirmed=U Filename=menusw.exe Description=Related to Sony VAIO - passwords, encryption, and a biometric fingerprint sensor Source=Paul Collins Startup list [Bios] Number=1064 Confirmed=X Filename=Bios32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [BIOS XP Loader] Number=1065 Confirmed=X Filename=[random filename] Description=Added by the RBOT-IC WORM! Source=Paul Collins Startup list [BIOS1] Number=1066 Confirmed=X Filename=BIOS1.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [BIOVCIP] Number=1067 Confirmed=? Filename=BIOVCIP.exe Description=?? Source=Paul Collins Startup list [BitComet] Number=1068 Confirmed=N Filename=BitComet.exe Description=BitComet P2P client - can be launched from Start -> Programs Source=Paul Collins Startup list [BitDefender Antivirus] Number=1069 Confirmed=X Filename=BITDEFENDERX.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [BitDefender Communicator] Number=1070 Confirmed=Y Filename=xcommsvr.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BitDefender for MSN Messenger] Number=1071 Confirmed=U Filename=msnmon.exe Description=Bitdefender anti-virus for MSN Messenger - no longer supported at the BitDefender website Source=Paul Collins Startup list [BitDefender for Yahoo! Messenger] Number=1072 Confirmed=U Filename=yahmon.exe Description=Bitdefender anti-virus for Yahoo! Messenger - no longer supported at the BitDefender website Source=Paul Collins Startup list [BitDefender Live! Init] Number=1073 Confirmed=Y Filename=bdinit.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BitDefender Scan Server] Number=1074 Confirmed=Y Filename=bdss.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BitDefender Virus Shield] Number=1075 Confirmed=Y Filename=vsserv.exe Description=BitDefender antivirus Source=Paul Collins Startup list [bitdefenderlive] Number=1076 Confirmed=Y Filename=avxlive.exe Description=Main program of BitDefender virus scanner/firewall Source=Paul Collins Startup list [BitDefender_P2P_Startup] Number=1077 Confirmed=U Filename=BitDefender_P2P_Startup.exe Description=Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website Source=Paul Collins Startup list [BitWare Print Monitor] Number=1078 Confirmed=N Filename=bwprnmon.exe Description=FaxServe network fax software Source=Paul Collins Startup list [BJ Printer Status Monitor] Number=1079 Confirmed=N Filename=Cjstsr.exe Description=Canon BJ printer status monitor Source=Paul Collins Startup list [BJ Status Monitor 5xx] Number=1080 Confirmed=N Filename=CJSTRxx.EXE Description=Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers Source=Paul Collins Startup list [bjcfd] Number=1081 Confirmed=N Filename=cdf.exe Description=BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs Source=Paul Collins Startup list [BlackICE PC Protection] Number=1082 Confirmed=N Filename=blackice.exe Description=Loads the user interface for the BlackICE PC Protection (was Defender) firewall program. From the parent site - '(the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' See also LoadBlackD Source=Paul Collins Startup list [BlackIce Utility] Number=1083 Confirmed=N Filename=blackice.exe Description=Loads the user interface for the BlackICE PC Protection (was Defender) firewall program. From the parent site - '(the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' See also LoadBlackD Source=Paul Collins Startup list [blads] Number=1084 Confirmed=U Filename=blads.exe Description=A Tweak-XP component, blocks advertisement banners in Internet Explorer. Can be enabled/disabled via Tweak-XP / Internet Tweaks Source=Paul Collins Startup list [blah service] Number=1085 Confirmed=X Filename=winupdate.exe Description=Added by the GAOBOT.BIA WORM! Source=Paul Collins Startup list [blah service] Number=1086 Confirmed=X Filename=winsysengine.exe Description=Added by the RBOT-KI WORM! Source=Paul Collins Startup list [blah service] Number=1087 Confirmed=X Filename=internet.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [blah service] Number=1088 Confirmed=X Filename=smnp.exe Description=Added by the RBOT.IZ WORM! Source=Paul Collins Startup list [blah service] Number=1089 Confirmed=X Filename=msnmsgrr.exe Description=Added by the RBOT.PZ WORM! Source=Paul Collins Startup list [blah service] Number=1090 Confirmed=X Filename=tazkmgr.exe Description=Added by the RBOT.UA WORM! Source=Paul Collins Startup list [blah service] Number=1091 Confirmed=X Filename=FaLeH.exe Description=Added by the RBOT-AES WORM! Source=Paul Collins Startup list [blah service] Number=1092 Confirmed=X Filename=microsoft.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [blah service] Number=1093 Confirmed=X Filename=evosys.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [blah service] Number=1094 Confirmed=X Filename=win32.exe Description=Added by the RBOT-AXO WORM! Source=Paul Collins Startup list [Blah service] Number=1095 Confirmed=X Filename=CCAPPS32.EXE Description=Added by the RBOT.TV WORM! Source=Paul Collins Startup list [blahh service] Number=1096 Confirmed=X Filename=msengine.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [blahx service] Number=1097 Confirmed=X Filename=msnjompa.exe Description=Added by the SDBOT.AML WORM! Source=Paul Collins Startup list [BlazeChanger] Number=1098 Confirmed=N Filename=FBZPaper.exe Description=Ember graphic file viewer, manager, and touch-up system Source=Paul Collins Startup list [bldbubg] Number=1099 Confirmed=N Filename=bldbubg.exe Description=Part of Dell Alerts which provides customers with an update on latest updates for his/her system Source=Paul Collins Startup list [BLF] Number=1100 Confirmed=X Filename=blf.exe Description=Added by the DELBOT-M WORM! Source=Paul Collins Startup list [blinkx] Number=1101 Confirmed=U Filename=blinkx.exe Description=Blinkx Desktop "Smart Folders" software Source=Paul Collins Startup list [BLMessagingIntegration] Number=1102 Confirmed=X Filename=blengine.exe Description=BuddyLinks adware Source=Paul Collins Startup list [BlockAds] Number=1103 Confirmed=U Filename=blads.exe Description=A Tweak-XP component, blocks advertisement banners in Internet Explorer. Can be enabled/disabled via Tweak-XP / Internet Tweaks Source=Paul Collins Startup list [BlockChecker] Number=1104 Confirmed=X Filename=Block-checker.exe Description=BlockChecker adware Source=Paul Collins Startup list [Blocker System611 Monitoring] Number=1105 Confirmed=X Filename=PopUpBlocker611.exe Description=Added by the RBOT.BLJ WORM! Source=Paul Collins Startup list [BlockTracker] Number=1106 Confirmed=N Filename=BlockTracker.exe Description=If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file Source=Paul Collins Startup list [blsloader] Number=1107 Confirmed=U Filename=blsloader.exe Description=BellSouth ISP Internet Tools Source=Paul Collins Startup list [blss] Number=1108 Confirmed=X Filename=blss.exe Description=Added by the BLARUL TROJAN! Source=Paul Collins Startup list [BLSTAPP] Number=1109 Confirmed=N Filename=blstapp.exe Description=Puts access to Creative's BlasterControl in the System Tray Source=Paul Collins Startup list [Blubster] Number=1110 Confirmed=N Filename=Blubster.exe Description=Related to Blubster Music sharing service Source=Paul Collins Startup list [Blue Frog] Number=1111 Confirmed=U Filename=bluefrog.exe Description=Blue Frog by Blue Security Inc. - actively fights spam by posting complaints on the sites advertised by the spam you receive Source=Paul Collins Startup list [BlueLight_uoltray] Number=1112 Confirmed=? Filename=exec.exe Description=Related to BlueLight Internet. What does it do and is it required? Source=Paul Collins Startup list [BlueSoleil] Number=1113 Confirmed=U Filename=BLUESO~1.EXE Description=BlueSoleil Bluetooth wireless manager from IVT Corporation Source=Paul Collins Startup list [BlueSpace NE] Number=1114 Confirmed=U Filename=BlueSpaceNE.exe Description="BlueSpace NE is a utility program used to run the Bluetooth function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter". Shortcut available via Start -> Programs Source=Paul Collins Startup list [BlueToothAuthentication Agent] Number=1115 Confirmed=U Filename=RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Description=Associated with BlueTooth software, designed to allow bluetooth mobile devices to authenticate to the computer, when connecting a PDA to your computer - necessary for the computer and the PDA to communicate. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup Source=Paul Collins Startup list [Blueyonder Instant Support Tool] Number=1116 Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system\'s identity like your name email address, city, state, etc and gets written to a log file". Blueyonder Instant Support is required to run with the Help and Support program. If you uncheck it and and then run Help and Support it will add another Blueyonder Instant Support in the startup menu. If you remove Blueyonder Instant Support in add/remove programs some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [BMail Installation] Number=1117 Confirmed=N Filename=FTP_back.exe Description=Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not Source=Paul Collins Startup list [Bman] Number=1118 Confirmed=X Filename=BMan1.exe Description=Abcsearch.com/DealHelper adware variant Source=Paul Collins Startup list [BMMGAG] Number=1119 Confirmed=U Filename=Rundll32 PWRMONIT.DLL, StartPwrMonitor Description=Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery information window Source=Paul Collins Startup list [BMMLREF] Number=1120 Confirmed=U Filename=BMMLREF.EXE Description=Battery Manager for IBM ThinkPad laptops Source=Paul Collins Startup list [BMMMONWND] Number=1121 Confirmed=? Filename=rundll32.exe [path] BatInfEx.dll, BMMAutonomicMonitor Description=IBM Thinkpad related. What does it do and is it required? Source=Paul Collins Startup list [BMO MasterCard Wallet] Number=1122 Confirmed=U Filename=EWALLET.EXE Description=The wallet conveniently stores billing, shipping and payment information on your PC Source=Paul Collins Startup list [BMupdate] Number=1123 Confirmed=N Filename=BMupdate.exe Description=Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example, and you install the driver self-install Source=Paul Collins Startup list [BMZ] Number=1124 Confirmed=X Filename=bmz.exe Description=NCase adware Source=Paul Collins Startup list [Bndt32] Number=1125 Confirmed=X Filename=Bndt32.exe Description=Added by the LACON WORM! Source=Paul Collins Startup list [Bnexe] Number=1126 Confirmed=X Filename=[random filename] Description=Added by the KITRO.D (or ARGEN.A) WORM! Source=Paul Collins Startup list [BO1HelperStartUp] Number=1127 Confirmed=U Filename=BO1HEL~1.EXE Description=ScreenScenes "Butterfly Oasis" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [BO1HelperStartUp] Number=1128 Confirmed=U Filename=Bo1helper.exe Description=ScreenScenes "Butterfly Oasis" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [Boarddata] Number=1129 Confirmed=X Filename=[path] repcale.exe [path] palsp.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [boby] Number=1130 Confirmed=X Filename=csrs.scr Description=Added by the BANCBAN-PC TROJAN! Source=Paul Collins Startup list [BOC412] Number=1131 Confirmed=Y Filename=BOC412.exe Description=Version 4.12 of NSClean's BOClean anti-trojan software Source=Paul Collins Startup list [BOCleanautostart] Number=1132 Confirmed=Y Filename=Boclean.exe Description=NSClean's BOClean anti-trojan software Source=Paul Collins Startup list [BOINC Manager] Number=1133 Confirmed=U Filename=boincmgr.exe Description=BOINC manager - "controls the use of your computer's disk, network, and processor resources" Source=Paul Collins Startup list [Boingo Wireless Utility] Number=1134 Confirmed=U Filename=Icon###XXX#X#.exe Description=Starts the Boingo Wireless utility, used to detect and login into Boingo wireless hotspots. The filename may be autogenerated when installing, two different variations along the lines listed here, where # is a number and X is a letter. Shortcut available via Start -> Programs Source=Paul Collins Startup list [boler.exe] Number=1135 Confirmed=X Filename=syser.exe Description=Added by the RBOT-AYS WORM! Source=Paul Collins Startup list [bombshel] Number=1136 Confirmed=U Filename=BOMB32.EXE Description=Part of McAfee Nuts & Bolts. Protects your Windows system from application failure and crashes - similar to Norton Crashguard. Your choice - may cause problems Source=Paul Collins Startup list [Bonzi Buddy] Number=1137 Confirmed=X Filename=?? Description=Bonzi Buddy adware - see here for removal instructions Source=Paul Collins Startup list [boo] Number=1138 Confirmed=X Filename=boo.exe Description=Adware downloader - recognized by Kaspersky antivirus as the FAVADD.O TROJAN! Source=Paul Collins Startup list [BookedSpace] Number=1139 Confirmed=X Filename=RunDLL32.EXE [path] bs2.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [BookmarkCentral] Number=1140 Confirmed=N Filename=BMLauncher.exe Description=Bookmark Express - "offers a more flexible way to manage Web site bookmarks, regardless of which browser you use" Source=Paul Collins Startup list [BookMarkSink] Number=1141 Confirmed=N Filename=syncit.exe Description=Bookmark synchronization utility Source=Paul Collins Startup list [BookMarkSync] Number=1142 Confirmed=N Filename=syncit.exe Description=Sync2IT BookMarkSync - "real-time automatic synchronization service that allows you to access your bookmarks, favorites and favorite files from any computer or any browser". Only installed with the users explicit permission and generally only remains running if the user decides to subscribe to the service. If it is no longer required it should be uninstalled to prevent a large number of clients 'checking in' to the server that have no chance of synchronizing Source=Paul Collins Startup list [BookMarkSync2It] Number=1143 Confirmed=N Filename=sync2it.exe Description=Sync2IT BookMarkSync - "real-time automatic synchronization service that allows you to access your bookmarks, favorites and favorite files from any computer or any browser". Only installed with the users explicit permission and generally only remains running if the user decides to subscribe to the service. If it is no longer required it should be uninstalled to prevent a large number of clients 'checking in' to the server that have no chance of synchronizing Source=Paul Collins Startup list [Boost XP Service] Number=1144 Confirmed=U Filename=bxservice.exe Description=Boost XP from Systweak - WinXP tweaking utility Source=Paul Collins Startup list [boot] Number=1145 Confirmed=X Filename=boot.exe Description=Added by the PUPPET-A TROJAN! Located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Boot] Number=1146 Confirmed=U Filename=Boot.exe Description=Part of Acer Empowering Technology. "Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles, or to create their own customized profiles". Located in the "Acer\Empowering Technology\ePower" directory Source=Paul Collins Startup list [Boot Check] Number=1147 Confirmed=X Filename=bootchk.exe Description=Added by the DELBOT-AB WORM! Source=Paul Collins Startup list [Boot Manager] Number=1148 Confirmed=X Filename=Njgal.exe Description=Added by the KILO TROJAN! Source=Paul Collins Startup list [Boot Manager] Number=1149 Confirmed=X Filename=bootmng.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [BootCfg] Number=1150 Confirmed=X Filename=Install.log.vbs Description=Added by the YPSAN.D WORM! Source=Paul Collins Startup list [BootCTRL] Number=1151 Confirmed=X Filename=bootctrl.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [BootLoader] Number=1152 Confirmed=X Filename=BootLoader.exe.vbs Description=Added by the WATERWORKS WORM! Source=Paul Collins Startup list [bootpd.exe] Number=1153 Confirmed=X Filename=bootpd.exe Description=Added by the AGENT-DT TROJAN! Source=Paul Collins Startup list [BootsCfg] Number=1154 Confirmed=X Filename=Date.POP.vbs Description=Added by the KUULLIO WORM! Source=Paul Collins Startup list [BootsCfg] Number=1155 Confirmed=X Filename=wscript.exe [path] All Users.vbs Description=Added by the SPILTRON WORM! Source=Paul Collins Startup list [BootsCfg] Number=1156 Confirmed=X Filename=wscript.exe [path] All Users.vbe Description=Added by the SPILTRON WORM! Source=Paul Collins Startup list [BootsCfg] Number=1157 Confirmed=X Filename=wscript.exe [path] Install.log.vbs Description=Added by the YPSAN.E WORM! Source=Paul Collins Startup list [BootStatus] Number=1158 Confirmed=U Filename=BOOTST~1.EXE Description=Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it, it has no more effect on resources Source=Paul Collins Startup list [BootWarn] Number=1159 Confirmed=U Filename=BootWarn.exe Description=From here: "Norton AntiVirus Boot Warning. This program is installed as a startup item when you install Norton AntiVirus, and also sometimes when you do a LiveUpdate which updates Norton AntiVirus significantly enough that a reboot is needed to complete the installation. We believe its purpose to be to warn the end-user that he must reboot his PC before using Norton AntiVirus in those cases when a reboot did not happen with the result that Norton AntiVirus did not fully complete its installation or software updating. Recommendation : Start Norton AntiVirus from "Start \ Programs \ Norton AntiVirus". If Norton AntiVirus comes up without problems, then fix this entry from the Msconfig Startup tab - it was left behind by mistake and is no longer needed now that Norton AntiVirus is fully installed and opens without error messages" Source=Paul Collins Startup list [boot_reg] Number=1160 Confirmed=X Filename=[path to file] Description=Added by the BANCBAN-CA TROJAN! Source=Paul Collins Startup list [Bose Wave/PC Monitor] Number=1161 Confirmed=N Filename=wavepcmonitor.exe Description=System Tray access for this system (more info on the system here). Available via Start -> Programs Source=Paul Collins Startup list [BossIdea] Number=1162 Confirmed=X Filename=winlogin.exe Description=Added by the LINEAGE-I TROJAN! Source=Paul Collins Startup list [Boston] Number=1163 Confirmed=? Filename=Boston.exe Description=Part of the Boston Acoustics USB speaker systems. What does it do and is it required? Source=Paul Collins Startup list [Bot Loader] Number=1164 Confirmed=X Filename=svchostt.exe Description=Added by the GAOBOT.ALV WORM! Source=Paul Collins Startup list [Bouncer RunStartup] Number=1165 Confirmed=X Filename=bouncer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [Bouncer RunStartup] Number=1166 Confirmed=X Filename=LiveUpdate.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [boy lovers of bsd] Number=1167 Confirmed=X Filename=ilikeboys.exe Description=Added by the MYTOB.LY WORM! Source=Paul Collins Startup list [bpcpost.exe] Number=1168 Confirmed=U Filename=bpcpost.exe Description=MS TV Viewer Post Setup Program. Part of MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [BPCv2 re] Number=1169 Confirmed=X Filename=bpc2 re inst.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [BPK] Number=1170 Confirmed=U Filename=bpk.exe Description=Blazing Tools Perfect Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [BPServer] Number=1171 Confirmed=N Filename=G6FTPSrv.exe Description=BulletProof FTP Server Source=Paul Collins Startup list [BQTray.exe] Number=1172 Confirmed=U Filename=BQTray.exe Description=System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility, hence the U recommendation. Create your own desktop shortcut to start manually Source=Paul Collins Startup list [Brasil] Number=1173 Confirmed=X Filename=Brasil.exe Description=Added by the OPASERV.E WORM! Source=Paul Collins Startup list [Brasil] Number=1174 Confirmed=X Filename=BRASIL.PIF Description=Added by the OPASERV.E WORM! Source=Paul Collins Startup list [BrasilOld] Number=1175 Confirmed=X Filename=[worm filename] Description=Added by the OPASERV.P WORM! Source=Paul Collins Startup list [BraveSentry] Number=1176 Confirmed=N Filename=BraveSentry.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Brct] Number=1177 Confirmed=X Filename=trdb.exe Description=Recognized by Kaspersky antivirus as the PurityScan.y TROJAN! Source=Paul Collins Startup list [Break_Reminder] Number=1178 Confirmed=U Filename=BREAK REMINDER.exe Description=Break Reminder - Remind yourself to take breaks to prevent computer related injuries. See here Source=Paul Collins Startup list [Breg] Number=1179 Confirmed=X Filename=bcre.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [Breg] Number=1180 Confirmed=X Filename=bptre.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [Breg] Number=1181 Confirmed=X Filename=breg.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [Bridge] Number=1182 Confirmed=X Filename=rundll32.exe ...Bridge.dll Description=Flingstone.com browser hijacker Source=Paul Collins Startup list [Brindys BriTray] Number=1183 Confirmed=Y Filename=BRITRAY.EXE Description=Main process for the following applications: GEDEX, SICARIO, BRINOTES, BRIRESPA, SICURE, TRASGO, UNDOCS, FRESH & BRIFAME (all of them from Brindys Software). Performs the following tasks [un]installation, web software autoupdate, notification windows, interprocess communication, tray bar icons & menus, alarms (brinotes), and common web launching from the mentioned applications. Can be stopped safely once run if so desired Source=Paul Collins Startup list [BrmfRmPA] Number=1184 Confirmed=U Filename=BrmfRmPA.exe Description=Brother resource manager - needed for a Brother MFC printer/copiert/scanner and PC to properly communicate Source=Paul Collins Startup list [Broadband Wizard] Number=1185 Confirmed=N Filename=bbwiz.exe Description=Starts Broadband Wizard so it runs in the System Tray. This application tests and optimizes your Cable or DSL connection. Available via Start -> Programs Source=Paul Collins Startup list [Broadcom Wireless Manager UI] Number=1186 Confirmed=U Filename=bcmntray.exe Description=Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [Broadcom Wireless Manager UI] Number=1187 Confirmed=N Filename=wltray.exe Description=System tray access to wireless LAN card configuration options Source=Paul Collins Startup list [Bron-Spizaetus] Number=1188 Confirmed=X Filename=CVT.exe Description=Added by the RONTOKBRO WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1189 Confirmed=X Filename=norBtok.exe Description=Added by the RONTOKBRO.B WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1190 Confirmed=X Filename=[path to file] Description=Added by the BRONTOK-F WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1191 Confirmed=X Filename=bronstab.exe Description=Added by the RONTOKBRO.C WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1192 Confirmed=X Filename=eksplorasi.exe Description=Added by the RONTOKBRO.J WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1193 Confirmed=X Filename=ElnorB.exe Description=Added by the RONTOKBRO.D WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1194 Confirmed=X Filename=sempalong.exe Description=Added by the BRONTOK-E WORM! Source=Paul Collins Startup list [Bron-Spizaetus] Number=1195 Confirmed=X Filename=RakyatKelaparan.exe Description=Added by the BRONTOK-J or BRONTOK-L WORMS! Source=Paul Collins Startup list [Bron-Spizaetus-5118REPM] Number=1196 Confirmed=X Filename=komodo-6321422.exe Description=Added by the BRONTOK-R WORM! Source=Paul Collins Startup list [Bron-Spizaetus-cfgmktoq] Number=1197 Confirmed=X Filename=bbm-qotkmgfc.exe Description=Added by the BRONTOK-M WORM! Source=Paul Collins Startup list [Bron-Spizaetus-cfgmmnru] Number=1198 Confirmed=X Filename=bbm-urnmmgfc.exe Description=Added by the BRONTOK-N WORM! Source=Paul Collins Startup list [BrowseProxy] Number=1199 Confirmed=X Filename=FindService.exe Description=Actual Names (AdvSearch) Internet Keywords parasite Source=Paul Collins Startup list [browser] Number=1200 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [browser] Number=1201 Confirmed=X Filename=s_menu.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [browser] Number=1202 Confirmed=X Filename=browse.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [browser] Number=1203 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [browser] Number=1204 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [browser aid] Number=1205 Confirmed=X Filename=browseraid.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Browser Help Svc] Number=1206 Confirmed=X Filename=BHSV.EXE Description=Added by the RBOT-AVQ WORM! Source=Paul Collins Startup list [Browser Hijack Blaster] Number=1207 Confirmed=Y Filename=bhblaster.exe Description=Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings. Now replaced by SpywareGuard Source=Paul Collins Startup list [Browser Launcher] Number=1208 Confirmed=U Filename=Commandr.exe Description=Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys Source=Paul Collins Startup list [Browser Pal] Number=1209 Confirmed=X Filename=adblck.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Browser Sentinel] Number=1210 Confirmed=U Filename=BrowserSentinel.exe Description=Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer, add itself to the Windows auto-run list or change your home page Source=Paul Collins Startup list [BrowserUpdateSched] Number=1211 Confirmed=X Filename=qwinnsap.exe Description=ZenoSearch adware Source=Paul Collins Startup list [BrowserUpdateSched] Number=1212 Confirmed=X Filename=twinorag.exe Description=ZenoSearch adware Source=Paul Collins Startup list [BrowserWebCheck] Number=1213 Confirmed=N Filename=loadwc.exe Description=Checks to make sure that IE is still your default browser Source=Paul Collins Startup list [brwdiag] Number=1214 Confirmed=X Filename=[path to worm] Description=Added by the STRATIO-BN WORM! Source=Paul Collins Startup list [BS Player] Number=1215 Confirmed=N Filename=bsplayer.exe Description=BSplayer - A video player used to play avi, mpg, wmv and other multimedia files Source=Paul Collins Startup list [BsCLiP] Number=1216 Confirmed=N Filename=BSCLIP.exe Description=CD recording utility that comes with a lot of CDR/CDRW drives and isn't required Source=Paul Collins Startup list [Bsoft lppt01] Number=1217 Confirmed=X Filename=Bsoft.exe Description=RapidBlaster variant (in a "BelmontSoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [bsplayer] Number=1218 Confirmed=N Filename=bsplayer.exe Description=BSplayer - a video player used to play avi, mpg, wmv and other multimedia files Source=Paul Collins Startup list [BSserver] Number=1219 Confirmed=X Filename=FileKan.exe Description=Added by the VB.CBW WORM! Source=Paul Collins Startup list [BSVCHOST] Number=1220 Confirmed=X Filename=SVCH0ST.EXE Description=Added by the VOXOM TROJAN! Source=Paul Collins Startup list [Bsx3] Number=1221 Confirmed=X Filename=RunDLL32.EXE [path] bs3.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [BT] Number=1222 Confirmed=X Filename=[path to trojan] Description=Added by the LITEBOT-B TROJAN! Source=Paul Collins Startup list [BT Broadband Help] Number=1223 Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". BT Broadband Help is required to run with the Help and Support program. If you uncheck BT Broadband Help and and then run Help and Support it will add another BT Broadband Help in the startup menu. If you remove the BT Broadband Help in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [BT00003*] Number=1224 Confirmed=X Filename=abcdefg23.exe Description=Added by the VB-VT TROJAN where * = 5,6 or 7! Source=Paul Collins Startup list [BT00003*] Number=1225 Confirmed=X Filename=hiklmnop27.exe Description=Added by the VB-VT TROJAN where * = 2,3 or 4! Source=Paul Collins Startup list [btbb_wcm_McciTrayApp] Number=1226 Confirmed=U Filename=McciTrayApp.exe Description=System tray access to Motive's Broadband 2.0 configuration and repair utility Source=Paul Collins Startup list [btinst] Number=1227 Confirmed=? Filename=btinst.exe Description=Associated with an Anycom bluetooth wireless card. What does it do and is it required? Source=Paul Collins Startup list [BTModemProtection] Number=1228 Confirmed=U Filename=BTModemProtection.exe Description=BT Privacy Online modem protection software, see here Source=Paul Collins Startup list [BTopenworld] Number=1229 Confirmed=U Filename=DialBTYahoo.exe Description=BT Yahoo! internet connection manager Source=Paul Collins Startup list [BTSETBOOTKEY] Number=1230 Confirmed=? Filename=BTSetBootKey.exe Description=Related to a USB Bluetooth adaptor. What does it do and is it required? Source=Paul Collins Startup list [BtStart] Number=1231 Confirmed=U Filename=btstart.exe Description=Broadcom (formerly WIDCOMM) Bluetooth Connectivity Software Source=Paul Collins Startup list [bttray] Number=1232 Confirmed=U Filename=bttray.exe Description=System tray icon which shows the status of a BlueTooth wireless module. Most systems with such a module installed can enable/disable the module. The system tray icon changes from blue/white to blue/red when the module is turned off. Allows access to explore bluetooth places, setup wizard, advanced configuration, quick connect and shutdown device Source=Paul Collins Startup list [BTUSRBDG] Number=1233 Confirmed=Y Filename=BtUsrBdg.exe Description=Used with a Mitsumi USB Bluetooth adaptor (and maybe others) Source=Paul Collins Startup list [BTUSRBDGF] Number=1234 Confirmed=Y Filename=BtUsrBdg.exe Description=Used with a Mitsumi USB Bluetooth adaptor (and maybe others) Source=Paul Collins Startup list [BTV] Number=1235 Confirmed=X Filename=btv.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [Buddyizer] Number=1236 Confirmed=N Filename=Buddyizer.exe Description=Part of the AIMster Peer to Peer (P2P) file sharing application that runs over the AOL Instant Messenger network Source=Paul Collins Startup list [BUFFALO Power Save Utility for HD] Number=1237 Confirmed=U Filename=HDManage.exe Description=Power Save utility for Buffalo backup hard discs Source=Paul Collins Startup list [bugwatcher service] Number=1238 Confirmed=U Filename=bugwatcher.exe Description=Bugtoaster is a service that sends reports on system/program crashes (certain types) back to Bugtoaster. They relay information to program authors and provide, if available, any known solutions to the crashes. It doesn't take up any room in memory, just activates in the event of certain program failures Source=Paul Collins Startup list [BuildBU] Number=1239 Confirmed=N Filename=bldbubg.exe Description=Part of Dell Alerts which provides customers with an update on latest updates for his/her system Source=Paul Collins Startup list [BuildLab] Number=1240 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [BuildLab] Number=1241 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [BuildLabs] Number=1242 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [BuildLabs] Number=1243 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [Bulldog Service] Number=1244 Confirmed=U Filename=upsd.exe Description=Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link Source=Paul Collins Startup list [BulletProof FTP Server] Number=1245 Confirmed=N Filename=bpftpserver.exe Description=BulletProof FTP Server Source=Paul Collins Startup list [BullGuard] Number=1246 Confirmed=Y Filename=mgui.exe Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullGuard] Number=1247 Confirmed=Y Filename=BullGuard.exe Description=Part of BullGuard antivirus Source=Paul Collins Startup list [BullGuard Update] Number=1248 Confirmed=U Filename=avxlive.exe Description=Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions Source=Paul Collins Startup list [BullGuard XComm] Number=1249 Confirmed=Y Filename=XCOMMSVR.EXE Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullGuardInit] Number=1250 Confirmed=Y Filename=AVXINIT.EXE Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullguardoptIn] Number=1251 Confirmed=Y Filename=bulldownload.exe Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullsEye] Number=1252 Confirmed=X Filename=bargains.exe Description=BargainBuddy adware Source=Paul Collins Startup list [BullsEye Network] Number=1253 Confirmed=X Filename=bargains.exe Description=BargainBuddy adware Source=Paul Collins Startup list [BullsEye Tracker] Number=1254 Confirmed=? Filename=BeTrack.exe Description=Bullseye - intelligent research assistant Source=Paul Collins Startup list [Bunx] Number=1255 Confirmed=X Filename=beagle.exe Description=Added by the LEBREAT-E WORM! Source=Paul Collins Startup list [BurnQuick Queue] Number=1256 Confirmed=N Filename=BQTray.exe Description=System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility, hence the U recommendation. Create your own desktop shortcut to start manually Source=Paul Collins Startup list [Button Server] Number=1257 Confirmed=U Filename=bttnserv.exe Description=Found on a Compaq PC, for the extra buttons on the keyboard for the speaker volume, media player, sleep and internet buttons. If the buttons aren't used on the keyboard or your's doesn't have them, then it isn't required Source=Paul Collins Startup list [ButtonKey] Number=1258 Confirmed=N Filename=ButtonKey.exe Description=CyberView TWAIN driver for the Pacific Image range of 35mm film scanners. Enables the one touch scanning button and places an icon an the System Tray. Use your scanners software or run it manually by creating a shortcut Source=Paul Collins Startup list [Buzme] Number=1259 Confirmed=N Filename=Bmui.exe Description=Buzme by RingCentral, Inc - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem Source=Paul Collins Startup list [BuzMe] Number=1260 Confirmed=U Filename=RCUI.exe Description=Display Client for the BuzMe Internet Call Waiting Service Source=Paul Collins Startup list [Buzof.exe] Number=1261 Confirmed=U Filename=buzof.exe Description=Buzof from Basta Computing "enables you to automatically answer, close or minimize virtually any recurring window including messages, prompts, and dialog boxes" Source=Paul Collins Startup list [bxproxy] Number=1262 Confirmed=X Filename=bxproxy.exe Description=Added by the BXPROXY TROJAN! Source=Paul Collins Startup list [bxsx5] Number=1263 Confirmed=X Filename=RunDLL32.EXE [path] bsx5.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [bxxs5] Number=1264 Confirmed=X Filename=RunDLL32.EXE [path] bxxs5.dll, dllrun Description=BookedSpace parasite Source=Paul Collins Startup list [Bymer.Scanner] Number=1265 Confirmed=X Filename=Wininit.exe Description=Added by the BYMER WORM! Source=Paul Collins Startup list [Bymer.Scanner] Number=1266 Confirmed=X Filename=Msinit.exe Description=Added by the BYMER WORM! Source=Paul Collins Startup list [c] Number=1267 Confirmed=X Filename=c:\archiv~1\win.com Description=Added by the CUYDOC TROJAN! Source=Paul Collins Startup list [C-Media Echo Control] Number=1268 Confirmed=U Filename=EchoCtrl.exe Description=C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer Source=Paul Collins Startup list [C-Media Mixer] Number=1269 Confirmed=N Filename=Mixer.exe Description=C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs Source=Paul Collins Startup list [C2K] Number=1270 Confirmed=U Filename=CYB2K.EXE Description=CYBERsitter 2000 or 2001 - anti-adult content filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser Source=Paul Collins Startup list [c32cs2] Number=1271 Confirmed=U Filename=c32cs2.exe Description=Cyber Sentinel - internet filtering software Source=Paul Collins Startup list [C7] Number=1272 Confirmed=X Filename=[path to worm] Description=Added by the MEDIAKILL.A WORM! Source=Paul Collins Startup list [C:\WINDOWS\IEXPLOR.EXE] Number=1273 Confirmed=X Filename=IEXPLOR.EXE Description="Pop Marketing" adware Source=Paul Collins Startup list [C:\WINDOWS\WinTask.exe] Number=1274 Confirmed=X Filename=WinTask.exe Description="Pop Marketing" adware Source=Paul Collins Startup list [CA-AMAgent] Number=1275 Confirmed=U Filename=amagent.exe Description=Unicenter Asset Management is a solution for proactively managing IT assets in a business environment. It provides full-featured asset tracking capabilities through automated discovery, hardware inventory, network inventory, software inventory, configuration management, software usage monitoring, license management and extensive cross-platform reporting Source=Paul Collins Startup list [CaAvTray] Number=1276 Confirmed=Y Filename=CAVTray.exe Description=eTrust� EZ Antivirus system tray application from Computer Associates Source=Paul Collins Startup list [Cabchk] Number=1277 Confirmed=X Filename=Cabchk.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Cabchk32] Number=1278 Confirmed=X Filename=Cabchk32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [CABCInstall] Number=1279 Confirmed=X Filename=CABCInstall.exe Description=Ignite Technologies (was CABC) content delivery software Source=Paul Collins Startup list [CacheBoost] Number=1280 Confirmed=U Filename=trayicon.exe Description=CacheBoost "optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers, resulting in a performance boost" Source=Paul Collins Startup list [CacheLoader] Number=1281 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-NZ TROJAN! Source=Paul Collins Startup list [Cacheman] Number=1282 Confirmed=N Filename=Cacheman.exe Description=Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up Source=Paul Collins Startup list [CacheMgr] Number=1283 Confirmed=Y Filename=CacheMgr.exe Description=Sophos Antivirus Remote Update Source=Paul Collins Startup list [CacheSentry Pro] Number=1284 Confirmed=U Filename=CacheSentry Pro.exe Description="CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache" Source=Paul Collins Startup list [CacheSentry Pro] Number=1285 Confirmed=U Filename=CacheSentry Pro.exe Description="CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache" Source=Paul Collins Startup list [CACStarter] Number=1286 Confirmed=N Filename=cacstart.exe Description=Cash A Check - check writing software Source=Paul Collins Startup list [Caddais BackupOnDemand] Number=1287 Confirmed=U Filename=BODMon.exe Description=Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" Source=Paul Collins Startup list [Cadenza] Number=1288 Confirmed=U Filename=CdzSvc.exe Description=Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices Source=Paul Collins Startup list [CADS] Number=1289 Confirmed=U Filename=cads.exe Description=Cyber Sentinel - internet filtering software Source=Paul Collins Startup list [CafeStation] Number=1290 Confirmed=U Filename=CafeStation.exe Description="CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations, manage customer database, sell products and generate detailed reports and statistics" Source=Paul Collins Startup list [CAgent] Number=1291 Confirmed=N Filename=CAgent.exe Description=Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents Source=Paul Collins Startup list [cAgOu] Number=1292 Confirmed=X Filename=[filename].hta Description=Added by the KAKWORM WORM! Source=Paul Collins Startup list [CahootWebcard] Number=1293 Confirmed=N Filename=CahootWebcard.exe Description="The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details". Run manually when needed Source=Paul Collins Startup list [caidiysetup] Number=1294 Confirmed=X Filename=diynetsetupuni.exe Description=DIYNet adware Source=Paul Collins Startup list [CAISafe] Number=1295 Confirmed=Y Filename=isafe.exe Description=Part of Computer Associates eTrust EZ Antivirus Source=Paul Collins Startup list [CaISSDT] Number=1296 Confirmed=U Filename=caissdt.exe Description=Computer Associates Dashboard Tray applet Source=Paul Collins Startup list [Cal Reminder Shortcut] Number=1297 Confirmed=N Filename=calrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Office Calendar Source=Paul Collins Startup list [Calc Microsoft Windows] Number=1298 Confirmed=X Filename=wincalc.exe Description=Added by an unidentied WORM or TROJAN! Source=Paul Collins Startup list [CALC32] Number=1299 Confirmed=X Filename=CALC32.EXE Description=Added by the SPYBOT-EC WORM! Source=Paul Collins Startup list [Calendar 200X Reminder] Number=1300 Confirmed=N Filename=calendar.exe Description=Calendar 200X - shows holidays, reminders of various anniversaries,tasks etc Source=Paul Collins Startup list [Calendarscope] Number=1301 Confirmed=U Filename=cs.exe Description=Calendarscope calendar software Source=Paul Collins Startup list [calk] Number=1302 Confirmed=X Filename=calk.exe Description=Added by the STARTPA-FH TROJAN! Source=Paul Collins Startup list [Call32] Number=1303 Confirmed=X Filename=Call32.exe Description=Added by the SPAMMIT-H TROJAN! Source=Paul Collins Startup list [CallBumping] Number=1304 Confirmed=Y Filename=cbpopw.exe Description=Related to the Gazel 128 PCI ISDN adapter. Required if you use it Source=Paul Collins Startup list [CallCenter Main Application] Number=1305 Confirmed=U Filename=V3calmcp.exe Description="V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answering machine capability, and sophistcated data communications." Main application Source=Paul Collins Startup list [CallCenter Printer Interface] Number=1306 Confirmed=U Filename=V3faxecp.exe Description="V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answering machine capability, and sophistcated data communications." Fax printer Source=Paul Collins Startup list [CallControl] Number=1307 Confirmed=N Filename=ftctrl32.exe Description=FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows Source=Paul Collins Startup list [CamCheck] Number=1308 Confirmed=N Filename=CamCheck.exe Description=NuCam camera software related Source=Paul Collins Startup list [Cameno] Number=1309 Confirmed=U Filename=Cameno.exe Description=Cameno is a program which brings tabbed windows to MSN Messenger 6.0 and above Source=Paul Collins Startup list [Camera Detector] Number=1310 Confirmed=U Filename=CAMDET~*.EXE Description=ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically Source=Paul Collins Startup list [Camera Detector] Number=1311 Confirmed=U Filename=Camdetect.exe Description=ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically Source=Paul Collins Startup list [Camera Detector] Number=1312 Confirmed=U Filename=DEVDET~*.EXE Description=ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically Source=Paul Collins Startup list [Camio Viewer x] Number=1313 Confirmed=N Filename=IXApplet.exe Description=Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version Source=Paul Collins Startup list [CamMonitor] Number=1314 Confirmed=? Filename=hpqcmon.exe Description=From HP and related to digital imaging Source=Paul Collins Startup list [Canada] Number=1315 Confirmed=N Filename=Canada.exe Description=Known to be a dialler - but is it maliscous or clean? Source=Paul Collins Startup list [Canary] Number=1316 Confirmed=U Filename=canary-std.exe Description=Canary keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [candy] Number=1317 Confirmed=X Filename=command32.exe Description=Added by the RBOT-LV WORM! Source=Paul Collins Startup list [candynet] Number=1318 Confirmed=X Filename=Taskmsg.exe Description=Added by the RBOT-NA WORM! Source=Paul Collins Startup list [Canon MultiPASS Status Monitor] Number=1319 Confirmed=U Filename=monitr32.exe Description=Cannon Multi-Pass status monitor - your choice Source=Paul Collins Startup list [Canon PC1200 iC D600 iR1200G Status Window] Number=1320 Confirmed=? Filename=CAPM1LAK.EXE Description=Cannon printer related - is it required in startup? Source=Paul Collins Startup list [Canon Printer Monitor BJCxxx] Number=1321 Confirmed=N Filename=Cjstlst.exe Description=Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs Source=Paul Collins Startup list [CAP3ON] Number=1322 Confirmed=? Filename=CAP3ONN.EXE Description=Canon driver, purpose unknown. Is it required in startup? Source=Paul Collins Startup list [Capfax] Number=1323 Confirmed=N Filename=capfax.exe Description=PhoneTools fax software Source=Paul Collins Startup list [CAPing] Number=1324 Confirmed=U Filename=CAPing.exe Description=Citibank Citianywhere software Source=Paul Collins Startup list [Capon] Number=1325 Confirmed=Y Filename=Capon.exe Description=Canon printer driver Source=Paul Collins Startup list [Capon] Number=1326 Confirmed=Y Filename=Caponn.exe Description=Canon printer driver Source=Paul Collins Startup list [CaptionMgr32] Number=1327 Confirmed=X Filename=crssr.exe Description=Added by the ZAR.A WORM! Source=Paul Collins Startup list [capture] Number=1328 Confirmed=X Filename=capture.exe Description=Added by the THEEF-B TROJAN! Source=Paul Collins Startup list [Capture Express 2000] Number=1329 Confirmed=N Filename=capexp.exe Description=Capture Express - screen capture utility Source=Paul Collins Startup list [Card Monitor] Number=1330 Confirmed=N Filename=REGCNT09.exe Description=For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs Source=Paul Collins Startup list [Care20] Number=1331 Confirmed=X Filename=Care20.exe Description=TopMoxie adware Source=Paul Collins Startup list [Care2GTU] Number=1332 Confirmed=U Filename=Care2GTU.exe Description=Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is, thanks to over 200 company profiles from Coop America. Saves 1 square foot of rainforest every day you use it. If it works and you like it, keep it Source=Paul Collins Startup list [carpserv] Number=1333 Confirmed=U Filename=carpserv.exe Description=Associated with Zoltrix and Conexant modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example Source=Paul Collins Startup list [CARPserver] Number=1334 Confirmed=X Filename=CARPserver.exe Description=Added by the BANKER-AN TROJAN! Source=Paul Collins Startup list [CARPservice] Number=1335 Confirmed=U Filename=carpserv.exe Description=Associated with Zoltrix and Conexant modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example Source=Paul Collins Startup list [cartao] Number=1336 Confirmed=X Filename=[path to file] Description=Added by the DLOADER-QD TROJAN! Source=Paul Collins Startup list [cartao] Number=1337 Confirmed=X Filename=conflicted.exe Description=Added by the DADOBRA-DV TROJAN! Source=Paul Collins Startup list [cartao] Number=1338 Confirmed=X Filename=killing.exe Description=Added by the DLOADER-QN TROJAN! Source=Paul Collins Startup list [CAS Client] Number=1339 Confirmed=X Filename=casclient.exe Description=CasinoClient adware Source=Paul Collins Startup list [Cas2Stub] Number=1340 Confirmed=X Filename=cas2stub.exe Description=CasinoClient adware Source=Paul Collins Startup list [CasAgnt] Number=1341 Confirmed=U Filename=CasAgnt.exe Description=Program by Extended Systems which allows you to sync your Casio PDA with your PC Source=Paul Collins Startup list [Casdvqwa] Number=1342 Confirmed=X Filename=bmqnzkg.exe Description=Added by the RANDEX.BE WORM! Source=Paul Collins Startup list [caseyvideo] Number=1343 Confirmed=X Filename=CaseyVideo.exe Description=Malware causing p0rn popups Source=Paul Collins Startup list [caseyvideo] Number=1344 Confirmed=X Filename=caseyvideo[*].exe [* = digit] Description=Malware causing p0rn popups Source=Paul Collins Startup list [CashBack] Number=1345 Confirmed=X Filename=cashback.exe Description=Part of eXact Advertising Software, consisting of "CashBack by BargainBuddy", BullsEye Network and NaviSearch Source=Paul Collins Startup list [CashFiesta] Number=1346 Confirmed=X Filename=Cashfiesta.exe Description=CASHFIESTA.A pay-per-surf adware Source=Paul Collins Startup list [Cashsurfers Cashbar Navigator] Number=1347 Confirmed=N Filename=Cashbar.Exe Description=Cashsurfers CashBar Navigator - "The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals" Source=Paul Collins Startup list [CashToolbar] Number=1348 Confirmed=X Filename=CD_Load.exe Description=CashToolbar Downloader-MY adware Source=Paul Collins Startup list [CashToolbar] Number=1349 Confirmed=X Filename=svchost.exe Description=CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Casino Royale] Number=1350 Confirmed=X Filename=jamesbond.exe Description=Added by the RBOT-FZO WORM! Source=Paul Collins Startup list [Cassandra] Number=1351 Confirmed=X Filename=[10 to 14 random char]THD.EXE Description=Added by the KREPPER-AI TROJAN! Source=Paul Collins Startup list [Cassandra] Number=1352 Confirmed=X Filename=cassandra.exe Description=SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN! Source=Paul Collins Startup list [CasStub] Number=1353 Confirmed=X Filename=casstub.exe Description=Added by the CASS-A TROJAN! Source=Paul Collins Startup list [Catalyst Control Centre] Number=1354 Confirmed=X Filename=atixvdm.exe Description=Added by the RBOT.DMW TROJAN! Source=Paul Collins Startup list [CAVRID] Number=1355 Confirmed=Y Filename=CAVRID.exe Description=eTrust� EZ Antivirus Real Time Infection Report from Computer Associates Source=Paul Collins Startup list [CAVS] Number=1356 Confirmed=Y Filename=CAVS.exe Description=Cheyenne (now eTrust) antivirus Source=Paul Collins Startup list [CAZNOVAS] Number=1357 Confirmed=X Filename=CAZNOVAS.exe Description=Added by the CAZNO TROJAN! Source=Paul Collins Startup list [CBACK.EXE] Number=1358 Confirmed=X Filename=CBACK.EXE Description=Added by the PENTA-A TROJAN! Source=Paul Collins Startup list [CBWAttn] Number=1359 Confirmed=U Filename=CBWAttn.exe Description=Required for Bitware to answer incoming faxes, can cause sleep mode problems Source=Paul Collins Startup list [CBWHost] Number=1360 Confirmed=U Filename=CBWHost.exe Description=Required for Bitware to answer incoming faxes, can cause sleep mode problems Source=Paul Collins Startup list [CBWUser] Number=1361 Confirmed=? Filename=CBWDial.exe Description=Associated with Bitware that integrates fax, voice, pager, and data communications on your desktop Source=Paul Collins Startup list [CC2KUI] Number=1362 Confirmed=X Filename=comet.exe Description=Comet Cursor adware Source=Paul Collins Startup list [Ccao] Number=1363 Confirmed=X Filename=regedit.exe Description=Probably a variant of MediaTickets adware. Note - this is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in a "mduu" subfolder, which may change Source=Paul Collins Startup list [ccApp] Number=1364 Confirmed=Y Filename=ccApp.exe Description=Part of Norton AntiVirus. Auto-protect and E-mail check will not function without this Source=Paul Collins Startup list [ccApp] Number=1365 Confirmed=X Filename=[random filename] Description=Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus Source=Paul Collins Startup list [ccApp] Number=1366 Confirmed=X Filename=WMADZ.EXE Description=Added by the RBOT-LJ WORM! Source=Paul Collins Startup list [ccApp] Number=1367 Confirmed=X Filename=.EXE Description=Added by the RBOT-LJ WORM! Source=Paul Collins Startup list [ccApp] Number=1368 Confirmed=X Filename=gcasServ.exe Description=Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name Source=Paul Collins Startup list [ccAppr] Number=1369 Confirmed=X Filename=svcrhost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccAppr] Number=1370 Confirmed=X Filename=expIorer.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccAppr] Number=1371 Confirmed=X Filename=outIook.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccAppr] Number=1372 Confirmed=X Filename=svcshost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccApps] Number=1373 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [ccApps] Number=1374 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [ccApps] Number=1375 Confirmed=X Filename=N/A Description=Added by the KANGAROO-A TROJAN! Source=Paul Collins Startup list [ccApps] Number=1376 Confirmed=X Filename=ccApps.exe Description=Added by the KANGAROO-B WORM! Source=Paul Collins Startup list [CCD Manager] Number=1377 Confirmed=U Filename=DDS.EXE Description=Project Labs Century CD manager for their CD/DVD storage device Source=Paul Collins Startup list [Ccdecode] Number=1378 Confirmed=N Filename=rundll32.exe streamci, StreamingDeviceSetup Description=Part of the closed caption decdoder/MS VBI codec. Should only run once Source=Paul Collins Startup list [CCDoctorLogonTesting] Number=1379 Confirmed=Y Filename=ccdoctor.exe Description=Checks your system to make sure it's configured properly for running IBM Rational ClearCase, a source code management tool. ClearCase is fairly sophisticated so there are a lot of system-related things that can cause it grief. If you run ClearCase you should not disable this as it provides a valuable service, but technically it isn't required to use the ClearCase product Source=Paul Collins Startup list [ccenter] Number=1380 Confirmed=Y Filename=CCenter.exe Description=RAV AntiVirus Source=Paul Collins Startup list [CcEvtMgr] Number=1381 Confirmed=Y Filename=ccEvtMgr.exe Description=Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via "ccApp" and was not required as a seperate entry but a recent update changed this Source=Paul Collins Startup list [ccEvtMrg.exe] Number=1382 Confirmed=X Filename=ccEvtMrg.exe Description=Added by the RBOT.GZ WORM! Source=Paul Collins Startup list [ccExecute] Number=1383 Confirmed=X Filename=bootcfg1.exe Description=Added by the NEMSI-B VIRUS! Source=Paul Collins Startup list [ccHelp] Number=1384 Confirmed=X Filename=ccHelp.hta Description="Searchq" adware Source=Paul Collins Startup list [ccleaner] Number=1385 Confirmed=U Filename=ccleaner.exe Description=CCleaner - removes unused files from your system Source=Paul Collins Startup list [ccpApps] Number=1386 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [ccpApps] Number=1387 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [ccProxy] Number=1388 Confirmed=U Filename=CCPROXY.EXE Description=Part of Norton Internet Security, proxy server that is used to support the parental controls. If you turn parental controls off at user level the process is not loaded. Reported to cause excessive CPU usage Source=Paul Collins Startup list [ccPrxy.exe] Number=1389 Confirmed=X Filename=ccPrxy.exe Description=Added by the SHIPUP-H WORM! Source=Paul Collins Startup list [CcPxySvc] Number=1390 Confirmed=Y Filename=CCPXYSVC.exe Description=Part of Norton's AntiVirus 2003, Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall Source=Paul Collins Startup list [ccreg] Number=1391 Confirmed=X Filename=explorer.exe Description=Added by the ZCREW TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder Source=Paul Collins Startup list [CcRegVfy] Number=1392 Confirmed=Y Filename=ccRegVfy.exe Description=Part of Norton AntiVirus 2003. "ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack" Source=Paul Collins Startup list [ccRegVfY] Number=1393 Confirmed=X Filename=expIorer.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccRegVfY] Number=1394 Confirmed=X Filename=svcrhost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccRegVfY] Number=1395 Confirmed=X Filename=svcshost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccRegVfY] Number=1396 Confirmed=X Filename=outIook.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [ccSetMgr] Number=1397 Confirmed=Y Filename=ccSetMgr.exe Description=Part of Norton AntiVirus 2004. What does it do? Source=Paul Collins Startup list [ccsvit.exe] Number=1398 Confirmed=X Filename=ccsvit.exe Description=Added by the STARTPA-HP TROJAN! Source=Paul Collins Startup list [cctray] Number=1399 Confirmed=U Filename=cctray.exe Description=Part of CA Internet Security Suite Source=Paul Collins Startup list [ccUpdate] Number=1400 Confirmed=X Filename=ccUpdate.exe Description=Added by the AGOBOT.YS WORM! Source=Paul Collins Startup list [ccWasher] Number=1401 Confirmed=U Filename=aolwasher.exe Description=Webroot Cache & Cookie Washer - cleaning browser tracks, including cache, cookies, history, mail trash, drop-down address bar, auto-complete forms and downloaded program files for IE, Netscape and AOL Source=Paul Collins Startup list [CCWC7a] Number=1402 Confirmed=U Filename=ac.exe Description=Moleculesoft Cache, Cookie & Windows Cleaner. No longer supported but available for free Source=Paul Collins Startup list [CCWC7I] Number=1403 Confirmed=U Filename=idxl.exe Description=Moleculesoft Cache, Cookie & Windows Cleaner. No longer supported but available for free Source=Paul Collins Startup list [CCWC7s] Number=1404 Confirmed=U Filename=stealth.exe Description=Moleculesoft Cache, Cookie & Windows Cleaner. No longer supported but available for free Source=Paul Collins Startup list [CD Storage Master] Number=1405 Confirmed=N Filename=cdstorager.exe Description=CD Storage Master - a program designed to catalog CD information, boasts a number of handy features for organizing your collection Source=Paul Collins Startup list [cd1] Number=1406 Confirmed=X Filename=cd1.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [CDANTSRV] Number=1407 Confirmed=N Filename=CDANTSRV.exe Description=C-Dilla License Management software. Used for any program that uses C-dilla Protection, example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually Source=Paul Collins Startup list [Cdcompat] Number=1408 Confirmed=X Filename=Cdcompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [cddrv32] Number=1409 Confirmed=X Filename=cddrv32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [CDInterceptor] Number=1410 Confirmed=N Filename=cdi.exe Description=CD indexer for measuring the speed of CD players Source=Paul Collins Startup list [CdnCtr] Number=1411 Confirmed=X Filename=cdnup.exe Description=CNNIC Update pest Source=Paul Collins Startup list [CDriver] Number=1412 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [Cdrom Controller] Number=1413 Confirmed=X Filename=cdromcntrl.exe Description=Added by the BATTRY-A TROJAN! Source=Paul Collins Startup list [cds] Number=1414 Confirmed=X Filename=cds.exe Description=Added by the SPYMON TROJAN! Source=Paul Collins Startup list [CDTray] Number=1415 Confirmed=N Filename=CDTray.exe Description=On HP PCs, this is the small CD icon next to the time Source=Paul Collins Startup list [CeEKEY] Number=1416 Confirmed=U Filename=CeEKey.exe Description=Hot Key utility included on Toshiba Satellite laptops Source=Paul Collins Startup list [CeEPOWER] Number=1417 Confirmed=U Filename=cepmtray.exe Description=Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed, Monitor Shut Off, Hard Drive Shut-Off, Monitor Brightness, System Stand-by and System Hibernate times Source=Paul Collins Startup list [Ceic] Number=1418 Confirmed=? Filename=Ceic.exe Description=?? Source=Paul Collins Startup list [Cekirge] Number=1419 Confirmed=X Filename=[path to worm] Description=Added by the KERGEZ.A WORM! Source=Paul Collins Startup list [center] Number=1420 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.A WORM! Source=Paul Collins Startup list [CentralProcessor] Number=1421 Confirmed=X Filename=taskimgr.exe Description=Added by the BANCOS.J TROJAN! Source=Paul Collins Startup list [CEPA] Number=1422 Confirmed=? Filename=wsot.exe Description=?? Source=Paul Collins Startup list [CertificateRegistration] Number=1423 Confirmed=U Filename=SafeSignCertReg.exe Description=SafeSign Certificate Registration Utility for Microsoft Crypto applications Source=Paul Collins Startup list [CertReg] Number=1424 Confirmed=U Filename=certreg.exe Description=Related to Gemplus Card Reader Source=Paul Collins Startup list [CertStoreInit] Number=1425 Confirmed=Y Filename=CertStoreInit Description=Aladdin eToken authentication and password management Source=Paul Collins Startup list [CesarFTP FTP Server] Number=1426 Confirmed=N Filename=server.exe Description=CesarFTPd - FTP server Source=Paul Collins Startup list [cesmain.dll] Number=1427 Confirmed=X Filename=cmail.dll, Rundll32 Description=CnsMin (Chinese Keywords) hijacker related Source=Paul Collins Startup list [CEventMgr] Number=1428 Confirmed=X Filename=Cell.exe Description=Added by the BIFROSE-AK TROJAN! Source=Paul Collins Startup list [CFD] Number=1429 Confirmed=N Filename=CFD.exe Description=BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs Source=Paul Collins Startup list [CFDStart] Number=1430 Confirmed=X Filename=WinMuschi.exe Description=WINMUSCHI dialler Source=Paul Collins Startup list [cfgboost] Number=1431 Confirmed=X Filename=cfgboot.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [cfgintpr] Number=1432 Confirmed=Y Filename=cfgintpr.exe Description=Configuration Interpreter - part of Tiny Personal Firewall V4 Source=Paul Collins Startup list [cfgmgr51] Number=1433 Confirmed=X Filename=RunDLL32.EXE [path] cfgmgr51.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [cfgmgr52] Number=1434 Confirmed=X Filename=RunDLL32.EXE [path] cfgmgr52.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [cfgwiz] Number=1435 Confirmed=N Filename=cfgwiz.exe Description=Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it Source=Paul Collins Startup list [cFosDNT] Number=1436 Confirmed=? Filename=cFosDNT.exe Description=cFos DSL Modem driver related. What does it do and is it required? Source=Paul Collins Startup list [cFosInst_Check] Number=1437 Confirmed=? Filename=cfosinst.exe Description=cFos DSL Modem driver related. What does it do and is it required? Source=Paul Collins Startup list [cFosSpeed] Number=1438 Confirmed=U Filename=cFosSpeed.exe Description=cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly Source=Paul Collins Startup list [CFSServ.exe] Number=1439 Confirmed=U Filename=CFSServ.exe Description=Belongs to Toshiba's configfree utility and searches for Wireless Devices Source=Paul Collins Startup list [cftmon32] Number=1440 Confirmed=X Filename=taskmgr*.exe [* = number] Description=Added by the SOWSAT.C and SOWSAT.J WORMS! Source=Paul Collins Startup list [cfy] Number=1441 Confirmed=X Filename=cfy.exe Description=Surfenhance.com SearchForIt adware variant Source=Paul Collins Startup list [CGI Firewall Script] Number=1442 Confirmed=X Filename=CGIAGENT.EXE Description=Added by the BROPIA-U WORM! Source=Paul Collins Startup list [CGServer] Number=1443 Confirmed=U Filename=cgserver.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs Source=Paul Collins Startup list [Cgtask Services] Number=1444 Confirmed=X Filename=cgtask.exe Description=Added by the LALA.B TROJAN! Source=Paul Collins Startup list [Cgywin] Number=1445 Confirmed=X Filename=cgywin32.exe Description=Added by the RBOT-AEI WORM! Source=Paul Collins Startup list [ChamClock] Number=1446 Confirmed=U Filename=ChamClock.exe Description=Chameleon Clock - system tray clock replacement Source=Paul Collins Startup list [change-me-now] Number=1447 Confirmed=X Filename=msgfix1.exe Description=Added by the SDBOT.ZD WORM! Source=Paul Collins Startup list [ChangeICON] Number=1448 Confirmed=U Filename=SPMSMON.EXE Description=Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem Source=Paul Collins Startup list [ChangeLines] Number=1449 Confirmed=? Filename=chngline.exe Description=?? Source=Paul Collins Startup list [Chatango] Number=1450 Confirmed=N Filename=Chatango.exe Description=Chatango - "allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions, blogs, personal websites, Friendster profiles, and your visitors will be able to contact you instantly, without downloading anything, or registering. Alo use it to send email to your friends, allowing them to respond to you in real time!." The 'MessageCatcher' icon in the System Tray notifies you when you get a message. When you get a message, a little alert pops up, which you can click on and start chatting immediately Source=Paul Collins Startup list [Chcenter] Number=1451 Confirmed=N Filename=chcenter.exe Description=IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" Source=Paul Collins Startup list [Chckup] Number=1452 Confirmed=X Filename=Netverchk.exe Description=Covert Sys Exec malware variant Source=Paul Collins Startup list [che32] Number=1453 Confirmed=X Filename=che.ocx.vbs Description=Added by the ADENU-B VIRUS! Source=Paul Collins Startup list [Cheatle] Number=1454 Confirmed=X Filename=GigaByte.exe Description=Added by the SHODI.B VIRUS! Source=Paul Collins Startup list [Check] Number=1455 Confirmed=X Filename=Check.exe Description=Added by the VB-DRN WORM! Source=Paul Collins Startup list [Check for One Touch Update] Number=1456 Confirmed=N Filename=wiseupdt.exe Description=Checks for updates for Visioneer OneTouch scanners Source=Paul Collins Startup list [Check for TWS Updates] Number=1457 Confirmed=N Filename=WiseUpdt.exe Description=Interactive Brokers - check for update to their standalone Java-based trading platform Source=Paul Collins Startup list [Check Messenger] Number=1458 Confirmed=U Filename=cmesseng.exe Description=Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness Source=Paul Collins Startup list [CheckCustomWorksUpdate] Number=1459 Confirmed=N Filename=CheckCWupdate.exe Description=Update checker, part of CustomWorks - "customize any embroidery designs to design your own unique creations" Source=Paul Collins Startup list [Checkdisk] Number=1460 Confirmed=X Filename=mscas.exe Description=Added by the VAGON-A TROJAN! Source=Paul Collins Startup list [CheckFaultKernel] Number=1461 Confirmed=X Filename=mswdm.exe Description=Added by the SMALL-CSK TROJAN! Source=Paul Collins Startup list [CheckIt] Number=1462 Confirmed=U Filename=ToolBox.exe Description=CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parameters at intervals you specify Source=Paul Collins Startup list [CheckIt 86] Number=1463 Confirmed=U Filename=CheckIt86.exe Description=CheckIt 86 popup blocker Source=Paul Collins Startup list [CheckMsgPlus] Number=1464 Confirmed=Y Filename=MsgPlusH.dll, VerifyInstallation Description=Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. Source=Paul Collins Startup list [checkrun] Number=1465 Confirmed=X Filename=elite***32.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [checkrun] Number=1466 Confirmed=X Filename=elitelsj32.exe Description=Added by the MULTIDR-ER TROJAN! Source=Paul Collins Startup list [CheckScan32] Number=1467 Confirmed=X Filename=regload16.exe Description=Added by the AEBOT.K WORM! Source=Paul Collins Startup list [checktime] Number=1468 Confirmed=? Filename=ct.exe Description=Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required? Source=Paul Collins Startup list [CheckVCR] Number=1469 Confirmed=Y Filename=IOMagic.exe Description=Driver for the I/OMagic Personal Video Recorder (DR-PCTV100) Source=Paul Collins Startup list [CherryKeyMan] Number=1470 Confirmed=U Filename=KeyMan.exe Description=Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys Source=Paul Collins Startup list [china11msn] Number=1471 Confirmed=X Filename=CHINA11MSN.EXE Description=Added by the ENVID.O WORM! Source=Paul Collins Startup list [ChineseStar] Number=1472 Confirmed=U Filename=cstar.exe Description=Chinese language support software Source=Paul Collins Startup list [CHIPDRIVEPinManager] Number=1473 Confirmed=U Filename=sokscmpn.exe Description=ChipDrive Smartcard software Source=Paul Collins Startup list [CHIPDRIVESmartcardManager] Number=1474 Confirmed=U Filename=SCMgr.exe Description=ChipDrive Smartcard software Source=Paul Collins Startup list [CHKADMIN] Number=1475 Confirmed=N Filename=CHKADMIN.EXE Description=Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" Source=Paul Collins Startup list [chkdsk] Number=1476 Confirmed=X Filename=autoexec.bat Description=Added by the ANPES WORM! Source=Paul Collins Startup list [Choke] Number=1477 Confirmed=X Filename=Choke.exe-blahh Description=Added by the CHOKE WORM! Source=Paul Collins Startup list [chope] Number=1478 Confirmed=X Filename=runlli32.exe Description=Added by the QQPASS-U TROJAN! Source=Paul Collins Startup list [chostsv] Number=1479 Confirmed=X Filename=chostsv.exe Description=Added by the BANPAES.C TROJAN! Source=Paul Collins Startup list [CHotKey] Number=1480 Confirmed=U Filename=mhotkey.exe Description=Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features Source=Paul Collins Startup list [CHotKey] Number=1481 Confirmed=U Filename=MK9805.EXE Description=Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features Source=Paul Collins Startup list [CHotKey] Number=1482 Confirmed=U Filename=zHotkey.exe Description=Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol , vol-, mute, etc. Only required for extended features Source=Paul Collins Startup list [Christmas Music Player] Number=1483 Confirmed=N Filename=TTEST6.EXE Description="Christmas Music Player brings the music of the Christmas Holiday to your desktop" Source=Paul Collins Startup list [ChromeMark] Number=1484 Confirmed=? Filename=keysh.exe Description=Related to this. Don't know what keysh.exe does though and if it's required Source=Paul Collins Startup list [ChronitelInitTV] Number=1485 Confirmed=? Filename=CHTVINIT.EXE Description=?? Source=Paul Collins Startup list [chrono] Number=1486 Confirmed=U Filename=chrono.exe Description=Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)." Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over Source=Paul Collins Startup list [CiaBackdoor] Number=1487 Confirmed=X Filename=msldr.com Description=Added by a VIRUS! Source=Paul Collins Startup list [cihost.exe] Number=1488 Confirmed=X Filename=cihost.exe Description=Added by the LINST TROJAN! Source=Paul Collins Startup list [CIJxP2PSERVER] Number=1489 Confirmed=N Filename=CIJxP2PS.EXE Description=Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 Source=Paul Collins Startup list [Cisco Systems VPN Client] Number=1490 Confirmed=U Filename=ipsecdialer.exe Description=Cisco VPN Client - lets local users gain Administrator privileges on the operating system Source=Paul Collins Startup list [Cisco Systems VPN Client] Number=1491 Confirmed=N Filename=vpngui.exe Description=Sets up IPSec communications for Cisco's VPN Client Source=Paul Collins Startup list [CISrvr Program] Number=1492 Confirmed=N Filename=CISRVR.EXE Description=Related to internet setup on Compaq PC's Source=Paul Collins Startup list [Cissi] Number=1493 Confirmed=X Filename=Cissi.exe Description=Added by the CISSI.A WORM! Source=Paul Collins Startup list [CitiUCS] Number=1494 Confirmed=U Filename=CitiUCS.exe Description=Citibank Virtual Account Numbers - "With this free service for Citi cardmembers, you never have to give out your real credit card number online" Source=Paul Collins Startup list [CitiVAN] Number=1495 Confirmed=N Filename=CitiVAN.exe Description=Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again Source=Paul Collins Startup list [CJET] Number=1496 Confirmed=X Filename=CJet.exe Description=Added by the Adware.FFToolBar adware toolbar Source=Paul Collins Startup list [Cjstcom] Number=1497 Confirmed=Y Filename=Cjstcom.exe Description=Canon printer BJ status language monitor Source=Paul Collins Startup list [ClamWin] Number=1498 Confirmed=Y Filename=ClamTray.exe Description=ClamWin antivirus Source=Paul Collins Startup list [Classes] Number=1499 Confirmed=X Filename=int1.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1500 Confirmed=X Filename=intl.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1501 Confirmed=X Filename=run_21.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1502 Confirmed=X Filename=srv.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1503 Confirmed=X Filename=srv2.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1504 Confirmed=X Filename=MSTAR2.EXE Description="Switch" adult content dialler Source=Paul Collins Startup list [Classes] Number=1505 Confirmed=X Filename=mstart.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [clcbt.exe] Number=1506 Confirmed=X Filename=clcbt.exe Description=Added by the AGENT.CBA TROJAN! Source=Paul Collins Startup list [CLCLSet] Number=1507 Confirmed=U Filename=CLCL.exe Description=CLCL clipboard caching utility Source=Paul Collins Startup list [CleanEasyImg] Number=1508 Confirmed=? Filename=cleanall.exe Description=?? Source=Paul Collins Startup list [CleanRegPath] Number=1509 Confirmed=? Filename=CleanReg.exe Description=Apparently Annex A ADSL modem related. What does it do and is it required? Source=Paul Collins Startup list [CleanSweep Smart Sweep- Internet Sweep] Number=1510 Confirmed=U Filename=Csinsm32.exe Description=Automatic logging of installs from Norton CleanSweep - available via Start -> Programs Source=Paul Collins Startup list [CleanSweep Useage Watch] Number=1511 Confirmed=N Filename=CSUSEM32.EXE Description=Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time Source=Paul Collins Startup list [CleanTemp] Number=1512 Confirmed=U Filename=CLEANT~1.EXEB Description=CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory Source=Paul Collins Startup list [CleanTemp] Number=1513 Confirmed=U Filename=CleanTemp.exe Description=CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory Source=Paul Collins Startup list [Cleanup] Number=1514 Confirmed=N Filename=ONICTASK.EXE Description=Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet Source=Paul Collins Startup list [CleanUp] Number=1515 Confirmed=Y Filename=mcappins.exe Description=Used by McAfee Virusscan to perform product updates. When updates are available the program will download and install them automatically. Recommended to leave enabled Source=Paul Collins Startup list [CleanupProgram] Number=1516 Confirmed=? Filename=cleanup.exe Description=In a C:\Sony\sys folder - Sony Vaio related? Source=Paul Collins Startup list [clean_service] Number=1517 Confirmed=X Filename=clean_service.cmd Description=Added by the REFAZ WORM! Source=Paul Collins Startup list [clfmon] Number=1518 Confirmed=X Filename=clfmon.exe Description=Added by the TACTSLAY.E TROJAN! Source=Paul Collins Startup list [clfmon] Number=1519 Confirmed=X Filename=nvsvca32.exe Description=Added by the TACTSLAY.E TROJAN! Source=Paul Collins Startup list [clfmon.exe] Number=1520 Confirmed=X Filename=clfmon.exe Description=Added by the AGENT-BJ TROJAN! Source=Paul Collins Startup list [Click Radio Tuner] Number=1521 Confirmed=N Filename=clickr~1.exe Description=ClickRadio - subscription service playing radio music via the internet Source=Paul Collins Startup list [Click Tray Calendar] Number=1522 Confirmed=N Filename=ClickT~1.EXE Description=ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc Source=Paul Collins Startup list [ClickMe] Number=1523 Confirmed=N Filename=ClickMe.exe Description=ClickM "JOKE" program Source=Paul Collins Startup list [Clickoff] Number=1524 Confirmed=U Filename=Clickoff.exe Description=Clickoff automatically dismisses annoying dialog boxes Source=Paul Collins Startup list [ClickTheButton] Number=1525 Confirmed=X Filename=CTB.EXE Description=ClickTheButton Downloader-MY adware Source=Paul Collins Startup list [ClickTheButton] Number=1526 Confirmed=X Filename=csrss.exe Description=ClickTheButton Downloader-MY adware! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [ClickTheButton] Number=1527 Confirmed=X Filename=MSCStat.exe Description=ClickTheButton Downloader-MY adware Source=Paul Collins Startup list [CLICONFG] Number=1528 Confirmed=X Filename=CLICONFG.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [Client Access API Daemon] Number=1529 Confirmed=U Filename=cwbappcd.exe Description=IBM iSeries Client Access, see here Source=Paul Collins Startup list [Client Access Check Version] Number=1530 Confirmed=N Filename=cwbckver.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources Source=Paul Collins Startup list [Client Access Express Welcome] Number=1531 Confirmed=? Filename=cwbwlwiz.exe Description=Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? Source=Paul Collins Startup list [Client Access Help Update] Number=1532 Confirmed=N Filename=cwbinhlp.exe Description=Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries Source=Paul Collins Startup list [Client Access Service] Number=1533 Confirmed=N Filename=CwbSvStr.Exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources Source=Paul Collins Startup list [Client Access Taskbar] Number=1534 Confirmed=U Filename=cwbuitsk.exe Description=IBM iSeries Client Access taskbar, see here Source=Paul Collins Startup list [Client Agent] Number=1535 Confirmed=X Filename=ipxwping.exe Description=Added by the PPDOOR-N TROJAN! Source=Paul Collins Startup list [Client Agent] Number=1536 Confirmed=X Filename=photes.exe Description=Added by the PPDOOR-P TROJAN! Source=Paul Collins Startup list [Client Agent] Number=1537 Confirmed=X Filename=[path to file] Description=Added by the PPDOOR-J TROJAN! Source=Paul Collins Startup list [Client agent for ARCserve] Number=1538 Confirmed=? Filename=W95AGENT.EXE Description=Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? Source=Paul Collins Startup list [Client for Microsoft Networks] Number=1539 Confirmed=X Filename=msclient32.exe Description=Added by the SDBOT-BXQ WORM! Source=Paul Collins Startup list [Client Server Control Process] Number=1540 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT-HR TROJAN! Source=Paul Collins Startup list [Client Server Run Time Proccess] Number=1541 Confirmed=X Filename=csrsrv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Client Server Runtime] Number=1542 Confirmed=X Filename=[path to worm] Description=Added by the POEBOT-KR WORM! Source=Paul Collins Startup list [Client Server Runtime Process] Number=1543 Confirmed=X Filename=csrsss.exe Description=Added by the SDBOT-LD WORM! Source=Paul Collins Startup list [Client Server Runtime Process] Number=1544 Confirmed=X Filename=csrs.exe Description=Added by the LINKBOT.M WORM! Source=Paul Collins Startup list [Client Server Runtime Process] Number=1545 Confirmed=X Filename=smmss.exe Description=Backdoor TROJAN! Possible SDBOT-GEN variant Source=Paul Collins Startup list [Client Update] Number=1546 Confirmed=X Filename=wup.exe Description=Added by a variant of the OPANKI-A WORM! Source=Paul Collins Startup list [ClientMan1] Number=1547 Confirmed=X Filename=mscman.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [Clik Status Monitor] Number=1548 Confirmed=N Filename=toolsclickstat.exe Description=Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed Source=Paul Collins Startup list [clipboard.exe] Number=1549 Confirmed=X Filename=clipboard.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Clipbook Service] Number=1550 Confirmed=N Filename=Clipsrv.exe Description=Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks Source=Paul Collins Startup list [ClipMate5x] Number=1551 Confirmed=N Filename=ClipMt5x.exe Description=Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs Source=Paul Collins Startup list [Clipmate6] Number=1552 Confirmed=N Filename=CLIPMT60.EXE Description=Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs Source=Paul Collins Startup list [ClipMate7] Number=1553 Confirmed=N Filename=ClipMate.exe Description=Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard Source=Paul Collins Startup list [Clipomatic] Number=1554 Confirmed=N Filename=Clipomatic.exe Description=Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data Source=Paul Collins Startup list [Clipsrv] Number=1555 Confirmed=N Filename=Clipsrv.exe Description=Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks Source=Paul Collins Startup list [ClipSrv] Number=1556 Confirmed=X Filename=clipserv.exe Description=Added by the SDBOT-AAV and SDBOT-AFE WORMS! Source=Paul Collins Startup list [ClipSrv] Number=1557 Confirmed=X Filename=CLIPBRD3D.EXE Description=Added by the MOFEI-D WORM! Source=Paul Collins Startup list [ClipTrak] Number=1558 Confirmed=N Filename=ClipTrak.exe Description=ClipTrak - clipboard extender Source=Paul Collins Startup list [ClipTrakker] Number=1559 Confirmed=N Filename=ClipTrakker.exe Description=Cliptrakker - clipboard extender Source=Paul Collins Startup list [CLISTART] Number=1560 Confirmed=N Filename=CLIStart.exe Description=Puts the ATI Catalyst� Control Center Icon/Shortcut on the System Tray - available via Start -> Programs Source=Paul Collins Startup list [CLMFrontPanel] Number=1561 Confirmed=U Filename=clmpanel.exe Description=System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost Source=Paul Collins Startup list [clnwall] Number=1562 Confirmed=? Filename=rundll.exe setupx.dll, InstallHinfSection ..delwall.inf Description=?? Source=Paul Collins Startup list [clock] Number=1563 Confirmed=X Filename=[various filenames] Description=LiveChat Adware - known file names include: mssetup.exe, kstatus.exe, spoolsv.exe, sptsupd.exe, osk.exe, msswchx.exe, netdde.exe, msbkup.exe Source=Paul Collins Startup list [Clock Manager] Number=1564 Confirmed=X Filename=amsngr.exe Description=Added by the SDBOT-XM TROJAN! Source=Paul Collins Startup list [ClockSync] Number=1565 Confirmed=X Filename=Sync.exe Description=ClockSync - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available Source=Paul Collins Startup list [ClockWise] Number=1566 Confirmed=U Filename=CLOCKWISE.EXE Description=ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync Source=Paul Collins Startup list [ClocX] Number=1567 Confirmed=U Filename=ClocX.exe Description=ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms etc� Source=Paul Collins Startup list [CloneCD] Number=1568 Confirmed=U Filename=CloneCDTray.exe Description=System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions Source=Paul Collins Startup list [CloneCDElbyCDFL] Number=1569 Confirmed=U Filename=ElbyCheck.exe Description=From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it Source=Paul Collins Startup list [CloneCDTray] Number=1570 Confirmed=U Filename=CloneCDTray.exe Description=System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions Source=Paul Collins Startup list [Clotusorgreg0] Number=1571 Confirmed=? Filename=prtStart.exe Orgprt.exe Description=IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? Source=Paul Collins Startup list [Clre] Number=1572 Confirmed=X Filename=mmdc.exe Description=Added by the PURSCAN-AI TROJAN! Source=Paul Collins Startup list [ClrSchLoader] Number=1573 Confirmed=X Filename=[path to file] Description=ClearSearch adware Source=Paul Collins Startup list [CLSID] Number=1574 Confirmed=X Filename=com.exe Description=Adult content dialler Source=Paul Collins Startup list [CLSID] Number=1575 Confirmed=X Filename=dll.exe Description=Adult content dialler Source=Paul Collins Startup list [CLSID] Number=1576 Confirmed=X Filename=msgplus.exe Description=Adult content dialler Source=Paul Collins Startup list [CLSID] Number=1577 Confirmed=X Filename=plugin.exe Description=Adult content dialler Source=Paul Collins Startup list [CLSID] Number=1578 Confirmed=X Filename=sed.exe Description=Adult content dialler Source=Paul Collins Startup list [CLSID] Number=1579 Confirmed=X Filename=msgplus.exe Description=Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension Source=Paul Collins Startup list [CLSRSS] Number=1580 Confirmed=X Filename=LSACS.EXE Description=Added by the SILLYFDC-X WORM! Source=Paul Collins Startup list [CM-SmWizard] Number=1581 Confirmed=? Filename=SmWizard.exe Description=SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? Source=Paul Collins Startup list [cma] Number=1582 Confirmed=U Filename=cma.exe Description=DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" Source=Paul Collins Startup list [CMAPP] Number=1583 Confirmed=X Filename=cmappclient.exe Description=CasClient adware - also detected as the CMAPP TROJAN! Source=Paul Collins Startup list [Cmaudio] Number=1584 Confirmed=N Filename=Rundll32 cmicnfg.cpl, CMICtrlWnd Description=System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Cmd] Number=1585 Confirmed=X Filename=cmd32.exe Description=Added by the TANKED WORM! Source=Paul Collins Startup list [cmd32] Number=1586 Confirmed=X Filename=configs.exe Description=Hijacker, also detected as the QURL-2 TROJAN! Source=Paul Collins Startup list [cmdbcs] Number=1587 Confirmed=X Filename=cmdbcs.exe Description=Added by the LINEAG-GKW TROJAN! Source=Paul Collins Startup list [cmdcon] Number=1588 Confirmed=X Filename=cmdcon.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [CME] Number=1589 Confirmed=X Filename=cme.exe Description=Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [CmeSYS] Number=1590 Confirmed=X Filename=CMEsys.exe Description=Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [CmeUPD] Number=1591 Confirmed=X Filename=CMEupd.exe Description=Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [CMFibula] Number=1592 Confirmed=X Filename=CMFibula.exe Description=CASClient adware Source=Paul Collins Startup list [CmFlywaveName] Number=1593 Confirmed=N Filename=CmFlywav.exe Description=Driver for Linksys Wireless-G Music Bridge Source=Paul Collins Startup list [CMGrdian] Number=1594 Confirmed=? Filename=CMGrdian.exe Description=One of the McAfee shared components. What does it do and is it required? Source=Paul Collins Startup list [CMMan] Number=1595 Confirmed=X Filename=CMMan.exe Description=Added by the CMAPP TROJAN! Source=Paul Collins Startup list [Cmmon32Sys] Number=1596 Confirmed=X Filename=cmmon32.exe Description=Added by the SMALL.CL TROJAN! Source=Paul Collins Startup list [cmonitor] Number=1597 Confirmed=N Filename=startupmon.exe Description=SystemDoctor is a security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [CmPCIaudio] Number=1598 Confirmed=U Filename=RunDll32 CMICNFG3.CPL, CMICtrlWnd Description=Registers the Control Panel applet for a C-Media PCI sound card Source=Paul Collins Startup list [CMPDPSRV] Number=1599 Confirmed=U Filename=CMPDPSRV.EXE Description=Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more". Installed with some Compaq and Lexmark printers Source=Paul Collins Startup list [Cmpnt] Number=1600 Confirmed=X Filename=Devices2.exe Description=Added by the TOMPAI-D TROJAN! Source=Paul Collins Startup list [Cmpnt] Number=1601 Confirmed=X Filename=mainsv.exe Description=Added by the TOMPAI-C TROJAN! Source=Paul Collins Startup list [cmrss] Number=1602 Confirmed=X Filename=cmrss.exe Description=Added by the DELF.DU TROJAN! Source=Paul Collins Startup list [cmrss] Number=1603 Confirmed=X Filename=crmss.exe Description=Added by the DLOADER-EK TROJAN! Source=Paul Collins Startup list [cmrss] Number=1604 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-QQ TROJAN! Source=Paul Collins Startup list [cmrst] Number=1605 Confirmed=X Filename=cmrst.exe Description=Added by the BANCOS.S TROJAN! Source=Paul Collins Startup list [cmrst] Number=1606 Confirmed=X Filename=cmrst.scr Description=Added by the DLOADER-FP TROJAN! Source=Paul Collins Startup list [cms] Number=1607 Confirmed=X Filename=iserver.exe Description=Added by the DLOADER-WK TROJAN! Source=Paul Collins Startup list [CMSETTINGS] Number=1608 Confirmed=U Filename=ctmn.exe Description=Part of NetNanny Chat Monitor Source=Paul Collins Startup list [cmsound] Number=1609 Confirmed=X Filename=vcpdll.exe Description=Added by the TCXMEDI-D downloader TROJAN! Source=Paul Collins Startup list [cmsound] Number=1610 Confirmed=X Filename=vcsystem.exe Description=Added by the TCXMEDI-D downloader TROJAN! Source=Paul Collins Startup list [cmss] Number=1611 Confirmed=X Filename=system.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [cmssapp] Number=1612 Confirmed=X Filename=iexplore_.exe Description=Added by the BANCBAN-CQ TROJAN! Source=Paul Collins Startup list [cmssapp] Number=1613 Confirmed=X Filename=iexplore.exe Description=Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [cmssSystemProcess] Number=1614 Confirmed=X Filename=csmss.exe Description=Added by the AGENT-CO TROJAN! Source=Paul Collins Startup list [cmssSystemProcess] Number=1615 Confirmed=X Filename=mcsmss.exe Description=Added by a variant of the AGENT.EI TROJAN! Source=Paul Collins Startup list [cmssSystemProcess] Number=1616 Confirmed=X Filename=csms.exe Description=Added by the AGENT-Y TROJAN! Source=Paul Collins Startup list [CMSystem] Number=1617 Confirmed=X Filename=CMSystem.exe Description=CASClient adware Source=Paul Collins Startup list [cmt101] Number=1618 Confirmed=X Filename=cmt101.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [CmUCRRun] Number=1619 Confirmed=? Filename=CmUCReye.exe Description=Related to Medion Display Information. What does it do and is it required? Source=Paul Collins Startup list [cmx32] Number=1620 Confirmed=X Filename=cmx32.exe Description=Added by the GEMA.D TROJAN! Source=Paul Collins Startup list [Cn323] Number=1621 Confirmed=X Filename=cnfrm33.exe Description=Added by the MIMAIL.G WORM! Source=Paul Collins Startup list [Cn911] Number=1622 Confirmed=X Filename=ODBCJET.exe Description=Added by the BIFROSE-PR TROJAN! Source=Paul Collins Startup list [CNBABE] Number=1623 Confirmed=X Filename=CNBABE.EXE Description=Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing Source=Paul Collins Startup list [cnet] Number=1624 Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [Cnfrm32] Number=1625 Confirmed=X Filename=cnfrm.exe Description=Added by the MIMAIL.D WORM! Source=Paul Collins Startup list [CnsMax] Number=1626 Confirmed=X Filename=Internat.exe Description=Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir% Source=Paul Collins Startup list [CnsMin] Number=1627 Confirmed=X Filename=Rundll32.exe CNSMIN.DLL, Rundll32 Description=CnsMin (Chinese Keywords) hijacker related Source=Paul Collins Startup list [CnxAdslL] Number=1628 Confirmed=Y Filename=CnxAdslL.exe Description=DLink, Zoom, or Conexant modem driver Source=Paul Collins Startup list [CnxDslTaskBar] Number=1629 Confirmed=N Filename=CnxDslTb.exe Description=Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems Source=Paul Collins Startup list [Cobian Backup 8 interface] Number=1630 Confirmed=U Filename=cbInterface.exe Description="Cobian Backup is a backup program that can be executed in 2 ways: as a normal application or as a Windows Service. The program can schedule automatic backups for files and directories locally or to FTP servers and can use compression and encryption" Source=Paul Collins Startup list [Codename Dashboard] Number=1631 Confirmed=U Filename=dashboard.exe Description=Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have any information you want, on your desktop, all the time" Source=Paul Collins Startup list [cof.updit] Number=1632 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [CognizanceTS] Number=1633 Confirmed=U Filename=rundll32.exe [path] AsTsVcc.dll, RegisterModule Description=Cognizance Corp Identity And Access Management suite Source=Paul Collins Startup list [Coldlife -icmp] Number=1634 Confirmed=X Filename=Systray.exe Description=Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process Source=Paul Collins Startup list [coloreal] Number=1635 Confirmed=U Filename=coloreal.exe Description=Makes colours sharper and brighter, but will only work with coloreal capable monitors Source=Paul Collins Startup list [Colorific Control Panel] Number=1636 Confirmed=N Filename=Hgcctl95.exe Description=From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor Source=Paul Collins Startup list [COM Service] Number=1637 Confirmed=X Filename=mscom32.com Description=Added by the BEASTY.H TROJAN! Source=Paul Collins Startup list [COM Service] Number=1638 Confirmed=X Filename=msynvr.com Description=Added by the BEASTY.G TROJAN! Source=Paul Collins Startup list [COM Service] Number=1639 Confirmed=X Filename=msjclh.com Description=Added by the BEASTY.E TROJAN! Source=Paul Collins Startup list [COM Service] Number=1640 Confirmed=X Filename=msdrce.com Description=Added by the BEASTY.I TROJAN! Source=Paul Collins Startup list [COM Service] Number=1641 Confirmed=X Filename=msflyx.com Description=Added by the BEASTDO-O TROJAN! Source=Paul Collins Startup list [COM+ Event System] Number=1642 Confirmed=X Filename=DRWTSN16.EXE Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [COM+ EventSystem Services] Number=1643 Confirmed=X Filename=ECSERVER.EXE Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Com+ Sys] Number=1644 Confirmed=X Filename=csrs.exe Description=Added by the FORBOT-BT WORM! Source=Paul Collins Startup list [COM+ System Applications] Number=1645 Confirmed=X Filename=lsas.exe Description=Added by the AGOBOT.SE WORM! Source=Paul Collins Startup list [COM++ System] Number=1646 Confirmed=X Filename=exploier.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [COM++ System] Number=1647 Confirmed=X Filename=suchost.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [COM++ System] Number=1648 Confirmed=X Filename=svchost.exe... Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [COM-IP] Number=1649 Confirmed=N Filename=COMIP.EXE Description=COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) Source=Paul Collins Startup list [ComAgent] Number=1650 Confirmed=U Filename=ComAgent.exe Description=ComAgent - MDaemon's instant messaging client Source=Paul Collins Startup list [combo.exe] Number=1651 Confirmed=X Filename=combo.exe Description=Added by the CHIMO-C TROJAN! Source=Paul Collins Startup list [combop.exe] Number=1652 Confirmed=X Filename=combop.exe Description=Added by the BOWFEED-A TROJAN! Source=Paul Collins Startup list [Comcast Network] Number=1653 Confirmed=X Filename=ribiva.exe Description=Added by an IRC TROJAN variant! Source=Paul Collins Startup list [ComcastSUPPORT] Number=1654 Confirmed=X Filename=tgkill.exe Description=Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs Source=Paul Collins Startup list [COMCFG] Number=1655 Confirmed=X Filename=comcfg.exe Description=Added by the TOADCOM.A TROJAN! Source=Paul Collins Startup list [comctl32] Number=1656 Confirmed=X Filename=comctl32.exe Description=Adware - recognized by Kaspersky antivirus as TrojanDownloader.Win32.Agent.am Source=Paul Collins Startup list [COMDRV32] Number=1657 Confirmed=U Filename=svdhost.exe Description=Orvell Monitoring 2003 surveillance software. Uninstall this software unless you put it there yourself. Note - asks for permission to contact the IP address of http://www.protectcom.com/ Source=Paul Collins Startup list [Comm Driver] Number=1658 Confirmed=U Filename=commh32.exe Description=G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! Source=Paul Collins Startup list [Command] Number=1659 Confirmed=X Filename=system.exe Description=Added by the GATECRASH.A or GATECRASH.B TROJANS! Source=Paul Collins Startup list [Command] Number=1660 Confirmed=X Filename=Gotit.exe Description=Added by the TITOG WORM! Source=Paul Collins Startup list [COMMAND] Number=1661 Confirmed=X Filename=command.exe Description=Added by the QQPASS.E TROJAN! Source=Paul Collins Startup list [command] Number=1662 Confirmed=X Filename=javaw.exe Description=Added by the AGOBOT-LG WORM! Source=Paul Collins Startup list [Command Prompt32] Number=1663 Confirmed=X Filename=CmdPrompt32.pif Description=Added by the ASSIRAL.B WORM! Source=Paul Collins Startup list [command32] Number=1664 Confirmed=X Filename=command32.exe Description=Added by the LINEADI-A TROJAN! Source=Paul Collins Startup list [CommCtr] Number=1665 Confirmed=N Filename=commctr.exe Description="Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!". Available via Start -> Programs Source=Paul Collins Startup list [Comodo Firewall] Number=1666 Confirmed=U Filename=CPF.exe Description=Comodo Firewall Source=Paul Collins Startup list [CompanionWizard] Number=1667 Confirmed=N Filename=compwiz.exe Description=WinAntiVirus 2006 virus software - not recommended, see here Source=Paul Collins Startup list [Compaq Alerter] Number=1668 Confirmed=U Filename=CPQAlert.exe Description=Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information Source=Paul Collins Startup list [Compaq Computer Corp SCCenter Module] Number=1669 Confirmed=N Filename=SCCENTER.EXE Description=For Compaq PC's. Part of Backweb Source=Paul Collins Startup list [Compaq Computer Security] Number=1670 Confirmed=? Filename=Rundll32.exe SECURE32.CPL, Service Description=?? Source=Paul Collins Startup list [Compaq Connections] Number=1671 Confirmed=N Filename=COMPAQ~1.EXE Description=See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer owners" Source=Paul Collins Startup list [Compaq Connections] Number=1672 Confirmed=N Filename=BackWeb-1940576.exe Description=See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer owners". * can be any digit Source=Paul Collins Startup list [Compaq DMI] Number=1673 Confirmed=N Filename=cpqdmi.exe Description=Compaq version of the Desktop Management Interface Source=Paul Collins Startup list [Compaq Drivers] Number=1674 Confirmed=X Filename=F1rewalls.exe Description=Added by the SDBOT-WD WORM! Source=Paul Collins Startup list [Compaq Internet Setup] Number=1675 Confirmed=N Filename=inetwizard.exe Description=For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list Source=Paul Collins Startup list [Compaq Jes Drivers] Number=1676 Confirmed=X Filename=winjes.exe Description=Added by the SDBOT-XR WORM! Source=Paul Collins Startup list [Compaq Knowledge Center] Number=1677 Confirmed=U Filename=silent.exe & matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support". You decide Source=Paul Collins Startup list [Compaq Message Server] Number=1678 Confirmed=N Filename=COMPAQ-RBA.EXE Description=Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not required and can cause problems Source=Paul Collins Startup list [Compaq PK Daemon] Number=1679 Confirmed=U Filename=cpqkl.exe Description=For Compaq laptops for programming user configurable keys. Not required unless you use them Source=Paul Collins Startup list [Compaq Print Fax] Number=1680 Confirmed=X Filename=cpqa1000.exe Description=Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm Source=Paul Collins Startup list [Compaq Service Drivers] Number=1681 Confirmed=X Filename=systeminfos.exe Description=Added by the SDBOT-XC WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1682 Confirmed=X Filename=compq.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1683 Confirmed=X Filename=navapqwa.exe Description=Added by the SDBOT.BBQ WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1684 Confirmed=X Filename=amsn.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1685 Confirmed=X Filename=compqs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1686 Confirmed=X Filename=msnt.exe Description=Added by the SDBOT.CQL WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1687 Confirmed=X Filename=NtKernelSystem.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1688 Confirmed=X Filename=wincmd.exe Description=Added by the RBOT.ATV WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1689 Confirmed=X Filename=wind32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1690 Confirmed=X Filename=winmsn.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1691 Confirmed=X Filename=compaq.exe Description=Added by the SDBOT-AFU WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1692 Confirmed=X Filename=msnsvc.exe Description=Added by the RBOT.BKT WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1693 Confirmed=X Filename=ntsys32.exe Description=Added by the RBOT.CIW WORM! Source=Paul Collins Startup list [Compaq Service Drivers] Number=1694 Confirmed=X Filename=winsvc.exe Description=Added by the SDBOT-AGD WORM! Source=Paul Collins Startup list [Compaq Service Drivers 32] Number=1695 Confirmed=X Filename=compq32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Compaq Service Drivrs] Number=1696 Confirmed=X Filename=copq.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Compaq Services Drivers] Number=1697 Confirmed=X Filename=ndt32.exe Description=Added by the RBOT.CQZ WORM! Source=Paul Collins Startup list [Compaq Sound Drivers For WINDOWS] Number=1698 Confirmed=X Filename=sounddr.exe Description=Added by the SDBOT-XG WORM! Source=Paul Collins Startup list [Compaq Video CD Watcher] Number=1699 Confirmed=N Filename=?? Description=For Compaq PC's. MPEG viewer Source=Paul Collins Startup list [Compaq32 Service Drivers] Number=1700 Confirmed=X Filename=ms32.exe Description=Added by the SDBOT.BWH WORM! Source=Paul Collins Startup list [Compaq32 Service Drivers] Number=1701 Confirmed=X Filename=msconfig32.exe Description=Added by the SDBOT-ADC WORM! Source=Paul Collins Startup list [Compaq32 Service Drivers] Number=1702 Confirmed=X Filename=msnt32.exe Description=Added by the RBOT.BVF WORM! Source=Paul Collins Startup list [CompaqHW Comp Manager] Number=1703 Confirmed=? Filename=cpqhcm.exe Description=Running on a Compaq laptop - any ideas? Source=Paul Collins Startup list [CompaqPrinTray] Number=1704 Confirmed=N Filename=printray.exe Description=Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop Source=Paul Collins Startup list [Compaqs Service Driver] Number=1705 Confirmed=X Filename=copypad32.exe Description=Added by the SDBOT.CSO WORM! Source=Paul Collins Startup list [Compaqs Service Drivers] Number=1706 Confirmed=X Filename=compqs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [CompaqSystray] Number=1707 Confirmed=N Filename=cpqpscp.exe Description=Compaq System Tray icon Source=Paul Collins Startup list [Compatibility Service Process] Number=1708 Confirmed=X Filename=regsvs.exe Description=Added by the GAOBOT.YN WORM! Source=Paul Collins Startup list [Compd Service Drivrs] Number=1709 Confirmed=X Filename=codq.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ComproRemote] Number=1710 Confirmed=U Filename=ComproRemote.exe Description=VideoMate TV tuner and capture card - remote control driver Source=Paul Collins Startup list [ComproSchedulerDTV] Number=1711 Confirmed=U Filename=ComproSchedulerDTV.exe Description=VideoMate TV tuner and capture card - scheduler Source=Paul Collins Startup list [Computing Technologie Firewall] Number=1712 Confirmed=X Filename=lsauth.exe Description=Added by the SDBOT-WX WORM! Source=Paul Collins Startup list [COMSMDEXE] Number=1713 Confirmed=N Filename=comsmd.exe Description=3Com tray icon Source=Paul Collins Startup list [ComStart] Number=1714 Confirmed=N Filename=Trojan Guarder.exe Description=TrojanGuarder is a security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [ComTry Web Searcher] Number=1715 Confirmed=X Filename=wstray.exe Description=Comtry MP3 Downloader related - spyware Source=Paul Collins Startup list [comxt] Number=1716 Confirmed=X Filename=comxt.exe Description=Added by the COMXT TROJAN! Source=Paul Collins Startup list [con] Number=1717 Confirmed=X Filename=[path to trojan] Description=Added by the BRAVE-A TROJAN! Source=Paul Collins Startup list [Config] Number=1718 Confirmed=X Filename=service.exe Description=Added by the ISRAZ.B WORM! Source=Paul Collins Startup list [Config Loadation] Number=1719 Confirmed=X Filename=iEEexplore.exe Description=Added by the SDBOT.H TROJAN! Source=Paul Collins Startup list [Config Loadatiorin] Number=1720 Confirmed=X Filename=I3Explorer.exe Description=Added by the SDBOT.H TROJAN! Source=Paul Collins Startup list [Config Loader] Number=1721 Confirmed=X Filename=svchosl.exe Description=Added by the GAOBOT.P WORM! Source=Paul Collins Startup list [Config Loader] Number=1722 Confirmed=X Filename=sysldr32.exe Description=Added by the GAOBOT WORM! Source=Paul Collins Startup list [Config Loader] Number=1723 Confirmed=X Filename=scvhost.exe Description=Added by the GAOBOT.AE or GAOBOT.AO WORMS! Source=Paul Collins Startup list [Config Loader] Number=1724 Confirmed=X Filename=svhost.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Config Loader for Microsoft Windows] Number=1725 Confirmed=X Filename=mwincfg32.exe Description=Added by the AGOBOT.BD WORM! Source=Paul Collins Startup list [Config Loader2] Number=1726 Confirmed=X Filename=explores.exe Description=Added by the GAOBOT.BT WORM! Source=Paul Collins Startup list [Config Loadr] Number=1727 Confirmed=X Filename=winsys32.exe Description=Added by the AGOBOT-HN WORM! Source=Paul Collins Startup list [Config33.exe] Number=1728 Confirmed=X Filename=Config33.exe Description=Added by the SDBOT.T TROJAN! Source=Paul Collins Startup list [ConfiggLoader] Number=1729 Confirmed=X Filename=cart322.exe Description=Added by the GAOBOT.DJ WORM! Source=Paul Collins Startup list [ConfigSafe] Number=1730 Confirmed=U Filename=CFGSAFE.EXE Description=ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice Source=Paul Collins Startup list [ConfigSafe] Number=1731 Confirmed=U Filename=AUTOCHK.EXE Description=ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice Source=Paul Collins Startup list [ConfigServices] Number=1732 Confirmed=N Filename=Config.exe Description=Part of initial setup on a Compaq PC Source=Paul Collins Startup list [configsetup] Number=1733 Confirmed=X Filename=configsetup32.exe Description=Added by the AGOBOT-AFP WORM! Source=Paul Collins Startup list [Configuration] Number=1734 Confirmed=X Filename=explorer32.exe Description=Added by the SDBOT-ML WORM! Source=Paul Collins Startup list [Configuration] Number=1735 Confirmed=X Filename=[filename] Description=Added by the SDBOT-ML WORM! Source=Paul Collins Startup list [configuration] Number=1736 Confirmed=X Filename=apphost.exe Description=Added by the SDBOT-VP WORM! Source=Paul Collins Startup list [Configuration] Number=1737 Confirmed=X Filename=ntsys32.exe Description=Added by the SDBOT-LN WORM! Source=Paul Collins Startup list [Configuration Default] Number=1738 Confirmed=X Filename=Wuxat.exe Description=Added by the SPYBOT-CA WORM! Source=Paul Collins Startup list [Configuration File] Number=1739 Confirmed=X Filename=Winset32.exe Description=Added by the FLUX.101 TROJAN! Source=Paul Collins Startup list [Configuration Loaded] Number=1740 Confirmed=X Filename=wupdated.exe Description=Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS! Source=Paul Collins Startup list [Configuration Loaded] Number=1741 Confirmed=X Filename=lssas.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [Configuration Loader] Number=1742 Confirmed=X Filename=aim95.exe Description=Added by the LOADCFG or SDBOT TROJANS! Source=Paul Collins Startup list [Configuration Loader] Number=1743 Confirmed=X Filename=cmd32.exe Description=Added by the LOADCFG or SDBOT TROJANS! Source=Paul Collins Startup list [Configuration Loader] Number=1744 Confirmed=X Filename=service5.exe Description=Added by the GAOBOT.AF WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1745 Confirmed=? Filename=lfass.exe Description=?? Source=Paul Collins Startup list [Configuration Loader] Number=1746 Confirmed=X Filename=sycfg34.exe Description=Added by the GAOBOT.AN WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1747 Confirmed=X Filename=wincrt32.exe Description=Added by the GAOBOT.BF WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1748 Confirmed=X Filename=windex.exe Description=Added by the GAOBOT.BZ WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1749 Confirmed=X Filename=dosrun32.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1750 Confirmed=X Filename=Service.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1751 Confirmed=X Filename=Servicess.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1752 Confirmed=X Filename=sw32.exe Description=Added by the AGOBOT.BQ WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1753 Confirmed=X Filename=System.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1754 Confirmed=X Filename=Winreg.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1755 Confirmed=X Filename=sysinfo.exe Description=Added by the GAOBOT.FQ WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1756 Confirmed=X Filename=microsoft.exe Description=Added by the GAOBOT.JB WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1757 Confirmed=X Filename=confgldr.exe Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [configuration loader] Number=1758 Confirmed=X Filename=winicfg32.exe Description=Added by the GAOBOT.RQ WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1759 Confirmed=X Filename=svhst.exe Description=Added by the GAOBOT.YC WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1760 Confirmed=X Filename=msgfix.exe Description=Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS! Source=Paul Collins Startup list [Configuration Loader] Number=1761 Confirmed=X Filename=msnss.exe Description=Added by the GAOBOT.AUS WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1762 Confirmed=X Filename=IEXPL0RE.EXE Description=Added by the LOADCFG or SDBOT TROJANS! Source=Paul Collins Startup list [Configuration Loader] Number=1763 Confirmed=X Filename=loadcfg32.exe Description=Added by the LOADCFG or SDBOT TROJANS! Source=Paul Collins Startup list [Configuration Loader] Number=1764 Confirmed=X Filename=MSTasks.exe Description=Added by the LOADCFG or SDBOT TROJANS! Source=Paul Collins Startup list [Configuration Loader] Number=1765 Confirmed=X Filename=systemry.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1766 Confirmed=X Filename=ccSort.exe Description=Added by the AGOBOT.SR WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1767 Confirmed=X Filename=smss32.exe Description=Added by the AGOBOT.MB WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1768 Confirmed=X Filename=wincffg.exe Description=Added by the AGOBOT.A3 WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1769 Confirmed=X Filename=seru32.exe Description=Added by the SDBOT-VR WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1770 Confirmed=X Filename=botss.exe Description=Added by the SDBOT-XS WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1771 Confirmed=X Filename=ldasp.exe Description=Added by the AGOBOT.BH WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1772 Confirmed=X Filename=msgcfgsrv.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1773 Confirmed=X Filename=smsai.exe Description=Added by the SDBOT-YE WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1774 Confirmed=X Filename=svupdate.exe Description=Added by the RANDEX.DXP WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1775 Confirmed=X Filename=crcss.exe Description=Added by the AGOBOT.ADG WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1776 Confirmed=X Filename=lexplore.exe Description=Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [Configuration Loader] Number=1777 Confirmed=X Filename=scvhost.exe Description=Added by the AGOBOT-AAE and SDBOT.AR WORMS! Source=Paul Collins Startup list [Configuration Loader] Number=1778 Confirmed=X Filename=svchost.exe Description=Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Configuration Loader] Number=1779 Confirmed=X Filename=svchost2.exe Description=Added by the AGOBOT.JR WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1780 Confirmed=X Filename=dezi.exe Description=Added by the SDBOT-OB WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1781 Confirmed=X Filename=mouse.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1782 Confirmed=X Filename=msg.exe Description=Added by the SDBOT.BT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1783 Confirmed=X Filename=WinHelper.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1784 Confirmed=X Filename=extrac.exe Description=Added by the SDBOT-AFP WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1785 Confirmed=X Filename=DVD-Player.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1786 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Configuration Loader] Number=1787 Confirmed=X Filename=svchost.exe Description=Added by the PARADROP-AI WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Configuration Loader] Number=1788 Confirmed=X Filename=wincore.exe Description=Added by the SDBOT.BHE WORM! Source=Paul Collins Startup list [Configuration Loader] Number=1789 Confirmed=X Filename=configldr.exe Description=Added by the AGOBOT-PP TROJAN! Source=Paul Collins Startup list [Configuration Loader ] Number=1790 Confirmed=X Filename=syscfg32.exe Description=Added by the SDBOT.B TROJAN! Source=Paul Collins Startup list [Configuration Loader Service] Number=1791 Confirmed=X Filename=Winsys32.exe Description=Added by the RBOT-YV WORM! Source=Paul Collins Startup list [Configuration Loader Service] Number=1792 Confirmed=X Filename=devl32.exe Description=Added by the SDBOT-XY WORM! Source=Paul Collins Startup list [Configuration Loader10] Number=1793 Confirmed=X Filename=ip7.exe Description=Added by the AGOBOT-ANZ WORM! Source=Paul Collins Startup list [Configuration Loading] Number=1794 Confirmed=X Filename=svchos1.exe Description=Added by the GAOBOT.DK WORM! Source=Paul Collins Startup list [Configuration Loading] Number=1795 Confirmed=X Filename=configldr.exe Description=Added by the AGOBOT-EC WORM! Source=Paul Collins Startup list [Configuration Loading Service] Number=1796 Confirmed=X Filename=wscel.exe Description=Added by the SDBOT-WJ WORM! Source=Paul Collins Startup list [Configuration Loadr] Number=1797 Confirmed=X Filename=iexplore.exee Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Configuration Manager] Number=1798 Confirmed=X Filename=CNFGLD32.EXE Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [Configuration Manager] Number=1799 Confirmed=X Filename=Cnfgldr.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [Configuration Manager] Number=1800 Confirmed=X Filename=cfg32.exe Description=BookedSpace parasite Source=Paul Collins Startup list [Configuration Servecie] Number=1801 Confirmed=X Filename=sewins.exe Description=Added by the SDBOT-COH WORM! Source=Paul Collins Startup list [Configuration Service] Number=1802 Confirmed=X Filename=suchost.exe Description=Added by the TREB TROJAN! Source=Paul Collins Startup list [Configuration Services] Number=1803 Confirmed=X Filename=mswords.exe Description=Added by the SDBOT-YM WORM! Source=Paul Collins Startup list [Configuration Utility] Number=1804 Confirmed=N Filename=CONFIG.EXE Description=Controls linksys wireless connection. Available from the Desktop Source=Paul Collins Startup list [Configuration Utility] Number=1805 Confirmed=U Filename=wlanutil.exe Description=NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards) Source=Paul Collins Startup list [Configuration Wizard] Number=1806 Confirmed=X Filename=Cfgwiz32.exe Description=Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) Source=Paul Collins Startup list [Configuration32 Loader32] Number=1807 Confirmed=X Filename=winamp32.exe Description=Added by the SDBOT-BIC WORM! Source=Paul Collins Startup list [ConfLoader] Number=1808 Confirmed=X Filename=sysconf16.exe Description=Added by the SDBOT-FB TROJAN! Source=Paul Collins Startup list [Conmgr] Number=1809 Confirmed=N Filename=conmgr.exe Description=Starts Winfax pro at startup Source=Paul Collins Startup list [ConMgr.exe] Number=1810 Confirmed=U Filename=conmgr.exe Description=Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut Source=Paul Collins Startup list [Connect2Party] Number=1811 Confirmed=X Filename=connect2party.exe Description=Adult content dialler Source=Paul Collins Startup list [Connection Keeper] Number=1812 Confirmed=U Filename=ConKeepM.exe Description="Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle, thus preventing your ISP from dropping your connection due to inactivity" Source=Paul Collins Startup list [Connection Manager] Number=1813 Confirmed=N Filename=CManager.exe Description=SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service Source=Paul Collins Startup list [Connectivity Tool] Number=1814 Confirmed=X Filename=[path to trojan] Description=Added by the LITEBOT-E TROJAN! Source=Paul Collins Startup list [Connector] Number=1815 Confirmed=X Filename=SYS.EXE Description=Added by the dialer.Nunci premium dialer Source=Paul Collins Startup list [Connector] Number=1816 Confirmed=X Filename=sms.EXE Description=Added by the ExDial-B premium rate adult content dialer Source=Paul Collins Startup list [Cons] Number=1817 Confirmed=X Filename=consol32.exe Description=Hijacker - redirects to a p0rn portal, where foistware like ISTBar gets stealth installed Source=Paul Collins Startup list [conscorr] Number=1818 Confirmed=X Filename=conscorr.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [Console de Gerenciamento Microsoft] Number=1819 Confirmed=X Filename=csrss.exe Description=Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a System\Level4 subfolder Source=Paul Collins Startup list [Console de Gerenciamento Microsoft] Number=1820 Confirmed=X Filename=csrss.exe Description=Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Central de Seguran�a" subfolder Source=Paul Collins Startup list [Consumer Input] Number=1821 Confirmed=U Filename=ConsumerInput.exe Description=Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ Source=Paul Collins Startup list [Consumer Input Rewarded with MyPoints, Consumer Input] Number=1822 Confirmed=U Filename=ConsumerInputRewardedwithMyPoints, ConsumerInput.exe Description=Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ Source=Paul Collins Startup list [Consumer Input Rewarded with MyPoints, Consumer Input Update] Number=1823 Confirmed=U Filename=ConsumerInputRewardedwithMyPoints, ConsumerInputUa.exe Description=Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ Source=Paul Collins Startup list [Contacte] Number=1824 Confirmed=? Filename=contacte.exe Description=Some kind of driver? Source=Paul Collins Startup list [Content connector] Number=1825 Confirmed=X Filename=[random filename].exe Description=Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder Source=Paul Collins Startup list [ContentDownload] Number=1826 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [ContentService] Number=1827 Confirmed=X Filename=winservn.exe Description=Homepage hijacker Source=Paul Collins Startup list [ContinueInstall] Number=1828 Confirmed=X Filename=bpsinstall.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Control] Number=1829 Confirmed=X Filename=rundll32.exe ctrlpan.dll, Restore ControlPanel Description=CoolWebSearch Msconfd parasite variant Source=Paul Collins Startup list [Control Center] Number=1830 Confirmed=N Filename=Center.exe Description=Related to an Asus WLAN card Source=Paul Collins Startup list [Control handler] Number=1831 Confirmed=X Filename=***********.exe [* = random char] Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Control handler] Number=1832 Confirmed=X Filename=ahjinst.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Control handler] Number=1833 Confirmed=X Filename=[10 to 14 random char]THD.EXE Description=Added by the KREPPER-AI TROJAN! Source=Paul Collins Startup list [control panel] Number=1834 Confirmed=N Filename=smctrlw.exe Description=System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card Source=Paul Collins Startup list [Control Panel] Number=1835 Confirmed=X Filename=System.exe Description=Added by the DANI TROJAN! Source=Paul Collins Startup list [control panel software service] Number=1836 Confirmed=X Filename=cprs.exe Description=Added by the RBOT-FPI WORM! Source=Paul Collins Startup list [Controladores] Number=1837 Confirmed=X Filename=[path to trojan] Description=Added by the TELEFO-A TROJAN! Source=Paul Collins Startup list [ControlCenter2.0] Number=1838 Confirmed=N Filename=brctrcen.exe Description=Brother scanner 'Control Center' application - can be started manually Source=Paul Collins Startup list [ControlCentreTray] Number=1839 Confirmed=N Filename=XWCTray.exe Description=System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc Source=Paul Collins Startup list [Controlled Resource System Service] Number=1840 Confirmed=X Filename=crss.exe Description=Added by the AGOBOT.GH WORM! Source=Paul Collins Startup list [Controller] Number=1841 Confirmed=N Filename=WFXCTL32.EXE Description=From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [ControlPanel] Number=1842 Confirmed=X Filename=rundll32 internat.dll, LoadKeyboardProfile Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [ControlPanel] Number=1843 Confirmed=X Filename=host32.exe internat.dll, LoadKeyboardProfile Description=Added by a vairant of the DELF.DW TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1844 Confirmed=X Filename=[path] cmd32.exe internat.dll, LoadKeyboardProfile Description=Added by the DLOADER-HF TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1845 Confirmed=X Filename=systemctrl.exe internet.dll, LoadNetworkProfile Description=Browser hijacker, also detected as STARTPA-FX Source=Paul Collins Startup list [ControlPanel] Number=1846 Confirmed=X Filename=internat.dll, LoadKeyboardProfile Description=Added by the BIZVES-A TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1847 Confirmed=X Filename=popcorn.exe internat.dll, LoadKeyboardProfile Description=Added by the BIZVES-B TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1848 Confirmed=X Filename=popcorn64.exe Description=Browser hijacker, redirecting to loadcash.biz Source=Paul Collins Startup list [ControlPanel] Number=1849 Confirmed=X Filename=popcorn64.exe rundll.dll, LoadMouseProfile Description=Added by the DLOADER-OI TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1850 Confirmed=X Filename=popcorn72.exe rundll.dll, LoadMouseProfile Description=Added by the DLOADER-RA TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1851 Confirmed=X Filename=svcc.exe Description=WorldSearch adware Source=Paul Collins Startup list [ControlPanel] Number=1852 Confirmed=X Filename=popcorn320.exe rundll.dll, LoadMouseProfile Description=Added by a variant of the DLOADER-RA TROJAN! Source=Paul Collins Startup list [ControlPanel] Number=1853 Confirmed=X Filename=[path] private.exe internat.dll, LoadMouseCarpetProfile Description=Reported by Norman Virus Control as W32/Downloader. Creates the files sdfff, fdsf and zxczxc. In the C:\WINDOWS\SYSTEM32 directory creates the files d.exe, s.exe and r.exe Source=Paul Collins Startup list [ControlServiceMgr] Number=1854 Confirmed=X Filename=csmsv.exe Description=Added by the AGENT-XC TROJAN! Source=Paul Collins Startup list [Cookie Cop 2] Number=1855 Confirmed=U Filename=CookieCop.exe Description=Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [Cookie Pal] Number=1856 Confirmed=U Filename=CPBRWTCH.EXE Description=Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [CookieJar] Number=1857 Confirmed=U Filename=Cookiejar.exe Description=Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return. No longer being actively supported Source=Paul Collins Startup list [CookiePatrol] Number=1858 Confirmed=U Filename=CookiePatrol.exe Description=CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition Source=Paul Collins Startup list [CookieWall] Number=1859 Confirmed=U Filename=cookie.exe Description=CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [Cool Desk] Number=1860 Confirmed=U Filename=cdesk.exe Description=Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you Source=Paul Collins Startup list [CoolDownloads] Number=1861 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [CoolMP3] Number=1862 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [CoolSwitch] Number=1863 Confirmed=U Filename=taskswitch.exe Description=ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen Source=Paul Collins Startup list [Coolwallpaper] Number=1864 Confirmed=N Filename=cwm_tray.exe Description=Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers Source=Paul Collins Startup list [coolwebprogram] Number=1865 Confirmed=X Filename=clrssn.exe Description=CoolWebSearch Smartsearch parasite variant Source=Paul Collins Startup list [Copernic Desktop Search] Number=1866 Confirmed=N Filename=DesktopSearch.exe Description=Copernic Desktop Search - "Easily search your entire hard drive in less than a second to pinpoint the right file, e-mail, music or pictures" Source=Paul Collins Startup list [Copernic Desktop Search 2] Number=1867 Confirmed=U Filename=DesktopSearchService.exe Description=Copernic Desktop Search - search agent Source=Paul Collins Startup list [CopernicPerUserTaskMgr] Number=1868 Confirmed=U Filename=CopernicPerUserTaskMgr.exe Description=Automatic tasking feature of Copernic Pro multi-search engine tool Source=Paul Collins Startup list [Copy handler] Number=1869 Confirmed=U Filename=Copy Handler.exe Description=Copy Handler lets you copy between hard disks, floppies, local networks, CDs, and many other storage media. Copy Handler gives you the power to pause, resume, restart, and cancel during the copying and moving processes Source=Paul Collins Startup list [Copyright] Number=1870 Confirmed=N Filename=mwcpyrt.exe Description=Displays copyright information on IBM ThinkPads Source=Paul Collins Startup list [CoreCenter] Number=1871 Confirmed=U Filename=CoreCenter.exe Description=MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking Source=Paul Collins Startup list [CoreCenter] Number=1872 Confirmed=U Filename=CORECE~1.EXE Description=MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking Source=Paul Collins Startup list [Corel Colleagues & Contacts Reminders] Number=1873 Confirmed=N Filename=cffrem.exe Description=Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of the now defunct Corel Print Office Source=Paul Collins Startup list [Corel Desktop Application Director] Number=1874 Confirmed=N Filename=dadx.exe Description=The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs Source=Paul Collins Startup list [Corel Family & Friends reminders] Number=1875 Confirmed=N Filename=CFFREM.EXE Description=Corel Family & Friends - all-in-one calender, address book and list manager. Part of the now defunct Corel Print House Magic Source=Paul Collins Startup list [Corel Photo Downloader] Number=1876 Confirmed=N Filename=MediaDetect.exe Description=Related to Corel Photo Album Source=Paul Collins Startup list [Corel Registration] Number=1877 Confirmed=N Filename=Remind32.exe Description=If you don't want to register Corel products and be reminded about it every 2 weeks disable it Source=Paul Collins Startup list [Corel Registration Reminder] Number=1878 Confirmed=N Filename=Remind32.exe Description=If you don't want to register Corel products and be reminded about it every 2 weeks disable it Source=Paul Collins Startup list [Corel Reminder] Number=1879 Confirmed=N Filename=NAVBROWSER.EXE Description=If you don't want to register Corel products and be reminded about it every 2 weeks disable it Source=Paul Collins Startup list [Corel Reminder] Number=1880 Confirmed=N Filename=NAVBrowser.exe Description=Registration reminder for CorelDRAW 10 Source=Paul Collins Startup list [CorelCENTRAL 10] Number=1881 Confirmed=N Filename=I_26dadCC.exe Description=CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs Source=Paul Collins Startup list [CorelDraw Toolbox] Number=1882 Confirmed=X Filename=CorelDraw.exe Description=Added by the SDBOT-VZ WORM! Source=Paul Collins Startup list [CorelMedia FoldersIndexer8] Number=1883 Confirmed=N Filename=MFindexer.exe Description=Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office Source=Paul Collins Startup list [CorelMedia FoldersIndexer8] Number=1884 Confirmed=N Filename=MFINDE~1.EXE Description=Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office Source=Paul Collins Startup list [CoreSrv] Number=1885 Confirmed=X Filename=coresrv.exe Description=Some IRC trojans/worms use this - see here for more information Source=Paul Collins Startup list [CORESYS] Number=1886 Confirmed=? Filename=coresys.exe Description=?? Source=Paul Collins Startup list [CorrectConnect] Number=1887 Confirmed=N Filename=CConnect.exe Description=Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available Source=Paul Collins Startup list [cosine] Number=1888 Confirmed=X Filename=cosine.exe Description=Added by the RBOT-SW WORM! Source=Paul Collins Startup list [CostAware] Number=1889 Confirmed=U Filename=niIPCApp.exe Description=NetInternals CostAware - download quota measuring tool Source=Paul Collins Startup list [Country Select] Number=1890 Confirmed=N Filename=pctptt.exe Description=Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required Source=Paul Collins Startup list [CountrySelection] Number=1891 Confirmed=N Filename=pctptt.exe Description=Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required Source=Paul Collins Startup list [Coupon Offers] Number=1892 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [couponica] Number=1893 Confirmed=X Filename=couponica.exe Description=Adware - see here Source=Paul Collins Startup list [CP] Number=1894 Confirmed=? Filename=CopyProtectionNotifier.exe Description=Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition Source=Paul Collins Startup list [CP32NOT] Number=1895 Confirmed=U Filename=CP32BTN.EXE Description=For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons Source=Paul Collins Startup list [CP4HPOT] Number=1896 Confirmed=U Filename=OneTouch.EXE Description=One Touch keyboard driver. Required if you use the additional keys Source=Paul Collins Startup list [CP888M1] Number=1897 Confirmed=N Filename=CP888M1.EXE Description=Related to EZbutton quick launcher for the Media player app that comes with certain laptops Source=Paul Collins Startup list [CPA9P2PSERVER] Number=1898 Confirmed=? Filename=CPA9P2PS.exe Description=Found on a Compaq Presario but what is it? Source=Paul Collins Startup list [cpanel] Number=1899 Confirmed=X Filename=winlogin32.exe Description=Added by the RBOT-FOY WORM! Source=Paul Collins Startup list [CPATR10] Number=1900 Confirmed=U Filename=CPATR10.EXE Description=Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast Source=Paul Collins Startup list [CPBrWtch] Number=1901 Confirmed=U Filename=CPBrWtch.exe Description=Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [CPD_EXE] Number=1902 Confirmed=Y Filename=CPD.EXE Description=Firewall bundled with McAfee VirusScan 6.* Source=Paul Collins Startup list [cpl] Number=1903 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [cpl] Number=1904 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [cpl] Number=1905 Confirmed=X Filename=s_menu.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [cpl] Number=1906 Confirmed=X Filename=browse.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [cpl] Number=1907 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [CplBTQ00] Number=1908 Confirmed=N Filename=CplBTQ00.EXE Description=Related to EZbutton quick launcher for the Media player app that comes with certain laptops Source=Paul Collins Startup list [CPLDBL10] Number=1909 Confirmed=N Filename=CPLDBL10.exe Description=Related to EZbutton quick launcher for the Media player app that comes with certain laptops Source=Paul Collins Startup list [cpntmgc] Number=1910 Confirmed=X Filename=wincomp.exe Description=Added by the WINTRIM_A TROJAN! Source=Paul Collins Startup list [cpntmgc] Number=1911 Confirmed=X Filename=simcss.exe Description=Added by the MAGICON.A TROJAN! Source=Paul Collins Startup list [cpntmgc] Number=1912 Confirmed=X Filename=navpmc.exe Description=Added by the SIMCSS TROJAN! Source=Paul Collins Startup list [cpntmgc] Number=1913 Confirmed=X Filename=winmgts.exe Description=Added by the WINTRIM-B TROJAN! Source=Paul Collins Startup list [CPortPatch] Number=1914 Confirmed=? Filename=cppatch.exe Description=CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? Source=Paul Collins Startup list [CPQAcDc] Number=1915 Confirmed=Y Filename=CPQAcDc.exe Description=Compaq PowerCon power management software for laptops Source=Paul Collins Startup list [CPQAlert] Number=1916 Confirmed=U Filename=CPQAlert.exe Description=Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information Source=Paul Collins Startup list [CPQBootPerfDB] Number=1917 Confirmed=N Filename=CPQBootPerfDB.EXE Description=See the entry for Compaq Message Server Source=Paul Collins Startup list [CPQCalib] Number=1918 Confirmed=Y Filename=CPQCalib.exe Description=Compaq PowerCon power management software for laptops Source=Paul Collins Startup list [CPQDFWAG] Number=1919 Confirmed=N Filename=CpqDfwAg.exe Description=For Compaq PC's. Runs Compaq diagnostics on every boot Source=Paul Collins Startup list [CPQEASYACC] Number=1920 Confirmed=U Filename=cpqeadm.exe Description=For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [CPQEASYACC] Number=1921 Confirmed=U Filename=StartEAK.exe Description=Easy Access Button Support for Compaq PCs. Required if you use these Source=Paul Collins Startup list [cpqeaui] Number=1922 Confirmed=U Filename=cpqeaui.exe Description=For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [cpqek] Number=1923 Confirmed=U Filename=kcpqek.exe Description=For Compaq PC's. Easy Access button support for the keyboard Source=Paul Collins Startup list [CPQInet Runtime Service] Number=1924 Confirmed=U Filename=CpqInet.exe Description=For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers Source=Paul Collins Startup list [CPQINKAGENT] Number=1925 Confirmed=N Filename=cpqinkag.exe Description=That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) Source=Paul Collins Startup list [cpqns] Number=1926 Confirmed=U Filename=cpqnpcss.exe Description=Related to Compaq.Net - not required if you don't use that Source=Paul Collins Startup list [Cpqset] Number=1927 Confirmed=N Filename=Cpqset.exe Description=Default settings software in Hewlett Packard notebook Source=Paul Collins Startup list [CPQSTUTFIX] Number=1928 Confirmed=Y Filename=stutfix.exe Description=For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton Source=Paul Collins Startup list [cpr] Number=1929 Confirmed=X Filename=cpr Description=Adroar.com adware downloader Source=Paul Collins Startup list [cprocsvc] Number=1930 Confirmed=X Filename=cproc.exe Description=Added by MSIL.AGENT.C TROJAN! Source=Paul Collins Startup list [CPU Manager] Number=1931 Confirmed=X Filename=cpumgr.exe Description=Added by the PANDEM.B WORM! Source=Paul Collins Startup list [CPU Temp Control] Number=1932 Confirmed=X Filename=wuitgurd.exe Description=Added by the RBOT-AHV WORM! Source=Paul Collins Startup list [CPU Watcher] Number=1933 Confirmed=X Filename=rundll32.exe [path] cpu.dll,load Description=Added by the DLOADER-LO TROJAN! Source=Paul Collins Startup list [CPU Windows Status] Number=1934 Confirmed=X Filename=cpustats.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [CPUcool] Number=1935 Confirmed=U Filename=Cpucool.exe Description=Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Cpusave] Number=1936 Confirmed=X Filename=Cpusave.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Cpusave32] Number=1937 Confirmed=X Filename=Cpusave32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [CPVHOST Settings] Number=1938 Confirmed=X Filename=cpvhost.exe Description=Added by the SDBOT.HMW WORM! Source=Paul Collins Startup list [cpyt] Number=1939 Confirmed=X Filename=hidep.exe Description=Added by the MIRJACK-A TROJAN! Source=Paul Collins Startup list [cqlyg] Number=1940 Confirmed=X Filename=world_cup_.bat Description=Added by the WCUP.A WORM! Source=Paul Collins Startup list [CQSCP2P SERVER] Number=1941 Confirmed=? Filename=?? Description="Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed Source=Paul Collins Startup list [CQSCP2PS] Number=1942 Confirmed=? Filename=?? Description="Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed Source=Paul Collins Startup list [Cr**.exe [* = random char]] Number=1943 Confirmed=X Filename=Cr**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Cr**.exe [* = random char]] Number=1944 Confirmed=X Filename=Cr**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Cr**32.exe [* = random char]] Number=1945 Confirmed=X Filename=Cr**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [cracked_windows1] Number=1946 Confirmed=U Filename=cracked_windows1.exe Description=Cracked Windows popup killer Source=Paul Collins Startup list [CrazyTalk Serve] Number=1947 Confirmed=N Filename=rundll32.exe CrazyTalk.dll, DIIServeMediaFile Description=CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS Source=Paul Collins Startup list [CRBroadCasting] Number=1948 Confirmed=U Filename=CRBroadCasting.exe Description=CardReader2 from On Track Inovations Ltd. USB Card Reader Source=Paul Collins Startup list [CRC Value Verifier] Number=1949 Confirmed=X Filename=crsss32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [CRC Value Verifier] Number=1950 Confirmed=X Filename=Crsss64.exe Description=Added by the RBOT-NY WORM! Source=Paul Collins Startup list [CRC Value Verifier] Number=1951 Confirmed=X Filename=svchost32.exe Description=Added by the RBOT-OA WORM! Source=Paul Collins Startup list [CRC Value Verifier] Number=1952 Confirmed=X Filename=crsss.exe Description=Added by the SPYBOT.UK WORM! Source=Paul Collins Startup list [Crc32stats Dependencies] Number=1953 Confirmed=X Filename=Crc32stats.exe Description=Added by the MYTOB.GT WORM! Source=Paul Collins Startup list [CRCSS] Number=1954 Confirmed=X Filename=crcss.exe Description=Added by the IRCBOT-TH WORM! Source=Paul Collins Startup list [Creata Mail] Number=1955 Confirmed=U Filename=JMSrvr.exe Description=Creata_Mail. Smileys, stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express Source=Paul Collins Startup list [Create A Monster] Number=1956 Confirmed=X Filename=createAMonster.exe Description=Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related Source=Paul Collins Startup list [CreateCD] Number=1957 Confirmed=N Filename=Createcd.exe Description=Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs Source=Paul Collins Startup list [CreateCD50] Number=1958 Confirmed=N Filename=Createcd50.exe Description=Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs Source=Paul Collins Startup list [Creative AGP Wizard] Number=1959 Confirmed=N Filename=agpwiz.exe Description=Part of Creative's BlasterControl Source=Paul Collins Startup list [Creative Audio Drivers] Number=1960 Confirmed=X Filename=creative.exe Description=Added by the RBOT-FKR WORM! Source=Paul Collins Startup list [Creative Detector] Number=1961 Confirmed=N Filename=CTDetect.exe Description=Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again Source=Paul Collins Startup list [Creative Launcher] Number=1962 Confirmed=N Filename=CTLauncher.exe Description=For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs Source=Paul Collins Startup list [Creative MediaSource Go] Number=1963 Confirmed=N Filename=CTCMSGo.exe Description="Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats" Source=Paul Collins Startup list [Creative PCI Audio Configuration Utility] Number=1964 Confirmed=N Filename=starter.exe Description=System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer Source=Paul Collins Startup list [Creative Service for CDROM Access] Number=1965 Confirmed=N Filename=Ctsvccda.exe Description=Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs Source=Paul Collins Startup list [Creative WebCam Tray] Number=1966 Confirmed=N Filename=Camtray.exe Description=Creative WebCam tray control - can be started manually Source=Paul Collins Startup list [Creative.exe] Number=1967 Confirmed=X Filename=Creative.exe Description=Added by the PROLIN WORM! Source=Paul Collins Startup list [CreativeDiscNotifier] Number=1968 Confirmed=N Filename=CTNOTIFY.EXE Description=For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [CreativeMixer] Number=1969 Confirmed=U Filename=CTMIX32.EXE Description=Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon Source=Paul Collins Startup list [CreativeTaskScheduler] Number=1970 Confirmed=? Filename=CTSched.exe Description=Creative Task Scheduler. What does it do and is it required? Source=Paul Collins Startup list [Critical Update Check] Number=1971 Confirmed=X Filename=battlenet.exe Description=Added by the DELF-LB TROJAN! Source=Paul Collins Startup list [CriticalUpdate] Number=1972 Confirmed=N Filename=Wucrtupd.exe Description=MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site Source=Paul Collins Startup list [CriticalUpdate] Number=1973 Confirmed=X Filename=wucrtupd.exe Description=Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder, and must not be confused with the legitimate Windows process of the same name as described here Source=Paul Collins Startup list [Crnsava] Number=1974 Confirmed=X Filename=scrnsave.pif Description=Added by the SDBOT-ZV WORM! Source=Paul Collins Startup list [cronos] Number=1975 Confirmed=X Filename=MARCO!.SCR Description=Added by the OPASERV.G WORM! Source=Paul Collins Startup list [CrossMenu] Number=1976 Confirmed=X Filename=CrossMenu Description=Toshiba CrossMenu Utility - allows the user to create their own menus Source=Paul Collins Startup list [CRP386 Networking] Number=1977 Confirmed=X Filename=crp386.exe Description=Added by the IRCBOT.N TROJAN! Source=Paul Collins Startup list [crs] Number=1978 Confirmed=X Filename=crs.exe Description=Added by the AGOBOT-TJ WORM! Source=Paul Collins Startup list [CRSSXP SysInfo] Number=1979 Confirmed=X Filename=crssxp.exe Description=Added by the SDBOT.NHS WORM! Source=Paul Collins Startup list [Crusty] Number=1980 Confirmed=X Filename=dmcpl.exe Description=Added by the RUSTY WORM! Source=Paul Collins Startup list [cryptdlg] Number=1981 Confirmed=X Filename=cryptdlg.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [cryptoexpert] Number=1982 Confirmed=U Filename=cexpert.exe Description=CryptoExpert from SecureAction Research. Advanced on the fly encryption system Source=Paul Collins Startup list [Cryptographic Service] Number=1983 Confirmed=X Filename=******.exe [* = random char] Description=Added by the KORGO.W or KORGO.X or KORGO.AB WORMS! Source=Paul Collins Startup list [Crystal 3D Audio Control] Number=1984 Confirmed=? Filename=CWD3DSND.EXE Description=Crystal 3D Audio sound driver. Is it required? Source=Paul Collins Startup list [csaRem] Number=1985 Confirmed=N Filename=spqmdmui.exe Description=Compaq modem country selection Source=Paul Collins Startup list [CSAV_CheckViruses] Number=1986 Confirmed=Y Filename=vchk.exe Description=Command Antivirus related Source=Paul Collins Startup list [csc] Number=1987 Confirmed=U Filename=csc.exe Description=Command line compiler for Microsoft C# it gets installed with the .NET SDK Source=Paul Collins Startup list [CSCRS Value] Number=1988 Confirmed=X Filename=cscrs.exe Description=Added by the RBOT-AAA WORM! Source=Paul Collins Startup list [CSCRS Value Check] Number=1989 Confirmed=X Filename=MsPMSPSd.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [CSINJECT.EXE] Number=1990 Confirmed=U Filename=CSINJECT.EXE Description=Part of Quarterdeck/Norton CleanSweep. "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes" Source=Paul Collins Startup list [csm Win Updates] Number=1991 Confirmed=X Filename=csm.exe Description=Added by the ZOTOB.B WORM! Source=Paul Collins Startup list [csoftok] Number=1992 Confirmed=X Filename=softok.exe Description=Added by the QQPASS.G TROJAN! Source=Paul Collins Startup list [csrs] Number=1993 Confirmed=X Filename=csrs.exe Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [csrsc] Number=1994 Confirmed=X Filename=csrsc.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [CSRSS] Number=1995 Confirmed=X Filename=CSRSS.EXE Description=Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Csrss] Number=1996 Confirmed=X Filename=csrss.exe Description=Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup and the executeable resides in a random folder name Source=Paul Collins Startup list [csrss] Number=1997 Confirmed=X Filename=csrss.exe Description=Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [csrss] Number=1998 Confirmed=X Filename=csrss.exe Description=Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a random subfolder Source=Paul Collins Startup list [csrss] Number=1999 Confirmed=X Filename=msmsgs.exe Description=Added by the CHODE-J WORM! Source=Paul Collins Startup list [csrss] Number=2000 Confirmed=X Filename=nwiz.exe Description=Added by the CHODE-J WORM! Source=Paul Collins Startup list [csrss] Number=2001 Confirmed=U Filename=csrss.exe Description=BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files/Supremtec folder Source=Paul Collins Startup list [CSRSS Loader] Number=2002 Confirmed=X Filename=csrsss.exe Description=Added by the AGOBOT.TX WORM! Source=Paul Collins Startup list [csrss.exe] Number=2003 Confirmed=X Filename=csrss.exe Description=Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in the Winnt\System32 or Windows\System32 folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [csrssLevel4] Number=2004 Confirmed=X Filename=csrss.exe Description=Unidentified malware. Note - this file is placed in a C:\Windows\System\Level4 folder, and should NOT be confused with the legitimate csrss.exe process which is always located in the Winnt\System32 or Windows\System32 folder and should NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [CSRSSU] Number=2005 Confirmed=X Filename=CSRSSU.exe Description=CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN! Source=Paul Collins Startup list [CSRSSW] Number=2006 Confirmed=X Filename=CSRSSW.EXE Description=Added by the CWS-F TROJAN! Source=Paul Collins Startup list [CSRSWIN] Number=2007 Confirmed=X Filename=[trojan filename] Description=Added by the WINSHELL.50 TROJAN! Source=Paul Collins Startup list [CSRSX] Number=2008 Confirmed=X Filename=[trojan filename] Description=Added by the WINSHELL.50.B TROJAN! Source=Paul Collins Startup list [CSS Server] Number=2009 Confirmed=U Filename=CSSServer.exe Description=ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [cssauth] Number=2010 Confirmed=U Filename=cssauth.exe Description=Related to IBM ThinkVantage Client Security Solution Source=Paul Collins Startup list [CSScheduleCheck] Number=2011 Confirmed=Y Filename=SCHWIZEX.EXE Description=Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot Source=Paul Collins Startup list [cssrs] Number=2012 Confirmed=X Filename=cssrs.exe Description=Added by the BANCBAN-DW TROJAN! Source=Paul Collins Startup list [csss] Number=2013 Confirmed=X Filename=Csss.exe Description=Added by the BALICK TROJAN! Source=Paul Collins Startup list [CSS_Central] Number=2014 Confirmed=U Filename=CSS_1631.EXE Description=CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). "CSS Central� provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console" Source=Paul Collins Startup list [CSV10P1] Number=2015 Confirmed=X Filename=CSP001.exe Description=ClearSearch adware Source=Paul Collins Startup list [CSV10P70] Number=2016 Confirmed=X Filename=CSv10P070.exe Description=ClearSearch adware Source=Paul Collins Startup list [CSV7P26] Number=2017 Confirmed=X Filename=CSV7P26.exe Description=ClearSearch adware Source=Paul Collins Startup list [CSV7P70] Number=2018 Confirmed=X Filename=CSV7P070.exe Description=ClearSearch adware Source=Paul Collins Startup list [CSV7P91] Number=2019 Confirmed=X Filename=CSV7P91.exe Description=ClearSearch adware Source=Paul Collins Startup list [csvdea] Number=2020 Confirmed=U Filename=csvdea.exe Description=SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [csvhost.exe] Number=2021 Confirmed=X Filename=csvhost.exe Description=Added by the CIMUZ-BD TROJAN! Source=Paul Collins Startup list [ct] Number=2022 Confirmed=Y Filename=ct.exe Description=ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it Source=Paul Collins Startup list [CT Control Settings] Number=2023 Confirmed=X Filename=CTSVCCD.EXE Description=Added by the RBOT-YS WORM! Source=Paul Collins Startup list [CTAVTray] Number=2024 Confirmed=N Filename=CTAvTray.exe Description=For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ Source=Paul Collins Startup list [CTCMonitor] Number=2025 Confirmed=U Filename=CTCMonitor.exe Description=Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office, it is not required Source=Paul Collins Startup list [CTDVDDet] Number=2026 Confirmed=N Filename=CTDVDDet.exe Description=Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again Source=Paul Collins Startup list [CTDVDDet] Number=2027 Confirmed=N Filename=CTDetect.exe Description=Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again Source=Paul Collins Startup list [ctflog manager] Number=2028 Confirmed=X Filename=ctflog.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [CTFM0N.exe] Number=2029 Confirmed=X Filename=CTFM0N.exe Description=Added by the STARTPAGE.P TROJAN! Source=Paul Collins Startup list [ctfmon] Number=2030 Confirmed=U Filename=ctfmon.exe Description=CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. Ctfmon can be disabled from Control Panel, Text & Speech Services. Note - the file will always be located in the System32 folder, if it is located elsewhere it will likely be a worm or trojan! Can cause problems with some other programs if left enabled - see here for such an example Source=Paul Collins Startup list [ctfmon] Number=2031 Confirmed=X Filename=taskmgr32*.exe [* = number] Description=Added by the SOWSAT.B WORM! Source=Paul Collins Startup list [ctfmon] Number=2032 Confirmed=X Filename=cftmon.exe Description=Added by the DELIVE-A TROJAN! Note - this file is found in C:\Windows or C:\Winnt and is not the valid MS Office file of the same name (see here) Source=Paul Collins Startup list [ctfmon] Number=2033 Confirmed=X Filename=mIRC.dll Description=Added by the DELBOT-E TROJAN! Source=Paul Collins Startup list [ctfmon] Number=2034 Confirmed=X Filename=WinConst.exe Description=Added by the ASSASIN-G TROJAN! Source=Paul Collins Startup list [CTFMon] Number=2035 Confirmed=U Filename=ctfmon.exe Description=Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you installed it yourself! Found in the System\CTF (9x/Me) or System32\CTF (NT/2K/XP) folder Source=Paul Collins Startup list [ctfmon] Number=2036 Confirmed=X Filename=msnmsgr.exe Description=Added by the JV TROJAN! Source=Paul Collins Startup list [Ctfmon.exe] Number=2037 Confirmed=X Filename=ctfmon32.exe Description=CoolWebSearch Ctfmon32 parasite variant Source=Paul Collins Startup list [ctfmon.exe] Number=2038 Confirmed=X Filename=ctfmon.exe Description=Added by the RAIDYS TROJAN! Note - this should not be confused with the valid Office XP file, see here Source=Paul Collins Startup list [ctfmon.exe] Number=2039 Confirmed=X Filename=msupdate32.exe Description=Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe Source=Paul Collins Startup list [ctfmon.exe] Number=2040 Confirmed=U Filename=ctfmon.exe Description=CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. Ctfmon can be disabled from Control Panel, Text & Speech Services. Note - the file will always be located in the System32 folder, if it is located elsewhere it will likely be a worm or trojan! Can cause problems with some other programs if left enabled - see here for such an example Source=Paul Collins Startup list [CTFMON32] Number=2041 Confirmed=X Filename=CTFMON32.EXE Description=CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN! Source=Paul Collins Startup list [CTFMONSS] Number=2042 Confirmed=X Filename=CTFMONSS.EXE Description=Added by the CWS-F TROJAN! Source=Paul Collins Startup list [ctfnom] Number=2043 Confirmed=X Filename=rundIl32.exe Description=Added by the LEGMIR-AW TROJAN! Source=Paul Collins Startup list [ctfnom.exe] Number=2044 Confirmed=X Filename=SVOHOST.exe Description=Added by the DIGIDOR-A TROJAN! Source=Paul Collins Startup list [ctfnom.exe] Number=2045 Confirmed=X Filename=OSRSS.exe Description=Added by the DLOADER-UQ TROJAN! Source=Paul Collins Startup list [CTHELPER] Number=2046 Confirmed=U Filename=CTHELPER.EXE Description=CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative's sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it Source=Paul Collins Startup list [CTHelper] Number=2047 Confirmed=X Filename=cthelper.exe Description=Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here Source=Paul Collins Startup list [CTime] Number=2048 Confirmed=X Filename=[path to trojan] Description=Added by the HTTPDOS TROJAN! Source=Paul Collins Startup list [CTin10] Number=2049 Confirmed=X Filename=CTin10.exe Description=Added by the BANCOS.E TROJAN! Source=Paul Collins Startup list [CtModule] Number=2050 Confirmed=X Filename=CtModule.exe Description=Added by the CLICKER-EG TROJAN! Source=Paul Collins Startup list [CTNMRUN] Number=2051 Confirmed=U Filename=ctnmrun.exe Description=Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected Source=Paul Collins Startup list [CTPDPSRV] Number=2052 Confirmed=? Filename=CTPDPSRV.EXE Description=Printer driver (in the WINDOWS\System32\spool\DRIVERS\W32\X86 folder). Is it required? Source=Paul Collins Startup list [CTPerformanceUtility] Number=2053 Confirmed=N Filename=CTPowUti.exe Description=Related to Creative PowerSysTrayApp. This program is a non-essential process, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [ctpmon] Number=2054 Confirmed=X Filename=ctpmon.exe Description=System Registry Cleaner - stealth installed foistware from sysregistry.com Source=Paul Collins Startup list [CTRegRun] Number=2055 Confirmed=N Filename=CTRegRun.exe Description=For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative Source=Paul Collins Startup list [CtrlVol] Number=2056 Confirmed=U Filename=CtrlVol.exe Description=Volume control key on Acer, Fujitsu and other laptops Source=Paul Collins Startup list [CTSched] Number=2057 Confirmed=? Filename=CTSched.exe Description=Creative Task Scheduler. What does it do and is it required? Source=Paul Collins Startup list [CTStartup] Number=2058 Confirmed=N Filename=CTEaxSpl.exe Description=Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard Source=Paul Collins Startup list [CTSyncU.exe] Number=2059 Confirmed=N Filename=CTSyncU.exe Description=Creative Sync Manager - synchronizes music tracks on your computer with your player Source=Paul Collins Startup list [CTsysVol] Number=2060 Confirmed=U Filename=CTSYSVOL.exe Description=Creative sound card volume controls Source=Paul Collins Startup list [cttdpsrv] Number=2061 Confirmed=? Filename=cttdpsrv.exe Description=?? Source=Paul Collins Startup list [CTUpdate] Number=2062 Confirmed=X Filename=ctupdclt.exe Description=Added by the RBOT-ABG WORM! Source=Paul Collins Startup list [CTxfiHlp] Number=2063 Confirmed=N Filename=CTXFIHLP.EXE Description=Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card Source=Paul Collins Startup list [CTXFIREG] Number=2064 Confirmed=N Filename=CTxfiReg.exe Description=Creative Labs sound card driver related. It appears that it isn't required and maybe registration related Source=Paul Collins Startup list [Ctykd] Number=2065 Confirmed=X Filename=[path to file] Description=SMALL.SN spyware Source=Paul Collins Startup list [CU1] Number=2066 Confirmed=X Filename=VCClient.exe Description=Associated with the Surf Sidekick adware and should be removed Source=Paul Collins Startup list [CU2] Number=2067 Confirmed=X Filename=VCMain.exe Description=Associated with the Surf Sidekick adware and should be removed Source=Paul Collins Startup list [cuagentExe] Number=2068 Confirmed=Y Filename=Cuagent.exe Description=Command Antivirus related Source=Paul Collins Startup list [cuo] Number=2069 Confirmed=X Filename=cuo.exe Description=Added by the BUGBEAR.A WORM! Source=Paul Collins Startup list [Current Security Config] Number=2070 Confirmed=X Filename=csecure.exe Description=Added by the RBOT-AMO WORM! Source=Paul Collins Startup list [cursor] Number=2071 Confirmed=N Filename=Screendragon_VS_Taskbar.exe Description=ScreenDragon video player Source=Paul Collins Startup list [CursorXP] Number=2072 Confirmed=N Filename=CursorXP.exe Description=CursorXP from Stardock - tool for creating mouse cursors Source=Paul Collins Startup list [Customizer2000] Number=2073 Confirmed=U Filename=logon.exe Description=Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" Source=Paul Collins Startup list [CuteMX] Number=2074 Confirmed=N Filename=CuteMX.EXE Description=File sharing utility Source=Paul Collins Startup list [cvmonitor.exe] Number=2075 Confirmed=X Filename=cvmonitor.exe Description=Added by the SDBOT.BV WORM! Source=Paul Collins Startup list [CVPND] Number=2076 Confirmed=Y Filename=cvpnd.exe Description=Sub-system used by Cisco VPN client for making a connection to a remote IPSec server Source=Paul Collins Startup list [CW] Number=2077 Confirmed=U Filename=cw4.exe Description=Chat Watch "is a monitoring and logging software for online chat and instant messaging programs" Source=Paul Collins Startup list [CWatch] Number=2078 Confirmed=U Filename=cw.exe Description=ChatWatch - chat monitoring tool Source=Paul Collins Startup list [cwbckver] Number=2079 Confirmed=N Filename=cwbckver.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources Source=Paul Collins Startup list [cwbinhlp] Number=2080 Confirmed=N Filename=cwbinhlp.exe Description=Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries Source=Paul Collins Startup list [cwbsvstr] Number=2081 Confirmed=N Filename=cwbsvstr.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources Source=Paul Collins Startup list [cwbwlwiz] Number=2082 Confirmed=? Filename=cwbwlwiz.exe Description=Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? Source=Paul Collins Startup list [Cwcdschk.exe] Number=2083 Confirmed=? Filename=Cwcdschk.exe Description=IBM Thinkpad related? Source=Paul Collins Startup list [cwcptray] Number=2084 Confirmed=U Filename=cwcptray.exe Description=Related to ContentWatch Parental Control internet filter Source=Paul Collins Startup list [cwingllib] Number=2085 Confirmed=X Filename=atllsimm.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [cwupdate] Number=2086 Confirmed=U Filename=cwupdate.exe Description=ContentProtect from ContentWatch - internet filter Source=Paul Collins Startup list [CXMon] Number=2087 Confirmed=N Filename=Hpi_Monitor.exe Description=Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs Source=Paul Collins Startup list [Cyber] Number=2088 Confirmed=N Filename=cyberchk.exe Description=Part of Belkins "Multimedia Cleaning Kit" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after "x" amount of time has passed Source=Paul Collins Startup list [Cyber Trio] Number=2089 Confirmed=U Filename=showmode.exe Description=From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs Source=Paul Collins Startup list [Cyber-Defender 2003] Number=2090 Confirmed=U Filename=uwcdsvr.exe Description=Cyber Defender 2003 Source=Paul Collins Startup list [cyberfree.exe] Number=2091 Confirmed=X Filename=****.dat [* = random char] Description=Unidentified adware Source=Paul Collins Startup list [Cyberhawk] Number=2092 Confirmed=U Filename=CHTray.exe Description=Cyberhawk from Novatix. Protects against viruses, spyware, identity theft Source=Paul Collins Startup list [CyberLat Ram Cleaner] Number=2093 Confirmed=U Filename=CLRamCleaner.exe Description=CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [CyberMedia Agent] Number=2094 Confirmed=N Filename=CMAGENT.EXE Description=Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled Source=Paul Collins Startup list [CyberPatrolNew] Number=2095 Confirmed=U Filename=cphq.exe Description="CyberPatrol is one of the most powerful and popular client-based, browser independent, Internet safety software solutions for Windows-based standalone PCs available today" Source=Paul Collins Startup list [CyberWolf] Number=2096 Confirmed=X Filename=CyberWolf.exe Description=Added by the KICKIN.A (or CYDOG.C) WORM! Source=Paul Collins Startup list [CyDoor] Number=2097 Confirmed=X Filename=CD_Load.exe Description=Adware. Check here for information about Cy-Door and here for a program that can remove it Source=Paul Collins Startup list [CydoorUpdate] Number=2098 Confirmed=X Filename=CD_Load.exe Description=Adware. Check here for information about Cy-Door and here for a program that can remove it Source=Paul Collins Startup list [CYNHKey] Number=2099 Confirmed=? Filename=CYNHKey.exe Description=?? Source=Paul Collins Startup list [CyphTray] Number=2100 Confirmed=N Filename=CyphTray.exe Description=Cypherus - encryption software Source=Paul Collins Startup list [CypressLinkMon] Number=2101 Confirmed=U Filename=CypressLinkMon.exe Description=Related to CypressViewer from Siemens that "allows ACUSON Cypress cardiovascular system PLUS users to store, view, and analyze Cypress system PLUS studies on a standard Windows PC" Source=Paul Collins Startup list [D SYSTEM] Number=2102 Confirmed=X Filename=dd.exe Description=Added by the MYTOB-FN WORM! Source=Paul Collins Startup list [D-Link Air USB Utility] Number=2103 Confirmed=Y Filename=AirCFG.exe Description=D-Link wireless PCI adapter related Source=Paul Collins Startup list [D-Link Air Utility] Number=2104 Confirmed=Y Filename=AirCFG.exe Description=D-Link wireless PCI adapter related Source=Paul Collins Startup list [D-Link AirPlus DWL-650+ Utility] Number=2105 Confirmed=N Filename=WLANMON.exe Description=D-Link Air Plus Wireless PC modem connection monitor Source=Paul Collins Startup list [D-Link AirPlus G] Number=2106 Confirmed=Y Filename=AirGCFG.exe Description=D-Link Airplus Wireless Router driver Source=Paul Collins Startup list [D-Link AirPlus G Wireless Utility] Number=2107 Confirmed=Y Filename=AirPlus.exe Description=D-Link AirPlus G wireless configuration and monitoring utility Source=Paul Collins Startup list [D-Link AirPlus XtremeG] Number=2108 Confirmed=U Filename=AirPlusCFG.exe Description=D-Link AirPlus XtremeG wireless configuration utility Source=Paul Collins Startup list [D066UUtility] Number=2109 Confirmed=N Filename=D066UUTY.EXE Description=TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software Source=Paul Collins Startup list [D3**.exe [* = random char]] Number=2110 Confirmed=X Filename=D3**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [D3**32.exe [* = random char]] Number=2111 Confirmed=X Filename=D3**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [d3dupdate.exe] Number=2112 Confirmed=X Filename=bbeagle.exe Description=Added by the BEAGLE.A WORM! Source=Paul Collins Startup list [D4] Number=2113 Confirmed=U Filename=D4.exe Description=Dimension 4 - network time synchronization freeware - starts-up, adjusts the system clock, then shuts down Source=Paul Collins Startup list [dabrun] Number=2114 Confirmed=X Filename=rundll32.exe [path] dabapi.dll, Rundll32 Description=SinaUpdateCenter adware Source=Paul Collins Startup list [DACONFIGEXE] Number=2115 Confirmed=N Filename=daconfig.exe Description=3Com NIC Diagnostics. Available via Start -> Programs Source=Paul Collins Startup list [DadApp] Number=2116 Confirmed=Y Filename=dadapp.exe Description="DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required, but should be left in because it can create a hassle and doesn't always restore functionality to those buttons once unchecked and rechecked" - direct from Dell Source=Paul Collins Startup list [Daemon] Number=2117 Confirmed=N Filename=DAEMON32.EXE Description=Pre-loads game profiles for MS Sidewinder game controllers prior to release 2.0 of the software. Recommend upgrade. Available via Start -> Programs Source=Paul Collins Startup list [Daemon] Number=2118 Confirmed=U Filename=Daemon.exe Description=Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive Source=Paul Collins Startup list [Daemon] Number=2119 Confirmed=X Filename=daemon.exe c daemon2.exe Description=Added by the SELOTIMA.A WORM! Source=Paul Collins Startup list [DAEMON Tools-1033] Number=2120 Confirmed=U Filename=Daemon.exe Description=Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive Source=Paul Collins Startup list [Daily Planner] Number=2121 Confirmed=N Filename=dayplan.exe Description=Daily Planner - discontinued, and now part of KMCS Deluxe System Suite. Tool to plan your days, and check activities off as you complete them Source=Paul Collins Startup list [Daily Weather Forecast] Number=2122 Confirmed=X Filename=weather.exe Description=Added by the DLOADER-IP TROJAN! Source=Paul Collins Startup list [DamedWare Services] Number=2123 Confirmed=X Filename=dwdrce.exe Description=Added by the RBOT-AOJ WORM! Source=Paul Collins Startup list [Dancer] Number=2124 Confirmed=U Filename=DncLE.exe Description=Part of Microsoft Plus! Digital Media Edition - see here Source=Paul Collins Startup list [Danton*] Number=2125 Confirmed=X Filename=[random filename] Description=Added by the DANTON TROJAN! where * = random number Source=Paul Collins Startup list [Dap] Number=2126 Confirmed=N Filename=DAP.exe Description=Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based Source=Paul Collins Startup list [dark] Number=2127 Confirmed=X Filename=imgst.scr Description=Added by the BANCOS.U TROJAN! Source=Paul Collins Startup list [dark] Number=2128 Confirmed=X Filename=imgrt.scr Description=Added by the BANCBAN-FH TROJAN! Source=Paul Collins Startup list [dark] Number=2129 Confirmed=X Filename=csrs.scr Description=Added by the BANCBAN-GT or BANCBAN-GU TROJANS! Source=Paul Collins Startup list [DarkDevil.Grasiele.BR] Number=2130 Confirmed=X Filename=Grasiele.VBS Description=Added by the LEMBRA WORM! Source=Paul Collins Startup list [DarKNesS LsasS] Number=2131 Confirmed=X Filename=LsasS23.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [DashIE] Number=2132 Confirmed=? Filename=N/A Description=Could be related to "Dash Power Shopping" tool bar in IE? Source=Paul Collins Startup list [dasxdads] Number=2133 Confirmed=X Filename=fsdqd.exe Description=Added by the GAOBOT.BIQ WORM! Source=Paul Collins Startup list [Data] Number=2134 Confirmed=X Filename=System.dat.vbs Description=Added by the BISCUIT.A WORM! Source=Paul Collins Startup list [data] Number=2135 Confirmed=X Filename=msngs.exe Description=Added by the RBOT-ADQ WORM! Source=Paul Collins Startup list [Data LifeGuard] Number=2136 Confirmed=N Filename=BACKWE~1.EXE Description=Data LifeGuard diagnostic tools for Western Digital's series of hard drives Source=Paul Collins Startup list [Data LifeGuard LifeLine Lite installer] Number=2137 Confirmed=N Filename=DLGLI.EXE Description=Backweb installer - see here Source=Paul Collins Startup list [Data Restore Service] Number=2138 Confirmed=X Filename=prq8.exe Description=Added by the KELVIR.AI WORM! Source=Paul Collins Startup list [Data789] Number=2139 Confirmed=X Filename=Regedit.exe ....data789.tmp Description=Homepage hijacker Source=Paul Collins Startup list [DATABASE MySql] Number=2140 Confirmed=X Filename=[path] repcale.exe [path] beird.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [DataCaching] Number=2141 Confirmed=N Filename=FlashKsk.exe Description=SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon Source=Paul Collins Startup list [DataKeeper] Number=2142 Confirmed=U Filename=DataKeeper.exe Description=PowerQuest DataKeeper (now owned by Symantec) backup software Source=Paul Collins Startup list [DataLayer] Number=2143 Confirmed=U Filename=DataLayer.exe Description=Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." Synchronize the phone with, for example Outlook. You can also use it to browse your phone, edit the phone list and so on Source=Paul Collins Startup list [DataViz Inc Messenger] Number=2144 Confirmed=X Filename=DvzIncMsgr.exe Description=Installed with DataViz "Documents to Go" software Source=Paul Collins Startup list [DataViz Messenger] Number=2145 Confirmed=N Filename=DvzMsgr.exe Description=DataViz Documents to Go - "allows you to use your Word, Excel and PowerPoint files on your handheld anywhere, anytime. In addition, it now synchronizes e-mail with attachments, PDF files, pictures and Excel-like charts" Source=Paul Collins Startup list [Datcheck] Number=2146 Confirmed=X Filename=datcheck.exe Description=Added by the KEYPANIC TROJAN! Source=Paul Collins Startup list [Date Manager] Number=2147 Confirmed=X Filename=datemanager.exe Description=Date Manager - calender program. Spyware/adware based provided by The Gator Corporation. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [Datechecker] Number=2148 Confirmed=? Filename=N/A Description=Could be related to this? Source=Paul Collins Startup list [DateMakerIntl] Number=2149 Confirmed=X Filename=DateMakerIntl.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [DAupdate] Number=2150 Confirmed=X Filename=DAupdate.exe Description=NavEnhance adware Source=Paul Collins Startup list [DAW9532.exe] Number=2151 Confirmed=? Filename=DAW9532.EXE Description=Loaded during installation of some 3Com network cards. Enables their DynamicAccess desktop management software. Is it required? Source=Paul Collins Startup list [DayToday] Number=2152 Confirmed=U Filename=DAYTODAY.EXE Description=DayToday from RoboMagic Software Corp. Displays the date on the taskbar Source=Paul Collins Startup list [DAZEL Delivery Agent] Number=2153 Confirmed=U Filename=DcDaemon.exe Description=Control and send documents, etc, to any destination. The Dazel Corporation has now been taken over by HP Source=Paul Collins Startup list [dbserv] Number=2154 Confirmed=N Filename=dbserv.exe Description=Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled Source=Paul Collins Startup list [DC6_Check] Number=2155 Confirmed=N Filename=uwasdc.exe Description=WinAntiSpyware 2006 spyware remover - not recommended, see here Source=Paul Collins Startup list [DC6_check] Number=2156 Confirmed=N Filename=dc6_startupmon.exe Description=WinAntiVirus 2006 virus software - not recommended, see here Source=Paul Collins Startup list [dc6_check] Number=2157 Confirmed=N Filename=dcmon.exe Description=SystemDoctor is a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [DCE Manager] Number=2158 Confirmed=X Filename=dcemgr.exe Description=Added by the TUMAG TROJAN! Source=Paul Collins Startup list [DCfssvc] Number=2159 Confirmed=U Filename=dcfssvc.exe Description=Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup, your camera will not cause your computer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example Source=Paul Collins Startup list [dcfssve] Number=2160 Confirmed=U Filename=dcfssvc.exe Description=Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup, your camera will not cause your computer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example Source=Paul Collins Startup list [Dcom System Patch] Number=2161 Confirmed=X Filename=Microsoft.exe Description=Added by the RANDEX.MS WORM! Source=Paul Collins Startup list [dcsm] Number=2162 Confirmed=N Filename=dcsm.exe Description=DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks Source=Paul Collins Startup list [DDCActiveMenu] Number=2163 Confirmed=N Filename=DDCActiveMenu.exe Description=Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [DDCM] Number=2164 Confirmed=N Filename=DDCMan.exe Description=Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [DDCMan] Number=2165 Confirmed=N Filename=DDCMan.exe Description=Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [ddeproc] Number=2166 Confirmed=X Filename=ddeproc.exe Description=Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here Source=Paul Collins Startup list [ddhelper] Number=2167 Confirmed=U Filename=W815DM.EXE Description=Enuff Parental Control Software by Akrontech Source=Paul Collins Startup list [DDialler] Number=2168 Confirmed=X Filename=DDialler.exe Description=Adult content dialler Source=Paul Collins Startup list [DDriver] Number=2169 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [DDT] Number=2170 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [de32gen] Number=2171 Confirmed=X Filename=de32gen.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [DeadAIM] Number=2172 Confirmed=N Filename=rundll32.exe DeadAIM.ocm, ExportedCheckODLs Description=DeadAIM - feature enhancing product for AOL's Instant Messenger program Source=Paul Collins Startup list [DealHelperBrwsr] Number=2173 Confirmed=X Filename=dhbrwsr.exe Description=DealHelper adware Source=Paul Collins Startup list [DealHelperDown] Number=2174 Confirmed=X Filename=download.exe Description=DealHelper adware Source=Paul Collins Startup list [DealHelperUpdate] Number=2175 Confirmed=X Filename=DHUpdt.exe Description=DealHelper adware Source=Paul Collins Startup list [Death.exe] Number=2176 Confirmed=X Filename=Death.exe Description=Added by the DELF-ERW TROJAN! Source=Paul Collins Startup list [Debug] Number=2177 Confirmed=X Filename=DebugW32.exe Description=Added by the GUBED TROJAN! Source=Paul Collins Startup list [Debugger] Number=2178 Confirmed=X Filename=dbg32.exe Description=Added by the MYTOB-FW WORM! Source=Paul Collins Startup list [Debugger] Number=2179 Confirmed=X Filename=explorer32dbg.exe Description=Added by the CWS-M TROJAN! Source=Paul Collins Startup list [Debugger] Number=2180 Confirmed=X Filename=iexplore_dbg.exe Description=Added by the CWS-M TROJAN! Source=Paul Collins Startup list [debugger] Number=2181 Confirmed=X Filename=help.pif Description=Added by the DELF-DRA WORM! Source=Paul Collins Startup list [DebugMonitor] Number=2182 Confirmed=X Filename=debugmonitor.exe Description=Added by the MYDOOM.BG WORM! Source=Paul Collins Startup list [DeeEnEs] Number=2183 Confirmed=U Filename=DeeEnEs.exe Description=DeeEnEs - automatically updates a dynamic IP address when it changes Source=Paul Collins Startup list [deejay] Number=2184 Confirmed=X Filename=forboo.exe Description=Added by the FORBOT-AY WORM! Source=Paul Collins Startup list [Default] Number=2185 Confirmed=X Filename=explore.vbs Description=Added by the ALLEM WORM! Source=Paul Collins Startup list [Default] Number=2186 Confirmed=X Filename=mtask.vbe Description=Added by the ALLEM WORM! Source=Paul Collins Startup list [default] Number=2187 Confirmed=X Filename=shell32.exe Description=Added by the BINGHE TROJAN! Source=Paul Collins Startup list [Default System Research] Number=2188 Confirmed=X Filename=vhchost.exe Description=Added by the TARNO.I TROJAN! Source=Paul Collins Startup list [Default web browser] Number=2189 Confirmed=X Filename=IexpIore.exe Description=Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer), the first has a captial "i" in place of lower case "L" Source=Paul Collins Startup list [Default_Page_URL] Number=2190 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [Default_Search_URL] Number=2191 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [defender] Number=2192 Confirmed=X Filename=defender25.exe Description=DollarRevenue adware Source=Paul Collins Startup list [defender] Number=2193 Confirmed=X Filename=dfndref_7.exe Description=DollarRevenue adware Source=Paul Collins Startup list [defergui] Number=2194 Confirmed=? Filename=defergui.exe Description=Related to IBM Standard Software Installer. What does it do and is it required? Source=Paul Collins Startup list [defragm_check] Number=2195 Confirmed=X Filename=defragment.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [defragsys] Number=2196 Confirmed=X Filename=svchost.exe Description=Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [defwatch] Number=2197 Confirmed=U Filename=defwatch.exe Description=Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis Source=Paul Collins Startup list [Deko550] Number=2198 Confirmed=U Filename=Deko550.exe Description=Associated with the Deko550 entry-level SD real-time graphics system from Avid Technology Source=Paul Collins Startup list [Delay] Number=2199 Confirmed=U Filename=delayrun.exe Description=On HP PCs this program is used to help prevent conflicts or timing issues on fast computers Source=Paul Collins Startup list [Delayrun] Number=2200 Confirmed=U Filename=delayrun.exe Description=On HP PCs this program is used to help prevent conflicts or timing issues on fast computers Source=Paul Collins Startup list [delcab] Number=2201 Confirmed=? Filename=deltreew.exe C:\cabs Description=?? Source=Paul Collins Startup list [Delete Me] Number=2202 Confirmed=X Filename=worm.exe Description=Added by the DOOMHUNTER WORM! Source=Paul Collins Startup list [DeleteHistoryFree] Number=2203 Confirmed=U Filename=dhf.exe Description=Delete History Free - "Privacy protection software for deleting Internet surfing and other computer activity tracks from your PC" Source=Paul Collins Startup list [Dell AIO Printer A***] Number=2204 Confirmed=N Filename=dlbabmgr.exe Description=Dell AIO Printer A*** related (*** = model). Not Required at Startup Source=Paul Collins Startup list [Dell AIO Printer A***] Number=2205 Confirmed=N Filename=dlbfbmgr.exe Description=Dell AIO Printer A*** related (*** = model). Not Required at Startup Source=Paul Collins Startup list [Dell AIO Printer A***] Number=2206 Confirmed=N Filename=dlbkbmgr.exe Description=Dell AIO Printer A*** related (*** = model). Not Required at Startup Source=Paul Collins Startup list [Dell Alert] Number=2207 Confirmed=N Filename=DAMon.exe Description="Dell Alert" utility, that's supposed to make interaction with Support easier Source=Paul Collins Startup list [Dell Photo AIO Printer 922] Number=2208 Confirmed=? Filename=dlbtbmgr.exe Description=Dell Photo AIO Printer 922 Device Monitor. Is it required? Source=Paul Collins Startup list [Dell Photo AIO Printer 942] Number=2209 Confirmed=? Filename=dlbubmgr.exe Description=Dell Photo AIO Printer 942 Device Monitor. Is it required? Source=Paul Collins Startup list [Dell Photo AIO Printer 962] Number=2210 Confirmed=? Filename=dlbxmon.exe Description=Dell Photo AIO Printer 962 Device Monitor. Is it required? Source=Paul Collins Startup list [Dell QuickSet] Number=2211 Confirmed=N Filename=quickset.exe Description=Dell taskbar icon allowing you to quickly change settings Source=Paul Collins Startup list [Dell Wireless Manager UI] Number=2212 Confirmed=U Filename=WLTRAY Description=Installed alongside Dell Wireless WLAN Card and provides additional configuration options for these devices Source=Paul Collins Startup list [Dell Wireless Manager UI] Number=2213 Confirmed=N Filename=wltray.exe Description=System tray access to wireless LAN card configuration options Source=Paul Collins Startup list [DellDMI] Number=2214 Confirmed=? Filename=delldmi.exe Description=Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards? Source=Paul Collins Startup list [DELLMMKB] Number=2215 Confirmed=U Filename=DELLMMKB.EXE Description=Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys Source=Paul Collins Startup list [DellSC] Number=2216 Confirmed=N Filename=dellsc.exe Description=Dell Solution Center - web-based troubleshooting tools and educational offerings Source=Paul Collins Startup list [DellSupport] Number=2217 Confirmed=U Filename=DSAgnt.exe Description=Dell Support Agent offers additional support and update features for your Dell computer or laptop Source=Paul Collins Startup list [DellTouch] Number=2218 Confirmed=U Filename=MMKeybd.exe Description=Dell multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [DellTouch] Number=2219 Confirmed=U Filename=DELLMMKB.EXE Description=Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys Source=Paul Collins Startup list [delmsbb] Number=2220 Confirmed=X Filename=delmsbb.exe Description=NCase adware Source=Paul Collins Startup list [delsaap] Number=2221 Confirmed=X Filename=delsaap.exe Description=NCase adware Source=Paul Collins Startup list [delstart] Number=2222 Confirmed=? Filename=delstart.exe Description=Reportedly part of BT ISP software - what does it do and is it required in startup? Source=Paul Collins Startup list [delsubmit] Number=2223 Confirmed=X Filename=rundll32.exe advpack.dll, DelNodeRunDLL32 submit.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [DelTmp] Number=2224 Confirmed=? Filename=DelTemp.exe Description=Added to the startup list after installing a Creative SoundBlaster Audigy soundcard. Deletes temporary files once an installation is complete? Source=Paul Collins Startup list [DeltTray] Number=2225 Confirmed=N Filename=deltray.exe Description=System Tray access to the control panel for the M-Audio Delta 44 PCI Analog Recording Interface. Available via a desktop shortcut, Start -> Programs or Start -> Settings -> Control Panel Source=Paul Collins Startup list [DeluxeCommunications] Number=2226 Confirmed=X Filename=Dxc.exe Description=Deluxe Communications, a SurfSideKick adware variant Source=Paul Collins Startup list [DELXP Protocol] Number=2227 Confirmed=X Filename=delxp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [demon] Number=2228 Confirmed=? Filename=demon.exe Description=Part of the French Wanadoo ADSL extense pack. What does it do and is it required? Source=Paul Collins Startup list [Deneca] Number=2229 Confirmed=X Filename=Virus salvado Description=Added by the DELUZ VIRUS! Source=Paul Collins Startup list [DepFrez] Number=2230 Confirmed=U Filename=frzstate.exe Description=Deep Freeze from Faronics Coporation. "Freezes" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators, for example Source=Paul Collins Startup list [Description of Shortcuts] Number=2231 Confirmed=? Filename=*.exe Description=* seems to be a sequence of alphanumerics that can be different, i.e., 1960F8A9, 4EBD23F5, etc. Each of these files would appear to be a shortcut, i.e., 4EBD23F5 is actually Works Calender Reminder (found via a registry search) Source=Paul Collins Startup list [Desire] Number=2232 Confirmed=X Filename=desires.exe Description=Adult content dialler Source=Paul Collins Startup list [desk-top-service] Number=2233 Confirmed=? Filename=desk-top-service.exe Description=?? Source=Paul Collins Startup list [DeskAd Service] Number=2234 Confirmed=X Filename=DeskAdServ.exe Description=DeskAd.Service adware Source=Paul Collins Startup list [DeskColor] Number=2235 Confirmed=N Filename=DESKCOLOR.EXE Description=Provides transparent icon text backgrounds and coloured icon text Source=Paul Collins Startup list [Deskflag] Number=2236 Confirmed=N Filename=Deskflag.exe Description=DeskFlag - animated USA flag on the desktop Source=Paul Collins Startup list [DeskMateAutoUpdate] Number=2237 Confirmed=X Filename=DeskMateAutoUpdate.exe Description=DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related Source=Paul Collins Startup list [Desksite CMA] Number=2238 Confirmed=U Filename=cma.exe Description=DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" Source=Paul Collins Startup list [Desktop] Number=2239 Confirmed=X Filename=rundll32.exe msconfd.dll, Restore ControlPanel Description=Added by the BOOKMARKER TROJAN! Source=Paul Collins Startup list [desktop] Number=2240 Confirmed=X Filename=desktop.exe Description=Added by the SDBOT.MD WORM! Source=Paul Collins Startup list [Desktop] Number=2241 Confirmed=X Filename=Desktop.com Description=Added by the VB-DRN WORM! Source=Paul Collins Startup list [Desktop Architect] Number=2242 Confirmed=N Filename=DATRAY.EXE Description=Desktop theme manager available here - for managing the desktop appearance, fonts, sounds, etc Source=Paul Collins Startup list [Desktop Plant] Number=2243 Confirmed=N Filename=AZARE10S.PLT Description=Vritual plant from here - this version is an Azalea, there are others so the filename may be different Source=Paul Collins Startup list [Desktop Search] Number=2244 Confirmed=X Filename=desktop.exe Description=iSearch "Desktop Search" hijacker Source=Paul Collins Startup list [Desktop Service Centre] Number=2245 Confirmed=? Filename=DSC.exe Description=OptusNet DSL or Dial-Up connection software - is it required? Source=Paul Collins Startup list [Desktop Weather] Number=2246 Confirmed=N Filename=THE WEATHER CHANNEL.exe Description=Desktop Weather by The Weather Channel - provides current temperature, conditions, alerts, etc Source=Paul Collins Startup list [Desktop Weather 3] Number=2247 Confirmed=N Filename=THE WEATHER CHANNEL.exe Description=Desktop Weather 3 by The Weather Channel - provides current temperature, conditions, alerts, etc Source=Paul Collins Startup list [Desktop Weather 3] Number=2248 Confirmed=N Filename=THEWEA~1.EXE Description=Desktop Weather 3 by The Weather Channel - provides current temperature, conditions, alerts, etc Source=Paul Collins Startup list [desktopmgr] Number=2249 Confirmed=N Filename=desktopmgr.exe Description=Synchronisation manager for the cradles for the Research In Motion range of wireless handhelds, including the "Blackberry" Source=Paul Collins Startup list [DesktopUpdate] Number=2250 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [DesktopX] Number=2251 Confirmed=U Filename=DESKTOPX.EXE Description=A program that replaces the regular Desktop and Taskbar, and can be changed to the user's liking Source=Paul Collins Startup list [deskup] Number=2252 Confirmed=N Filename=deskup.exe Description=Adds Iomega Zip drive icons to the desktop Source=Paul Collins Startup list [destroyb11] Number=2253 Confirmed=X Filename=destroyb11.exe Description=Added by the DELF-KO TROJAN! Source=Paul Collins Startup list [detect] Number=2254 Confirmed=U Filename=idetect.exe Description=iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled Source=Paul Collins Startup list [detect] Number=2255 Confirmed=? Filename=turbodetect.exe Description=?? Source=Paul Collins Startup list [Detector] Number=2256 Confirmed=N Filename=detector.exe Description=USB port detector for LG scanners. Sits in the System Tray, and when it detects the scanner through the USB port, you can run the scanner software from the tray. It is not required at all, since you can use the scan software from almost any photo editing software Source=Paul Collins Startup list [Development Environment] Number=2257 Confirmed=X Filename=devenv.exe Description=Added by the DELBOT-AH WORM! Source=Paul Collins Startup list [DEventAgent] Number=2258 Confirmed=U Filename=eventagt.exe Description=DEvent Agent Module client - part of Dell OpenManage and used for server management. Only required if you use this Source=Paul Collins Startup list [Device Configuration Loader] Number=2259 Confirmed=X Filename=msdvc32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Device Detector] Number=2260 Confirmed=U Filename=DevDetect.exe Description=ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically Source=Paul Collins Startup list [Device Detector 2] Number=2261 Confirmed=N Filename=DevDtct2.exe Description=Installed by various Olympus products, this program detects the active connection of a speech device (voice recorder, etc) to a USB port then runs specific client software used to access that device. The DevDtct2 process has a "high" priority level which can negatively impact system resources Source=Paul Collins Startup list [Device Manager] Number=2262 Confirmed=X Filename=wfxmgr.exe Description=Added by the RBOT.AJU WORM! Source=Paul Collins Startup list [DeviceDiscovery] Number=2263 Confirmed=U Filename=hpotdd01.exe Description=Detection of new imaging, printing and other peripherals on HP machines such as USB printers, cameras and Bluetooth products. "This program is a non-essential process, but should not be terminated unless suspected to be causing problems" Source=Paul Collins Startup list [DevicePath] Number=2264 Confirmed=X Filename=Proyecto1.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [DevicePath] Number=2265 Confirmed=X Filename=Root.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [Devices] Number=2266 Confirmed=U Filename=olesvr.exe Description=Salfeld Child Control - parental control software Source=Paul Collins Startup list [Devicewin] Number=2267 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-AEV TROJAN! Source=Paul Collins Startup list [devldr16] Number=2268 Confirmed=U Filename=devldr16.exe Description=Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices Source=Paul Collins Startup list [devldr16.exe] Number=2269 Confirmed=U Filename=devldr16.exe Description=Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices Source=Paul Collins Startup list [Devlog] Number=2270 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Devlog] Number=2271 Confirmed=? Filename=devlog.exe Description=Apparently mainboard/chipset related, by a French company called AS Media - what exactly is it, and is it required Source=Paul Collins Startup list [dfgfdgrergd] Number=2272 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.CK TROJAN! Source=Paul Collins Startup list [DGJM] Number=2273 Confirmed=? Filename=DGJM.exe Description=?? Source=Paul Collins Startup list [dgtstart] Number=2274 Confirmed=X Filename=dgtstart.exe Description=DigitalNames.g adware Source=Paul Collins Startup list [dguard] Number=2275 Confirmed=U Filename=dguard.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [DHCP Server] Number=2276 Confirmed=X Filename=regsvr.exe Description=Added by the RBOT-PR WORM! Source=Paul Collins Startup list [dhcpagnt] Number=2277 Confirmed=Y Filename=dhcpagnt.exe Description=Intel DSL modem driver - leave enabled or you'll have to re-install the drivers Source=Paul Collins Startup list [DHNUXB] Number=2278 Confirmed=? Filename=DHNUXB.exe Description=?? Source=Paul Collins Startup list [diagent] Number=2279 Confirmed=N Filename=diagent.exe Description=System Tray access for Creative Diagnostics for the Creative SoundBlaster series soundcards. Available via Start -> Programs Source=Paul Collins Startup list [Diagnostic] Number=2280 Confirmed=X Filename=diagnostic.exe Description=Added by the ALPHA-C TROJAN! Source=Paul Collins Startup list [Dial22] Number=2281 Confirmed=X Filename=dlm.exe Description=Adult content dialler Source=Paul Collins Startup list [Dial33] Number=2282 Confirmed=X Filename=dlm.exe Description=Adult content dialler Source=Paul Collins Startup list [Dialer] Number=2283 Confirmed=X Filename=rundll32.exe msa32chk.dll Description=Unidentfied malware Source=Paul Collins Startup list [Dialer Control] Number=2284 Confirmed=U Filename=dc.exe Description=Dialer-Control. Detects and protects from premium rate p0rn diallers Source=Paul Collins Startup list [Dialer Detect] Number=2285 Confirmed=U Filename=dd.exe Description=DialerDetect detects stealth installed premium rate diallers, and sounds the alarm when such a connection is being installed without you knowing it Source=Paul Collins Startup list [Dialgo SDK] Number=2286 Confirmed=U Filename=PhoneAnswer.exe Description=Dialgo Wave Modem ActiveX - "Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID, Wave Playback, Wave Recording, Digit Monitoring, POP3 e-mail Manipulation, Speech Recognition and Synthesis" Source=Paul Collins Startup list [DialNet] Number=2287 Confirmed=X Filename=mxt32.exe Description=Adult content dialler Source=Paul Collins Startup list [Dialog Box Assistant] Number=2288 Confirmed=N Filename=OSDEx.exe Description=Dialog Box Assistant from Duality Software. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders Source=Paul Collins Startup list [Dialog Helper] Number=2289 Confirmed=N Filename=PDDLGHLP.EXE Description=Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs Source=Paul Collins Startup list [DialUp Network Application] Number=2290 Confirmed=X Filename=Rnaap.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Diamondview] Number=2291 Confirmed=? Filename=Diamondview.exe Description=Manulife Financial Insurance program. Is it required at startup? Source=Paul Collins Startup list [DIECOX] Number=2292 Confirmed=X Filename=csrss.exe Description=Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Diesel] Number=2293 Confirmed=X Filename=Recalculate.exe Description=Added by the LAZAR TROJAN! Source=Paul Collins Startup list [DietK] Number=2294 Confirmed=U Filename=DietK.exe Description=Diet Kazaa add-on for Kazaa Media Desktop - "removes all adware and popups, built in Download Accelerator, makes searches faster and helps produce more results" Source=Paul Collins Startup list [DigiCell] Number=2295 Confirmed=U Filename=DigiCell.exe Description=MSI DigiCell - "the most useful and powerful utility that MSI has spent much research and efforts to develop, helps users to monitor and configure all the integrated peripherals of the system, such as audio program, power management, MP3 files management and communication / 802.11g WLAN settings. Moreover, with this unique utility, you will be able to activate the MSI well-known features, Live Update and Core Center" Source=Paul Collins Startup list [DigiD] Number=2296 Confirmed=X Filename=DigitalSound.exe Description=Adware downloader Source=Paul Collins Startup list [DigiGuide] Number=2297 Confirmed=N Filename=CLIENT.EXE Description=TV guide and reminder Source=Paul Collins Startup list [DigiGuide] Number=2298 Confirmed=N Filename=client01.exe Description=TV guide and reminder Source=Paul Collins Startup list [Digisoft AntiDialer] Number=2299 Confirmed=U Filename=AntiDialer.exe Description=Digisoft AntiDialer Source=Paul Collins Startup list [DigiSrv] Number=2300 Confirmed=U Filename=DigiSrv.exe Description=Related to camera software from DigitalDreams Source=Paul Collins Startup list [Digital Dashboard] Number=2301 Confirmed=N Filename=devgulp.exe Description=For Compaq PC's. Loads Digital Dashboard options Source=Paul Collins Startup list [Digital Line Detect] Number=2302 Confirmed=N Filename=DLG.exe Description=Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems Source=Paul Collins Startup list [Digital River eBot] Number=2303 Confirmed=N Filename=downlo~1.exe Description=Digital River Systems EBOT for downloading software from their site. In some cases, if you purchase software online for a download from a software manufacturer, you will be sent to this online company's site for the download after the purchase is complete. Read more here Source=Paul Collins Startup list [DigitalNames] Number=2304 Confirmed=X Filename=DigitalNamesStart.exe Description=DigitalNames spyware variant Source=Paul Collins Startup list [DigitalWizard] Number=2305 Confirmed=N Filename=ISWizard.exe Description=InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content Source=Paul Collins Startup list [DigitalWizard Monitor] Number=2306 Confirmed=N Filename=dwMon.exe Description=InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content Source=Paul Collins Startup list [DIGServices] Number=2307 Confirmed=U Filename=DIGServices Description=Created by Disney but licensed to ESPN for watching videos Source=Paul Collins Startup list [DIGStream] Number=2308 Confirmed=N Filename=digstream.exe Description=DIGStream Cache Manager - part of ESPN Motion and Disney Motion that periodically check for new videos and indication they're available in the System Tray. Starting ESPN Motion/Disney Motion starts digstream automatically Source=Paul Collins Startup list [Dimension] Number=2309 Confirmed=U Filename=Dimension.exe Description=Dimension - a program which lets you customize MSN messenger such as adding animated and coloured nicknames, personal toast creator, war tools (login flooder), and allows viewing and interacting with the raw MSN protocol Source=Paul Collins Startup list [Dimension4] Number=2310 Confirmed=U Filename=d4.exe Description=Dimension 4 - network time synchronization freeware - starts-up, adjusts the system clock, then shuts down Source=Paul Collins Startup list [Dino3] Number=2311 Confirmed=X Filename=dino3.exe Description=Related to Jurassic Park III and enables a dinosaur to walk across the screen. Also generates adverts and classified as adware as a result Source=Paul Collins Startup list [Dinst] Number=2312 Confirmed=X Filename=dinst.exe Description=IMIServer/IEPlugin adware Source=Paul Collins Startup list [Dir1] Number=2313 Confirmed=X Filename=caKe Description=Added by the CAKE WORM! Source=Paul Collins Startup list [Direct settings] Number=2314 Confirmed=X Filename=sdchost.exe Description=Added by the DAEMONI-I TROJAN! Source=Paul Collins Startup list [Direct Update] Number=2315 Confirmed=U Filename=DUControl.exe Description=DirectUpdate dynamic DNS updater Source=Paul Collins Startup list [Direct X Direct3D] Number=2316 Confirmed=X Filename=dxd3d.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Direct X Opengl] Number=2317 Confirmed=X Filename=dxopengl.exe Description=Added by a variant of the RBOT-CJ WORM! Source=Paul Collins Startup list [direct3d.exe] Number=2318 Confirmed=X Filename=direct3d.exe Description=Added by the CERTIF-F TROJAN! Source=Paul Collins Startup list [DirectCD] Number=2319 Confirmed=N Filename=DirectCD.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [directs.exe] Number=2320 Confirmed=X Filename=directs.exe Description=Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS! Source=Paul Collins Startup list [DIRECTVDSL] Number=2321 Confirmed=U Filename=Directvdsl.exe Description=Starts DirectTV DSL modem at boot up. Can also be started manually Source=Paul Collins Startup list [DirectX] Number=2322 Confirmed=X Filename=ddhelp32.exe Description=Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe Source=Paul Collins Startup list [directx] Number=2323 Confirmed=X Filename=Directx.exe Description=Added by the SDBOT.D TROJAN! Source=Paul Collins Startup list [directx] Number=2324 Confirmed=X Filename=Sqlexploit.exe Description=Added by the SDBOT.D TROJAN! Source=Paul Collins Startup list [DirectX] Number=2325 Confirmed=X Filename=DirectX.exe Description=Added by the BLAXE or LOGPOLE WORMS! Source=Paul Collins Startup list [directx] Number=2326 Confirmed=X Filename=NTCmd.exe Description=Added by the SDBOT.D TROJAN! Source=Paul Collins Startup list [directx] Number=2327 Confirmed=X Filename=PipeCmd.exe Description=Added by the SDBOT.D TROJAN! Source=Paul Collins Startup list [DirectX 32] Number=2328 Confirmed=X Filename=directx32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [DirectX For Microsoft Windows] Number=2329 Confirmed=X Filename=dtxservice.exe Description=Added by the PROGENT TROJAN! Source=Paul Collins Startup list [DirectX for Microsoft Windows] Number=2330 Confirmed=X Filename=Fservice.exe Description=Added by the PRORAT TROJAN! Source=Paul Collins Startup list [DirectX for Microsoft Windows] Number=2331 Confirmed=X Filename=Sservice.exe Description=Added by the PRORAT TROJAN! Source=Paul Collins Startup list [DirectX For Microsoft� Windows] Number=2332 Confirmed=X Filename=fservice.exe Description=Added by the PRORAT-P TROJAN! Source=Paul Collins Startup list [DirectX shell driver] Number=2333 Confirmed=X Filename=[path to trojan] Description=Added by the MARKTMAN-B TROJAN! Source=Paul Collins Startup list [DirectX Video Driver] Number=2334 Confirmed=X Filename=dxterm5.exe Description=Added by the WILAB-A TROJAN! Source=Paul Collins Startup list [DirectX64] Number=2335 Confirmed=X Filename=DirectXset.exe Description=Added by the BROWNEY.A WORM! Source=Paul Collins Startup list [DirectX9 Diag] Number=2336 Confirmed=X Filename=dx9diag.exe Description=Added by the RBOT-ALT WORM! Source=Paul Collins Startup list [Dirkey] Number=2337 Confirmed=U Filename=Dirkey.exe Description=Dirkey - small utility that allows you to bookmark up to 9 folders by using the Ctrl+Alt+1..9 shortcut keys in an Open/Save File dialog or in Windows Explorer. After this the Ctrl+1..9 shortcut keys can be used in the same or another window to go to any of the 9 bookmarked folders Source=Paul Collins Startup list [Disable EHCI] Number=2338 Confirmed=? Filename=nousb20.exe Description=?? Source=Paul Collins Startup list [Disc Detector] Number=2339 Confirmed=N Filename=CtNotify.exe Description=For Creative sound cards. Detects when you insert a CD, DVD, etc Source=Paul Collins Startup list [disc detector] Number=2340 Confirmed=? Filename=qnetquestnotifty.exe Description=?? Source=Paul Collins Startup list [discoveg] Number=2341 Confirmed=? Filename=discoveg.exe Description=?? Source=Paul Collins Startup list [DISCover] Number=2342 Confirmed=? Filename=DISCover.exe Description=Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required? Source=Paul Collins Startup list [DiscoverDeskshop] Number=2343 Confirmed=N Filename=Deskshop.exe Description=Discover Deskshop - single use "virtual" credit card Source=Paul Collins Startup list [DiscUpdateManager] Number=2344 Confirmed=U Filename=DiscUpdMgr.exe Description=Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games Source=Paul Collins Startup list [Disk Keeper] Number=2345 Confirmed=X Filename=[path to trojan] Description=Added by the SMALL-VE TROJAN! Source=Paul Collins Startup list [Disk Keeper] Number=2346 Confirmed=X Filename=SECURITY.EXE Description=Daosearch adware Source=Paul Collins Startup list [Disk Manager] Number=2347 Confirmed=X Filename=diskver.exe Description=Added by the RBOT.AQT WORM! Source=Paul Collins Startup list [Disk Master] Number=2348 Confirmed=X Filename=[trojan name] Description=Added by the DISTER TROJAN! - a spam relayer Source=Paul Collins Startup list [DiskCheck] Number=2349 Confirmed=X Filename=msdarkend.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [DiskeeperSystray] Number=2350 Confirmed=N Filename=DkIcon.exe Description=DisKeeper defragmentation software - can be started manually Source=Paul Collins Startup list [diskinf] Number=2351 Confirmed=X Filename=diskinf.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [DISKMON.EXE] Number=2352 Confirmed=? Filename=DISKMON.EXE Description=?? Source=Paul Collins Startup list [Disknag] Number=2353 Confirmed=N Filename=disknag.exe Description=Dell program that reminds you to make your backup diskettes Source=Paul Collins Startup list [Diskstart] Number=2354 Confirmed=X Filename=Code.exe Description=Adult content dialler Source=Paul Collins Startup list [Diskstart] Number=2355 Confirmed=X Filename=cat.exe Description=MS-Connect dialler Source=Paul Collins Startup list [Diskstart] Number=2356 Confirmed=X Filename=hit.exe Description=Adult content dialler Source=Paul Collins Startup list [Diskstart] Number=2357 Confirmed=X Filename=Snt.exe Description=Adult content dialler Source=Paul Collins Startup list [Disk_Monitor] Number=2358 Confirmed=U Filename=Disk_Monitor.exe Description=Multi-media, Smartmedia, Compact Flash card reader for reading digital camera cards. Device is recognised as internal USB disk drive. Necessary if camera cards are to be recognised as soon as they are inserted into the reader Source=Paul Collins Startup list [Dispatcher] Number=2359 Confirmed=X Filename=dispatcher.exe Description=Added by the DLOADR-AS TROJAN! Source=Paul Collins Startup list [display] Number=2360 Confirmed=U Filename=The_Eye.exe Description=ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [Display Drivers] Number=2361 Confirmed=X Filename=cssrs.exe Description=Added by the AGOBOT.FX WORM! Source=Paul Collins Startup list [Display Settings] Number=2362 Confirmed=N Filename=hptasks.exe Description=Allows for the adjustment of the display for LCD screen, CRT Monitor and TV output on HP computers Source=Paul Collins Startup list [DisplayTrayIcon] Number=2363 Confirmed=N Filename=TrayIcon.exe Description=System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution, etc regularily use Control Panel -> Display Source=Paul Collins Startup list [Disspy] Number=2364 Confirmed=U Filename=disspy.exe Description=Disspy spyware detection and removal software Source=Paul Collins Startup list [Distiller Assistant 3.01] Number=2365 Confirmed=N Filename=DISTASST.EXE Description=From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs Source=Paul Collins Startup list [Distributed File System] Number=2366 Confirmed=X Filename=Dfsvc.exe Description=Added by the MYFIP.A or MYFIP.K WORMS! Source=Paul Collins Startup list [Distributed File System] Number=2367 Confirmed=X Filename=kernel32dll.exe Description=Added by the MYFIP-C or MYFIP.K WORMS! Source=Paul Collins Startup list [Distributed File System] Number=2368 Confirmed=X Filename=blade.exe Description=Added by the MYFIP.AC WORM! Source=Paul Collins Startup list [Distributed File System] Number=2369 Confirmed=U Filename=win.exe Description=Added by the MYFIP.AB WORM! Source=Paul Collins Startup list [distributed.net client] Number=2370 Confirmed=U Filename=DNETC.EXE Description=Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses Source=Paul Collins Startup list [Dit] Number=2371 Confirmed=Y Filename=dit.exe Description="Drive Icon and Label Utility" - assigns drive icons and names to flash memory cards. Required, otherwise the drives aren't found Source=Paul Collins Startup list [Dit] Number=2372 Confirmed=X Filename=dit.exe Description=Added by the LAZAR-A TROJAN! Note - this is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [DiTask.exe] Number=2373 Confirmed=N Filename=DiTask.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. System Tray icon which shows you the status of your lines (free, occupied with incoming or outgoing call). Available via Start -> Programs Source=Paul Collins Startup list [Divamon.exe] Number=2374 Confirmed=? Filename=Divamon.exe Description=Associated with an Eicon Networks Diva ISDN or ADSL modem - what does it do and is it required? Source=Paul Collins Startup list [divx] Number=2375 Confirmed=X Filename=divxenc.exe Description=Added to the SPBOT.B TROJAN! Source=Paul Collins Startup list [Divx] Number=2376 Confirmed=X Filename=codll.exe Description=Added by the GRAVEBOT-A TROJAN! Source=Paul Collins Startup list [DivX MediaPlayer 7.0] Number=2377 Confirmed=X Filename=Dr.DivX.exe Description=Added by the ALADINZ.G TROJAN! Source=Paul Collins Startup list [DivX Player] Number=2378 Confirmed=X Filename=DivXPlayer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [DivX Updater] Number=2379 Confirmed=X Filename=DivX.Exe Description=Added by the NALDEM TROJAN or MASTAK VIRUS! Source=Paul Collins Startup list [DIVX Video Player] Number=2380 Confirmed=X Filename=DIVXPloyer.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Divx4 codec] Number=2381 Confirmed=X Filename=devldr32.exe Description=Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file Source=Paul Collins Startup list [DJREGFIX] Number=2382 Confirmed=N Filename=regedit /s c:\hpdjregfix.reg Description=DJRegFix showed up first in WinME as a "clever" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This "utility" adds the functionality and compatibility HP forgot to add in its WinME drivers Source=Paul Collins Startup list [DJSNetCN] Number=2383 Confirmed=? Filename=DJSNetCN.exe Description="Symantec Licensing Detect Internet Connection", part of Norton Antivirus. What does it do and is it required? Source=Paul Collins Startup list [djtopr1150.exe] Number=2384 Confirmed=X Filename=djtopr1150.exe Description=WebRebates adware Source=Paul Collins Startup list [dKernel] Number=2385 Confirmed=X Filename=dKernel.exe Description=Added by the DECOY-A WORM! Source=Paul Collins Startup list [DkService] Number=2386 Confirmed=Y Filename=DkService.exe Description=From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled, otherwise you could have problems starting it manually. Source=Paul Collins Startup list [DKTime] Number=2387 Confirmed=X Filename=dktime.exe Description=Added by the LUNII TROJAN! Source=Paul Collins Startup list [Dkware lptt01] Number=2388 Confirmed=X Filename=dkware.exe Description=RapidBlaster variant (in a "DonkeySoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Dkware ml097e] Number=2389 Confirmed=X Filename=dkware.exe Description=RapidBlaster variant (in a "DonkeySoft" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [dkzzixm] Number=2390 Confirmed=? Filename=dkzzixm.exe Description=?? Source=Paul Collins Startup list [dla] Number=2391 Confirmed=Y Filename=tfswctrl.exe Description=Drive letter access to a UDF packet writer for CD-RW - from HP, Veritas an others. Similar to Roxio's DirectCD and does the same thing. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones" Source=Paul Collins Startup list [DLA] Number=2392 Confirmed=U Filename=DLACTRLW.EXE Description=Sonic CD/DVD burning applications Source=Paul Collins Startup list [DlaTray] Number=2393 Confirmed=N Filename=Dlatray.exe Description=System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones" Source=Paul Collins Startup list [dlbcserv] Number=2394 Confirmed=N Filename=dlbcserv.exe Description=Related to Dell Photo Printers and provides additional configuration options for these devices Source=Paul Collins Startup list [DLBUCATS] Number=2395 Confirmed=U Filename=DLBUtime.dll, _RunDLLEntry@16 Description=Related to Dell Photo Printers - drivers Source=Paul Collins Startup list [dlccmon.exe] Number=2396 Confirmed=? Filename=dlccmon.exe Description=Dell Photo AIO Printer 924 Device Monitor. What does it do and is it required? Source=Paul Collins Startup list [DLCDCATS] Number=2397 Confirmed=? Filename=rundll32 [path] DLCDtime.dll, _RunDLLEntry@16 Description=Related to Dell Photo Printers - what does it do and is it required in startup? Source=Paul Collins Startup list [dlcdmon.exe] Number=2398 Confirmed=N Filename=dlcdmon.exe Description=Related to Dell Photo Printers - required in order to use the scanner of the printer. If disabled, scanning cannot occur because the driver isn't running Source=Paul Collins Startup list [dlcgmon.exe] Number=2399 Confirmed=U Filename=dlcgmon.exe Description=Dell 810 AIO phot printer device monitor. Is it required? Source=Paul Collins Startup list [dlder] Number=2400 Confirmed=X Filename=dlder.exe Description=Advertising spyware. Considered to be one oft the worst - even creating a fake "explorer.exe" file. Can be installed via versions of "Grokster", "Lime Wire" and "KaZaA" amongst other file-sharing utilities (see here). Reported in the past as a virus Source=Paul Collins Startup list [DlDir1] Number=2401 Confirmed=X Filename=caKe Description=Added by the CAKE WORM! Source=Paul Collins Startup list [DLForcerExe] Number=2402 Confirmed=? Filename=DLForcerEXE.exe Description=?? Source=Paul Collins Startup list [DLF_00000B00] Number=2403 Confirmed=N Filename=Vcdlf.exe Description=Known to cause problems with "Out of memory" errors (see here). Otherwise, it's purpose is unknown Source=Paul Collins Startup list [DLG] Number=2404 Confirmed=N Filename=DLGCHBW.exe Description=Backweb part of Data LifeGuard - diagnostic tools for Western Digital's series of hard drives. Automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [DLHelperEXE] Number=2405 Confirmed=N Filename=WATCH.exe Description=Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished Source=Paul Collins Startup list [DLHelperEXE.exe] Number=2406 Confirmed=X Filename=N/A Description=Downloader for Microgaming/Casino software - stealth installed Source=Paul Collins Startup list [dlhost] Number=2407 Confirmed=X Filename=dlhost.exe Description=Added by the EXPHOOK-A TROJAN! Source=Paul Collins Startup list [DLINK dfe drivers for Windows NT] Number=2408 Confirmed=X Filename=windfe.exe Description=Added by the RANDEX.AK WORM! Source=Paul Collins Startup list [DLink System Tray] Number=2409 Confirmed=U Filename=dlnetst.exe Description=Related to D-Link DGE-530T PCI card for servers and workstations Source=Paul Collins Startup list [Dlite] Number=2410 Confirmed=X Filename=dllmanager.exe Description=Added by the WOOTBOT.DN WORM! Source=Paul Collins Startup list [Dll Boot Loader on Startup (do not remove this)] Number=2411 Confirmed=X Filename=[various filenames] Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [DLL Manager] Number=2412 Confirmed=X Filename=dllmngr32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [DLL Service Manager] Number=2413 Confirmed=X Filename=[path to worm] Description=Added by the RPCBOT.F TROJAN! Source=Paul Collins Startup list [dll services] Number=2414 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [DLL32] Number=2415 Confirmed=X Filename=dllmem32.exe Description=Added by the KWBOT.E WORM! Source=Paul Collins Startup list [DLL32] Number=2416 Confirmed=X Filename=dllhost.dll Description=Added by the SUCLOVE.A WORM! Source=Paul Collins Startup list [DllCacherv2] Number=2417 Confirmed=X Filename=dllcachev2.exe Description=Added by the LATEDA TROJAN! Source=Paul Collins Startup list [dlldmt] Number=2418 Confirmed=X Filename=dlldmt.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [DllExecutable] Number=2419 Confirmed=X Filename=[path to file] Description=Added by the VB-SP WORM! Source=Paul Collins Startup list [dllhelp] Number=2420 Confirmed=X Filename=dllhelp.exe Description=Added by the STARTPAGE.DQ hijacker Source=Paul Collins Startup list [dllhelp] Number=2421 Confirmed=X Filename=dllhlp.exe Description=Added by the Downloader-HI TROJAN! Source=Paul Collins Startup list [DLLHost] Number=2422 Confirmed=X Filename=dllhst.exe Description=Added by the DELBOT-AC WORM! Source=Paul Collins Startup list [dllhostxp.exe] Number=2423 Confirmed=X Filename=dllhostxp.exe Description=Browser hijacker and adware downloader Source=Paul Collins Startup list [DllLoader] Number=2424 Confirmed=X Filename=lssas.exe Description=Added by the JE WORM! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [Dlload] Number=2425 Confirmed=X Filename=killer.exe Description=Added by the KILLAV-FK TROJAN! Source=Paul Collins Startup list [dllreg] Number=2426 Confirmed=X Filename=dllreg.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [DLLService32] Number=2427 Confirmed=X Filename=dllsvc32.exe Description=Added by the AGOBOT.VX WORM! Source=Paul Collins Startup list [DLM.exe] Number=2428 Confirmed=N Filename=DLM.exe Description=IGN Download Manager has become a requirement for downloading files through FilePlanet.com. It is based on Internet Explorer and it installs through an ActiveX-plugin, hence Internet Explorer must be installed beforehand and downloads has to be has to be initialized through that browser Source=Paul Collins Startup list [dlmMgr] Number=2429 Confirmed=N Filename=AdobeDownloadManager.exe Description=Adobe Download Manager - "can prevent you from having to start from the beginning should your download process be interrupted, and it offers a level of service not possible Source=Paul Collins Startup list [DLPSP] Number=2430 Confirmed=U Filename=DLPSP.EXE Description=Dell laser printer status monitor Source=Paul Collins Startup list [dlsp2mx] Number=2431 Confirmed=X Filename=dlsp2mx.exe Description=Added by the MPB-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "dlsp2mx" Source=Paul Collins Startup list [DLT] Number=2432 Confirmed=? Filename=dlt.exe Description=?? Source=Paul Collins Startup list [dluca] Number=2433 Confirmed=X Filename=dluca.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [dluca] Number=2434 Confirmed=X Filename=dluca.exe Description=Added by the DLUCA.C TROJAN! Source=Paul Collins Startup list [dluxde] Number=2435 Confirmed=X Filename=dluxde.exe Description=All-In-One-Telcom (adult content dialler) variant Source=Paul Collins Startup list [Dluxjp] Number=2436 Confirmed=X Filename=cnfrm.exe Description=Added by the DLUCA.D TROJAN! Source=Paul Collins Startup list [Dm Hr] Number=2437 Confirmed=X Filename=lpns.exe Description=Added by the IRCBOT.WORM.61673 WORM! Source=Paul Collins Startup list [DM mgr] Number=2438 Confirmed=X Filename=dm_mgr.exe Description=Added by the JITTAR TROJAN! Source=Paul Collins Startup list [dm***.exe [* = random char]] Number=2439 Confirmed=X Filename=dm***.exe [* = random char] Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [DMAScheduler] Number=2440 Confirmed=N Filename=DMAScheduler.exe Description=Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [DMC] Number=2441 Confirmed=X Filename=dmc.exe Description=Added by Trojan-Downloader.Win32.Dluca.bv TROJAN! Source=Paul Collins Startup list [DMHotKey] Number=2442 Confirmed=U Filename=DMLoader.exe Description=HotKey access to the Samsung Display Manager on laptops and ultra-mobiles that support it - such as the M55 and Q1 Source=Paul Collins Startup list [DMILDR] Number=2443 Confirmed=N Filename=dmildr.exe Description=Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. Available via Start -> Programs Source=Paul Collins Startup list [DMISL] Number=2444 Confirmed=N Filename=DMISL.EXE Description=DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information Source=Paul Collins Startup list [DMISLAPP] Number=2445 Confirmed=N Filename=DMISLAPP.exe Description=DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information Source=Paul Collins Startup list [dmjay] Number=2446 Confirmed=? Filename=dmjay.exe Description=?? Source=Paul Collins Startup list [dmloader] Number=2447 Confirmed=X Filename=dmloader.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Dmsvc32] Number=2448 Confirmed=X Filename=Dmsvc32.exe Description=Added by the AGOBOT.ABU WORM! Source=Paul Collins Startup list [dmtdll] Number=2449 Confirmed=X Filename=dmtdll.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [DMXLauncher] Number=2450 Confirmed=U Filename=DMXLauncher.exe Description=Part of Dell's Media Experience, a multimedia suite which offers the user functionality to organise and play music and digital video files Source=Paul Collins Startup list [dm[3 random letters].exe] Number=2451 Confirmed=X Filename=dm[3 random letters].exe Description=Added by the RUINDEM TROJAN! Source=Paul Collins Startup list [DM_server] Number=2452 Confirmed=X Filename=dmserver.exe Description=Comet Cursor adware Source=Paul Collins Startup list [dm_service] Number=2453 Confirmed=X Filename=[path to file] Description=Added by the MITGLIEDER.P TROJAN! Source=Paul Collins Startup list [dnam] Number=2454 Confirmed=X Filename=d140113.a.Stub.EXE Description=Added by the STUB_A TROJAN! Source=Paul Collins Startup list [Dnar] Number=2455 Confirmed=X Filename=Dnar.exe Description=Unknown, except that it is not necessary. Tends to phone home a lot. DMI related - see here Source=Paul Collins Startup list [DNE Binding Watchdog] Number=2456 Confirmed=Y Filename=rundll dnes.dll, DnDneCheckBindings Description=Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work Source=Paul Collins Startup list [DNE DUN Watchdog] Number=2457 Confirmed=Y Filename=rundll dnes.dll, DnDneCheckDUN13 Description=Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work Source=Paul Collins Startup list [DNHelper32] Number=2458 Confirmed=X Filename=DNHlp32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [DNS] Number=2459 Confirmed=X Filename=mc-58-12-0000080.exe Description=Shorty adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [DNS] Number=2460 Confirmed=X Filename=mc-58-12-0000093.exe Description=Shorty adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [DNS] Number=2461 Confirmed=X Filename=mc-110-12-0000079.exe Description=Shorty adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [DNS] Number=2462 Confirmed=X Filename=mc-58-12-0000120.exe Description=Shorty adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [DNS] Number=2463 Confirmed=X Filename=mc-58-12-0000140.exe Description=Shorty adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [DNS] Number=2464 Confirmed=X Filename=[worm filename] Description=Added by the CQG WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Common Files folder Source=Paul Collins Startup list [Dns Resolver] Number=2465 Confirmed=X Filename=dnsrslve.exe Description=Added by the RBOT-WS WORM! Source=Paul Collins Startup list [DNS Service] Number=2466 Confirmed=X Filename=dnsresolver.exe Description=Added by the RBOT-PQ WORM! Source=Paul Collins Startup list [DNS Service] Number=2467 Confirmed=X Filename=dnssvc.exe Description=Added by the DELBOT-Z WORM! Source=Paul Collins Startup list [DNS2GoClient] Number=2468 Confirmed=? Filename=dns2goclient.exe Description=DNS2Go is a Domain Name System that will make your computer accessible anytime, anywhere by associating a domain name of your choice to your currently assigned IP address. Is it required? Source=Paul Collins Startup list [DNSCacheBoost] Number=2469 Confirmed=X Filename=dnsping.exe Description=Added by the DNSBUST-A TROJAN! Source=Paul Collins Startup list [dnscleaner] Number=2470 Confirmed=X Filename=dnscleaner.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [DNXVC] Number=2471 Confirmed=? Filename=dnxvc.exe Description=?? Source=Paul Collins Startup list [DocTor] Number=2472 Confirmed=X Filename=Doctor.exe Description=Added by the DOTOR.A WORM! Source=Paul Collins Startup list [DocuMagix Init] Number=2473 Confirmed=N Filename=PWATCH.EXE Description=PaperMaster is an application for the PC designed to automate the process of organizing, archiving, and retrieving digital versions of files. Start manually if needed Source=Paul Collins Startup list [Document Manager] Number=2474 Confirmed=U Filename=docmgr.exe Description=Wave Systems Corp. Document Manager - "provides secure storage and management capabilities for file and folder level encryption" Source=Paul Collins Startup list [Doggy Style] Number=2475 Confirmed=X Filename=MsPMSPSd.exe Description=Added by the SDBOT-AAP WORM! Source=Paul Collins Startup list [DOGStart] Number=2476 Confirmed=X Filename=GSDOGST.EXE Description=Added by an unidentified VIRUS, WORM or TROJAN! A possibility is a trojan known as PENIS Source=Paul Collins Startup list [Doing] Number=2477 Confirmed=? Filename=doing.exe Description=?? Source=Paul Collins Startup list [doit.exe] Number=2478 Confirmed=X Filename=doit.exe Description=Added by the FORBOT-EK WORM! Source=Paul Collins Startup list [Domain Name Resolve Service] Number=2479 Confirmed=X Filename=dnsresolver.exe Description=Added by the KIMAN.A WORM! Source=Paul Collins Startup list [Don't Panic] Number=2480 Confirmed=U Filename=dontpanicdemodp.exe Description=30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite." Source=Paul Collins Startup list [Don't Panic Pop-Up Stopper] Number=2481 Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [Don't Panic!] Number=2482 Confirmed=U Filename=DP.EXE Description=Don't Panic! privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite" Source=Paul Collins Startup list [Dopus] Number=2483 Confirmed=U Filename=dopus.exe Description=Directory Opus - a file manager from GPSoft Source=Paul Collins Startup list [dos] Number=2484 Confirmed=X Filename=dos64.exe Description=Adware downloader trojan Source=Paul Collins Startup list [Dos Prompt Loader] Number=2485 Confirmed=X Filename=cygwin.exe Description=Added by the SDBOT-VV WORM! Source=Paul Collins Startup list [Dosbat] Number=2486 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [DoubleDesktop] Number=2487 Confirmed=U Filename=dd.exe Description="DoubleDesktop is a smart and elegant system tray utility that effectively doubles the width of your Windows desktop" Source=Paul Collins Startup list [DoUWantIt] Number=2488 Confirmed=N Filename=duwi.exe Description=DoUWantIt - online shopping assistant. Start it manually Source=Paul Collins Startup list [down] Number=2489 Confirmed=X Filename=hlp32.exe Description=Added by the DLOADER.BG TROJAN! Source=Paul Collins Startup list [down] Number=2490 Confirmed=X Filename=[trojan filename] Description=Added by the Small-QJ TROJAN! Source=Paul Collins Startup list [Down2Home] Number=2491 Confirmed=U Filename=Down2Home.exe Description=Down2Home - "monitors your ADSL/Cablemodem/Dialup traffic and provides you with usefull statistics about the amount of data your PC has transferred" Source=Paul Collins Startup list [Download Accelerator Plus 5.0] Number=2492 Confirmed=N Filename=DAP.exe Description=Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based Source=Paul Collins Startup list [Download Plus] Number=2493 Confirmed=X Filename=DownloadPlus.exe Description=DownloadPlus adware Source=Paul Collins Startup list [Download Wonder] Number=2494 Confirmed=N Filename=DownloadWonder.exe Description=Download Wonder from Forty Software. Download manager for resuming downloads, amongst other features Source=Paul Collins Startup list [DownloadAccelerator] Number=2495 Confirmed=N Filename=DAP.EXE Description=Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is adware based Source=Paul Collins Startup list [DownloadLegalMusic] Number=2496 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [DownloadWare] Number=2497 Confirmed=X Filename=dw.exe Description=DownloadWare adware Source=Paul Collins Startup list [DownloadWare Engine] Number=2498 Confirmed=X Filename=Dwe.exe Description=DownloadWare adware Source=Paul Collins Startup list [Downxz] Number=2499 Confirmed=X Filename=Downxz.bat Description=Added by the MYDOOM.W WORM Source=Paul Collins Startup list [DPAgnt] Number=2500 Confirmed=N Filename=DPAgnt.exe Description=digitalPersona fingerprint scanner Source=Paul Collins Startup list [DPAS] Number=2501 Confirmed=U Filename=DPASNT.exe Description=DefenderPro AntiSpy - spyware remover Source=Paul Collins Startup list [DPASUpdate] Number=2502 Confirmed=U Filename=DPASAutUpdate.exe Description=Automatic updates for DefenderPro AntiSpy - spyware remover Source=Paul Collins Startup list [Dpcnav] Number=2503 Confirmed=Y Filename=dpcnav.exe Description=DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access Source=Paul Collins Startup list [DPConfig] Number=2504 Confirmed=N Filename=DPConfig.exe Description=Compuware DevPartner Studio Configuration Utility, a tool for software developers - System Tray access to configure the utility's analysis. Not required at startup, can be launched from the Start Menu programs group when needed Source=Paul Collins Startup list [dpcproxy] Number=2505 Confirmed=X Filename=dpcproxy.exe Description=Added by the GOLDENP-A TROJAN! Source=Paul Collins Startup list [DPCProxyLoadOnStartup] Number=2506 Confirmed=Y Filename=dpcstart.exe Description=DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access Source=Paul Collins Startup list [Dpcstart] Number=2507 Confirmed=Y Filename=dpcstart.exe Description=DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access Source=Paul Collins Startup list [dpi] Number=2508 Confirmed=X Filename=dpi.exe Description=Delfin Media Viewer or "Promulgate" adware Source=Paul Collins Startup list [dpnsvr32] Number=2509 Confirmed=X Filename=dpnsvr32.exe Description=Added by the AOLPASS-B TROJAN! Source=Paul Collins Startup list [dpps2] Number=2510 Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [dps] Number=2511 Confirmed=X Filename=dps.exe Description=SmartestSearch parasite - poses as a foistware, bogus adware/spyware remover called "scumware-remover" Source=Paul Collins Startup list [dptracker] Number=2512 Confirmed=N Filename=dptracker.exe Description=CamTrack webcam software that enhances the way people video chat Source=Paul Collins Startup list [DpUtil] Number=2513 Confirmed=U Filename=TEDTray.exe Description=Main executable for TOSHIBA DualPoint Utility Main Module. It is a system tray icon program that provides configuration options for dual pointing device Source=Paul Collins Startup list [Drag'n'Drop_Autolaunch] Number=2514 Confirmed=N Filename=Autolaunch.exe Description=Iomega HotBurn - CD-RW burning software Source=Paul Collins Startup list [DragDrop] Number=2515 Confirmed=? Filename=DragDrop.exe Description=?? Source=Paul Collins Startup list [DragnDrop_Autolaunch] Number=2516 Confirmed=N Filename=Autolaunch.exe Description=Iomega HotBurn - CD-RW burning software Source=Paul Collins Startup list [DRam prmaessor] Number=2517 Confirmed=X Filename=[random filename] Description=Added by the RBOT.CSG WORM! Source=Paul Collins Startup list [DRam prosesor] Number=2518 Confirmed=X Filename=[random filename] Description=Added by the SPYBOT.EE WORM! Source=Paul Collins Startup list [DRam prosessor] Number=2519 Confirmed=X Filename=[random filename] Description=Added by the RBOT.CSG WORM! Source=Paul Collins Startup list [DRam prosessor] Number=2520 Confirmed=X Filename=plscd.exe Description=Added by the RBOT.CYA WORM! Source=Paul Collins Startup list [DRam prosessor] Number=2521 Confirmed=X Filename=HWAPI.exe Description=Added by a variant of the RBOT WORM! Note - this is not the McAfee HackerWatch process which has the same filename Source=Paul Collins Startup list [DRan posessor] Number=2522 Confirmed=X Filename=DAP.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [DrCache] Number=2523 Confirmed=X Filename=MSTDC.EXE Description=Added by the JM TROJAN! Source=Paul Collins Startup list [dreams] Number=2524 Confirmed=X Filename=server.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [DrefIW] Number=2525 Confirmed=X Filename=SysDrefIWv2.exe Description=Added by the DREF-C WORM! Source=Paul Collins Startup list [DrefIW] Number=2526 Confirmed=X Filename=SysDref.exe Description=Added by the DREF-D WORM! Source=Paul Collins Startup list [dregfix] Number=2527 Confirmed=? Filename=ph_finder.exe Description=?? Source=Paul Collins Startup list [DrgToDsc] Number=2528 Confirmed=N Filename=DrgToDsc.exe Description=Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly Source=Paul Collins Startup list [dried.exe] Number=2529 Confirmed=? Filename=dried.exe Description=?? Source=Paul Collins Startup list [DriveCleaner 2006 Free] Number=2530 Confirmed=N Filename=UDC2006.exe Description=DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks Source=Paul Collins Startup list [DriveIcons] Number=2531 Confirmed=U Filename=DriveIcon.exe Description=Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers Source=Paul Collins Startup list [DriveLED] Number=2532 Confirmed=U Filename=OODLed.exe Description=O&O DriveLED - hard disk monitoring and crash prevention Source=Paul Collins Startup list [Driver] Number=2533 Confirmed=X Filename=gbot.exe Description=Added by the JUNTADOR.K TROJAN! Source=Paul Collins Startup list [Driver32] Number=2534 Confirmed=X Filename=Scam32.exe Description=Added by the SIRCAM WORM! Source=Paul Collins Startup list [DriverCheck] Number=2535 Confirmed=X Filename=svchost.exe Description=Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:\DriverLoad folder Source=Paul Collins Startup list [DriverDB] Number=2536 Confirmed=X Filename=svcmdx32.exe Description=Added by the BERPI TROJAN! Source=Paul Collins Startup list [DriverLoad] Number=2537 Confirmed=X Filename=svchost.exe Description=Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:\DriverLoad folder Source=Paul Collins Startup list [DriverModule] Number=2538 Confirmed=X Filename=csrnvrt.exe Description=Added by the IRCBOT.I TROJAN! Source=Paul Collins Startup list [DriverPath] Number=2539 Confirmed=X Filename=system32.exe Description=Added by the PRORAT-S TROJAN! Source=Paul Collins Startup list [Drivers for Internet Explorer] Number=2540 Confirmed=X Filename=accesweb.exe Description=Added by freewebs.com hijacker! Source=Paul Collins Startup list [DriveSelect] Number=2541 Confirmed=N Filename=driveselect.exe Description=DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs Source=Paul Collins Startup list [drkly16j] Number=2542 Confirmed=U Filename=rundll32.exe drkly16j.dll, ServiceCheck Description=KidsWatch Time Control parental control software Source=Paul Collins Startup list [dRMON SmartAgent] Number=2543 Confirmed=U Filename=SmartAgt.exe Description=Part of the network monitoring program group for 3Com NIC cards. See here for more info Source=Paul Collins Startup list [drmu] Number=2544 Confirmed=X Filename=W95Mm.exe Description=Homepage hijacker installing a toolbar: http://tdko.com/. Lop.com in disguise Source=Paul Collins Startup list [drocher] Number=2545 Confirmed=X Filename=d.exe Description=Adult content dialler Source=Paul Collins Startup list [DropSpam Lifestyle] Number=2546 Confirmed=X Filename=dslifestyle.exe Description=Dropspam adware Source=Paul Collins Startup list [drvddll.exe] Number=2547 Confirmed=X Filename=drvddll.exe Description=Added by the BEAGLE.AP WORM! Source=Paul Collins Startup list [Drvddll_exe] Number=2548 Confirmed=X Filename=drvddll.exe Description=Added by the BEAGLE.X WORM! Source=Paul Collins Startup list [DrvListnr] Number=2549 Confirmed=? Filename=DrvListnr.exe Description=Analog Devices SoundMAX soundcard related. What does it do and is it required? Source=Paul Collins Startup list [drvlsnr] Number=2550 Confirmed=U Filename=drvlsnr.exe Description=Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly Source=Paul Collins Startup list [DrvMon.exe] Number=2551 Confirmed=U Filename=DrvMon.exe Description=Alcor drive monitor software Source=Paul Collins Startup list [drvnetw] Number=2552 Confirmed=X Filename=drvnetw.exe Description=Added by the BROGGER-B TROJAN! Source=Paul Collins Startup list [drvr32h] Number=2553 Confirmed=X Filename=drvr32h.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [drvrmanager] Number=2554 Confirmed=X Filename=drvrquery32.exe Description=Added by the BOOHOO WORM! Source=Paul Collins Startup list [drvsys.exe] Number=2555 Confirmed=X Filename=drvsys.exe Description=Added by the BEAGLE.W WORM! Source=Paul Collins Startup list [drvsyskit] Number=2556 Confirmed=X Filename=hidr.exe Description=Added by the BAGLE.HR WORM! Source=Paul Collins Startup list [drvupd] Number=2557 Confirmed=X Filename=rundll32 ..drvupd.inf Description=Hijacker - drvupd.inf file installs a "searchforge.com" hijack Source=Paul Collins Startup list [drv_st_key] Number=2558 Confirmed=X Filename=hidn.exe Description=Added by the BEAGLE.FF WORM! Source=Paul Collins Startup list [DrWatson] Number=2559 Confirmed=X Filename=drwatson_.exe Description=Added by the LOHAV-S TROJAN! Source=Paul Collins Startup list [DrWatson] Number=2560 Confirmed=X Filename=drwatson_32.exe Description=Added by the LOHAV-S TROJAN! Source=Paul Collins Startup list [DrWeb Antivirus] Number=2561 Confirmed=X Filename=DRWEBAV.EXE Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Drwebscheduler] Number=2562 Confirmed=Y Filename=Drwebscd.exe Description=DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications, in particular the antivirus scanner or the update subsystem Source=Paul Collins Startup list [DR_S] Number=2563 Confirmed=X Filename=DR_S.exe Description=AdShooter adware Source=Paul Collins Startup list [ds] Number=2564 Confirmed=X Filename=ds.exe Description=Added by the SPYMON TROJAN! Source=Paul Collins Startup list [DS Clock] Number=2565 Confirmed=U Filename=dsclock.exe Description=Digital desktop clock including synchronization with atomic servers - see here Source=Paul Collins Startup list [dsa] Number=2566 Confirmed=X Filename=dsa.exe Description=Homepage hijacker - redirecting to downseek.com Source=Paul Collins Startup list [DSAcass] Number=2567 Confirmed=X Filename=[path to file] Description=Added by the RANKY.M TROJAN! Source=Paul Collins Startup list [DSB] Number=2568 Confirmed=X Filename=DSB.exe Description=EnergyPlugin adware Source=Paul Collins Startup list [dsd] Number=2569 Confirmed=X Filename=zz.exe Description=Added by the RBOT-FOX WORM! Source=Paul Collins Startup list [DSentry] Number=2570 Confirmed=N Filename=DSentry.exe Description=Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement an anti-spyware service. Run manually before installation starts Source=Paul Collins Startup list [Dsi] Number=2571 Confirmed=X Filename=dp-******.exe Description=Added by an unidentified adware where ****** are random characters Source=Paul Collins Startup list [Dsi] Number=2572 Confirmed=X Filename=dp-him.exe Description=Added by the MULTIDR-AH TROJAN! Source=Paul Collins Startup list [Dskcompat] Number=2573 Confirmed=X Filename=Dskcompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [DSKEY] Number=2574 Confirmed=U Filename=DsKey.exe Description=Part of PC PhoneHome - "secretly sends an invisible email message to an email address of your choice containing the physical location of your computer every time you get an Internet connection". Security software from Brigadoon Security Group for tracking down lost/stolen computers Source=Paul Collins Startup list [DSL Monitor] Number=2575 Confirmed=N Filename=spdstrm.exe Description=Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray Source=Paul Collins Startup list [DSLagentexe] Number=2576 Confirmed=Y Filename=DSLagent.exe Description=Used in conjunction with USB connected ADSL modems from Eicon Networks (as used by BT for its Broadband internet service for example). Required for a permanent ADSL connection Source=Paul Collins Startup list [dslmon] Number=2577 Confirmed=Y Filename=dslmon.exe Description=Sagem DSL modem related. Apparently needed to detect the modem Source=Paul Collins Startup list [DSLSTATEXE] Number=2578 Confirmed=U Filename=dslstat.exe Description=System tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example) Source=Paul Collins Startup list [DsmSer] Number=2579 Confirmed=X Filename=dsm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [DsmSer] Number=2580 Confirmed=X Filename=msmpatch.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [DsmSer] Number=2581 Confirmed=X Filename=svosm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [DsmSer] Number=2582 Confirmed=X Filename=sysup.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [DsplObjects] Number=2583 Confirmed=X Filename=windspl.exe Description=Added by the BEAGLE.DN WORM! Source=Paul Collins Startup list [DSS] Number=2584 Confirmed=X Filename=dssagent.exe Description=DSSAgent by Br�derbund - spyware. Sends encrypted emails about the system back to the originators of the program. Also a resource hog. See here for more info Source=Paul Collins Startup list [DSS] Number=2585 Confirmed=X Filename=[path to trojan] Description=Added by the DSSDOOR-C TROJAN! Source=Paul Collins Startup list [DSService] Number=2586 Confirmed=X Filename=dmrss.exe Description=Added by the AGOBOT-XX WORM! Source=Paul Collins Startup list [DSSSGENS] Number=2587 Confirmed=? Filename=dssagens.exe Description=?? Source=Paul Collins Startup list [DSystemDriver] Number=2588 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [DU Meter] Number=2589 Confirmed=N Filename=DUMETER.EXE Description=Hagel Technologies internet bandwidth monitor Source=Paul Collins Startup list [duck] Number=2590 Confirmed=X Filename=duck.exe Description=Added by the AGOBOT-AVG WORM! Source=Paul Collins Startup list [Dumeter Services] Number=2591 Confirmed=X Filename=dumeter.exe Description=Added by the SDBOT-AEQ WORM! Source=Paul Collins Startup list [dumprep 0 -k] Number=2592 Confirmed=N Filename=dumprep 0 -k Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [dumprep 0 -u] Number=2593 Confirmed=N Filename=dumprep 0 -u Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [DUN_SERVICES3] Number=2594 Confirmed=X Filename=dun3.exe Description=Added by the SOKIRON TROJAN! Source=Paul Collins Startup list [Duweculey] Number=2595 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BRP WORM! Source=Paul Collins Startup list [dvd43] Number=2596 Confirmed=N Filename=DVD43_Tray.exe Description=DVD43 is "a small tool that integrates into Windows and overrides CSS copy-protection found on DVD movies" Source=Paul Collins Startup list [DVD43] Number=2597 Confirmed=U Filename=DVD43.exe Description=DVD43 is a small tool that overrides CSS copy-protection found on DVD movies Source=Paul Collins Startup list [dvd98] Number=2598 Confirmed=X Filename=windvd98.exe Description=Added by the CULT.P WORM! Source=Paul Collins Startup list [DVDBitSet] Number=2599 Confirmed=U Filename=DVDBitSet.exe Description=DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used Source=Paul Collins Startup list [DVDCheck] Number=2600 Confirmed=? Filename=DVDCheck.exe Description=Related to an Intervideo program. What does it do and is it required in startup? Source=Paul Collins Startup list [Dvdcompat] Number=2601 Confirmed=X Filename=Dvdcompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [DVDLauncher] Number=2602 Confirmed=N Filename=DVDLauncher.exe Description=Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion Source=Paul Collins Startup list [DVDSentry] Number=2603 Confirmed=N Filename=DSentry.exe Description=Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement an anti-spyware service. Run manually before installation starts Source=Paul Collins Startup list [DVDTray] Number=2604 Confirmed=N Filename=DVDTray.exe Description=HP CD/DVD Tray icon installed with the DVD writer software. Periodically checks for new drive firmware Source=Paul Collins Startup list [DVDUpgrade] Number=2605 Confirmed=N Filename=DVDUpgrd.exe Description=Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs Source=Paul Collins Startup list [DVDXGhost] Number=2606 Confirmed=N Filename=DVDGhost.EXE Description=DVD Ghost - "utility to make your software DVD players and DVD copy/backup softwares restriction-free, and copy/backup DVD to hard disk" Source=Paul Collins Startup list [Dvp95] Number=2607 Confirmed=Y Filename=Dvp95.exe Description=Scan engine for F-Secure and Command antivirus software based on the F-Prot AntiVirus engine Source=Paul Collins Startup list [dvpapi9x] Number=2608 Confirmed=Y Filename=DVPAPI9X.exe Description=Command AntiVirus for Windows 95/98/Me Source=Paul Collins Startup list [DvpInitExe] Number=2609 Confirmed=Y Filename=Dvpinit.exe Description=Command Antivirus related Source=Paul Collins Startup list [dvprpt] Number=2610 Confirmed=Y Filename=Dvprpt.exe Description=Command Antivirus related Source=Paul Collins Startup list [dvraudio] Number=2611 Confirmed=X Filename=dvraudio.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [dvsfss] Number=2612 Confirmed=X Filename=fbsfsdrs.exe Description=Added by the SDBOT-QA WORM! Source=Paul Collins Startup list [DVSync] Number=2613 Confirmed=U Filename=dvsync.exe Description=DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC Source=Paul Collins Startup list [Dvx] Number=2614 Confirmed=X Filename=wsxsvc.exe Description=Delfin Media Viewer or "Promulgate" adware variant Source=Paul Collins Startup list [dw] Number=2615 Confirmed=X Filename=dw.exe Description=DownloadWare adware Source=Paul Collins Startup list [DW4] Number=2616 Confirmed=N Filename=Weather.exe Description=Desktop Weather Source=Paul Collins Startup list [DWHeartbeatMonitor] Number=2617 Confirmed=U Filename=DWHeartbeatMonitor.exe Description=DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference Source=Paul Collins Startup list [DwlClient] Number=2618 Confirmed=N Filename=support.exe Description=Download manager for Dell support alerts Source=Paul Collins Startup list [dwStart] Number=2619 Confirmed=Y Filename=FireWall.exe Description=The Shield firewall Source=Paul Collins Startup list [Dx] Number=2620 Confirmed=X Filename=sys*.exe [* = random number] Description=Added by the DEXTER.A WORM! Source=Paul Collins Startup list [Dx8compat] Number=2621 Confirmed=X Filename=Dx8compat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [dxdiags.exe] Number=2622 Confirmed=X Filename=dxdiags.exe Description=Added by the CERTIF-G TROJAN! Source=Paul Collins Startup list [DxDialog] Number=2623 Confirmed=X Filename=dxdlg32.exe Description=Added by the VB-CXT TROJAN! Source=Paul Collins Startup list [dxdll32] Number=2624 Confirmed=X Filename=ntxdll.exe Description=Added by the GAOBOT.CPX WORM! Source=Paul Collins Startup list [DXDllRegExe] Number=2625 Confirmed=N Filename=dxdllreg.exe Description=Created when you select "Yes" to check the "WHQL Digital signatures" in the DirectX9 files at the first time you open it Source=Paul Collins Startup list [DxLoad] Number=2626 Confirmed=X Filename=DX3DRndr.exe Description=Added by the GIBE.B WORM! Source=Paul Collins Startup list [DXM6Patch_981116] Number=2627 Confirmed=N Filename=p_981116.exe Description=Win32 cabinet self extractor. More info here Source=Paul Collins Startup list [dxmsrv] Number=2628 Confirmed=X Filename=dxmsrv.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Dxsty] Number=2629 Confirmed=X Filename=Dxsty.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Dxupdate.exe] Number=2630 Confirmed=X Filename=Dxupdate.exe Description=Added by the MAFEG WORM! Source=Paul Collins Startup list [dxvid] Number=2631 Confirmed=X Filename=dxvid.exe Description=Added by Trojan-Downloader.Win32.Dluca.by TROJAN! Source=Paul Collins Startup list [DyFuCA] Number=2632 Confirmed=X Filename=optimize.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [DyFuCA Active Alert] Number=2633 Confirmed=X Filename=actalert.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [Dynamic DHCP] Number=2634 Confirmed=X Filename=dydhcp.exe Description=Added by the RINBOT.B TROJAN! Source=Paul Collins Startup list [Dynamic Dns Binary] Number=2635 Confirmed=X Filename=dynitora.exe Description=Added by the RBOT-WT WORM! Source=Paul Collins Startup list [Dynamic Dns Binary] Number=2636 Confirmed=X Filename=CMD16.EXE Description=Added by the RBOT-XM WORM! Source=Paul Collins Startup list [Dynamic Dns Binary] Number=2637 Confirmed=X Filename=winxp34.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Dynamic Dns Binary] Number=2638 Confirmed=X Filename=WinHelpcfn.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Dynamic Link Library loader] Number=2639 Confirmed=X Filename=Loader32.exe Description=Added by the KOL TROJAN! Source=Paul Collins Startup list [DynDNS Updater] Number=2640 Confirmed=U Filename=DynDNS.exe Description=Dynamic DNS IP address updater tool, used as a client for Dynamic DNS service providers such as http://www.DynDNS.org Source=Paul Collins Startup list [DynDNS-Updater Traytool] Number=2641 Confirmed=N Filename=ddutray.exe Description=DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually Source=Paul Collins Startup list [DynHttp Dns Binary] Number=2642 Confirmed=X Filename=dynizari.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [DynSite] Number=2643 Confirmed=U Filename=DynSite.exe Description=DynSite - dynamic DNS client, also called an automatic IP updater Source=Paul Collins Startup list [Dynu Basic Client] Number=2644 Confirmed=U Filename=dynubas.exe Description=Dynu online dynamic IP update client. Useful when using a dial up modem Source=Paul Collins Startup list [DZKillMe] Number=2645 Confirmed=? Filename=DZSAVEME.EXE Description=?? Source=Paul Collins Startup list [D_V_T] Number=2646 Confirmed=U Filename=dvt.exe Description=DICOM Validation Tool - "DICOM is increasingly being used as the standard communication mechanism when integrating various medical products in a hospital environment" Source=Paul Collins Startup list [D_V_T] Number=2647 Confirmed=? Filename=dvt.exe Description=Installation could be a crack/hack to NOD32 here. Seen and removed in many logs. Investigate it further and if this file is present C:\d_v_t.reg then it should be fixed. Not to be confused with the DICOM entry here. Both files are located in the Windows/Windir directory Source=Paul Collins Startup list [E-Card] Number=2648 Confirmed=X Filename=ecard.exe Description=Added by the YODI WORM! Source=Paul Collins Startup list [E-color] Number=2649 Confirmed=U Filename=IconMgr.Exe Description=Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program Source=Paul Collins Startup list [E-nrgyPlus] Number=2650 Confirmed=X Filename=E-nrgyPlus.exe Description=Added by the Energyplus TRACKWARE! Tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a remote site Source=Paul Collins Startup list [e-Surveiller Station] Number=2651 Confirmed=X Filename=estation.exe Description=Added by ESurveiller spyware. Note - ESurveiller is spyware that monitors and records keystrokes and mouse clicks, instant message conversations, Internet activity and applications used, must be manually installed Source=Paul Collins Startup list [E06DXLRD_7604703] Number=2652 Confirmed=U Filename=EDICT.EXE Description=Related to Microsoft Encarta dictionary functions Source=Paul Collins Startup list [E6TaskPanel] Number=2653 Confirmed=N Filename=TaskPanl.exe Description=Earthlink Task Panel - part of Earthlink TotalAccess 2003 internet access software. Quick access to internet, E-mail and web-space Source=Paul Collins Startup list [eabconfg.cpl] Number=2654 Confirmed=U Filename=EabServr.exe Description=Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys Source=Paul Collins Startup list [Eac Download] Number=2655 Confirmed=X Filename=download.exe Description=Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here Source=Paul Collins Startup list [EACLEAN] Number=2656 Confirmed=U Filename=eaclean.exe Description=For Compaq PC's. Easy Access button support for the keyboard Source=Paul Collins Startup list [Eac_Cnry] Number=2657 Confirmed=X Filename=canary.exe Description=Added by the CANARY TROJAN! Source=Paul Collins Startup list [Eac_rnvdl] Number=2658 Confirmed=? Filename=ANTIVIRUS_INSTALL.EXE Description=?? Source=Paul Collins Startup list [EanthologyApp] Number=2659 Confirmed=U Filename=EANTHO~1.EXE Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [EanthologyApp] Number=2660 Confirmed=U Filename=eanthology.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [eanthology_install.exe] Number=2661 Confirmed=U Filename=eanthology_install.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [eanth_critical_update_alert] Number=2662 Confirmed=U Filename=sys_alert.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [eanth_system_patcher] Number=2663 Confirmed=U Filename=sys_alert.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [Eapcisetup] Number=2664 Confirmed=N Filename=sbsetup.exe Description=Rockwell RipTide soundcard application software. Sound works without it Source=Paul Collins Startup list [EAPCISETUP] Number=2665 Confirmed=N Filename=wizard.exe Description=Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation Source=Paul Collins Startup list [Earthlink Protection Control Center] Number=2666 Confirmed=Y Filename=elnk_pcc.exe Description=EarthLink Protection Control Center - "powerful, integrated security program makes it easier than ever to protect yourself against viruses, spyware, and hackers-all from one convenient location" Source=Paul Collins Startup list [EarthLink ToolBar 5.0] Number=2667 Confirmed=N Filename=etoolbar.exe Description=EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar, but you can delete these or add more buttons any time Source=Paul Collins Startup list [Easy Key] Number=2668 Confirmed=U Filename=easykey.exe Description=For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used Source=Paul Collins Startup list [Easy Start Button] Number=2669 Confirmed=N Filename=esb.exe Description=Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys Source=Paul Collins Startup list [Easy-PrintToolBox] Number=2670 Confirmed=U Filename=BJPSMAIN.EXE Description=A utility to launch the applications that are bundled with a Canon bubblejet printer Source=Paul Collins Startup list [EasyAV] Number=2671 Confirmed=X Filename=EasyAV.exe Description=Added by the NETSKY.S or NETSKY.T WORMS! Source=Paul Collins Startup list [EasyDates] Number=2672 Confirmed=X Filename=EasyDates.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [EasyDates_nl] Number=2673 Confirmed=X Filename=EasyDates_nl.exe Description=Adult content dialler Source=Paul Collins Startup list [EasyKey] Number=2674 Confirmed=U Filename=easykey.exe Description=For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used Source=Paul Collins Startup list [EasyKeyboardLogger] Number=2675 Confirmed=U Filename=EasyKeyboardLogger.exe Description=EasyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [EasyMessage] Number=2676 Confirmed=U Filename=em2.exe Description=Easy Messenger, instant messenger for MSN, AOL, ICQ, and Yahoo. See here Source=Paul Collins Startup list [EasySearchBar] Number=2677 Confirmed=X Filename=ESBUpdate.exe Description=EasySearchBar adware downloader Source=Paul Collins Startup list [easyServ] Number=2678 Confirmed=X Filename=Server.exe Description=Added by the EASYSERV TROJAN! Source=Paul Collins Startup list [EasySync Pro] Number=2679 Confirmed=U Filename=XCPCMenu.exe Description=EasySync Pro is a Lotus (now owned by IBM) program for synchronizing a PDA with Lotus Notes Source=Paul Collins Startup list [EasyTuneIII] Number=2680 Confirmed=U Filename=EasyTune.exe Description=Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Source=Paul Collins Startup list [EasyTuneIV] Number=2681 Confirmed=U Filename=ET4Tray.exe Description=Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Source=Paul Collins Startup list [easywww] Number=2682 Confirmed=X Filename=easywww2.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [EbatesMoeMoneyMaker] Number=2683 Confirmed=N Filename=wjview ...Code Description=Ebates adware Source=Paul Collins Startup list [EbatesMoeMoneyMaker0] Number=2684 Confirmed=X Filename=EbatesMoeMoneyMaker0.exe Description=Ebates adware Source=Paul Collins Startup list [eBay Toolbar] Number=2685 Confirmed=X Filename=EBAYTBAR.EXE Description=eBay Toolbar - reportes as spyware as it "phones home" Source=Paul Collins Startup list [eBayToolbar] Number=2686 Confirmed=U Filename=eBayTBDaemon.exe Description=eBay toolabar related - also contains eBay account Guard which monitors for fraudulent eBay sites Source=Paul Collins Startup list [eBoard] Number=2687 Confirmed=U Filename=Eboard.exe Description=eMachines multimedia keyboard manager. Required if you use the extra keys Source=Paul Collins Startup list [eBot] Number=2688 Confirmed=N Filename=DownloadWizard.exe Description=eBot from Digital River - "helps ensure your computer always has the latest technology, fixes, add-ons, upgrades and 'cool stuff'." Can optionally be installed with software such as Net Nanny internet filtering software. Available via Start -> Programs Source=Paul Collins Startup list [EC21] Number=2689 Confirmed=U Filename=EZQ.EXE Description=Related to EC21. "EC21 is the world�s largest B2B marketplace to facilitate online trades between exporters and importers from all around the world" Source=Paul Collins Startup list [ecko] Number=2690 Confirmed=X Filename=claro.exe Description=Added by the DLOADR-AQJ TROJAN! Source=Paul Collins Startup list [ecpe] Number=2691 Confirmed=? Filename=ECPE.EXE Description=?? Source=Paul Collins Startup list [eDataSecurity Loader] Number=2692 Confirmed=U Filename=eDSloader.exe Description=Part of Acer Empowering Technology. "Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons, using passwords and advanced encryption algorithms" Source=Paul Collins Startup list [edexter] Number=2693 Confirmed=N Filename=edexter.exe Description=eDexter supplements internet filtering by substituting local images for filtered images in order to prevent browser stalls and other annoyances. Can be activated manually when starting the browser Source=Paul Collins Startup list [editpad] Number=2694 Confirmed=X Filename=editpad.exe Description=Added by the CONSPER-B TROJAN! Source=Paul Collins Startup list [EDLoader] Number=2695 Confirmed=N Filename=DTLoader.exe Description=Effective Desktop from MiniStars Software - desktop management software no longer being supported Source=Paul Collins Startup list [eDonkey2000] Number=2696 Confirmed=U Filename=edonkey2000.exe Description=File sharing network - not recommended as the free version of this application should be avoided as it installs, without permission, New.Net, Webhancer, WebSearch Toolbar and WinTools Source=Paul Collins Startup list [EDRestore] Number=2697 Confirmed=U Filename=?? Description=Set Point from Easy Desk Software - "small utility that automatically sets System Restore points for WinME/XP" Source=Paul Collins Startup list [educational writer] Number=2698 Confirmed=X Filename=[random filename] Description=Added by the RBOT-LZ WORM! Source=Paul Collins Startup list [Edwizard] Number=2699 Confirmed=U Filename=Edwizard.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [EDxMC110] Number=2700 Confirmed=X Filename=Isass.exe Description=Added by the VB-NIA WORM! Source=Paul Collins Startup list [EEventManager] Number=2701 Confirmed=N Filename=EEventManager.exe Description=Part of the Epson Creativity Suite supplied with their multi-function printer/scanners, Event Manager launches File Manager or PageManager for EPSON automatically when you press the B&W Start or Color Start button on the control panel in Scan mode Source=Paul Collins Startup list [eFax DllCmd] Number=2702 Confirmed=U Filename=J2GDllCmd.exe Description=eFax Messenger fax software Source=Paul Collins Startup list [eFax Tray Menu] Number=2703 Confirmed=N Filename=HotTray.exe Description=eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Source=Paul Collins Startup list [eFax Tray Menu] Number=2704 Confirmed=U Filename=J2GTray.exe Description=eFax Messenger fax software tray menu Source=Paul Collins Startup list [eFax.com Tray Menu] Number=2705 Confirmed=N Filename=HotTray.exe Description=eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Source=Paul Collins Startup list [efaxs lptt01] Number=2706 Confirmed=X Filename=efaxs.exe Description=RapidBlaster variant (in a "efaxs" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [efaxs ml097e] Number=2707 Confirmed=X Filename=efaxs.exe Description=RapidBlaster variant (in a "efaxs" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [EFI Job Monitor] Number=2708 Confirmed=U Filename=[path] efjm.dll,run Description=Ricoh Imagio Printer/Scanner driver status monitor Source=Paul Collins Startup list [Efpap.exe] Number=2709 Confirmed=U Filename=Efpap.exe Description=Easy File & Folder Protector. Deny access to certain files and folders, or to hide them securely from viewing and searching Source=Paul Collins Startup list [ehTray] Number=2710 Confirmed=U Filename=ehtray.exe Description=Enables the user to access Windows Messenger from within Windows Media Center Edition Source=Paul Collins Startup list [ei10.exe] Number=2711 Confirmed=X Filename=ei10.exe Description=Added by the AGOBOT-NK WORM! Source=Paul Collins Startup list [Eicon NetworksLAN_DAEMON] Number=2712 Confirmed=U Filename=watch.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually Source=Paul Collins Startup list [Eicon TechnologyLAN_DAEMON] Number=2713 Confirmed=U Filename=watch.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually Source=Paul Collins Startup list [eixfi] Number=2714 Confirmed=X Filename=china.bat Description=Added by the WCUP.A WORM! Source=Paul Collins Startup list [Elbycheck] Number=2715 Confirmed=U Filename=ElbyCheck.exe Description=From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it Source=Paul Collins Startup list [Electron Microscope] Number=2716 Confirmed=U Filename=EMIII.exe Description=Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home, FAH. It will monitor up to 50 clients and give you the details about each client's progress as the FAH client runs. EM will also show you what each change in the protein looks like as the process continues Source=Paul Collins Startup list [Element] Number=2717 Confirmed=X Filename=Element.txt Description=Added by the ELEM TROJAN! Source=Paul Collins Startup list [element furth] Number=2718 Confirmed=X Filename=[path] repcale.exe [path] palsp.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [elitemedia] Number=2719 Confirmed=X Filename=elitemediapop.exe Description=Added by the LOWZONE-BB TROJAN! Also known as Elitebar/EliteToolbar/EliteSidebar adware Source=Paul Collins Startup list [elm] Number=2720 Confirmed=N Filename=Elmenv.exe Description=ViaTech eLicense for securing, distributing and selling music online Source=Paul Collins Startup list [ELNKProxy] Number=2721 Confirmed=X Filename=smproxy.exe Description=Surfmonkey adware Source=Paul Collins Startup list [ELSA WINman Suite] Number=2722 Confirmed=U Filename=Winmsuit.exe Description=Allows you to totally customize your ELSA graphics card settings, including overclocking the GPU Source=Paul Collins Startup list [ElsaCapiCtl] Number=2723 Confirmed=Y Filename=Rcapi.exe Description=Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there you can not bring up the dialog box which is sometimes needed to reset the modem Source=Paul Collins Startup list [ELSAChipGuard] Number=2724 Confirmed=U Filename=elsavect.exe Description=ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed, and will halt the system if either are at dangerous levels and restore the default clock speeds upon reboot. Leave enabled if overclocking Source=Paul Collins Startup list [ELSBLaunch] Number=2725 Confirmed=U Filename=ELSBLaunch.exe Description=EarthLink SpamBlocker Source=Paul Collins Startup list [EMA.exe] Number=2726 Confirmed=N Filename=EMA.EXE Description=Time management system which helps you to manage your time and appointments Source=Paul Collins Startup list [eMachines eBoard] Number=2727 Confirmed=U Filename=Eboard.exe Description=eMachines multimedia keyboard manager. Required if you use the extra keys Source=Paul Collins Startup list [Email Protection] Number=2728 Confirmed=Y Filename=emlproxy.exe Description=AntiVirus Quick Heal - E-mail protection Source=Paul Collins Startup list [EmailScan] Number=2729 Confirmed=Y Filename=mcvsescn.exe Description=Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails Source=Paul Collins Startup list [eMakeSV] Number=2730 Confirmed=X Filename=EMAKESV.EXE Description=Switch premium rate adult content dialler variant Source=Paul Collins Startup list [eMakeSV] Number=2731 Confirmed=X Filename=EMAKE2B.EXE Description=Switch premium rate adult content dialer variant Source=Paul Collins Startup list [EMBASSY Trust Suite Secure Update] Number=2732 Confirmed=U Filename=AutoUpdate.exe Description=Updates for Wave Systems Corp. Embassy Trust Suite - "delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today" Source=Paul Collins Startup list [eMCryT Sh3ars Panagers] Number=2733 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-AWI WORM! Source=Paul Collins Startup list [EMMeter] Number=2734 Confirmed=U Filename=EMMeter.exe Description="Express Meter provides detailed information about how your software assets are being used. With Express Meter you can monitor application usage, identify software usage patterns, and control application launches�all of which can help you make better decisions about your IT investments" Source=Paul Collins Startup list [emoc0re] Number=2735 Confirmed=X Filename=emo.exe Description=Added by the AGOBOT-AGE WORM! Source=Paul Collins Startup list [empin] Number=2736 Confirmed=X Filename=e121307.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [empin] Number=2737 Confirmed=X Filename=e121307.Stub.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [emsw.exe] Number=2738 Confirmed=X Filename=emsw.exe Description=Attune HelpExpress - spyware. Disable and uninstall - see here Source=Paul Collins Startup list [emule] Number=2739 Confirmed=X Filename=emule.exe Description=Added by the RBOT-ALZ WORM! Source=Paul Collins Startup list [eMusicClient Systray] Number=2740 Confirmed=N Filename=eMusicClient.exe Description=eMusic MP3 download software Source=Paul Collins Startup list [EM_EXEC] Number=2741 Confirmed=U Filename=EM_EXEC.EXE Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [EN4060C Taskbar] Number=2742 Confirmed=N Filename=en4060ct.exe Description=Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray Source=Paul Collins Startup list [enBrowser] Number=2743 Confirmed=X Filename=[name of file] Description=WINBO adware Source=Paul Collins Startup list [encapsulated command tool] Number=2744 Confirmed=? Filename=wintr.com Description=?? Source=Paul Collins Startup list [Encarta Dictionary Quickshelf] Number=2745 Confirmed=N Filename=QSHLFED.EXE Description=Provides quick access to Encarta's Dictionary features? Source=Paul Collins Startup list [ENCMONITOR] Number=2746 Confirmed=N Filename=monitor.exe Description=The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it Source=Paul Collins Startup list [Encoder Agent] Number=2747 Confirmed=N Filename=WMENCAGT.EXE Description=MS Windows Media Encoder, which already has a shortcut in the Start Menu if installed Source=Paul Collins Startup list [Encompass_ENCMONTR] Number=2748 Confirmed=U Filename=ENCMONTR.EXE Description=Optional simple browser from Yahoo (Encompass) Source=Paul Collins Startup list [ENCSurf] Number=2749 Confirmed=? Filename=surfboard.exe Description=?? Source=Paul Collins Startup list [Energizer FileSaver] Number=2750 Confirmed=N Filename=Energizer FileSaver.exe Description=Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended Source=Paul Collins Startup list [EnergyPlugIn] Number=2751 Confirmed=X Filename=EnergyPlugin.exe Description=EnergyPlugin adware variant Source=Paul Collins Startup list [enginecs2] Number=2752 Confirmed=U Filename=enginecs2.exe Description=Cyber Sentinel - internet filtering software Source=Paul Collins Startup list [EngUtil] Number=2753 Confirmed=Y Filename=EngUtil.exe Description=Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking Source=Paul Collins Startup list [Enh Win Updt] Number=2754 Confirmed=X Filename=enhupdt.exe Description=Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.OneClickNetSearch.h Source=Paul Collins Startup list [enhance32] Number=2755 Confirmed=X Filename=enhance32.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [EnigmaPopupStop] Number=2756 Confirmed=N Filename=EnigmaPopupStop.exe Description=Part of Enigma SpyHunter - not recommended, see note Source=Paul Collins Startup list [ENSApServer2_0] Number=2757 Confirmed=? Filename=APSERVER.EXE Description=Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required? Source=Paul Collins Startup list [ENSMIX32.EXE] Number=2758 Confirmed=? Filename=ENSMIX32.EXE Description=Sound card driver. Is it required? Source=Paul Collins Startup list [EnsoniqMixer] Number=2759 Confirmed=U Filename=starter.exe Description=Puts the Ensoniq mixer in system tray. From Ensoniq Technologies "Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility Source=Paul Collins Startup list [Entbloess 2] Number=2760 Confirmed=U Filename=Entbloess2.exe Description=Related to Window-Switcher (now Reflex Vision) - it allows you to see previews of all your open applications via a single keystroke in a manner similar to Apple's Expos�, for Windows 2K/XP Source=Paul Collins Startup list [Enterra Icon Keeper] Number=2761 Confirmed=U Filename=IcnKeepr.exe Description=Icon Keeper - "tool to save and restore icon positions on the desktop" Source=Paul Collins Startup list [Enumerate Service] Number=2762 Confirmed=X Filename=wsys.exe Description=Added by the MANIFEST TROJAN! Source=Paul Collins Startup list [EnvyHFCPL] Number=2763 Confirmed=Y Filename=EnMixCPL.exe Description=VIA Envy24 PCI Audio Controller driver Source=Paul Collins Startup list [eonemng] Number=2764 Confirmed=U Filename=eOneMng.exe Description=eOne Manager, provides access to the buttons on the keyboard and on the front of the console for the eMachines eOne PC Source=Paul Collins Startup list [EOUApp] Number=2765 Confirmed=U Filename=EOUWiz.exe Description=Intel ProSET Wireless related - provides additional configuration options for these devices Source=Paul Collins Startup list [EOUWiz] Number=2766 Confirmed=U Filename=EOUWiz.exe Description=Intel ProSET Wireless related - provides additional configuration options for these devices Source=Paul Collins Startup list [ePower_DMC] Number=2767 Confirmed=U Filename=ePower_DMC.exe Description=Part of Acer Empowering Technology. "Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles, or to create their own customized profiles" Source=Paul Collins Startup list [EPoXUSDM] Number=2768 Confirmed=U Filename=USDM.EXE Description=EPoX Universal Serial Data Monitor - a diagnostics tool that shows Temps, Fan Speeds, Voltages...etc Source=Paul Collins Startup list [ePrint 3.0 Service] Number=2769 Confirmed=N Filename=EPRINT3.EXE Description=LEADTOOLS ePrint file conversion software - "convert any file to and from over 150 document and image formats including searchable PDF, DOC, HTML, TXT, Multi-page TIFF, JPG, GIF, PNG and many more!" Can be started manually Source=Paul Collins Startup list [ePrint 4.0 Service] Number=2770 Confirmed=N Filename=EPRINT4.EXE Description=A component of the "LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF, DOC, HTML, TXT , Multi-page TIFF, JPG, GIF, PNG and many more!" Can be started manually Source=Paul Collins Startup list [ePrompter] Number=2771 Confirmed=U Filename=ePrompter.exe Description=ePrompter - E-mail notification software Source=Paul Collins Startup list [EPS] Number=2772 Confirmed=N Filename=e_srcv02.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPS] Number=2773 Confirmed=N Filename=e_srcv03.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPSON Background Monitor] Number=2774 Confirmed=N Filename=STMS.EXE Description=Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not Source=Paul Collins Startup list [EPSON CardMonitor] Number=2775 Confirmed=U Filename=EPSON CardMonitor1.0.exe Description=Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint Source=Paul Collins Startup list [EPSON Status Monitor 3 Environment Check] Number=2776 Confirmed=N Filename=e_srcv03.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPSON Status Monitor 3 Environment Check] Number=2777 Confirmed=N Filename=e_srcv02.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPSON Status Monitor 3 Environment Check 2] Number=2778 Confirmed=N Filename=e_srcv03.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPSON Status Monitor 3 Environment Check 2] Number=2779 Confirmed=N Filename=e_srcv02.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [EPSON Stylus C44 Series] Number=2780 Confirmed=U Filename=E_S10IC2.EXE Description=Epson Stylus C44 Series printer monitor - for checking ink levels, etc Source=Paul Collins Startup list [EPSON Stylus C46 Series] Number=2781 Confirmed=U Filename=E_S4I0T1.EXE Description=Epson Stylus C46 Series printer monitor - for checking ink levels, etc Source=Paul Collins Startup list [Epson Stylus C62 Series] Number=2782 Confirmed=U Filename=E-S0BIC1.EXE Description=Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Source=Paul Collins Startup list [Epson Stylus C82 Series] Number=2783 Confirmed=U Filename=e_s0hic1.EXE Description=Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Source=Paul Collins Startup list [EPSON Stylus DX4800 Series] Number=2784 Confirmed=? Filename=E_FATIADE.EXE Description=Related to Epson Stylus DX4800 Series printer - what does it do and is it required in startup? Source=Paul Collins Startup list [EPSON Stylus Photo R300 Series] Number=2785 Confirmed=U Filename=E_S4I2F1.EXE Description=Epson Status Monitor 3 for the Epson Stylus Photo R300 (and probably others) printers - monitors the status of ink levels, a print job spooled to that printer, etc Source=Paul Collins Startup list [EPSON Stylus Photo RX420 Series] Number=2786 Confirmed=U Filename=E_FATI9CE.EXE Description=Related to the EPSON Stylus Photo RX420 Series printer/scanner/copier Source=Paul Collins Startup list [EpsonPhotoStarter] Number=2787 Confirmed=U Filename=EPSON_PhotoStarter.exe Description=Only needed if you want to make full use of the capabilities of an Epson printer that included this Source=Paul Collins Startup list [Eptr] Number=2788 Confirmed=X Filename=nopdb.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [EQAdvice] Number=2789 Confirmed=X Filename=EQAdvice.exe Description=Added by NewAds1 ADAWARE! Source=Paul Collins Startup list [EQArticle] Number=2790 Confirmed=U Filename=EQArticle.exe Description=EQArticle adware Source=Paul Collins Startup list [Equipmen] Number=2791 Confirmed=? Filename=Equipmen.exe Description=?? Source=Paul Collins Startup list [Eraser] Number=2792 Confirmed=U Filename=eraser.exe Description=Eraser allows for complete removal of data from your hard drive Source=Paul Collins Startup list [eRecoveryService] Number=2793 Confirmed=U Filename=check.exe Description=Acer Notebook related. Acer eRecovery allows the user to restore the operating system or backup the current system profile, thus ensuring system integrity Source=Paul Collins Startup list [eRecoveryService] Number=2794 Confirmed=U Filename=Monitor.exe Description=Part of Acer Empowering Technology. "Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer, and also acts as a versatile standalone backup and recovery manager" Source=Paul Collins Startup list [EReg] Number=2795 Confirmed=N Filename=reg32.exe Description=EReg is a software registration tool incorporated on products such as those by Br�derbund, Connectix, Hewlett-Packard, The Learning Company, and Sierra. Needless to say you don't need it Source=Paul Collins Startup list [erfgddfk] Number=2796 Confirmed=X Filename=wind2ll2.exe Description=Added by the BEAGLE.CQ WORM! Source=Paul Collins Startup list [erghgjhgdr] Number=2797 Confirmed=X Filename=windlhhl.exe Description=Added by the BEAGLE.BG WORM! Source=Paul Collins Startup list [erghgjhjgdr] Number=2798 Confirmed=X Filename=windlhhl.exe Description=Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS! Source=Paul Collins Startup list [erm] Number=2799 Confirmed=? Filename=erm.exe Description=?? Source=Paul Collins Startup list [eros.exe] Number=2800 Confirmed=X Filename=eros.exe Description=Adult content dailler Source=Paul Collins Startup list [Error Nuker] Number=2801 Confirmed=N Filename=ErrorNuker.exe Description=ErrorNuker registry cleaner - only required if you want the application to run a scan at startup. The program can be launched manually if required Source=Paul Collins Startup list [Error Safe] Number=2802 Confirmed=N Filename=ers.exe Description=ErrorSafe security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [ErrorGuard] Number=2803 Confirmed=X Filename=ErrorGuard.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [errorhandler] Number=2804 Confirmed=X Filename=errorhandler.exe Description=Added by ErrorHandler ADAWARE! Source=Paul Collins Startup list [ERS] Number=2805 Confirmed=N Filename=ers_startupmon.exe Description=ErrorSafe security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [erscw] Number=2806 Confirmed=N Filename=erscw.exe Description=ErrorSafe security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [ERS_check] Number=2807 Confirmed=N Filename=ers_startupmon.exe Description=ErrorSafe security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [erthegdr] Number=2808 Confirmed=X Filename=windll2.exe Description=Added by the BEAGLE.CG WORM! Source=Paul Collins Startup list [erthgdr] Number=2809 Confirmed=X Filename=windll.exe Description=Added by the BEAGLE.AO or BEAGLE.AQ WORMS! Source=Paul Collins Startup list [erthgdr] Number=2810 Confirmed=X Filename=svc.exe Description=Added by the BEAGLE.BN or BEAGLE.BP WORM! Source=Paul Collins Startup list [erthgdr2] Number=2811 Confirmed=X Filename=svc23.exe Description=Added by the BAGLE.CG WORM! Source=Paul Collins Startup list [ERTS0749] Number=2812 Confirmed=? Filename=ERTS0749.exe Description=IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? Source=Paul Collins Startup list [ERUNT AutoBackup] Number=2813 Confirmed=U Filename=AUTOBACK.EXE Description=ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots, resulting in numerous backups that can be restored Source=Paul Collins Startup list [eSafe Protect] Number=2814 Confirmed=Y Filename=ESPWatch.exe Description=eSafe from Aladdin - internet security for gateway and E-mail servers Source=Paul Collins Startup list [ESB] Number=2815 Confirmed=U Filename=esb.exe Description=Easy Start Button - provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys Source=Paul Collins Startup list [eScan Monitor] Number=2816 Confirmed=Y Filename=AVKWCTL9X.EXE Description=MicroWorld eScan antivirus Source=Paul Collins Startup list [eScan Scheduler] Number=2817 Confirmed=U Filename=avkserv.exe Description=MicroWorld eScan antivirus scheduler Source=Paul Collins Startup list [eScan Updater] Number=2818 Confirmed=U Filename=Trayicos.exe Description=MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads Source=Paul Collins Startup list [EScorcher] Number=2819 Confirmed=X Filename=escorcher.exe Description=Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead Source=Paul Collins Startup list [ESFTP] Number=2820 Confirmed=N Filename=esftp.exe Description=ESftp - FTP client for transfering files between a local PC and another remote computer Source=Paul Collins Startup list [Esoh] Number=2821 Confirmed=X Filename=Esoh123.exe Description=Added by the AGOBOT.FF WORM! Source=Paul Collins Startup list [Especial] Number=2822 Confirmed=X Filename=Deneca.bat Description=Added by the DELUZ VIRUS! Source=Paul Collins Startup list [ESPN BottomLine] Number=2823 Confirmed=N Filename=bline.exe Description=ESPN BottomLine. "You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop, without even worrying about a browser. As long you keep the BottomLine running, you will continue to receive live scores and breaking news, and by clicking on any score or news item, you will be taken directly to the corresponding page on ESPN.com for a full break down." Source=Paul Collins Startup list [ESS Daemon] Number=2824 Confirmed=? Filename=Essd.exe Description=Related to an ESS based soundacard. Is it required? Source=Paul Collins Startup list [essapm] Number=2825 Confirmed=? Filename=essapm.exe Description=ESS Solo soundcard driver. Is it required? Source=Paul Collins Startup list [Essdc] Number=2826 Confirmed=Y Filename=essdc.exe Description=Related to an ESS Solo soundcard. Seems as though it's required Source=Paul Collins Startup list [ESSNDSYS] Number=2827 Confirmed=? Filename=ESSNDSYS.EXE Description=Related to an ESS based soundacard. Is it required? Source=Paul Collins Startup list [ESSOLO] Number=2828 Confirmed=Y Filename=ESSOLO.exe Description=Sound card driver that re-instates itself every time it's removed Source=Paul Collins Startup list [esspk] Number=2829 Confirmed=Y Filename=esspk.exe Description=ESS Technology modem speaker driver file. Required to get on-line with this modem Source=Paul Collins Startup list [EssSpkPhone] Number=2830 Confirmed=U Filename=essspk.exe Description=ESS Technologies Call waiting, which gets installed by the drivers for V92 modems based on ESS Technologies chipsets Source=Paul Collins Startup list [eSupInit] Number=2831 Confirmed=? Filename=eSupCmd.exe Description=Related to SupportSoft (aka Support.com) "Real-Time Service Management software". What does it do and is it required? Source=Paul Collins Startup list [ETB Tester] Number=2832 Confirmed=X Filename=etbtest.exe Description=Added by the RBOT-ABR WORM! Source=Paul Collins Startup list [etbrun] Number=2833 Confirmed=X Filename=elit***32.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [Ethernet] Number=2834 Confirmed=N Filename=tcaudiag.exe Description=3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs Source=Paul Collins Startup list [ethernet] Number=2835 Confirmed=X Filename=airftp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ethernet] Number=2836 Confirmed=X Filename=msnger.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ethernet] Number=2837 Confirmed=X Filename=msftp.exe Description=Added by the SDBOT.BXJ WORM! Source=Paul Collins Startup list [Ethernet Drivers] Number=2838 Confirmed=X Filename=smrrs.exe Description=Added by the RBOT-AAK WORM! Source=Paul Collins Startup list [Ethernet Drivers] Number=2839 Confirmed=X Filename=ethernet.exe Description=Added by the GAOBOT.CEZ WORM! Source=Paul Collins Startup list [Etraffic] Number=2840 Confirmed=X Filename=JavaRun.exe Description=TopMoxie adware Source=Paul Collins Startup list [eTrust EZ Firewall] Number=2841 Confirmed=Y Filename=efpeadm.exe Description=eTrust EZ Firewall Source=Paul Collins Startup list [eTrust PestPatrol Active Protection] Number=2842 Confirmed=U Filename=PPActiveDetection.exe Description=PestPatrol real-time protection feature. "Stops spyware before it infects your system" Source=Paul Collins Startup list [eTrust Realtime Monitor] Number=2843 Confirmed=X Filename=realmon.exe Description=Added by the LAZAR.B TROJAN! Source=Paul Collins Startup list [eTrustCIPE] Number=2844 Confirmed=Y Filename=ezdsmain.exe Description=eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior Source=Paul Collins Startup list [eTunnel] Number=2845 Confirmed=X Filename=winfw.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [EUP Service] Number=2846 Confirmed=X Filename=eupsvc.exe Description=Added by the DELBOT-Q WORM! Source=Paul Collins Startup list [EuroGlot] Number=2847 Confirmed=U Filename=EuroGlot.exe Description=Euroglot - "multilanguage translating system, available in the languages Dutch, English, French, German, Spanish and Italian" Source=Paul Collins Startup list [Event Log] Number=2848 Confirmed=? Filename=eventlog.exe Description=?? Source=Paul Collins Startup list [Event Planner Reminders] Number=2849 Confirmed=N Filename=PLNRnote.exe Description=Sierra Event Planner tray icon Source=Paul Collins Startup list [Event Reminder] Number=2850 Confirmed=N Filename=pmremind.exe Description=A calendar/alarm program that installs with Br�derbund Printmaster Source=Paul Collins Startup list [EventApplicationCmd] Number=2851 Confirmed=X Filename=smschk.exe Description=Added by the IRCBOT-AO TROJAN! Source=Paul Collins Startup list [EVENTLISTENER] Number=2852 Confirmed=U Filename=EvLstnr.exe Description=Used with a Nikon digital camera to recognize when the camera is plugged in Source=Paul Collins Startup list [eventmgr] Number=2853 Confirmed=N Filename=eventmgr.exe Description=Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs Source=Paul Collins Startup list [eventwvr] Number=2854 Confirmed=X Filename=eventwvr.exe Description=Added by the COSIAM_G TROJAN! Source=Paul Collins Startup list [Evidence Cleaner] Number=2855 Confirmed=U Filename=ecleaner.exe Description=Evidence Cleaner cleans up tracks left by your PC and Internet activities Source=Paul Collins Startup list [Evidence Eliminator] Number=2856 Confirmed=N Filename=ee.exe Description=Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis Source=Paul Collins Startup list [Evil] Number=2857 Confirmed=X Filename=Evil.exe Description=Added by the MYTOB.JM WORM! Source=Paul Collins Startup list [evntsvc] Number=2858 Confirmed=N Filename=evntsc.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [EVOLOSTA] Number=2859 Confirmed=U Filename=EVOLOSTA.EXE Description=Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID, peer-to-peer mode channel, link speed, WEP encryption options, and has enable/disable and rescan buttons. It is not needed if using Windows XP or higher, as they have this built-in to the control panel. Also, if the user is very sure that there is ONLY ONE network available to connect to, then they can remove this. If it is not in startup, and the user needs to run it, they can simply type EVOLOSTA in the Start -> Run dialog to run it Source=Paul Collins Startup list [Evoluent Mouse Manager] Number=2860 Confirmed=U Filename=EvoMouExec.exe Description=Mouse manager for Evoluent VertcialMouse Source=Paul Collins Startup list [EvtHtm] Number=2861 Confirmed=X Filename=evthtm.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [EW Message Server] Number=2862 Confirmed=U Filename=msg32.exe Description=Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices Source=Paul Collins Startup list [eWare Startup] Number=2863 Confirmed=N Filename=iWareStart.exe Description=eWare iWare task bar. Not required Source=Paul Collins Startup list [ewupdater] Number=2864 Confirmed=X Filename=ewupdater.exe Description=EasyWebSearch adware updater Source=Paul Collins Startup list [example] Number=2865 Confirmed=X Filename=[random filename].exe Description=Added by the NUCLEAR TROJAN! Note - this trojan file is found in the Windows\NR or Winnt\NR folder Source=Paul Collins Startup list [Excite Platform] Number=2866 Confirmed=N Filename=Exlaunch.exe Description=Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer Source=Paul Collins Startup list [Excite Private Messenger Pipe] Number=2867 Confirmed=? Filename=x8impipe.exe Description=?? Source=Paul Collins Startup list [ExciteAssistantEXE] Number=2868 Confirmed=N Filename=ASSISTANT.EXE Description=With Excite Assistant, you can access a wide variety of online information, including email, news, and stock quotes without having to have a browser window open Source=Paul Collins Startup list [exdl.exe] Number=2869 Confirmed=X Filename=exdl.exe Description=BargainBuddy foistware Source=Paul Collins Startup list [exe lptt01] Number=2870 Confirmed=X Filename=exe.exe Description=RapidBlaster variant (in a "Exe" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [exe ml097e] Number=2871 Confirmed=X Filename=exe.exe Description=RapidBlaster variant (in a "Exe" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [execfg4] Number=2872 Confirmed=X Filename=execfg4.exe Description=Added by the ELECTRON WORM! Source=Paul Collins Startup list [ExecUser] Number=2873 Confirmed=X Filename=ExecUser.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Execute] Number=2874 Confirmed=? Filename=delfolders.exe Description=?? Source=Paul Collins Startup list [ExeName32] Number=2875 Confirmed=X Filename=Warm.scr Description=Added by the SCOLD WORM! Source=Paul Collins Startup list [ExFilter] Number=2876 Confirmed=X Filename=Rundll32.exe [path] cdnspie.dll, ExecFilter Description=CNNIC Update pest Source=Paul Collins Startup list [exgiwsl] Number=2877 Confirmed=? Filename=exgiwsl.exe Description=?? Source=Paul Collins Startup list [Exif Launcher] Number=2878 Confirmed=U Filename=Exiflaquickdcr.exe Description=USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly Source=Paul Collins Startup list [Exif Launcher] Number=2879 Confirmed=U Filename=QuickDCF.exe Description=USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly Source=Paul Collins Startup list [ExitKiller] Number=2880 Confirmed=U Filename=Ekiller.exe Description=Exit Killer - automatically closes pop-up windows in your browser Source=Paul Collins Startup list [exmon] Number=2881 Confirmed=? Filename=hpimoniter.exe Description=Some kind of hp digital camera maybe or a photo smart connection probe? Source=Paul Collins Startup list [Exn] Number=2882 Confirmed=X Filename=exn.exe Description=Added by the IRCBOT.RJ WORM! Source=Paul Collins Startup list [EXPL0RE.EXE] Number=2883 Confirmed=X Filename=EXPL0RE.EXE Description=Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit "0" instead of the uppercase letter "o" Source=Paul Collins Startup list [Expl0rer soft] Number=2884 Confirmed=X Filename=expl0rer.pif Description=Added by the RBOT-AQR WORM! Source=Paul Collins Startup list [expler] Number=2885 Confirmed=X Filename=Updadv.exe Description=Added by the QQPASS-N TROJAN! Source=Paul Collins Startup list [Explkw] Number=2886 Confirmed=X Filename=expup.exe Description=Keywords hijacker Source=Paul Collins Startup list [explore] Number=2887 Confirmed=X Filename=explore.exe Description=Added by any number of VIRUSES, WORMS or TROJANS! Source=Paul Collins Startup list [Explore] Number=2888 Confirmed=X Filename=Explorer.exe Description=Added by the IRC.FLOOD.G TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [Explore] Number=2889 Confirmed=X Filename=explore.exe Description=Adult content dialler Source=Paul Collins Startup list [explore manager] Number=2890 Confirmed=X Filename=explore.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [explore.exe] Number=2891 Confirmed=X Filename=Explore.exe Description=Added by the GRAYBIRD.G TROJAN! Source=Paul Collins Startup list [exploreff.exe] Number=2892 Confirmed=X Filename=exploreff.exe Description=Added by the FINFANSE TROJAN! Source=Paul Collins Startup list [explorer] Number=2893 Confirmed=U Filename=explorer.exe Description=Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL Source=Paul Collins Startup list [explorer] Number=2894 Confirmed=X Filename=wscript.exe [filename] Description=Sneaky way to start any VBS script. Many viruses use VBS files Source=Paul Collins Startup list [Explorer] Number=2895 Confirmed=X Filename=shellexpl.exe Description=Added by the SHELDOR TROJAN! Source=Paul Collins Startup list [explorer] Number=2896 Confirmed=X Filename=expl32.exe Description=Added by the RATSOU TROJAN! Source=Paul Collins Startup list [Explorer] Number=2897 Confirmed=X Filename=[path to worm] Description=Added by the AUTEX WORM! Source=Paul Collins Startup list [Explorer] Number=2898 Confirmed=X Filename=shellexp.exe Description=Added by a variant of the SHELDOR TROJAN! Source=Paul Collins Startup list [EXPLORER] Number=2899 Confirmed=X Filename=EXPL0RER.EXE Description=Added by the BEASTDO-Y TROJAN! Note the "0" in the filename rather than upper case "o" Source=Paul Collins Startup list [EXPLORER] Number=2900 Confirmed=X Filename=sys.exe Description=Added by the SILLYFDC-A TROJAN! Source=Paul Collins Startup list [Explorer] Number=2901 Confirmed=X Filename=config_.com Description=Added by the FLOPPY-D WORM! Source=Paul Collins Startup list [Explorer] Number=2902 Confirmed=X Filename=drv.exe Description=Added by the SMALL-FD TROJAN! Source=Paul Collins Startup list [explorer] Number=2903 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT-EU TROJAN! Source=Paul Collins Startup list [explorer] Number=2904 Confirmed=X Filename=explorer.exe Description=Added by the KEYLOG-AK TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a "service" subfolder of the System folder Source=Paul Collins Startup list [EXPLORER] Number=2905 Confirmed=X Filename=EXPLORER.exe Description=Added by the NETHIEF-P TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a "SHELLEXT" subfolder of the System folder Source=Paul Collins Startup list [explorer] Number=2906 Confirmed=X Filename=explorer.exe Description=Added by the BLOCKEY-A TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a "config" subfolder of the System folder Source=Paul Collins Startup list [explorer] Number=2907 Confirmed=X Filename=Yinstall.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Explorer] Number=2908 Confirmed=X Filename=Windows Explorer.exe Description=Added by the SILLYFDC-I WORM! Source=Paul Collins Startup list [Explorer Loader] Number=2909 Confirmed=X Filename=explr32.exe Description=Added by the AGOBOT.N WORM! Source=Paul Collins Startup list [Explorer Loader] Number=2910 Confirmed=X Filename=explorerl.exe Description=Added by the SDBOT-ADI WORM! Source=Paul Collins Startup list [Explorer lptt01] Number=2911 Confirmed=X Filename=explorer.exe Description=RapidBlaster variant (in a "explorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [EXPLORER MICROSOFT SYSTEM] Number=2912 Confirmed=X Filename=explore.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Explorer ml097e] Number=2913 Confirmed=X Filename=explorer.exe Description=RapidBlaster variant (in a "explorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [Explorer soft] Number=2914 Confirmed=X Filename=explorer.pif Description=Added by the RBOT-APK WORM! Source=Paul Collins Startup list [Explorer soft] Number=2915 Confirmed=X Filename=explorer.com Description=Added by the RBOT-ARM WORM! Source=Paul Collins Startup list [Explorer Updater] Number=2916 Confirmed=X Filename=IEXPLORE.exe Description=Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [explorer.exe] Number=2917 Confirmed=X Filename=explorer.exe Description=Added by the AGENT-EW or PWS-CY TROJANS! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [explorer.exe] Number=2918 Confirmed=X Filename=explorer.exe Description=Added by the DELF-ACL TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [Explorer32] Number=2919 Confirmed=X Filename=Expl32.exe Description=Added by the HACKTACK.B TROJAN! Source=Paul Collins Startup list [Explorer32] Number=2920 Confirmed=X Filename=explorer6s4.exe Description=Added by the Downloader.Win32.Small.biq TROJAN! Source=Paul Collins Startup list [Explorer32] Number=2921 Confirmed=X Filename=efsdfgxg.exe Description=Added by the CLICKER-Y TROJAN! Source=Paul Collins Startup list [ExploreUpdSched] Number=2922 Confirmed=X Filename=[random filename].exe Description=ZenoSearch adware Source=Paul Collins Startup list [exporet] Number=2923 Confirmed=X Filename=winset.exe Description=Added by the QQPASS-I TROJAN! Source=Paul Collins Startup list [Express ClickYes] Number=2924 Confirmed=U Filename=ClickYes.exe Description="Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt, that asks you to confirm mail sending from third party applications" Source=Paul Collins Startup list [Exshow95] Number=2925 Confirmed=U Filename=EXSHOW95.exe Description=Support software for some of the Kensington mice. Provides access to extra features like those available with enhanced Logitech and MS devices Source=Paul Collins Startup list [External Dependencies] Number=2926 Confirmed=X Filename=External.exe Description=Added by the MYTOB.EC WORM! Source=Paul Collins Startup list [ExtraDNS] Number=2927 Confirmed=U Filename=ExtraDNS.exe Description=ExtraDNS - DNS configuration tool Source=Paul Collins Startup list [Extranet AutoDial] Number=2928 Confirmed=? Filename=AutoExt.exe Description=Nortel Networks Contivity Extranet Switching Software Source=Paul Collins Startup list [ExxtremeHelperDemon] Number=2929 Confirmed=? Filename=exxdemon.exe Description=Creative Exxtreme graphics card related? Source=Paul Collins Startup list [Eye Tide Launcher] Number=2930 Confirmed=N Filename=oneeyetideone.exe Description=Nascar wallpaper Source=Paul Collins Startup list [EZ Firewall] Number=2931 Confirmed=Y Filename=ca.exe Description=eTrust EZ Armor Internet Security Source=Paul Collins Startup list [ezagent] Number=2932 Confirmed=N Filename=ezagent.exe Description=EzVCR recording software for the ASUS TV FM card. Available via Start -> Programs Source=Paul Collins Startup list [EzButton] Number=2933 Confirmed=N Filename=EzButton.EXE Description=EZbutton is a quick launcher for the Media player app that comes with certain laptops Source=Paul Collins Startup list [EZDesk] Number=2934 Confirmed=N Filename=EZDESK.EXE Description=Utility that remembers icon locations for each user and resolution. Available here Source=Paul Collins Startup list [EzEjMnAp] Number=2935 Confirmed=N Filename=EzEjMnAp.exe Description=For IBM Thinkpad Notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually". Available via Start -> Programs Source=Paul Collins Startup list [eZmmod] Number=2936 Confirmed=X Filename=mmod.exe Description=eZula TopText adware Source=Paul Collins Startup list [EZNORUN] Number=2937 Confirmed=? Filename=EZNORUN.EXE Description=Easy Internet related? Source=Paul Collins Startup list [EzPrint] Number=2938 Confirmed=N Filename=ezprint.exe Description=Configuration options for Lexmark printing devices Source=Paul Collins Startup list [ezPS_Px] Number=2939 Confirmed=Y Filename=ezSP_PxEngine.exe Description=Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Source=Paul Collins Startup list [ezPS_Px] Number=2940 Confirmed=Y Filename=ezSP_Px.exe Description=Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Source=Paul Collins Startup list [ezShieldProtector for Px] Number=2941 Confirmed=Y Filename=ezSP_Px.exe Description=Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Source=Paul Collins Startup list [ezShieldProtector for Px] Number=2942 Confirmed=Y Filename=ezSP_PxEngine.exe Description=Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Source=Paul Collins Startup list [EZSMART App] Number=2943 Confirmed=U Filename=ezsmart.exe Description=EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported Source=Paul Collins Startup list [ezula] Number=2944 Confirmed=X Filename=eZmmod.exe Description=eZula TopText adware Source=Paul Collins Startup list [eZulaMain] Number=2945 Confirmed=X Filename=eZulaMain.exe Description=eZula TopText adware Source=Paul Collins Startup list [eZuluMain] Number=2946 Confirmed=X Filename=eZuluMain.exe Description=Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work Source=Paul Collins Startup list [eZWO] Number=2947 Confirmed=X Filename=wo.exe Description=eZula TopText adware Source=Paul Collins Startup list [E_S10IC2] Number=2948 Confirmed=U Filename=E_S10IC2.exe Description=Epson Stylus C44 Series printer monitor - for checking ink levels, etc Source=Paul Collins Startup list [E_S23] Number=2949 Confirmed=U Filename=E_SICN03.exe Description=Epson printer status monitor - for checking ink levels, etc. Source=Paul Collins Startup list [E_S4I2F1] Number=2950 Confirmed=U Filename=E_S4I2F1.exe Description=Epson Status Monitor 3 for the Epson Stylus Photo R300 (and probably others) printers - monitors the status of ink levels, a print job spooled to that printer, etc Source=Paul Collins Startup list [E_S4I2G1] Number=2951 Confirmed=N Filename=E_S4I2G1.EXE Description=Epson Status Monitor 3 for the Epson Stylus CX5400 printer/scanner/copier (and probably others) - monitors the status of ink levels, a print job spooled to that printer, etc Source=Paul Collins Startup list [E_SOEIC1] Number=2952 Confirmed=U Filename=E_SOEIC1.exe Description=Epson Stylus printer monitor - for checking ink levels, etc. Source=Paul Collins Startup list [F-Secure 2005] Number=2953 Confirmed=X Filename=svchost.exe Description=Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [F-Secure 2006] Number=2954 Confirmed=Y Filename=fspex.exe Description=F-Secure Anti-Virus automatic updater Source=Paul Collins Startup list [F-Secure Management Agent] Number=2955 Confirmed=U Filename=FSMA32.EXE Description=F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products Source=Paul Collins Startup list [F-Secure Manager] Number=2956 Confirmed=Y Filename=FSM32.EXE Description=F-Secure antivirus - carry out scheduled virus scans automatically Source=Paul Collins Startup list [F-Secure Startup Wizard] Number=2957 Confirmed=Y Filename=FSSW.EXE Description=F-Secure antivirus Source=Paul Collins Startup list [F-Secure TNB] Number=2958 Confirmed=Y Filename=TNBUtil.exe Description=F-Secure antivirus Source=Paul Collins Startup list [F-StopW] Number=2959 Confirmed=Y Filename=F-StopW.exe Description=F-Prot anti-virus background scanner by F-Risk Software Source=Paul Collins Startup list [f1Tray.exe] Number=2960 Confirmed=U Filename=F1TRAY.EXE Description=System Tray icon for FusionOne's MightyPhone software. "MightyPhone is a concept for wirelessly synchronizing the data on your mobile phone with your web-based or PC based organizer" Source=Paul Collins Startup list [f607] Number=2961 Confirmed=X Filename=f607.exe Description=Added by the URAT.B TROJAN! Source=Paul Collins Startup list [f73cdc8ee94e] Number=2962 Confirmed=X Filename=btsendto.exe Description=Associated with mysearchnow.com/searchbar.html Source=Paul Collins Startup list [FamilyKeyLogger] Number=2963 Confirmed=U Filename=cisvc.exe Description=Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Fantasia injector] Number=2964 Confirmed=X Filename=wincfg.exe Description=Added by the AGOBOT.US WORM! Source=Paul Collins Startup list [fapmon] Number=2965 Confirmed=? Filename=fapmon.exe Description=Fair Access Policy monitor for DirecPC/DirecWay internet access Source=Paul Collins Startup list [farmmext] Number=2966 Confirmed=X Filename=farmmext.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [Fash] Number=2967 Confirmed=X Filename=Fash.exe Description=Unidentified adware Source=Paul Collins Startup list [fast] Number=2968 Confirmed=N Filename=fast.exe Description=Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys Source=Paul Collins Startup list [FAST Defrag] Number=2969 Confirmed=N Filename=FAST2.EXE Description=FastDefrag defragmenting software Source=Paul Collins Startup list [Fast Home] Number=2970 Confirmed=X Filename=svcnvt.exe Description=Recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Delf.ks This file may be found in the System folder on 9x machines, however as of this writing it has only been seen in the System32 folder Source=Paul Collins Startup list [Fast Search] Number=2971 Confirmed=X Filename=svcnv.exe Description=Homepage, Startpage hijacker. Possible variant of Trojan-Downloader.Win32.Delf Source=Paul Collins Startup list [Fast start] Number=2972 Confirmed=X Filename=Ntut.exe Description=Adware - recognized by Kaspersky antivirus as Trojan.Win32.Favadd.I Source=Paul Collins Startup list [Fast start] Number=2973 Confirmed=X Filename=svcnt.exe Description=Adware - recognized by Kaspersky antivirus as a variant of the FAVADD TROJAN! Source=Paul Collins Startup list [FastCache] Number=2974 Confirmed=U Filename=fc.exe Description=FastCache from AnalogX - speeds up browsing by resolving DNS requests locally Source=Paul Collins Startup list [FastStart] Number=2975 Confirmed=X Filename=ntnut32.exe Description=Added by the STARTPAGE.L TROJAN! Source=Paul Collins Startup list [FastStart] Number=2976 Confirmed=X Filename=svcnut.exe Description=Browser hijacker - a variant of the STARTPAGE.L TROJAN! Source=Paul Collins Startup list [FastStart] Number=2977 Confirmed=X Filename=svcnut32.exe Description=Browser hijacker - a variant of the STARTPAGE.L TROJAN! Source=Paul Collins Startup list [FastTrack Accelerator] Number=2978 Confirmed=N Filename=SPEED UP.EXE Description=FastTrack Accelerator - "speedup" utility for programs that use the FastTrack network such as KaZaA Media Desktop, Grokster and Morpheus Source=Paul Collins Startup list [FASTTRACKNETVISION] Number=2979 Confirmed=X Filename=NETVISION.exe Description=DialCar-Z premium rate dialer Source=Paul Collins Startup list [FastUser] Number=2980 Confirmed=N Filename=fast.exe Description=Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys Source=Paul Collins Startup list [FastUsr] Number=2981 Confirmed=N Filename=fast.exe Description=Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys Source=Paul Collins Startup list [FatPipe] Number=2982 Confirmed=U Filename=DHCP Description=Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users Source=Paul Collins Startup list [Fatpipe Dialer] Number=2983 Confirmed=U Filename=fpdialer.exe Description=Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users Source=Paul Collins Startup list [fatrecov] Number=2984 Confirmed=U Filename=fatrecov.exe Description=SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [FaxCenterServer] Number=2985 Confirmed=U Filename=fm3032.exe Description=FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark, MCI, Lotus, My Software, Broderbund, Traffic Software and many others Source=Paul Collins Startup list [FaxCtrl.exe] Number=2986 Confirmed=U Filename=ASMediaProxyServer.exe Description=Part of Avaya's Contact Center Express - "a multi-channel, high-volume software solution from Avaya designed specifically for the intelligent routing and computer telephony integration (CTI) needs of medium-sized contact centers" Source=Paul Collins Startup list [FaxTalk CallControl 6.0] Number=2987 Confirmed=N Filename=FTClCtrl.EXE Description=This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually Source=Paul Collins Startup list [FBDirect] Number=2988 Confirmed=U Filename=FBDirect.exe Description=Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs Source=Paul Collins Startup list [FBI] Number=2989 Confirmed=? Filename=FBISM.exe Description=Compaq related but what does it do? Source=Paul Collins Startup list [fc] Number=2990 Confirmed=X Filename=runfc.exe Description=Added by the CAMPURF WORM! Source=Paul Collins Startup list [FCEngine] Number=2991 Confirmed=X Filename=FCEngine.exe Description=CASClient adware Source=Paul Collins Startup list [FCHelp] Number=2992 Confirmed=X Filename=FCHelp.exe Description=Added by either FCHelp adware or a variant of it Source=Paul Collins Startup list [FCMan] Number=2993 Confirmed=X Filename=FCMan.exe Description=FCHelp adware Source=Paul Collins Startup list [FDD SYSTEM] Number=2994 Confirmed=X Filename=Fdd.exe Description=Added by the MYTOB-FO WORM! Source=Paul Collins Startup list [Fdr Command Module] Number=2995 Confirmed=X Filename=sp2.exe Description=Added by the SDBOT.WP WORM! Source=Paul Collins Startup list [FDriver] Number=2996 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [FD_SAP] Number=2997 Confirmed=U Filename=FD.exe Description=Reported to be the autopassword program from the Sony Microvault thumb drive Source=Paul Collins Startup list [feelalright] Number=2998 Confirmed=X Filename=mirc.exe Description=Added by the IRCFLOOD-M WORM! Source=Paul Collins Startup list [FEELitDeviceManager] Number=2999 Confirmed=U Filename=feelitdm.exe Description=Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals) Source=Paul Collins Startup list [fegoze] Number=3000 Confirmed=X Filename=SVCH0ST.EXE Description=Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [Fellowes Proxy] Number=3001 Confirmed=U Filename=R3proxy.exe Description=Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice Source=Paul Collins Startup list [Fen Startups] Number=3002 Confirmed=X Filename=fensvc32.exe Description=Added by the RANDEX.CCF WORM! Source=Paul Collins Startup list [FerrariWallPaper] Number=3003 Confirmed=U Filename=FerrariWP.exe Description=Calendar that replaces the default desktop background image. It comes with every Acer Ferrari 3000 laptop. Also downloadable for members of www.ferrari.com Source=Paul Collins Startup list [ffis] Number=3004 Confirmed=X Filename=ffisearch.exe Description=iSearch "Desktop Search" hijacker Source=Paul Collins Startup list [FG1_00] Number=3005 Confirmed=U Filename=frntgate.exe Description=FrontGate MX - e-mail spam blocker Source=Paul Collins Startup list [fGQEGqHOME] Number=3006 Confirmed=X Filename=gwwgtp.exe Description=Added by the RANKY.J TROJAN! Source=Paul Collins Startup list [FHPage] Number=3007 Confirmed=X Filename=shdochp.exe Description=Added by the DELF-Ks TROJAN! Source=Paul Collins Startup list [FHStart] Number=3008 Confirmed=X Filename=shdocsvc.exe Description=Added by the DELF-Ks TROJAN! Source=Paul Collins Startup list [Fhtisxk] Number=3009 Confirmed=U Filename=fhtisxk.exe Description=XtraKeys keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [FieldForms Sync] Number=3010 Confirmed=U Filename=SyncService.exe Description=Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run, on a wide range of mobile devices. Supports Microsoft Access databases, and provides for synchronization of other data as well Source=Paul Collins Startup list [FiendlyType] Number=3011 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [FILE] Number=3012 Confirmed=X Filename=abcdefg.exe Description=Added by the KELVIR.DD WORM! Source=Paul Collins Startup list [file indexing service] Number=3013 Confirmed=? Filename=msfindfile.exe Description=New version of MS FindFast and still a resource hog? Source=Paul Collins Startup list [file laoder configuration] Number=3014 Confirmed=X Filename=rnd32.exe Description=Added by the RBOT.BQJ WORM! Source=Paul Collins Startup list [File System] Number=3015 Confirmed=X Filename=taskmqrs.exe Description=Added by a variant of the TOXBOT/CODBOT WORM! Source=Paul Collins Startup list [File System] Number=3016 Confirmed=X Filename=taskmqr.exe Description=Added by the RBOT.BWQ WORM! Source=Paul Collins Startup list [File System Service] Number=3017 Confirmed=X Filename=wmiprvsc.exe Description=Added by the AGOBOT-HZ TROJAN! Source=Paul Collins Startup list [File0_0] Number=3018 Confirmed=X Filename=MD1.exe Description=Added by the DLOADER-OR TROJAN! Source=Paul Collins Startup list [File1] Number=3019 Confirmed=X Filename=Dia Claro.htm Description=Added by the DLOADER-OR TROJAN! Source=Paul Collins Startup list [FileFreedom_Plugin] Number=3020 Confirmed=X Filename=wtm.exe Description=FileFreedom peer-to-peer sharing program Source=Paul Collins Startup list [FileManager32] Number=3021 Confirmed=X Filename=Wscript.exe ..ChkMgr32.vbs Description=Added by the NOTUP.A WORM! Source=Paul Collins Startup list [FileSoft] Number=3022 Confirmed=X Filename=Wscript.exe UpdataFiles.vbs Description=Added by the SST.B WORM! Source=Paul Collins Startup list [FilmLoop] Number=3023 Confirmed=U Filename=FilmLoopService.exe Description=Related to FilmLoop - a photocasting network. Share your pictures with your family and friends Source=Paul Collins Startup list [FilterGate] Number=3024 Confirmed=U Filename=filtergate.exe Description=Filtergate internet filtering software - filters sounds, popup ads, background sound and other unnecessary website items Source=Paul Collins Startup list [Filterguard] Number=3025 Confirmed=U Filename=Filtrgrd.exe Description=An icon located in the lower left of the screen and looks like a lifesaver. This icon is a "short-cut" to access the basic features of SOS-Guardian, SOS-KidProof Lite, SOS Best Defense and SOS Pro such as Internet filtering utility. You can access this menu by "right-clicking" on the icon Source=Paul Collins Startup list [Find] Number=3026 Confirmed=X Filename=find.exe Description=Added by the OPANKI WORM! Source=Paul Collins Startup list [Find Fast] Number=3027 Confirmed=X Filename=Findfast.exe Description=Complete utter waste of space! Part of MS Office - searches disk drives for Office file types to make opening them easier Source=Paul Collins Startup list [Find Virus Launch Program] Number=3028 Confirmed=Y Filename=fvlaunch.exe Description=Part of Dr. Solomon's Antivirus Source=Paul Collins Startup list [FindHack] Number=3029 Confirmed=X Filename=[path to trojan] Description=Added by the KELVIR-BA TROJAN! Source=Paul Collins Startup list [FinePrint Dispatcher v4] Number=3030 Confirmed=U Filename=fpdisp4a.exe Description=FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. "FinePrint saves ink, paper, time and money by controlling and enhancing printed output" Source=Paul Collins Startup list [FinePrint Dispatcher v4] Number=3031 Confirmed=U Filename=fpdisp4.exe Description=FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. "FinePrint saves ink, paper, time and money by controlling and enhancing printed output" Source=Paul Collins Startup list [FinePrint Dispatcher v5] Number=3032 Confirmed=U Filename=fpdisp5a.exe Description=FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. "FinePrint saves ink, paper, time and money by controlling and enhancing printed output" Source=Paul Collins Startup list [FineReader7NewsReaderPro] Number=3033 Confirmed=N Filename=AbbyyNewsReader.exe Description=ABBYY FineReader OCR software - version 7 Source=Paul Collins Startup list [Fire Wall services] Number=3034 Confirmed=X Filename=[random filename] Description=Added by the IRCBOT-QY WORM! Source=Paul Collins Startup list [FireFox] Number=3035 Confirmed=X Filename=firefox.exe Description=Added by the RBOT-ATP WORM! Note - this is not the popular FireFox web browser and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [FireFox Service Drivers] Number=3036 Confirmed=X Filename=ssmss.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [FireFox Startup Drivers] Number=3037 Confirmed=X Filename=wuaclt.exe Description=Added by the RBOT.BYX WORM! Source=Paul Collins Startup list [firefox.exe] Number=3038 Confirmed=X Filename=firefox.exe Description=Added by the BANKER-EBO TROJAN! Note - this is not the popular FireFox web browser and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Firewall] Number=3039 Confirmed=X Filename= wmlaunch .exe Description=Added by the ELIPTER.A or ELIPTER.B WORMS! Source=Paul Collins Startup list [Firewall] Number=3040 Confirmed=X Filename=wmlaunch .exe Description=Added by the ELIPTER.D WORM! Source=Paul Collins Startup list [Firewall] Number=3041 Confirmed=X Filename=SP2 UPDATE.exe Description=Added by the ELITPER.E WORM! Source=Paul Collins Startup list [Firewall] Number=3042 Confirmed=X Filename=Firewall.bat Description=Added by the YPSAN.G WORM! Source=Paul Collins Startup list [firewall] Number=3043 Confirmed=X Filename=fw_304.exe Description=Added by the JQ TROJAN! Source=Paul Collins Startup list [Firewall auto setup] Number=3044 Confirmed=X Filename=winlogon.exe Description=Added by a TROJAN - see here. Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Firewall Policy] Number=3045 Confirmed=X Filename=MidiDef32.exe Description=Added by the PIEBOT-A TROJAN! Source=Paul Collins Startup list [Firewall Sp2 system] Number=3046 Confirmed=X Filename=sys32Conf.exe Description=Added by the Rbot-ABT WORM! Source=Paul Collins Startup list [Firewall Update System1] Number=3047 Confirmed=X Filename=WinedowsUpdater1.exe Description=Added by the RBOT-ARU WORM! Source=Paul Collins Startup list [Firewall Updater] Number=3048 Confirmed=X Filename=msnupdateit.exe Description=Added by the RBOT-AAQ WORM! Source=Paul Collins Startup list [Firewall.exe] Number=3049 Confirmed=X Filename=Firewall.exe Description=Added by the AGENT.AGL WORM! Source=Paul Collins Startup list [FirewallActivies] Number=3050 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "3041" subfolder Source=Paul Collins Startup list [FirewallStartup] Number=3051 Confirmed=U Filename=Firewallstartup.exe Description=Innovative Startup Firewall - "designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean, fast and in it's best shape" Source=Paul Collins Startup list [FirewallSvr] Number=3052 Confirmed=X Filename=FirewallSvr.exe Description=Added by the NETSKY.X or NETSKY.Y WORMS! Source=Paul Collins Startup list [firewall_anti] Number=3053 Confirmed=X Filename=firewall_anti.exe Description=Added by the NETDENY-B TROJAN! Source=Paul Collins Startup list [FireWire Driver] Number=3054 Confirmed=X Filename=samx.exe Description=Added by the SDBOT.AE WORM! Source=Paul Collins Startup list [FireWire Service] Number=3055 Confirmed=X Filename=nvscv32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [FireWire Services] Number=3056 Confirmed=X Filename=nvcsv32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [First Home Page] Number=3057 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [FIX] Number=3058 Confirmed=X Filename=WinFIX1.0.vbs Description=Added by the GORMLEZ-A WORM! Source=Paul Collins Startup list [Fix-it] Number=3059 Confirmed=Y Filename=mxtask.exe Description=Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard, intellicluster, anti-virus, or autoupdater. Otherwise not required Source=Paul Collins Startup list [Fix-it AV] Number=3060 Confirmed=Y Filename=memcheck.exe Description=Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources Source=Paul Collins Startup list [FjMenu] Number=3061 Confirmed=U Filename=FjMenu.exe Description=From the "Fujitsu Menu" tray icon you have instant access to the Control Panel, Tablet pc keyboard, Tablet and pen settings, Fujitsu display controls, brightness control, sounds and audio devices, capture screen, capture window, organize favorites, power options, printers and faxes, LCD brightness MIN, LCD brightness MAX, Enable/disable Button Panel and the Fujitsu menu settings, which are customizable Source=Paul Collins Startup list [FJTWAIN Setup] Number=3062 Confirmed=U Filename=FjtwSetup.exe Description=Fujitsu scanner utility Source=Paul Collins Startup list [FKS v2.0] Number=3063 Confirmed=X Filename=msngr.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [fkSysMon] Number=3064 Confirmed=N Filename=fksysmon.exe Description=fkWrae SysMon - system monitor - "displays the current memory consumption, CPU and resource usage, date, time, Windows uptime, IP address and a lot more" Source=Paul Collins Startup list [FlaCPY] Number=3065 Confirmed=X Filename=flacpy.exe Description=FlashEnhancer adware variant Source=Paul Collins Startup list [FLASH32] Number=3066 Confirmed=? Filename=-flash32.exe Description=?? Source=Paul Collins Startup list [FlashEnc] Number=3067 Confirmed=U Filename=FlashEnc.exe Description=Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission, which is a pain. No need for it if you do not want these features Source=Paul Collins Startup list [Flashget Download Manager] Number=3068 Confirmed=X Filename=Flashget.exe Description=Added by the RBOT-AGZ WORM! Source=Paul Collins Startup list [FlashPath Monitor] Number=3069 Confirmed=N Filename=SDSTAT.EXE Description=System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs Source=Paul Collins Startup list [FlashPath Monitor] Number=3070 Confirmed=N Filename=FLSHSTAT.EXE Description=System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs Source=Paul Collins Startup list [FlashPath Status] Number=3071 Confirmed=N Filename=SDSTAT.EXE Description=System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs Source=Paul Collins Startup list [FlashPath Status] Number=3072 Confirmed=N Filename=FLSHSTAT.EXE Description=System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs Source=Paul Collins Startup list [Flash_Player_Install] Number=3073 Confirmed=X Filename=ying.exe Description=Constructor VC2000 malware Source=Paul Collins Startup list [FlenCPY] Number=3074 Confirmed=X Filename=flencpy.exe Description=FlashEnhancer adware variant Source=Paul Collins Startup list [Flexicd] Number=3075 Confirmed=U Filename=Flexicd.exe Description=CD player - part of the Win95 Power Toys Source=Paul Collins Startup list [FLMK08KB] Number=3076 Confirmed=U Filename=MMKEYBD.EXE Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [FLMOFFICE4DMOUSE] Number=3077 Confirmed=U Filename=moffice.exe Description=Micro Innovations mouse management Source=Paul Collins Startup list [FLMOFFICE4DMOUSE] Number=3078 Confirmed=U Filename=mouse32a.exe Description=Micro Innovations mouse management Source=Paul Collins Startup list [FLMTRUSTKB] Number=3079 Confirmed=? Filename=KbdAp32A.exe Description=Keyboard utility for a Trust brand keyboard. What does it do and is it required? Source=Paul Collins Startup list [FLMTRUSTMOUSE] Number=3080 Confirmed=U Filename=mouse32a.exe Description=Mouse utility for a Trust brand mouse Source=Paul Collins Startup list [FlnCPY] Number=3081 Confirmed=X Filename=flncpy.exe Description=FlashEnhancer adware variant Source=Paul Collins Startup list [FLooDNeT] Number=3082 Confirmed=X Filename=FLooDeR.exe Description=Added by the ENDOOL TROJAN! Source=Paul Collins Startup list [Floppy Master] Number=3083 Confirmed=X Filename=[path to trojan] Description=Added by the ZONIT-F TROJAN! Source=Paul Collins Startup list [Flow Go TV] Number=3084 Confirmed=? Filename=flogotv.exe Description=?? Source=Paul Collins Startup list [flps] Number=3085 Confirmed=X Filename=flps.vbs Description=Added by the BYRON WORM! Source=Paul Collins Startup list [flpycntl] Number=3086 Confirmed=X Filename=flpycntl.exe Description=Added by the CRYPTER.C TROJAN! Source=Paul Collins Startup list [FLSVCI] Number=3087 Confirmed=? Filename=FLSVCI.exe Description=?? Source=Paul Collins Startup list [FltProcess] Number=3088 Confirmed=Y Filename=msinet.exe Description=Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done Source=Paul Collins Startup list [FlyswatDesktop] Number=3089 Confirmed=X Filename=flydesk.exe Description=Advertising spyware Source=Paul Collins Startup list [FmctrlTray] Number=3090 Confirmed=U Filename=Fmctrl.EXE Description=Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used) Source=Paul Collins Startup list [fmnwebassist] Number=3091 Confirmed=X Filename=fmnwebassist.exe Description=Adware popup generator Source=Paul Collins Startup list [FMStart] Number=3092 Confirmed=U Filename=Fmstart.exe Description=GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks, allows all users to send and receive faxes right from their desktop Source=Paul Collins Startup list [FMSZ] Number=3093 Confirmed=X Filename=fmsz.exe Description=Added by the FMSZ TROJAN! Source=Paul Collins Startup list [fnmwebassist] Number=3094 Confirmed=X Filename=fnmwebassist.exe Description=WinPL adware Source=Paul Collins Startup list [Focus] Number=3095 Confirmed=? Filename=Focus.exe Description=ISDN configuration wizard? Source=Paul Collins Startup list [Folder Service] Number=3096 Confirmed=X Filename=wssdtu.exe Description=Added by the MANIFEST TROJAN! Source=Paul Collins Startup list [Folder View] Number=3097 Confirmed=U Filename=folderview.exe Description=Folder View enhances the Windows file Explorer by making all folders you need available in a single click Source=Paul Collins Startup list [FolderClone v*.*.*] Number=3098 Confirmed=U Filename=folderclone.exe Description=Folderclone backup and synchronization software Source=Paul Collins Startup list [Folding@home] Number=3099 Confirmed=N Filename=WINFAH.EXE Description=Folding@Home is a distributed computing project which studies protein folding, misfolding, aggregation, and related diseases - must be running in order to access the internet to upload to the servers. Available via Start -> Programs Source=Paul Collins Startup list [FoneSyncSystemTray] Number=3100 Confirmed=N Filename=FoneSyncSystemTray.exe Description=System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required Source=Paul Collins Startup list [FontFix] Number=3101 Confirmed=X Filename=fontfix.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [fontnav] Number=3102 Confirmed=N Filename=FontNav.exe Description=Font Navigator from Bitstream Inc. - a font management utility Source=Paul Collins Startup list [FontsLoader] Number=3103 Confirmed=X Filename=ldfnt32.hta Description=Unidentified malware Source=Paul Collins Startup list [FONTVIEW] Number=3104 Confirmed=X Filename=FONTVIEW.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [FooBar 1.0] Number=3105 Confirmed=U Filename=FooBar.exe Description=FooBar - "combines fifteen high-quality productivity tools in a single toolbar that floats on your desktop or runs in the Windows task bar" Source=Paul Collins Startup list [foobin lptt01] Number=3106 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "foo1" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [foobin ml097e] Number=3107 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "foo1" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [FoolProof] Number=3108 Confirmed=Y Filename=fpwinldr.exe Description=FoolProof Security PC security software from SmartStuff Source=Paul Collins Startup list [FoolProofSweep] Number=3109 Confirmed=Y Filename=?? Description=Part of FoolProof Security PC security software from SmartStuff Source=Paul Collins Startup list [Forbes] Number=3110 Confirmed=N Filename=ForbesAlerts.exe Description=Forbes Business News Alerts - displays business news headlines in a little window on the screen Source=Paul Collins Startup list [ForceShow] Number=3111 Confirmed=X Filename=rundll32.exe QaBar.dll, ForceShowBar Description=AdultLinks.QBar parasite related Source=Paul Collins Startup list [Forget Me Not] Number=3112 Confirmed=N Filename=AGRemind.exe Description=Calendar reminder part of Broderbund's American Greetings� CreataCard� Source=Paul Collins Startup list [FortiClient] Number=3113 Confirmed=X Filename=FortiClient.exe Description=Fortinet security systems are the new generation of real time network protection systems Source=Paul Collins Startup list [Fortis Secure Layer Config] Number=3114 Confirmed=U Filename=cseinst.exe Description=Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information Source=Paul Collins Startup list [FotoStation Easy AutoLaunch] Number=3115 Confirmed=N Filename=FotoStation Easy AutoLaunch.exe Description=Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either Source=Paul Collins Startup list [Foul PX] Number=3116 Confirmed=U Filename=FoulPX.exe Description=Foul PX, Optusnet usage stat checker Source=Paul Collins Startup list [FourthDay] Number=3117 Confirmed=U Filename=FourthDay.exe Description=The Fourth Day - "astronomical clock and almanac for your system tray" Source=Paul Collins Startup list [foxdh] Number=3118 Confirmed=X Filename=foxdhend.exe Description=Added by the MENGHUAN TROJAN! Source=Paul Collins Startup list [foxdh] Number=3119 Confirmed=X Filename=foxdh.exe Description=Added by the GWGHOST-Q TROJAN! Source=Paul Collins Startup list [foxrxjh] Number=3120 Confirmed=X Filename=foxrxjh.exe Description=Added by the GWGHOST-T TROJAN! Source=Paul Collins Startup list [foxwudy9912] Number=3121 Confirmed=X Filename=service.exe Description=Added by the BANCOS-BT TROJAN! Source=Paul Collins Startup list [FP Loader] Number=3122 Confirmed=Y Filename=loadfp.exe Description=FoolProof Security - PC security software from SmartStuff Source=Paul Collins Startup list [FPWGMWZD] Number=3123 Confirmed=? Filename=FPWGMWZD.exe Description=?? Source=Paul Collins Startup list [Fpx] Number=3124 Confirmed=N Filename=mnmsrvc.exe Description=Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations Source=Paul Collins Startup list [fqor] Number=3125 Confirmed=X Filename=stub_113_4_0_4_0.exe Description=TargetSaver adware Source=Paul Collins Startup list [FrameWork 2.5] Number=3126 Confirmed=X Filename=FrameWork.exe Description=Added by the RBOT-FMW WORM! Note - can terminate AV related processes Source=Paul Collins Startup list [France] Number=3127 Confirmed=X Filename=svchost.exe Description=Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Fraps] Number=3128 Confirmed=U Filename=fraps.exe Description=Fraps Real-Time Video Capture software Source=Paul Collins Startup list [Free Download Manager] Number=3129 Confirmed=N Filename=fdm.exe Description="Free Download Manager" - see here Source=Paul Collins Startup list [Free Downloads Monitor] Number=3130 Confirmed=? Filename=fdcmon.exe Description=?? Source=Paul Collins Startup list [Free Ram Optimizer] Number=3131 Confirmed=U Filename=fro.exe Description=Free Ram Optimizer monitors your memory, and frees up ram if it falls below a certain minimum. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own mind Source=Paul Collins Startup list [Freedom] Number=3132 Confirmed=Y Filename=Freedom.exe Description=Freedom Internet Security & Privacy - anti-virus, personal firewall and parental control. It also blocks ads, safeguards your personal information, encrypts your passwords, and much more. No longer available for sale Source=Paul Collins Startup list [FreeMem Pro] Number=3133 Confirmed=U Filename=FMEMPRO.EXE Description=FreeMem Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [FreeMemVn2] Number=3134 Confirmed=U Filename=FreeMem.exe Description=FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [FreeMP3download] Number=3135 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [FreeRAM XP] Number=3136 Confirmed=U Filename=FreeRAM XP Pro *.exe Description=FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [freestyle] Number=3137 Confirmed=X Filename=lockx.exe Description=Added by the RBOT-ATH WORM! Source=Paul Collins Startup list [freesurfer] Number=3138 Confirmed=U Filename=fs20.exe Description=EMS Free Surfer mk II - pop-up stopper Source=Paul Collins Startup list [freexstyle] Number=3139 Confirmed=X Filename=lockbar.exe Description=Added by the LOXBOT.D WORM! Source=Paul Collins Startup list [freexstyle] Number=3140 Confirmed=X Filename=lockbr.exe Description=Added by the LOXBOT.C WORM! Source=Paul Collins Startup list [Fresh Desktop] Number=3141 Confirmed=U Filename=freshdesktop.exe Description=Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals Source=Paul Collins Startup list [freshclam] Number=3142 Confirmed=N Filename=freshclam.exe Description=Auto update agent of the open source Clamwin virus scanner Source=Paul Collins Startup list [frguk] Number=3143 Confirmed=? Filename=shdrkmck.exe Description=?? Source=Paul Collins Startup list [FridaysInHellInstaller] Number=3144 Confirmed=? Filename=FridaysInHellInstaller.exe Description=?? Source=Paul Collins Startup list [FriendlyType] Number=3145 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [FriendlyTypeName] Number=3146 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [FriendlyTypeName] Number=3147 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [FriendlyWebQuick-Launch] Number=3148 Confirmed=N Filename=SELFCERT.EXE Description=selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well Source=Paul Collins Startup list [FRISK FP-Scheduler] Number=3149 Confirmed=U Filename=F-Sched.exe Description=Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis Source=Paul Collins Startup list [FRITZ!DSL Startcenter] Number=3150 Confirmed=? Filename=StCenter.exe Description=FRITZ! ISP software "StartCenter" User interface that allows you to manage, tweak and diagnose many aspects of your internet connection - is it required? Source=Paul Collins Startup list [FRITZ!webProtect] Number=3151 Confirmed=U Filename=FwebProt.exe Description=Firewall included in FRITZ! ISP DSL software Source=Paul Collins Startup list [Fromine WinPopup] Number=3152 Confirmed=N Filename=winpopup.exe Description=Instant Messenger program Source=Paul Collins Startup list [Frsk] Number=3153 Confirmed=X Filename=frsk.exe Description=Unidentified adware downloader trojan Source=Paul Collins Startup list [FRW_EXE] Number=3154 Confirmed=Y Filename=FRW.EXE Description=ConSeal Signal9 firewall - now McAfee Personal firewall Source=Paul Collins Startup list [frxmxins] Number=3155 Confirmed=Y Filename=frxmxins.exe Description=ATI 3D Studio MAX/VIZ driver Source=Paul Collins Startup list [FS Agent] Number=3156 Confirmed=X Filename=fagent.exe Description=Added by the VOLVER-B TROJAN! Source=Paul Collins Startup list [FS6519] Number=3157 Confirmed=X Filename=FS6519.dll.vbs Description=Added by the SOLOW.B WORM! Source=Paul Collins Startup list [fsaa] Number=3158 Confirmed=Y Filename=fsaa.exe Description=F-Secure antivirus Authentication Agent - creates and stores private keys used by a client to access servers Source=Paul Collins Startup list [FSCBoss] Number=3159 Confirmed=N Filename=FSCBoss.exe Description=Free Store Club shop online software Source=Paul Collins Startup list [FSDPSRV] Number=3160 Confirmed=? Filename=FSDPSRV.exe Description=?? Source=Paul Collins Startup list [FSH] Number=3161 Confirmed=X Filename=svcnva.exe Description=Malware, detected by Ewido Security Suite as TrojanDownloader.Delf.ks Source=Paul Collins Startup list [fsp] Number=3162 Confirmed=U Filename=fsp.exe Description=Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents Source=Paul Collins Startup list [fspr] Number=3163 Confirmed=Y Filename=FolderShield.exe Description=Folder Shield - hide personal files and folders Source=Paul Collins Startup list [FSScrCtl] Number=3164 Confirmed=N Filename=FSScrCtl.exe Description=Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver" Source=Paul Collins Startup list [fsserv] Number=3165 Confirmed=U Filename=fserv.exe Description=Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time Source=Paul Collins Startup list [FSW] Number=3166 Confirmed=X Filename=FSW.exe Description=FreeScratchAndWin parasite Source=Paul Collins Startup list [FSWebServer] Number=3167 Confirmed=U Filename=fsws.exe Description=Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services Source=Paul Collins Startup list [FtkCPY] Number=3168 Confirmed=X Filename=ftkcpy.exe Description=FlashEnhancer adware variant Source=Paul Collins Startup list [FtLnSOP_setup] Number=3169 Confirmed=U Filename=FtLnSOP.exe Description=Fujitsu scanner utility Source=Paul Collins Startup list [FTMSFLT(USB)] Number=3170 Confirmed=U Filename=FTMSFLTU.EXE Description=Fujitsu's Touch Panel Message Notifier Source=Paul Collins Startup list [FTP FOR WINDOWS] Number=3171 Confirmed=X Filename=ftpwin32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [FTPGraber] Number=3172 Confirmed=X Filename=FTPGraber.exe Description=Added by the DLOADER-DT TROJAN! Source=Paul Collins Startup list [FTPManager] Number=3173 Confirmed=N Filename=FTPDM.exe Description="Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another, remote computer system connected via a modem and telephone lines or by a local-area network (with upload transfer resume and download transfer resume)". Can be started manually Source=Paul Collins Startup list [Ftpqueue] Number=3174 Confirmed=U Filename=Ftpsched.exe Description=Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers Source=Paul Collins Startup list [ftutil2] Number=3175 Confirmed=U Filename=rundll32.exe [path] ftutil2.dll, SetWriteCacheMode Description=Related to Promise Technology's FastTrak SX4030/4060 PCI ATA Raid 5 controller (and possibly others) Source=Paul Collins Startup list [Fucker] Number=3176 Confirmed=X Filename=fucker.vbs Description=Added by the CATCHER-A WORM! Source=Paul Collins Startup list [Fujitsu Menu] Number=3177 Confirmed=U Filename=FjMnuIco.exe Description=From the "Fujitsu Menu" tray icon you have instant access to the Control Panel, Tablet pc keyboard, Tablet and pen settings, Fujitsu display controls, brightness control, sounds and audio devices, capture screen, capture window, organize favorites, power options, printers and faxes, LCD brightness MIN, LCD brightness MAX, Enable/disable Button Panel and the Fujitsu menu settings, which are customizable Source=Paul Collins Startup list [fukerservice] Number=3178 Confirmed=X Filename=fukerz.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [FUKLBAR] Number=3179 Confirmed=X Filename=bar.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [FusionHdtvTray] Number=3180 Confirmed=U Filename=FusionHdtvTray.exe Description=FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software Source=Paul Collins Startup list [FusionRC] Number=3181 Confirmed=U Filename=FusionRC.exe Description=Remote control manager for DVICO FusionHDTV Source=Paul Collins Startup list [FusionRemote] Number=3182 Confirmed=U Filename=FusionRc.exe Description=Remote control manager for DVICO FusionHDTV Source=Paul Collins Startup list [FusionTrayAgent] Number=3183 Confirmed=N Filename=FusionHdtvTray.exe Description=FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software Source=Paul Collins Startup list [fvek] Number=3184 Confirmed=X Filename=fvek.exe Description=Added by the DRIVOL-A TROJAN! Source=Paul Collins Startup list [FW Manager] Number=3185 Confirmed=X Filename=fwcheck.exe Description=Added by the DELBOT-H WORM! Source=Paul Collins Startup list [FWDMON.EXE] Number=3186 Confirmed=X Filename=fwdmon.exe Description=Added by the PROXY-S TROJAN! Source=Paul Collins Startup list [fwenc.exe] Number=3187 Confirmed=Y Filename=fwenc.exe Description=Check Point SecuRemote VPN client - "dynamic and fixed IP addressing for all ISP services - dial-up, cable modem, or DSL - the ideal solution for telecommuters and mobile workers" Source=Paul Collins Startup list [Fwr Command Module] Number=3188 Confirmed=X Filename=fwr.exe Description=Added by the SDBOT-PP WORM! Source=Paul Collins Startup list [fwrastrc] Number=3189 Confirmed=N Filename=fwrastrc.exe Description=Dial-up software for Friendly Technologies/1NationOnLine free ISP Source=Paul Collins Startup list [fwservice] Number=3190 Confirmed=U Filename=fwservice Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [FX] Number=3191 Confirmed=X Filename=ieloader.exe Description=Added by the SMALL.RR TROJAN! Source=Paul Collins Startup list [fxredir] Number=3192 Confirmed=U Filename=fxredir.exe Description=Canon MultiPASS fax redirector Source=Paul Collins Startup list [fzg] Number=3193 Confirmed=X Filename=svhost32.exe Description=Added by the DLOADER.BDK TROJAN! Source=Paul Collins Startup list [f~a] Number=3194 Confirmed=X Filename=ra32.exe Description=Added by the CAY TROJAN! Source=Paul Collins Startup list [g.exe] Number=3195 Confirmed=X Filename=g.exe Description=Added by the GRAYBIRD.Q TROJAN! Source=Paul Collins Startup list [G00123] Number=3196 Confirmed=X Filename=[worm filename] Description=Added by the BUGBROS WORM! Source=Paul Collins Startup list [G0mez] Number=3197 Confirmed=X Filename=G0mez.vbs Description=Added by the GORMLEZ-A WORM! Source=Paul Collins Startup list [G3] Number=3198 Confirmed=X Filename=GSMedia3.exe Description=Malware downloader - recognized by Kaspersky antivirus as Trojan.Win32.VB.ux Source=Paul Collins Startup list [g3dctl] Number=3199 Confirmed=? Filename=g3dctl.exe Description=?? Source=Paul Collins Startup list [Gadu-Gadu] Number=3200 Confirmed=N Filename=gg.exe Description=Polish language Instant Messaging client Source=Paul Collins Startup list [Gadwin PrintScreen] Number=3201 Confirmed=N Filename=PrintScreen.exe Description=Gadwin PrintScreen - utility to capture, print or save the current window Source=Paul Collins Startup list [GAELICUM.EXE] Number=3202 Confirmed=X Filename=GAELICUM.EXE Description=Added by the PENTA-A TROJAN! Source=Paul Collins Startup list [gah95on6] Number=3203 Confirmed=X Filename=gah95on6.exe Description=ShopAtHome/SAHagent adware Source=Paul Collins Startup list [gaim] Number=3204 Confirmed=U Filename=gaim.exe Description=Gaim is an instant messenger client with capability to connect to AIM, ICQ, MSN Messenger, Yahoo, IRC, Jabber, Gadu-Gadu and Zephyr networks Source=Paul Collins Startup list [Gainward] Number=3205 Confirmed=U Filename=TBPanel.exe Description=Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [game] Number=3206 Confirmed=X Filename=shit.exe Description=Added by the Netclap Gold backdoor TROJAN! Source=Paul Collins Startup list [Game Device] Number=3207 Confirmed=N Filename=JOYUPDRV.EXE Description=Genius game controller profile activator Source=Paul Collins Startup list [Game House] Number=3208 Confirmed=X Filename=GameHouse.exe Description=Added by the DELF-DRA WORM! Source=Paul Collins Startup list [GameDrive] Number=3209 Confirmed=N Filename=GDTask.exe Description=GameDrive Virtual Driver from FarStone Technology, Inc. Run PC games without the disc Source=Paul Collins Startup list [Games Acceleration] Number=3210 Confirmed=X Filename=svshost.exe Description=EasySearch adware Source=Paul Collins Startup list [Games Acceleration] Number=3211 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Games Acceleration] Number=3212 Confirmed=X Filename=svshost1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Games toolbar] Number=3213 Confirmed=X Filename=rundll32.exe [path] tbGame.dll, DllShowTB Description=Topconverting.com\180Search "Games Toolbar" adware Source=Paul Collins Startup list [GameSpot] Number=3214 Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [gameutil.exe] Number=3215 Confirmed=U Filename=gameutil.exe Description=Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot Source=Paul Collins Startup list [GammaHotKeys] Number=3216 Confirmed=U Filename=setgamma.exe Description=Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop Source=Paul Collins Startup list [gaSrv] Number=3217 Confirmed=X Filename=gaSrv.exe Description=Adware downloader, identified by Panda antivirus as Trojan.Downloader.ALQ Source=Paul Collins Startup list [gaSrve] Number=3218 Confirmed=X Filename=gaSrve.exe Description=Adware downloader, identified by Panda antivirus as Trojan.Downloader.ALQ Source=Paul Collins Startup list [Gate Personal Firewall] Number=3219 Confirmed=X Filename=Systpl.exe Description=Added by the RBOT.ADC WORM Source=Paul Collins Startup list [Gateway Extended Warranty] Number=3220 Confirmed=N Filename=GWCares.exe Description=Gateway Extended Warranty reminder Source=Paul Collins Startup list [Gator] Number=3221 Confirmed=X Filename=gator.exe Description=Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [Gator eWallet] Number=3222 Confirmed=X Filename=gator.exe Description=Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [Gay_Sexy_**] Number=3223 Confirmed=X Filename=Gay_Sexy_**.exe Description=Premium rate adult content dialler (where * is a random char) Source=Paul Collins Startup list [GazelDisplay] Number=3224 Confirmed=U Filename=gsyno.exe Description=BT Digital Access USB - Gazel ISDN installation System Tray icon Source=Paul Collins Startup list [GBSpaceMan] Number=3225 Confirmed=Y Filename=SpaceMan.exe Description=GreenBorder - secure your browsing activities on the internet Source=Paul Collins Startup list [GBTray] Number=3226 Confirmed=U Filename=GBTray.exe Description=System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [gCac] Number=3227 Confirmed=X Filename=gcac.exe Description=Added by the TACTSLAY.U TROJAN! Source=Paul Collins Startup list [gcasDtServ] Number=3228 Confirmed=X Filename=gcasDtServ.exe Description=Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup Source=Paul Collins Startup list [gcasServ] Number=3229 Confirmed=U Filename=gcasServ.exe Description=Giant Antipsyware - now superseeded by Microsoft Windows AntiSpyware Source=Paul Collins Startup list [gcasServ] Number=3230 Confirmed=X Filename=realsched.exe Description=Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Source=Paul Collins Startup list [GCC Reminder] Number=3231 Confirmed=? Filename=gccrem.exe Description=Associated with AcraMax Greeting Card Creator. Is it a registration reminder? Source=Paul Collins Startup list [GCS] Number=3232 Confirmed=N Filename=GrabClipSave.exe Description=GrabClipSave screen capture tool Source=Paul Collins Startup list [GDAX] Number=3233 Confirmed=X Filename=[path to backdoor] Description=Added by the RANKY.K TROJAN! Source=Paul Collins Startup list [gdien32] Number=3234 Confirmed=X Filename=gdien32.exe Description=Added by the SINGU-P TROJAN! Source=Paul Collins Startup list [gdimx] Number=3235 Confirmed=X Filename=gdimx.exe Description=MPB-D dialer. Note - provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "gdimx" Source=Paul Collins Startup list [GDMgr.exe] Number=3236 Confirmed=U Filename=gdmgr.exe Description=GuardMon is a commercial surveillance software program designed to monitor all forms of user activity on a computer Source=Paul Collins Startup list [GDrive] Number=3237 Confirmed=N Filename=GDriver.exe Description=Found on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager Source=Paul Collins Startup list [Gearbox] Number=3238 Confirmed=N Filename=confsvr.exe Description=NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here Source=Paul Collins Startup list [GEARsec] Number=3239 Confirmed=N Filename=gearsec.exe Description=Installed by Apple Quicktime package - iPod/iTunes CDRW support. Can be disabled if you only require Quicktime player Source=Paul Collins Startup list [GEDZAC] Number=3240 Confirmed=X Filename=GEDZAC.exe Description=Added by the GEMEL WORM! Source=Paul Collins Startup list [GemStRmW] Number=3241 Confirmed=N Filename=GemStRmW.exe Description=For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card, start it manually Source=Paul Collins Startup list [Gene USB Monitor] Number=3242 Confirmed=U Filename=USBMonit.exe Description=Monitors USB ports for insertion of Sandisk USB flashdrives Source=Paul Collins Startup list [general lptt01] Number=3243 Confirmed=X Filename=general.exe Description=RapidBlaster variant (in a "General" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [general ml097e] Number=3244 Confirmed=X Filename=general.exe Description=RapidBlaster variant (in a "General" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Generic host proccess for windows] Number=3245 Confirmed=X Filename=SVCHOSTS.EXE Description=Added by the SPYBOT-GQ WORM! Source=Paul Collins Startup list [Generic Host Process] Number=3246 Confirmed=X Filename=SCHOST.EXE Description=Added by the RBOT-NC WORM! Source=Paul Collins Startup list [Generic Host Process] Number=3247 Confirmed=X Filename=svchost.exe Description=Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Generic Host Process for Win32 Service] Number=3248 Confirmed=X Filename=svlhost.exe Description=Added by the WOOTBOT.EX WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Service] Number=3249 Confirmed=X Filename=svchost.exe Description=Added by the SPYBOT.NC WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3250 Confirmed=X Filename=ntspcv.exe Description=Added by the SDBOT.S TROJAN! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3251 Confirmed=X Filename=intspvc.exe Description=Added by the DINFOR.D WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3252 Confirmed=X Filename=winsvc.exe Description=Added by the SDBOT-O WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3253 Confirmed=X Filename=bazzi.exe Description=Added by the AHKER.E WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3254 Confirmed=X Filename=winsvc32.exe Description=Added by the SDBOT-P WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3255 Confirmed=X Filename=lspsvc.exe Description=Added by the MUMU.C WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3256 Confirmed=X Filename=SPSVC.EXE Description=Added by the SDBOT.DA WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3257 Confirmed=X Filename=svchost32.exe Description=Added by the AGOBOT.ALH WORM! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Number=3258 Confirmed=X Filename=sv�h�st.exe Description=Added by the DLOADER.AK TROJAN! Source=Paul Collins Startup list [Generic Host Process2 System Backup] Number=3259 Confirmed=X Filename=scvhost2.exe Description=Added by the RBOT-BAH WORM! Source=Paul Collins Startup list [Generic Host Process326a System Backup] Number=3260 Confirmed=X Filename=scvhost326a.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Generic Host Service] Number=3261 Confirmed=X Filename=lshost.exe Description=Added by the RBOT.LU WORM! Source=Paul Collins Startup list [Generic Service Process] Number=3262 Confirmed=X Filename=regsvc32.exe Description=Added by the GAOBOT.UJ or GAOBOT.UL WORMS! Source=Paul Collins Startup list [Generic Service Process] Number=3263 Confirmed=X Filename=serv1ces.exe Description=Added by the AGOBOT-JK WORM! Source=Paul Collins Startup list [Generic Service Process] Number=3264 Confirmed=X Filename=nvsvc.exe Description=Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Generic Services Process] Number=3265 Confirmed=X Filename=regsvc32.exe Description=Added by the GAOBOT.SY WORM! Source=Paul Collins Startup list [GenericHostXP] Number=3266 Confirmed=X Filename=WinLoaderXP.exe Description=Added by the BDOOR-ACX TROJAN! Source=Paul Collins Startup list [Genie USB Monitor] Number=3267 Confirmed=Y Filename=USBmonitor.exe Description=Port monitor for an external USB hard drive. Required to enable access to the drive Source=Paul Collins Startup list [Geography TX 1.0 NT] Number=3268 Confirmed=X Filename=CompuSpeed.vbs Description=Added by the NEWLEY-A WORM! Source=Paul Collins Startup list [Gerenciamento de arquivos do Windows] Number=3269 Confirmed=X Filename=Winmod32.exe Description=Added by the DLOADER-WG TROJAN! Source=Paul Collins Startup list [german.exe] Number=3270 Confirmed=X Filename=winsystems.exe Description=Added by the BAGLEDl-AE TROJAN! Source=Paul Collins Startup list [german.exe] Number=3271 Confirmed=X Filename=wintems.exe Description=Added by the BAGLE-AS TROJAN! Source=Paul Collins Startup list [Gestionnaire de disques universel] Number=3272 Confirmed=X Filename=sysoobe.exe Description=Added by the TOADER-A TROJAN! Source=Paul Collins Startup list [Get Smile] Number=3273 Confirmed=N Filename=getsmile.exe Description=Puts smilie faces in your E-mail. Run manually when required Source=Paul Collins Startup list [GetRight Tray Icon] Number=3274 Confirmed=N Filename=GETRIGHT.EXE Description=GetRight from Headlight Software - download manager for resuming downloads and choosing multiple download locations. The freeware version is/was spyware. The registered version isn't if you don't install the Aureate/Radiate software. Available via Start -> Programs Source=Paul Collins Startup list [GetTheMusic] Number=3275 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [getwin] Number=3276 Confirmed=X Filename=winB_.exe Description=Added by the BANKER-HS TROJAN! Source=Paul Collins Startup list [GhostSecuritySuite] Number=3277 Confirmed=U Filename=gss.exe Description=Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools Source=Paul Collins Startup list [GhostStartService] Number=3278 Confirmed=N Filename=GhostStartService.exe Description=Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard Source=Paul Collins Startup list [GhostStartTrayApp] Number=3279 Confirmed=N Filename=GhostStartTrayApp.exe Description=System Tray access to Norton Ghost - added from the 2003 version Source=Paul Collins Startup list [GhostSurfDelSatellite] Number=3280 Confirmed=? Filename=DeleteSatellite.exe Description=SpyCatcher spyware remover related. What does it do and is it required? Source=Paul Collins Startup list [GhostSurfDelSatellite] Number=3281 Confirmed=Y Filename=DeleteSatellite.exe Description=Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning, you'll want to leave this file in place Source=Paul Collins Startup list [gigabit.exe] Number=3282 Confirmed=X Filename=gigabit.exe Description=Added by the BEAGLE.U WORM! Source=Paul Collins Startup list [GigaByte] Number=3283 Confirmed=X Filename=Cheatle.exe Description=Added by the SHODI.B VIRUS! Source=Paul Collins Startup list [Gilat SOM Enumerator] Number=3284 Confirmed=Y Filename=dllhost.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [GilatFTC] Number=3285 Confirmed=Y Filename=ftc.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [gimmygames] Number=3286 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADR-LN TROJAN! Source=Paul Collins Startup list [gimmysmileys] Number=3287 Confirmed=X Filename=gimmysmileys.exe Description=GimmySmileys adware Source=Paul Collins Startup list [GinaDll] Number=3288 Confirmed=X Filename=ntgina.dll Description=Added by the ANIG.A WORM! Source=Paul Collins Startup list [GisdnLog] Number=3289 Confirmed=? Filename=gisdnlog.exe Description=BT Digital Access USB Source=Paul Collins Startup list [Glass2k] Number=3290 Confirmed=U Filename=Glass2k.exe Description="Glass2k is a small little program that allows Win2K/XP users to make any window transparent" Source=Paul Collins Startup list [GLF Network Lan Monitor] Number=3291 Confirmed=X Filename=NPFMNTOR.exe Description=Added by the RBOT-AGY WORM! Source=Paul Collins Startup list [Glide] Number=3292 Confirmed=Y Filename=Glidew32.exe Description=Cirque touchpad driver Source=Paul Collins Startup list [Global Startup] Number=3293 Confirmed=X Filename=WinDash.EXE Description=Recognized by Kaspersky antivirus as IM-Worm.Win32.VB.q, may be related to the ATTECH-C WORM Source=Paul Collins Startup list [GlobalSCAPE] Number=3294 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AYM WORM! Source=Paul Collins Startup list [GLSetIT32] Number=3295 Confirmed=X Filename=msiexec16.exe Description=Added by the OPTIX PRO TROJAN! Source=Paul Collins Startup list [GLSetIT32] Number=3296 Confirmed=X Filename=isass.exe Description=Added by a variant of the OPTIX PRO TROJAN! Source=Paul Collins Startup list [GLSetT32] Number=3297 Confirmed=X Filename=smsiexec.exe Description=Added by the OPTIX-D TROJAN! Source=Paul Collins Startup list [gluon] Number=3298 Confirmed=? Filename=gluon.exe Description=In a gluon/bin sub-directory Source=Paul Collins Startup list [glv] Number=3299 Confirmed=X Filename=glv.exe Description=Added by the DLOADER-NG TROJAN! Source=Paul Collins Startup list [GMedia2] Number=3300 Confirmed=X Filename=GSM2.exe Description=Malware downloader - recognized by Kaspersky antivirus as Trojan.Win32.VB.ux Source=Paul Collins Startup list [GMedia2] Number=3301 Confirmed=X Filename=GSMedia3.exe Description=Malware downloader - recognized by Kaspersky antivirus as Trojan.Win32.VB.ux Source=Paul Collins Startup list [Gmouse] Number=3302 Confirmed=Y Filename=Gmouse.exe Description=Amouse mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Gnetmous] Number=3303 Confirmed=U Filename=gnetmous.exe Description=Genius NetScroll+ mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [GNETMOUSE] Number=3304 Confirmed=U Filename=gnetmouse.exe Description=Genius mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [GNP Generic Host Process] Number=3305 Confirmed=X Filename=svchost.exe Description=Added by the ZAPCHAS TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [GNP Generic Host Process] Number=3306 Confirmed=X Filename=svchost.exe Description=Added by the ZAPCHAS-R TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup and is always located in the System32 folder. This worm file is found in the System folder Source=Paul Collins Startup list [GNP Generic Host Process] Number=3307 Confirmed=X Filename=svchost.exe Description=Added by the ZAPCHAS-AA TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This one replaces svchost.exe in the System32 folder with a copy of Mirc on (NT/2K/XP) systems and just adds svchost.exe to the System folder on (9x/Me) systems Source=Paul Collins Startup list [gnub] Number=3308 Confirmed=? Filename=gnub.exe Description=?? Source=Paul Collins Startup list [go] Number=3309 Confirmed=X Filename=cvir.exe Description=Added by the SILOV-A WORM! Source=Paul Collins Startup list [Go!Zilla] Number=3310 Confirmed=X Filename=gozilla.exe Description=Download manager for resuming downloads and choosing multiple download locations. Advertising spyware Source=Paul Collins Startup list [Go!Zilla Monster Downloads] Number=3311 Confirmed=X Filename=Go.exe Description=Download manager for resuming downloads and choosing multiple download locations. Advertising spyware Source=Paul Collins Startup list [GoBack] Number=3312 Confirmed=U Filename=GBMenu.exe Description=Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GoBack] Number=3313 Confirmed=U Filename=GBTray.exe Description=System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GoBack Polling Service] Number=3314 Confirmed=U Filename=GBPoll.exe Description=Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GoBack Tray Icon] Number=3315 Confirmed=U Filename=GBTray.exe Description=Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GOG] Number=3316 Confirmed=X Filename=GOG.exe Description=Added by the PHILIS.B VIRUS! Source=Paul Collins Startup list [goidr] Number=3317 Confirmed=X Filename=goidr.exe Description=Goidr adware Source=Paul Collins Startup list [Goldensoft_MndlSvr] Number=3318 Confirmed=U Filename=MndlSvr.exe Description=Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200X for true multitasking Source=Paul Collins Startup list [Golum] Number=3319 Confirmed=X Filename=services.exe Description=Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [golumm] Number=3320 Confirmed=X Filename=services.exe Description=Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "golumm" subfolder Source=Paul Collins Startup list [good] Number=3321 Confirmed=X Filename=badvir.exe Description=Added by the SILOV-B WORM! Source=Paul Collins Startup list [google] Number=3322 Confirmed=X Filename=google.exe Description=Added by the RBOT-AMW WORM! Source=Paul Collins Startup list [Google Desktop] Number=3323 Confirmed=U Filename=GoogleDesktop.exe Description=Google Desktop Search - "a desktop search application that provides full text search over your email, computer files, chats, and the web pages you've viewed. By making your computer searchable, Google Desktop Search puts your information easily within your reach and frees you from having to manually organize your files, emails, and bookmarks" Source=Paul Collins Startup list [Google Desktop Search] Number=3324 Confirmed=N Filename=GoogleDesktop.exe Description=Google Desktop Search - "a desktop search application that provides full text search over your email, computer files, chats, and the web pages you've viewed. By making your computer searchable, Google Desktop Search puts your information easily within your reach and frees you from having to manually organize your files, emails, and bookmarks" Source=Paul Collins Startup list [Google Earth] Number=3325 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AXK TROJAN! Source=Paul Collins Startup list [Google Earth Viewer] Number=3326 Confirmed=N Filename=GOOGLEMAPS.EXE Description=Google Earth "combines satellite imagery, maps and the power of Google Search to put the world's geographic information at your fingertips" Source=Paul Collins Startup list [google Intrenet Explorer] Number=3327 Confirmed=X Filename=google.pif Description=Added by the RBOT-ARA WORM! Source=Paul Collins Startup list [Google service] Number=3328 Confirmed=X Filename=Googlesetup.exe Description=Added by the IRCBOT-RJ WORM! Source=Paul Collins Startup list [google toolbar] Number=3329 Confirmed=X Filename=ggtb32.exe Description=Added by the AGOBOT-RR WORM! Source=Paul Collins Startup list [Google Updater] Number=3330 Confirmed=N Filename=GOOGLE~1.EXE Description=Downloads and installs updates for Google applications (Google Earth, Google Desktop, etc.) Source=Paul Collins Startup list [GoogleDCClient] Number=3331 Confirmed=N Filename=GoogleDCC.exe Description=Google Compute Client - only present if you installed the Google Toolbar with "Google Compute" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser, click on the little double-helix on the Google Toolbar, and click "Stop Computing". No longer supported Source=Paul Collins Startup list [googletalk] Number=3332 Confirmed=U Filename=googletalk.exe Description=Google Talk "enables you to call or send instant messages to your friends for free-anytime, anywhere in the world". Can be launched manually Source=Paul Collins Startup list [GoToMyPC] Number=3333 Confirmed=U Filename=g2svc.exe Description=ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser Source=Paul Collins Startup list [GotSmiley] Number=3334 Confirmed=X Filename=GotSmiley.exe Description=GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [gouday.exe] Number=3335 Confirmed=X Filename=readme.exe Description=Added by the BEAGLE.C WORM! Source=Paul Collins Startup list [GRA] Number=3336 Confirmed=N Filename=gra.exe Description=Looks at system resources at startup and warns you if they have dropped. Contains links to the Disk Clean Up, Defrag and Start Up Menu. It does have a link to a startup configuration utility. Similar to msconfig but can keep a list of disabled apps. Not really necessary. Only appears if you load the Gateway Startup Utility Source=Paul Collins Startup list [gramdate] Number=3337 Confirmed=? Filename=2Stop.exe Description=?? Source=Paul Collins Startup list [Graphic Driver] Number=3338 Confirmed=X Filename=smss32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Graphic Loader] Number=3339 Confirmed=X Filename=ntvdm32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Gravis Appawareloader] Number=3340 Confirmed=U Filename=dbserver.exe Description=Looks like it's associated with Gravis game controllers and the Keyset Manager, allowing the user to program the buttons for games that don't support them Source=Paul Collins Startup list [Gravis Xperience Driver Support] Number=3341 Confirmed=U Filename=Grxp4exe.exe Description=Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used Source=Paul Collins Startup list [GrdSys32] Number=3342 Confirmed=? Filename=GrdSys32.exe Description=X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand? Source=Paul Collins Startup list [Greetings Workshop] Number=3343 Confirmed=N Filename=GWREMIND.EXE Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [gremier] Number=3344 Confirmed=X Filename=wscript.exe gpremier.vbs Description=Added by the GPREMIER WORM! Source=Paul Collins Startup list [Gremlin] Number=3345 Confirmed=X Filename=intrenat.exe Description=Added by the DOOMJUICE WORM! Source=Paul Collins Startup list [Grokster] Number=3346 Confirmed=N Filename=Grokster.exe Description=Grokster Peer-To-Peer File Sharing program Source=Paul Collins Startup list [GrooveMonitor] Number=3347 Confirmed=Y Filename=GrooveMonitor.exe Description=Microsoft Office Groove 2007 - Groove Folder Sharing synchronization (GFS). If you kill it, your GFS workspaces may not synchronize properly (particularly around unread-marks), and you might experience some nagging discomfort Source=Paul Collins Startup list [GrpConv] Number=3348 Confirmed=N Filename=grpconv.exe Description=Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article Source=Paul Collins Startup list [GsAds] Number=3349 Confirmed=X Filename=gms2.exe Description=PacerD_Media/Pacimedia.com adware Source=Paul Collins Startup list [Gscbc] Number=3350 Confirmed=? Filename=Gscbc.exe Description=?? Source=Paul Collins Startup list [gshp] Number=3351 Confirmed=X Filename=zzgshp.vbs Description=Homepage hi-jacker Source=Paul Collins Startup list [Gsiconexe] Number=3352 Confirmed=N Filename=Gsicon.exe Description=ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities Source=Paul Collins Startup list [GsiFinal] Number=3353 Confirmed=? Filename=rundll32 gspndll.dll, postInstall final Description=USB DSL modem related - [what does it do and is it required in startup? Source=Paul Collins Startup list [GSISETUP] Number=3354 Confirmed=? Filename=[path] GsiInst.exe INSTALL [path] V205Res 13 Description=BT Voyager ADSL modem related - what does it do and is it required? Source=Paul Collins Startup list [GSOrganizer] Number=3355 Confirmed=N Filename=GSOrganizer.exe Description=GoldenSection Organizer (now WinOrganizer - personal information manager Source=Paul Collins Startup list [gssomatic] Number=3356 Confirmed=X Filename=gssomatic.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [GStartup] Number=3357 Confirmed=X Filename=GMT.exe Description=Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [gsv] Number=3358 Confirmed=X Filename=gsv.exe Description=Added by the ROBAL 1.0 backdoor TROJAN! Source=Paul Collins Startup list [GT] Number=3359 Confirmed=X Filename=GT.EXE Description=Added by the SDBOT-AJ WORM! Source=Paul Collins Startup list [GTVEpg] Number=3360 Confirmed=U Filename=GTVEpg.exe Description=Part of Got All Media - control your TV tuner and other utilities from your PC Source=Paul Collins Startup list [GTVRec] Number=3361 Confirmed=X Filename=GTVRec.exe Description=Part of Got All Media - control your TV tuner and other utilities from your PC Source=Paul Collins Startup list [Gtwatch] Number=3362 Confirmed=N Filename=gtwatch.exe Description=Associated with a Mustec scanner and not required Source=Paul Collins Startup list [gtydf] Number=3363 Confirmed=X Filename=iisca.exe Description=Added by the CLAGGER-BB TROJAN! Source=Paul Collins Startup list [gtydf] Number=3364 Confirmed=X Filename=iscca.exe Description=Added by the DWNLDR-GTK TROJAN! Source=Paul Collins Startup list [Guard] Number=3365 Confirmed=U Filename=Guard.exe Description=Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program Source=Paul Collins Startup list [Guardian] Number=3366 Confirmed=N Filename=CMGrdian.exe Description=McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System Mechanic Source=Paul Collins Startup list [Guardian PC Security Tools] Number=3367 Confirmed=U Filename=Pfft.exe Description=Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite Source=Paul Collins Startup list [guarnset] Number=3368 Confirmed=X Filename=guarnset.exe Description=Adlogix adware Source=Paul Collins Startup list [GURL] Number=3369 Confirmed=X Filename=gurl.exe Description=GURLWatcher spyware Source=Paul Collins Startup list [GuruNet] Number=3370 Confirmed=U Filename=GuruNet.exe Description=GuruNet lets you click on any word on your screen to get the relevant information you want Source=Paul Collins Startup list [GustavVED] Number=3371 Confirmed=X Filename=[filename].exe Description=Added by the OPASERV.H WORM! Source=Paul Collins Startup list [gvagfxj] Number=3372 Confirmed=X Filename=rundll32 ...gvagfxj.dll Description=Unidentified adware, spyware or virus Source=Paul Collins Startup list [gw port controller] Number=3373 Confirmed=Y Filename=PORTCT95.EXE Description=From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties, the file is known as "Smart Thru Fax Drive Spy" and is supplied by Samsung Source=Paul Collins Startup list [GWInkMonitor] Number=3374 Confirmed=N Filename=GWInkMonitor.exe Description=Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink, do you want to buy some! Source=Paul Collins Startup list [gwiz] Number=3375 Confirmed=X Filename=ntsystem.exe Description=Added by the NITWIZ.A TROJAN! Source=Paul Collins Startup list [GWMDMMSG] Number=3376 Confirmed=N Filename=GWMDMMSG.exe Description=Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly Source=Paul Collins Startup list [GWMDMpi] Number=3377 Confirmed=U Filename=GWMDMpi.exe Description=Used with internal modems on Gateway PCs such as the 450SX Notebook. Required for audio settings to be maintained and does not remain in memory once run. See here for more information Source=Paul Collins Startup list [gwum] Number=3378 Confirmed=U Filename=gwum.exe Description=Gigabyte utility manager. Loads if you have a Gigabyte motherboard and got a full bundle of utilities installed. Monitors CPU, fans, BIOS etc. Only used by system "tweakers" Source=Paul Collins Startup list [gyy] Number=3379 Confirmed=? Filename=gyy.exe Description=Possibly Gator (and therefore spyware) related? Source=Paul Collins Startup list [G_Server.exe] Number=3380 Confirmed=X Filename=G_Server.exe Description=Added by the FEUTEL-C TROJAN! Source=Paul Collins Startup list [G_Server1.2.exe] Number=3381 Confirmed=X Filename=G_Server1.2.exe Description=Added by the GRAYBIRD-Z TROJAN! Source=Paul Collins Startup list [H/PC Connection Agent] Number=3382 Confirmed=U Filename=WCESCOMM.EXE Description=Active sync for use with Windows CE based palm PC Source=Paul Collins Startup list [H2OWIBU] Number=3383 Confirmed=U Filename=CXWibu.exe Description=Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware Source=Paul Collins Startup list [h4te Service Drivers] Number=3384 Confirmed=X Filename=h4te.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [hachimitsu-lemon] Number=3385 Confirmed=X Filename=hachimitsu-lemon.exe Description=Added by the HACHILEM TROJAN! Source=Paul Collins Startup list [hagent] Number=3386 Confirmed=X Filename=avp.exe Description=Added by the "Herman Agent" remote access TROJAN! Source=Paul Collins Startup list [HalifaxHowardCluster] Number=3387 Confirmed=U Filename=skinkers.exe Description="Howard the Weatherman" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages Source=Paul Collins Startup list [HaMFrontPanel] Number=3388 Confirmed=U Filename=hampanel.exe Description=Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget, but otherwise pointless Source=Paul Collins Startup list [Handy Backup 3.9] Number=3389 Confirmed=U Filename=hbagent.exe Description=Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers Source=Paul Collins Startup list [HanUpdate] Number=3390 Confirmed=X Filename=hanz.exe Description=Added by the RBOT-GLJ WORM! Source=Paul Collins Startup list [Hard drive Controller] Number=3391 Confirmed=X Filename=hdcontroller.exe Description=Added by the KIMAN.B WORM! Source=Paul Collins Startup list [Hardware Doctor] Number=3392 Confirmed=U Filename=Hwdoctor.exe Description=Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds, voltages, temperatures. Only required if you're concerned about your system temperature - typically for "overclocked" systems Source=Paul Collins Startup list [Hardware Monitor Service] Number=3393 Confirmed=X Filename=mshms.exe Description=Added by the WOLLF-A TROJAN! Source=Paul Collins Startup list [Hardware Profile] Number=3394 Confirmed=X Filename=hxdef.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Hardware Profile] Number=3395 Confirmed=X Filename=hxdef.exe... Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Hardware Sensors Monitor] Number=3396 Confirmed=U Filename=hmonitor.exe Description=Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems Source=Paul Collins Startup list [Hardware Shell Detection] Number=3397 Confirmed=X Filename=WinHSD.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Hare] Number=3398 Confirmed=U Filename=hare.exe Description=Hare - improve and optimize performance of desktop/laptop PCs Source=Paul Collins Startup list [HATAPE] Number=3399 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-QF TROJAN! Source=Paul Collins Startup list [HawkEye] Number=3400 Confirmed=U Filename=HAWK_95.EXE Description=Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs Source=Paul Collins Startup list [HawkEye IV Control Panel] Number=3401 Confirmed=U Filename=HAWK_32.EXE Description=Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs Source=Paul Collins Startup list [Hbinst] Number=3402 Confirmed=X Filename=Hbinst.exe Description=Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here Source=Paul Collins Startup list [HC Reminder] Number=3403 Confirmed=N Filename=hc.exe Description=For Compaq PC's. Help Compiler, crunches help database, will run without being in startup when needed Source=Paul Collins Startup list [HCDetect] Number=3404 Confirmed=N Filename=HCDetect.exe Description=MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification, detection, and Internet Connection Sharing (ICS) taskbar icon. Not required - network can be set-up manually, also has a known memory leak problem Source=Paul Collins Startup list [hcenter] Number=3405 Confirmed=U Filename=tgcmd.exe Description=See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [hclean32.exe] Number=3406 Confirmed=X Filename=hclean32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [Hcontrol] Number=3407 Confirmed=U Filename=hcontrol.exe Description=Hotkeys on an ASUS Notebook. Only required if you use the additional keys Source=Paul Collins Startup list [hcsystray] Number=3408 Confirmed=N Filename=hc_tray.exe Description=Kuma Notifier for the Shootout! game from the History Channel. "It lets you know whenever there�s a new episode that�s been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information" Source=Paul Collins Startup list [HDAShCut] Number=3409 Confirmed=N Filename=HDAShCut.exe Description=High definition audio page shortcut - not required Source=Paul Collins Startup list [HDAudio] Number=3410 Confirmed=X Filename=hda.exe Description=Added by the TACTSLAY.U TROJAN! Source=Paul Collins Startup list [HDAudio Driver 1.0] Number=3411 Confirmed=X Filename=[random filename].exe Description=Added by the TEADOOR-D TROJAN! Source=Paul Collins Startup list [HDAudio Driver 2.0] Number=3412 Confirmed=X Filename=[random filename].exe Description=Added by the TEADOOR-E TROJAN! Source=Paul Collins Startup list [HDDHealth] Number=3413 Confirmed=U Filename=hddhealth.exe Description=HDD Health is a "full-featured failure-prediction agent for machines using Windows 95, 98, NT, Me, 2000 and XP. Sitting in the system tray, it monitors hard disks and alerts you to impending failure" Source=Paul Collins Startup list [HDDlife] Number=3414 Confirmed=U Filename=HDDlife.exe Description=HDDlife checks the health of your hard drives at regular intervals and informs you about the results of these checks Source=Paul Collins Startup list [HDhelp] Number=3415 Confirmed=? Filename=tbhdhelp.exe Description=Associated with Philips Edge series soundcards. Is it required? Source=Paul Collins Startup list [hdlfoe df98ndf] Number=3416 Confirmed=X Filename=svchots.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [hdlpscom] Number=3417 Confirmed=X Filename=[8 random letters].exe Description=Added by the RBOT-FUL WORM! Source=Paul Collins Startup list [HDtray] Number=3418 Confirmed=N Filename=HDtray.exe Description=Philips Edge Series Control Panel Tray Utility - system tray icon for a Philips Edge series soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [he3bbcff] Number=3419 Confirmed=X Filename=rundll32.exe [path] he3bbcff.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [he3e3fc4] Number=3420 Confirmed=X Filename=rundll32.exe [path] he3e3fc4.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [HELLBOT TEST] Number=3421 Confirmed=X Filename=1hellbot.exe Description=Added by the MYDOOM.BO WORM! Source=Paul Collins Startup list [HELLBOT3] Number=3422 Confirmed=X Filename=coolbot.exe Description=Added by the MYTOB.AB WORM! Source=Paul Collins Startup list [hellodolly] Number=3423 Confirmed=X Filename=shost.exe Description=Added by the YODO WORM! Source=Paul Collins Startup list [helloworld] Number=3424 Confirmed=X Filename=nb32ext2.exe Description=Added by the MYDOOM.BV WORM! Source=Paul Collins Startup list [helloworld] Number=3425 Confirmed=X Filename=nb32ext3.exe Description=Added by the MYTOB.JT WORM! Source=Paul Collins Startup list [Help] Number=3426 Confirmed=? Filename=helpext.exe Description=?? Source=Paul Collins Startup list [help] Number=3427 Confirmed=X Filename=help.scr Description=Added by the BANCOS-BBU TROJAN! Source=Paul Collins Startup list [Help Temp Files] Number=3428 Confirmed=X Filename=netreg.exe Description=Added by the FORBOT-EM WORM! Source=Paul Collins Startup list [helpctl.exe] Number=3429 Confirmed=X Filename=helpctl.exe Description=Added by the GASLIDE TROJAN! Source=Paul Collins Startup list [Helper] Number=3430 Confirmed=X Filename=eschlp.exe Description=Added by the BLASTER.T WORM! Source=Paul Collins Startup list [HELPER] Number=3431 Confirmed=X Filename=greece nm.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [HELPER] Number=3432 Confirmed=X Filename=Netherlands.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [HELPER] Number=3433 Confirmed=X Filename=new zealand.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [HELPER] Number=3434 Confirmed=X Filename=sweden.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [HELPER] Number=3435 Confirmed=X Filename=canada.exe Description=AsdPlug premium rate adult content dialler variant Source=Paul Collins Startup list [HELPER] Number=3436 Confirmed=X Filename=france.exe Description=AsdPlug premium rate adult content dialler variant Source=Paul Collins Startup list [HELPER] Number=3437 Confirmed=X Filename=temp532.exe Description=AsdPlug premium rate adult content dialler variant Source=Paul Collins Startup list [helper.dll] Number=3438 Confirmed=X Filename=[path] rundll32.exe [path] helper.dll Description=CnsMin (Chinese Keywords) hijacker related Source=Paul Collins Startup list [HelpExp.exe] Number=3439 Confirmed=X Filename=HelpExp.exe Description=Attune HelpExpress - spyware. Disable and uninstall - see here Source=Paul Collins Startup list [helpmanager] Number=3440 Confirmed=X Filename=spoler.exe Description=Added by the RANDEX.J WORM! Source=Paul Collins Startup list [helpw] Number=3441 Confirmed=X Filename=helpw.exe Description=Adware downloader Source=Paul Collins Startup list [hen] Number=3442 Confirmed=X Filename=[filename].exe Description=Added by the TARNO.G TROJAN! Source=Paul Collins Startup list [heomstool] Number=3443 Confirmed=X Filename=heomstool.exe Description=Added by the HEOMS TROJAN! Source=Paul Collins Startup list [hErcUnes] Number=3444 Confirmed=X Filename=softhost.exe Description=Added by the GARROCH WORM! Source=Paul Collins Startup list [Hermes Messenger] Number=3445 Confirmed=U Filename=DGDRHE~1.EXE Description=A LAN messenger alternative to WinPopUp - Digital Dreams Software Source=Paul Collins Startup list [Hewlett Packard Manager] Number=3446 Confirmed=X Filename=hpmanager.exe Description=Added by the MYTOB.KE WORM! Note - this is not a valid Hewlett-Packard program Source=Paul Collins Startup list [Hewlett Packard Recorder] Number=3447 Confirmed=N Filename=Remind32.exe Description=HP multifunction registration Source=Paul Collins Startup list [Hf] Number=3448 Confirmed=U Filename=Hf.exe Description=Hide Folders - hide your folders so only you can view them Source=Paul Collins Startup list [HF Security] Number=3449 Confirmed=X Filename=hfsecure.exe Description=Added by the AGOBOT-TI WORM! Source=Paul Collins Startup list [hffsrv] Number=3450 Confirmed=U Filename=hffsrv.exe Description=Hide Files & Folders is a "password-protected security utility working at the Windows kernel level allowing you to password-protect files and folders, or to hide them securely from viewing and searching" Source=Paul Collins Startup list [hfxp] Number=3451 Confirmed=U Filename=hfxp.exe Description=Hide Folders XP - hide your folders so only you can view them Source=Paul Collins Startup list [hgqhp.exe] Number=3452 Confirmed=X Filename=hgqhp.exe Description=Added by the FLUSH.F TROJAN! Source=Paul Collins Startup list [HGTXPEI] Number=3453 Confirmed=N Filename=FirstReboot.exe Description=Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [HiberMonitor] Number=3454 Confirmed=? Filename=HCount.exe Description=?? Source=Paul Collins Startup list [Hibernation] Number=3455 Confirmed=U Filename=hib32.exe Description=Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate, etc. Required if you run of battery regularly Source=Paul Collins Startup list [Hid.exe] Number=3456 Confirmed=X Filename=hid.exe Description=Added by the RATSOU.B TROJAN! Source=Paul Collins Startup list [HideOE] Number=3457 Confirmed=U Filename=HideOE.exe Description=HideOE - allows you to 'hide' Outlook Express or minimize it to the System Tray Source=Paul Collins Startup list [HideRun.exe] Number=3458 Confirmed=X Filename=Hiderun.exe and svhost.exe and pro.gif Description=Added by the BOOHOO WORM! Source=Paul Collins Startup list [HideStyle] Number=3459 Confirmed=X Filename=Ante Browse Trust.exe Description=IE toolbar taking you to Lop.com. If the exe is running, end it and remove the "Stupidmore" directory from C:\Program Files Source=Paul Collins Startup list [hidserv] Number=3460 Confirmed=U Filename=hidserv.exe Description=This is the Human Interface Device Server for Win98SE/2000/Me/XP, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case then re-enable it. Equivalent to MMHid in Win98. On HP Computers, HIDSERV is the controller for the keyboard sound controls on the USB and PS/2 keyboards Source=Paul Collins Startup list [High Definition Audio Property Page Shortcut] Number=3461 Confirmed=N Filename=HDAudPropShortcut.exe Description=Realtek audio card related - probably adds the odd feature to one of the "Sounds" Control Panel applet tabs - doesn't appear to be required Source=Paul Collins Startup list [HighPoint ATA RAID Management Software] Number=3462 Confirmed=Y Filename=raidman.exe Description=HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID Source=Paul Collins Startup list [HijackThis startup scan] Number=3463 Confirmed=U Filename=HijackThis.exe Description=HijackThis lists the contents of key areas of the Registry and hard drive areas that are used by both legitimate programmers and hijackers. The program is continually updated to detect and remove new hijacks. It does not target specific programs and URLs, only the methods used by hijackers to force you onto their sites. As a result, false positives are imminent, and unless you're sure about what you're doing, you always should consult with knowledgable folks before deleting anything. Required if you'd like HijackThis to run a scan at startup, and show the results when new items are found (if so, check the appropriate box in the "Config" section") Source=Paul Collins Startup list [HijSrv32] Number=3464 Confirmed=X Filename=hijsrv.exe Description=Added by the BANKGERM-D TROJAN! Source=Paul Collins Startup list [HistoryKill] Number=3465 Confirmed=N Filename=histkill.exe Description=HistoryKill removes your web surfing path by removing the URL drop-list history, detailed history file, cache, and cookies in both IE and Netscape Navigator browsers. Available via Start -> Programs Source=Paul Collins Startup list [Hitman Pro SurfRight Helper] Number=3466 Confirmed=U Filename=srhelper.exe Description=Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy Source=Paul Collins Startup list [HitQ] Number=3467 Confirmed=X Filename=HitQ.exe Description=Hijacker, for more information see here Source=Paul Collins Startup list [HitwarePKLite] Number=3468 Confirmed=U Filename=HITWAR~1.EXE Description=Hitware Popup Killer Lite Source=Paul Collins Startup list [HIV] Number=3469 Confirmed=X Filename=HIV.exe Description=Added by the HIVA TROJAN! Source=Paul Collins Startup list [hk] Number=3470 Confirmed=U Filename=hk.exe Description=KeyLoggerExp keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [hkcmd] Number=3471 Confirmed=U Filename=hkcmd.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. If the user wishes to have "HotKey" access to Intel's customised graphics properties, it is required, otherwise not. It can be disabled via the Display Properties in the Control Panel Source=Paul Collins Startup list [HKEYok] Number=3472 Confirmed=X Filename=runlli32.exe Description=Added by the QQPASS-U TROJAN! Source=Paul Collins Startup list [HKLM\Run] Number=3473 Confirmed=X Filename=windowsupdate.exe Description=Added by the FORBOT-BJ WORM! (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) Source=Paul Collins Startup list [hkserv] Number=3474 Confirmed=U Filename=HKserv.exe Description=Keyboard manager program required to use programmable power and function keys on some laptops such as the Sony PCG R505TS Source=Paul Collins Startup list [hkss] Number=3475 Confirmed=U Filename=hkss.exe Description=Compaq HotKey Support - multimedia keyboard support Source=Paul Collins Startup list [HLcleanup] Number=3476 Confirmed=X Filename=hlsetup2.exe Description=LinkReplacer/FFinder adware Source=Paul Collins Startup list [hldrrr] Number=3477 Confirmed=X Filename=hldrrr.exe Description=Added by the BAGLE-KF WORM! Source=Paul Collins Startup list [hlhtxo.exe] Number=3478 Confirmed=X Filename=hlhtxo.exe Description=Added by the QLOWZONES-27 TROJAN! Source=Paul Collins Startup list [HLL Data Parameter] Number=3479 Confirmed=X Filename=hllcxpa.exe Description=Added by the RBOT.AFG WORM! Source=Paul Collins Startup list [HMI PowerSystem] Number=3480 Confirmed=X Filename=hmisvc32.exe Description=Added by the RANDEX.CZZ WORM! Source=Paul Collins Startup list [HML PowerSource] Number=3481 Confirmed=X Filename=hmlsvc32.exe Description=Added by the SDBOT-XL WORM! Source=Paul Collins Startup list [Hmonitor] Number=3482 Confirmed=U Filename=Hmonitor.exe Description=Hardware sensor monitoring program. Only required if you overclock your system and want to check on the status Source=Paul Collins Startup list [HMV PowerSource] Number=3483 Confirmed=X Filename=hmusvc32.exe Description=Added by the SDBOT-YW WORM! Source=Paul Collins Startup list [ho2stdll.exe] Number=3484 Confirmed=X Filename=ho2stdll.exe Description=Added by the BANKER-HO TROJAN! Source=Paul Collins Startup list [HOI Services] Number=3485 Confirmed=X Filename=holsvc32.exe Description=Added by the AGOBOT-SF WORM! Source=Paul Collins Startup list [Holiday Lights] Number=3486 Confirmed=N Filename=Holiday Lights.exe Description=Holiday Lights from Tiger Technologies. Festive desktop enhancement that adds lights. Available via Start -> Programs Source=Paul Collins Startup list [Hollaback] Number=3487 Confirmed=X Filename=slvhosts.exe Description=Added by the SDBOT.BMO WORM! Source=Paul Collins Startup list [Home Theater SchSvr] Number=3488 Confirmed=N Filename=SchSvr.exe Description=WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [HomeAlarm] Number=3489 Confirmed=U Filename=HomeAlarm.exe Description=Chameleon Clock - system tray clock replacement Source=Paul Collins Startup list [HomeCentre WakeUp] Number=3490 Confirmed=? Filename=LGWAKEUP.EXE Description=Associated with the no longer supported Xerox HomeCentre printer/scanner Source=Paul Collins Startup list [Homeland Network] Number=3491 Confirmed=X Filename=HomelandNetwork.exe Description=Homeland Network Notifier - pops ads Source=Paul Collins Startup list [Honor] Number=3492 Confirmed=? Filename=honor.exe Description=?? Source=Paul Collins Startup list [Hook99startup] Number=3493 Confirmed=U Filename=hk2re.exe Description="Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons, bitmaps and can extract icons from executables and libraries. Hook99 can also make the background of desktop icons captions transparent" Source=Paul Collins Startup list [HookSys] Number=3494 Confirmed=U Filename=HookSys.exe Description=SurfinGuard Pro from Finjan - internet protection software, protects against all malicious code delivered through executables, scripting files, ActiveX and Java Source=Paul Collins Startup list [HornetMonitor] Number=3495 Confirmed=U Filename=MntrHrnt.exe Description=Hornet Monitor - monitoring system that detects and responds to unauthorized access attempts and sources of channel interference on any local DSSS network Source=Paul Collins Startup list [HorngTech4D] Number=3496 Confirmed=Y Filename=bally4d.exe Description=HorngTech 4D mouse driver Source=Paul Collins Startup list [Host] Number=3497 Confirmed=X Filename=N/A Description=Added by the POPDIS or STARTPAGE.F TROJANS! Source=Paul Collins Startup list [host] Number=3498 Confirmed=X Filename=help.exe Description=Identified as the DELF.LF by Ewido Security Suite Source=Paul Collins Startup list [Host Process] Number=3499 Confirmed=X Filename=mame.exe Description=Added by the RBOT-APO WORM! Source=Paul Collins Startup list [hostdll.exe] Number=3500 Confirmed=X Filename=hostdll.exe Description=Added by the BANKER-BO TROJAN! Source=Paul Collins Startup list [HostManager] Number=3501 Confirmed=U Filename=AOLHostManager.exe Description=Manages a component essential to the operation of most current AOL software. If you remove it from startup it will load when IE is launched, increasing lauching time Source=Paul Collins Startup list [HostManager] Number=3502 Confirmed=N Filename=AOLSoftware.exe Description=Quoted from AOL Beta Team, "Manages a component essential to the operation of most current AOL software, client or not. You should be able to remove it from Startup (it'll just load when Explorer is launched, which will extend load time a bit), but do leave it on your system". Source=Paul Collins Startup list [Hostren.exe] Number=3503 Confirmed=X Filename=Hostren.exe Description=Added by PWS.BANKER.F, a variant of the BANKER-BO TROJAN! Source=Paul Collins Startup list [hostserv] Number=3504 Confirmed=X Filename=hostserv.exe Description=Added by the RBOT.BPZ WORM! Source=Paul Collins Startup list [hostserv] Number=3505 Confirmed=X Filename=wiz98.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [HostsMan] Number=3506 Confirmed=U Filename=hm.exe Description="HostsMan is a freeware application that lets you manage your Hosts file with ease". It is mainly intended to block specific domains (mostly advertising servers) by redirecting them to localhost, but can also be used to add any other domain/Ip combination that you want to be included in the HOSTS file Source=Paul Collins Startup list [HostSrv] Number=3507 Confirmed=X Filename=sachostx.exe Description=Added by the LOOKSKY.H WORM! Drops multiple files in the System (9x/ME) or System32 (NT/2K/XP) folders Source=Paul Collins Startup list [HostSrv] Number=3508 Confirmed=X Filename=sachostx.exe Description=Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS! Source=Paul Collins Startup list [HostSrv] Number=3509 Confirmed=X Filename=sachostx.exe... Description=Added by the LOOKSKY.E WORM! Source=Paul Collins Startup list [HostSVC syse] Number=3510 Confirmed=X Filename=HostSVC.exe Description=Added by the RBOT-ANZ WORM! Source=Paul Collins Startup list [Hot Corners] Number=3511 Confirmed=U Filename=Hotc.exe Description=Hot Corners - "lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen" Source=Paul Collins Startup list [Hot Key Kbd 2690 Daemon] Number=3512 Confirmed=U Filename=SK9910DM.exe Description=Multimedia keyboard manager - required if you use any special keys Source=Paul Collins Startup list [Hot Key Keybd 9910 Daemon] Number=3513 Confirmed=U Filename=SK9910DM.exe Description=Multimedia keyboard manager - required if you use any special keys Source=Paul Collins Startup list [Hot Party 22] Number=3514 Confirmed=? Filename=hotpart22.exe Description=?? Source=Paul Collins Startup list [HotAction_hr] Number=3515 Confirmed=X Filename=hotaction_hr.exe Description=Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "HotAction_hr" Source=Paul Collins Startup list [Hotbar] Number=3516 Confirmed=X Filename=Hbinst.exe Description=Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here Source=Paul Collins Startup list [Hotbar] Number=3517 Confirmed=X Filename=HbOEAddOn.exe Description=Hotbar adware Source=Paul Collins Startup list [Hotfix Updat] Number=3518 Confirmed=X Filename=svdhost32.exe Description=Added by the GAOBOT.ZW WORM! Source=Paul Collins Startup list [HotIDE] Number=3519 Confirmed=U Filename=hotide.exe Description=HotIDE allows Acer TravelMate owners to hot-swap external drives without switching of their notebooks Source=Paul Collins Startup list [HotkeyApp] Number=3520 Confirmed=U Filename=HotkeyApp.exe Description=Programmable keys on Acer, Fujitsu and other laptops Source=Paul Collins Startup list [HotKeysCmds] Number=3521 Confirmed=U Filename=hkcmd.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. If the user wishes to have "HotKey" access to Intel's customised graphics properties, it is required, otherwise not. It can be disabled via the Display Properties in the Control Panel Source=Paul Collins Startup list [HotPix] Number=3522 Confirmed=X Filename=hotpix.exe Description=Adult content dialler Source=Paul Collins Startup list [hotplug] Number=3523 Confirmed=X Filename=hotplug.exe Description=Added by the SILLYDL TROJAN! Source=Paul Collins Startup list [Hotplug] Number=3524 Confirmed=U Filename=hot_plug.exe Description=Related to the SiS_Hot_Plug_Application. Enables automated driver loading for hotpluggable devices. If this service is stopped, hotplug devices will no longer function Source=Paul Collins Startup list [HotSync Manager] Number=3525 Confirmed=N Filename=hotsync.exe Description=Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start -> Programs Source=Paul Collins Startup list [hotwetlove] Number=3526 Confirmed=X Filename=hotwetlove.exe Description=Adult content dialler. Will not uninstall - components have to be manually deleted Source=Paul Collins Startup list [Hot_Kiss] Number=3527 Confirmed=X Filename=Hot_Kiss.exe Description=Adult content dialler Source=Paul Collins Startup list [Hot_Tarts] Number=3528 Confirmed=X Filename=Hot_Tarts.exe Description=Adult content dialler Source=Paul Collins Startup list [Hot_Tarts_**] Number=3529 Confirmed=X Filename=Hot_Tarts_**.exe Description=Premium rate adult content dialer (where * is a random char) Source=Paul Collins Startup list [Hot_Tarts_Au] Number=3530 Confirmed=X Filename=Hot_Tarts_Au.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [Hot_Tarts_mc] Number=3531 Confirmed=X Filename=Hot_Tarts_mc.exe Description=HotTarts adult content dialer Source=Paul Collins Startup list [HoverDesk] Number=3532 Confirmed=U Filename=HoverDesk.exe Description=HoverDesk - desktop replacement software Source=Paul Collins Startup list [hp 1000 firmware] Number=3533 Confirmed=? Filename=fwdl.exe Description=HP LaserJet 1000 related. Is it a driver or automatic firmware update (based upon the filename)? Source=Paul Collins Startup list [HP AutoIndexer] Number=3534 Confirmed=U Filename=hppautoindexer.exe Description=Installed by HP multi-function printer driver software, related to PC faxing. If you are not using the PC faxing feature you can go ahead and disable these services from the startup Source=Paul Collins Startup list [HP CD Writer] Number=3535 Confirmed=N Filename=hpcdtray.exe Description=System Tray access to a HP CD-Writer's functions. Available via Start -> Programs Source=Paul Collins Startup list [HP CD-DVD] Number=3536 Confirmed=N Filename=hpcdtray.exe Description=System Tray access to a HP CD-Writer's functions. Available via Start -> Programs Source=Paul Collins Startup list [HP CD-Writer] Number=3537 Confirmed=N Filename=hpcdtray.exe Description=System Tray access to a HP CD-Writer's functions. Available via Start -> Programs Source=Paul Collins Startup list [hp center] Number=3538 Confirmed=X Filename=BACKWEB-*****.exe Description=See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer owners". Applies to certain HP Pavilion desktop computers between Fall 2001 and Spring 2003. * can be any digit Source=Paul Collins Startup list [hp center UI] Number=3539 Confirmed=N Filename=ShadowBar.exe Description=User Interface for HP Center - see here Source=Paul Collins Startup list [HP Component Manager] Number=3540 Confirmed=N Filename=hpcmpmgr.exe Description=Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error "Windows can't shutdown the computer because hpcmpmgr.exe can't be ended" Source=Paul Collins Startup list [HP Deskjet] Number=3541 Confirmed=X Filename=HP_DeskJet_500.exe Description=Added by the FORBOT-DA WORM! Source=Paul Collins Startup list [HP Digital Imaging Monitor] Number=3542 Confirmed=U Filename=hpqtra08.exe Description=System Tray access to HP Director. Required if you prefer to use the all-in-one buttons to manually scan documents or transfer photos froma camera, for example Source=Paul Collins Startup list [HP Display Settings] Number=3543 Confirmed=U Filename=hpdisply.exe Description=Sets default display settings. Unchecking this item has been reported to cure a "Problem sending command to keyboard" error message Source=Paul Collins Startup list [HP IDScheduler] Number=3544 Confirmed=? Filename=HPIDSCHD.exe Description=HP Instant Delivery Scheduler Source=Paul Collins Startup list [HP Image Zone Fast Start] Number=3545 Confirmed=N Filename=hpqthb08.exe Description=Improves the startup time of HP Image Zone. If you disable it, HP Image Zone takes a long time to start up only the first time you run it. Subsequent startups are much faster than the first time Source=Paul Collins Startup list [HP Info Express] Number=3546 Confirmed=N Filename=?? Description=On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb Source=Paul Collins Startup list [HP Instant Support] Number=3547 Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". HP Instant Support is required to run with the Help and Support program. If you uncheck HP Instant Support and and then run Help and Support it will add another HP Instant Support in the startup menu. If you remove the HP Instant Support in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [HP Internet Center] Number=3548 Confirmed=N Filename=SURFBRD.EXE Description=Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them Source=Paul Collins Startup list [HP JetDiscovery] Number=3549 Confirmed=N Filename=HPJETDSC.EXE Description=HP JetAdmin software which monitors printing jobs on a network environment Source=Paul Collins Startup list [HP JetSpeed Autostart] Number=3550 Confirmed=N Filename=AUTOSTART.EXE Description=Autostart executable for the old multiplayer game HP Jetspeed Source=Paul Collins Startup list [HP Laser Jet Director] Number=3551 Confirmed=U Filename=hppdirector.exe Description=System Tray icon that opens various functions such as copy, fax, email, scan, copy plus, etc. Right-click on it and you see a few options such as the preceding bar plus About, Help, ToolBox, Exit, etc Source=Paul Collins Startup list [HP Network Registry Agent] Number=3552 Confirmed=? Filename=hpnra.exe Description=?? Source=Paul Collins Startup list [HP OfficeJet Series xxx Startup] Number=3553 Confirmed=? Filename=HPOSTR03.EXE Description=xxx represents the series number - such as 700. What does it do and it it required? Source=Paul Collins Startup list [HP OfficeJet Series xxx Startup] Number=3554 Confirmed=? Filename=HPOstr05.exe Description=xxx represents the series number - such as 700. What does it do and it it required? Source=Paul Collins Startup list [HP Parallel Port Test] Number=3555 Confirmed=N Filename=hppt.exe Description=Associated with a HP ScanJet scanner Source=Paul Collins Startup list [HP Photo Manager] Number=3556 Confirmed=X Filename=HPPhotoManager.exe Description=Added by the SDBOT.AXU WORM! Source=Paul Collins Startup list [HP Port Resolver] Number=3557 Confirmed=? Filename=hpbpro.exe Description=?? Source=Paul Collins Startup list [HP Precision Scan] Number=3558 Confirmed=N Filename=hpmdlbwx.exe Description=HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required Source=Paul Collins Startup list [HP Presentation Ready] Number=3559 Confirmed=N Filename=PresRdy.exe Description=HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device" Source=Paul Collins Startup list [hp psc 2000 Series] Number=3560 Confirmed=U Filename=hpobnz08.exe Description=System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start Source=Paul Collins Startup list [HP RecordNow] Number=3561 Confirmed=U Filename=?? Description=From HP "Software for the CD writer. Do not prevent from starting unless the CD writer is never going to be used." Source=Paul Collins Startup list [HP ScanPatch] Number=3562 Confirmed=U Filename=HPScanFix.exe Description=Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used, then it is safe to remove or prevent from starting Source=Paul Collins Startup list [HP ScanPicture] Number=3563 Confirmed=N Filename=hpsplmwa.exe Description=HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required Source=Paul Collins Startup list [HP SchedIndexer] Number=3564 Confirmed=U Filename=hppschedindexer.exe Description=Installed by HP multi-function printer driver software, related to PC faxing. If you are not using the PC faxing feature you can go ahead and disable these services from the startup Source=Paul Collins Startup list [HP Service Drivers] Number=3565 Confirmed=X Filename=hdsys.exe Description=Added by the SDBOT-ZE WORM! Source=Paul Collins Startup list [hp Silent Service] Number=3566 Confirmed=? Filename=HpSrvUI.exe Description=HP related Source=Paul Collins Startup list [HP Simple Trax] Number=3567 Confirmed=N Filename=Hpcron.exe Description=Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon Source=Paul Collins Startup list [HP software update] Number=3568 Confirmed=N Filename=HPWuSchd2.exe Description=HP software updates. If a shortcut doesn't exist create your own and run it manually Source=Paul Collins Startup list [HP software update] Number=3569 Confirmed=N Filename=HPWuSchd.exe Description=HP software updates. If a shortcut doesn't exist, create your own and run it manually Source=Paul Collins Startup list [HP Status] Number=3570 Confirmed=N Filename=hpstatus.exe Description=HP Printer Status and Alerts Source=Paul Collins Startup list [HP Status Server] Number=3571 Confirmed=? Filename=hpboid.exe Description=Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required? Source=Paul Collins Startup list [HP TV Now] Number=3572 Confirmed=U Filename=HpTvNow.exe Description=Application supplied with HP notebooks. It activates the S-Video port and is said to improve the quality of the output signal (resolution/timeouts) Source=Paul Collins Startup list [HP Updates] Number=3573 Confirmed=N Filename=?? Description=On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb Source=Paul Collins Startup list [HP Visualize Init] Number=3574 Confirmed=? Filename=HpVisIni.exe Description=HP Visualize software related. What does it do and is it required? Source=Paul Collins Startup list [HP-Aio Flight] Number=3575 Confirmed=N Filename=Remind32.exe Description=HP multifunction registration Source=Paul Collins Startup list [hpaiodevice] Number=3576 Confirmed=N Filename=hpodev07.exe Description=Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner Source=Paul Collins Startup list [HPAiODevice(hp officejet g series)] Number=3577 Confirmed=? Filename=hpoavn07.exe Description=HP Printer related, reportedly lets file transfers from an HP device pass files through Windows firewall. Is it required? Source=Paul Collins Startup list [HPAiODevice(hp psc 900 series) -1] Number=3578 Confirmed=N Filename=hpobrt07.exe Description=Installed with a Hewlett Packard 900 series colour printer, scanner, fax, photo card slot printer, copier. Assumed to perform an identical function to the hpaiodevice entry Source=Paul Collins Startup list [HPAIO_PrintFolderMgr] Number=3579 Confirmed=N Filename=hpoopm07.exe Description=Directly from HP: "This process has one purpose - detects if the device moves to a different port, and notifies other processes to look on the new port." For various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the HP icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner Source=Paul Collins Startup list [HPBootOp] Number=3580 Confirmed=U Filename=HPBootOp.exe Description="HP Boot Optimizer intelligently and dynamically launches software during startup, based on available resources, to improve startup performance" Source=Paul Collins Startup list [hpcmd] Number=3581 Confirmed=X Filename=cmd.exe Description=Added by the ADCLICK-DS TROJAN! Source=Paul Collins Startup list [hpcmpmgr] Number=3582 Confirmed=N Filename=hpcmpmgr.exe Description=Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error "Windows can't shutdown the computer because hpcmpmgr.exe can't be ended" Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3583 Confirmed=U Filename=hpztsbol.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3584 Confirmed=U Filename=hpztsd02.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3585 Confirmed=U Filename=hpztsb04.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3586 Confirmed=U Filename=hpztsb05.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3587 Confirmed=U Filename=hpztsb07.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HPDJ Taskbar Utility] Number=3588 Confirmed=U Filename=hpztsb09.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpfsched] Number=3589 Confirmed=N Filename=hpfsched.exe Description=HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature Source=Paul Collins Startup list [HPGamesActiveMenu] Number=3590 Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [hpgs2wnd] Number=3591 Confirmed=N Filename=hpgs2wnd.exe Description="HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites". Available via Start -> Programs Source=Paul Collins Startup list [Hpha1mon] Number=3592 Confirmed=U Filename=Hpha1mon.exe Description=Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature Source=Paul Collins Startup list [HPHAxMON] Number=3593 Confirmed=U Filename=HPHAxMON.EXE Description=Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature and known to cause system crashes in some cases. "x" can be 1, 2 or 3 and depends upon driver version. Replaced by HPHmon** (where ** is the version number) from version 4 onwards Source=Paul Collins Startup list [HPHmon**] Number=3594 Confirmed=U Filename=HPHMON**.EXE Description=Monitors the status of the memory card reader slot on a HP printers and displays a tray icon if a memory card isn't inserted. Also creates a virtual drive and assigns it the first available drive letter - which can lead to problems with drive management. ** represents the version number. Disable if you don't use the reader Source=Paul Collins Startup list [HPHmon03] Number=3595 Confirmed=U Filename=hphmon03.exe Description=Related to the Hewlett-Packard Photosmart's configuration and diagnostics module Source=Paul Collins Startup list [HPHmon04] Number=3596 Confirmed=U Filename=hphmon04.exe Description=Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature Source=Paul Collins Startup list [HPHmon05] Number=3597 Confirmed=? Filename=hphmon05.exe Description=?? Source=Paul Collins Startup list [HPHmon06] Number=3598 Confirmed=U Filename=hphmon06.exe Description=Related to the Hewlett Packard software HP Photosmart printer, it provides easy access to flash card reading functions. This program is not essential to the running of the system. Your choice Source=Paul Collins Startup list [Hphome] Number=3599 Confirmed=X Filename=hphome.js Description=Homepage hijacker Source=Paul Collins Startup list [HPHUPD**] Number=3600 Confirmed=N Filename=hphupd**.exe Description=HP software update checker and wizard launcher. ** represents the version number. Available via Start -> Programs Source=Paul Collins Startup list [hpjsiroute] Number=3601 Confirmed=? Filename=hpjsira.exe Description=Related to HP laserjet printers and IP addresses. An IP address is appended to the name field - ie "hpjsiroute192.168.1.2" Source=Paul Collins Startup list [HPl Services] Number=3602 Confirmed=X Filename=hmlsvc32.exe Description=Added by the AGOBOT-SI WORM and variants! Source=Paul Collins Startup list [HpLamp] Number=3603 Confirmed=Y Filename=HPLAMP.EXE Description=HP Scanner Utility that controls your scanners light bulb. Needed if it's switched on Source=Paul Collins Startup list [hplampc] Number=3604 Confirmed=U Filename=hplampc.exe Description=HP Scanner Lamp Utility - fixes an issue with the scanner lamp not going off Source=Paul Collins Startup list [HPLaptopGamesActiveMenu] Number=3605 Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [HPLJ Config] Number=3606 Confirmed=Y Filename=SetConfig.exe Description=Connects system to networked HP printer. Source=Paul Collins Startup list [HPLogiFinder] Number=3607 Confirmed=U Filename=hp_finder.exe Description=HP LogiFinder helps detect and allows the use of the centre button for the Logitech mouse. Can be disabled if not used Source=Paul Collins Startup list [HpMmKbd] Number=3608 Confirmed=U Filename=HpMmKbd.exe Description=HP's multimedia keyboard driver which enables the end-user to use the automation features of the HP multimedia keyboard Source=Paul Collins Startup list [HPMVTray] Number=3609 Confirmed=U Filename=HPMVTray.exe Description=HP Media Vault Networked Storage Device - System Tray management utility Source=Paul Collins Startup list [HPNT] Number=3610 Confirmed=X Filename=hpdll.exe Description=Malware - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.VB.ku Source=Paul Collins Startup list [hpodblia] Number=3611 Confirmed=N Filename=hpodblia.exe Description=HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Source=Paul Collins Startup list [hpoddt01.exe] Number=3612 Confirmed=N Filename=N/A Description=Installed by the "HP Photo and Imaging Director" software. If you ask for the imaging software, this program will be started Source=Paul Collins Startup list [hpodlb08] Number=3613 Confirmed=N Filename=hpodlb08.exe Description=HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Source=Paul Collins Startup list [hpotdd01.exe] Number=3614 Confirmed=Y Filename=hpotdd01.exe Description=Detection of new imaging, printing and other peripherals on HP machines such as USB printers, cameras and Bluetooth products. "This program is a non-essential process, but should not be terminated unless suspected to be causing problems" Source=Paul Collins Startup list [hpppta] Number=3615 Confirmed=Y Filename=HPPPTA.exe Description=HP parallel port driver for certain hardware Source=Paul Collins Startup list [HpPrinter] Number=3616 Confirmed=X Filename=hpserver.exe Description=Added by the CMJSPY-W TROJAN! Source=Paul Collins Startup list [HPPROPTY] Number=3617 Confirmed=N Filename=HPPROPTY.EXE Description=HP LaserJet Toolbox Source=Paul Collins Startup list [HPPWRSAV] Number=3618 Confirmed=U Filename=HPPWRSAV.EXE Description=Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com, pick your OS option under the SUPPORT tab, follow the instructions and you will find an updated lamp control patch Source=Paul Collins Startup list [hpqcmon] Number=3619 Confirmed=? Filename=hpqcmon.exe Description=From HP and related to digital imaging Source=Paul Collins Startup list [HPSCANMonitor] Number=3620 Confirmed=U Filename=hpsjvxd.exe Description=HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner Source=Paul Collins Startup list [hpScannerFirstBoot] Number=3621 Confirmed=? Filename=scannerfb.exe Description=HP scanner related Source=Paul Collins Startup list [hpsjbmgr] Number=3622 Confirmed=N Filename=hpsjbmgr.exe Description=HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup, unless the scanner is used every day, such as in a business environment Source=Paul Collins Startup list [HPStart] Number=3623 Confirmed=N Filename=hpstart.wsf Description=This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot Source=Paul Collins Startup list [hpsysconf1] Number=3624 Confirmed=X Filename=[random filename] Description=Added by a variant of the VIVIA.A TROJAN! Source=Paul Collins Startup list [hpsysdrv] Number=3625 Confirmed=U Filename=hpsysdrv.exe Description=This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP, if it can't tell that it is an HP it will not run. If unchecked, it can prevent the running of the Application Recovery CDs, the use of the multimedia keys, and the HP Instant Support. Also seen that without it running, the Riptide Sound card that was installed on some older HP computers stops working Source=Paul Collins Startup list [hptools] Number=3626 Confirmed=X Filename=hptools.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [hptools] Number=3627 Confirmed=X Filename=microsoft.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [HPU] Number=3628 Confirmed=N Filename=ProvenTactics.exe Description=Proven Internet Marketing software Source=Paul Collins Startup list [hpWirelessAssistant] Number=3629 Confirmed=U Filename=HP Wireless Assistant.exe Description=The HP Wireless Assistant is a user application that provides a way to control the enablement of individual wireless devices (such as Bluetooth or WLAN devices) and that shows the state of the radios for these wireless devices Source=Paul Collins Startup list [HPZTS04] Number=3630 Confirmed=N Filename=hpzts04.exe Description=Hewlett Packard printer toolbox shortcut that resides in the system tray Source=Paul Collins Startup list [hpztsb02] Number=3631 Confirmed=U Filename=hpztsb02.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpztsb04] Number=3632 Confirmed=U Filename=hpztsb04.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpztsb05] Number=3633 Confirmed=U Filename=hpztsb05.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpztsb07] Number=3634 Confirmed=U Filename=hpztsb07.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpztsb09] Number=3635 Confirmed=U Filename=hpztsb09.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [hpztsbol] Number=3636 Confirmed=U Filename=hpztsbol.exe Description=HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer Source=Paul Collins Startup list [HP_dla] Number=3637 Confirmed=N Filename=dlatray.exe Description=On HP PCs, tray icon for dla - which provides drive letter access to HP's and Veritas' version of DirectCD Source=Paul Collins Startup list [HQI Services] Number=3638 Confirmed=X Filename=hqisvc32.exe Description=Added by the AGOBOT-RO WORM! Source=Paul Collins Startup list [HQI Services] Number=3639 Confirmed=X Filename=hqlsvc32.exe Description=Added by the AGOBOT-RP WORM! Source=Paul Collins Startup list [HR] Number=3640 Confirmed=U Filename=Hr.exe Description=HiddenRecorder periodically takes screenshots of the computer. If you didn't install this yourself remove it Source=Paul Collins Startup list [HREF.OCX] Number=3641 Confirmed=U Filename=regsvr32.exe ....HREF.OCX Description=HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller Source=Paul Collins Startup list [Hrn_qtv] Number=3642 Confirmed=X Filename=hrnsvc32.exe Description=Added by the SDBOT-AET WORM! Source=Paul Collins Startup list [hsim] Number=3643 Confirmed=X Filename=isearch.exe Description=Unidentified malware Source=Paul Collins Startup list [hsim] Number=3644 Confirmed=X Filename=sexgame.exe Description=Unidentified malware Source=Paul Collins Startup list [hsim] Number=3645 Confirmed=X Filename=toolbar.exe Description=Unidentified malware Source=Paul Collins Startup list [HSLAB Logger] Number=3646 Confirmed=U Filename=logger.exe Description=HSLABLogger logs user activity and Internet activity. The gathered information can be sent to a predetermined email address. If you didn't install this yourself uninstall it Source=Paul Collins Startup list [HSTrans] Number=3647 Confirmed=U Filename=hstrans.exe Description=Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen Source=Paul Collins Startup list [HsuGuiControl] Number=3648 Confirmed=? Filename=HsuGuiControl.exe Description=Part of the Starband Internet satellite client. What does it do and is it required? Source=Paul Collins Startup list [Hti] Number=3649 Confirmed=U Filename=npdor.exe Description=Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required Source=Paul Collins Startup list [HTML Help System] Number=3650 Confirmed=X Filename=hhs.pif Description=Added by the RBOT-ATB WORM! Source=Paul Collins Startup list [HTML32 Help System] Number=3651 Confirmed=X Filename=hhs32.pif Description=Added by the RBOT-ATE WORM! Source=Paul Collins Startup list [HTpatch] Number=3652 Confirmed=U Filename=htpatch.exe Description=HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6% Source=Paul Collins Startup list [HtProtect] Number=3653 Confirmed=X Filename=AVprotect.exe Description=Added by the NETSKY.L WORM! Source=Paul Collins Startup list [HTTP Tunneling Server] Number=3654 Confirmed=X Filename=mstunnel.exe Description=Added by the RBOT.EDL WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3655 Confirmed=X Filename=LienVandeKelder.exe Description=Added by the MYTOB-AZ WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3656 Confirmed=X Filename=Lien Van de Kelder.exe Description=Added by the MYTOB-AP WORM and variants! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3657 Confirmed=X Filename=Lien Vande Kelder.exe Description=Added by the MYTOB-AQ WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3658 Confirmed=X Filename=Lien vd Kelder.exe Description=Added by the MYTOB-M WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3659 Confirmed=X Filename=Lien.exe Description=Added by the MYTOB-CZ WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3660 Confirmed=X Filename=Lientjeuh.exe Description=Added by the MYTOB-P WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3661 Confirmed=X Filename=LienVdK.exe Description=Added by the MYTOB-U WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3662 Confirmed=X Filename=Van de Kelder Lien.exe Description=Added by the MYTOB-BF WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.be] Number=3663 Confirmed=X Filename=We Love Lien Van de Kelder.exe Description=Added by the MYTOB-CV WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.com] Number=3664 Confirmed=X Filename=Lien Van de Kelder.exe Description=Added by the MYTOB-EQ WORM! Source=Paul Collins Startup list [http://www.lienvandekelder.com/] Number=3665 Confirmed=X Filename=LienVandeKelder.exe Description=Added by the MYTOB-EO WORM! Source=Paul Collins Startup list [httpd] Number=3666 Confirmed=X Filename=c_pan.exe Description=Added by a variant of the DELF-A TROJAN! Source=Paul Collins Startup list [httpd] Number=3667 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [httpd] Number=3668 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [httpd] Number=3669 Confirmed=X Filename=s_menu.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [httpd] Number=3670 Confirmed=X Filename=browse.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [httpd] Number=3671 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [https-ssl] Number=3672 Confirmed=X Filename=https.exe Description=Added by the MOEGA.D WORM! Source=Paul Collins Startup list [huhdir] Number=3673 Confirmed=? Filename=huhdir.exe Description=?? Source=Paul Collins Startup list [huigezi] Number=3674 Confirmed=X Filename=HgzServer.exe Description=Added by the GRAYBIRD.C TROJAN! Source=Paul Collins Startup list [Hvid] Number=3675 Confirmed=X Filename=Hvid.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [HWINFO*] Number=3676 Confirmed=X Filename=HWINFO* Description=Added by the PUROL WORM! where * is a random character Source=Paul Collins Startup list [HWinst] Number=3677 Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Hwp] Number=3678 Confirmed=X Filename=system_wc.exe Description=Eziin adware Source=Paul Collins Startup list [hws] Number=3679 Confirmed=X Filename=hws.exe Description=Added by the STARTPA-CT TROJAN! Source=Paul Collins Startup list [HWSetup] Number=3680 Confirmed=U Filename=HWSetup.exe hwSetUP Description="Toshiba Hardware Setup is the Toshiba configuration management tool available through Windows." Allows the user to change BIOS, hard disk, memory, boot disk priority and other settings Source=Paul Collins Startup list [hxadsec] Number=3681 Confirmed=X Filename=[path to trojan] Description=Added by the ADCLICK-AP TROJAN! Source=Paul Collins Startup list [HXDL.EXE] Number=3682 Confirmed=X Filename=HXDL.EXE Description=Attune HelpExpress - spyware. Disable and uninstall - see here Source=Paul Collins Startup list [HXIUL.EXE] Number=3683 Confirmed=X Filename=HXIUL.EXE Description=Attune HelpExpress - spyware. Disable and uninstall - see here Source=Paul Collins Startup list [HydarVisionDesktopManager] Number=3684 Confirmed=U Filename=desk95.exe Description=ATI's HydraVision desktop management software, allowing for multi-monitor support, as included in ATI HydraVision versions 2.5 and earlier. Has been reported to cause problems, such as this one. HydraVision can be uninstalled through Add/Remove Programs Source=Paul Collins Startup list [HydraVisionDesktopManager] Number=3685 Confirmed=U Filename=desk98.exe Description=ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup Source=Paul Collins Startup list [HydraVisionViewport] Number=3686 Confirmed=U Filename=viewport.exe Description=ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup Source=Paul Collins Startup list [Hyper Start] Number=3687 Confirmed=X Filename=instantmsgrs.exe Description=Added by the RBOT-NH WORM! Source=Paul Collins Startup list [I am not Ranky. I am eTunnel!] Number=3688 Confirmed=X Filename=msyervice.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [I am not Ranky. I am eTunnel!] Number=3689 Confirmed=X Filename=winsys.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [I am not Ranky. I am eTunnel!] Number=3690 Confirmed=X Filename=disney.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [I-Worm.GiGu] Number=3691 Confirmed=X Filename=uGiG.eXe Description=Added by the GINK WORM! Source=Paul Collins Startup list [I/O Controllers] Number=3692 Confirmed=X Filename=svcnet.exe Description=Added by the TIBIK-B TROJAN! Source=Paul Collins Startup list [I386] Number=3693 Confirmed=X Filename=I386.exe Description=Added by the MYPOWER WORM! Source=Paul Collins Startup list [I81SHELL] Number=3694 Confirmed=? Filename=I81SHELL.exe Description=Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard Source=Paul Collins Startup list [i8kfangui] Number=3695 Confirmed=U Filename=i8kfangui.exe Description=Graphical interface for fan speed control Source=Paul Collins Startup list [IAAnotif] Number=3696 Confirmed=U Filename=iaanotif.exe Description=IAA Event Monitor User Notification Tool - part of Intel� Application Accelerator - "a performance software package for desktop PCs using select Intel� chipsets" that "replaces the ATA drivers that come with Windows with drivers optimized for desktop and mobile PCs." If you use the RAID version it's required to notify you if a RAID 1 disk has failed Source=Paul Collins Startup list [iamapp] Number=3697 Confirmed=Y Filename=iamapp.exe Description=AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago, it's now the Norton Personal Firewall executable as well Source=Paul Collins Startup list [Iamnacho On Irc.MusIrc.com Is a Homosexual!] Number=3698 Confirmed=X Filename=XBox64.exe Description=Added by the RANDEX.Y WORM! Source=Paul Collins Startup list [Iap] Number=3699 Confirmed=? Filename=iap.exe Description=Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely? Source=Paul Collins Startup list [ias] Number=3700 Confirmed=U Filename=ias.exe Description=InvisibleASpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [IASHLPR] Number=3701 Confirmed=X Filename=IASHLPR.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [ibin] Number=3702 Confirmed=X Filename=[path to trojan] Description=Added by the PERDA-C TROJAN! Source=Paul Collins Startup list [ibm] Number=3703 Confirmed=X Filename=ibm.exe Description=Added by the LEGMIR-AH TROJAN! Source=Paul Collins Startup list [IBM Warranty Notification] Number=3704 Confirmed=? Filename=ERTS0749.exe Description=IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? Source=Paul Collins Startup list [ibmmessages] Number=3705 Confirmed=N Filename=ibmmessages.exe Description=Allows IBM to push messages onto users' computers. Quote: "The Access IBM Message Center can display messages to inform you about software and solutions available from IBM as well as messages from IBM eSupport" Source=Paul Collins Startup list [Ibmmon.exe] Number=3706 Confirmed=? Filename=Ibmmon.exe Description=?? Source=Paul Collins Startup list [Ibmpmsvc] Number=3707 Confirmed=U Filename=ibmpmsvc.exe Description=Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn, F3, F4 & F12 - which have specific functions to control the standby and hibernate buttons. Not required if you don't plan to go into standy or hibernate modes Source=Paul Collins Startup list [IBMPRC] Number=3708 Confirmed=? Filename=ibmprc.exe Description=IBM application - what does it do and is it required? Source=Paul Collins Startup list [IBMUltraBayHotSwapCPLLoader] Number=3709 Confirmed=U Filename=IBMBAY2N.EXE Description=Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops Source=Paul Collins Startup list [IBMUltraBayHotSwapSound] Number=3710 Confirmed=? Filename=IBMBAYSN.EXE Description=Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound? Source=Paul Collins Startup list [IBM_PWMGR] Number=3711 Confirmed=Y Filename=pwmgr.exe Description=IBM Password Manager Source=Paul Collins Startup list [IBWin Background process] Number=3712 Confirmed=U Filename=IBackground.exe Description=IBackup for Windows Source=Paul Collins Startup list [IBWin Monitor] Number=3713 Confirmed=U Filename=IBMonitor.exe Description=IBackup for Windows Source=Paul Collins Startup list [IcaBar] Number=3714 Confirmed=Y Filename=icabar.exe Description=Related to Citrix MetaFrame Source=Paul Collins Startup list [icasServ] Number=3715 Confirmed=X Filename=icasServ.exe Description=Browser hijacker, redirecting to Searchforfree.info. Also detected as the ICASERV-A TROJAN! Source=Paul Collins Startup list [ICcontrol] Number=3716 Confirmed=X Filename=iccontrol.exe Description=Added by the ICcontrol premium rate adult content dialer Source=Paul Collins Startup list [icdd7ee6] Number=3717 Confirmed=X Filename=rundll32.exe [path] icdd7ee6.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [icddefff] Number=3718 Confirmed=X Filename=rundll32.exe [path] icddefff.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [ICH Synth] Number=3719 Confirmed=N Filename=eusexe.exe Description=Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices Source=Paul Collins Startup list [icifati] Number=3720 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.ZZH WORM! Source=Paul Collins Startup list [iClean] Number=3721 Confirmed=U Filename=iClean.exe Description=IEClean - "advanced, comprehensive package of tools which perform a number of functions to allow you to control your online privacy" Source=Paul Collins Startup list [ICM] Number=3722 Confirmed=U Filename=ICM.EXE Description=Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail Source=Paul Collins Startup list [iCn] Number=3723 Confirmed=N Filename=NAG.EXE Description=iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy, if they exist. Not related to the Mac icon program of the same name Source=Paul Collins Startup list [ICO] Number=3724 Confirmed=N Filename=ICO.EXE Description=Found on Sony Vaio and IBM Thinkpad (and possibly other) laptops and seems to be related to Mouse Suite 98 Daemon according to the properties. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Source=Paul Collins Startup list [Icon Animation] Number=3725 Confirmed=N Filename=HDE.EXE Description=Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons Source=Paul Collins Startup list [Icon Hearit 95] Number=3726 Confirmed=N Filename=hearit95.exe Description=Audio desktop customization utility from Moon Valley Software. Resource hog Source=Paul Collins Startup list [Icon Hearit 98] Number=3727 Confirmed=N Filename=hearit98.exe Description=Audio desktop customization utility from Moon Valley Software. Resource hog Source=Paul Collins Startup list [Icon lptt01] Number=3728 Confirmed=X Filename=icon.exe Description=RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Icon ml097e] Number=3729 Confirmed=X Filename=icon.exe Description=RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [ICONCLNT] Number=3730 Confirmed=Y Filename=iconclnt.exe Description=APC PowerChute Tray Icon. Associated with the UPS listing Source=Paul Collins Startup list [ICONDESK] Number=3731 Confirmed=U Filename=ICONDESK.EXE Description=Small utility which will allow you the option of hiding or showing your desktop icons Source=Paul Collins Startup list [Iconfig.exe] Number=3732 Confirmed=N Filename=Iconfig.exe Description=Icon for LS-120 "Superdisk" Source=Paul Collins Startup list [iConfigLoader] Number=3733 Confirmed=X Filename=DIIhost.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Iconoid] Number=3734 Confirmed=N Filename=Iconoid.exe Description=Iconoid is a desktop icon manager Source=Paul Collins Startup list [Iconsaver] Number=3735 Confirmed=N Filename=Iconsaver.exe Description=IconSaver is a desktop icon manager Source=Paul Collins Startup list [ICQ] Number=3736 Confirmed=X Filename=ICQNET.vbs Description=Added by the GORMLEZ-A WORM! Source=Paul Collins Startup list [ICQ Center] Number=3737 Confirmed=X Filename=[path to worm] Description=Added by the RANDIN WORM! Source=Paul Collins Startup list [ICQ Chat Service] Number=3738 Confirmed=X Filename=icqjdhs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [ICQ Hacking Pro] Number=3739 Confirmed=X Filename=ICQpro.exe Description=Added by a variant of the NETSPY TROJAN! Source=Paul Collins Startup list [ICQ Lite] Number=3740 Confirmed=N Filename=ICQLite.exe Description=ICQ Lite - compact version of the popular messaging program Source=Paul Collins Startup list [icq lite] Number=3741 Confirmed=X Filename=scvhost.exe Description=Added by the AGENT-DSF TROJAN! Source=Paul Collins Startup list [icq lite] Number=3742 Confirmed=X Filename=winlog.exe Description=Added by the IRCBOT-TJ TROJAN! Source=Paul Collins Startup list [ICQ Lite Messenger] Number=3743 Confirmed=X Filename=[random filename] Description=Added by an unidentified VIRUS, WORM or TROJAN! Unlike the legitimate ICQ Lite executable, which will be located in the ICQLITE folder in Program Files, this particular impostor is located in the Windows or Winnt\System32 directory Source=Paul Collins Startup list [ICQ Messenger 2002] Number=3744 Confirmed=X Filename=ICQ2002.exe Description=Added by the SDBOT-ABL WORM! Source=Paul Collins Startup list [ICQ Net] Number=3745 Confirmed=X Filename=winlogon.exe Description=Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [ICQ Plus] Number=3746 Confirmed=N Filename=vplus.exe Description=ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs Source=Paul Collins Startup list [IcqBeta] Number=3747 Confirmed=X Filename=webcamupdate.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [ICQNet] Number=3748 Confirmed=X Filename=winlogon.exe Description=Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [icrosof Avps32 Control] Number=3749 Confirmed=X Filename=av32.pif Description=Added by the RBOT-AVC WORM! Source=Paul Collins Startup list [icrosoft Visual] Number=3750 Confirmed=X Filename=plscx.exe Description=Added by the RBOT-AYO WORM! Source=Paul Collins Startup list [icrosoft Visual InterDevc] Number=3751 Confirmed=X Filename=zvslmqb.exe Description=Added by the RBOT-AYP WORM! Source=Paul Collins Startup list [icrosoft Windows DLL Services Configuration] Number=3752 Confirmed=X Filename=poker3.exe Description=Added by the SDBOT-AER WORM! Source=Paul Collins Startup list [icrosoftf Avpx Control] Number=3753 Confirmed=X Filename=avpx.exe Description=Added by the RBOT-AYN WORM! Source=Paul Collins Startup list [ICSDCLT] Number=3754 Confirmed=U Filename=rundll32.exe Icsdclt.dll, ICSClient Description=Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines Source=Paul Collins Startup list [ICServer] Number=3755 Confirmed=N Filename=Icserver.exe Description=Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations Source=Paul Collins Startup list [ICSMGR] Number=3756 Confirmed=Y Filename=ICSMGR.EXE Description=Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers Source=Paul Collins Startup list [IC_KEY_3] Number=3757 Confirmed=N Filename=spvic.exe Description=Instant Chess related Source=Paul Collins Startup list [ID Commander] Number=3758 Confirmed=N Filename=IDCom.exe Description=Caller ID utility for identifying incoming telephone numbers Source=Paul Collins Startup list [ID8525] Number=3759 Confirmed=X Filename=ID8525.exe Description=Added by the ID8525.A TROJAN! Source=Paul Collins Startup list [ID8525] Number=3760 Confirmed=X Filename=id85255.exe Description=Added by the ID8525.A TROJAN! Source=Paul Collins Startup list [IDA] Number=3761 Confirmed=? Filename=IDA.EXE Description=HP related - in a Program FilesHewlett-PackardPC COE folder Source=Paul Collins Startup list [IDE] Number=3762 Confirmed=X Filename=ide.exe Description=Added by the ASSASIN.F TROJAN! Source=Paul Collins Startup list [IDE Loader] Number=3763 Confirmed=X Filename=IDElibr32.exe Description=Added by the XILON TROJAN! Related to the game "Diablo II" Source=Paul Collins Startup list [idecntl] Number=3764 Confirmed=X Filename=idecntl.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [iDesktop] Number=3765 Confirmed=U Filename=idesktop.exe Description=Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse Source=Paul Collins Startup list [IDMan] Number=3766 Confirmed=N Filename=IDMan.exe Description=Internet Download Manager - download files faster, schedule and resume Source=Paul Collins Startup list [IDTemplates] Number=3767 Confirmed=X Filename=IDTemplate.exe Description=Added by the BRONTOK-H WORM! Source=Paul Collins Startup list [IDW Logging Tool] Number=3768 Confirmed=N Filename=idwlog.exe Description=Added with WinXP SP1. Usually only found in internal builds only to indicate the current build being used. Can cause slow network logon problems Source=Paul Collins Startup list [IE configure] Number=3769 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-C TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [IE Doctor] Number=3770 Confirmed=U Filename=IEDoctor.exe Description=IE Doctor Toolbar - "IE Doctor can help you to Repair IE easily, protect IE and OE from all malicious changes. It can Repair the HomePage, context menu, IE toolbar button, startup items, Favorites, typed URLs and the entire Internet Options" Source=Paul Collins Startup list [IE Java Update] Number=3771 Confirmed=X Filename=iejava.exe Description=Added by the AGENT-HD TROJAN! Source=Paul Collins Startup list [IE Menu Extension toolbar] Number=3772 Confirmed=X Filename=rundll32.exe [path] tbextn.dll DllShowTB Description=Topconverting.com\180Search "IEMenuExtension" toolbar Source=Paul Collins Startup list [IE New Window Maximizer] Number=3773 Confirmed=U Filename=iemaximizer.exe Description=IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows Source=Paul Collins Startup list [IE Runtime] Number=3774 Confirmed=X Filename=wini.exe Description=Added by the PICRATE.B WORM! Source=Paul Collins Startup list [IE Runtimes] Number=3775 Confirmed=X Filename=winis.exe Description=Added by the RBOT-ADZ TROJAN! Source=Paul Collins Startup list [IE**.exe [* = random char]] Number=3776 Confirmed=X Filename=IE**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [IE**32.exe [* = random char]] Number=3777 Confirmed=X Filename=IE**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [IE-Bar] Number=3778 Confirmed=X Filename=iebar.exe Description=DesktopMedia adware Source=Paul Collins Startup list [IE6] Number=3779 Confirmed=X Filename=wkstmg.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [IE6] Number=3780 Confirmed=X Filename=ssmss.exe Description=Added by the GAOBOT.DXO WORM! Source=Paul Collins Startup list [IE6] Number=3781 Confirmed=X Filename=porn.pif Description=Added by the RBOT-ATF WORM! Source=Paul Collins Startup list [IEACCESS] Number=3782 Confirmed=X Filename=temp532.exe Description=AsdPlug premium rate adult content dialer variant Source=Paul Collins Startup list [IEACCESS] Number=3783 Confirmed=X Filename=surfya.exe Description=IEAccess premium rate adult content dialer variant Source=Paul Collins Startup list [IEAgent update check] Number=3784 Confirmed=X Filename=iewatch.exe Description=Added by the BOMKA TROJAN! Source=Paul Collins Startup list [iecheck] Number=3785 Confirmed=N Filename=iecheck.exe Description=Integrity checker for IconEdit2 icon editor. It serves for IconEdit2 internal tasks only and can be safely deleted from the system if you are running the latest version of IconEdit2 Source=Paul Collins Startup list [IECheck] Number=3786 Confirmed=X Filename=MSDTCs.exe Description=Added by the TIRBOT-D WORM! Source=Paul Collins Startup list [IECheck] Number=3787 Confirmed=X Filename=xpssl.exe Description=Added by the TIRBOT-E WORM! Source=Paul Collins Startup list [IECheck] Number=3788 Confirmed=X Filename=mssvp.exe Description=Added by the TIRBOT-G WORM! Source=Paul Collins Startup list [IECleanAux] Number=3789 Confirmed=U Filename=Ieboot6.exe Description=IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc. Performs cleaning tasks at startup Source=Paul Collins Startup list [iedll] Number=3790 Confirmed=X Filename=iedll.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com Source=Paul Collins Startup list [IEDriver] Number=3791 Confirmed=X Filename=IEDriver.exe Description=Installed as part of adware (Cydoor) based peer-to-peer file sharing software called URLBlaze Source=Paul Collins Startup list [IEDriver] Number=3792 Confirmed=X Filename=xplore.exe Description=IEDriver adware variant Source=Paul Collins Startup list [IEDriver] Number=3793 Confirmed=X Filename=TD.exe Description=IEDriver adware variant Source=Paul Collins Startup list [IEengine] Number=3794 Confirmed=X Filename=IEeng.exe Description=STARTPAG.AI hijacker Source=Paul Collins Startup list [IEFeatures] Number=3795 Confirmed=X Filename=IEFeatures.exe Description=Added by the POPMON.A TROJAN! - also known as PopMonster adware Source=Paul Collins Startup list [IEFeatures] Number=3796 Confirmed=X Filename=Internetfeatures.exe Description=Added by the POPMON.A TROJAN! - also known as PopMonster adware Source=Paul Collins Startup list [IefxTray] Number=3797 Confirmed=X Filename=IefxTray.exe Description=Added by the RILER-H TROJAN! Source=Paul Collins Startup list [ieharv.exe] Number=3798 Confirmed=X Filename=ieharv.exe Description=Added by the BANKER-HH TROJAN! Source=Paul Collins Startup list [Iehelper] Number=3799 Confirmed=X Filename=syslaunch.exe Description=Outwar adware downloader Source=Paul Collins Startup list [iel2cde8] Number=3800 Confirmed=X Filename=rundll32.exe [path] iel2cde8.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [ielcaabe] Number=3801 Confirmed=X Filename=rundll32.exe [path] ielcaabe.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [IELoader32] Number=3802 Confirmed=X Filename=iexplore32.exe Description=Added by the SPEX or SPEX.B WORMS! Source=Paul Collins Startup list [Iesar] Number=3803 Confirmed=X Filename=Iesar.exe Description=Browser hijacker - redirecting to an adult web page Source=Paul Collins Startup list [Iesearch.exe] Number=3804 Confirmed=X Filename=Iesearch.exe Description=LookNSearch adware Source=Paul Collins Startup list [IESet] Number=3805 Confirmed=X Filename=IExplorer.dll Description=Added by the PWS-BLUEDIT TROJAN! Source=Paul Collins Startup list [iestart] Number=3806 Confirmed=X Filename=iexp1orer.exe Description=Added by the NEMOG.C TROJAN! Source=Paul Collins Startup list [ietsr] Number=3807 Confirmed=N Filename=ietsr.exe Description=IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc Source=Paul Collins Startup list [ieupdate] Number=3808 Confirmed=X Filename=MCP****.exe [**** = random char] Description=Added by the ASOXY TROJAN! Source=Paul Collins Startup list [ieupdate] Number=3809 Confirmed=X Filename=mcpdll32.exe Description=Adware downloader trojan Source=Paul Collins Startup list [IEXPL0RER] Number=3810 Confirmed=X Filename=IEXPL0RER.EXE Description=Added by the AGOBOT-QL WORM! Note the filename has a "0" rather than an upper case "o" Source=Paul Collins Startup list [iexpl0res] Number=3811 Confirmed=X Filename=iexpl0res.exe Description=Added by the RBOT.AEX WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot Source=Paul Collins Startup list [IExploer] Number=3812 Confirmed=X Filename=svshosts.exe Description=Added by the IRCBOT.BT TROJAN! Source=Paul Collins Startup list [Iexploit] Number=3813 Confirmed=X Filename=Iexploit.html Description=Added by the INKER.B WORM! Source=Paul Collins Startup list [Iexplore] Number=3814 Confirmed=X Filename=iexplore.exe Description=Added by the BOXER TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [IEXPLORE] Number=3815 Confirmed=X Filename=iexplore.exe Description=Added by the APHEXDOOR TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [IExplore] Number=3816 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the DLOADER-YZ TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a "Custom" subfolder Source=Paul Collins Startup list [IExplore] Number=3817 Confirmed=X Filename=IEXPLORE.exe Description=Added by the DLOADR-AAM TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the "Arquivos de programas\Internet Explorer\Custom" folder Source=Paul Collins Startup list [IEXPLORE] Number=3818 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the BANKER-BWE TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Iexplore Services] Number=3819 Confirmed=X Filename=iexplore.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [IEXPLORE.EXE] Number=3820 Confirmed=X Filename=[path to trojan] Description=Added by the BANCOS-CJ TROJAN! Source=Paul Collins Startup list [IEXPLORE.EXE] Number=3821 Confirmed=X Filename=goot.exe Description=Added by the BIFROSE-C TROJAN! Source=Paul Collins Startup list [IExplorer] Number=3822 Confirmed=X Filename=Iexplor32.exe Description=Added by the BDOOR-BY TROJAN! Source=Paul Collins Startup list [IExplorer] Number=3823 Confirmed=X Filename=IExplorer.EXE Description=Added by the BANCOS-CH TROJAN! Source=Paul Collins Startup list [IEXPLORER] Number=3824 Confirmed=X Filename=msiecfg.exe Description=Added by the JU or BANCBAN-IP TROJANS! Source=Paul Collins Startup list [Iexplorer] Number=3825 Confirmed=X Filename=explorer.exe Description=Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System folder Source=Paul Collins Startup list [iexplorer lptt01] Number=3826 Confirmed=X Filename=iexplorer.exe Description=RapidBlaster variant (in a "iexplorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [iexplorer ml097e] Number=3827 Confirmed=X Filename=iexplorer.exe Description=RapidBlaster variant (in a "iexplorer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Iexplorer.exe] Number=3828 Confirmed=X Filename=Iexplorer.exe Description=Added by the BANCBAN-EN TROJAN! Source=Paul Collins Startup list [IExplorer32 Java Scripting] Number=3829 Confirmed=X Filename=IExplore32b.exe Description=Added by the RBOT.ABO WORM! Source=Paul Collins Startup list [IExplorer32c Java Scripting] Number=3830 Confirmed=X Filename=IExplore32cb.exe Description=Added by the RBOT.ABN WORM! Source=Paul Collins Startup list [IExplorer6 Java Scripting] Number=3831 Confirmed=X Filename=IExplore326.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [IExplorer7 Java Scripting] Number=3832 Confirmed=X Filename=IExplore327.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ifp] Number=3833 Confirmed=X Filename=ipf.exe Description=Added by the CLAGGER-AG TROJAN! Source=Paul Collins Startup list [IFSplash.exe] Number=3834 Confirmed=U Filename=IFSplash.exe Description=I-FORCE driver for force feedback steering wheel Source=Paul Collins Startup list [igamatu] Number=3835 Confirmed=X Filename=ekor.exe Description=Added by the SDBOT.AQ TROJAN! Source=Paul Collins Startup list [igamatu] Number=3836 Confirmed=X Filename=atecaca.exe Description=Added by the IRCBOT.R WORM! Source=Paul Collins Startup list [igfxtray] Number=3837 Confirmed=U Filename=igfxtray.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. Quick access to the control panel via a System Tray icon. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Iglpbv] Number=3838 Confirmed=? Filename=Iglpbv.exe Description=?? Source=Paul Collins Startup list [igndlm.exe] Number=3839 Confirmed=N Filename=DLM.exe Description=IGN Download Manager has become a requirement for downloading files through FilePlanet.com. It is based on Internet Explorer and it installs through an ActiveX-plugin, hence Internet Explorer must be installed beforehand and downloads has to be initialized through that browser Source=Paul Collins Startup list [igsex2x] Number=3840 Confirmed=X Filename=igsex2x.exe Description=NewDial premium rate adult content dialler Source=Paul Collins Startup list [iHP-100] Number=3841 Confirmed=? Filename=iHPDetect.exe Description=Drive Letter Searcher, iRiver iHP-100 iHP and H Series player related - does it need to start with Windows every time? Source=Paul Collins Startup list [iilc] Number=3842 Confirmed=X Filename=IILC.EXE Description=Homepage hijacker Source=Paul Collins Startup list [Iinl] Number=3843 Confirmed=X Filename=iptl.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [iisvers] Number=3844 Confirmed=X Filename=iisvers.exe Description=Added by an unidentified TROJAN or adware Source=Paul Collins Startup list [iIWiper] Number=3845 Confirmed=N Filename=Systemwiper.exe Description=System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis Source=Paul Collins Startup list [IJ75P2PSERVER] Number=3846 Confirmed=Y Filename=IJ75P2PS.EXE Description=Printer utility which is required in order to make the printer work correctly Source=Paul Collins Startup list [IKE Service 95] Number=3847 Confirmed=Y Filename=IKEService.exe Description=Associated with PGP. The PGP Tray can be disabled, but without IKESERVICE you won't be able to de- or encrypt anything Source=Paul Collins Startup list [iKeyWorks] Number=3848 Confirmed=U Filename=IKEYMAIN.EXE Description=A4Tech wireless keyboard driver and utility Source=Paul Collins Startup list [iLLeGaL] Number=3849 Confirmed=X Filename=Mplayer.exe Description=Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename Source=Paul Collins Startup list [iLLeGaL.exe] Number=3850 Confirmed=X Filename=Mplayer.exe Description=Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename Source=Paul Collins Startup list [ILO_Office_Manager] Number=3851 Confirmed=? Filename=IntEdReg.exe /OFFMAN Description=Intense Educational Ltd - Language Office Software. Is it required? Source=Paul Collins Startup list [iLyric] Number=3852 Confirmed=U Filename=iLyric.exe Description=iLyric plugin for Winamp media player. Allows you to retrieve the lyrics for your songs with the press of a button Source=Paul Collins Startup list [iM Start Center] Number=3853 Confirmed=N Filename=iM_Tray.exe Description=Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner Source=Paul Collins Startup list [Image] Number=3854 Confirmed=X Filename=rundll32 image.dll, Install Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Image & Restore] Number=3855 Confirmed=Y Filename=IMAGE32.exe Description=Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased, if Image was recently run Source=Paul Collins Startup list [Image Transfer] Number=3856 Confirmed=N Filename=SonyTray.exe Description=Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually Source=Paul Collins Startup list [ImageDrive-{hex numbers}] Number=3857 Confirmed=U Filename=ImageDrive.exe Description=Nero ImageDrive from Ahead - virtual CD/DVD drive software Source=Paul Collins Startup list [Imagefox] Number=3858 Confirmed=U Filename=imagefox.exe Description=ImageFox 2.0 (formerly available from ACDSee) is an "add-on" graphics previewer for most Windows Open/Save As dialog boxes Source=Paul Collins Startup list [Imagemgt32] Number=3859 Confirmed=X Filename=Imagemgt32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [ImagePath] Number=3860 Confirmed=X Filename=taskbarmngr.exe Description=Added by the SDBOT-XB WORM! Source=Paul Collins Startup list [IMAPI] Number=3861 Confirmed=X Filename=load.exe Description=Added by the DOWNDEL-A TROJAN! Source=Paul Collins Startup list [iMarkup Client] Number=3862 Confirmed=N Filename=iUtil.exe Description=Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs Source=Paul Collins Startup list [Imatio] Number=3863 Confirmed=U Filename=imation.exe Description=Imation Disk Manager - enables you to create a password protected area on your Imation USB flash drive Source=Paul Collins Startup list [IMClass] Number=3864 Confirmed=X Filename=Svhosl.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [imekrig] Number=3865 Confirmed=N Filename=imekrig.exe Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) Source=Paul Collins Startup list [IMEKRMIG6.1] Number=3866 Confirmed=N Filename=IMEKRMIG.EXE Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) Source=Paul Collins Startup list [Imesh] Number=3867 Confirmed=N Filename=?? Description=Imesh is a file sharing system Source=Paul Collins Startup list [Imesh Auto Update] Number=3868 Confirmed=N Filename=?? Description=Update check for the Imesh file sharing system. Turn the update off under "options" Source=Paul Collins Startup list [IMEvtMgr.exe] Number=3869 Confirmed=X Filename=IMEvtMgr.exe Description=Added by the KEYLOG-AR TROJAN! Source=Paul Collins Startup list [ImgIcon] Number=3870 Confirmed=U Filename=ImgIcon.exe Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [imgit] Number=3871 Confirmed=X Filename=[path to file] Description=Added by the BANKER-EM TROJAN! Source=Paul Collins Startup list [ImgStart] Number=3872 Confirmed=N Filename=ImgStart.exe Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Imjpmig*.*] Number=3873 Confirmed=N Filename=IMJPMIG.EXE Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Korean and this one is Japanese). *.* represents the version number Source=Paul Collins Startup list [immcheck.exe] Number=3874 Confirmed=? Filename=immcheck.exe Description=Related to I-FORCE driver for force feedback steering wheel? Source=Paul Collins Startup list [ImMsn] Number=3875 Confirmed=X Filename=timed.exe Description=Added by the WEBDOR.AK TROJAN! Source=Paul Collins Startup list [IMOL] Number=3876 Confirmed=U Filename=IMOLApp.exe Description=IncrediMail for Office Outlook Add-On Source=Paul Collins Startup list [Imonitor] Number=3877 Confirmed=N Filename=Plguni.exe Description=McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Source=Paul Collins Startup list [imonitor] Number=3878 Confirmed=X Filename=[path to trojan] Description=Added by the IMONI-A TROJAN! Source=Paul Collins Startup list [IMONTRAY] Number=3879 Confirmed=U Filename=imontray.exe Description=System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you change PCMCIA cards Source=Paul Collins Startup list [IMprocess] Number=3880 Confirmed=X Filename=IM-svr.EXE Description=IMNames adware Source=Paul Collins Startup list [IMStart] Number=3881 Confirmed=U Filename=IMStart.exe Description=InterMute security software related Source=Paul Collins Startup list [imwinsrvc] Number=3882 Confirmed=X Filename=acpmonsrv.exe Description=Added by the SLAPER.E TROJAN! Source=Paul Collins Startup list [IMwire] Number=3883 Confirmed=X Filename=imwireup.exe Description=SafeSurfing adware variant Source=Paul Collins Startup list [im_autorn] Number=3884 Confirmed=X Filename=im_1.exe Description=Added by the IMAV.A WORM! Source=Paul Collins Startup list [im_autorn] Number=3885 Confirmed=X Filename=im_2.exe Description=Added by the BAGLEDL-BO TROJAN! Source=Paul Collins Startup list [InCD] Number=3886 Confirmed=Y Filename=incd.exe Description=Ahead InCD packet writing software - similar to DirectCD. For Nero 5.0 or 5.5 (InCD3), it does not need to start with Windows. You can run InCD.exe manually before inserting an appropriately formatted CD-RW (CD-MRW) disk. For Nero 6.0, 6.3 or 6.6 (InCD4), it does need to start with Windows. It does not function correctly when you try to run it manually, and you will not have write access to MRW (Mount Rainier) formatted CD-RW (CD-MRW) or DVD-MRW disks. To regain write access and other features, InCD 4 must start with Windows Source=Paul Collins Startup list [IncMail] Number=3887 Confirmed=N Filename=IncMail.exe Description="IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality" Source=Paul Collins Startup list [InControl Desktop Manager] Number=3888 Confirmed=N Filename=DMHKEY.EXE Description=For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs Source=Paul Collins Startup list [Incredimail] Number=3889 Confirmed=N Filename=incredimail.exe Description="IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality" Source=Paul Collins Startup list [Incredimail] Number=3890 Confirmed=N Filename=IncMail.exe Description="IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality" Source=Paul Collins Startup list [Index Service] Number=3891 Confirmed=X Filename=dllhost32.exe Description=Added by the AGOBOT.CH WORM! Source=Paul Collins Startup list [Index Washer] Number=3892 Confirmed=U Filename=WashIdx.exe Description=Window Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [Indexindicator] Number=3893 Confirmed=X Filename=Indexindicator.exe Description=Added by the LAZAR TROJAN! Source=Paul Collins Startup list [IndexSearch] Number=3894 Confirmed=N Filename=IndexSearch.exe Description=Associated with PaperPort scanner software from ScanSoft Source=Paul Collins Startup list [IndexTray] Number=3895 Confirmed=U Filename=IndexTray.exe Description=Part of Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents" Source=Paul Collins Startup list [ine] Number=3896 Confirmed=X Filename=svchosts.exe Description=Added by the RBOT.BNL WORM! Source=Paul Collins Startup list [Inet DataBase] Number=3897 Confirmed=X Filename=Inetdbs.exe Description=Added by the QEDS WORM! Source=Paul Collins Startup list [Inet Delivery] Number=3898 Confirmed=X Filename=inetdl.exe Description=Inet Delivery adware Source=Paul Collins Startup list [Inet Delivery] Number=3899 Confirmed=X Filename=inetdl_2.exe Description=Inet Delivery adware Source=Paul Collins Startup list [Inetapi] Number=3900 Confirmed=X Filename=Netapi.exe Description=Added by the NETDEVIL.14 TROJAN! Source=Paul Collins Startup list [inetcntrl] Number=3901 Confirmed=U Filename=inetcntrl.exe Description=Bsafe Online - internet filter Source=Paul Collins Startup list [InetConf] Number=3902 Confirmed=? Filename=inetconf.exe Description=?? Source=Paul Collins Startup list [Inetd] Number=3903 Confirmed=U Filename=INETD32.EXE Description=Windows Inet Daemon from Hummingbird Communications. "Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons". Provides PCs with the full functionality of a UNIX workstation Source=Paul Collins Startup list [inetinfo.exe] Number=3904 Confirmed=U Filename=inetinfo.exe Description=Executable used by MS Internet Information Server (IIS). If it's running, then so is IIS. Useful in knowing whether you require the patch for the Code Red worm. Comes with PWS (Personal Web Server) or NT4 and handles ASP-, PHP code (+ more) Source=Paul Collins Startup list [inetinfomon manager] Number=3905 Confirmed=X Filename=inetinfomon.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [inetmgr] Number=3906 Confirmed=X Filename=inetmgr.exe Description=Actual Names (AdvSearch) Internet Keywords parasite Source=Paul Collins Startup list [InetMSN] Number=3907 Confirmed=X Filename=msnet.exe Description=Added by a variant of the SDBOT TROJAN! Source=Paul Collins Startup list [InetServices] Number=3908 Confirmed=X Filename=wsock32.exe Description=Added by the WOCK32-A TROJAN! Source=Paul Collins Startup list [infamous.exe] Number=3909 Confirmed=X Filename=wmplayer.exe Description=Added by unknown malware. WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup. Infamous.exe is identified by Panda antivirus as Trj/Briss.A Source=Paul Collins Startup list [Info Select] Number=3910 Confirmed=U Filename=is.exe Description=Info Select from Micro Logic - personal information manager Source=Paul Collins Startup list [Info32x] Number=3911 Confirmed=X Filename=Info32x.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [InfoPenMSN] Number=3912 Confirmed=U Filename=InfoPenIM.exe Description=InfoPenMSN is a MSN Messenger plugin that allows you to send data written/drawn by hand Source=Paul Collins Startup list [Infoplay.exe] Number=3913 Confirmed=? Filename=Infoplay.exe Description=Written by New Media Properties, LLC and you're asked if you want to download and install it if you visit one of their search engine websites (which I chose not to). What does it do and is it needed? Source=Paul Collins Startup list [Information Update] Number=3914 Confirmed=X Filename=iu.exe Description=Recognized by Kaspersky antivirus as Downloader.Win32.Centim.ch TROJAN! Note - the file associated with this is located in the Program Files\Information Update folder Source=Paul Collins Startup list [Infra-red Monitor] Number=3915 Confirmed=U Filename=IRMON.EXE Description=System Tray access to infra-red devices. Not required unless you use infra-red devices Source=Paul Collins Startup list [infus] Number=3916 Confirmed=X Filename=infus.exe Description=Adult content dialler Source=Paul Collins Startup list [Infuzer] Number=3917 Confirmed=U Filename=Infuzer.exe Description=Infuzer - "is a service that copies dates from the web or an email straight to your electronic calendar". Beware of the following adware trait - "Infuzer provides web site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them, as well as increasing return visits and brand awareness, and providing new e-commerce opportunities" Source=Paul Collins Startup list [infwin] Number=3918 Confirmed=X Filename=infwin.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [Init32] Number=3919 Confirmed=X Filename=Init32.exe Description=Added by the WINEX.A TROJAN! Source=Paul Collins Startup list [Initial Page] Number=3920 Confirmed=X Filename=install.exe Description=EasySearch browser hijack installer Source=Paul Collins Startup list [Initialize8x8] Number=3921 Confirmed=Y Filename=8x8_init.exe Description=Tool that initializes a Pinnacle PCTV card - maybe in capture or in showing overlay Source=Paul Collins Startup list [injob] Number=3922 Confirmed=X Filename=injobs.exe Description=Added by the BINJO TROJAN! Source=Paul Collins Startup list [Ink Monitor] Number=3923 Confirmed=N Filename=InkMonitor.exe Description=Associated with Epson (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line Source=Paul Collins Startup list [InkWatch] Number=3924 Confirmed=N Filename=InkWatch.exe Description=Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line Source=Paul Collins Startup list [InoRPC] Number=3925 Confirmed=Y Filename=InoRpc.exe Description=Associated with eTrust Antivirus/InoculateIT Source=Paul Collins Startup list [InoRT] Number=3926 Confirmed=Y Filename=InoRT9x.exe Description=Associated with the Realtime Monitor of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. For NT/2K/XP users you may need a patch if seeing high CPU useage Source=Paul Collins Startup list [InoTask] Number=3927 Confirmed=U Filename=InoTask.exe Description=Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates Source=Paul Collins Startup list [insCOA5] Number=3928 Confirmed=? Filename=insCOA5.exe Description=?? Source=Paul Collins Startup list [InstaAlert] Number=3929 Confirmed=U Filename=InstaAlert.exe Description="Kayako InstaAlert allows you to receive realtime alerts whenever a ticket gets updated under the assigned departments. The application displays popups as and when the tickets are created or replied to allowing you to answer your customer requests and issues promptly" Source=Paul Collins Startup list [InstaFinderK] Number=3930 Confirmed=X Filename=InstaFinderK inst.exe Description=InstaFinder adware Source=Paul Collins Startup list [Install] Number=3931 Confirmed=X Filename=Install.exe Description=Added by the BANCBAN-HG TROJAN! Source=Paul Collins Startup list [Install Pending Files] Number=3932 Confirmed=? Filename=sifxinst.exe Description=Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required? Source=Paul Collins Startup list [InstallAurealDemos] Number=3933 Confirmed=N Filename=InstallAurealDemos.js Description=Used to initialize the Aureal A3D demos InstallShield wizard Source=Paul Collins Startup list [InstallBuddy] Number=3934 Confirmed=U Filename=Ibtna.exe Description=InstallBuddy - automatically translates and installs your desktop documents, such as Adobe PDF, HTML, Microsoft Word, Excel and PowerPoint files, to your Palm organizer when you HotSync Source=Paul Collins Startup list [Installed shell32.dll] Number=3935 Confirmed=X Filename=Office.exe... Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Installer] Number=3936 Confirmed=X Filename=dial.exe Description=Malware - recognized by Kaspersky antivirus as the AGENT.MM TROJAN! Source=Paul Collins Startup list [InstallNAIProduct] Number=3937 Confirmed=? Filename=SETUP.EXE Description=Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error? Source=Paul Collins Startup list [Installs SP2] Number=3938 Confirmed=X Filename=[path] repcale.exe [path] palsp.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [Installstub] Number=3939 Confirmed=U Filename=installstub.exe Description=Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone Source=Paul Collins Startup list [Instance 001] Number=3940 Confirmed=X Filename=[path to worm] Description=Added by the Alasrou-A WORM! Source=Paul Collins Startup list [Instant Access] Number=3941 Confirmed=X Filename=rundll32.exe EGDHTML_1023.dll, InstantAccess Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3942 Confirmed=X Filename=rundll32.exe eg_auth_****.dll, InstantAccess [**** = digits] Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3943 Confirmed=X Filename=rundll32.exe EGCOMLIB_****.dll, InstantAccess [**** = digits] Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3944 Confirmed=X Filename=rundll32.exe EGCOMSERVICE_****.dll, InstantAccess [**** = digits] Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3945 Confirmed=X Filename=rundll32.exe EGDACCESS_****.dll, InstantAccess [**** = digits] Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3946 Confirmed=X Filename=rundll32.exe p2esocks_****.dll, InstantAccess [**** = digits] Description=Electronic_Group/InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Access] Number=3947 Confirmed=X Filename=mwsrvacc.exe Description=InstantAccess premium rate adult content dialer Source=Paul Collins Startup list [Instant Access] Number=3948 Confirmed=X Filename=linewsrv.exe Description=InstantAccess premium rate adult content dialer variant Source=Paul Collins Startup list [Instant Buzz Daemon] Number=3949 Confirmed=X Filename=IBDaemon.exe Description=Instant Buzz adware Source=Paul Collins Startup list [Instant Update Center] Number=3950 Confirmed=N Filename=reminder.exe Description=From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it keeps re-checking itself when using MSCONFIG. PrintMaster 11 uses filename PMremind.exe - it has to be unchecked in startup in the same manner Source=Paul Collins Startup list [Instant Wireless Configuration Utility] Number=3951 Confirmed=U Filename=WUSB11cfg.exe Description=Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Source=Paul Collins Startup list [Instant Wireless Configuration Utility] Number=3952 Confirmed=U Filename=WPC11Cfg.exe Description=Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Source=Paul Collins Startup list [InstantAccess] Number=3953 Confirmed=N Filename=INSTAN~1.EXE Description=From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs Source=Paul Collins Startup list [InstantDrive] Number=3954 Confirmed=U Filename=InstantDrive.exe Description=Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software Source=Paul Collins Startup list [InstantPleasure] Number=3955 Confirmed=X Filename=instantpleasure.exe Description=Adult content dialler Source=Paul Collins Startup list [InstantPleasureXXX] Number=3956 Confirmed=X Filename=instantpleasurexxx.exe Description=Adult content dialler Source=Paul Collins Startup list [InstantTray] Number=3957 Confirmed=N Filename=PCLETray.exe Description=Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually Source=Paul Collins Startup list [instit] Number=3958 Confirmed=X Filename=instit.bat Description=Added by the OPASERV.H WORM! Source=Paul Collins Startup list [instit] Number=3959 Confirmed=X Filename=INSTIT.BAT Description=Added by the OPASERV.K WORM! Source=Paul Collins Startup list [InstUtlR.exe] Number=3960 Confirmed=? Filename=InstUtlR.exe Description=?? Source=Paul Collins Startup list [intdctrr] Number=3961 Confirmed=X Filename=idctup20.exe Description=SafeSurfing adware variant Source=Paul Collins Startup list [Intec Service Drivers] Number=3962 Confirmed=X Filename=msmsgrs.exe Description=Added by the SDBOT-ADN WORM! Source=Paul Collins Startup list [Intec Service Drivers] Number=3963 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-GLU WORM! Source=Paul Collins Startup list [Intec Services Driverrs] Number=3964 Confirmed=X Filename=winrvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Intel Active Monitor] Number=3965 Confirmed=U Filename=imontray.exe Description=System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you change PCMCIA cards Source=Paul Collins Startup list [Intel Driver] Number=3966 Confirmed=X Filename=csrs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Intel File Transfer] Number=3967 Confirmed=U Filename=xfr.exe Description=Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Source=Paul Collins Startup list [Intel PDS] Number=3968 Confirmed=U Filename=pds.exe Description=Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start the dial-up if installed and enabled Source=Paul Collins Startup list [Intel Product Number Utility] Number=3969 Confirmed=U Filename=IntelProcNumUtility.exe Description=Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here Source=Paul Collins Startup list [Intel PROSet Tray Icon] Number=3970 Confirmed=N Filename=promon.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [Intel Service Drivers] Number=3971 Confirmed=X Filename=msconfig16.exe Description=Added by the MSCONFIG16 TROJAN! Source=Paul Collins Startup list [Intel system tool] Number=3972 Confirmed=X Filename=hookdump.exe Description=Added by the SPYRE-H TROJAN! Source=Paul Collins Startup list [Intel system tool] Number=3973 Confirmed=X Filename=winnook.exe Description=Added by the SPYRE-C TROJAN! Source=Paul Collins Startup list [Intel system tool] Number=3974 Confirmed=X Filename=svehost.exe Description=Added by the AGENT-EBT TROJAN! Source=Paul Collins Startup list [Intel system works] Number=3975 Confirmed=X Filename=iis.exe Description=Added by the RBOT.QGA WORM! Source=Paul Collins Startup list [Intel(R) Common User Interface] Number=3976 Confirmed=U Filename=hkcmd.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. If the user wishes to have "HotKey" access to Intel's customised graphics properties, it is required, otherwise not. It can be disabled via the Display Properties in the Control Panel Source=Paul Collins Startup list [Intel(R) Common User Interface] Number=3977 Confirmed=N Filename=igfxpers.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. Not known exactly what it does but apparently it isn't required Source=Paul Collins Startup list [intel32.exe] Number=3978 Confirmed=X Filename=intel32.exe Description=Added by the SmitFraud alias SPYJACK-B TROJAN! Source=Paul Collins Startup list [IntelAPMClient] Number=3979 Confirmed=U Filename=amclient.exe Description=LANDesk Management Suite software component Source=Paul Collins Startup list [IntelAudioStudio] Number=3980 Confirmed=N Filename=IntelAudioStudio.exe Description="Intel Audio Studio combines Intel� High Definition audio hardware features with Sonic Focus* Audio Refinement and Dolby* technologies to provide you with a comprehensive tool that puts you in control of your audio experience". Audio utility supplied with Intel motherboards Source=Paul Collins Startup list [InteliSys] Number=3981 Confirmed=X Filename=smss.exe Description=Advertisingvision adware! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [intell32.exe] Number=3982 Confirmed=X Filename=intell32.exe Description=Added by the SmitFraud alias Desktophijack.C TROJAN! Source=Paul Collins Startup list [intell321.exe] Number=3983 Confirmed=X Filename=intell321.exe Description=Added by the SPYJACK-B TROJAN! Source=Paul Collins Startup list [Intelliflag_be.exe] Number=3984 Confirmed=X Filename=Intelliflag_be.exe Description=Added by the Intelliflag SPYWARE! Source=Paul Collins Startup list [IntelliPoint] Number=3985 Confirmed=U Filename=point32.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Intellitype] Number=3986 Confirmed=U Filename=type32.exe Description=For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings unless you have changed them Source=Paul Collins Startup list [IntelMEM] Number=3987 Confirmed=U Filename=IntelMEM.exe Description=Related to connection events on an Intel chipset based modem. It can alert you if the telephone line is being used when you're trying to get online (when you're using dial-up). It can also alert you if your modem line is disconnected. Furthermore, it can alert you if you have made a wrong connection with your modem line Source=Paul Collins Startup list [IntelProcNumUtility] Number=3988 Confirmed=U Filename=cpunumber.exe Description=Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here Source=Paul Collins Startup list [IntelWireless] Number=3989 Confirmed=Y Filename=ifrmewrk.exe Description=Associated with the Intel PRO/Set Wireless software Source=Paul Collins Startup list [IntelZeroConfig] Number=3990 Confirmed=U Filename=ZCfgSvc.exe Description=Zero Config MFC Application, part of Intel's ProSET utilities and installed by the drivers for many of Intel wireless network cards - essential to the proper functioning of many of the Intel ProSET utilities (but not all) and these System Tray ProSET utilities are a must if you are using your wireless connection, if only so you know when the signal is fading or dropping. The problem is that, in some PCs, ZCFGSVC can be incredibly badly behaved : taking up to 100% of CPU time and therefore resulting in an extremely slow PC, preventing the installation of software or Windows updates, or causing "Not Responding" or "End this Program" shutdown problems. If you experience this, try first the very latest drivers from Intel or your laptop manufacturer. If that still does not solve the problem and you have WinXP/2003, try setting the "Wireless Zero Configuration" service to disabled Source=Paul Collins Startup list [Intel� Common User Interface] Number=3991 Confirmed=U Filename=igfxtray.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. Quick access to the control panel via a System Tray icon. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Intense Registry Service] Number=3992 Confirmed=? Filename=IntEdReg.exe /CHECK Description=Intense Educational Ltd - Language Office Software. Is it required? Source=Paul Collins Startup list [InterceptedSystem] Number=3993 Confirmed=X Filename=[path to worm] Description=Added by the ANACON-B WORM! Source=Paul Collins Startup list [InterCheck Monitor] Number=3994 Confirmed=Y Filename=Icmon.exe Description=Part of Sophos ant-virus sofware Source=Paul Collins Startup list [InterCheckMonitor] Number=3995 Confirmed=Y Filename=ICMON.EXE Description=Part of Sophos anti-virus sofware Source=Paul Collins Startup list [Interdll] Number=3996 Confirmed=X Filename=Interdll.exe Description=Added by the DELF family of TROJANS! Source=Paul Collins Startup list [Internal] Number=3997 Confirmed=X Filename=[trojan filename] Description=Added by the SMOTHER and TRANSLAT TROJANS! Source=Paul Collins Startup list [Internal] Number=3998 Confirmed=X Filename=regedit.exe /s %windir%c:\[month number] Description=Added by the FORTNIGHT.D TROJAN! Source=Paul Collins Startup list [Internal Memory File] Number=3999 Confirmed=X Filename=sysintmemory.exe Description=Added by the RBOT-GKT WORM! Source=Paul Collins Startup list [InternalSystray] Number=4000 Confirmed=X Filename=Kazza.exe Description=Added by a variant of the OPTIX TROJAN! Note - unlike the valid KaZaA executable, this is located in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP) Source=Paul Collins Startup list [internat] Number=4001 Confirmed=X Filename=internat.exe Description=Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir% Source=Paul Collins Startup list [Internat] Number=4002 Confirmed=X Filename=systray.exe Description=Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the "Properties" reveal it to be a Microsoft file Source=Paul Collins Startup list [Internat] Number=4003 Confirmed=X Filename=msgsrv32.exe Description=Added by the NYRUBOT-A WORM! Source=Paul Collins Startup list [Internat] Number=4004 Confirmed=X Filename=[trojan filename] Description=Added by the CMJSPY-Y TROJAN! Source=Paul Collins Startup list [Internat Conf] Number=4005 Confirmed=X Filename=bootconf.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com; see for example here Source=Paul Collins Startup list [internat.exe] Number=4006 Confirmed=N Filename=internat.exe Description=Microsoft language selection icon in system tray, located in the System (Win98/Me) or System32 (WinNT/2K/XP) folder Source=Paul Collins Startup list [Internat.exe] Number=4007 Confirmed=X Filename=internat.exe Description=Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (Win98/Me) or %windir%System32 (WinNT/2K/XP) (where %windir% is the Windows directory - C:Windows or C:Winnt) and has a "?" icon wheras this version resides in %windir% and has a ZIP icon Source=Paul Collins Startup list [internct] Number=4008 Confirmed=X Filename=WinSocks5.exe Description=Added by the GRAYBIRD.F TROJAN! Source=Paul Collins Startup list [internet] Number=4009 Confirmed=X Filename=smss.exe Description=Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Internet] Number=4010 Confirmed=X Filename=Internet.exe Description=Added by the PWS-CS TROJAN! Source=Paul Collins Startup list [Internet] Number=4011 Confirmed=X Filename=recruit.exe Description=Added by the RBOT-AJG WORM! Source=Paul Collins Startup list [internet] Number=4012 Confirmed=X Filename=[trojan filename].exe Description=Added by the MIFENG-D TROJAN! Source=Paul Collins Startup list [Internet] Number=4013 Confirmed=X Filename=winlogom.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Internet] Number=4014 Confirmed=X Filename=nteusodp.exe Description=Added by the RBOT-GFJ WORM! Source=Paul Collins Startup list [internet] Number=4015 Confirmed=X Filename=winsas32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Internet Answering Machine] Number=4016 Confirmed=U Filename=IAMNET~1.EXE Description=From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access Source=Paul Collins Startup list [Internet Answering Machine] Number=4017 Confirmed=U Filename=IAM.exe Description=From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access Source=Paul Collins Startup list [Internet Call Manager] Number=4018 Confirmed=U Filename=ICM.EXE Description=Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail Source=Paul Collins Startup list [Internet Config] Number=4019 Confirmed=X Filename=svchosts.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [Internet Connection Wizard] Number=4020 Confirmed=X Filename=stisvsq.exe Description=EasySearch adware Source=Paul Collins Startup list [Internet Connection Wizard] Number=4021 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Internet Connection Wizard] Number=4022 Confirmed=X Filename=stisvsq1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Internet Content Publisher] Number=4023 Confirmed=X Filename=ICP.EXE Description=Added by the RBOT-UD WORM! Source=Paul Collins Startup list [Internet Download Accelerator] Number=4024 Confirmed=U Filename=ida.exe Description=Internet Download Accelerator download manager Source=Paul Collins Startup list [Internet download manager service] Number=4025 Confirmed=X Filename=idman.exe Description=Added by the RBOT-BMS WORM! Source=Paul Collins Startup list [Internet Exploere Services] Number=4026 Confirmed=X Filename=urlmon32.dll.exe Description=Added by the EVIAN.C WORM! Source=Paul Collins Startup list [Internet Explore Microsoft] Number=4027 Confirmed=X Filename=lEXPLORE.EXE Description=Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [Internet Explorer] Number=4028 Confirmed=X Filename=iexplorer.exe Description=Added by the LORSIS WORM! Note - the legitimate IE (iexplore.exe) does not figure in Msconfig/Startup unless added manually and this loads from the "RunServices" key Source=Paul Collins Startup list [Internet Explorer] Number=4029 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Internet Explorer] Number=4030 Confirmed=X Filename=IExplorer.exe Description=Added by the NETHIEF-O TROJAN! Source=Paul Collins Startup list [Internet Explorer] Number=4031 Confirmed=X Filename=http.exe Description=Added as part of a new potential CWS infection, and part of a suite of programs that installs a web server, php, ftp server, socks, and mail server on your computer without your knowledge. These files are known to be part of an infection that transmits information about your bank accounts, passwords, and other financial information. It should be deleted immediately, you should enable your firewall, and you should contact your financial services in order to report the issue and to have your passwords changed Source=Paul Collins Startup list [Internet Explorer] Number=4032 Confirmed=X Filename=iexpiore.exe Description=Added by the RBOT-AZC WORM! Source=Paul Collins Startup list [Internet Explorer Configuration] Number=4033 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Internet Explorer Security] Number=4034 Confirmed=X Filename=iexplore.pif Description=Added by the RBOT-ALQ WORM! Source=Paul Collins Startup list [Internet Explorer Updater] Number=4035 Confirmed=X Filename=lexbac.exe Description=Added by the DOWNLOAD TROJAN! Source=Paul Collins Startup list [Internet Explorer Updater] Number=4036 Confirmed=X Filename=iexplorer.exe Description=Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) Source=Paul Collins Startup list [Internet History Eraser] Number=4037 Confirmed=U Filename=HERASER.exe Description=Internet History Eraser - deletes your browsing tracks Source=Paul Collins Startup list [Internet Loader1] Number=4038 Confirmed=X Filename=MSInstall61.exe Description=Added by the KWBOT.B WORM! Source=Paul Collins Startup list [Internet Mail and News] Number=4039 Confirmed=X Filename=msqdevl.exe Description=EasySearch adware Source=Paul Collins Startup list [Internet Mail and News] Number=4040 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Internet Mail and News] Number=4041 Confirmed=X Filename=msqdevl1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Internet Optimizer] Number=4042 Confirmed=U Filename=optimize.exe Description=Internet connection optimizer. Leave this enabled if you find it improves your connection Source=Paul Collins Startup list [Internet Optimizer] Number=4043 Confirmed=X Filename=optimize.exe Description=Internet Optimizer parasite, MoneyTree variant - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [Internet Security Service] Number=4044 Confirmed=X Filename=msq32.exe Description=Added by the RBOT-GFP WORM! Source=Paul Collins Startup list [Internet Send] Number=4045 Confirmed=X Filename=More log.exe Description=Unidentfied adware Source=Paul Collins Startup list [Internet Server] Number=4046 Confirmed=X Filename=inetsrv.exe Description=Added by the STARTPA-EM TROJAN! Source=Paul Collins Startup list [Internet Service] Number=4047 Confirmed=X Filename=intersvc.exe Description=Added by the SPYBOT-DE WORM! Source=Paul Collins Startup list [internet service] Number=4048 Confirmed=X Filename=syscfg32.exe Description=Added by the RBOT-QS WORM! Source=Paul Collins Startup list [internet service] Number=4049 Confirmed=X Filename=ssvhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [internet service] Number=4050 Confirmed=X Filename=svho0st98.exe Description=Added by the RBOT.EAT WORM! Source=Paul Collins Startup list [Internet Services] Number=4051 Confirmed=X Filename=systemdev.exe Description=Added by the SDBOT-PW WORM! Source=Paul Collins Startup list [Internet Services] Number=4052 Confirmed=X Filename=internet.exe Description=Added by the MYTOB.BT WORM! Source=Paul Collins Startup list [Internet Services] Number=4053 Confirmed=X Filename=interserv.exe Description=Added by the RBOT.BNT WORM! Source=Paul Collins Startup list [Internet Services] Number=4054 Confirmed=X Filename=Netsvc.exe Description=Added by the MYTOB.MN WORM! Source=Paul Collins Startup list [INTERNET SERVISES] Number=4055 Confirmed=X Filename=winz32.exe Description=Added by the KWBOT.Z WORM! Source=Paul Collins Startup list [Internet Sharing Server] Number=4056 Confirmed=Y Filename=iss_srvr.exe Description=Intel AnyPoint internet sharing software. Now discontinued Source=Paul Collins Startup list [Internet Suspention] Number=4057 Confirmed=X Filename=story.exe Description=Added by the WOOTBOT.HV WORM! Source=Paul Collins Startup list [Internet Sweeper] Number=4058 Confirmed=N Filename=Sweeper.exe Description=Internet Sweeper - removes unnecessart left over files after browsing the internet Source=Paul Collins Startup list [Internet Timer] Number=4059 Confirmed=U Filename=ITIMER.exe Description=Shareware dial-up connection call cost calculator from Ratsoft Source=Paul Collins Startup list [Internet Washer Pro] Number=4060 Confirmed=X Filename=iw.exe Description=Internet Washer manages temporary browser files, cookies, etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003 Source=Paul Collins Startup list [Internet.exe] Number=4061 Confirmed=X Filename=Internet.exe Description=Added by the MAGICCALL VIRUS! Source=Paul Collins Startup list [internet.exe] Number=4062 Confirmed=X Filename=yinyin3345.vbs Description=Added by the YINI MACRO! Source=Paul Collins Startup list [Internet2 Optimizer] Number=4063 Confirmed=X Filename=wkfix.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [InternetExplorer2] Number=4064 Confirmed=X Filename=windows.exe Description=Added by the SDBOT-CZP WORM! Source=Paul Collins Startup list [InternetSpy] Number=4065 Confirmed=U Filename=InternetSpy.exe Description=Internet Spy - freeware keylogger that tracks all visited websites including the date and exact time these sites were visited. The information is stored in a file that may be accessed by the person who knows where it is saved. Remove unless you installed it yourself! Source=Paul Collins Startup list [InternetWasherPro] Number=4066 Confirmed=X Filename=iw.exe Description=Internet Washer manages temporary browser files, cookies, etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003 Source=Paul Collins Startup list [INTERNET_SERVISES] Number=4067 Confirmed=X Filename=winz32.exe Description=Added by the SDBOT.Q TROJAN! Source=Paul Collins Startup list [InternodeUsage] Number=4068 Confirmed=U Filename=mum.exe Description=Australian ISP's free monthly download meter Source=Paul Collins Startup list [Internt] Number=4069 Confirmed=X Filename=Internt.exe Description=Added by the PEEPER or CARUFAX.A TROJANS! Source=Paul Collins Startup list [Intersoft Msngr] Number=4070 Confirmed=X Filename=intersoftmsngr.exe Description=Added by the AGOBOT-NW WORM! Source=Paul Collins Startup list [InterTrust Quick Start] Number=4071 Confirmed=N Filename=it_cpq~1.exe Description=InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business Source=Paul Collins Startup list [InterU] Number=4072 Confirmed=X Filename=WINDRV.EXE Description=Added by the IRCINTER.A TROJAN! Source=Paul Collins Startup list [Intervideo Win Cinema Manager] Number=4073 Confirmed=N Filename=WinCinemaMgr.exe Description=WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo Win Cinema Manager] Number=4074 Confirmed=N Filename=WINCIN~1.EXE Description=WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo WinCinema Manager] Number=4075 Confirmed=N Filename=WinCinemaMgr.exe Description=WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo WinCinema Manager] Number=4076 Confirmed=N Filename=WINCIN~1.EXE Description=WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo WinScheduler] Number=4077 Confirmed=N Filename=WinScheduler.exe Description=WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo WinScheduler] Number=4078 Confirmed=N Filename=SchSvr.exe Description=WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [InterWARN] Number=4079 Confirmed=U Filename=interwarn.exe Description=InterWARN by Storm Alert Inc. Provides customized, automated access to critical weather and civil emergency information from the US National Weather Service. Required if audio and screen crawler alerts are desired. Also available via Start -> Programs Source=Paul Collins Startup list [Intespention] Number=4080 Confirmed=X Filename=IEXPLORE.exe Description=Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Intmgr] Number=4081 Confirmed=X Filename=Intmgr.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [intranet] Number=4082 Confirmed=X Filename=SYS32CFG.EXE Description=Added by the SPYBOT-DW WORM! Source=Paul Collins Startup list [Intranet] Number=4083 Confirmed=X Filename=intranet.exe Description=Added by the CHIMOZ.AC TROJAN! Source=Paul Collins Startup list [Intrenat] Number=4084 Confirmed=X Filename=Intrenat.exe Description=Added by the LEMIR.E TROJAN! Source=Paul Collins Startup list [Introducing Media Manager] Number=4085 Confirmed=N Filename=SPLASHA.EXE Description=MS Media Manager tour. Not required Source=Paul Collins Startup list [Introduction-Registration] Number=4086 Confirmed=N Filename=?? Description=For Compaq PC's. Should only run first time, PC Introduction & Compaq registration Source=Paul Collins Startup list [IntruderAlert] Number=4087 Confirmed=X Filename=ia99.exe Description=Intruder Alert '99 from Bonzi - spyware Source=Paul Collins Startup list [IntSys1] Number=4088 Confirmed=X Filename=[path to trojan] Description=Added by the BANLOA-ASE TROJAN! Source=Paul Collins Startup list [Inventory Scan] Number=4089 Confirmed=U Filename=LDISCN32.EXE Description=LANDesk Management_Suite software component Source=Paul Collins Startup list [Ioadqm] Number=4090 Confirmed=X Filename=Media Player.exe Description=Added by the HAWAWI WORM! Source=Paul Collins Startup list [iobi] Number=4091 Confirmed=N Filename=iobiClient.exe Description=iobi Home - a mail/voice service by Verizon Source=Paul Collins Startup list [Iolo Task Agent] Number=4092 Confirmed=U Filename=Task_Agent.exe Description=Iolo System Mechanic Task Agent. Scheduled maintenance Source=Paul Collins Startup list [iolo Utility Bar] Number=4093 Confirmed=N Filename=SMUtilityBar.exe Description=Iolo System Mechanic Utility Bar - can be launched manually Source=Paul Collins Startup list [ioloDelayModule] Number=4094 Confirmed=U Filename=delay.exe Description=Part of Iolo System Mechanic. Used to delay the start of an application which loads automatically as Windows loads Source=Paul Collins Startup list [Iomega Automatic Backup] Number=4095 Confirmed=U Filename=ibackup.exe Description=Iomega Automatic Backup - automatic backups for use with Iomega portable HDD Source=Paul Collins Startup list [Iomega Automatic Backup 1.0.1] Number=4096 Confirmed=U Filename=ibackup.exe Description=Iomega Automatic Backup - automatic backups for use with Iomega portable HDD Source=Paul Collins Startup list [Iomega Backup Scheduler] Number=4097 Confirmed=N Filename=dtiom98.exe Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomega Disk Icons] Number=4098 Confirmed=U Filename=IMGICON.EXE Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [Iomega Drive Icons] Number=4099 Confirmed=U Filename=IMGICON.EXE Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [Iomega ImIconXP] Number=4100 Confirmed=U Filename=imiconxp.exe Description=Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system, and provides drag-and-drop file access, access and write protection, and formatting of the disks Source=Paul Collins Startup list [Iomega QuickSync] Number=4101 Confirmed=? Filename=Quicksync.exe Description=?? Source=Paul Collins Startup list [Iomega Startup Options] Number=4102 Confirmed=N Filename=IMGSTART.EXE Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomega Watch] Number=4103 Confirmed=N Filename=IOWATCH.EXE Description=Used by Iomega drives. Available via Start -> Programs Source=Paul Collins Startup list [IomegaWare] Number=4104 Confirmed=N Filename=COMMANDER.EXE Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomon98.exe] Number=4105 Confirmed=U Filename=Iomon98.exe Description=PC-Cillin 98 real time virus check. Can cause floppy disk accesses to hang Source=Paul Collins Startup list [IP Stack] Number=4106 Confirmed=X Filename=ipstack.exe Description=Added by the AGOBOT.CW WORM! Source=Paul Collins Startup list [IP**.exe [* = random char]] Number=4107 Confirmed=X Filename=IP**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [IP**32.exe [* = random char]] Number=4108 Confirmed=X Filename=IP**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [iPalm] Number=4109 Confirmed=N Filename=mon.exe Description=Installed with a Panasonic iPalm digital camera. Used to upload photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded Source=Paul Collins Startup list [IPC Connection] Number=4110 Confirmed=X Filename=ipcconn.exe Description=Added by the RBOT-AEG WORM! Source=Paul Collins Startup list [IPC Spool Manager] Number=4111 Confirmed=X Filename=wnmgre.exe Description=Added by the SDBOT-ZC WORM! Source=Paul Collins Startup list [IPC Spool Manager] Number=4112 Confirmed=X Filename=winspec.exe Description=Added by the SDBOT-BLU WORM! Source=Paul Collins Startup list [ipcfg.exe] Number=4113 Confirmed=X Filename=ipcfg.exe Description=Adware - recognized by McAfee antivirus as a variant of the AdClicker-BM trojan Source=Paul Collins Startup list [IPConfig] Number=4114 Confirmed=X Filename=svcxnv32.exe Description=Added by the HACARMY.E TROJAN! Source=Paul Collins Startup list [IPConfig] Number=4115 Confirmed=X Filename=svcxnw32.exe Description=Added by a variant of the HACARMY.E TROJAN! Source=Paul Collins Startup list [IpCtrl] Number=4116 Confirmed=X Filename=ipcon32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [IPFW] Number=4117 Confirmed=X Filename=ipwf.exe Description=Added by the DLOADER-YF TROJAN! Source=Paul Collins Startup list [IPHSend] Number=4118 Confirmed=? Filename=IPHSend.exe Description=AOL related. What does it do and is it required? Source=Paul Collins Startup list [IPInSightLAN 0*] Number=4119 Confirmed=X Filename=ipclient.exe Description=Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly "phones home" and wastes resources. * represents 1 or 2 Source=Paul Collins Startup list [IPInSightMonitor 0*] Number=4120 Confirmed=N Filename=ipmon32.exe Description=Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. * represents 1 or 2 Source=Paul Collins Startup list [IPinst] Number=4121 Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [iPlusAgent2] Number=4122 Confirmed=? Filename=iAgent2.exe Description=Related to iriver portable media products. What does it do and is it required? Source=Paul Collins Startup list [ipmon.exe] Number=4123 Confirmed=X Filename=ipmon.exe Description=Added by the RECERV or R3C.B TROJANS! Source=Paul Collins Startup list [IpNetwork] Number=4124 Confirmed=X Filename=ipnetwork.exe Description=Maxifiles adware Source=Paul Collins Startup list [Ipnuker] Number=4125 Confirmed=X Filename=Ipnuker.vbs Description=Added by the INKER.B WORM! Source=Paul Collins Startup list [iPOD USB Driver] Number=4126 Confirmed=X Filename=IPODUSB.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [iPod USB Service] Number=4127 Confirmed=X Filename=iPODService.exe Description=Added by a variant of the RBOT WORM! Do NOT confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the Program Files\iPod\bin folder, and is implemented as a system service, thus NOT listed in Msconfig/Startup! Source=Paul Collins Startup list [iPodManager] Number=4128 Confirmed=U Filename=iPodManager.exe Description=Apple iPod Management software for the iPod MP3 player. Allows updating, formating, restoring and other functions associated with iPods Source=Paul Collins Startup list [iPodWatcher] Number=4129 Confirmed=? Filename=iPodWatcher.exe Description=Associated with Apple's iPod MP3 player. Detects when the iPod is connected? Source=Paul Collins Startup list [IPOT Service Drivers] Number=4130 Confirmed=X Filename=compaq.exe Description=Added by a variant of the FUROOTKIT TROJAN! Source=Paul Collins Startup list [IPOT Service Drivers] Number=4131 Confirmed=X Filename=compaq.exe Description=Added by a variant of the FUROOTKIT TROJAN! Source=Paul Collins Startup list [IPOT USB Service DRIVER] Number=4132 Confirmed=X Filename=hpsebc087.exe Description=Added by the SDBOT-WA WORM! Source=Paul Collins Startup list [IPOT USB Service DRV32] Number=4133 Confirmed=X Filename=hpsebc08.exe Description=Added by the SDBOT-WH WORM! Source=Paul Collins Startup list [IPPDetect] Number=4134 Confirmed=N Filename=IPP4Detect.exe Description=Part of Presto! Mr.Photo - "an ideal program for creating, sharing, and manag-ing digital images and videos" Source=Paul Collins Startup list [ipreg] Number=4135 Confirmed=X Filename=ipreg.exe Description=Added by the ZAGABAN-H TROJAN! Source=Paul Collins Startup list [iPrint Tray] Number=4136 Confirmed=N Filename=iprntctl.exe Description=Novell� iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net Source=Paul Collins Startup list [iProtectYou] Number=4137 Confirmed=U Filename=ip.exe Description=iProtectYou - internet filtering/parental control and network monitoring software Source=Paul Collins Startup list [iprun] Number=4138 Confirmed=X Filename=iPY.exe Description=iProtectYou spyware Source=Paul Collins Startup list [ipsecdialer] Number=4139 Confirmed=U Filename=IPSECD~1.EXE Description=Cisco VPN Client - lets local users gain Administrator privileges on the operating system Source=Paul Collins Startup list [ipsecdialer] Number=4140 Confirmed=U Filename=ipsecdialer.exe Description=Cisco VPN Client - lets local users gain Administrator privileges on the operating system Source=Paul Collins Startup list [IPSecMon] Number=4141 Confirmed=Y Filename=IPSecMon.exe Description=Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Source=Paul Collins Startup list [IPTable Configuration] Number=4142 Confirmed=X Filename=Winipcfgs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [iptray] Number=4143 Confirmed=N Filename=iptray.exe Description=System Tray access to Intel Desktop Utilities - "provides you with the means to monitor system temperatures, voltages, fan speeds, and hard drive health; view detailed system information, and test your system hardware for common errors" Source=Paul Collins Startup list [IPv6 Helper Driver] Number=4144 Confirmed=X Filename=csass.exe Description=Added by the AGOBOT.TC WORM! Source=Paul Collins Startup list [IPv6 STUN Service] Number=4145 Confirmed=X Filename=netstun.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [IPW] Number=4146 Confirmed=N Filename=IPW.exe Description=Internet Phone Wizard from Actiontec - Voice over IP (VoIP) that allows you to "make and receive free Internet calls on your regular phone" whilst "at the same time, make and receive regular (landline) calls on your phone" Source=Paul Collins Startup list [ipwf] Number=4147 Confirmed=X Filename=ipwf.exe Description=Added by the SCHOEBERL TROJAN! Source=Paul Collins Startup list [IpWins] Number=4148 Confirmed=X Filename=ipwins.exe Description=Added by Maxfiles adware Source=Paul Collins Startup list [ipxwshel] Number=4149 Confirmed=X Filename=ipxwshel.exe Description=Added by the WAREZOV.DG WORM! Source=Paul Collins Startup list [IQES.exe] Number=4150 Confirmed=? Filename=iqes.exe Description=?? Source=Paul Collins Startup list [Ir41_32.ax] Number=4151 Confirmed=U Filename=regsvr32.exe [path] Ir41_32.ax Description=Intel� Indeo� video 4.4 Decompression Filter related Source=Paul Collins Startup list [irassync] Number=4152 Confirmed=X Filename=irasyncd.exe Description=IRASSync adware Source=Paul Collins Startup list [irc session] Number=4153 Confirmed=X Filename=sessionmgr.exe Description=Added by the SDBOT-ACE WORM! Source=Paul Collins Startup list [IREIKE] Number=4154 Confirmed=Y Filename=IreIKE.exe Description=Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Source=Paul Collins Startup list [iRis Active Monitor] Number=4155 Confirmed=N Filename=winmon32.exe Description=Iris Antivirus - discontinued, replace with good alternative Source=Paul Collins Startup list [iRiS AntiVirus Active Monitor] Number=4156 Confirmed=N Filename=WIMMUN32.exe Description=Iris Antivirus - discontinued, replace with good alternative Source=Paul Collins Startup list [iRiver AutoDB] Number=4157 Confirmed=U Filename=MLService.exe Description=Associated with the iRiver Music Manager Source=Paul Collins Startup list [iRiver Updater] Number=4158 Confirmed=N Filename=Updater.exe Description=Updates for the iRiver Music Manager - used with their digital music players Source=Paul Collins Startup list [IrMon] Number=4159 Confirmed=U Filename=IRMON.EXE Description=System Tray access to infra-red devices. Not required unless you use infra-red devices Source=Paul Collins Startup list [IRPMonitor] Number=4160 Confirmed=? Filename=itcnmon.exe Description=?? Source=Paul Collins Startup list [irssyncd] Number=4161 Confirmed=X Filename=irssyncd.exe Description=SafeSurfing adware variant Source=Paul Collins Startup list [Irwftp] Number=4162 Confirmed=X Filename=[path to trojan] Description=Added by the BANCOS-AP TROJAN! Source=Paul Collins Startup list [irwftp] Number=4163 Confirmed=X Filename=iexplorer.exe Description=Added by the BANKER-AN TROJAN! Source=Paul Collins Startup list [irwftp] Number=4164 Confirmed=X Filename=ftpmon.exe Description=Added by the BANCBAN-BO TROJAN! Source=Paul Collins Startup list [IrXfer] Number=4165 Confirmed=U Filename=IrXfer.exe Description=Microsoft Infrared Transfer application Source=Paul Collins Startup list [ir_ftp] Number=4166 Confirmed=X Filename=ir_ftp.exe Description=Added by the IRFTP TROJAN! Source=Paul Collins Startup list [ir_ftp] Number=4167 Confirmed=X Filename=irwftp.exe Description=Added by the BANCOS.H TROJAN! Source=Paul Collins Startup list [IS CfgWiz] Number=4168 Confirmed=N Filename=cfgwiz.exe Description=Norton Internet Security configuration wizard Source=Paul Collins Startup list [Isass] Number=4169 Confirmed=X Filename=Isass.exe Description=Added by the FUTRO TROJAN! Source=Paul Collins Startup list [ISBMgr.exe] Number=4170 Confirmed=U Filename=ISBMgr.exe Description=Related to Sony ISB Utility. This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [iscch] Number=4171 Confirmed=X Filename=iscch.exe Description=Added by the LCPRANK-A WORM! Source=Paul Collins Startup list [isdbdc] Number=4172 Confirmed=N Filename=isdbdc.exe Description=For Compaq PC's. May install properties in dial-up networking when you register with an ISP Source=Paul Collins Startup list [isDeleteMe] Number=4173 Confirmed=U Filename=isDel.bat Description=Used by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product Source=Paul Collins Startup list [ISDN Monitor] Number=4174 Confirmed=N Filename=Linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [ISDNwatch] Number=4175 Confirmed=U Filename=IWatch.exe Description=FRITZ!X ISDNWatch - "dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks" Source=Paul Collins Startup list [ISHelp] Number=4176 Confirmed=U Filename=help.exe Description=ISpy is a security risk that logs keystrokes and captures screenshots. If you didn't install this yourself uninstall it Source=Paul Collins Startup list [iShield] Number=4177 Confirmed=U Filename=iShield.exe Description="GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser" Source=Paul Collins Startup list [ISLP2STA] Number=4178 Confirmed=Y Filename=ISLP2STA.EXE Description=A process from Cisco Systems Inc associated with Windows Update for wireless NIC drivers Source=Paul Collins Startup list [ISP.COM High Speed] Number=4179 Confirmed=Y Filename=slipgui.exe Description=User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server Source=Paul Collins Startup list [ISPSERVICE] Number=4180 Confirmed=X Filename=psycho.exe Description=Added by the IRCFLOOD-O TROJAN! Source=Paul Collins Startup list [iSpyNOW] Number=4181 Confirmed=U Filename=ispynow.exe Description=iSpyNOW - remote monitoring and surveillance software Source=Paul Collins Startup list [Israfel] Number=4182 Confirmed=X Filename=Israfel.vbs Description=Added by the GAGGLE.D or GAGGLE.E WORMS! Source=Paul Collins Startup list [IsReminder] Number=4183 Confirmed=N Filename=ISPopup.exe Description=Related to GuardWare iShield - this is the registration reminder for the trial version, so not required in startup Source=Paul Collins Startup list [issEnc32Svr] Number=4184 Confirmed=X Filename=issEnc32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [ISSI EZUpdate Service] Number=4185 Confirmed=N Filename=issimsvc.exe Description=Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching Source=Paul Collins Startup list [ISStart] Number=4186 Confirmed=U Filename=ISStart.exe Description=LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation Source=Paul Collins Startup list [ISSVC] Number=4187 Confirmed=Y Filename=ISSVC.exe Description=Part of Norton Internet Security Suite Source=Paul Collins Startup list [ISS_Certtool] Number=4188 Confirmed=Y Filename=certtool.exe Description=IBM Client Security Certification Tool Source=Paul Collins Startup list [IST Service] Number=4189 Confirmed=X Filename=istsvc.exe Description=ISTBar adware Source=Paul Collins Startup list [ist service uninstall] Number=4190 Confirmed=X Filename=[random filename] Description=ISTBar parasite related Source=Paul Collins Startup list [istinstall zazzer.exe] Number=4191 Confirmed=X Filename=istinstall zazzer.exe Description=Unidentified adware downloader/installer Source=Paul Collins Startup list [ISUSPM Startup] Number=4192 Confirmed=N Filename=ISUSPM.exe Description=InstallShield Update Service Scheduler. Automatically searches for and performs any updates to the software so you're always working with the most current version Source=Paul Collins Startup list [ISUSScheduler] Number=4193 Confirmed=N Filename=issch.exe Description=InstallShield Update Service Scheduler. Automatically searches for and performs any updates to the software so you're always working with the most current version Source=Paul Collins Startup list [isxa] Number=4194 Confirmed=X Filename=isxa.exe Description=Added by the SMALL-EIV TROJAN! Source=Paul Collins Startup list [isystem] Number=4195 Confirmed=X Filename=isystem.exe Description=Added by the CHORUS-A TROJAN! Searchforfree browser hijacker Source=Paul Collins Startup list [ItalU] Number=4196 Confirmed=X Filename=italfds.exe Description=Added by a TROJAN! See here TROJAN! Source=Paul Collins Startup list [Itk] Number=4197 Confirmed=U Filename=Itk.exe Description=In The Know - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [itk.exe] Number=4198 Confirmed=U Filename=itk.exe Description=Insert ToggleKey by Mike Lin. ITK sounds a tone whenever you press Insert Source=Paul Collins Startup list [iTouch] Number=4199 Confirmed=U Filename=iTouch.exe Description=iTouch loads the iTouch configuration program for Logitech keyboards. It's needed if your keyboard has shortcut buttons and if you use them. It's also needed if your keyboard does not have the num lock, caps lock, and scroll lock lights on it and you use the on-screen displays for num lock, caps lock, and scroll lock Source=Paul Collins Startup list [ItsDeductiblePopUp] Number=4200 Confirmed=N Filename=ItsDeductible.exe Description=ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip Source=Paul Collins Startup list [ITUNES] Number=4201 Confirmed=X Filename=itune.exe Description=Added by the RBOT-ZU WORM! Source=Paul Collins Startup list [ITUNES] Number=4202 Confirmed=X Filename=itunes.exe Description=Added by the OSCABOT-L WORM! Note - this file will be placed in the Windows\System32 or Winnt\System32 folder, and should not be confused with the (legitimate) Apple iTunes process, always located in the Program Files\iTunes folder Source=Paul Collins Startup list [Itunes] Number=4203 Confirmed=X Filename=dials.exe Description=Detected as Trojan-Dropper.Win32.Agent.mm by Kaspersky Anti-Virus Source=Paul Collins Startup list [iTunes Helper] Number=4204 Confirmed=Y Filename=iTunesHelper.exe Description=Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation Source=Paul Collins Startup list [iTunes Music] Number=4205 Confirmed=X Filename=iTunesHelper32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [iTunesAgent] Number=4206 Confirmed=X Filename=ita.exe Description=Added by the TACTSLAY.U TROJAN! Source=Paul Collins Startup list [itunesff] Number=4207 Confirmed=X Filename=itunesff.exe Description=Added by the EB adult premium dialer Source=Paul Collins Startup list [iTunesHelper] Number=4208 Confirmed=Y Filename=iTunesHelper.exe Description=Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation Source=Paul Collins Startup list [itype] Number=4209 Confirmed=? Filename=itype.exe Description=Microsoft IntelliType Pro keyboard related - what does it do and is it required? Source=Paul Collins Startup list [Iusage] Number=4210 Confirmed=N Filename=netdet.exe Description=Internet Usage Monitor - utility to calculate the cost and time on the internet via dial-up Source=Paul Collins Startup list [iut75] Number=4211 Confirmed=X Filename=uzcx.exe Description=Added by the DLOADER-AXV TROJAN! Source=Paul Collins Startup list [IVPServiceMgr] Number=4212 Confirmed=N Filename=ivpsvmgr.exe Description=Toshiba IVP Service Manager application which appears as a red satellite dish icon in the System Tray. This is Toshiba's equivalent to the Windows Automatic Update feature as, whenever you are connected to the Internet, it will check for Windows updates and Toshiba updates Source=Paul Collins Startup list [ivy.exe] Number=4213 Confirmed=X Filename=ivy.exe Description=Added by the AGENT-ENZ TROJAN! Source=Paul Collins Startup list [IW ControlCenter] Number=4214 Confirmed=N Filename=iwctrl.exe Description=Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis Source=Paul Collins Startup list [iwctrl] Number=4215 Confirmed=U Filename=iwctrl.exe Description=Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis Source=Paul Collins Startup list [ixplore] Number=4216 Confirmed=X Filename=ixplore.exe Description=Added by the SDBOT-CY TROJAN! Source=Paul Collins Startup list [ixproxy] Number=4217 Confirmed=X Filename=[path to trojan] Description=Added by the XORPIX-A TROJAN! Source=Paul Collins Startup list [iyelejiv] Number=4218 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BJK WORM! Source=Paul Collins Startup list [IZE] Number=4219 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [j2 Tray Menu] Number=4220 Confirmed=N Filename=HotTray.exe Description=eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Source=Paul Collins Startup list [JA Cfg Util v2] Number=4221 Confirmed=X Filename=jacfg2.exe Description=Added by the RBOT-AL WORM! Source=Paul Collins Startup list [JA Config 32] Number=4222 Confirmed=X Filename=Awesome32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Jammer] Number=4223 Confirmed=U Filename=jammer.exe Description=Jammer by Agnitum - "Jammer is the last word in Internet security. It combines a user-friendly interface with very sophisticated and powerful security measures that protect your Windows system while you are surfing the web" Source=Paul Collins Startup list [Jammer2nd] Number=4224 Confirmed=X Filename=Jammer2nd.exe Description=Added by the NETSKY.Z WORM! Source=Paul Collins Startup list [Java applet] Number=4225 Confirmed=X Filename=javaup.exe Description=Added by the SDBOT-ACF WORM! Source=Paul Collins Startup list [Java Auto Update] Number=4226 Confirmed=X Filename=ujm.exe Description=Added by the SDBOT-ADH WORM! Source=Paul Collins Startup list [Java Runtime Environment] Number=4227 Confirmed=X Filename=jbuild.exe Description=Added by the DELBOT-J WORM! Source=Paul Collins Startup list [Java Runtime Value] Number=4228 Confirmed=X Filename=runjava.exe Description=Added by the RBOT-DDJ WORM! Source=Paul Collins Startup list [Java Runtimes] Number=4229 Confirmed=X Filename=iexplore.exe Description=Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a Winnt\Java\Java folder Source=Paul Collins Startup list [Java Virtual Machine] Number=4230 Confirmed=X Filename=javaw.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Java**.exe [* = random char]] Number=4231 Confirmed=X Filename=Java**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Java**32.exe [* = random char]] Number=4232 Confirmed=X Filename=Java**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [java-plugin] Number=4233 Confirmed=X Filename=javasctp.exe Description=Added by the VB.AMX TROJAN! Source=Paul Collins Startup list [Javascript] Number=4234 Confirmed=X Filename=jscript.exe Description=Added by the DELBOT-AD WORM! Source=Paul Collins Startup list [JavaScript Debugging Service] Number=4235 Confirmed=X Filename=JsDbgMan.exe Description=Added by the DERDEO.E WORM! Source=Paul Collins Startup list [JavaUpdate0.07] Number=4236 Confirmed=X Filename=[filename] Description=Added by the JUPDATE TROJAN! Source=Paul Collins Startup list [JavaUpdateSched] Number=4237 Confirmed=X Filename=jusched32.exe Description=Added by the CKB TROJAN! Source=Paul Collins Startup list [JavaVM] Number=4238 Confirmed=X Filename=java.exe Description=Added by the MYDOOM.M or MYDOOM.N or other variants of the MYDOOM WORMS! Note - not to be confused with the valid Windows "java.exe" which resides in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K) or C:\Windows\System32 (WinXP) as this resides in C:\Windows or C:\Winnt Source=Paul Collins Startup list [jawa32] Number=4239 Confirmed=X Filename=jawa32.exe Description=Added by the AGENT.BG WORM! Source=Paul Collins Startup list [Jawa322] Number=4240 Confirmed=X Filename=jawa32.exe Description=Added by a variant of the AGENT.BG trojan Source=Paul Collins Startup list [JB] Number=4241 Confirmed=N Filename=Jiffybar.exe Description="Get Paid As You surf" application Source=Paul Collins Startup list [Jet Detection] Number=4242 Confirmed=N Filename=ADGJDet.exe Description=Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Source=Paul Collins Startup list [JetAdmin Discovery Indicator] Number=4243 Confirmed=Y Filename=HPJETDSC.EXE Description=HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the registry, and remains active to control the Discovery Indicator Source=Paul Collins Startup list [jete] Number=4244 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BRT WORM! Source=Paul Collins Startup list [jiahus] Number=4245 Confirmed=X Filename=svchqs.exe Description=Added by the WOWPWS-AL TROJAN! Source=Paul Collins Startup list [jijbl] Number=4246 Confirmed=X Filename=ezlwy.bat Description=Added by the REDDW WORM! Source=Paul Collins Startup list [JMB36X Configure] Number=4247 Confirmed=U Filename=JMRaidTool.exe Description=JMB36x series Raid configuration utility from JMicron Technology Source=Paul Collins Startup list [Job-oversigt] Number=4248 Confirmed=U Filename=taskmon.exe Description=Task Monitor (on Danish language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase) Source=Paul Collins Startup list [JobHisInit] Number=4249 Confirmed=U Filename=JobHisInit.exe Description=Used by Ricoh network printers to enable network printing from the client Source=Paul Collins Startup list [Jog Serve] Number=4250 Confirmed=U Filename=JogServ2.exe Description="Jog Dial" on a Sony Vaio laptop. The dial can select various functions such as control audio. Needed if you use its features Source=Paul Collins Startup list [JogServ2] Number=4251 Confirmed=U Filename=JogServ2.exe Description="Jog Dial" on a Sony Vaio laptop. The dial can select various functions such as control audio. Needed if you use its features Source=Paul Collins Startup list [john315] Number=4252 Confirmed=X Filename=srrvc.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [jon315] Number=4253 Confirmed=X Filename=[path to trojan] Description=Added by the MAILBOT-BI TROJAN! Source=Paul Collins Startup list [jotl] Number=4254 Confirmed=? Filename=millenzje.exe Description=?? Source=Paul Collins Startup list [JOYTECH USB Neo S Controller] Number=4255 Confirmed=U Filename=JoytechNeoSTrayIcon.exe Description=System Tray access to Joytech Neo S PC gamepad controller software Source=Paul Collins Startup list [Jreg] Number=4256 Confirmed=X Filename=Jreg2b.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [Jufualt] Number=4257 Confirmed=X Filename=winxp2.exe Description=Added by the SDBOT-AAB WORM! Source=Paul Collins Startup list [Jufualt] Number=4258 Confirmed=X Filename=svhost.exe Description=Added by the SDBOT-ADJ WORM! Source=Paul Collins Startup list [Juno_uoltray] Number=4259 Confirmed=N Filename=exec.exe Description=Juno ISP software - not required Source=Paul Collins Startup list [jusched] Number=4260 Confirmed=N Filename=jusched.exe Description=Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel Source=Paul Collins Startup list [jusched] Number=4261 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-BWR TROJAN! Source=Paul Collins Startup list [jushed32.exe] Number=4262 Confirmed=X Filename=jushed32.exe Description=CoolWebSearch parasite variant - also detected as the BIZTEN-L TROJAN! Source=Paul Collins Startup list [jusodl] Number=4263 Confirmed=X Filename=severe.exe Description=Added by the QQPASS.48436 TROJAN! Source=Paul Collins Startup list [JussDropUtility] Number=4264 Confirmed=U Filename=JussDrop.exe Description=Related to DropShots Inc. A subscription based service for family to connect, converse and share photos and videos Source=Paul Collins Startup list [jutsu] Number=4265 Confirmed=X Filename=jutsu.exe Description=Added by the RBOT-LS WORM! Source=Paul Collins Startup list [jv16 PT TempFileTool] Number=4266 Confirmed=U Filename=TempTool.exe Description=jv16 PowerTools File Cleaner - "allows you to find obsolete and left-over temporary files" Source=Paul Collins Startup list [jv16PT - Privacy Protector] Number=4267 Confirmed=U Filename=Task.jvb Description=jv16 PowerTools Privacy Protector - "allows you to protect your privacy by automatically clearing out all the unwanted history items and cookies from you computer, every time you start your computer" Source=Paul Collins Startup list [Jv16pt Network Resident] Number=4268 Confirmed=U Filename=jv16pt_network.exe Description=jv16 PowerTools network resident program. Only needed if you are using the program's network features Source=Paul Collins Startup list [jvdnlssn] Number=4269 Confirmed=X Filename=fljzsshc.exe Description=Flingstone.com adware - and its Golden Palace Casino program Source=Paul Collins Startup list [JVM0] Number=4270 Confirmed=X Filename=JVM0.exe Description=Added by the BANLOA-AX TROJAN! Source=Paul Collins Startup list [JVM0.12] Number=4271 Confirmed=X Filename=[random filename] Description=Added by the TEADOOR-A TROJAN! Source=Paul Collins Startup list [JVM0.14] Number=4272 Confirmed=X Filename=[random filename] Description=Added by the TEADOOR-B TROJAN! Source=Paul Collins Startup list [JW Manager] Number=4273 Confirmed=X Filename=jwmngr.exe Description=Added by the DELBOT-G WORM! Source=Paul Collins Startup list [jxef1104] Number=4274 Confirmed=X Filename=jxef1104.exe Description=Added by the XIPI-A WORM! Source=Paul Collins Startup list [JXL Radio] Number=4275 Confirmed=X Filename=jxl.exe Description=Added by the RBOT-EBE WORM! Source=Paul Collins Startup list [Jzi16] Number=4276 Confirmed=? Filename=jzi16.exe Description=?? Source=Paul Collins Startup list [K2ps_full.task] Number=4277 Confirmed=X Filename=K2ps_full.exe Description=Added by the JUNTADOR.K TROJAN! Source=Paul Collins Startup list [K6CPU.EXE] Number=4278 Confirmed=N Filename=K6CPU.EXE Description=Authenticates CPU as K6 in system properties Source=Paul Collins Startup list [Kadoc] Number=4279 Confirmed=X Filename=[random filename].exe Description=Added by the STAPREW TROJAN! Source=Paul Collins Startup list [kak] Number=4280 Confirmed=X Filename=kak.hta Description=Added by the KAKWORM WORM! Source=Paul Collins Startup list [Kalibump] Number=4281 Confirmed=U Filename=Kalibump.exe Description=Used with the now unsupported Kali software for on-line gaming. This is used to automatically bump up the priority of WinProxy to GREATLY improve game speed when using a SOCKS proxy Source=Paul Collins Startup list [kalvsys] Number=4282 Confirmed=X Filename=kalv****.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [kalvsys] Number=4283 Confirmed=X Filename=kalv***32.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [Kana Reminder] Number=4284 Confirmed=N Filename=Reminder.exe Description=Kana Reminder is a program which can be used to set a reminder to be triggered at a specified time Source=Paul Collins Startup list [Karen's Once-A-Day II] Number=4285 Confirmed=U Filename=PTOAD.exe Description="Have a job that should be run exactly once each day? Karen's Once-A-Day II is just what you need!" Scheduler that lets you specify progams, web pages and files that be run or opened automatically, the first time Source=Paul Collins Startup list [KASP] Number=4286 Confirmed=U Filename=OESpamTest.exe Description=Kaspersky Anti-Spam Source=Paul Collins Startup list [Kasper Antivirus] Number=4287 Confirmed=X Filename=KASPERANTIVIRUS.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Kaspersky Anti-Hacker] Number=4288 Confirmed=Y Filename=KAVPF.exe Description=Kaspersky Anti-Hacker firewall Source=Paul Collins Startup list [Kaspersky Antivirus] Number=4289 Confirmed=X Filename=KasperskyAV.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [KasperskyAv] Number=4290 Confirmed=X Filename=kaspersky.exe Description=Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky AntiVirus Source=Paul Collins Startup list [KasperskyAVEng] Number=4291 Confirmed=X Filename=Kasperskyaveng.exe Description=Added by the NETSKY.V WORM! Source=Paul Collins Startup list [KAT] Number=4292 Confirmed=X Filename=KAT.vbs Description=Added by the SOAD-D WORM! Source=Paul Collins Startup list [kav] Number=4293 Confirmed=Y Filename=avp.exe Description=AOL's Active Virus Shield Source=Paul Collins Startup list [KAVFOX] Number=4294 Confirmed=X Filename=win1ogoin.exe Description=Added by GWGHOST-M TROJAN! Source=Paul Collins Startup list [KAVPersonal] Number=4295 Confirmed=X Filename=svchost.exe Description=Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [KAVPersonal50] Number=4296 Confirmed=Y Filename=Kav.exe Description=Kaspersky Anti-Virus Personal 5.0 Source=Paul Collins Startup list [KAVPersonal90] Number=4297 Confirmed=X Filename=wscntfy.exe Description=Added by the BANKER-FZ TROJAN! Source=Paul Collins Startup list [KavPFW] Number=4298 Confirmed=Y Filename=KavPFW.exe Description=KingSoft Personal Firewall Source=Paul Collins Startup list [KavRuns] Number=4299 Confirmed=X Filename=Windll.exe Description=Added by the TRYNOMA TROJAN! Source=Paul Collins Startup list [KavStart] Number=4300 Confirmed=Y Filename=KAVStart.exe Description=KingSoft Personal Firewall Source=Paul Collins Startup list [kavsvc] Number=4301 Confirmed=Y Filename=kavsvc.exe Description=Kaspersky antivirus Source=Paul Collins Startup list [kavsvc] Number=4302 Confirmed=X Filename=[random 6 char filename] Description=Qoologic downloader trojan variant using random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) - do not confuse with the Kaspersky antivirus startup item, as described here Source=Paul Collins Startup list [KavSvc] Number=4303 Confirmed=X Filename=******.exe reg_run [* = random char] Description=Added by the QOOLOGIC TROJAN! Source=Paul Collins Startup list [kavsvc] Number=4304 Confirmed=X Filename=[random 6 char filename] Description=Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) Source=Paul Collins Startup list [KAVutil] Number=4305 Confirmed=X Filename=[worm filename] Description=Added by the WINTOO.B WORM! Source=Paul Collins Startup list [KAZAA] Number=4306 Confirmed=N Filename=kazaa.exe Description=KAZAA is a file-sharing program which unfortunately being ad-based includes "Cy-door" adware. Check here for information about "Cy-door" and here for a program that can remove it Source=Paul Collins Startup list [Kazaa Download Accelerator Updater (required)] Number=4307 Confirmed=X Filename=regsvr32 [path] kdp****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [Kazaa lptt01] Number=4308 Confirmed=X Filename=kazaa.exe Description=RapidBlaster variant (in a "kazaa" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same executable name Source=Paul Collins Startup list [Kazaa ml097e] Number=4309 Confirmed=X Filename=kazaa.exe Description=RapidBlaster variant (in a "kazaa" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid KaZaA file sharing program which has the same executable name Source=Paul Collins Startup list [KAZAACuf] Number=4310 Confirmed=X Filename=9 Description=Added by the KITRO.D (or ARGEN.A) WORM! Source=Paul Collins Startup list [kazaalite] Number=4311 Confirmed=N Filename=kazaalite.exe Description=Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original, this one does not contain any advertising or tracking mechanisms Source=Paul Collins Startup list [KaZooM] Number=4312 Confirmed=N Filename=KaZooM.Exe Description=KaZoom from Blue Haven Media - "add-on application that automatically speeds up the download process and finds the files you want with far more power than regular KaZaA searches" Source=Paul Collins Startup list [KB891711] Number=4313 Confirmed=Y Filename=KB891711.exe Description=Installed by the Windows KB891711 critical update, see this security bulletin - this file reportedly needs to continue running in order to patch the vulnerability, at least until a more practical solution is found. There have however been reports of fatal exception errors in systems running Windows 98, and in such a case Microsoft advises to either uninstall the patch (Add/Remove Programs) or prevent it from running at startup Source=Paul Collins Startup list [KB918547] Number=4314 Confirmed=Y Filename=KB918547.EXE Description=Bug-fix for a Microsoft graphics rendering engine vulnerability - see here. Windows 98/Me only Source=Paul Collins Startup list [KB926239] Number=4315 Confirmed=Y Filename=rundll32.exe [path] apphelp.dll, ShimFlushCache Description=Microsoft KB926239 fix. Windows Media Player 10 may close unexpectedly on a Windows XP-based computer Source=Paul Collins Startup list [KBD] Number=4316 Confirmed=U Filename=KBD.EXE Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [KBD MediaCenter] Number=4317 Confirmed=U Filename=MEDIACTR.EXE Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [kbddrv32] Number=4318 Confirmed=X Filename=kbddrv32.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [kbddrvinf] Number=4319 Confirmed=X Filename=kbddrvinf.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [KCeasy] Number=4320 Confirmed=N Filename=KCeasy.exe Description=KCeasy - a Windows peer-to-peer filesharing application which uses giFT as its 'back end' foundation. The networks currently supported are OpenFT and Gnutella Source=Paul Collins Startup list [KClient] Number=4321 Confirmed=U Filename=kstatus.exe Description=KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet Source=Paul Collins Startup list [kdx] Number=4322 Confirmed=N Filename=KHost.exe Description=KonTiki Secure Delivery Plug In related. "The Kontiki Delivery Management System (DMS) is a secure delivery network for distribution of video, software, audio, documents, and other digital media. The Kontiki DMS enables enterprises to efficiently publish, secure, deliver and track digital media to employees, partners, and customers" Source=Paul Collins Startup list [KE9801] Number=4323 Confirmed=U Filename=DriBat32.exe Description=KE9801 multimedia keyboard driver - required if you use the multimedia keys Source=Paul Collins Startup list [Keenvalue] Number=4324 Confirmed=X Filename=Keenvalue.exe Description=eUniverse/KeenValue adware Source=Paul Collins Startup list [KEMailKb] Number=4325 Confirmed=U Filename=KEMailKb.EXE Description=Controls the buttons at the top of the Micro Innovations 650i Internet Access Keyboard. If you disable it you cannot use the buttons - like volume control or shut down Source=Paul Collins Startup list [Kemet] Number=4326 Confirmed=? Filename=kemet.exe Description=?? Source=Paul Collins Startup list [Kerio VPN Client] Number=4327 Confirmed=U Filename=kvpnclient.exe Description=Kerio VPN Client Source=Paul Collins Startup list [kern64dll] Number=4328 Confirmed=X Filename=[random filename] Description=Added by the TARNO.J TROJAN! Source=Paul Collins Startup list [Kernal Fault Check] Number=4329 Confirmed=X Filename=ntosrkl.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [kernctl32] Number=4330 Confirmed=X Filename=rundll32 kctl32.dll, initialize Description=Added by the AGENT.AT TROJAN! Source=Paul Collins Startup list [Kerne0223] Number=4331 Confirmed=X Filename=Kerne0223.exe Description=Added by the LEGMIR-ZA TROJAN! Source=Paul Collins Startup list [Kernel] Number=4332 Confirmed=X Filename=bboy.exe Description=Added by the MUMU.B WORM! Source=Paul Collins Startup list [Kernel] Number=4333 Confirmed=X Filename=services.exe Description=Added by the FOOZ-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [KERNEL 32] Number=4334 Confirmed=X Filename=SKERNEL32.com Description=Added by the SEMAPI-A WORM Source=Paul Collins Startup list [Kernel and Hardware Abstraction Layer] Number=4335 Confirmed=U Filename=KHALMNPR.EXE Description=Part of the Logitech Setpoint software for their wired and wireless mice and trackballs. Sets the Windows mouse sensitivity to minimum. The idea is that you will use the SetPoint Control Panel to adjust your mouse sensitivity. This setting is maintained separately from the Windows setting, but is combined with the Windows setting to determine the final sensitivity. For this reason, KHALMNPR sets the Windows setting to 0 so it doesn't alter the one you set in SetPoint Source=Paul Collins Startup list [Kernel Faults] Number=4336 Confirmed=X Filename=ftphost.exe Description=Added by the RBOT.BHU WORM! Source=Paul Collins Startup list [Kernel Loader] Number=4337 Confirmed=X Filename=ntkrnl.exe Description=Added by the CERVIVEC.A WORM! Source=Paul Collins Startup list [Kernel Manager] Number=4338 Confirmed=X Filename=krnlmgr.exe Description=Added by the JUNY.A TROJAN! Source=Paul Collins Startup list [Kernel Services] Number=4339 Confirmed=X Filename=service32.exe Description=Added by the PRX-B TROJAN! Source=Paul Collins Startup list [kernel system daemon] Number=4340 Confirmed=X Filename=ACTIVAT0R.exe Description=Added by the RANDEX.AW WORM! Source=Paul Collins Startup list [kernel12.exe] Number=4341 Confirmed=X Filename=kernel12.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [kernel32] Number=4342 Confirmed=X Filename=kern32.exe Description=Added by the BADTRANS.A WORM! Source=Paul Collins Startup list [Kernel32] Number=4343 Confirmed=X Filename=Kernel32.exe Description=Added by a number of VIRUSES, WORMS and TROJANS! Source=Paul Collins Startup list [kernel32] Number=4344 Confirmed=X Filename=kernel.dli Description=Added by the NETDEVIL.B TROJAN! Source=Paul Collins Startup list [Kernel32] Number=4345 Confirmed=X Filename=Kernel.dll Description=Added by the REDLOF.M VIRUS! Source=Paul Collins Startup list [kernel32] Number=4346 Confirmed=X Filename=kernel32.dlI Description=Added by the NETDEVIL.15 TROJAN! Source=Paul Collins Startup list [Kernel32] Number=4347 Confirmed=X Filename=krnl32.exe Description=Added by the EPON WORM! Source=Paul Collins Startup list [Kernel32] Number=4348 Confirmed=X Filename=Kernel32.win Description=Added by the GAGGLE.D or GAGGLE.E WORMS! Source=Paul Collins Startup list [Kernel32] Number=4349 Confirmed=X Filename=kernel32s.exe Description=Added by the SDBOT-PU TROJAN! Source=Paul Collins Startup list [kernel32] Number=4350 Confirmed=X Filename=kernel32.dll.vbs Description=Added by the WEKODE-A WORM! Source=Paul Collins Startup list [Kernel32] Number=4351 Confirmed=X Filename=svchosts.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [kernel32dll] Number=4352 Confirmed=X Filename=guardpc.exe Description=Added by the FORBOT-CU WORM! Source=Paul Collins Startup list [KernelCheck] Number=4353 Confirmed=X Filename=sys****.exe [* = digit] Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [KernelCheck] Number=4354 Confirmed=X Filename=winser.exe Description=Added by the TSPY_LMIR.SL TROJAN! Source=Paul Collins Startup list [kernelfaultcheck] Number=4355 Confirmed=N Filename=dumprep 0 -k Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [kernelfaultcheck] Number=4356 Confirmed=N Filename=dumprep 0 -u Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [KernelFaultCheck] Number=4357 Confirmed=X Filename=ptool32.exe Description=Added by the LEGMIR-BN TROJAN! Source=Paul Collins Startup list [KernelFaultChk] Number=4358 Confirmed=X Filename=sms.exe Description=Added by the DEADHAT WORM! Do not confuse with the valid "kernelfaultcheck" which runs "dumprep 0 -k" or "dumprep 0 -u" Source=Paul Collins Startup list [Kernell] Number=4359 Confirmed=X Filename=systems.exe Description=Added by the TARNO.C TROJAN! Source=Paul Collins Startup list [Kernell32] Number=4360 Confirmed=X Filename=Kernell.dll Description=Added by the DESTINY.A TROJAN! Source=Paul Collins Startup list [KernellApps] Number=4361 Confirmed=X Filename=csrss.exe Description=Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [KernellApps] Number=4362 Confirmed=X Filename=lexplore.exe Description=Added by the BANCBAN-BS TROJAN! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [KernellApps32] Number=4363 Confirmed=X Filename=smss.exe Description=Added by the BANCBAN-AN TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Kernelw] Number=4364 Confirmed=X Filename=Kernelw32.exe Description=Added by the INDOR.E WORM! Source=Paul Collins Startup list [Kernel_check] Number=4365 Confirmed=X Filename=wmiprvse.exe Description=Added by the SONEBOT-B WORM! Note - this is not the legitimate wmiprvse.exe process which is always located in the System32\wbem folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [key] Number=4366 Confirmed=X Filename=sysxp.exe Description=Added by the BEAGLE.AB WORM! Source=Paul Collins Startup list [key] Number=4367 Confirmed=X Filename=sys_xp.exe Description=Added by the BEAGLE.AC WORM! Source=Paul Collins Startup list [key] Number=4368 Confirmed=X Filename=winxp.exe Description=Added by the BEAGLE.AG WORM! Source=Paul Collins Startup list [Key Logger] Number=4369 Confirmed=X Filename=csrss.exe Description=Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the root folder - normally C: Source=Paul Collins Startup list [Key Text] Number=4370 Confirmed=N Filename=KeyText.exe Description=Key Text 2000 from MJMSoft Design - utility to automate repetitive keyboard tasks. Available via Start -> Programs Source=Paul Collins Startup list [Key1] Number=4371 Confirmed=X Filename=Rlid.exe Description=Added by the LIXY TROJAN! Source=Paul Collins Startup list [Key2] Number=4372 Confirmed=? Filename=serve.exe Description=?? Source=Paul Collins Startup list [key2] Number=4373 Confirmed=X Filename=winlog.exe Description=Added by the BAGLEDI-AL TROJAN! Source=Paul Collins Startup list [KeyAccess] Number=4374 Confirmed=Y Filename=keyacc32.exe Description=KeyServer KeyAccess client software - "when the KeyServer program is launched, the KeyServer process becomes active so license requests from client computers can be serviced. Without KeyAccess, a keyed program cannot run, so license control is very secure" Source=Paul Collins Startup list [Keybdcntl] Number=4375 Confirmed=X Filename=keybdcntl.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [KeyBoard] Number=4376 Confirmed=U Filename=Keyboard.exe Description=Labtec keyboard utility Source=Paul Collins Startup list [keyboard] Number=4377 Confirmed=X Filename=keyboard*.exe [* = number] Description=Recognized by Kaspersky antivirus as TrojanDownloader.VB.zg Source=Paul Collins Startup list [keyboard] Number=4378 Confirmed=X Filename=kybrdef_7.exe Description=DollarRevenue adware Source=Paul Collins Startup list [keyboard] Number=4379 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADR-AOZ TROJAN! Source=Paul Collins Startup list [Keyboard Manager] Number=4380 Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [Keyboard Preload Check] Number=4381 Confirmed=Y Filename=Preload.exe Description=Millenium Multi-Function Keyboard driver Source=Paul Collins Startup list [keyboard_enum] Number=4382 Confirmed=X Filename=keyboard_enum.exe Description=Added by the GP TROJAN! Source=Paul Collins Startup list [KeyMaestro] Number=4383 Confirmed=U Filename=kmaestro.exe Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [keymap] Number=4384 Confirmed=U Filename=keymap.exe Description=System Tray utility and background task used by games produced by Kesmai (published by Interactive Magic) and which enables you to program keys to do specific actions during the game Source=Paul Collins Startup list [keymgrldr] Number=4385 Confirmed=X Filename=rundll32 setupapi, InstallHinfSection... keymgr3.inf Description=CoolWebSearch Oemsyspnp parasite variant Source=Paul Collins Startup list [KeyPatrol] Number=4386 Confirmed=U Filename=KeyPatrol.exe Description=KeyPatrol - key logger detector using both behavioral and pattern-matching algorithms that used to be part of PestPatrol before CA's aquisition Source=Paul Collins Startup list [keyserv] Number=4387 Confirmed=X Filename=keyserv.exe Description=KeyThief spyware Source=Paul Collins Startup list [Keyspan Digital Media Remote] Number=4388 Confirmed=U Filename=KDMRdmn.exe Description=Remote control driver for Keyspan Digital Media Remote devices Source=Paul Collins Startup list [keystroke] Number=4389 Confirmed=U Filename=keystroke.exe Description=QuickLaunch surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [KeyWallet] Number=4390 Confirmed=U Filename=KWallet.exe Description="KeyWallet is a useful and convenient desktop utility that spares you the trouble of filling in your logins, passwords and other personal data manually" Source=Paul Collins Startup list [kfienq] Number=4391 Confirmed=X Filename=masbl.bat Description=Added by the KIFER TROJAN! Source=Paul Collins Startup list [Kgjg] Number=4392 Confirmed=X Filename=rnnypbw.exe Description=Added by the QuickLinks/Forethought adware Source=Paul Collins Startup list [khooker] Number=4393 Confirmed=N Filename=khooker.exe Description=SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required Source=Paul Collins Startup list [KICKMON.EXE] Number=4394 Confirmed=U Filename=KICKMON.EXE Description=KeepItClean - utility that deletes safe to remove files, cookies, browsing history, etc. This is the scheduler - if you don't schedule clean-ups it isn't required Source=Paul Collins Startup list [Kill Popup] Number=4395 Confirmed=U Filename=KillPopup.exe Description=KillPopup - pop-up stopper Source=Paul Collins Startup list [KillAndClean] Number=4396 Confirmed=N Filename=KillAndClean.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [kimochiz.exe] Number=4397 Confirmed=X Filename=kimochiz.exe Description=Added by the MDROP-BB TROJAN! Source=Paul Collins Startup list [Kinberlink] Number=4398 Confirmed=N Filename=Kinberlink.exe Description=Kinberlink network messaging. Available via Start -> Programs Source=Paul Collins Startup list [KIT3] Number=4399 Confirmed=X Filename=hpprintqueue.exe Description=Added by the ADCLICK-DS TROJAN! Source=Paul Collins Startup list [KK Loader] Number=4400 Confirmed=U Filename=loadkk.exe Description=KeyKey XP Professional from KeyKey.com. "Monitor Instant Messages, Chats, Emails, Web Site URLs, Passwords, Computer Programs, Start Up and Shut Down time and much more completely undetected to the user." Source=Paul Collins Startup list [KKM Service] Number=4401 Confirmed=X Filename=kkm.exe Description=Added by the NANPY-I WORM! Source=Paul Collins Startup list [KL AntiFunLove] Number=4402 Confirmed=X Filename=flcss.exe Description=Added by the FUNLOVE.4099 WORM! Source=Paul Collins Startup list [KLog] Number=4403 Confirmed=U Filename=Keyspy.exe Description=KeyLoggPro.B keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [klop] Number=4404 Confirmed=X Filename=[path to file] Description=Added by the AGENT-WQ TROJAN! Source=Paul Collins Startup list [klop] Number=4405 Confirmed=X Filename=[random].tmp Description=Found with Trojan.Win32.StartPage.aw. Possibly a variant of the AGENT-WQ TROJAN! Source=Paul Collins Startup list [klp] Number=4406 Confirmed=U Filename=run32dll.exe Description=PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online Source=Paul Collins Startup list [klp] Number=4407 Confirmed=U Filename=explorer.exe Description=ComSurveilSys keystroke logger/monitoring program - remove unless you installed it yourself! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is found in a System\PAL\CSS subfolder Source=Paul Collins Startup list [KM9801U] Number=4408 Confirmed=U Filename=MMHotKey.exe Description=Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen Source=Paul Collins Startup list [kmw_run.exe] Number=4409 Confirmed=U Filename=kmw_run.exe Description=Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features Source=Paul Collins Startup list [kmw_show.exe] Number=4410 Confirmed=U Filename=kmw_show.exe Description=Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features Source=Paul Collins Startup list [KN_PanelApp] Number=4411 Confirmed=U Filename=PanelApp.exe Description=KnowledgePanel online survey software Source=Paul Collins Startup list [Kodak Batch Transfer] Number=4412 Confirmed=N Filename=pezdow1.exe Description=Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC Source=Paul Collins Startup list [Kodak EasyShare software] Number=4413 Confirmed=U Filename=EasyShare.exe Description=Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually Source=Paul Collins Startup list [Kodak Picture Easy *.* Batch Transfer] Number=4414 Confirmed=N Filename=PezDownload.exe Description=Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version Source=Paul Collins Startup list [Kodak Picture Transfer Software] Number=4415 Confirmed=N Filename=pts.exe Description=Looks for Kodak camera connection and media insertion. Available via Start -> Programs Source=Paul Collins Startup list [Kodak Software Updater] Number=4416 Confirmed=N Filename=backweb*****.exe Description=Software updater for Kodak Easyshare digital cameras Source=Paul Collins Startup list [KodakCCS] Number=4417 Confirmed=Y Filename=KodakCCS.exe Description=Kodak DC File System Driver Source=Paul Collins Startup list [Komunikator] Number=4418 Confirmed=U Filename=tlen.exe Description=Tlen - a Polish language instant messaging client Source=Paul Collins Startup list [KONICA MINOLTA magicolor 2400W STD] Number=4419 Confirmed=U Filename=MSTMON_S.EXE Description=Konica Minolta Magicolor 2400W colour printer monitor Source=Paul Collins Startup list [Konni Symbol Autostart] Number=4420 Confirmed=N Filename=KonniSymbol.exe Description=Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5 Source=Paul Collins Startup list [kontiki] Number=4421 Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [KPDrv4XP] Number=4422 Confirmed=Y Filename=KPDrv4XP.exe Description=MediaKey USB Keypad Driver Source=Paul Collins Startup list [KPFW32.EXE] Number=4423 Confirmed=Y Filename=KPFW32.EXE Description=KingSoft Personal Firewall Source=Paul Collins Startup list [KPFWSvc.EXE] Number=4424 Confirmed=Y Filename=KPFWSvc.EXE Description=KingSoft Personal Firewall Source=Paul Collins Startup list [Kraidman] Number=4425 Confirmed=U Filename=Kraidman.exe Description="Toshiba RAID Support is a Toshiba EasyGuard feature that uses RAID Level 1 technology to minimise downtime by protecting against data loss and ensuring quick data recovery" - for Toshiba laptops Source=Paul Collins Startup list [KREC32] Number=4426 Confirmed=U Filename=krec32.exe Description=StarrCommander Pro Keystroke logging software Source=Paul Collins Startup list [KRNL] Number=4427 Confirmed=X Filename=Kernl32.exe Description=Added by the ZOMBY.B TROJAN! Source=Paul Collins Startup list [Krnlcheck] Number=4428 Confirmed=X Filename=csrss.exe Description=Added by the BOTNACHALA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Krnlmod] Number=4429 Confirmed=U Filename=Krnlmod.exe Description=Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Kryptel Component Start] Number=4430 Confirmed=U Filename=Kicker.exe Description=Kryptel encryption software Source=Paul Collins Startup list [ksrlnhm] Number=4431 Confirmed=X Filename=zxatgso.exe Description=Added by the DLOADER-LI TROJAN! Source=Paul Collins Startup list [Ksrv32] Number=4432 Confirmed=X Filename=Ksrv32.exe Description=Added by the AGOBOT-PI WORM! Source=Paul Collins Startup list [KTAX Auto Loader] Number=4433 Confirmed=X Filename=ktax.exe Description=Added by the SDBOT-MZ WORM! Source=Paul Collins Startup list [ktchnsnk] Number=4434 Confirmed=U Filename=ktchnsnk.exe Description=HP program found with the Office Jet 500/600/700 series which initializes the Office Jet manager each time the computer is booted up or rebooted Source=Paul Collins Startup list [KV2005] Number=4435 Confirmed=X Filename=word.EXE Description=Added by the IW TROJAN! Source=Paul Collins Startup list [kv3000] Number=4436 Confirmed=X Filename=lover.vbe Description=Added by the ZSYANG.B WORM! Source=Paul Collins Startup list [kvern16.dll] Number=4437 Confirmed=X Filename=regsvr32.exe [path] kvern16.dll Description=DailyWinner adware Source=Paul Collins Startup list [KV_HOST] Number=4438 Confirmed=X Filename=cxjx.exe Description=Added by the LEGMIR-BB TROJAN! Source=Paul Collins Startup list [kw3eef76] Number=4439 Confirmed=X Filename=rundll32.exe [path] kw3eef76.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [kX Mixer] Number=4440 Confirmed=N Filename=kxmixer.exe Description=Provides Mixer and Control functionality to KxProject Audio driver for EMU10k based soundcards Source=Paul Collins Startup list [KX509] Number=4441 Confirmed=U Filename=kx509_kfwk5.exe Description=Kerberos Secure Authentication for Windows Source=Paul Collins Startup list [KYE_Showicon] Number=4442 Confirmed=? Filename=shwicon.exe Description=Card reader for memory cards from digital cameras. Is it required? Source=Paul Collins Startup list [KYK Control Settings] Number=4443 Confirmed=X Filename=KYSVCXD.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [KYM Control Settings] Number=4444 Confirmed=X Filename=phqghum.exe Description=Added by the RBOT.BQD WORM! Source=Paul Collins Startup list [L4r1$$a] Number=4445 Confirmed=X Filename=L4r1$$a.pif Description=Added by the ASSIRAL-C WORM! Source=Paul Collins Startup list [laltin] Number=4446 Confirmed=X Filename=L90112201.Stub.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [LAN Driver] Number=4447 Confirmed=X Filename=landriver32.exe Description=Added by the RBOT.BT WORM! Source=Paul Collins Startup list [lanbrup] Number=4448 Confirmed=X Filename=lanbrup.exe Description=SafeSurfing adware Source=Paul Collins Startup list [LanguageMonitor] Number=4449 Confirmed=U Filename=Oplmsb01.exe Description=OKI Printer language support monitor Source=Paul Collins Startup list [LanGuard] Number=4450 Confirmed=X Filename=languard.exe Description=Adware downloader - also detected as the SECONDT-C TROJAN! Source=Paul Collins Startup list [LanGuard] Number=4451 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-VO TROJAN! Source=Paul Collins Startup list [LANMessage Pro] Number=4452 Confirmed=U Filename=LANMES~1.exe Description=LANMessage Pro - "a powerful tool for communicating with other people on your office/home network" Source=Paul Collins Startup list [LanSpeed2] Number=4453 Confirmed=U Filename=LanSpeed2.exe Description=Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card) Source=Paul Collins Startup list [LaoKey] Number=4454 Confirmed=U Filename=LaoKey.exe Description=Lao Script for Windows (LSWin) is an extension to the Windows operating system to allow Lao language to be used with many different Windows-based applications Source=Paul Collins Startup list [LapLink scheduler] Number=4455 Confirmed=U Filename=Llsched.exe Description=Utility that automatically performs file transfers as unattended background operations Source=Paul Collins Startup list [Lar] Number=4456 Confirmed=X Filename=Llass.exe Description=Added by the INOR-A TROJAN! Source=Paul Collins Startup list [lar] Number=4457 Confirmed=X Filename=[trojan filename] Description=Added by the ROXY.C TROJAN! Source=Paul Collins Startup list [LARISSA ANTI VIRUS] Number=4458 Confirmed=X Filename=LARISSA_ANTI_VIRUS.exe Description=Added by the KLASSIR TROJAN! Source=Paul Collins Startup list [Lasb] Number=4459 Confirmed=? Filename=ewat.exe Description=?? Source=Paul Collins Startup list [LasErma] Number=4460 Confirmed=X Filename=Ermasys32.exe Description=Added by the LERMA-A WORM! Source=Paul Collins Startup list [LAsIAf32] Number=4461 Confirmed=X Filename=RePEAtLD.exe Description=Added by the REPEATLD WORM! Source=Paul Collins Startup list [LASTinst] Number=4462 Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Later] Number=4463 Confirmed=? Filename=later.exe Description=?? Source=Paul Collins Startup list [LaunApp] Number=4464 Confirmed=U Filename=LaunApp.exe Description=Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Source=Paul Collins Startup list [Launcg] Number=4465 Confirmed=? Filename=launcg.exe Description=?? Source=Paul Collins Startup list [Launch Ai Booster] Number=4466 Confirmed=U Filename=OverClk.exe Description=ASUS Ai Booster is an application that allows you to overclock the CPU either manually or automatically without the hassle of entering the BIOS Setup Source=Paul Collins Startup list [Launch Context 5.0] Number=4467 Confirmed=N Filename=Launch.exe Description=Context - electronic dictionary Source=Paul Collins Startup list [Launch LCDMon] Number=4468 Confirmed=U Filename=LCDMon.exe Description=Logitech LCD G-Series software driver Source=Paul Collins Startup list [Launch LCDMon] Number=4469 Confirmed=N Filename=LCDMon.exe Description=Driver/utility for Logitech G-Series gaming keyboards and mice Source=Paul Collins Startup list [Launch LGDCore] Number=4470 Confirmed=U Filename=LGDCore.exe Description=Driver/utility for Logitech G-Series gaming keyboards and mice Source=Paul Collins Startup list [Launch Norton AntiVirus 2000] Number=4471 Confirmed=X Filename=jorgf.exe Description=Added by the RBOT-AUI WORM! Source=Paul Collins Startup list [Launch YahooPOPs! at Windows startup] Number=4472 Confirmed=N Filename=YAHOOPOPS.EXE Description=YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs Source=Paul Collins Startup list [LaunchAp] Number=4473 Confirmed=U Filename=LaunchAp.exe Description=Programmable keys on Acer, Fujitsu and other laptops Source=Paul Collins Startup list [LaunchApp] Number=4474 Confirmed=U Filename=Alaunch.exe Description=Acer Launch tool utility on laptops Source=Paul Collins Startup list [Launchboard] Number=4475 Confirmed=U Filename=lnchbrd.exe Description="LaunchBoard software from Darwin turns your keyboard into a remote control for the Internet and your computer! With LaunchBoard 2.0, you can customize up to 38 keys on your PC keyboard to instantly launch Web Sites, start applications, perform custom macros, handle Windows shortcuts, store passwords, and perform loads of other customizable functions" Source=Paul Collins Startup list [Launcher] Number=4476 Confirmed=X Filename=launcher.exe Description=Spyware component related to DownloadWare and found in Program FilesKFH Source=Paul Collins Startup list [Launcher] Number=4477 Confirmed=N Filename=relaunch.exe Description=Audio Applications Launcher for the Philips Rythmic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtray). Available via Start -> Programs Source=Paul Collins Startup list [Lavasoft Ad-Aware] Number=4478 Confirmed=X Filename=Ad-Aware.exe Description=Added by the RBOT-SO WORM! Note - this is not the popular Ad-aware spware/adware removal tool Source=Paul Collins Startup list [Lavasoft Adwatch] Number=4479 Confirmed=U Filename=Ad-watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [laxmsp32.exe] Number=4480 Confirmed=Y Filename=laxmsp32.exe Description=Lexmark Scan and Copy Control Program for the X63 (and maybe others) printer/scanner. Required for the scanner to work Source=Paul Collins Startup list [layersldm] Number=4481 Confirmed=X Filename=hostplsrvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Laz] Number=4482 Confirmed=X Filename=Kernn.exe Description=Added by the BANCOS-LN WORM! Source=Paul Collins Startup list [Lcass] Number=4483 Confirmed=X Filename=Lcass.exe Description=Added by the SILLYFDC-W WORM! Source=Paul Collins Startup list [LCDC] Number=4484 Confirmed=U Filename=LCDC.exe Description=LCDC is an application that displays various information on your LCD or VFD screen. The number of things that LCDC can do is expandable by Plugins Source=Paul Collins Startup list [LCDMon] Number=4485 Confirmed=Y Filename=LCDMon.exe Description=Driver/utility for Logitech G-Series gaming keyboards and mice Source=Paul Collins Startup list [LCDPlayer] Number=4486 Confirmed=Y Filename=LCDPlyer.exe Description=Related to SuperAdBlocker Source=Paul Collins Startup list [lcfep] Number=4487 Confirmed=N Filename=lcfep.exe Description=Tivoli 'TME' System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally" Source=Paul Collins Startup list [LCIDConfig] Number=4488 Confirmed=? Filename=lcidchng.exe Description=?? Source=Paul Collins Startup list [LClock] Number=4489 Confirmed=U Filename=lclock.exe Description=LClock is a program that makes the Windows' clock look like a Windows Longhorn Clock Source=Paul Collins Startup list [lcvga] Number=4490 Confirmed=X Filename=lcvga.exe Description=Added by the HOSTOL-A TROJAN! Source=Paul Collins Startup list [ld] Number=4491 Confirmed=X Filename=ld.exe Description=CoolWebSearch Tooncomics parasite affiliate variant - redirects to fastwebfinder.com Source=Paul Collins Startup list [LDM] Number=4492 Confirmed=N Filename=backweb-8876480.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [LDM] Number=4493 Confirmed=N Filename=ldmconf.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [LDM] Number=4494 Confirmed=N Filename=LogitechDesktopMessenger.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [ldriver] Number=4495 Confirmed=X Filename=ldriver.exe Description=Added by the CHORUS-A TROJAN! Searchforfree browser hijacker Source=Paul Collins Startup list [LED TRAY] Number=4496 Confirmed=U Filename=LEDTRAY.EXE Description=Installs a USB compact flash card reader or drive on start-up. The device is distributed by Microtech and is made by a company called SnapShot. Required if you want the reader to work Source=Paul Collins Startup list [ledpointer] Number=4497 Confirmed=U Filename=CNYHKey.exe Description=Chicony Electronics Multimedia Keyboard Hotkey Driver Source=Paul Collins Startup list [LeechGet] Number=4498 Confirmed=N Filename=LeechGet.exe Description=LeechGet download manager Source=Paul Collins Startup list [leeman] Number=4499 Confirmed=X Filename=leeman.exe Description=Added by the COSIAM-D TROJAN! Source=Paul Collins Startup list [LEMSRV] Number=4500 Confirmed=X Filename=lemsrv.exe Description=Added by the IRCBOT-TC TROJAN! Source=Paul Collins Startup list [LetsSearch] Number=4501 Confirmed=X Filename=LetsSearch.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Letum] Number=4502 Confirmed=X Filename=[path to worm] Description=Added by the LETUM.A WORM! Source=Paul Collins Startup list [Lexmark **** Series] Number=4503 Confirmed=U Filename=lxbabmgr.exe Description=Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark **** Series] Number=4504 Confirmed=U Filename=lxbkbmgr.exe Description=Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark **** series] Number=4505 Confirmed=U Filename=lxbtbmgr.exe Description=Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark **** Series] Number=4506 Confirmed=U Filename=lxbmbmgr.exe Description=Lexmark System Tray application (where "****" is the model) that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark 2200 Series Button Manager] Number=4507 Confirmed=Y Filename=lxbvbmgr.exe Description=Lexmark printer button manager. Required for correct operation Source=Paul Collins Startup list [Lexmark 3100 Series] Number=4508 Confirmed=Y Filename=lxbrbmgr.exe Description=Lexmark printer button manager. Required for correct operation Source=Paul Collins Startup list [Lexmark X6100 Series] Number=4509 Confirmed=Y Filename=lxbfbmgr.exe Description=Lexmark X6100 printer button manager - required for correct operation Source=Paul Collins Startup list [Lexmark Xxx Button Manager] Number=4510 Confirmed=Y Filename=AcBtnMgr_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [Lexmark Xxx Button Monitor] Number=4511 Confirmed=Y Filename=ACMonitor_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [LexmarkPrinTray] Number=4512 Confirmed=N Filename=printray.exe Description=Lexmark Printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. Can also be listed as PrinTray Source=Paul Collins Startup list [Lexmark_X79-55] Number=4513 Confirmed=X Filename=lsasss.exe Description=Added by the ZONEBAC TROJAN! Source=Paul Collins Startup list [lexplore] Number=4514 Confirmed=X Filename=lexplore.exe Description=Added by the BROPIA WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [lexpps] Number=4515 Confirmed=N Filename=lexpps.exe Description=For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC, the file is not used, (or should not be used) at all". It is known that firewalls can however alert you to "lexpps.exe" requesting server privileges Source=Paul Collins Startup list [LexStart] Number=4516 Confirmed=U Filename=lexstart.exe Description=Lexmark printer software may add Lexstart.exe in the startup folder to handle print commands that you send to the printer. Sometimes required for the printer to work correctly - not in the case of a Lexmark Z42 for instance Source=Paul Collins Startup list [Lfh] Number=4517 Confirmed=X Filename=Lfh.exe Description=Added by the ZAURGA-A TROJAN! Source=Paul Collins Startup list [Lfsndmng] Number=4518 Confirmed=U Filename=lfsndmng.exe Description=LightningFAX Enterprise Fax Server - "puts faxing at the fingertips of networked enterprise users. It enables rapid, secure sending and Direct-To-Desktop Delivery of mission-critical documents" Source=Paul Collins Startup list [LGDCore] Number=4519 Confirmed=U Filename=LGDCore.exe Description=Driver/utility for Logitech G-Series gaming keyboards and mice Source=Paul Collins Startup list [lgm] Number=4520 Confirmed=X Filename=lgm.exe Description=Added by the ACID-F WORM! Source=Paul Collins Startup list [LGODDFU] Number=4521 Confirmed=U Filename=fwupdate.exe Description=Auto firmware update program for LG Electronics CD-ROM/DVD writer Source=Paul Collins Startup list [LgWDskTp] Number=4522 Confirmed=U Filename=LgWDskTp.exe Description=Logitech Wireless Desktop mouse and keyboard software. There is an icon for this program on the taskbar next to the clock Source=Paul Collins Startup list [lhttseng] Number=4523 Confirmed=N Filename=rundll32.exe ..lhttseng.inf, RemoveCabinet Description=Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine Source=Paul Collins Startup list [li-multi****] Number=4524 Confirmed=X Filename=li-multi****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-rcash00001] Number=4525 Confirmed=X Filename=vldial.exe Description=Added by the Vl TROJAN! Source=Paul Collins Startup list [li-speed****] Number=4526 Confirmed=X Filename=dlres.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-thund****] Number=4527 Confirmed=X Filename=li-thund****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-vita****] Number=4528 Confirmed=X Filename=li-vita****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li01f948] Number=4529 Confirmed=X Filename=rundll32.exe [path] li01f948.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [LicCrtl] Number=4530 Confirmed=N Filename=runservice.exe Description=Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program Source=Paul Collins Startup list [LicCtrl] Number=4531 Confirmed=U Filename=rundll32.exe [path] MMFS.DLL, Service Description=Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program Source=Paul Collins Startup list [License Manager] Number=4532 Confirmed=X Filename=license_manager.exe Description=MediaPipe peer-to-peer file swapping program also reported as a hijacker Source=Paul Collins Startup list [lich] Number=4533 Confirmed=X Filename=lich.exe Description=Added by QLOWZON-BN TROJAN! Source=Paul Collins Startup list [LidPolicy] Number=4534 Confirmed=U Filename=pwrschem.exe Description=A utility for configuring certain HP notebook models to enter Standby mode when the lid is closed only when running on battery Source=Paul Collins Startup list [Life FireWall Update1] Number=4535 Confirmed=X Filename=FireWall-Update1.exe Description=Added by the RBOT-ARS WORM! Source=Paul Collins Startup list [LifeCam] Number=4536 Confirmed=? Filename=LifeExp.exe Description=Related to Microsoft's LifeCam series of webcams. What does it do and is it required? Source=Paul Collins Startup list [LifeDrive Manager] Number=4537 Confirmed=N Filename=LifeDriveMgr.exe Description=Keeps the Palm LifeDrive Manager utility in the systray. Shortcut available via Start -> Programs Source=Paul Collins Startup list [LifeDrive� Manager] Number=4538 Confirmed=U Filename=LifeDriveMgrTray.exe Description=System Tray utility for the Palm LifeDrive Mobile Manager Source=Paul Collins Startup list [LifeScape Media Detector] Number=4539 Confirmed=N Filename=PicasaMediaDetector.exe Description=Media detector for Picasa's automatic photo organizer Source=Paul Collins Startup list [lify] Number=4540 Confirmed=X Filename=yujixit.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Lightning Download] Number=4541 Confirmed=U Filename=Lightning.exe Description=Lightning Download download manager. Can be launched manually, but will need to start up if you want it to "catch clicks" off Internet Explorer Source=Paul Collins Startup list [Limewire] Number=4542 Confirmed=X Filename=LimeWire.exe Description=Added by the RBOT-AGH WORM! Source=Paul Collins Startup list [LimeWire x.x] Number=4543 Confirmed=N Filename=LimeWire.exe Description=LimeWire - Peer to Peer (P2P) file-sharing client. x.x represents the version number. Note - as with all P2P sharing programs they are susceptible to various forms of malware Source=Paul Collins Startup list [Limpet] Number=4544 Confirmed=X Filename=explorer16.exe Description=Added by the RBOT-AJD WORM! Source=Paul Collins Startup list [Line Speed Meter V3.0] Number=4545 Confirmed=N Filename=LineSpeedMeter.exe Description=LineSpeedMeter - detect the download and upload speed of your internet connection Source=Paul Collins Startup list [Lingvo Launcher] Number=4546 Confirmed=U Filename=Lvagent.exe Description=ABBYY Lingvo Electronic Dictionaries Source=Paul Collins Startup list [LingvoTraining] Number=4547 Confirmed=U Filename=Tutor.exe Description=ABBYY Lingvo Electronic Dictionaries Source=Paul Collins Startup list [Linker] Number=4548 Confirmed=X Filename=LinkMaker.exe Description=Links adware Source=Paul Collins Startup list [links] Number=4549 Confirmed=X Filename=links.exe Description=Added by the LOWZONE-BI TROJAN! Source=Paul Collins Startup list [Linksts] Number=4550 Confirmed=N Filename=linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [Linksts] Number=4551 Confirmed=X Filename=linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [Linksys Modem Drivers] Number=4552 Confirmed=X Filename=linksys.exe Description=Added by the IRCBOT.VD WORM! Source=Paul Collins Startup list [linkyuu] Number=4553 Confirmed=X Filename=linkuyy.exe Description=Added by the DLOADER.MC TROJAN! Source=Paul Collins Startup list [Linux] Number=4554 Confirmed=X Filename=Linux.vbs Description=Added by the LOVELETTER.AS VIRUS! Source=Paul Collins Startup list [LiquidView] Number=4555 Confirmed=U Filename=lviewj.exe Description="Liquid View lets you increase the legibility of the Microsoft Windows interface regardless of your display's native resolution. The software lets you increase the size of items that are hard to read on your monitor" Source=Paul Collins Startup list [Lisa] Number=4556 Confirmed=X Filename=Lisa.exe Description=Added by the SCOM-D premium rate adult content dialler Source=Paul Collins Startup list [List checker 32 BIT] Number=4557 Confirmed=X Filename=list32.exe Description=Added by the RBOT-AHO WORM! Source=Paul Collins Startup list [Litebot] Number=4558 Confirmed=X Filename=[path to trojan] Description=Added by the LITEBOT-A TROJAN! Source=Paul Collins Startup list [LIU] Number=4559 Confirmed=N Filename=LIU.exe Description=Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway Source=Paul Collins Startup list [LIU] Number=4560 Confirmed=N Filename=Rubicon.exe Description=Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway Source=Paul Collins Startup list [Live Menu] Number=4561 Confirmed=N Filename=Dllcmd32.exe Description=eFax Send button for eFax Messenger Plus. Available via Start -> Programs Disabling instructions available here Source=Paul Collins Startup list [Live-Help] Number=4562 Confirmed=X Filename=lmns.exe Description=Added by the RBOT-GHE WORM! Source=Paul Collins Startup list [LiveMonitor] Number=4563 Confirmed=N Filename=LMonitor.exe Description=MSI Live Update - auto-detects and suggests the latest BIOS/Driver/Utilities information Source=Paul Collins Startup list [LiveNote] Number=4564 Confirmed=N Filename=Livenote.exe Description=Asus graphics card driver live update feature Source=Paul Collins Startup list [LiveSexCams] Number=4565 Confirmed=X Filename=LiveSexCams.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [LiveUpdate] Number=4566 Confirmed=U Filename=LiveUpdate.exe Description=Web-update utility as used by various types of software - see here Source=Paul Collins Startup list [LiveUpdate] Number=4567 Confirmed=X Filename=[Windows username]05.exe Description=Added by the LINEAGE TROJAN! Source=Paul Collins Startup list [Livre] Number=4568 Confirmed=X Filename=Dibane.bat Description=Added by the BANEDI VIRUS! Source=Paul Collins Startup list [Ljx] Number=4569 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAG-ABD TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). This file is located in the "inf" sub-folder Source=Paul Collins Startup list [lk3h1] Number=4570 Confirmed=X Filename=[path to file] Description=Added by the MOSUCK-G TROJAN! Source=Paul Collins Startup list [LLMODCL2] Number=4571 Confirmed=? Filename=rundll.exe setupx.dll, InstallHinfSection ..LLMODCL2.INF Description=?? Source=Paul Collins Startup list [llsass] Number=4572 Confirmed=X Filename=llsass.exe Description=Added by the PROXY-GG TROJAN! Note - this malware actually changes the default value data of the registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [LM Status] Number=4573 Confirmed=N Filename=LMSTATUS.EXE Description=Xerox WorkCenter XE - language monitor status application Source=Paul Collins Startup list [LMA Manager] Number=4574 Confirmed=X Filename=lmamanager.exe Description=Added by the TILEBOT-AD WORM! Source=Paul Collins Startup list [LManager] Number=4575 Confirmed=U Filename=QtZgAcer.EXE Description=Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio Source=Paul Collins Startup list [LManager] Number=4576 Confirmed=U Filename=QtZpAcer.exe Description=Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio Source=Paul Collins Startup list [LManager] Number=4577 Confirmed=U Filename=HotkeyApp.exe Description=Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio Source=Paul Collins Startup list [LManager] Number=4578 Confirmed=U Filename=QtaET2S.EXE Description=Acer Launch Manager - on Acer laptops, provides configurability for the special keys on their range of multimedia keyboards Source=Paul Collins Startup list [lMAPl] Number=4579 Confirmed=X Filename=lMAPl.exe Description=Added by the AGOBOT-RE WORM! Source=Paul Collins Startup list [LMgrOSD] Number=4580 Confirmed=U Filename=OSDCtrl.exe Description=OSD (on-screen-display) utility - part of Acer Launch Manager. Gives you control to customize the monitor to your liking...from sound, brightness, contrast, horizontal and vertical positions, phase, pixel clock, color and language Source=Paul Collins Startup list [LMonitor] Number=4581 Confirmed=N Filename=LMonitor.exe Description=MSI Live Update - auto-detects and suggests the latest BIOS/Driver/Utilities information Source=Paul Collins Startup list [lmpdpsrv] Number=4582 Confirmed=? Filename=lmpdpsrv.exe Description=Related to a Lexmark printer/scanner. Printer sharing server? Is it required? Source=Paul Collins Startup list [lmrt] Number=4583 Confirmed=X Filename=lmrt.exe Description=Unidentified adware Source=Paul Collins Startup list [LMSTATUS] Number=4584 Confirmed=N Filename=LMSTATUS.EXE Description=Xerox WorkCenter XE - language monitor status application Source=Paul Collins Startup list [LMSXXD] Number=4585 Confirmed=Y Filename=LMSXXD.exe Description=Driver for Xerox XD series printer/copiers Source=Paul Collins Startup list [lmu] Number=4586 Confirmed=X Filename=LMU.exe Description=Downloader trojan, recognized by Kaspersky antivirus as Agent.bg Source=Paul Collins Startup list [lnternet Explorer] Number=4587 Confirmed=X Filename=AMSNDMGR.EXE Description=Added by the KWBOT.R WORM! Note that the "l" is a lower case "L" and not an upper case "I" Source=Paul Collins Startup list [lnwin.exe] Number=4588 Confirmed=X Filename=lnwin.exe Description=Added by the DLOADR-ATC TROJAN! Source=Paul Collins Startup list [load] Number=4589 Confirmed=X Filename=mdm.exe Description=Added by the BINGHE TROJAN! Source=Paul Collins Startup list [load] Number=4590 Confirmed=X Filename=msgsr32.exe Description=Added by the SDBOT-QR WORM! Source=Paul Collins Startup list [load] Number=4591 Confirmed=X Filename=[path to worm] Description=Added by the KELVIR.AI WORM! Source=Paul Collins Startup list [Load] Number=4592 Confirmed=X Filename=MyGame.exe Description=Added by the LAMEYEAR-A WORM! Source=Paul Collins Startup list [load] Number=4593 Confirmed=X Filename=_Kerne1.exe Description=Added by the LINEAGE-AN TROJAN! Source=Paul Collins Startup list [load] Number=4594 Confirmed=X Filename=Internat.exe Description=Added by the WOWCRAFT TROJAN! Source=Paul Collins Startup list [load] Number=4595 Confirmed=X Filename=rundll32.exe Description=Added by the WOWCRAFT TROJAN! Source=Paul Collins Startup list [load] Number=4596 Confirmed=X Filename=svhost32.exe Description=Added by the WOWCRAFT TROJAN! Source=Paul Collins Startup list [load] Number=4597 Confirmed=X Filename=svchsot.exe Description=Added by the GWGHOST-O TROJAN! Source=Paul Collins Startup list [load] Number=4598 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-OZ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [load] Number=4599 Confirmed=X Filename=Kerne121.exe Description=Added by the LINEAGE-ON TROJAN! Source=Paul Collins Startup list [load] Number=4600 Confirmed=X Filename=Kerne1211.exe Description=Added by the LINEAGE-DY TROJAN! Source=Paul Collins Startup list [load] Number=4601 Confirmed=X Filename=rundl132.exe Description=Added by the LOOKED-CK WORM! Source=Paul Collins Startup list [Load Service] Number=4602 Confirmed=X Filename=SvHost.exe Description=Added by the PESIN-D WORM! Source=Paul Collins Startup list [LOAD WB] Number=4603 Confirmed=U Filename=LOADWB.EXE Description=Part of Stardock's WindowBlinds custom desktop program. "WindowBlinds is the first utility of its kind. It extends Win98/NT/2K/XP to have a fully skinnable user interface. You can change the style of title bars, buttons, toolbars and much more". If you use it - keep it if not then uninstall it Source=Paul Collins Startup list [Load-Guard] Number=4604 Confirmed=X Filename=Wscript.exe LGuarg.exe.vbs Description=Added by the YENO.B and YENO.C WORMS! Source=Paul Collins Startup list [LOAD32] Number=4605 Confirmed=X Filename=Lorena.exe Description=Added by the MAPSON.C WORM! Source=Paul Collins Startup list [load32] Number=4606 Confirmed=X Filename=load32.exe Description=Added by the NIBU, BAMBO TROJANS and DUMARU WORM! Source=Paul Collins Startup list [load32] Number=4607 Confirmed=X Filename=l32x.exe Description=Added by the DUMARU.Z or DUMARU.Y or DUMARU.AD WORM! Source=Paul Collins Startup list [load32] Number=4608 Confirmed=X Filename=1111a.exe Description=Added by the DUMARU.AH WORM! Source=Paul Collins Startup list [load32] Number=4609 Confirmed=X Filename=swchost.exe Description=Added by the TURTA.A WORM! Source=Paul Collins Startup list [load32] Number=4610 Confirmed=X Filename=netda.exe Description=Added by the NIBU.E TROJAN! Source=Paul Collins Startup list [load32] Number=4611 Confirmed=X Filename=winldra.exe Description=Added by the BACKDOOR.NIBU.J or DUMARU-BI TROJANS! Note - also known as Srv.SSA-KeyLogger by Sunbelt Software which has developed a free removal tool for this keylogger Source=Paul Collins Startup list [load=] Number=4612 Confirmed=N Filename=adw30.exe Description=After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95 Source=Paul Collins Startup list [load=] Number=4613 Confirmed=U Filename=asistat.exe Description=Status monitor for an NEC SuperScript printer Source=Paul Collins Startup list [load=] Number=4614 Confirmed=? Filename=cfgsys32.exe Description=?? Source=Paul Collins Startup list [load=] Number=4615 Confirmed=U Filename=esspk.exe Description=Speakerphone capability through a soundcard for an ESS modem Source=Paul Collins Startup list [load=] Number=4616 Confirmed=Y Filename=hotkey.exe Description=Solo 5300 display driver for Win2K on some Gateway laptops Source=Paul Collins Startup list [load=] Number=4617 Confirmed=N Filename=HPWHRC.EXE Description=Loads the Status Window software for the HP Laserjet printers Source=Paul Collins Startup list [load=] Number=4618 Confirmed=? Filename=WPSLOAD.EXE Description=Windows printing system that comes with the setup for Canon BJC series on the manufacturer's disk Source=Paul Collins Startup list [load=] Number=4619 Confirmed=N Filename=vi_grm.exe Description=Monitor drivers for Trio2x/3x based video cards - displays control panel for quick access to display settings Source=Paul Collins Startup list [load=] Number=4620 Confirmed=? Filename=WINOSCFG.EXE Description=Could it be something to do with configuring Windows on a new PC from an OEM supplier? Source=Paul Collins Startup list [load=] Number=4621 Confirmed=Y Filename=wpshrc.exe Description=Required to prevent configuration errors on a Compaq LBP-660 and LBP-460 parallel port laser printers (and maybe others) Source=Paul Collins Startup list [load=] Number=4622 Confirmed=Y Filename=Bfrecv.exe Description=Bitware modem driver Source=Paul Collins Startup list [load=] Number=4623 Confirmed=X Filename=msater.exe Description=Added by the RETSAM TROJAN! Source=Paul Collins Startup list [load=] Number=4624 Confirmed=X Filename=shambl3r.exe Description=Added by the REMABL WORM! Source=Paul Collins Startup list [load=] Number=4625 Confirmed=X Filename=Spoolsv.exe Description=Added by the CIADOOR.B TROJAN! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [Load=] Number=4626 Confirmed=? Filename=wtfeat.exe Description=Associated with the Wintab Digitizer Source=Paul Collins Startup list [load=] Number=4627 Confirmed=Y Filename=AICLIENT.EXE Description=Asset Insight from Tangram - asset managing software. Required if an organisation is running a centrally administered asset management system Source=Paul Collins Startup list [load=] Number=4628 Confirmed=X Filename=hint.exe Description=Added by the ATAK WORM! Source=Paul Collins Startup list [load=] Number=4629 Confirmed=X Filename=win32exec.exe Description=Added by the BITTER WORM! Source=Paul Collins Startup list [load=] Number=4630 Confirmed=X Filename=a1g.exe Description=Added by the ATAK.B WORM! Source=Paul Collins Startup list [load=] Number=4631 Confirmed=X Filename=dapdll.exe Description=Added by the ATAK.E WORM! Source=Paul Collins Startup list [load=] Number=4632 Confirmed=X Filename=svhost32.exe Description=Added by the LINEAGE-AB TROJAN! Source=Paul Collins Startup list [load=] Number=4633 Confirmed=Y Filename=01comm32.exe Description=Related to Elsa CommPro (Communicate Pro) access software for Microlink modems - this software contains answering machine and fax functions, plus a terminal program, a WWW-browser launch function, Internet telephony, and address management. Required if you use those Source=Paul Collins Startup list [load=] Number=4634 Confirmed=X Filename=inetinfo.exe Description=Added by the PROXY-GG TROJAN! Source=Paul Collins Startup list [load=] Number=4635 Confirmed=X Filename=Kerne14.exe Description=Added by the LINEAGE-BA TROJAN! Source=Paul Collins Startup list [Loadab1] Number=4636 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-AJ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [LoadBlackD] Number=4637 Confirmed=Y Filename=blackd.exe Description=This is the "intrusion detection system" of the BlackICE PC Protection (was Defender) firewall which loads independently of the "user interface" (BlackICE Utility) Source=Paul Collins Startup list [LoadBtnHnd] Number=4638 Confirmed=? Filename=BtnHnd.exe Description=Fujitsu LifeBook related Source=Paul Collins Startup list [LoadDBackUp] Number=4639 Confirmed=X Filename=BcTool.exe Description=Added by the GIBE WORM! Source=Paul Collins Startup list [loaddll] Number=4640 Confirmed=X Filename=loaddll.exe Description=Winvest spyware Source=Paul Collins Startup list [LoadDvpApi9x] Number=4641 Confirmed=? Filename=DVPAPI9X.exe Description=Part of Command AntiVirus for Windows 95/98/Me. Is it needed? Source=Paul Collins Startup list [loader] Number=4642 Confirmed=X Filename=loader.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com. Downloader for iedll.exe Source=Paul Collins Startup list [loader] Number=4643 Confirmed=X Filename=WMPLAYER.EXE Description=Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup Source=Paul Collins Startup list [loader32] Number=4644 Confirmed=X Filename=Loader32.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [loader32 ] Number=4645 Confirmed=X Filename=sys*****.exe [***** = random digit] Description=Added by the DOMCOM TROJAN! Source=Paul Collins Startup list [Loaders] Number=4646 Confirmed=X Filename=HeIp.exe Description=Added by the SDBOT-ADB WORM! Source=Paul Collins Startup list [loadfax] Number=4647 Confirmed=X Filename=loadfax.exe Description=Added by the WINFLUX-C TROJAN! Source=Paul Collins Startup list [LoadFonts] Number=4648 Confirmed=X Filename=LoadFonts.vbs Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [LoadFonts] Number=4649 Confirmed=X Filename=Tahoma.vbs Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [LoadGolfCourses] Number=4650 Confirmed=X Filename=LoadGolfCourses.exe Description=PlayMiniGolf.com foistware - stealth installed! Source=Paul Collins Startup list [LoadHTML] Number=4651 Confirmed=X Filename=rundll32.exe mshtmpre.dll, MShtmpre Description=Mshtmpre adware Source=Paul Collins Startup list [LoadingAgent] Number=4652 Confirmed=X Filename=ZipLoader32.exe Description=Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Source=Paul Collins Startup list [LoadingAgent] Number=4653 Confirmed=X Filename=msload32.exe Description=Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Source=Paul Collins Startup list [LoadManager] Number=4654 Confirmed=X Filename=msload.exe Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [loadMecq0] Number=4655 Confirmed=X Filename=explorer.exe Description=Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [loadMecq3] Number=4656 Confirmed=X Filename=rundll32.exe Description=Added by the LEGMIR-AS TROJAN! Source=Paul Collins Startup list [loadMect1] Number=4657 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [loadMefs] Number=4658 Confirmed=X Filename=rundll32.exe Description=Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). This file is located in the Windows\inf or Winnt\inf folder Source=Paul Collins Startup list [loadMefs] Number=4659 Confirmed=X Filename=smss32.exe Description=Added by the FLOOD-EL TROJAN! Source=Paul Collins Startup list [LoadMSvcmm] Number=4660 Confirmed=N Filename=msvcmm32.exe Description=Auto-update for Movielink - internet movie rental System Tray access Source=Paul Collins Startup list [LoadOrderVerification] Number=4661 Confirmed=X Filename=[random filename] Description=Added by the TRON.A TROJAN! Source=Paul Collins Startup list [Loadout Manager] Number=4662 Confirmed=U Filename=nost_LM.exe Description=Manager for the Belkin Nostromo n50 SpeedPad game controller - see here Source=Paul Collins Startup list [LoadPFW] Number=4663 Confirmed=X Filename=wmimgr.exe Description=Added by the QEDS-B WORM! Source=Paul Collins Startup list [LoadPowerProfile] Number=4664 Confirmed=X Filename=ASDAPI.EXE Description=Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll Source=Paul Collins Startup list [LoadPowerProfile] Number=4665 Confirmed=U Filename=Rundll32.exe powrprof.dll Description=Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your selected power scheme. May not be required - depends upon whether you modify the default Control Panel -> Power Options settings Source=Paul Collins Startup list [LoadPowerProfile] Number=4666 Confirmed=X Filename=Rundll.exe powerprof.dll Description=Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses "Rundll.exe" whereas the uninfected version uses "Rundll32.exe" Source=Paul Collins Startup list [LoadPowerProfile] Number=4667 Confirmed=X Filename=rundl.exe Description=Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll Source=Paul Collins Startup list [LoadPowerProfile] Number=4668 Confirmed=X Filename=Rundll32.exe Description=Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line Source=Paul Collins Startup list [LoadPowerScheme] Number=4669 Confirmed=X Filename=rundll32.exe powerprof.dll CheckPowerProfile Description=Ulubione adult content dialer Source=Paul Collins Startup list [LoadQM] Number=4670 Confirmed=U Filename=loadqm.exe Description=Installed with MSN Explorer and loads the MSN Queue Manager. Required to enable the WU AutoUpdate feature. Note that disabling this can sometimes prevent internet sharing working on Win2K Pro SP2. Reports also suggest that removing it will re-enable internet access - hence the "users choice" recommendation. If you have problems leave it, otherwise I recommend you disable it Source=Paul Collins Startup list [loads.exe] Number=4671 Confirmed=X Filename=loads.exe Description=MediaMotor adware Source=Paul Collins Startup list [loads.exe] Number=4672 Confirmed=X Filename=medload.exe Description=Medload adware Source=Paul Collins Startup list [loads.exe] Number=4673 Confirmed=X Filename=suploads.exe Description=Added by the AGENT-BZ TROJAN! Source=Paul Collins Startup list [LoadService] Number=4674 Confirmed=X Filename=Rest In Peace Description=Added by the KANGAROO-A WORM! Source=Paul Collins Startup list [LoadService] Number=4675 Confirmed=X Filename=Maaf, tempatmu bukan di sin Description=Added by the KAGEN-A TROJAN! Source=Paul Collins Startup list [LoadService] Number=4676 Confirmed=X Filename=Virus Description=Added by the CAGER.A WORM! Source=Paul Collins Startup list [LoadSIPS] Number=4677 Confirmed=X Filename=rundll32.exe [path] SIPSPI32.dll, SIPSPI32 Description=123Mania adware Source=Paul Collins Startup list [LoadWatcher] Number=4678 Confirmed=? Filename=Test.exe Description=Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct? Source=Paul Collins Startup list [LoadWatcher] Number=4679 Confirmed=X Filename=watcher.exe Description=Watcher spyware Source=Paul Collins Startup list [loadwin] Number=4680 Confirmed=X Filename=winset.exe Description=Added by the QQPASS-I TROJAN! Source=Paul Collins Startup list [loadwin] Number=4681 Confirmed=X Filename=winsys.exe Description=Added by the QQPASS-J TROJAN! Source=Paul Collins Startup list [LoadWindowsFile] Number=4682 Confirmed=X Filename=[filename] Description=Added by the DELF.B TROJAN! where [filename] is the infected file Source=Paul Collins Startup list [Local Area Network] Number=4683 Confirmed=X Filename=OpenGL.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Local Authority Service] Number=4684 Confirmed=X Filename=lsass.exe Description=Added by the AMRKTMAN-C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Local Internet Connection] Number=4685 Confirmed=X Filename=LIC.exe Description=Added by the SDBOT-YA WORM! Source=Paul Collins Startup list [LOCAL INTERNET WEB DRIVERS FOR WIN32] Number=4686 Confirmed=X Filename=phqghume.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Local Page] Number=4687 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [Local runole service] Number=4688 Confirmed=X Filename=srvc32.exe Description=Added by the SMALL-DP TROJAN! Source=Paul Collins Startup list [Local Security Authority Servce] Number=4689 Confirmed=X Filename=lssas.exe Description=Added by the POEBOT-T WORM! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [Local Security Authority Service] Number=4690 Confirmed=X Filename=lssas.exe Description=Added by the POEBOT-J WORM! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [Local Security Authority Service] Number=4691 Confirmed=X Filename=Isass.exe Description=Added by the LINKBOT.M WORM! Source=Paul Collins Startup list [Local Service] Number=4692 Confirmed=X Filename=Intenat.exe Description=Added by the NUCLEAR-J TROJAN! Source=Paul Collins Startup list [Local Service] Number=4693 Confirmed=X Filename=services.exe Description=Added by the P2PWORM-T WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Cursors" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [Local-Settings-of-[User Name]] Number=4694 Confirmed=X Filename=[User Name].exe Description=Added by the GAVGENT.A WORM! Source=Paul Collins Startup list [LocalProxy] Number=4695 Confirmed=U Filename=proxy4free.exe Description="ProxyTools is a package of Perl network utilities designed mainly to assist those whose Internet access is censored, unreliable, or otherwise damaged. Uncensored access is provided to any outside service required (Usenet News, Web browsing, IRC, Socks etc.). Setup requires installation of Perl and some modules" Source=Paul Collins Startup list [LocalSystem] Number=4696 Confirmed=X Filename=svchost.exe Description=EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Locator Service] Number=4697 Confirmed=X Filename=[filename] Description=Added by the AGOBOT-KY TROJAN! Source=Paul Collins Startup list [Lock My PC] Number=4698 Confirmed=U Filename=lockpc.exe Description=Lock My PC - a tool for quick computer locking when you leave it unattended. It shows a lock screen, disables Windows hot keys and mouse Source=Paul Collins Startup list [logg] Number=4699 Confirmed=X Filename=logo_1.exe Description=Added by the PWFUZZ-A WORM! Source=Paul Collins Startup list [Login] Number=4700 Confirmed=U Filename=winlog.exe Description=Salfeld Child Control - parental control software Source=Paul Collins Startup list [login] Number=4701 Confirmed=X Filename=[path to trojan] Description=Added by the HOTWORD-A TROJAN! Source=Paul Collins Startup list [Login] Number=4702 Confirmed=X Filename=Login.exe Description=Added by the BANCBAN-AH TROJAN! Source=Paul Collins Startup list [Login] Number=4703 Confirmed=X Filename=lala.exe Description=Added by the BUGSPR-A TROJAN! Source=Paul Collins Startup list [Login Screen Saver] Number=4704 Confirmed=X Filename=login.scr Description=Added by the RBOT-AVN WORM! Source=Paul Collins Startup list [Login Service] Number=4705 Confirmed=X Filename=[path to file] Description=Added by the MIGMAF TROJAN! Source=Paul Collins Startup list [LoginPassport] Number=4706 Confirmed=X Filename=Lgnpsp32.exe Description=Added by the REDIST.C WORM! Source=Paul Collins Startup list [Logitech] Number=4707 Confirmed=X Filename=Logitech.exe Description=Added by the RBOT.BJH WORM! Source=Paul Collins Startup list [Logitech Camera] Number=4708 Confirmed=X Filename=Soundcane.exe Description=Added by the SDBOT.MUC WORM! Source=Paul Collins Startup list [Logitech Desktop] Number=4709 Confirmed=X Filename=ApPache.exe Description=Added by the RBOT-YP WORM! Source=Paul Collins Startup list [Logitech Desktop] Number=4710 Confirmed=X Filename=IPCONN.EXE Description=Added by the SDBOT-WE WORM! Source=Paul Collins Startup list [Logitech Desktop Controller] Number=4711 Confirmed=X Filename=wrcam.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Logitech Desktop Messenger] Number=4712 Confirmed=N Filename=backweb-8876480.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [Logitech Desktop Messenger] Number=4713 Confirmed=N Filename=ldmconf.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [Logitech Hardware Abstraction Layer] Number=4714 Confirmed=U Filename=Khalmnpr.exe Description=Part of the Logitech Setpoint software for their wired and wireless mice and trackballs. Sets the Windows mouse sensitivity to minimum. The idea is that you will use the SetPoint Control Panel to adjust your mouse sensitivity. This setting is maintained separately from the Windows setting, but is combined with the Windows setting to determine the final sensitivity. For this reason, KHALMNPR sets the Windows setting to 0 so it doesn't alter the one you set in SetPoint Source=Paul Collins Startup list [Logitech SetPoint] Number=4715 Confirmed=U Filename=KEM.exe Description=Keyboard and mouse drivers and utilities for Logitech's latest products - supersedes iTouch and MouseWare on their older products. Required if you use special features such as multimedia keys Source=Paul Collins Startup list [Logitech SetPoint] Number=4716 Confirmed=U Filename=KHALMNPR.EXE Description=Part of the Logitech Setpoint software for their wired and wireless mice and trackballs. Sets the Windows mouse sensitivity to minimum. The idea is that you will use the SetPoint Control Panel to adjust your mouse sensitivity. This setting is maintained separately from the Windows setting, but is combined with the Windows setting to determine the final sensitivity. For this reason, KHALMNPR sets the Windows setting to 0 so it doesn't alter the one you set in SetPoint Source=Paul Collins Startup list [Logitech SetPoint] Number=4717 Confirmed=U Filename=Setpoint.exe Description=Logitech SetPoint Event Manager for their range of mice and keyboards. Required if you want to use the advanced features of these devices and is located in the Logitech\Setpoint sub-folder of Program Files Source=Paul Collins Startup list [Logitech Utility] Number=4718 Confirmed=U Filename=Logi_MwX.exe Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [Logitech Wakeup] Number=4719 Confirmed=N Filename=lgwakeup.exe Description=Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images Source=Paul Collins Startup list [Logitech Wireless] Number=4720 Confirmed=X Filename=logitechwls.exe Description=Added by the MYTOB-BS WORM! Source=Paul Collins Startup list [LogitechCameraAssistant] Number=4721 Confirmed=U Filename=CameraAssistant.exe Description=Related to Logitech QuickCams and provides additional configuration options for these devices Source=Paul Collins Startup list [LogitechCameraService(E)] Number=4722 Confirmed=U Filename=ElkCtrl.exe Description=Related to Logitech Camera Service and provides additional configuration options for these devices Source=Paul Collins Startup list [LogitechCommunicationsManager] Number=4723 Confirmed=Y Filename=communications_helper.exe Description=Installed with a Logitech Quickcam Messenger and if disabled the camera will not work - at least not in the quick capture mode Source=Paul Collins Startup list [LogitechDesktopMessenger] Number=4724 Confirmed=N Filename=LogitechDesktopMessenger.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [LogitechGalleryRepair] Number=4725 Confirmed=U Filename=ISStart.exe Description=LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation Source=Paul Collins Startup list [LogitechImageStudioTray] Number=4726 Confirmed=N Filename=LogiTray.exe Description=Logitech Image Studio - installed with Logitech QuickCams Source=Paul Collins Startup list [LogitechQuickCamRibbon] Number=4727 Confirmed=N Filename=quickcam10.exe Description=Installed with a Logitech Quickcam Messenger. Camera's software which is non-essential. When you open it, it allows you to open the quick capture, camera settings, etc Source=Paul Collins Startup list [Logitechs] Number=4728 Confirmed=X Filename=Logitechs.exe Description=Added by the SDBOT.BWE WORM! Source=Paul Collins Startup list [LogitechSoftwareUpdate] Number=4729 Confirmed=N Filename=ManifestEngine.exe Description=Updater, part of Logitech Image Studio - installed with Logitech QuickCam cameras Source=Paul Collins Startup list [LogitechVideoRepair] Number=4730 Confirmed=U Filename=ISStart.exe Description=LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation Source=Paul Collins Startup list [LogitechVideoTray] Number=4731 Confirmed=N Filename=LogiTray.exe Description=Logitech Image Studio - installed with Logitech QuickCams Source=Paul Collins Startup list [LogitechVideo[inspector]] Number=4732 Confirmed=N Filename=InstallHelper.exe Description=Logitech QuickCam software installation helper Source=Paul Collins Startup list [LogiTray] Number=4733 Confirmed=N Filename=LogiTray.exe Description=Logitech Image Studio - installed with Logitech QuickCams Source=Paul Collins Startup list [Logi_Mwx] Number=4734 Confirmed=U Filename=Logi_MwX.exe Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [LogMeIn GUI] Number=4735 Confirmed=U Filename=LogMeInSystray.exe Description=RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, an intranet or the Internet) - and on the client side all you need is a web browser, a terminal emulator or a WAP-enabled phone Source=Paul Collins Startup list [LogMeIn GUI] Number=4736 Confirmed=U Filename=ragui.exe Description=RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, an intranet or the Internet) - and on the client side all you need is a web browser, a terminal emulator or a WAP-enabled phone Source=Paul Collins Startup list [Logo] Number=4737 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-RH TROJAN! Source=Paul Collins Startup list [Logon Loader] Number=4738 Confirmed=U Filename=LogonLoader.exe Description=Logon Loader - customize boot & login screens Source=Paul Collins Startup list [Logon Loader Random] Number=4739 Confirmed=U Filename=LogonLoader.exe Description=Logon Loader - customize boot & login screens Source=Paul Collins Startup list [Logon.exe] Number=4740 Confirmed=X Filename=logon.exe Description=Added by the ZINS.A TROJAN! Source=Paul Collins Startup list [LogonStudio] Number=4741 Confirmed=U Filename=logonstudio.exe Description=WinCustomize LogonStudio - "Allows Windows XP users to edit, change, and apply new logon screens. LogonStudio comes built with a visual editor to make it easy to create your own logons which can then be uploaded to websites to be used by others users" Source=Paul Collins Startup list [LogService] Number=4742 Confirmed=X Filename=wincalc.exe Description=Added by the PAPROXY TROJAN! Source=Paul Collins Startup list [LogService] Number=4743 Confirmed=X Filename=lsass.exe Description=Added by the IU TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [LogService] Number=4744 Confirmed=X Filename=lsrss.exe Description=Added by the PAPROXY-D TROJAN! Source=Paul Collins Startup list [LogWatch] Number=4745 Confirmed=U Filename=logwat95.exe Description=Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll. Not required if you already have a newer version or the patch has been applied Source=Paul Collins Startup list [longos] Number=4746 Confirmed=X Filename=WIWT.EXE Description=Added by the BANKER-CD TROJAN! Source=Paul Collins Startup list [Look 'n' Stop] Number=4747 Confirmed=Y Filename=looknstop.exe Description=Look 'n' Stop personal firewall Source=Paul Collins Startup list [LookNMeet] Number=4748 Confirmed=N Filename=Agent.exe Description=LooknMeet dating service Source=Paul Collins Startup list [Lookup_Sys] Number=4749 Confirmed=X Filename=lookupsys.exe Description=P04n trojan Source=Paul Collins Startup list [Lotus Organizer EasyClip] Number=4750 Confirmed=N Filename=easyclip.exe Description="The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address, appointment, task or Notepad page." Available via Start -> Programs Source=Paul Collins Startup list [Lotus QuickStart] Number=4751 Confirmed=N Filename=smartctr.exe Description=Lotus central application, called SmartCenter, which runs on the Windows desktop. SmartCenter toolbar stretches across the top or, optionally, the bottom of the screen. Uses a lot of resources. Available via Start -> Programs Source=Paul Collins Startup list [Lotus SuiteStart] Number=4752 Confirmed=U Filename=suitest.exe Description=Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs Source=Paul Collins Startup list [LowVersionSupport] Number=4753 Confirmed=X Filename=[filename] Description=Added by the LASTRAS TROJAN! Source=Paul Collins Startup list [LPManager] Number=4754 Confirmed=U Filename=LPMGR.exe Description=Part of Lenovo's IBM ThinkVantage Productivity Center for - "guides you to a host of information and tools to help you set up, understand, maintain, and enhance your ThinkPad� notebook or ThinkCentre� desktop" Source=Paul Collins Startup list [Lpr] Number=4755 Confirmed=X Filename=Lpr123.exe Description=Added by the REMPSTEAL password stealer TROJAN! Source=Paul Collins Startup list [Lpr123] Number=4756 Confirmed=X Filename=Lpr123.exe Description=Added by the REMPSTEAL password stealer TROJAN! Source=Paul Collins Startup list [LPS] Number=4757 Confirmed=U Filename=Lps.exe Description=Local Port Scanner - "With LPS you're able to check your computer for open or listening ports" Source=Paul Collins Startup list [LPtask] Number=4758 Confirmed=U Filename=lptask.exe Description=Program Lock It And Protect Pro - lock and protect your folders from being opened, moved or deleted Source=Paul Collins Startup list [LRBZ Utility 32] Number=4759 Confirmed=X Filename=lrbz32.exe Description=Added by the AGOBOT-JQ WORM! Source=Paul Collins Startup list [LS120 Superdisk] Number=4760 Confirmed=N Filename=?? Description=Supposed to accelerate transfer rate on LS-120, contributes to system lockups Source=Paul Collins Startup list [LSA] Number=4761 Confirmed=X Filename=wfdmgr.exe Description=Added by the MYTOB.C WORM! Source=Paul Collins Startup list [LSA] Number=4762 Confirmed=X Filename=lsa.exe Description=Added by the SDBOT-YV WORM! Source=Paul Collins Startup list [LSA Service] Number=4763 Confirmed=X Filename=LSASS.exe Description=Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [lsa Services] Number=4764 Confirmed=X Filename=lsa2srv.exe Description=Added by the TAME-C WORM! Source=Paul Collins Startup list [LSA Shell (Export Version)] Number=4765 Confirmed=X Filename=LSASS.exe Description=Added by several variants of the AHKER WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [LsaManager] Number=4766 Confirmed=X Filename=lsamgr.exe Description=Added by the BEAGLE.DR WORM! Source=Paul Collins Startup list [lsass] Number=4767 Confirmed=X Filename=lsass.exe Description=Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Debug\UserMode subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [lsass] Number=4768 Confirmed=X Filename=start.bat Description=Added by the ZCREW TROJAN! Source=Paul Collins Startup list [lsass] Number=4769 Confirmed=X Filename=[path to lsass.exe] Description=Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [lsass] Number=4770 Confirmed=X Filename=lsasrv.exe Description=Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS! Source=Paul Collins Startup list [Lsass] Number=4771 Confirmed=X Filename=woekd.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [lsass] Number=4772 Confirmed=X Filename=elite***32.exe Description=EliteBar adware Source=Paul Collins Startup list [Lsass] Number=4773 Confirmed=X Filename=Lsass.exe Description=Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Lsass] Number=4774 Confirmed=X Filename=Lsass.exe Description=Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder Source=Paul Collins Startup list [LsasS] Number=4775 Confirmed=X Filename=Sygate.exe Description=Added by the SDBOT.BCA WORM! Source=Paul Collins Startup list [Lsass] Number=4776 Confirmed=X Filename=kavmm.exe Description=Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor, the legitimate file will always be located in the Kaspersky Lab folder in Program Files Source=Paul Collins Startup list [LSASS 32] Number=4777 Confirmed=X Filename=ISASS32.pif Description=Added by the ASSIRAL-C WORM! Source=Paul Collins Startup list [LSASS Authority] Number=4778 Confirmed=X Filename=lshosts32.exe Description=Added by the SDBOT-UY TROJAN! Source=Paul Collins Startup list [LSASS Authority] Number=4779 Confirmed=X Filename=lsvhosts.exe Description=Added by the SDBOT.BCE WORM! Source=Paul Collins Startup list [LSASS Daemon] Number=4780 Confirmed=X Filename=LSASSd.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [lsass service] Number=4781 Confirmed=X Filename=lsass2.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [lsass16] Number=4782 Confirmed=X Filename=lsass16.exe Description=Added by the BANKER-BXX TROJAN! Source=Paul Collins Startup list [lsass2k Update] Number=4783 Confirmed=X Filename=lsass2k.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [LSASS32] Number=4784 Confirmed=X Filename=Isass32.exe Description=Added by the KELVIR.M WORM! Source=Paul Collins Startup list [lsass32] Number=4785 Confirmed=X Filename=lsass32.exe Description=Added by the LYDRA-B TROJAN! Source=Paul Collins Startup list [lsass64BiT.exe] Number=4786 Confirmed=X Filename=lsass64BiT.exe Description=Added by the FORBOT-CK WORM! Source=Paul Collins Startup list [lsassig] Number=4787 Confirmed=X Filename=lsassig.exe Description=Added by the BANCOS-EC TROJAN! Source=Paul Collins Startup list [lsasss] Number=4788 Confirmed=X Filename=lsasss.exe Description=Added by the GEEKMY-A TROJAN! Source=Paul Collins Startup list [lsasss.exe] Number=4789 Confirmed=X Filename=lsasss.exe Description=Added by the SASSER.E WORM! Source=Paul Collins Startup list [lsburnwatcher] Number=4790 Confirmed=N Filename=lsburnwatcher.exe Description=Used for automatically updating HP programs Source=Paul Collins Startup list [lsess] Number=4791 Confirmed=X Filename=lsess.exe Description=Added by the SINNAKA.A WORM! Source=Paul Collins Startup list [lsmass] Number=4792 Confirmed=X Filename=lsmass.exe Description=Added by the WALLOP-B TROJAN! Source=Paul Collins Startup list [lsmss.exe] Number=4793 Confirmed=X Filename=lsmss.exe Description=Added by the PROXY-GG TROJAN! Source=Paul Collins Startup list [LSPFix] Number=4794 Confirmed=U Filename=LSPmonitor.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [lspins] Number=4795 Confirmed=X Filename=igps.exe Description=Reported as the VB.KC TROJAN by Kapersky Anti-Virus Source=Paul Collins Startup list [LSPmonitor] Number=4796 Confirmed=U Filename=LSPmonitor.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [lssass] Number=4797 Confirmed=X Filename=lssas.exe Description=Added by the AGOBOT.RL WORM! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [LSvr] Number=4798 Confirmed=X Filename=LSvr.exe Description=PowerStrip foistware. Note - this is not the same as the video tweaking utility of the same name here Source=Paul Collins Startup list [LT DAEMON] Number=4799 Confirmed=Y Filename=ltdaemon.exe Description=Acts as a data spooler for the DSL modem (similar to a cache). Do not uncheck if the DSL modem is being used Source=Paul Collins Startup list [LTDMgr] Number=4800 Confirmed=X Filename=LTDMgr.exe Description=PowerStrip foistware. Note - this is not the same as the video tweaking utility of the same name here Source=Paul Collins Startup list [LTM2] Number=4801 Confirmed=X Filename=MSGSRV32.EXE Description=Added by the LITMUS.A TROJAN! Note - MSGSRV32.EXE in this case is in a Litmus sub-directory and is not to be confused with the valid version in C:\Windows\System Source=Paul Collins Startup list [LTM2] Number=4802 Confirmed=X Filename=MPGSRV32.EXE Description=Added by the LITMUS.201 TROJAN! Source=Paul Collins Startup list [LTM2] Number=4803 Confirmed=X Filename=MSGSRV320.EXE Description=Added by the LITMUS.C TROJAN! Source=Paul Collins Startup list [LTM2] Number=4804 Confirmed=X Filename=winupdate.exe Description=Added by the LITMUS.203 TROJAN! Source=Paul Collins Startup list [LTM2] Number=4805 Confirmed=X Filename=bible.exe Description=Added by the LITMUS.203 TROJAN! Source=Paul Collins Startup list [LTM2] Number=4806 Confirmed=X Filename=winscan.exe Description=Added by the LITMUS-B TROJAN! Source=Paul Collins Startup list [LTM2] Number=4807 Confirmed=X Filename=lssas.exe Description=Added by a variant of the LITMUS TROJAN! Note - this is not the legitimate lsass.exe process Source=Paul Collins Startup list [LTM2] Number=4808 Confirmed=X Filename=MSGSSV32.EXE Description=Added by the FC.C TROJAN! Source=Paul Collins Startup list [LTM2] Number=4809 Confirmed=X Filename=msns6 Description=Added by the LITMUS.C TROJAN! Source=Paul Collins Startup list [LTM2] Number=4810 Confirmed=X Filename=RundlI.exe Description=Added by the MULTIDRP.BG TROJAN! Source=Paul Collins Startup list [LTM2] Number=4811 Confirmed=X Filename=SVCHOST32.exe Description=Added by the LITMUS.203B TROJAN! Source=Paul Collins Startup list [LTM2] Number=4812 Confirmed=X Filename=SVCHOST�.exe Description=Added by the DROPPERFL.A TROJAN! Source=Paul Collins Startup list [LTM2] Number=4813 Confirmed=X Filename=winvers16.exe Description=Added by the SMALL.ND TROJAN! Source=Paul Collins Startup list [LtMoh] Number=4814 Confirmed=U Filename=Ltmoh.exe Description=Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet Source=Paul Collins Startup list [LTMSG] Number=4815 Confirmed=Y Filename=ltmsg.exe Description=One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [Lto Manager] Number=4816 Confirmed=Y Filename=DesktopLtoManager.exe Description=Related to Global Positioning System (GPS) found on HP iPAQ hw6500 unit and others Source=Paul Collins Startup list [LTSMMSG] Number=4817 Confirmed=N Filename=LTSMMSG.exe Description=Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook, Acer and Sony Vaio notebooks, maybe others too Source=Paul Collins Startup list [LTSMSG] Number=4818 Confirmed=X Filename=Shell32.exe Description=Added by the LEMIR.B TROJAN! Source=Paul Collins Startup list [LTT2] Number=4819 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAGE-BI TROJAN! Source=Paul Collins Startup list [LTWinModem1] Number=4820 Confirmed=Y Filename=ltmsg.exe Description=One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [ltwob] Number=4821 Confirmed=X Filename=formatsys.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [ltwob] Number=4822 Confirmed=X Filename=msmbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [ltwob] Number=4823 Confirmed=X Filename=serbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [LUGuard] Number=4824 Confirmed=U Filename=LUGuard.exe Description=PC-Duo Remote Control enables your help desk technicians to take instant control of any remote desktop PC at any location across the LAN, WAN or internet Source=Paul Collins Startup list [lup] Number=4825 Confirmed=X Filename=lup.exe Description=Added by the IRCBOT_GEN WORM! Source=Paul Collins Startup list [Lusetup] Number=4826 Confirmed=Y Filename=LUSetup.exe Description=Symantec LiveUpdate installer - required to install a new version of the application. Will only run once, and the entry is automatically deleted after a reboot Source=Paul Collins Startup list [LVComs] Number=4827 Confirmed=U Filename=lvcoms.exe Description=Lvcomm server. Related to Logitech Quick Cam - works fine without it but it is needed for the Logitech ImageStudio software to connect to the camera Source=Paul Collins Startup list [LVCOMSX] Number=4828 Confirmed=N Filename=LVCOMSX.EXE Description=It provides extra functionality for Logitech multimedia webcam devices. When disabled the camera still works in quick capture but you can get a slight increase in picture quality - not so snowy and the movement wasn't so jerky Source=Paul Collins Startup list [LWBMOUSE] Number=4829 Confirmed=U Filename=lwbwheel.exe Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [LWBMOUSE] Number=4830 Confirmed=U Filename=MOUSE32A.EXE Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Lwinst Run Profiler] Number=4831 Confirmed=N Filename=lwtest.exe Description=Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs Source=Paul Collins Startup list [lwjcjuti.exe] Number=4832 Confirmed=X Filename=lwjcjuti.exe Description=Added by the DWNLDR-GTQ TROJAN! Source=Paul Collins Startup list [lxamsp32] Number=4833 Confirmed=? Filename=lxamsp32.exe Description=Associated with a Lexmark Printer - is it required? Source=Paul Collins Startup list [LXbbmgr] Number=4834 Confirmed=? Filename=LXbbmgr.exe Description=Lexmark printer button manager? Is it required? Source=Paul Collins Startup list [LXBLKsk] Number=4835 Confirmed=? Filename=LXBLKsk.exe Description=Lexmark related. What does it do, and is it required? Source=Paul Collins Startup list [lxbrbmgr] Number=4836 Confirmed=Y Filename=lxbrbmgr.exe Description=Lexmark printer button manager. Required for correct operation Source=Paul Collins Startup list [LXBRKsk] Number=4837 Confirmed=? Filename=LXBRKsk.exe Description=Lexmark printer related. What does it do and is it required? Source=Paul Collins Startup list [LXBSCATS] Number=4838 Confirmed=? Filename=rundll32 [path] LXBStime.dll, _RunDLLEntry@16 Description=Related to the DLT LibraryXpressLXB tape backup storage device - what does it do and is it required? Source=Paul Collins Startup list [LXBTCATS] Number=4839 Confirmed=? Filename=rundll32 [path] LXBTtime.dll, _RunDLLEntry@16 Description=Lexmark printer related - what does it do and is it required? Source=Paul Collins Startup list [lxbxmon.exe] Number=4840 Confirmed=? Filename=lxbxmon.exe Description=Lexmark 7100 series device monitor. Is it required? Source=Paul Collins Startup list [LXCCCATS] Number=4841 Confirmed=? Filename=rundll32 [path] LXCCtime.dll, _RunDLLEntry@16 Description=Lexmark printer related - what does it do and is it required? Source=Paul Collins Startup list [lxccmon.exe] Number=4842 Confirmed=U Filename=lxccmon.exe Description=Lexmark 3300 series printers/scanners Source=Paul Collins Startup list [LXCGCATS] Number=4843 Confirmed=U Filename=LXCGtime.dll Description=Lexmark printing software - reports back on printer and cartridge useage Source=Paul Collins Startup list [lxcgmon.exe] Number=4844 Confirmed=? Filename=lxcgmon.exe Description=Lexmark printer related - what does it do and is it required? Source=Paul Collins Startup list [lxcrmon.exe] Number=4845 Confirmed=? Filename=lxcrmon.exe Description=Lexmark 2400 series printer monitor - what does it do and is it required? Source=Paul Collins Startup list [lxctmon.exe] Number=4846 Confirmed=? Filename=lxctmon.exe Description=Lexmark 5400 series device monitor. Is it required? Source=Paul Collins Startup list [LXSUPMON] Number=4847 Confirmed=N Filename=LXSUPMON.EXE Description=Lexmark Printer. The printer should work fine without it Source=Paul Collins Startup list [lycosInside] Number=4848 Confirmed=? Filename=Lyc_SysTray.exe Description=Lycos eMail related - what does it do and is it required? Source=Paul Collins Startup list [LyraHD2TrayApp] Number=4849 Confirmed=U Filename=LYRAHD2TrayApp.exe Description=Related to RCA Lyra MP3 Player Source=Paul Collins Startup list [LzioMediaUpdater] Number=4850 Confirmed=X Filename=LzioMediaUpdater.exe Description=LZIO.com adware downloader Source=Paul Collins Startup list [M Player Post Installer] Number=4851 Confirmed=? Filename=postinstallm.exe Description=?? Source=Paul Collins Startup list [M S DVD DirectX Dll Drivers] Number=4852 Confirmed=X Filename=msxdl.exe Description=Added by the SDBOT-BJN WORM! Source=Paul Collins Startup list [M-Audio Delta Taskbar Icon] Number=4853 Confirmed=N Filename=DeltTray.exe Description=M-Audio Delta Control Panel for M-Audio brand Delta series audio cards. System Tray access to audio settings - available through Control Panel Source=Paul Collins Startup list [M-soft Office] Number=4854 Confirmed=X Filename=M-soft Office.hta Description=HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Source=Paul Collins Startup list [M1cr0s0ft S3rcurity] Number=4855 Confirmed=X Filename=systemconfig.exe Description=Added by the RBOT.BKB WORM! Source=Paul Collins Startup list [M1cr0s0ft Upd4t4zS] Number=4856 Confirmed=X Filename=update32.exe Description=Added by the RBOT-MI WORM! Source=Paul Collins Startup list [m32info] Number=4857 Confirmed=X Filename=m32info.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [M3Tray] Number=4858 Confirmed=N Filename=m3tray.exe Description=Movielink - internet movie rental System Tray access Source=Paul Collins Startup list [Macfee Security Patch] Number=4859 Confirmed=X Filename=Mpfsheild.exe Description=Added by the RBOT-NP WORM! Source=Paul Collins Startup list [Machine Debug Manager] Number=4860 Confirmed=U Filename=mdm.exe Description=Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as MDM7. See here to disable Source=Paul Collins Startup list [Machine Debug Manager] Number=4861 Confirmed=X Filename=msdn.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Machine Update Soft] Number=4862 Confirmed=X Filename=wusas.exe Description=Added by an unidfentified WORM! Source=Paul Collins Startup list [MacLic] Number=4863 Confirmed=N Filename=MacLic.exe Description=Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks Source=Paul Collins Startup list [MacName] Number=4864 Confirmed=N Filename=MacName.exe Description=Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks Source=Paul Collins Startup list [Macromedia 8] Number=4865 Confirmed=X Filename=Flash Player.exe Description=Added by the JAMBU-A WORM! Source=Paul Collins Startup list [Macromedia Critical Updater] Number=4866 Confirmed=X Filename=rarww.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Macromedia Dreamweaver XM] Number=4867 Confirmed=X Filename=macdwXM.exe Description=Added by the AGOBOT-RI WORM! Source=Paul Collins Startup list [Macromedia Drive] Number=4868 Confirmed=X Filename=Iexplor32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Macromedia Flash Update] Number=4869 Confirmed=X Filename=scvhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MAD.EXE] Number=4870 Confirmed=Y Filename=MAD.EXE Description=MAD.exe is the MS Exchange 5.5 System Attendant and can also consume a large amount of resources - resolved by the latest Exchange 5.5 Service Pack. Also part of Exchange 2000 Server but does it have the same problems?. Apparently you need to leave this running but is it needed at start-up? Source=Paul Collins Startup list [MadExe] Number=4871 Confirmed=N Filename=LaunchRA.exe Description=Part of Dell Resolution Assistant - "a diagnostic program that allows you to contact Dell. When factory-installed by Dell, it allowed you to perform hardware and software diagnostics that provided alerts to potential problems and enabled real-time communication with Dell RA techs. You can now use RA only to contact Dell by e-mail" Source=Paul Collins Startup list [MAFWTaskbarApp] Number=4872 Confirmed=U Filename=MAFWTray.exe Description=Drivers for the M-Audio Firewire Audiophile - Interface Source=Paul Collins Startup list [MagicDsk] Number=4873 Confirmed=U Filename=MAGICDSK.EXE Description=Magic DeskTop is a small and novel utility which will allow you the option of hiding or showing your desktop icons Source=Paul Collins Startup list [MagicKeyboard] Number=4874 Confirmed=U Filename=PreMKBD.exe Description=Related to Samsung laptops. Provides ability to program keys to perform specific functions Source=Paul Collins Startup list [MagicLinker3] Number=4875 Confirmed=U Filename=MagicLnk.exe Description=ThaiSoftware Thai Dictionary Source=Paul Collins Startup list [Magitime] Number=4876 Confirmed=N Filename=Magitime.exe Description=Magitime - connection tracking utility which monitors online time, expense, data transfer Source=Paul Collins Startup list [Mail.com] Number=4877 Confirmed=? Filename=mcalert.exe Description=Mail.com - free web-mail service. Does mcalert.exe notify you when new mail has arrived? Source=Paul Collins Startup list [MailBell] Number=4878 Confirmed=U Filename=mailbell.exe Description=MailBell e-mail notification tool that will notify you about new messages arrived to your mailbox. Works with both POP3 mailboxes and web-mail based systems. You should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) Source=Paul Collins Startup list [Mailbox Verifier] Number=4879 Confirmed=U Filename=mboxvrfy.exe Description=Mailbox Verifier (MV) is free software that will notify you about new messages arrived to your mailbox. Only works with POP3 mailboxes (not web-mail based systems). You should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) Source=Paul Collins Startup list [MailCleaner] Number=4880 Confirmed=U Filename=MAILCLEANER.EXE Description=MailCleaner "protect your computer from viruses sent to your machine via the popular e-Mail reader Incredimail. In addition the program will check all incoming files downloaded by Internet Explorer, Netscape Navigator, ICQ and iMesh". Not recommended as it bundles GAIN adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [mailman.exe] Number=4881 Confirmed=X Filename=mailman.exe Description=Added by the CERTIF-E TROJAN! Source=Paul Collins Startup list [MailScan Dispatcher] Number=4882 Confirmed=Y Filename=Launch.exe Description=MicroWorld MailScan Dispatcher splits each e-mail message into various components such as the header, body and attachment. Compressed formats (ZIP, ARJ, etc.) are scanned for viruses and cleaned Source=Paul Collins Startup list [Mail_Check] Number=4883 Confirmed=X Filename=Mail_Check.exe Description=Added by the PANOIL.C WORM! Source=Paul Collins Startup list [MAIN] Number=4884 Confirmed=U Filename=main.exe Description=SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Source=Paul Collins Startup list [Main Executable (HP)] Number=4885 Confirmed=? Filename=HP05T0R5.exe Description=HP (Hewlett-Packard) related. Maybe related to printers. Now - what does it do? Source=Paul Collins Startup list [main16] Number=4886 Confirmed=X Filename=main16.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [main32] Number=4887 Confirmed=X Filename=main32.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [MainStart] Number=4888 Confirmed=X Filename=svcmfte32.exe Description=Added by the STINX-A TROJAN! Source=Paul Collins Startup list [mainviewex] Number=4889 Confirmed=X Filename=mainviewex.exe Description=Added by the GEMA.D TROJAN! Source=Paul Collins Startup list [Major Microsoft Windows Driver Boot loader] Number=4890 Confirmed=X Filename=bpool.exe Description=Added by the MYTOB.AJ WORM! Source=Paul Collins Startup list [Malware Sweeper] Number=4891 Confirmed=U Filename=MalSwep.exe Description=Malware Sweeper - "Protects the user from malicious malware and monitors the sanity of the running programs" Source=Paul Collins Startup list [Malware-Wipe] Number=4892 Confirmed=N Filename=Malware-Wipe.exe Description=Malware remover - not recommended, see here Source=Paul Collins Startup list [Malware-Wiped] Number=4893 Confirmed=N Filename=Malware-Wiped.exe Description=Malware remover - not recommended, see here Source=Paul Collins Startup list [MalwareWipe] Number=4894 Confirmed=N Filename=MalwareWipe.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [MalwareWiped] Number=4895 Confirmed=N Filename=MalwareWiped.exe Description=Malware remover - not recommended, see here Source=Paul Collins Startup list [MalwareWiper] Number=4896 Confirmed=N Filename=MalwareWiper.exe Description=Malware remover - not recommended, see here Source=Paul Collins Startup list [ManageDesk Lite] Number=4897 Confirmed=U Filename=ManageDesk Lite.exe Description=ManageDesk Lite from Managebytes Desktop management software. Each desktop is a separate working space for you to use Source=Paul Collins Startup list [ManageProtocolCtrl] Number=4898 Confirmed=X Filename=csmsv.exe Description=Added by the LOOKSKY.B TROJAN! Source=Paul Collins Startup list [Manager Monitor] Number=4899 Confirmed=U Filename=monitor.exe Description=MindStorm AnalyzerPro from Secure Associates. "A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices" Source=Paul Collins Startup list [Managment Service] Number=4900 Confirmed=X Filename=[random filename] Description=Added by the RBOT.BIS TROJAN! Source=Paul Collins Startup list [Mania Win Restore] Number=4901 Confirmed=N Filename=RESWIN.EXE Description=Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs Source=Paul Collins Startup list [Mantis] Number=4902 Confirmed=X Filename=[filename] Description=Added by the MANTIBE VIRUS! Source=Paul Collins Startup list [MapiDrv] Number=4903 Confirmed=X Filename=mpisvc.exe Description=Added by the MIPSIV TROJAN! Source=Paul Collins Startup list [mapisvc32] Number=4904 Confirmed=X Filename=mapisvc32.exe Description=Added by the KX VIRUS and also recognised by Symantec as FPAI adware Source=Paul Collins Startup list [mark the service] Number=4905 Confirmed=X Filename=xxtra32.exe Description=Added by the SDBOT.APP WORM! Source=Paul Collins Startup list [Martini] Number=4906 Confirmed=X Filename=pinmart.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mascro soft SDK updates2] Number=4907 Confirmed=X Filename=SDKrepair2.exe Description=Added by the SDBOT.BXM WORM! Source=Paul Collins Startup list [masqform.exe] Number=4908 Confirmed=N Filename=masqform.exe Description=PureEdge Viewer 6.0, reportedly associated with viewing and text editing US Air Force electronic forms Source=Paul Collins Startup list [masqform.exe] Number=4909 Confirmed=U Filename=masqform.exe Description=PureEdge Viewer - provides automation framework to manage and deploy XML forms-based processes for e-business and e-government systems. PureEdge was taken over by IBM (see here) and the product became Workplace Forms Source=Paul Collins Startup list [Mass storage check registry] Number=4910 Confirmed=N Filename=rundll32.exe MSDServ.dll, check registry Description=Used with a USB based smartmedia card reader Source=Paul Collins Startup list [Master Card Updaate 32] Number=4911 Confirmed=X Filename=Mastercard32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Master Volume Spy] Number=4912 Confirmed=U Filename=MASTERVOLUMESPY.EXE Description=Volume control for the Gateway Destination "DestiVu" media interface Source=Paul Collins Startup list [Matador] Number=4913 Confirmed=U Filename=mlfbuddy.exe Description=MailFrontier - anti-spam application Source=Paul Collins Startup list [Matador] Number=4914 Confirmed=U Filename=mantispm.exe Description=MailFrontier Desktop (Matador) email spam blocker software Source=Paul Collins Startup list [MatrixScreen] Number=4915 Confirmed=X Filename=[filename] Description=Added by the MATRIXSCREEN TROJAN! Source=Paul Collins Startup list [MatrixScreenSaver] Number=4916 Confirmed=X Filename=mss.exe Description=Malware, see here Source=Paul Collins Startup list [Matrox Color Control] Number=4917 Confirmed=N Filename=hgcctl95.exe Description=For Matrox video cards. Quick access to changing colors Source=Paul Collins Startup list [Matrox Control Center] Number=4918 Confirmed=N Filename=mgactrl.exe Description=For Matrox video cards. Quick access to settings Source=Paul Collins Startup list [Matrox Diagnostic] Number=4919 Confirmed=N Filename=mgadiag.exe Description=For Matrox video cards. Quick access to diagnostics Source=Paul Collins Startup list [Matrox Powerdesk] Number=4920 Confirmed=N Filename=PDesk.exe Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [Matrox PowerDesk 8] Number=4921 Confirmed=N Filename=Matrox.PowerDesk.exe /silent Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [Matrox QuickDesk] Number=4922 Confirmed=N Filename=mgaqdesk.exe Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [MAV_check] Number=4923 Confirmed=N Filename=mav_startupmon.exe Description=WinAntiVirus Pro 2007 virus software - not recommended, see here Source=Paul Collins Startup list [MaxAlerts] Number=4924 Confirmed=X Filename=max.exe Description=Bonzi MaxALERT - spyware Source=Paul Collins Startup list [MaxtorCombo] Number=4925 Confirmed=Y Filename=ComboButton.exe Description=Required to be able to use the Maxtor OneTouch button on your external Maxtor harddrive. It is used to start up backup software (Retrospect) Source=Paul Collins Startup list [MaxtorOneTouch] Number=4926 Confirmed=U Filename=OneTouch.exe Description=Maxtor OneTouch Hard Drives/OneTouch Family hard disk backup software Source=Paul Collins Startup list [MaxtorReg] Number=4927 Confirmed=U Filename=AUTOREG.EXE Description=Part of SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of Source=Paul Collins Startup list [MayaPan] Number=4928 Confirmed=Y Filename=MayaPan.Exe Description=Audiotrak Maya soundcard driver Source=Paul Collins Startup list [mb2np] Number=4929 Confirmed=X Filename=[random filename] Description=Added by the IRCBOT.TJ WORM! Source=Paul Collins Startup list [MBM 4] Number=4930 Confirmed=U Filename=MBM4.exe Description=Motherboard Monitor 4 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs Source=Paul Collins Startup list [MBM 5] Number=4931 Confirmed=U Filename=MBM5.exe Description=Motherboard Monitor 5 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs Source=Paul Collins Startup list [MBMon] Number=4932 Confirmed=? Filename=Rundll32 CTMBHA.DLL, MBMon Description=Creative Filter AudioControlMB Module - related to the Creative Audigy line of sound cards. What does it do and is it required? Source=Paul Collins Startup list [MBNet] Number=4933 Confirmed=U Filename=mbnet.exe Description=MBNet (Portugal) Credit Card Processing software Source=Paul Collins Startup list [MBProbe] Number=4934 Confirmed=U Filename=mbrpobe.exe Description=MBProbe - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs Source=Paul Collins Startup list [mbssm32] Number=4935 Confirmed=U Filename=mbssm32.exe Description=Reported as Micro Bill Systems foistware - but not according to the company themselves, see here Source=Paul Collins Startup list [MC] Number=4936 Confirmed=X Filename=wintrims.exe Description=Added by the WINTRIM TROJAN! Source=Paul Collins Startup list [MC] Number=4937 Confirmed=X Filename=MAGICON.EXE Description=Added by the MAGICON.A TROJAN! Source=Paul Collins Startup list [MC] Number=4938 Confirmed=X Filename=N/A Description=Added by the SIMCSS TROJAN! Source=Paul Collins Startup list [MC] Number=4939 Confirmed=X Filename=WINTRIM.EXE Description=Added by the WINTRIM_A TROJAN! Source=Paul Collins Startup list [McAfee] Number=4940 Confirmed=X Filename=McAffeAv.exe Description=Added by the NETSKY.AL WORM! Source=Paul Collins Startup list [mcafee] Number=4941 Confirmed=X Filename=Win32.dll.vbs Description=Added by the CATCHER-B WORM! Source=Paul Collins Startup list [Mcafee Anti Scan] Number=4942 Confirmed=X Filename=NortonScn.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [McAfee Antivirus] Number=4943 Confirmed=X Filename=McAfeeAV.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Mcafee Antivirus Monitoring System326] Number=4944 Confirmed=X Filename=VSStatmn326.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mcafee Antivirus Monitoring System32mn] Number=4945 Confirmed=X Filename=VSStatmn32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [McAfee Antivirus Protection] Number=4946 Confirmed=X Filename=mcafeeAV.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Mcafee Auto Protect] Number=4947 Confirmed=X Filename=mcafeshield.exe Description=Added by the RBOT-UH WORM! Source=Paul Collins Startup list [McAfee Desktop Firewall Tray] Number=4948 Confirmed=Y Filename=FireTray.exe Description=McAfee Desktop Firewall Source=Paul Collins Startup list [McAfee Firewall] Number=4949 Confirmed=Y Filename=CPD.EXE Description=Firewall bundled with McAfee VirusScan 6.*. Can also be listed as CPD_EXE Source=Paul Collins Startup list [McAfee Guardian] Number=4950 Confirmed=N Filename=CMGRDIAN.EXE Description=McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System Mechanic Source=Paul Collins Startup list [McAfee Online virus Scanner] Number=4951 Confirmed=X Filename=avp.exe Description=Added by the RBOT-GCV WORM! Not to be confused with AOL's Active Virus Shield (by Kaspersky) Source=Paul Collins Startup list [McAfee QuickClean Imonitor] Number=4952 Confirmed=N Filename=Plguni.exe Description=McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Source=Paul Collins Startup list [mcafee Software Intrenet] Number=4953 Confirmed=X Filename=mcafee.exe Description=Added by the RBOT-ATR WORM! Note - this is not a valid McAfee program Source=Paul Collins Startup list [McAfee Windows Protection] Number=4954 Confirmed=X Filename=mcafee32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [McAfee Winguage] Number=4955 Confirmed=N Filename=?? Description=Part of McAfee Nuts & Bolts. "WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [McAfee.InstantUpdate.Monitor] Number=4956 Confirmed=U Filename=RuLaunch.exe Description=Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Source=Paul Collins Startup list [McAfeeFireTray] Number=4957 Confirmed=Y Filename=Firetray.exe Description=McAfee Desktop Firewall Source=Paul Collins Startup list [McAfeeScanPlus] Number=4958 Confirmed=X Filename=McAfeeScanPlus.exe Description=Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder Source=Paul Collins Startup list [McAfeeUpdaterUI] Number=4959 Confirmed=Y Filename=UpdaterUI.exe Description=Associated with McAfee Enterprise 7.0.0. - background process Source=Paul Collins Startup list [McAfeeVirusScanService] Number=4960 Confirmed=Y Filename=Avsynmgr.exe Description=From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe), WebScanX (Webscanx.exe), VirusScan System Scan (Vshwin32.exe) and VirusScan Console (Avconsol.exe) under one application Source=Paul Collins Startup list [McAfeeWebscanX] Number=4961 Confirmed=Y Filename=WebScanX.exe Description=From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [Mcaffe Antivirus] Number=4962 Confirmed=X Filename=Mcafeescn.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [McAgentExe] Number=4963 Confirmed=U Filename=mcagent.exe Description=From McAfee VirusScan On-line. The Agent is a red M icon that appears in the Windows system tray or Notification Area (if you're running Windows XP). If you don't see the agent icon, VirusScan Online may not be installed Source=Paul Collins Startup list [Mcappins.exe] Number=4964 Confirmed=Y Filename=mcappins.exe Description=Used by McAfee Virusscan to perform product updates. When updates are available the program will download and install them automatically. Recommended to leave enabled Source=Paul Collins Startup list [MChanger] Number=4965 Confirmed=N Filename=MChanger.exe Description=Media Changer - utility that allows you to change wallpapers, sounds, themes, etc Source=Paul Collins Startup list [McLogLch_exe] Number=4966 Confirmed=N Filename=McLogLch.exe Description=Related to McAfee security suite. This is a non-essential program, but should not be disabled unless suspected to be causing problems Source=Paul Collins Startup list [MCM3] Number=4967 Confirmed=X Filename=mcm3.exe Description=ShopAtHome/SAHagent adware variant Source=Paul Collins Startup list [McRegWiz] Number=4968 Confirmed=? Filename=mcregwiz.exe Description=McAfee antivirus related. What does it do and is it required? Source=Paul Collins Startup list [Mcrosoftr Update] Number=4969 Confirmed=X Filename=Mcrosoftr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [McShld9x] Number=4970 Confirmed=Y Filename=mcshld9x.exe Description=Part of McAfee's Virusscan Online. Must be enabled for scanning to work Source=Paul Collins Startup list [MCTskShd] Number=4971 Confirmed=Y Filename=mctskshd.exe Description=Part of McAfee SecurityCenter. Runs in the background controlling critcal updates and control antivirus related actions. This program is important for the stable and secure running of your computer Source=Paul Collins Startup list [McUpdateExe] Number=4972 Confirmed=U Filename=mcupdate.exe Description=From McAfee VirusScan On-line. Automatically updates your virus definitions. Leave enabled unless you regularly update these definitions Source=Paul Collins Startup list [McVsRte] Number=4973 Confirmed=Y Filename=mcvsrte.exe Description=Part of McAfee's SecurityCenter. Must remain checked but one user reports Windows glitches with no response from McAfee as to why Source=Paul Collins Startup list [mcvsshld] Number=4974 Confirmed=Y Filename=mcvsshld.exe Description=McAfee VirusScan On-line. See also the McAgentExe entry Source=Paul Collins Startup list [MCX Update] Number=4975 Confirmed=X Filename=wisp.exe Description=Added by the RBOT-AQH WORM! Source=Paul Collins Startup list [MCX Updte] Number=4976 Confirmed=X Filename=scorti.exe Description=Added by the RBOT-ARP WORM! Source=Paul Collins Startup list [MD IE Plugin] Number=4977 Confirmed=X Filename=md.exe Description=Marketdart spyware Source=Paul Collins Startup list [MD IE Plugin] Number=4978 Confirmed=X Filename=winy.exe Description=Adware Source=Paul Collins Startup list [mdac_runonce] Number=4979 Confirmed=N Filename=runonce.exe Description=Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe". Source=Paul Collins Startup list [MDDiskProtect.exe] Number=4980 Confirmed=N Filename=MDDiskProtect.exe Description=MediaFour MacDrive for Windows - easily open, edit and save files from Mac-formatted disks, format Mac disks and burn Mac CDs and DVDs! Source=Paul Collins Startup list [mdetect] Number=4981 Confirmed=X Filename=[path to trojan] Description=Added by the SPABOT TROJAN! Source=Paul Collins Startup list [Mdm] Number=4982 Confirmed=X Filename=Mdm.vbs Description=Added by the WHITEHO VIRUS or TRAPPY WORM! Source=Paul Collins Startup list [mdm] Number=4983 Confirmed=X Filename=mdm.exe Description=Added by the LYDRA-F TROJAN! Note - this is not the valid Machine Debug Manager which shares the same filename Source=Paul Collins Startup list [MDM7] Number=4984 Confirmed=U Filename=mdm.exe Description=Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as Machine Debug Manager. See here to disable Source=Paul Collins Startup list [Mdmdll] Number=4985 Confirmed=X Filename=mdmdll.exe Description=Added by the CRYPTER TROJAN! Source=Paul Collins Startup list [Mdmdll32] Number=4986 Confirmed=X Filename=mdmdll32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [MDN] Number=4987 Confirmed=X Filename=MDNS.exe Description=Added by the SPYBOT.JPB WORM! Source=Paul Collins Startup list [MDN] Number=4988 Confirmed=X Filename=MDNZ.exe Description=Added by the RBOT.AQD WORM! Source=Paul Collins Startup list [MDN] Number=4989 Confirmed=X Filename=MDN.exe Description=Added by the RBOT.AOA WORM! Source=Paul Collins Startup list [mds.exe] Number=4990 Confirmed=X Filename=mds.exe Description=Added by the MADS-A TROJAN! Source=Paul Collins Startup list [MDSA Sentinel X] Number=4991 Confirmed=X Filename=smss.exe Description=Added by SentinelX spyware. Note - SentinelX is spyware that logs keystrokes. It also monitors and records Web sites visited and applications used. The risk can capture periodic screen shots and may be configured so as to block access to specific Web sites and chat rooms, must be manually installed. Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "MDSA Software" subfolder of the Program Files folder Source=Paul Collins Startup list [mdwmdmsp] Number=4992 Confirmed=X Filename=mdwmdmsp.exe Description=Adware - recognized by Kaspersky antivirus as TrojanDownloader.Win32.Agent.am Source=Paul Collins Startup list [MECA] Number=4993 Confirmed=N Filename=Meca.exe Description=Meca cross-platform communications technology, branded messengers will connect with AOL, MSN, Yahoo!, and ICQ users Source=Paul Collins Startup list [MedGS] Number=4994 Confirmed=X Filename=MEDGS1.exe Description=PacerD_Media/Pacimedia.com adware Source=Paul Collins Startup list [Media Access] Number=4995 Confirmed=X Filename=MediaAccK.exe Description=Windupdates MEDIAPAS.A adware Source=Paul Collins Startup list [Media Access] Number=4996 Confirmed=X Filename=MediaAccK.exe Description=Added by the PODROP-C TROJAN! Source=Paul Collins Startup list [Media Gateway] Number=4997 Confirmed=X Filename=MediaGateway.exe Description=180Solutions adware related Source=Paul Collins Startup list [Media Load] Number=4998 Confirmed=X Filename=msn32.exe Description=Added by a unidentified WORM or TROJAN! Source=Paul Collins Startup list [Media Manager Indexer] Number=4999 Confirmed=U Filename=AIRSVCU.EXE Description=Part of MS Visual InterDev, Media Manager is an easy media file management system that works in conjunction with Windows Explorer. The Media Manager Indexer is a program that indexes all the information about your media files and puts it into a database Source=Paul Collins Startup list [Media Pass] Number=5000 Confirmed=X Filename=MediaPassK.exe Description=MediaPass adware Source=Paul Collins Startup list [Media Pass] Number=5001 Confirmed=X Filename=MediaPass.exe Description=WindUpdates MediaPass adware Source=Paul Collins Startup list [Media Player] Number=5002 Confirmed=X Filename=media.exe Description=Added by the FLDMEDIA-A TROJAN! Source=Paul Collins Startup list [Media Player] Number=5003 Confirmed=X Filename=wmplayer.exe Description=Added by the AGOBOT-BM WORM! Source=Paul Collins Startup list [Media Player] Number=5004 Confirmed=X Filename=Sysdll.exe Description=Added by the BANKER-BR TROJAN! Source=Paul Collins Startup list [Media Player] Number=5005 Confirmed=X Filename=Sysnet.exe Description=Added by the BANKER.MW WORM! Source=Paul Collins Startup list [Media Player Update] Number=5006 Confirmed=X Filename=xpsp1mfh.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Media Plug x.1.2] Number=5007 Confirmed=X Filename=msdm.exe Description=Added by the MULDROP.352 VIRUS! Source=Paul Collins Startup list [Media Service] Number=5008 Confirmed=X Filename=msn64.exe Description=Added by the SPYBOT.EV WORM! Source=Paul Collins Startup list [Media service] Number=5009 Confirmed=X Filename=msnmsgxr.exe Description=Added by the SDBOT.TF WORM! Source=Paul Collins Startup list [Media service] Number=5010 Confirmed=X Filename=SYSTEM64.EXE Description=Added by the RBOT.QV WORM! Source=Paul Collins Startup list [Media service] Number=5011 Confirmed=X Filename=notpad.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Media Software UPdater] Number=5012 Confirmed=X Filename=sscs.exe Description=Added by the RBOT-ABE WORM! Source=Paul Collins Startup list [Media X Services] Number=5013 Confirmed=X Filename=MSNGRx.exe Description=Added by the RBOT.AUL WORM! Source=Paul Collins Startup list [Media-XP-Service-Pack3] Number=5014 Confirmed=X Filename=msnzx.exe Description=Added by the SDBOT-ACW WORM! Source=Paul Collins Startup list [MEDIA32] Number=5015 Confirmed=X Filename=[path to trojan] Description=Added by the PURSCAN-Z TROJAN! Source=Paul Collins Startup list [MediaFace Integration] Number=5016 Confirmed=N Filename=Sethook.exe Description=Fellowes Neato� cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" Source=Paul Collins Startup list [Mediafour Mac Volume Notifications] Number=5017 Confirmed=U Filename=Macvntfy.exe Description=Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod Source=Paul Collins Startup list [Mediafour XPlay Tray Notification Icon] Number=5018 Confirmed=U Filename=Xptryicn.exe Description=Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod Source=Paul Collins Startup list [MediaKey] Number=5019 Confirmed=U Filename=MediaKey.exe Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [MediaLifeService] Number=5020 Confirmed=U Filename=MediaLifeService.exe Description=Related to MediaPlay Cordless Mouse from Logitech Source=Paul Collins Startup list [MediaLoads] Number=5021 Confirmed=X Filename=dw.exe Description=Medialoads adware Source=Paul Collins Startup list [MediaLoads Installer] Number=5022 Confirmed=X Filename=dw.exe Description=Medialoads adware Source=Paul Collins Startup list [MediaMonitor] Number=5023 Confirmed=N Filename=Mediam~1.exe Description=Installed by Smartdisk MVP CD burning software. Software will work fine without it Source=Paul Collins Startup list [mediamotor.exe] Number=5024 Confirmed=X Filename=mmups.exe Description=Added by the AGENT-BY TROJAN! Source=Paul Collins Startup list [MediaPath] Number=5025 Confirmed=X Filename=Proyecto1.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [MediaPath] Number=5026 Confirmed=X Filename=Root.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [MediaPipe P2P Loader] Number=5027 Confirmed=X Filename=mpp2pl.exe Description=MediaPipe peer-to-peer file swapping program also reported as a hijacker Source=Paul Collins Startup list [mediapluscash.exe] Number=5028 Confirmed=X Filename=mediapluscash.exe Description=MediaGateway adware Source=Paul Collins Startup list [MediaRing Talk] Number=5029 Confirmed=N Filename=mrtalk.exe Description=Media Ring Talk, voice recognition software, Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [MediaXPServicePack] Number=5030 Confirmed=X Filename=mxpsp.exe Description=Added by the SDBOT.CDT WORM! Source=Paul Collins Startup list [media_driver] Number=5031 Confirmed=X Filename=media_driver.exe Description=Added by the TUPEG VIRUS! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [media_manager] Number=5032 Confirmed=X Filename=mediaman.exe Description=Mini-Player, IMESH related foistware, see here Source=Paul Collins Startup list [media_stub] Number=5033 Confirmed=X Filename=stub.exe Description=Mini-Player, IMESH related foistware, see here Source=Paul Collins Startup list [MedionVFD] Number=5034 Confirmed=? Filename=MdionLCM.exe Description=Related to Medion Display Information. What does it do and is it required? Source=Paul Collins Startup list [Meeting Connection] Number=5035 Confirmed=X Filename=comsutil.exe Description=Added by the PPDOOR-E TROJAN! Source=Paul Collins Startup list [Meeting Connection] Number=5036 Confirmed=X Filename=wowdache.exe Description=Added by the PPDOOR-D TROJAN! Source=Paul Collins Startup list [Meeting Connection] Number=5037 Confirmed=X Filename=hgakdl32.exe Description=Looks like a variant of the PPDOOR-E TROJAN! Source=Paul Collins Startup list [MegaPanel] Number=5038 Confirmed=U Filename=HSTrans.exe Description=Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen Source=Paul Collins Startup list [melg34] Number=5039 Confirmed=X Filename=mdmd.exe Description=Added by an unidentified WORM or TROJAN - see here Source=Paul Collins Startup list [Members area] Number=5040 Confirmed=X Filename=******.exe [* = random digit] Description=Premium rate adult content dialer Source=Paul Collins Startup list [MemConfig] Number=5041 Confirmed=X Filename=SetupIE.com Description=Added by the TAPLAK WORM! Source=Paul Collins Startup list [Memento] Number=5042 Confirmed=N Filename=Memento.exe Description=Memento - simple app to keep text notes on your desktop Source=Paul Collins Startup list [MemMonster] Number=5043 Confirmed=U Filename=memmnstr.exe Description=MemMonster - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [MemoKit] Number=5044 Confirmed=U Filename=MK.EXE Description=Memory optimizer. It loads from startup group and it goes off as soon as the program (memokit.exe) is loaded in the System Tray. Mk.exe does not run while the memokit.exe is running. Probably loads a flash screen at startup and shutdown that stays on screen less than 5 seconds and gives you a button to push to purchase the full version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [memory] Number=5045 Confirmed=X Filename=outlookrem.exe Description=Added by the NOPIR.C WORM! Source=Paul Collins Startup list [Memory Check] Number=5046 Confirmed=X Filename=memore.exe Description=Added by the KILLAV.C TROJAN! Source=Paul Collins Startup list [Memory manager] Number=5047 Confirmed=X Filename=himem32.exe Description=Added by the MANCSYN TROJAN! Source=Paul Collins Startup list [Memory Service] Number=5048 Confirmed=X Filename=freememory.exe Description=Added by the RBOT.GEN WORM! Source=Paul Collins Startup list [Memory Stick Monitor] Number=5049 Confirmed=N Filename=MSTAT.exe Description=Used with the Sony floppy disk adapter for memory sticks, showing if there is a stick in the computer Source=Paul Collins Startup list [Memory Stick Monitor] Number=5050 Confirmed=U Filename=MSstat.exe Description=Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive Source=Paul Collins Startup list [Memory Watcher] Number=5051 Confirmed=X Filename=MemoryWatcher.exe Description=MemoryWatcher spyware Source=Paul Collins Startup list [Memory+] Number=5052 Confirmed=U Filename=tfimemsr.exe Description=Memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [MemoryBoost] Number=5053 Confirmed=U Filename=MemoryBoost.exe Description=MemoryBoost - memory optimizing program made by Tenebril Inc. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own mind Source=Paul Collins Startup list [MemoryCardManager] Number=5054 Confirmed=U Filename=MemCard.exe Description=Memory Card Manager - for removable memory cards found on Dell or Lexmark photo printers Source=Paul Collins Startup list [MemoryMeter] Number=5055 Confirmed=X Filename=MemoryMeter.exe Description=Autoinstalling spyware by Total Velocity Source=Paul Collins Startup list [MemoryZipperPlus] Number=5056 Confirmed=U Filename=memzip.exe Description=Memory Zipper Plus - "optimizes the memory management of your system and boost-up its performance amazingly!" Source=Paul Collins Startup list [memreader.exe] Number=5057 Confirmed=X Filename=memreader.exe Description=Added by the AGOBOT-TY WORM! Source=Paul Collins Startup list [MEMreaload] Number=5058 Confirmed=X Filename=MEMreaload.exe Description=Added by the LAZAR TROJAN! Source=Paul Collins Startup list [MemScanner] Number=5059 Confirmed=N Filename=MemScanner.exe Description=Part of Enigma SpyHunter - not recommended, see note Source=Paul Collins Startup list [MemTurbo] Number=5060 Confirmed=U Filename=memturbo.exe Description=MemTurbo memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [MenuSnap] Number=5061 Confirmed=N Filename=MenuSnap.exe Description=MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe Source=Paul Collins Startup list [Mercora] Number=5062 Confirmed=N Filename=MercoraClient.exe Description=Mercora MusicSearch "Search, find and listen to music on the world's largest jukebox, built by people just like you". Note - if you subscribe make sure you read the Privacy Policy Source=Paul Collins Startup list [Message Queuing] Number=5063 Confirmed=X Filename=msmqs.exe Description=Added by the FREEFORS TROJAN! Source=Paul Collins Startup list [MessagerStarter Freeserve] Number=5064 Confirmed=N Filename=StartMessager.exe Description=Freeserve Messenger Source=Paul Collins Startup list [Message_Blocker] Number=5065 Confirmed=U Filename=messageblock.exe Description=Message Blocker - "prevents Outlook Express from loading images or other content from the internet without confirmation, as well as executing scripts when displaying a formatted email message" Source=Paul Collins Startup list [Messanger] Number=5066 Confirmed=X Filename=trillian.exe Description=Added by the RBOT.CKI WORM! Source=Paul Collins Startup list [Messanger] Number=5067 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [Messanger] Number=5068 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [Messanger] Number=5069 Confirmed=Y Filename=s_menu.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [Messanger] Number=5070 Confirmed=X Filename=browse.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [Messenger] Number=5071 Confirmed=X Filename=messenger.exe Description=Added by the KUTEX TROJAN! Source=Paul Collins Startup list [Messenger] Number=5072 Confirmed=X Filename=ntsubsys.exe Description=Added by the SDBOT.BGE WORM! Source=Paul Collins Startup list [Messenger] Number=5073 Confirmed=X Filename=Wmsngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Messenger] Number=5074 Confirmed=Y Filename=SCANMSG.EXE Description=AntiVirus Quick Heal - virus protection Source=Paul Collins Startup list [Messenger Block] Number=5075 Confirmed=X Filename=msngrblock.exe Description=Added by the PATOO WORM! Source=Paul Collins Startup list [Messenger Protocol] Number=5076 Confirmed=X Filename=netsender.exe Description=Added by the SDBOT-ACC WORM! Source=Paul Collins Startup list [Messenger Service] Number=5077 Confirmed=X Filename=msmsgs.exe Description=Added by the SDBOT-ZB WORM! Source=Paul Collins Startup list [Messenger Service] Number=5078 Confirmed=X Filename=nvhost.exe Description=Added by the JLOK-A WORM! Source=Paul Collins Startup list [Messenger Service Updater] Number=5079 Confirmed=X Filename=svshost.exe Description=Added by the MYTOB.GC WORM! Source=Paul Collins Startup list [Messenger start-up] Number=5080 Confirmed=X Filename=Msgran.exe Description=Added by the GRAMOS WORM! Source=Paul Collins Startup list [Messenger6] Number=5081 Confirmed=X Filename=command.pif Description=Added by the INZAE.B WORM! Source=Paul Collins Startup list [MessengerDiscovery] Number=5082 Confirmed=U Filename=MessengerDiscovery.exe Description=MessengerDiscovery is a MSN Messenger add-on - adding over 70 new features. Now superseeded by MessengerDiscovery Live - with support added for Windows Live Source=Paul Collins Startup list [MessengerPlus] Number=5083 Confirmed=N Filename=MsgPlus.exe Description=MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"! Source=Paul Collins Startup list [MessengerPlus2] Number=5084 Confirmed=N Filename=MsgPlus.exe Description=MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"! Source=Paul Collins Startup list [MessengerPlus3] Number=5085 Confirmed=N Filename=MsgPlus.exe Description=MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"! Source=Paul Collins Startup list [messnger] Number=5086 Confirmed=X Filename=[worm filename] Description=Added by the DELODER WORM! Source=Paul Collins Startup list [messnger] Number=5087 Confirmed=X Filename=Dvldr32.exe Description=Added by the DELODER.A WORM! Source=Paul Collins Startup list [Metacafe] Number=5088 Confirmed=N Filename=MetacafeAgent.exe Description=Metacafe - video sharing on the web. Note - if you subscribe make sure you read the Privacy Policy Source=Paul Collins Startup list [MeTaLRoCk (irc.musirc.com) has sex with printers] Number=5089 Confirmed=X Filename=metalrock-is-gay.exe Description=Added by the RANDEX.Q WORM! Source=Paul Collins Startup list [MeuPrograma] Number=5090 Confirmed=X Filename=accwizz.exe Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [Mfc**.exe [* = random char]] Number=5091 Confirmed=X Filename=Mfc**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Mfc**32.exe [* = random char]] Number=5092 Confirmed=X Filename=Mfc**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [mfgboot] Number=5093 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [mFilter] Number=5094 Confirmed=X Filename=MNeck.exe Description=Added by the CLICKER-AG TROJAN! Source=Paul Collins Startup list [mfin32] Number=5095 Confirmed=X Filename=mfin32.exe Description=MyFreeInternetUpdate - adware downloader Source=Paul Collins Startup list [MGA Hook] Number=5096 Confirmed=? Filename=Mgahook.exe Description=MATROX Graphics card related. What does it do and is it required? Source=Paul Collins Startup list [MGA Quickdesk] Number=5097 Confirmed=N Filename=MGAQDESK.EXE Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [Mgabg] Number=5098 Confirmed=U Filename=Mgabg.exe Description=Matrox BIOS Guard - monitors a Matrox card's BIOS, and will reflash it when needed. Cards like the G400 have a nasty habit of losing their BIOS, especially on poor power supplies. If you make an emergency BIOS disk with the utility in their BIOS package, you can disable Mgabg.exe and just use the crash disk if/when needed Source=Paul Collins Startup list [mgavctrl] Number=5099 Confirmed=Y Filename=mgavrtcl.exe Description=McAfee's Virus Scan Online Source=Paul Collins Startup list [mgavctrl] Number=5100 Confirmed=Y Filename=mgavrte.exe Description=McAfee's Virus Scan Online Source=Paul Collins Startup list [mgavrtclexe] Number=5101 Confirmed=Y Filename=mgavrtcl.exe Description=McAfee's Virus Scan Online Source=Paul Collins Startup list [mgavrtclexe] Number=5102 Confirmed=Y Filename=mgavrte.exe Description=McAfee's Virus Scan Online Source=Paul Collins Startup list [MGA_CD_Install] Number=5103 Confirmed=N Filename=mgasetup.exe Description=Matrox Millennium video driver. Not required once drivers installed Source=Paul Collins Startup list [mgmtapi] Number=5104 Confirmed=X Filename=mgmtapi.exe Description=Unidentified malware Source=Paul Collins Startup list [MHDOGStart] Number=5105 Confirmed=X Filename=mhdogst.EXE Description=Added by an unidentified VIRUS, WORM or TROJAN! A possibility is a trojan known as PENIS Source=Paul Collins Startup list [MHINIT] Number=5106 Confirmed=N Filename=MHINIT.EXE Description=Part of the Cybermedia Clean Sweep package Source=Paul Collins Startup list [mhs3] Number=5107 Confirmed=X Filename=mhs3.exe Description=Added by the PWS-ALZ TROJAN! Source=Paul Collins Startup list [Mi7sft sdce] Number=5108 Confirmed=X Filename=b0yz.exe Description=Added by the RBOT.CWG WORM! Source=Paul Collins Startup list [Mi7sft sdce] Number=5109 Confirmed=X Filename=MNSQ.exe Description=Added by the RBOT.DMU WORM! Source=Paul Collins Startup list [Mi7sft sdce] Number=5110 Confirmed=X Filename=scorti.exe Description=Added by the RBOT.ELC WORM! Source=Paul Collins Startup list [Mickey Mouse Cereal] Number=5111 Confirmed=X Filename=[random filename].exe Description=Added by the RANKY.Q TROJAN! Source=Paul Collins Startup list [Micosoft Data Core] Number=5112 Confirmed=X Filename=runservice.exe Description=Added by the IRCBOT.BK WORM! Source=Paul Collins Startup list [Micr Update] Number=5113 Confirmed=X Filename=soundblaster.exe Description=Added by the SDBOT.NP WORM! Source=Paul Collins Startup list [Micr0s0ft Ms D0s] Number=5114 Confirmed=X Filename=msdx.exe Description=Added by the RBOT-AON WORM! Source=Paul Collins Startup list [Micr0s0ft Upd4t4z] Number=5115 Confirmed=X Filename=svchost32.exe Description=Added by the RBOT.ALF WORM! Source=Paul Collins Startup list [Micrcoft Exploerer] Number=5116 Confirmed=X Filename=spoolsal.exe Description=Added by the RBOT-AKK WORM! Source=Paul Collins Startup list [Micrcoft Exploerer] Number=5117 Confirmed=X Filename=svchose.exe Description=Added by the RBOT-ASL WORM! Source=Paul Collins Startup list [Micrcoft Updat] Number=5118 Confirmed=X Filename=spoolsae.exe Description=Added by the RBOT-AIB WORM! Source=Paul Collins Startup list [Micrcoft Updat] Number=5119 Confirmed=X Filename=spoolsaex.exe Description=Added by the RBOT-AJM WORM! Source=Paul Collins Startup list [Micrcoft Updat] Number=5120 Confirmed=X Filename=Internet.exe Description=Added by the RBOT-ANA WORM! Source=Paul Collins Startup list [Micrcsoft Certificate Services] Number=5121 Confirmed=X Filename=cflmon.exe Description=Added by the RBOT-FWV WORM! Source=Paul Collins Startup list [Micro CRC Protocol] Number=5122 Confirmed=X Filename=scrc32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Micro Process] Number=5123 Confirmed=X Filename=appconf.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Micro Update] Number=5124 Confirmed=X Filename=dailin.exe Description=Added by the RBOT-ER WORM! Source=Paul Collins Startup list [Microangelo Desktop] Number=5125 Confirmed=N Filename=Muamgr.exe Description=Using MicroAngelo On Display, you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system Source=Paul Collins Startup list [microAttuneDownload] Number=5126 Confirmed=N Filename=atmdlusr.exe Description=Application Launcher, MS Office application. USR (US Robotics) modem auto updater. May be a sub-set of Attune Source=Paul Collins Startup list [MicroCQ0] Number=5127 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-AK TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [MicroDialler] Number=5128 Confirmed=U Filename=atdialler1.exe Description=Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered Source=Paul Collins Startup list [MicroedSoft Toolbar] Number=5129 Confirmed=X Filename=Smoked.exe Description=Added by the RBOT-ALN WORM! Source=Paul Collins Startup list [Microfinder lptt01] Number=5130 Confirmed=X Filename=mcf.exe Description=RapidBlaster variant (in a "mcf" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Microfinder ml097e] Number=5131 Confirmed=X Filename=mcf.exe Description=RapidBlaster variant (in a "mcf" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Microfot Update] Number=5132 Confirmed=X Filename=winldx32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microft Exploerer] Number=5133 Confirmed=X Filename=spoolsac.exe Description=Added by the RBOT-AMD WORM! Source=Paul Collins Startup list [Microft Update 32] Number=5134 Confirmed=X Filename=winssx.exe Description=Added by the RBOT-AQS WORM! Source=Paul Collins Startup list [MicroLoad] Number=5135 Confirmed=X Filename=[random filename] Description=Added by the DARBY WORM! Source=Paul Collins Startup list [Micromedia Flash Update] Number=5136 Confirmed=X Filename=wdfmrg.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Micromedia Flash Update] Number=5137 Confirmed=X Filename=xptxt.exe Description=Added by the RBOT-GAB WORM! Source=Paul Collins Startup list [Microoft Timing] Number=5138 Confirmed=X Filename=pupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MICROSFT ANTIVIRUS UPDATE SUPPORT] Number=5139 Confirmed=X Filename=[random 10-letter filename].EXE Description=Added by the RBOT-AQA WORM! Source=Paul Collins Startup list [MICROSFT ANTIVIRUS UPDATE SUPPORT] Number=5140 Confirmed=X Filename=MSGUPDATED.EXE Description=Added by the RBOT-APZ WORM! Source=Paul Collins Startup list [Microsft Conf 32] Number=5141 Confirmed=X Filename=msaconf.exe Description=Added by the RBOT.EYA WORM! Source=Paul Collins Startup list [Microsft Confige 32] Number=5142 Confirmed=X Filename=msaconfigurez.exe Description=Added by the RBOT.CLC WORM! Source=Paul Collins Startup list [MICROSFT MX UPDATE SUPPORT] Number=5143 Confirmed=X Filename=taskmngrs.exe Description=Added by the RBOT-AUZ WORM! Source=Paul Collins Startup list [MICROSFT MX UPDATE SUPPORT] Number=5144 Confirmed=X Filename=winmx32.EXE Description=Added by the IRCBOT-FD WORM! Source=Paul Collins Startup list [MICROSFT RAMA UPDATE SUPPORT] Number=5145 Confirmed=X Filename=[random filename] Description=Added by the RBOT-ASM or RBOT-AUW WORMS! Source=Paul Collins Startup list [MICROSFT RAMA UPDATE SUPPORT] Number=5146 Confirmed=X Filename=MSN32.EXE Description=Added by the RBOT-AWJ WORM! Source=Paul Collins Startup list [MICROSFT RAMA UPDATE SUPPORT] Number=5147 Confirmed=X Filename=mtakthmyn.EXE Description=Added by the RBOT-AUJ WORM! Source=Paul Collins Startup list [Microsft Security Monitor Process] Number=5148 Confirmed=X Filename=cmh.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsft Security Monitor Process] Number=5149 Confirmed=X Filename=mssmppp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsft Security Monitor Process] Number=5150 Confirmed=X Filename=mssmpp.exe Description=Added by a variant of the RBOT-FUB WORM! Source=Paul Collins Startup list [Microsft Updtes] Number=5151 Confirmed=X Filename=sarvice.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsft Upgraed] Number=5152 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [microsft windows updates] Number=5153 Confirmed=X Filename=mwupdate32.exe Description=Added by a variant of the TOXBOT/CODBOT WORM! Source=Paul Collins Startup list [Microsof Value] Number=5154 Confirmed=X Filename=nmatt.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsof Windows Host] Number=5155 Confirmed=X Filename=svhost32.exe Description=Added by the RBOT.ADY WORM! Source=Paul Collins Startup list [Microsof Winlog Host] Number=5156 Confirmed=X Filename=wilogon32.exe Description=Added by the RBOT.XC WORM! Source=Paul Collins Startup list [Microsofot x386 System Monitor] Number=5157 Confirmed=X Filename=system32.exe Description=Added by the WOOTBOT.M WORM! Source=Paul Collins Startup list [microsoft] Number=5158 Confirmed=X Filename=svchost.exe Description=Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [microsoft] Number=5159 Confirmed=X Filename=microsoft.hta Description=HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Source=Paul Collins Startup list [Microsoft] Number=5160 Confirmed=X Filename=win32.exe Description=Added by the DARKMOON TROJAN! Source=Paul Collins Startup list [Microsoft] Number=5161 Confirmed=X Filename=iexplore.exe Description=Added by the QQROB-R TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft] Number=5162 Confirmed=X Filename=svchost.exe Description=Added by the ADUYO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft] Number=5163 Confirmed=X Filename=wuauclt.exe Description=Added by the QQROB-AQ TROJAN! Note - this is not the legitimate wuauclt.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft] Number=5164 Confirmed=X Filename=guard.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft] Number=5165 Confirmed=X Filename=wcsntfy.exe Description=Added by the AGOBOT-AHT WORM! Source=Paul Collins Startup list [Microsoft] Number=5166 Confirmed=X Filename=ssmss.exe Description=Added by the RBOT-FZF WORM! Source=Paul Collins Startup list [Microsoft] Number=5167 Confirmed=X Filename=lsass.ppf Description=Added by the RBOT-GAA WORM! Source=Paul Collins Startup list [Microsoft] Number=5168 Confirmed=X Filename=msvchost.exe Description=Added by the RBOT-GAW WORM! Source=Paul Collins Startup list [Microsoft] Number=5169 Confirmed=X Filename=mixers.exe Description=Added by the AGOBOT-AHU WORM! Source=Paul Collins Startup list [Microsoft] Number=5170 Confirmed=X Filename=msmsger.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft] Number=5171 Confirmed=X Filename=MSUPDATE.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsoft] Number=5172 Confirmed=X Filename=radnom.exe Description=Added by the RBOT-GHO WORM! Source=Paul Collins Startup list [Microsoft] Number=5173 Confirmed=X Filename=rtvcscan.exe Description=Added by the RBOT-GGU WORM! Source=Paul Collins Startup list [Microsoft] Number=5174 Confirmed=X Filename=taskbar.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft] Number=5175 Confirmed=X Filename=updater.exe Description=Added by the RBOT-GHP WORM! Source=Paul Collins Startup list [Microsoft] Number=5176 Confirmed=X Filename=windl32.exe Description=Added by the SDBOT-DCZ WORM! Source=Paul Collins Startup list [Microsoft Associates, Inc.] Number=5177 Confirmed=X Filename=iexplorer.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Microsoft (C) HTML Application host] Number=5178 Confirmed=X Filename=[random filename] Description=Added by the RBOT-YB WORM! Source=Paul Collins Startup list [Microsoft (R) Windows Configuration Backup Service] Number=5179 Confirmed=X Filename=svchost.exe Description=Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in either a "config", "mapping" or "security" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft (R) Windows DLL Loader] Number=5180 Confirmed=X Filename=rundll32.exe Description=Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). This file is located in a "dll" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft (R) Windows Network Latency Controller] Number=5181 Confirmed=X Filename=1.tmp Description=Added by a generic password stealer TROJAN - see here Source=Paul Collins Startup list [Microsoft (R) Windows Network Latency Controller] Number=5182 Confirmed=X Filename=nlc.exe Description=Added by a generic password stealer TROJAN - see here Source=Paul Collins Startup list [Microsoft (R) Windows Network Latency Controller] Number=5183 Confirmed=X Filename=sp2vc.exe Description=Added by a generic password stealer TROJAN - see here Source=Paul Collins Startup list [Microsoft (R) Windows Network Security Management Service] Number=5184 Confirmed=X Filename=nsms.exe Description=Added by the RANKY.LC TROJAN! Source=Paul Collins Startup list [Microsoft (R) Windows Protected Content Restoration Service] Number=5185 Confirmed=X Filename=services.exe Description=Added by the AGENT.AGV TROJAN! Source=Paul Collins Startup list [Microsoft (R) Windows Protocol Deployment Manager] Number=5186 Confirmed=X Filename=[random].tmp Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsoft (R) Windows TCP/IP Socket Driver] Number=5187 Confirmed=X Filename=[path to trojan] Description=Added by the PROXY-DD TROJAN! Source=Paul Collins Startup list [Microsoft (R) Windows Update Service] Number=5188 Confirmed=X Filename=wuauclt.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] Number=5189 Confirmed=X Filename=nrcs.exe Description=Added by the RANKY.X TROJAN! Source=Paul Collins Startup list [Microsoft .NET Confingurator] Number=5190 Confirmed=X Filename=msnconf.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft 16Bit Update] Number=5191 Confirmed=X Filename=wuapdate16.exe Description=Added by the RBOT.CZ WORM! Source=Paul Collins Startup list [Microsoft 64 Bit Runtime Updater] Number=5192 Confirmed=X Filename=wupdt64.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft ActiveX Debugger NT] Number=5193 Confirmed=X Filename=[path to trojan] Description=Added by the BANCOS-DO TROJAN! Source=Paul Collins Startup list [Microsoft ADservice] Number=5194 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Agent] Number=5195 Confirmed=X Filename=mdss32.exe Description=Added by the KEYLOG-AG TROJAN! Source=Paul Collins Startup list [Microsoft ALG32 Protocol] Number=5196 Confirmed=X Filename=alg32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft ALGXP Protocol] Number=5197 Confirmed=X Filename=alg32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Announcement Listener] Number=5198 Confirmed=N Filename=Annclist.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Microsoft Ansti Update] Number=5199 Confirmed=X Filename=msie.exe Description=Added by the RBOT-LE WORM! Source=Paul Collins Startup list [Microsoft Anti-Spy] Number=5200 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft AntiSpyware] Number=5201 Confirmed=X Filename=Bazzi.exe Description=Added by the AHKER.J WORM! Source=Paul Collins Startup list [Microsoft AntiSpyware] Number=5202 Confirmed=X Filename=KT06.pif Description=Added by the IRCBOT.GEN WORM! Source=Paul Collins Startup list [Microsoft AOL Instant Messenger] Number=5203 Confirmed=X Filename=MSAOL32.exe Description=Added by the RBOT-AAI WORM! Source=Paul Collins Startup list [Microsoft AOL32 Protocol] Number=5204 Confirmed=X Filename=aol32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Application Center] Number=5205 Confirmed=X Filename=mappc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Application Manager] Number=5206 Confirmed=X Filename=msapl32.exe Description=Added by the BROPIA-AE TROJAN! Source=Paul Collins Startup list [Microsoft AUT Update] Number=5207 Confirmed=X Filename=MSlti32.exe Description=Added by the RBOT-X WORM! Source=Paul Collins Startup list [Microsoft AUT Update] Number=5208 Confirmed=X Filename=MSlti16.exe Description=Added by the RBOT.EB WORM! Source=Paul Collins Startup list [Microsoft Authority Service] Number=5209 Confirmed=X Filename=lsass.exe Description=Added by the KALEL-D WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft auto update] Number=5210 Confirmed=X Filename=winupdate.exe Description=Added by the BMBOT TROJAN! Source=Paul Collins Startup list [Microsoft Auto Update] Number=5211 Confirmed=X Filename=WINHLP16.EXE Description=Added by the RBOT.GY WORM! Source=Paul Collins Startup list [Microsoft auto update] Number=5212 Confirmed=Y Filename=wuauclt.exe Description=Added by the CULT-B TROJAN! Note - this is not the legitimate wuauclt.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Automatic Update Serivce] Number=5213 Confirmed=X Filename=msautou.exe Description=Added by the RBOT-AOB WORM! Source=Paul Collins Startup list [Microsoft Automatic Updater] Number=5214 Confirmed=X Filename=Explorer.exe Description=Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder Source=Paul Collins Startup list [Microsoft AutoUpdater] Number=5215 Confirmed=X Filename=svhost.exe Description=Added by the RBOT.QG WORM! Source=Paul Collins Startup list [Microsoft Bool Value] Number=5216 Confirmed=X Filename=MV2.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft boot system cfg32] Number=5217 Confirmed=X Filename=actboost.exe Description=Added by the BROPIA.R WORM! Source=Paul Collins Startup list [Microsoft Broadband Networking] Number=5218 Confirmed=U Filename=MSBNTray.exe Description=Microsoft Broadband Networking Tray Application Source=Paul Collins Startup list [Microsoft Cab Manager] Number=5219 Confirmed=X Filename=exec.exe Description=Affilred adware Source=Paul Collins Startup list [Microsoft checker] Number=5220 Confirmed=X Filename=MsPMSPTv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Client] Number=5221 Confirmed=X Filename=mshost.exe Description=Added by the RBOT-AND WORM! Source=Paul Collins Startup list [Microsoft Client Pc] Number=5222 Confirmed=X Filename=spoolsrv.exe Description=Added by the RBOT-AQM WORM! Source=Paul Collins Startup list [Microsoft Client/Server Runtime Server Subsystem] Number=5223 Confirmed=X Filename=csrs.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Client/Server Runtime Server Subsystem] Number=5224 Confirmed=X Filename=csrssa.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Command Line] Number=5225 Confirmed=X Filename=wincmd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Conf Ldr] Number=5226 Confirmed=X Filename=sysconf.exe Description=Added by a variant of the SDBOT TROJAN! Source=Paul Collins Startup list [Microsoft ConfgKeys] Number=5227 Confirmed=X Filename=wurmgrd32.exe Description=Added by the RBOT-ARX WORM! Source=Paul Collins Startup list [Microsoft Config] Number=5228 Confirmed=X Filename=msconf.exe Description=Added by the RBOT.PV WORM! Source=Paul Collins Startup list [Microsoft Config] Number=5229 Confirmed=X Filename=MSCONF.EXE Description=Added by the RBOT-LG WORM! Source=Paul Collins Startup list [Microsoft Config 32] Number=5230 Confirmed=X Filename=msconfigx32.exe Description=Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant Source=Paul Collins Startup list [Microsoft Config 32bit] Number=5231 Confirmed=X Filename=mscnfg32.exe Description=Added by the RBOT-Z WORM! Source=Paul Collins Startup list [Microsoft Config File] Number=5232 Confirmed=X Filename=config.exe Description=Added by the KILLFILES.GR TROJAN! This is malware that will attempt to delete all system dlls! Source=Paul Collins Startup list [Microsoft Configoration Service] Number=5233 Confirmed=X Filename=msconfigs.exe Description=Added by the RBOT-ETT WORM! Source=Paul Collins Startup list [Microsoft Configs 32] Number=5234 Confirmed=X Filename=msgconfigrs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Configuration 35] Number=5235 Confirmed=X Filename=microsot1.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Microsoft Configure 32] Number=5236 Confirmed=X Filename=msgconfigre.exe Description=Added by a variant of the GAOBOT/AGOBOT WORM! Source=Paul Collins Startup list [Microsoft Connection Manager Monitor] Number=5237 Confirmed=X Filename=cmmon.pif Description=Added by the RBOT-AKV WORM! Source=Paul Collins Startup list [Microsoft Control Center] Number=5238 Confirmed=X Filename=crtl.exe Description=Added by the RBOT-VX WORM! Source=Paul Collins Startup list [Microsoft Core Support] Number=5239 Confirmed=X Filename=MSxUP32.exe Description=Added by the RBOT-ANR WORM! Source=Paul Collins Startup list [Microsoft Core Support] Number=5240 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT TROJAN! Source=Paul Collins Startup list [Microsoft Corp SQL Certificates] Number=5241 Confirmed=X Filename=sqlcer.exe Description=Added by the ZYBOT-C WORM! Source=Paul Collins Startup list [Microsoft Corp SSL Certificates] Number=5242 Confirmed=X Filename=windowz.exe Description=Added by the RBOT-GCZ WORM! Source=Paul Collins Startup list [Microsoft Corp TLS Certificates] Number=5243 Confirmed=X Filename=msauth.exe Description=Added by the RBOT-GAC WORM! Source=Paul Collins Startup list [Microsoft Corp Updates] Number=5244 Confirmed=X Filename=wupdates.exe Description=Added by the RBOT-AUU WORM! Source=Paul Collins Startup list [Microsoft Corporaticn SQL Handler] Number=5245 Confirmed=X Filename=sqlhandler.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Corporation] Number=5246 Confirmed=X Filename=[random filename] Description=Added by various VIRUSES, WORMS & TROJANS! Source=Paul Collins Startup list [Microsoft Corporation] Number=5247 Confirmed=X Filename=jview.exe Description=Added by the RBOT-AOD WORM! Source=Paul Collins Startup list [Microsoft Corporation SYM monitor] Number=5248 Confirmed=X Filename=mssym.exe Description=Added by the RBOT-GDB WORM! Source=Paul Collins Startup list [Microsoft CPXP Protocol] Number=5249 Confirmed=X Filename=cpxp.exe Description=Added by the RBOT.ATP WORM! Source=Paul Collins Startup list [Microsoft Crs Fix Serv] Number=5250 Confirmed=X Filename=wincrs.exe Description=Added by the SDBOT.BWF WORM! Source=Paul Collins Startup list [Microsoft CSRSS32 Protocol] Number=5251 Confirmed=X Filename=csrss32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft CSRSS386 Protocol] Number=5252 Confirmed=X Filename=csrss386.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Cvrt] Number=5253 Confirmed=X Filename=mscvrt32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Data Helper] Number=5254 Confirmed=X Filename=cihost.exe Description=Malware, possibly a variant of the LINST TROJAN Source=Paul Collins Startup list [Microsoft Data Machine] Number=5255 Confirmed=X Filename=csdata32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Database Handler] Number=5256 Confirmed=X Filename=mssql32.exe Description=Added by the RANDEX.AX WORM! Source=Paul Collins Startup list [Microsoft Datalog Application] Number=5257 Confirmed=X Filename=msdata.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft DDE Control] Number=5258 Confirmed=X Filename=wupades.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft DDEs Control] Number=5259 Confirmed=X Filename=Erun.pif Description=Added by the RBOT-AMU WORM! Source=Paul Collins Startup list [Microsoft Debug Service] Number=5260 Confirmed=X Filename=dbgbgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Decryption Technology] Number=5261 Confirmed=X Filename=Msfenoe.exe Description=Added by the SPYBOT-DG WORM! Source=Paul Collins Startup list [Microsoft Desktop Manager] Number=5262 Confirmed=X Filename=msdesk32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Dev] Number=5263 Confirmed=X Filename=iexplorer32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Development Debugger] Number=5264 Confirmed=X Filename=msdev.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Development Services] Number=5265 Confirmed=X Filename=msdevelop.exe Description=Added by the RBOT-FWS WORM! Source=Paul Collins Startup list [Microsoft Device Manager] Number=5266 Confirmed=X Filename=msdevmgr32.exe Description=Added by the LATEDA.B TROJAN! Source=Paul Collins Startup list [Microsoft Diagnostic] Number=5267 Confirmed=X Filename=[random filename] Description=Added by the ACEBOT TROJAN! Source=Paul Collins Startup list [Microsoft Diagnostic] Number=5268 Confirmed=X Filename=msdiag32.exe Description=Added by the RBOT-UC WORM! Source=Paul Collins Startup list [Microsoft Digital Clock] Number=5269 Confirmed=X Filename=msclock.exe Description=Added by the NACKBOT-D WORM! Source=Paul Collins Startup list [Microsoft DirectX] Number=5270 Confirmed=X Filename=Spoolserv.exe Description=Added by the DINFOR WORM! Source=Paul Collins Startup list [Microsoft DirectX] Number=5271 Confirmed=X Filename=rasmngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft DirectX] Number=5272 Confirmed=X Filename=PDSched.exe Description=Added by the SDBOT.CN WORM! Source=Paul Collins Startup list [Microsoft DirectX] Number=5273 Confirmed=X Filename=wuamgrd.exe Description=Added by the SDBOT.MY WORM! Source=Paul Collins Startup list [Microsoft DirectX] Number=5274 Confirmed=X Filename=time123.exe Description=Added by the SDBOT.MD WORM! Source=Paul Collins Startup list [Microsoft Directx] Number=5275 Confirmed=X Filename=directxat.exe Description=Added by the SDBOT-BXF WORM! Note - disables autostart for the SharedAccess service and deactivates the Microsoft Internet Connection Firewall (ICF) Source=Paul Collins Startup list [Microsoft Directx click] Number=5276 Confirmed=X Filename=directxclick.exe Description=Added by a variant of the RBOT-GHT WORM! Source=Paul Collins Startup list [Microsoft Directx clicks] Number=5277 Confirmed=X Filename=directxclickers.exe Description=Added by the RBOT-GHT WORM! Source=Paul Collins Startup list [Microsoft Directx push] Number=5278 Confirmed=X Filename=directxpushup.exe Description=Added by a variant of the RBOT-GHT WORM! Source=Paul Collins Startup list [Microsoft Directxsp] Number=5279 Confirmed=X Filename=directxbt.exe Description=Added by a variant of the RBOT-GHT WORM! Source=Paul Collins Startup list [Microsoft Directxspnew] Number=5280 Confirmed=X Filename=directxnew.exe Description=Added by a variant of the RBOT-GHT WORM! Source=Paul Collins Startup list [Microsoft DirktorWin] Number=5281 Confirmed=X Filename=[random filename] Description=Added by the SPYBOT.GEN3 TROJAN! Source=Paul Collins Startup list [Microsoft DLL] Number=5282 Confirmed=X Filename=fumeta.exe Description=Added by the RBOT-AUG WORM! Source=Paul Collins Startup list [Microsoft DLL Extensions] Number=5283 Confirmed=X Filename=SystemDll.exe Description=Added by the RBOT-ADV WORM! Source=Paul Collins Startup list [Microsoft dll Host Service] Number=5284 Confirmed=X Filename=wkssr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Dll Management] Number=5285 Confirmed=X Filename=windll.exe Description=Added by the RBOT-MT WORM! Source=Paul Collins Startup list [Microsoft Dll Printer Manager] Number=5286 Confirmed=X Filename=dllpt.exe Description=Added by the SDBOT.BIH WORM! Source=Paul Collins Startup list [Microsoft DLL Verifier] Number=5287 Confirmed=X Filename=file.exe Description=Added by the RBOT-AED WORM! Source=Paul Collins Startup list [Microsoft DLL Verifier] Number=5288 Confirmed=X Filename=chkfile.exe Description=Added by the RBOT-AOC WORM! Source=Paul Collins Startup list [Microsoft DLL Verifier] Number=5289 Confirmed=X Filename=csrssv.exe Description=Added by the RBOT-ATK WORM! Source=Paul Collins Startup list [Microsoft DLL Verifier] Number=5290 Confirmed=X Filename=mscon.exe Description=Added by the SDBOT.EAH WORM! Source=Paul Collins Startup list [Microsoft DLL Verifier] Number=5291 Confirmed=X Filename=winavguard.exe Description=Added by the SDBOT.AAD WORM! Source=Paul Collins Startup list [Microsoft DLLSet32] Number=5292 Confirmed=X Filename=dllset32.exe Description=Added by the RBOT.OZ WORM! Source=Paul Collins Startup list [Microsoft DNS Query] Number=5293 Confirmed=X Filename=msdns.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Microsoft DNSx] Number=5294 Confirmed=X Filename=mdnex.exe Description=Added by the DELBOT-AI WORM! Source=Paul Collins Startup list [Microsoft Document] Number=5295 Confirmed=X Filename=krisp.exe Description=Added by the SDBOT-RQ WORM! Source=Paul Collins Startup list [Microsoft Domain Controller] Number=5296 Confirmed=X Filename=mstc.exe Description=Added by the NUGACHE.A WORM! Source=Paul Collins Startup list [Microsoft Driver] Number=5297 Confirmed=X Filename=faet.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Driver Control] Number=5298 Confirmed=X Filename=windrv.exe Description=Added by the SDBOT.FW WORM! Source=Paul Collins Startup list [Microsoft Driver Manager] Number=5299 Confirmed=X Filename=mswindrv.exe Description=Added by the FORBOT-EZ WORM! Source=Paul Collins Startup list [Microsoft driver update] Number=5300 Confirmed=X Filename=Mshome.exe Description=Added by the SDBOT.BL WORM! Source=Paul Collins Startup list [Microsoft Drivers] Number=5301 Confirmed=X Filename=WSconf.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft ErgoPack] Number=5302 Confirmed=X Filename=wserb32.exe Description=Added by the RBOT-RI WORM! Source=Paul Collins Startup list [Microsoft EV32 Service] Number=5303 Confirmed=X Filename=MSev32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Event Engine] Number=5304 Confirmed=X Filename=EvtEngn.exe Description=Added by the RBOT-XV WORM! Source=Paul Collins Startup list [Microsoft Excel] Number=5305 Confirmed=X Filename=msexcel.exe Description=Added by the RBOT-TQ WORM! Source=Paul Collins Startup list [Microsoft Excell] Number=5306 Confirmed=X Filename=wuamngr32.exe Description=Added by the RBOT-QH WORM! Source=Paul Collins Startup list [Microsoft Executing] Number=5307 Confirmed=X Filename=microsoft.exe Description=Added by the AGOBOT.UV WORM! Source=Paul Collins Startup list [Microsoft Explorer] Number=5308 Confirmed=X Filename=svapache.exe Description=Added by the RBOT-VR WORM! Source=Paul Collins Startup list [Microsoft Explorer] Number=5309 Confirmed=X Filename=explorer.scr Description=Added by the RBOT-ADH WORM! Source=Paul Collins Startup list [Microsoft Explorer] Number=5310 Confirmed=X Filename=explorer.pif Description=Added by the SDBOT-ACX WORM! Source=Paul Collins Startup list [Microsoft explorer Update] Number=5311 Confirmed=X Filename=internal.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Explorer2] Number=5312 Confirmed=X Filename=system.exe Description=Added by the IRCBOT.BS TROJAN! Source=Paul Collins Startup list [Microsoft Explorer2] Number=5313 Confirmed=X Filename=nome.exe Description=Added by the RANDEX.AA WORM! Source=Paul Collins Startup list [Microsoft Explorer2] Number=5314 Confirmed=X Filename=bitchbot.exe Description=Added by the SDBOT.EV WORM! Source=Paul Collins Startup list [Microsoft EXPLOREXP Protocol] Number=5315 Confirmed=X Filename=explorexp.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Features] Number=5316 Confirmed=X Filename=ms32cfg.exe Description=Added by the RBOT.HO WORM! Source=Paul Collins Startup list [Microsoft Features] Number=5317 Confirmed=X Filename=msie.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft File Demand Manager] Number=5318 Confirmed=X Filename=wmgrdf.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Find Fast] Number=5319 Confirmed=X Filename=Findfast.exe Description=Complete utter waste of space! Part of MS Office - searches disk drives for Office file types and creates an index to make opening them easier Source=Paul Collins Startup list [Microsoft Firewall] Number=5320 Confirmed=X Filename=firewallsp2.exe Description=Added by the RBOT-MC WORM! Source=Paul Collins Startup list [MICROSOFT FIREWALL CLIENT] Number=5321 Confirmed=Y Filename=ISATRAY.EXE Description=MS Internet Security and Acceleration Server - see here Source=Paul Collins Startup list [Microsoft FixUp] Number=5322 Confirmed=X Filename=pevblbvr.exe Description=Added by the RBOT.DWK WORM! Source=Paul Collins Startup list [Microsoft FixUp] Number=5323 Confirmed=X Filename=wnpzjpuw.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Games] Number=5324 Confirmed=X Filename=gamemanager.exe Description=Added by the SPYBOT.AHQ WORM! Source=Paul Collins Startup list [Microsoft Generic Update Manager] Number=5325 Confirmed=X Filename=wupdate.exe Description=Added by the RBOT-AWC TROJAN! Source=Paul Collins Startup list [Microsoft Genetic Procress] Number=5326 Confirmed=X Filename=svchost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Gina V Encryption] Number=5327 Confirmed=X Filename=MSGINAV.EXE Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Greetings Reminders] Number=5328 Confirmed=N Filename=MHPRMIND.EXE Description=Microsoft Home Publishing greetings reminder Source=Paul Collins Startup list [Microsoft Greetings Workshop Reminder] Number=5329 Confirmed=N Filename=Gwremind.exe Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [Microsoft Greetings Reminder] Number=5330 Confirmed=N Filename=MHPRMINF.EXE Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [Microsoft Help] Number=5331 Confirmed=X Filename=svh0st.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Help Support] Number=5332 Confirmed=X Filename=mshelp32.exe Description=Addded by the KELVIR-BF WORM! Source=Paul Collins Startup list [Microsoft Help SVC] Number=5333 Confirmed=X Filename=msnmngr.exe Description=Added by the SDBOT-PQ WORM! Source=Paul Collins Startup list [Microsoft Help System] Number=5334 Confirmed=X Filename=mshelp32.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Microsoft Host Protocol] Number=5335 Confirmed=X Filename=svhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Hosting Service] Number=5336 Confirmed=X Filename=WINHOSTING.EXE Description=Added by the RBOT.AEV WORM! Source=Paul Collins Startup list [Microsoft Hosts Service] Number=5337 Confirmed=X Filename=Isass.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [microsoft hotmail monitor] Number=5338 Confirmed=U Filename=mshotmon.exe Description=Added by the MYTOB-FL WORM! Source=Paul Collins Startup list [Microsoft Hyptertext Helper] Number=5339 Confirmed=X Filename=mshtha.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft IDCN] Number=5340 Confirmed=X Filename=mshe1p.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Microsoft IE] Number=5341 Confirmed=X Filename=Iexplore.exe Description=Added by the FORBOT-AG WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft IE Execute shell] Number=5342 Confirmed=X Filename=IEExec.exe Description=Added by the ALADINZ.N TROJAN! Source=Paul Collins Startup list [MicroSoft IE Sasser] Number=5343 Confirmed=X Filename=ISASS.EXE Description=Added by the SDBOT.MX WORM! Source=Paul Collins Startup list [Microsoft IIS] Number=5344 Confirmed=X Filename=syshost.exe Description=Added by the FRANCETTE WORM! Source=Paul Collins Startup list [Microsoft IIS] Number=5345 Confirmed=X Filename=[filename] Description=Added by the FRANCETTE-S WORM! Source=Paul Collins Startup list [Microsoft Inc.] Number=5346 Confirmed=X Filename=iexplorer.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Microsoft Incroporate] Number=5347 Confirmed=X Filename=mfs.exe Description=Added by the RBOT-ANF WORM! Source=Paul Collins Startup list [Microsoft Inet Xp..] Number=5348 Confirmed=X Filename=teekids.exe Description=Added by the BLASTER.C WORM! Source=Paul Collins Startup list [Microsoft Installshield] Number=5349 Confirmed=X Filename=nundll32.exe Description=Added by the AGOBOT-AHZ WORM! Source=Paul Collins Startup list [Microsoft Instant Messenger] Number=5350 Confirmed=X Filename=msngmsngr32.exe Description=Added by the SPYBOTER.GEN TROJAN! Source=Paul Collins Startup list [Microsoft Int Service] Number=5351 Confirmed=X Filename=MsIntSrv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Intellitype Pro] Number=5352 Confirmed=U Filename=speedkey.exe Description=Additional keyboard shortcuts on MS programmable keyboard Source=Paul Collins Startup list [Microsoft Internal AntiVirus Systems] Number=5353 Confirmed=X Filename=dIlhost.exe Description=Added by the RBOT-AEV WORM! Source=Paul Collins Startup list [Microsoft Internet] Number=5354 Confirmed=X Filename=expl0rer.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Internet] Number=5355 Confirmed=X Filename=windows32.exe Description=Added by the SDBOT-F WORM! Source=Paul Collins Startup list [Microsoft Internet] Number=5356 Confirmed=X Filename=wincfg16.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Internet Acceleration Utility] Number=5357 Confirmed=X Filename=iau.exe Description=EasySearch adware Source=Paul Collins Startup list [Microsoft Internet Acceleration Utility] Number=5358 Confirmed=X Filename=[path to file] Description=Added by the AGENT-CX TROJAN! Source=Paul Collins Startup list [Microsoft Internet Acceleration Utility] Number=5359 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Microsoft Internet Exp] Number=5360 Confirmed=X Filename=iiexplorer.exe Description=Added by the RBOT-KX WORM! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5361 Confirmed=X Filename=iexplore.exe Description=Added by the POEBOT-J WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5362 Confirmed=X Filename=iexplorer.exe Description=Added by the SDBOT-XN WORM! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5363 Confirmed=X Filename=crsys32.exe Description=Added by the RBOT.UZ WORM! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5364 Confirmed=X Filename=movies.exe Description=Added by the BANCOS-DZ TROJAN! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5365 Confirmed=X Filename=svzhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5366 Confirmed=X Filename=mccagent.exe Description=Added by the DLOADER-UD TROJAN! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5367 Confirmed=X Filename=sysini.exe Description=Added by the DELF-LN TROJAN! Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5368 Confirmed=X Filename=svchost.exe Description=Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder Source=Paul Collins Startup list [Microsoft Internet Explorer] Number=5369 Confirmed=X Filename=lEXPLORE.EXE Description=Added by the RBOT-AMM WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [Microsoft Internet Firewall Manager] Number=5370 Confirmed=X Filename=GMT16.exe Description=Added by the RANDEX.AT WORM! Source=Paul Collins Startup list [Microsoft Internet Services] Number=5371 Confirmed=X Filename=Smss32.exe Description=Added by the RBOT.MS WORM! Source=Paul Collins Startup list [Microsoft Intrenet Explorer] Number=5372 Confirmed=X Filename=goaw.pif Description=Added by the RBOT-API WORM! Source=Paul Collins Startup list [Microsoft Intrenet Explorer] Number=5373 Confirmed=X Filename=Soundsyst.exe Description=Added by the RBOT-AQU WORM! Source=Paul Collins Startup list [Microsoft Intrenet Explorer] Number=5374 Confirmed=X Filename=cnsg.pif Description=Added by the RBOT-ARO WORM! Source=Paul Collins Startup list [Microsoft Intrenet Explorer] Number=5375 Confirmed=X Filename=wcumrg.exe Description=Added by the SDBOT-AFD WORM! Source=Paul Collins Startup list [Microsoft IPC] Number=5376 Confirmed=X Filename=system.exe Description=Added by the NULLBOT TROJAN! Source=Paul Collins Startup list [Microsoft IPC] Number=5377 Confirmed=X Filename=svshost.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft IT Update] Number=5378 Confirmed=X Filename=win64.exe Description=Added by the RBOT.GA WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5379 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5380 Confirmed=X Filename=IEserv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5381 Confirmed=X Filename=msupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5382 Confirmed=X Filename=winn43.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5383 Confirmed=X Filename=svchsst.exe Description=Added by the RBOT-DH WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5384 Confirmed=X Filename=win43.exe Description=Added by the RBOT-SA WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5385 Confirmed=X Filename=windows.exe Description=Added by the RBOT-GL WORM! Source=Paul Collins Startup list [Microsoft IT Update] Number=5386 Confirmed=X Filename=winsyst32.exe Description=Added by the RBOT-FC WORM! Source=Paul Collins Startup list [Microsoft Java Virtual Machine] Number=5387 Confirmed=X Filename=winscr32.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Microsoft Java Virtual Machine] Number=5388 Confirmed=X Filename=MsConfiG.exe Description=Added by the FORBOT-DV WORM! Source=Paul Collins Startup list [Microsoft Java Virtual Machine] Number=5389 Confirmed=X Filename=msjvm.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Java Virtual Machine] Number=5390 Confirmed=X Filename=javavm.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Java Windows Update] Number=5391 Confirmed=X Filename=[filename] Description=Added by the RBOT-DZ WORM! Source=Paul Collins Startup list [Microsoft JavaVM] Number=5392 Confirmed=X Filename=msjarun.exe Description=Added by the RBOT-JW WORM! Source=Paul Collins Startup list [Microsoft Kernel] Number=5393 Confirmed=X Filename=Windows_kernel32.exe Description=Added by the NETSKY.AE WORM! Source=Paul Collins Startup list [Microsoft LAN32 Protocol] Number=5394 Confirmed=X Filename=lanXp.exe Description=Added by the RBOT-SS WORM! Source=Paul Collins Startup list [Microsoft Lmhosting Service] Number=5395 Confirmed=X Filename=lmhosts.exe Description=Added by the RBOT-RC WORM! Source=Paul Collins Startup list [Microsoft Locals 332] Number=5396 Confirmed=X Filename=[random filename] Description=Added by the RBOT-KU WORM! Source=Paul Collins Startup list [Microsoft Login] Number=5397 Confirmed=X Filename=winlogin.exe Description=Added by the RBOT-AJP WORM! Source=Paul Collins Startup list [Microsoft LSA layer] Number=5398 Confirmed=X Filename=MSLSA32.exe Description=Added by the RBOT-AKZ WORM! Source=Paul Collins Startup list [Microsoft Lsass Center] Number=5399 Confirmed=X Filename=Isass.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Lsass Center] Number=5400 Confirmed=X Filename=telecomes.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft LSASS386 Protocol] Number=5401 Confirmed=X Filename=scvhost32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft LV] Number=5402 Confirmed=X Filename=[path to file] Description=Added by the BDL TROJAN! Source=Paul Collins Startup list [Microsoft Machine] Number=5403 Confirmed=X Filename=winjava.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Machine Script] Number=5404 Confirmed=X Filename=iexplorersis.exe Description=Added by the RBOT-CMH WORM! Source=Paul Collins Startup list [Microsoft Macro Protection SubSsy] Number=5405 Confirmed=X Filename=msacroprots386.exe Description=Added by the RBOT-KE WORM! Source=Paul Collins Startup list [Microsoft Macro Protection Subsystems] Number=5406 Confirmed=X Filename=msmacroprotxz.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Macro Protection Subsystems] Number=5407 Confirmed=X Filename=Msmacroprot32.exe Description=Added by the RBOT.KN WORM! Source=Paul Collins Startup list [Microsoft Management] Number=5408 Confirmed=X Filename=lmas.exe Description=Added by the FORBOT-CZ WORM! Source=Paul Collins Startup list [Microsoft Management Console] Number=5409 Confirmed=X Filename=lssas.exe Description=EasySearch adware Source=Paul Collins Startup list [Microsoft Management Console] Number=5410 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Microsoft Management Console] Number=5411 Confirmed=X Filename=lssas1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Microsoft Manager] Number=5412 Confirmed=X Filename=msmanager.exe Description=Added by the MYTOB.LF WORM! Source=Paul Collins Startup list [Microsoft Map PC] Number=5413 Confirmed=X Filename=mappc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Mapped PC] Number=5414 Confirmed=X Filename=mappedpc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft media] Number=5415 Confirmed=X Filename=winmplayers.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Media player 9] Number=5416 Confirmed=X Filename=msmedia32.exe Description=Added by the RBOT-ADO WORM! Source=Paul Collins Startup list [Microsoft media services] Number=5417 Confirmed=X Filename=Iassd.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft media services] Number=5418 Confirmed=X Filename=winmplayer.exe Description=Added by the RBOT.ZO WORM! Source=Paul Collins Startup list [Microsoft MediaScope] Number=5419 Confirmed=X Filename=winmes.exe Description=Added by the RBOT-XU WORM! Source=Paul Collins Startup list [Microsoft Message Machine] Number=5420 Confirmed=X Filename=msmesg32.exe Description=Added by the SPYBOT.BI WORM! Source=Paul Collins Startup list [Microsoft Messenger Management Controls] Number=5421 Confirmed=X Filename=msmgmctl.exe Description=Added by the RBOT-APA WORM! Source=Paul Collins Startup list [Microsoft Messenger Service] Number=5422 Confirmed=X Filename=msmsg32.exe Description=Added by the RBOT.BOK WORM! Source=Paul Collins Startup list [Microsoft Messenger XP] Number=5423 Confirmed=X Filename=MSMSN32.exe Description=Added by the RBOT-ZP WORM! Source=Paul Collins Startup list [Microsoft MicroP Protocol] Number=5424 Confirmed=X Filename=wdgmr32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Movie Maker] Number=5425 Confirmed=X Filename=Mmaker.exe Description=Added by the IRCBOT.C TROJAN! Note that this is not a valid Microsoft program Source=Paul Collins Startup list [Microsoft MSGPLUS32 Protocol] Number=5426 Confirmed=X Filename=msgplus32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft MSNGR32 Protocol] Number=5427 Confirmed=X Filename=msngr32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft msnseru] Number=5428 Confirmed=X Filename=msnseru.exe Description=Added by the RBOT-APB WORM! Source=Paul Collins Startup list [Microsoft MsnST] Number=5429 Confirmed=X Filename=msnst32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft MSUPDATE] Number=5430 Confirmed=X Filename=SpoolSvc.exe Description=Added by the SXTB-A TROJAN! Source=Paul Collins Startup list [Microsoft Neser Experience] Number=5431 Confirmed=X Filename=nese.exe Description=Added by the RBOT-YH WORM! Source=Paul Collins Startup list [Microsoft NetMeeting Associates, Inc.] Number=5432 Confirmed=X Filename=NetMeeting.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Microsoft Netview] Number=5433 Confirmed=X Filename=gesfm32.exe Description=Added by the RANDEX.C WORM! Source=Paul Collins Startup list [Microsoft Netview] Number=5434 Confirmed=X Filename=mssvc32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Netview Component v5.1] Number=5435 Confirmed=X Filename=msnv32.exe Description=Added by the RANDEX.F WORM! Source=Paul Collins Startup list [Microsoft Network] Number=5436 Confirmed=X Filename=msnet.exe Description=Added by the MOCKBOT.A WORM! Source=Paul Collins Startup list [Microsoft Network] Number=5437 Confirmed=X Filename=Networksystem.exe Description=Added by the SDBOT-AAI WORM! Source=Paul Collins Startup list [Microsoft Network Daemon for Win32] Number=5438 Confirmed=X Filename=Netd32.exe Description=Added by the SDBOT.R TROJAN! Source=Paul Collins Startup list [Microsoft Network Host] Number=5439 Confirmed=X Filename=svc0host.exe Description=Added by the SDBOT-AEN WORM! Source=Paul Collins Startup list [Microsoft Network Services Controller] Number=5440 Confirmed=X Filename=mmsvc32.exe Description=Added by the NANPY-A WORM! Source=Paul Collins Startup list [Microsoft Networking Agent For SP2] Number=5441 Confirmed=X Filename=msnac32.exe Description=Added by the SPYBOT.PEN WORM! Source=Paul Collins Startup list [Microsoft Nod32 Service] Number=5442 Confirmed=X Filename=nood32.exe Description=Added by the RBOT.EJP WORM! Source=Paul Collins Startup list [Microsoft NotePad] Number=5443 Confirmed=X Filename=notepad.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft NT Drivers] Number=5444 Confirmed=X Filename=ntdrv.exe Description=Added by the SDBOT.AJN TROJAN! Source=Paul Collins Startup list [Microsoft NT Update] Number=5445 Confirmed=X Filename=winexec32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Nvidia Video] Number=5446 Confirmed=X Filename=nvidia.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5447 Confirmed=N Filename=Osa.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Microsoft Office] Number=5448 Confirmed=N Filename=Msoffice.exe Description=Alternative shortcuts to the Start -> Programs way of running applications installed as part of MS Office. Some people prefer it but a better way is to create Desktop Shortcuts if you want access these programs quickly Source=Paul Collins Startup list [Microsoft Office] Number=5449 Confirmed=X Filename=MSMSGR.exe Description=Added by the GAOBOT.BB WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5450 Confirmed=N Filename=Osa9.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Microsoft Office] Number=5451 Confirmed=X Filename=lserv.exe Description=Added by the SDBOT.MH WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5452 Confirmed=X Filename=Microsoft Office.hta Description=HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Source=Paul Collins Startup list [Microsoft Office] Number=5453 Confirmed=X Filename=msoicons.exe Description=Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups! Source=Paul Collins Startup list [Microsoft Office] Number=5454 Confirmed=X Filename=Nxcao.exe Description=Added by the RBOT-ZE WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5455 Confirmed=X Filename=nxcxtpr.exe Description=Added by the RBOT-YG WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5456 Confirmed=X Filename=svxhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5457 Confirmed=X Filename=msoffice32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Office] Number=5458 Confirmed=X Filename=msoff.exe Description=Added by the RAKER-C TROJAN! Source=Paul Collins Startup list [Microsoft Office] Number=5459 Confirmed=X Filename=microsoft.exe Description=Added by the BANKER-VF TROJAN! Source=Paul Collins Startup list [Microsoft Office] Number=5460 Confirmed=X Filename=msvcp.exe Description=Added by the AGENT-XK TROJAN! Source=Paul Collins Startup list [Microsoft Office] Number=5461 Confirmed=X Filename=msmsgr.exe Description=Added by the GAOBOT.BB WORM! Source=Paul Collins Startup list [Microsoft Office Fast Cache] Number=5462 Confirmed=N Filename=Fastboot.exe Description=Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled Source=Paul Collins Startup list [Microsoft Office Monitor] Number=5463 Confirmed=X Filename=alg2k.exe Description=Added by the SDBOT-CZO WORM! Source=Paul Collins Startup list [Microsoft Office Monitor] Number=5464 Confirmed=X Filename=aql32.exe Description=Added by the RBOT-GCY TROJAN! Source=Paul Collins Startup list [Microsoft Office OneNote 2003 Quick Launch] Number=5465 Confirmed=U Filename=ONENOTEM.EXE Description=ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2003. It's required for the side note windows to work Source=Paul Collins Startup list [Microsoft Office Quick Launcher] Number=5466 Confirmed=X Filename=iau1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Microsoft Office Shortcut Bar] Number=5467 Confirmed=N Filename=Msoffice.exe Description=Alternative shortcuts to the Start -> Programs way of running applications installed as part of MS Office. Some people prefer it but a better way is to create Desktop Shortcuts if you want access these programs quickly Source=Paul Collins Startup list [Microsoft Office Start] Number=5468 Confirmed=X Filename=winupdates.exe Description=Added by the GAOBOT.BC WORM! Source=Paul Collins Startup list [Microsoft Office Startup] Number=5469 Confirmed=N Filename=Osa.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Microsoft Office Startup] Number=5470 Confirmed=N Filename=Osa9.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Microsoft Office Studio] Number=5471 Confirmed=X Filename=scvhvst.exe Description=Added by the RANDEX.CST WORM! Source=Paul Collins Startup list [Microsoft OfficeXP] Number=5472 Confirmed=X Filename=officeXP.exe Description=Added by the KILLAV.MA WORM! Source=Paul Collins Startup list [Microsoft Opeions] Number=5473 Confirmed=X Filename=IEXwe.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Outlook Express Protocol] Number=5474 Confirmed=X Filename=svchst.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Patch Update] Number=5475 Confirmed=X Filename=bootini.exe Description=Added by the RBOT-FMN WORM! Source=Paul Collins Startup list [Microsoft PC Health Remote Assistance File Open & Save controls] Number=5476 Confirmed=X Filename=sfrcdlg32.exe Description=Added by the RBOT-AVY WORM! Source=Paul Collins Startup list [Microsoft PCHealth32] Number=5477 Confirmed=X Filename=[path to file] Description=Added by the NICE-A TROJAN! Source=Paul Collins Startup list [Microsoft PCHealth32] Number=5478 Confirmed=X Filename=NDDENB.exe Description=Added by the PWSYAHOO-A TROJAN! Source=Paul Collins Startup list [Microsoft PCI Manager] Number=5479 Confirmed=X Filename=mspci.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Personal Firewalls] Number=5480 Confirmed=X Filename=bakw.exe Description=Added by the RBOT-KS WORM! Source=Paul Collins Startup list [Microsoft Proc Driver32] Number=5481 Confirmed=X Filename=msprc.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Microsoft Procedure Call] Number=5482 Confirmed=X Filename=MSPCALL.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft PSTCP32 Data] Number=5483 Confirmed=X Filename=pstcp32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft QMGR] Number=5484 Confirmed=X Filename=msnqmgr.exe Description=Added by the IRCBOT-S TROJAN! Source=Paul Collins Startup list [Microsoft RDLL] Number=5485 Confirmed=X Filename=sysconf32.exe Description=Added by a variant of the SDBOT TROJAN! Source=Paul Collins Startup list [Microsoft Redirect] Number=5486 Confirmed=X Filename=[path to file] Description=Added by the BANKER-FW TROJAN! Source=Paul Collins Startup list [Microsoft Redirect] Number=5487 Confirmed=X Filename=systen.exe Description=Added by the BANCOS-FO TROJAN! Source=Paul Collins Startup list [Microsoft Registro] Number=5488 Confirmed=X Filename=svchostt.exe Description=Added by the BANCOS-DH TROJAN! Source=Paul Collins Startup list [Microsoft Registry] Number=5489 Confirmed=X Filename=csrse.exe Description=Added by the RBOT-PC WORM! Source=Paul Collins Startup list [MicroSoft Remote Secure Service] Number=5490 Confirmed=X Filename=MSRSS.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Restore] Number=5491 Confirmed=X Filename=scrgrd.exe Description=Added by the SPYBOT.BR WORM! Source=Paul Collins Startup list [Microsoft Rundll] Number=5492 Confirmed=X Filename=windos.exe Description=Added by the SDBOT-WF WORM! Source=Paul Collins Startup list [Microsoft Runtime] Number=5493 Confirmed=X Filename=CfgDll32.exe Description=Added by the RANDEX.BD WORM! Source=Paul Collins Startup list [Microsoft Scanreg] Number=5494 Confirmed=X Filename=microsoftscanreg.exe Description=Added by the FRANRIV.A WORM! Source=Paul Collins Startup list [Microsoft SCVHOST32 Protocol] Number=5495 Confirmed=X Filename=scvhost32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft sddcE Contol] Number=5496 Confirmed=X Filename=taskmnegr.exe Description=Added by the RBOT-AUM WORM! Source=Paul Collins Startup list [Microsoft sdk temp] Number=5497 Confirmed=X Filename=sdktemp.exe Description=Added by the RBOT-ANP WORM! Source=Paul Collins Startup list [Microsoft SDKP3] Number=5498 Confirmed=X Filename=mswinsdq.exe Description=Added by the RBOT-ARY WORM! Source=Paul Collins Startup list [Microsoft Secure Messenger.NET Service] Number=5499 Confirmed=X Filename=securitychk.exe Description=Added by the SDBOT.VT WORM! Source=Paul Collins Startup list [Microsoft Security] Number=5500 Confirmed=X Filename=winService.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Security Center] Number=5501 Confirmed=X Filename=savservices.exe Description=Added by the RBOT-ANU WORM! Source=Paul Collins Startup list [Microsoft Security Center] Number=5502 Confirmed=X Filename=wcsntfy.exe Description=Added by the SDBOT.BYD WORM! Source=Paul Collins Startup list [Microsoft Security Controlers] Number=5503 Confirmed=X Filename=fxsecues.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Security GManagers] Number=5504 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Security Hot Fix Update] Number=5505 Confirmed=X Filename=mshotfix.exe Description=Affilred adware Source=Paul Collins Startup list [Microsoft Security Management] Number=5506 Confirmed=X Filename=winnt.exe Description=Added by the RBOT-MQ WORM! Source=Paul Collins Startup list [Microsoft Security Management] Number=5507 Confirmed=X Filename=winserv.exe Description=Added by the RBOT-MJ WORM! Source=Paul Collins Startup list [Microsoft Security Management] Number=5508 Confirmed=X Filename=winamp.exe Description=Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a "Winamp" subdirectory of the Program Files directory Source=Paul Collins Startup list [Microsoft Security Management] Number=5509 Confirmed=X Filename=wuauct1.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Security Management] Number=5510 Confirmed=X Filename=bling.exe Description=Added by the RBOT.XL WORM! Source=Paul Collins Startup list [Microsoft Security Management] Number=5511 Confirmed=X Filename=sp2fix.exe Description=Added by the RBOT.UB WORM! Source=Paul Collins Startup list [Microsoft Security Manager] Number=5512 Confirmed=X Filename=winamp.exe Description=Added by the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a "Winamp" subdirectory of the Program Files directory. This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft Security Monitor Process] Number=5513 Confirmed=X Filename=mssmp.exe Description=Added by the RBOT-FUB WORM! Source=Paul Collins Startup list [Microsoft Security Monitor Process] Number=5514 Confirmed=X Filename=mnsmp.exe Description=Added by the RBOT-FUB WORM! Source=Paul Collins Startup list [Microsoft Security Monitor Process] Number=5515 Confirmed=X Filename=msmp.exe Description=Added by a variant of the RBOT-FUB WORM! Source=Paul Collins Startup list [Microsoft Security Panager] Number=5516 Confirmed=X Filename=[filename] Description=Added by the RBOT-ANL WORM! Source=Paul Collins Startup list [Microsoft Security Panagers] Number=5517 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AIG WORM! Source=Paul Collins Startup list [Microsoft Security Panagers] Number=5518 Confirmed=X Filename=zzoboony.exe Description=Added by the RBOT-AOI WORM! Source=Paul Collins Startup list [Microsoft Security Process] Number=5519 Confirmed=X Filename=wininit.exe Description=Added by the RBOT-FKM WORM! Source=Paul Collins Startup list [Microsoft Server] Number=5520 Confirmed=X Filename=rserv.exe Description=Added by the AGOBOT.AVS WORM! Source=Paul Collins Startup list [Microsoft Server Applacations] Number=5521 Confirmed=X Filename=msnmsg.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Server Applacations] Number=5522 Confirmed=X Filename=wuauct1.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Server Applacations] Number=5523 Confirmed=X Filename=lsasss.exe Description=Added by the RBOT-AQQ WORM! Source=Paul Collins Startup list [Microsoft Server Applacations] Number=5524 Confirmed=X Filename=Q8See.exe Description=Added by the SPYBOT.GEN3 TROJAN! Source=Paul Collins Startup list [Microsoft Server Applacations] Number=5525 Confirmed=X Filename=cli.exe Description=Added by the RBOT-GAQ WORM! Source=Paul Collins Startup list [Microsoft Server Application] Number=5526 Confirmed=X Filename=Sound.exe Description=Added by the RBOT-NE WORM! Source=Paul Collins Startup list [microsoft server base] Number=5527 Confirmed=X Filename=lass.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Service] Number=5528 Confirmed=X Filename=microhost.exe Description=Added by the RBOT-LC WORM! Source=Paul Collins Startup list [Microsoft Service] Number=5529 Confirmed=X Filename=winsvc.exe Description=Added by the SPYBOT-DB WORM! Source=Paul Collins Startup list [Microsoft Service] Number=5530 Confirmed=X Filename=rundll.exe Description=Added by the POPO-A WORM! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [Microsoft Service Controller] Number=5531 Confirmed=X Filename=services.exe Description=Added by the KALEL-D WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Service Drivers] Number=5532 Confirmed=X Filename=System.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Service Drivers] Number=5533 Confirmed=X Filename=VSADNIM.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Service Host Process] Number=5534 Confirmed=X Filename=svchost.exe Description=Added by the KRYNOS.B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Help" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft Service Pack] Number=5535 Confirmed=X Filename=WindowsSP.exe Description=Added by the RBOT-RF WORM! Source=Paul Collins Startup list [Microsoft Service Pack2.1] Number=5536 Confirmed=X Filename=svchost2.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Services] Number=5537 Confirmed=X Filename=lsserv.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Services] Number=5538 Confirmed=X Filename=lssrv.exe Description=Added by the RBOT.CW WORM! Source=Paul Collins Startup list [Microsoft Services] Number=5539 Confirmed=X Filename=services.exe Description=Added by the ALETS TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Microsoft Services] Number=5540 Confirmed=X Filename=lsrv.exe Description=Added by the RBOT-BK WORM! Source=Paul Collins Startup list [Microsoft Services] Number=5541 Confirmed=X Filename=svshost.exe Description=Added by the ALETS.B TROJAN! Source=Paul Collins Startup list [Microsoft Services] Number=5542 Confirmed=X Filename=bsc32.exe Description=Added by the BDOOR-AW TROJAN! Source=Paul Collins Startup list [Microsoft Services] Number=5543 Confirmed=X Filename=Smss32.exe Description=Added by the RBOT-AD WORM! Source=Paul Collins Startup list [Microsoft Services] Number=5544 Confirmed=X Filename=svssshost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Services] Number=5545 Confirmed=X Filename=module.exe Description=Added by the LAVITS WORM! Source=Paul Collins Startup list [Microsoft Services Unitd] Number=5546 Confirmed=X Filename=MSU32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Servicez Manager] Number=5547 Confirmed=X Filename=servicemgrz.exe Description=Added by the RBOT-ASN WORM! Source=Paul Collins Startup list [Microsoft Session Manager Subsystem] Number=5548 Confirmed=X Filename=smss.exe Description=Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Sidewinder Game Controller Software] Number=5549 Confirmed=N Filename=SWTRAY.EXE Description=MS SideWinder game controller system tray icon. Available via Start -> Programs Source=Paul Collins Startup list [Microsoft Sinsup] Number=5550 Confirmed=X Filename=odjiwjf.exe Description=Added by the RBOT-DN WORM! Source=Paul Collins Startup list [Microsoft Software] Number=5551 Confirmed=X Filename=sysinfo33.exe Description=Added by the RBOT.LS WORM! Source=Paul Collins Startup list [microsoft software] Number=5552 Confirmed=X Filename=****.exe E255 [* = random char] Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsoft software] Number=5553 Confirmed=X Filename=cdaccess.exe Description=Added by the RBOT.ABK WORM! Source=Paul Collins Startup list [Microsoft Software Update] Number=5554 Confirmed=X Filename=nmon.exe Description=Added by the RBOT.HZ WORM! Source=Paul Collins Startup list [Microsoft Sound Driver] Number=5555 Confirmed=X Filename=sound32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Sound Technology] Number=5556 Confirmed=X Filename=winsound.exe Description=Added by the RBOT-AGG WORM! Source=Paul Collins Startup list [Microsoft Sound Volume Tool] Number=5557 Confirmed=N Filename=mssvol.exe Description=This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Microsoft Sounds] Number=5558 Confirmed=X Filename=soundman.exe Description=Added by the RBOT-GCI WORM! Source=Paul Collins Startup list [Microsoft SourceSafe] Number=5559 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft SpA Service] Number=5560 Confirmed=X Filename=msapps.exe Description=Added by the RBOT-VI WORM! Source=Paul Collins Startup list [Microsoft SpA Service] Number=5561 Confirmed=X Filename=win32.exe Description=Added by the RBOT.ATS WORM! Source=Paul Collins Startup list [Microsoft SpA Service] Number=5562 Confirmed=X Filename=Winupd32.exe Description=Added by the RBOT.LT WORM! Source=Paul Collins Startup list [Microsoft Special offer] Number=5563 Confirmed=X Filename=infoebay.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Spool Server for Win32] Number=5564 Confirmed=X Filename=spoolsrv.exe Description=Added by the RANDEX.H WORM! Source=Paul Collins Startup list [Microsoft SSISVRI32 Protocol] Number=5565 Confirmed=X Filename=ssisvri.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Standard Executions Library] Number=5566 Confirmed=X Filename=win32lib.exe Description=Added by the RBOT-AUK WORM! Source=Paul Collins Startup list [Microsoft standard protector] Number=5567 Confirmed=X Filename=winsocks5.exe Description=Added by the SMALL.CF TROJAN! Source=Paul Collins Startup list [Microsoft standard protector] Number=5568 Confirmed=X Filename=[path to trojan] Description=Added by the STOX-C TROJAN! Source=Paul Collins Startup list [Microsoft Sum32] Number=5569 Confirmed=X Filename=sum32.exe Description=Added by the RBOT-YW WORM! Source=Paul Collins Startup list [Microsoft Support] Number=5570 Confirmed=X Filename=sys32ms.exe Description=Added by the RBOT-AHI WORM! Source=Paul Collins Startup list [microsoft support] Number=5571 Confirmed=X Filename=svchostt.exe Description=Added by the AGOBOT.AWN WORM! Source=Paul Collins Startup list [Microsoft Svchost local services] Number=5572 Confirmed=X Filename=winoem.exe Description=Added by the RBOT-FPE Source=Paul Collins Startup list [Microsoft Svchost local services] Number=5573 Confirmed=X Filename=winoem.exe Description=Added by the RBOT-FPE WORM! Source=Paul Collins Startup list [Microsoft Svchost local services] Number=5574 Confirmed=X Filename=nzm23.exe Description=Added by the RBOT-GMC WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5575 Confirmed=X Filename=asgard.exe Description=Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5576 Confirmed=X Filename=bot.exe Description=Added by the SDBOT.IH WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5577 Confirmed=X Filename=netscape.exe Description=Added by the RANDEX.AE WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5578 Confirmed=X Filename=slhost.exe Description=Added by the SDBOT.YH WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5579 Confirmed=X Filename=svhost.exe Description=Added by the SDBOT-PY WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5580 Confirmed=X Filename=WinLoginnn.exe Description=Added by the SPYBOT.FO WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5581 Confirmed=X Filename=winupdate.exe Description=Added by the SDBOT.ER WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5582 Confirmed=X Filename=xXx.exe Description=Added by the SDBOT-KZ WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5583 Confirmed=X Filename=___synmgr.exe Description=Added by the MASLAN.A or MASLAN.C WORMS! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5584 Confirmed=X Filename=al.exe Description=Added by the OPTXPRO.132 TROJAN! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5585 Confirmed=X Filename=win.exe Description=Added by the SDBOT.AK WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5586 Confirmed=X Filename=java.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5587 Confirmed=X Filename=svchosts.exe Description=Added by the SDBOT-LM WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5588 Confirmed=X Filename=winlogon32.exe Description=Added by the SDBOT.AEU WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5589 Confirmed=X Filename=svxhost.exe Description=Added by the SDBOT-ZU WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5590 Confirmed=X Filename=wincfg32.exe Description=Added by the SDBOT.DO WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5591 Confirmed=X Filename=screen.exe Description=Added by the SDBOT-ACO WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5592 Confirmed=X Filename=devldr32.exe Description=Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5593 Confirmed=X Filename=explorer.exe Description=Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would only be in startups if you added it manually. This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5594 Confirmed=X Filename=firewire.exe Description=Added by the SDBOT-AFC WORM! Source=Paul Collins Startup list [Microsoft Synchronization Manager] Number=5595 Confirmed=X Filename=wmedia.exe Description=Added by the SDBOT.BFC WORM! Source=Paul Collins Startup list [Microsoft System] Number=5596 Confirmed=X Filename=msupdtm.exe Description=Added by the SPYBOT.PKC WORM! Source=Paul Collins Startup list [Microsoft System] Number=5597 Confirmed=X Filename=mssys32.exe Description=Added by the PETTICK.A WORM! Source=Paul Collins Startup list [Microsoft System] Number=5598 Confirmed=X Filename=sys.exe Description=Added by the RBOT.AKI WORM! Source=Paul Collins Startup list [Microsoft System Backup] Number=5599 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AGM WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5600 Confirmed=X Filename=Cool.exe Description=Added by the DONK.B WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5601 Confirmed=X Filename=Wnetlib.exe Description=Added by the DONK.C WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5602 Confirmed=X Filename=dbnetlib.exe Description=Added by the DONK.L WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5603 Confirmed=X Filename=Keymgr.exe Description=Added by the DONK.M WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5604 Confirmed=X Filename=inetman.exe Description=Added by the DONK.O WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5605 Confirmed=X Filename=ntsysmgr.exe Description=Added by the DONK.S WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5606 Confirmed=X Filename=ntsysman.exe Description=Added by the SDBOT-QW WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5607 Confirmed=X Filename=libsysmgr.exe Description=Added by the SDBOT-CAF WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5608 Confirmed=X Filename=sysmgr.exe Description=Added by the SDBOT-OO TROJAN! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5609 Confirmed=X Filename=netapi32.exe Description=Added by the DONK-E WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5610 Confirmed=X Filename=wnetmgr.exe Description=Added by the DONK.Q WORM! Source=Paul Collins Startup list [Microsoft System Checkup] Number=5611 Confirmed=X Filename=libsys32.exe Description=Added by the SDBOT-ACK WORM! Source=Paul Collins Startup list [Microsoft System Debug] Number=5612 Confirmed=X Filename=services32.exe Description=Added by the RBOT.AKH WORM! Source=Paul Collins Startup list [Microsoft System DLL Services Configuration] Number=5613 Confirmed=X Filename=windir32.exe Description=Added by the SDBOT-ACY TROJAN! Source=Paul Collins Startup list [Microsoft System File] Number=5614 Confirmed=X Filename=svchots.exe Description=Added by the RBOT.BYU WORM! Source=Paul Collins Startup list [Microsoft System Firewall 2006.2] Number=5615 Confirmed=X Filename=msmsgr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft System Firewall 2006.2] Number=5616 Confirmed=X Filename=msnmsgr.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility Source=Paul Collins Startup list [Microsoft System Firewall 2006.2] Number=5617 Confirmed=X Filename=reg32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft System Init] Number=5618 Confirmed=X Filename=mtmnr0.exe Description=Added by the SDBOT.BR TROJAN! Source=Paul Collins Startup list [Microsoft System NT] Number=5619 Confirmed=X Filename=svhost.exe Description=Added by the SDBOT.COU WORM! Source=Paul Collins Startup list [Microsoft System Restore Configuration] Number=5620 Confirmed=X Filename=CBRSS.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft System Saver] Number=5621 Confirmed=X Filename=[path to worm] Description=Added by the RBOT.BSK WORM! Source=Paul Collins Startup list [Microsoft System Security Agent] Number=5622 Confirmed=X Filename=MSTSA.EXE Description=Added by the RBOT.CCM WORM! Source=Paul Collins Startup list [Microsoft System Services] Number=5623 Confirmed=X Filename=msnmgsr.exe Description=Added by the KELVIR.K WORM! Source=Paul Collins Startup list [Microsoft System Services] Number=5624 Confirmed=X Filename=msmsgr.exe Description=Added by the RBOT-ZH WORM! Source=Paul Collins Startup list [Microsoft System Update] Number=5625 Confirmed=X Filename=sysupdate.exe Description=Added by the SDBOT.DG WORM! Source=Paul Collins Startup list [Microsoft System32 Update] Number=5626 Confirmed=X Filename=cmsrg.exe Description=Added by the RBOT-GN WORM! Source=Paul Collins Startup list [Microsoft Task32 Protocol] Number=5627 Confirmed=X Filename=taskmgr32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Taskmanager Updater] Number=5628 Confirmed=X Filename=keyboard.exe Description=Added by the RBOT-ALU WORM! Source=Paul Collins Startup list [Microsoft TCP/IP Connection Monitor] Number=5629 Confirmed=X Filename=svchost32.exe Description=Added by the RBOT.KS WORM! Source=Paul Collins Startup list [Microsoft Telecom Center] Number=5630 Confirmed=X Filename=tellecom.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Telecoma Center] Number=5631 Confirmed=X Filename=tellcoma.exe Description=Added by the RBOT-AWX WORM! Source=Paul Collins Startup list [Microsoft Telecoms Center] Number=5632 Confirmed=X Filename=telcoms.exe Description=Added by the IRCBOT.GEN WORM! Source=Paul Collins Startup list [Microsoft Telecoms Center] Number=5633 Confirmed=X Filename=xpfilesys.exe Description=Added by the RBOT.BCJ TROJAN! Source=Paul Collins Startup list [Microsoft Telecoms Center] Number=5634 Confirmed=X Filename=winupn.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Telecoms Center] Number=5635 Confirmed=X Filename=svcchost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Time Manager] Number=5636 Confirmed=X Filename=dveldr.exe Description=Added by the RBOT-HQ WORM! Source=Paul Collins Startup list [MicroSoft Toolbar] Number=5637 Confirmed=X Filename=key.exe Description=Added by the RBOT-AEW WORM! Source=Paul Collins Startup list [Microsoft Transfer File Server] Number=5638 Confirmed=X Filename=mtfs.exe Description=Added by the RBOT.AFE WORM! Source=Paul Collins Startup list [Microsoft Tray] Number=5639 Confirmed=X Filename=[random filename] Description=Added by the DELF.BZ TROJAN! Source=Paul Collins Startup list [Microsoft TTL Verifier] Number=5640 Confirmed=X Filename=msttl.exe Description=Added by the RBOT-GAP WORM! Source=Paul Collins Startup list [Microsoft U] Number=5641 Confirmed=X Filename=wuamkopxp.exe Description=Added by the RBOT-AHC WORM! Source=Paul Collins Startup list [Microsoft UMA Update] Number=5642 Confirmed=X Filename=MSuma32.exe Description=Added by the RBOT.FS WORM! Source=Paul Collins Startup list [MICROSOFT UNPACCKER SYSTEM] Number=5643 Confirmed=X Filename=unpak32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MICROSOFT UNPACK SYSTEM] Number=5644 Confirmed=X Filename=winrarx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updat3] Number=5645 Confirmed=X Filename=mswkst32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5646 Confirmed=X Filename=Microsoft.exe Description=Added by the GAOBOT.AFJ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5647 Confirmed=X Filename=mssmgrd.exe Description=Added by the SDBOT.JT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5648 Confirmed=X Filename=mvsc.exe Description=Added by the SPYBOT.DAZ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5649 Confirmed=X Filename=ascdl.exe Description=Added by the GAOBOT.SY WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5650 Confirmed=X Filename=Isac.exe Description=Added by the RBOT-AU WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5651 Confirmed=X Filename=automgr32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5652 Confirmed=X Filename=mediap.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5653 Confirmed=X Filename=Microsoftx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5654 Confirmed=X Filename=msconfg.exe Description=Added by the RBOT.H WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5655 Confirmed=X Filename=Mslti32.exe Description=Added by the RBOT-LX WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5656 Confirmed=X Filename=muamgrd.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5657 Confirmed=X Filename=navmgrd.exe Description=Added by the SDBOT.DP TROJAN! Source=Paul Collins Startup list [Microsoft Update] Number=5658 Confirmed=X Filename=Smss32.exe Description=Added by the RBOT.CB WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5659 Confirmed=X Filename=sys32cfg.exe Description=Added by the RBOT.DR WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5660 Confirmed=X Filename=VPC32.EXE Description=Added by the AGOBOT.XM WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5661 Confirmed=X Filename=winsys32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5662 Confirmed=X Filename=wuamgrd.exe Description=Added by the RBOT-LK WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5663 Confirmed=X Filename=wuammgr32.exe Description=Added by the RBOT-AW WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5664 Confirmed=X Filename=wudmate.exe Description=Added by the RBOT.AP WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5665 Confirmed=X Filename=msawindows.exe Description=Added by the GAOBOT.AFJ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5666 Confirmed=X Filename=msiwin84.exe Description=Added by the GAOBOT.AFJ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5667 Confirmed=X Filename=wuamgrd32.exe Description=Added by the RBOT.ZB WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5668 Confirmed=X Filename=NAV.exe Description=Added by the RBOT-IV WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5669 Confirmed=X Filename=systemi32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5670 Confirmed=X Filename=xpupdate.exe Description=Added by the RBOT-QE WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5671 Confirmed=X Filename=webm.exe Description=Added by the SDBOT.WK WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5672 Confirmed=X Filename=wuagrd.exe Description=Added by the RBOT-FK WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5673 Confirmed=X Filename=aaupdt.exe Description=Added by the RBOT-RQ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5674 Confirmed=X Filename=lsac.exe Description=Added by the GAOBOT.XW WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5675 Confirmed=X Filename=Mupdate.exe Description=Added by the RBOT-AG WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5676 Confirmed=X Filename=prowind32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5677 Confirmed=X Filename=snlogsvc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5678 Confirmed=X Filename=svhost.exe Description=Added by the RBOT-PI WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5679 Confirmed=X Filename=wauguard.exe Description=Added by the RBOT.AEE WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5680 Confirmed=X Filename=winscv.exe Description=Added by the RBOT-BH WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5681 Confirmed=X Filename=winsys.exe Description=Added by the RBOT-GV WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5682 Confirmed=X Filename=wserv32.exe Description=Added by the RBOT.AF WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5683 Confirmed=X Filename=wtm32.exe Description=Added by the RBOT-AQ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5684 Confirmed=X Filename=wumgrd.exe Description=Added by the SDBOT-KY WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5685 Confirmed=X Filename=wuampd.exe Description=Added by the RBOT-UT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5686 Confirmed=X Filename=msupdate32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5687 Confirmed=X Filename=Botnet.exe Description=Added by the RBOT.AFL WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5688 Confirmed=X Filename=sghost.exe Description=Added by the SDBOT.AKV WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5689 Confirmed=X Filename=update_w.exe Description=Added by the RBOT-EW WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5690 Confirmed=X Filename=windows24.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5691 Confirmed=X Filename=wingrd32.exe Description=Added by the RBOT-DW WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5692 Confirmed=X Filename=wssvr.exe Description=Added by the RBOT-OD WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5693 Confirmed=X Filename=wuamagr32.exe Description=Added by the SPYBOT.CG WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5694 Confirmed=X Filename=WinUpdate32.exe Description=Added by the RBOT-TI WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5695 Confirmed=X Filename=wkfix.exe Description=Added by the RBOT-ABZ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5696 Confirmed=X Filename=Kkk.exe Description=Added by the RBOT-AHL WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5697 Confirmed=X Filename=mcupdate.exe Description=Added by the RBOT.XT WORM! Note - this file is located in the Windows\System32 or Winnt\System32 folder, and should not be confused with the McAfee antivirus executable as described here Source=Paul Collins Startup list [Microsoft Update] Number=5698 Confirmed=X Filename=Micr0s0ft.exe Description=Added by the AGOBOT.AAR WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5699 Confirmed=X Filename=Msnmsngr.exe Description=Added by the RBOT.BQS WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5700 Confirmed=X Filename=msupdate32.exe Description=Added by the SPYBOT.LZ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5701 Confirmed=X Filename=scvhost.exe Description=Added by the RBOT-AEM WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5702 Confirmed=X Filename=svghost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5703 Confirmed=X Filename=sys.exe Description=Added by the RBOT-AJ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5704 Confirmed=X Filename=up2dat5.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5705 Confirmed=X Filename=winamp.exe Description=Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player Source=Paul Collins Startup list [Microsoft Update] Number=5706 Confirmed=X Filename=win-mang.exe Description=Added by the RBOT-AFK WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5707 Confirmed=X Filename=winupdater.exe Description=Added by the RBOT.BIN WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5708 Confirmed=X Filename=wuamk0032.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5709 Confirmed=X Filename=wuamk032.exe Description=Added by the RBOT-AHD WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5710 Confirmed=X Filename=wuamk0p32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5711 Confirmed=X Filename=wuamkop.exe Description=Added by the RBOT-AFI WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5712 Confirmed=X Filename=wuamkop32.exe Description=Added by the RBOT.BGU WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5713 Confirmed=X Filename=wuampkd.exe Description=Added by the SDBOT.BBX WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5714 Confirmed=X Filename=svzhost.exe Description=Added by the RBOT.OX WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5715 Confirmed=X Filename=win32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5716 Confirmed=X Filename=wininit.exe Description=Added by the RBOT-AKR WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5717 Confirmed=X Filename=wuamgrd3.exe Description=Added by the RBOT-AMC WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5718 Confirmed=X Filename=Wudates.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5719 Confirmed=X Filename=ms.exe Description=Added by the SDBOT.CC WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5720 Confirmed=X Filename=wuagmsd.exe Description=Added by the RBOT-AX WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5721 Confirmed=X Filename=cmss.exe Description=Added by the RBOT-ATQ WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5722 Confirmed=X Filename=wuamgrb.exe Description=Added by the RBOT-AZE WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5723 Confirmed=X Filename=WINDOC.EXE Description=Added by the SDBOT.PF WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5724 Confirmed=X Filename=phqghumea.exe Description=Added by the SDBOT.AFO WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5725 Confirmed=X Filename=system32.exe Description=Added by the RBOT.IS WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5726 Confirmed=X Filename=bling.exe Description=Added by the RBOT-AVK WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5727 Confirmed=X Filename=Sygate.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5728 Confirmed=X Filename=update.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5729 Confirmed=X Filename=WinDrv32.exe Description=Added by the RBOT.EGW WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5730 Confirmed=X Filename=devmks32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5731 Confirmed=X Filename=devmks32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft update] Number=5732 Confirmed=X Filename=winupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5733 Confirmed=X Filename=msupdate.exe Description=Added by the BOROBOT-I TROJAN! Source=Paul Collins Startup list [Microsoft Update] Number=5734 Confirmed=X Filename=mixer.exe Description=Added by the RBOT-AIR WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5735 Confirmed=X Filename=taskmgr32.exe Description=Added by the RBOT-CV WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5736 Confirmed=X Filename=drive.exe Description=Added by the BIFROSE-PN WORM! Source=Paul Collins Startup list [Microsoft Update] Number=5737 Confirmed=X Filename=wangard.exe Description=Added by the RBOT-LH WORM! Source=Paul Collins Startup list [Microsoft Update 23] Number=5738 Confirmed=X Filename=NtKernelSystem.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update 23] Number=5739 Confirmed=X Filename=spoolvs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5740 Confirmed=X Filename=explore32.exe Description=Added by the SPYBOT.CYM WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5741 Confirmed=X Filename=MSupdate32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5742 Confirmed=X Filename=wininit.exe Description=Added by the RBOT-ANY WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5743 Confirmed=X Filename=wininit32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5744 Confirmed=X Filename=[path to file] Description=Added by the RBOT-AJJ WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5745 Confirmed=X Filename=mscnfg.exe Description=Added by the RBOT-ALM WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5746 Confirmed=X Filename=servic.exe Description=Added by the RBOT-AXN WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5747 Confirmed=X Filename=winitXP32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5748 Confirmed=X Filename=mssetup32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5749 Confirmed=X Filename=wiit.exe Description=Added by the RBOT-AMS WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5750 Confirmed=X Filename=explorer.exe Description=Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Microsoft Update 32] Number=5751 Confirmed=X Filename=network.exe Description=Added by the RBOT-ARZ WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5752 Confirmed=X Filename=om4r.exe Description=Added by the RBOT-AQP WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5753 Confirmed=X Filename=winin.exe Description=Added by the RBOT-ARR WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5754 Confirmed=X Filename=wuinit.exe Description=Added by the AGOBOT-UE WORM! Source=Paul Collins Startup list [Microsoft Update 32] Number=5755 Confirmed=X Filename=neta.exe Description=Added by the RBOT-AMI WORM! Source=Paul Collins Startup list [Microsoft Update 33] Number=5756 Confirmed=X Filename=init.exe Description=Added by the RBOT-ATT WORM! Source=Paul Collins Startup list [Microsoft Update 64 BIT] Number=5757 Confirmed=X Filename=wininit32.exe Description=Added by the RBOT-AHE WORM! Source=Paul Collins Startup list [Microsoft Update 64 BIT] Number=5758 Confirmed=X Filename=winman32.exe Description=Added by the RBOT-AKI WORM! Source=Paul Collins Startup list [Microsoft Update 64 BIT] Number=5759 Confirmed=X Filename=schvost.exe Description=Added by the RBOT.CAU WORM! Source=Paul Collins Startup list [Microsoft Update 64 BIT] Number=5760 Confirmed=X Filename=winl32xe.exe Description=Added by the RBOT-AQO WORM! Source=Paul Collins Startup list [MICROSOFT UPDATE CONFIGURATION] Number=5761 Confirmed=X Filename=WIN32SNC.EXE Description=Added by the RBOT-AI WORM! Source=Paul Collins Startup list [Microsoft Update Control] Number=5762 Confirmed=X Filename=Ms64.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Debugger] Number=5763 Confirmed=X Filename=wincfg32.exe Description=Added by the SPYBOT.ZC WORM! Source=Paul Collins Startup list [Microsoft Update Device Drivers] Number=5764 Confirmed=X Filename=wuauclt.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Update DLL] Number=5765 Confirmed=X Filename=rxxhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Drivers] Number=5766 Confirmed=X Filename=explorers.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update Emulator] Number=5767 Confirmed=X Filename=kern-mxe.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Loader] Number=5768 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Loaders 2005] Number=5769 Confirmed=X Filename=winusers.exe Description=Added by the RBOT-AIQ WORM! Source=Paul Collins Startup list [Microsoft Update Loaders 2006] Number=5770 Confirmed=X Filename=winusersystem32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5771 Confirmed=X Filename=expl0rer.exe Description=Added by the SDBOT.OK WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5772 Confirmed=X Filename=rxhost.exe Description=Added by the RBOT.FC WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5773 Confirmed=X Filename=servicz.exe Description=Added by the RBOT-HU WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5774 Confirmed=X Filename=SP2.exe Description=Added by the SPYBOT.FP WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5775 Confirmed=X Filename=winini.exe Description=Added by the RBOT-KV WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5776 Confirmed=X Filename=xvshost.exe Description=Added by the RBOT.QP WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5777 Confirmed=X Filename=memstat.exe Description=Added by the RBOT-OM WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5778 Confirmed=X Filename=ntce.exe Description=Added by the RBOT-FA WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5779 Confirmed=X Filename=system03.exe Description=Added by the RBOT-NM WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5780 Confirmed=X Filename=wuawx.exe Description=Added by the RBOT-CE WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5781 Confirmed=X Filename=zonealarm.exe Description=Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5782 Confirmed=X Filename=systemll.exe Description=Added by the RBOT-JT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5783 Confirmed=X Filename=winupdt.exe Description=Added by the RBOT-FP WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5784 Confirmed=X Filename=svshost.exe Description=Added by the RBOT.AK WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5785 Confirmed=X Filename=wuamgd.exe Description=Added by the SDBOT.HQ WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5786 Confirmed=X Filename=wupdt32x.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5787 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5788 Confirmed=X Filename=linux.exe Description=Added by the RBOT-IM WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5789 Confirmed=X Filename=lmrss.exe Description=Added by the RBOT-DY WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5790 Confirmed=X Filename=windowsu.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5791 Confirmed=X Filename=wininigo.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5792 Confirmed=X Filename=winmgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5793 Confirmed=X Filename=Winmsixp32.exe Description=Added by the RBOT.DN WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5794 Confirmed=X Filename=Winregs32.exe Description=Added by the RBOT.DN WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5795 Confirmed=X Filename=winxpini.exe Description=Added by the RBOT-OB WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5796 Confirmed=X Filename=wuamgrd.exe Description=Added by the RBOT-HE WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5797 Confirmed=X Filename=wuagrd.exe Description=Added by the RBOT-GF WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5798 Confirmed=X Filename=LANWAKE.EXE Description=Added by the RBOT-QZ WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5799 Confirmed=X Filename=scvhost.exe Description=Added by the RBOT-GS WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5800 Confirmed=X Filename=winhost.exe Description=Added by the RBOT-GK WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5801 Confirmed=X Filename=winss.exe Description=Added by the RBOT.JU WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5802 Confirmed=X Filename=WUAMGRDXS.EXE Description=Added by the RBOT-GL WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5803 Confirmed=X Filename=crss32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5804 Confirmed=X Filename=lsasse.exe Description=Added by the RBOT-DI WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5805 Confirmed=X Filename=qwerty.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5806 Confirmed=X Filename=rxxhost.exe Description=Added by the RBOT.EP WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5807 Confirmed=X Filename=servicez.exe Description=Added by the SPYBOT.BI WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5808 Confirmed=X Filename=spoolserv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5809 Confirmed=X Filename=Systemnt.exe Description=Added by the RBOT.DA WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5810 Confirmed=X Filename=systemse.exe Description=Added by the RBOT-BD WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5811 Confirmed=X Filename=taskmngrs.exe Description=Added by the RBOT-CR WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5812 Confirmed=X Filename=windowsup.exe Description=Added by the RBOT-FV WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5813 Confirmed=X Filename=wuamgard.exe Description=Added by the SPYBOT.CS WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5814 Confirmed=X Filename=wupdate32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5815 Confirmed=X Filename=system.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5816 Confirmed=X Filename=TMEMSER.EXE Description=Added by the RBOT-NQ WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5817 Confirmed=X Filename=winnie.exe Description=Added by the RBOT-ACD WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5818 Confirmed=X Filename=winortho.exe Description=Added by the RBOT-NW WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5819 Confirmed=X Filename=wins32.exe Description=Added by the RBOT.EZ WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5820 Confirmed=X Filename=serviz.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5821 Confirmed=X Filename=TASKMAN4.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5822 Confirmed=X Filename=wftestb.exe Description=Added by the RBOT-AFZ WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5823 Confirmed=X Filename=Win32.exe Description=Added by the SDBOT.UV WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5824 Confirmed=X Filename=windns.exe Description=Added by the RBOT.EF WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5825 Confirmed=X Filename=MSOICONS.EXE Description=Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5826 Confirmed=X Filename=WINSVC32.EXE Description=Added by the RBOT.CU WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5827 Confirmed=X Filename=ntsystem.exe Description=Added by the RBOT.GF WORM! Source=Paul Collins Startup list [Microsoft Update Machine] Number=5828 Confirmed=X Filename=winupdte.exe Description=Added by the RBOT-GKL WORM! Source=Paul Collins Startup list [Microsoft Update Manager] Number=5829 Confirmed=X Filename=WINRLS.EXE Description=Added by the RBOT-AF WORM! Source=Paul Collins Startup list [Microsoft Update Manager] Number=5830 Confirmed=X Filename=svshost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Manager] Number=5831 Confirmed=X Filename=scvhost.exe Description=Added by the AGOBOT.AXJ WORM! Source=Paul Collins Startup list [Microsoft Update Manager] Number=5832 Confirmed=X Filename=scvideo.exe Description=Added by the SDBOT-CVP TROJAN! Source=Paul Collins Startup list [Microsoft Update Mechene] Number=5833 Confirmed=X Filename=Updatez.exe Description=Added by the RBOT-GI WORM! Source=Paul Collins Startup list [Microsoft Update Module] Number=5834 Confirmed=X Filename=rundll24.exe Description=Added by the RBOT-PS WORM! Source=Paul Collins Startup list [Microsoft Update Process] Number=5835 Confirmed=X Filename=wmipcvse.exe Description=Added by the AGOBOT-JF TROJAN! Source=Paul Collins Startup list [Microsoft Update Security Patch] Number=5836 Confirmed=X Filename=mssecurityupdatepatch.exe Description=Added by the AGENT.EF TROJAN! Source=Paul Collins Startup list [Microsoft Update Server] Number=5837 Confirmed=X Filename=mssrv.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Update Service] Number=5838 Confirmed=X Filename=csrss32.exe Description=Added by the AGOBOT-HC WORM! Source=Paul Collins Startup list [Microsoft Update Service] Number=5839 Confirmed=X Filename=mswin32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft update service] Number=5840 Confirmed=X Filename=systemm.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Update SERVICE] Number=5841 Confirmed=X Filename=phqghum.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Service] Number=5842 Confirmed=X Filename=msupdate.pif Description=Added by the RBOT-AQB WORM! Source=Paul Collins Startup list [Microsoft Update Services] Number=5843 Confirmed=X Filename=wcsnfty.exe Description=Added by the RBOT-AGK WORM! Source=Paul Collins Startup list [Microsoft Update Services] Number=5844 Confirmed=X Filename=wsnfty.exe Description=Added by the RBOT-AFU WORM! Source=Paul Collins Startup list [Microsoft Update Time] Number=5845 Confirmed=X Filename=wuam.exe Description=Added by the RBOT-M WORM! Source=Paul Collins Startup list [Microsoft Update USB2] Number=5846 Confirmed=X Filename=wuammgrd32.exe Description=Added by the RBOT-ADT WORM! Source=Paul Collins Startup list [Microsoft Update v2.6] Number=5847 Confirmed=X Filename=lxxex.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Update Win32a] Number=5848 Confirmed=X Filename=winupdate32a.exe Description=Added by the RBOT-LO WORM! Source=Paul Collins Startup list [Microsoft Update Win32x] Number=5849 Confirmed=X Filename=winupdate32x.exe Description=Added by the RBOT-AJN WORM! Source=Paul Collins Startup list [Microsoft Updater] Number=5850 Confirmed=X Filename=Winsys32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updater Resources] Number=5851 Confirmed=X Filename=WinFixd32.exe Description=Added by the SPYBOT.CA WORM! Source=Paul Collins Startup list [Microsoft UPDATER32] Number=5852 Confirmed=X Filename=lsass.exe Description=Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Updaters] Number=5853 Confirmed=X Filename=tskmgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updaters] Number=5854 Confirmed=X Filename=sysconfigs.exe Description=Added by the RBOT-DF TROJAN! Source=Paul Collins Startup list [Microsoft Updaters Pros] Number=5855 Confirmed=X Filename=WINDLL32XP.EXE Description=Added by the SPYBOTTER.GEN VIRUS! Source=Paul Collins Startup list [Microsoft Updates] Number=5856 Confirmed=X Filename=systemc32.exe Description=Added by the RBOT-GR WORM! Source=Paul Collins Startup list [Microsoft Updates] Number=5857 Confirmed=X Filename=wkssvr.exe Description=Added by the RBOT.R WORM! Source=Paul Collins Startup list [Microsoft Updates] Number=5858 Confirmed=X Filename=wkssvrs.exe Description=Added by the RBOT-EB WORM! Source=Paul Collins Startup list [Microsoft Updates] Number=5859 Confirmed=X Filename=wuamgrd.exe Description=Added by the RBOT-CO WORM! Source=Paul Collins Startup list [Microsoft Updates] Number=5860 Confirmed=X Filename=wtemp32.exe Description=Added by the RBOT-AHQ WORM! Source=Paul Collins Startup list [Microsoft Updates 2 USB] Number=5861 Confirmed=X Filename=wgafixer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updates 5 USB] Number=5862 Confirmed=X Filename=sp3fixer.exe Description=Added by the RBOT-ADS WORM! Source=Paul Collins Startup list [Microsoft Updates Resources] Number=5863 Confirmed=X Filename=WinFixIDs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updating] Number=5864 Confirmed=X Filename=navguard.exe Description=Added by the RBOT.HW WORM! Source=Paul Collins Startup list [Microsoft Updating] Number=5865 Confirmed=X Filename=syswr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updating] Number=5866 Confirmed=X Filename=wuamguards.exe Description=Added by the RBOT-BY WORM! Source=Paul Collins Startup list [Microsoft Updating Client] Number=5867 Confirmed=X Filename=websvc.exe Description=Added by the RBOT.AQ WORM! Source=Paul Collins Startup list [Microsoft Updating Machine] Number=5868 Confirmed=X Filename=sysc0de.exe Description=Added by the RBOT.RB WORM! Source=Paul Collins Startup list [Microsoft Updatting] Number=5869 Confirmed=X Filename=miroupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Updote] Number=5870 Confirmed=X Filename=[random filename] Description=Added by the RBOT-ARC WORM! Source=Paul Collins Startup list [Microsoft UpMachine] Number=5871 Confirmed=X Filename=doezs.exe Description=Added by the RBOT.BCT WORM! Source=Paul Collins Startup list [Microsoft upnp Update] Number=5872 Confirmed=X Filename=msie.exe Description=Added by the RBOT-LQ WORM! Source=Paul Collins Startup list [Microsoft uptime Service] Number=5873 Confirmed=X Filename=sysuptime.exe Description=Added by the RBOT-ACG WORM! Source=Paul Collins Startup list [Microsoft uptime Service] Number=5874 Confirmed=X Filename=sycuptime.exe Description=Added by the RBOT-AHY WORM! Source=Paul Collins Startup list [Microsoft UpToDate Driver (32-bits)] Number=5875 Confirmed=X Filename=[random filename].exe Description=Added by the SPYBOT.LXJ WORM! Source=Paul Collins Startup list [Microsoft USB2 Driver] Number=5876 Confirmed=X Filename=crmss.exe Description=Added by the RBOT-VK WORM! Source=Paul Collins Startup list [Microsoft Utility Startup] Number=5877 Confirmed=N Filename=OSA9.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Microsoft Values] Number=5878 Confirmed=X Filename=igfkishc.exe Description=Added by the RBOT-GLO WORM! Source=Paul Collins Startup list [Microsoft Vertupdate] Number=5879 Confirmed=X Filename=MSvert32.exe Description=Added by the MYTOB-CY WORM! Source=Paul Collins Startup list [Microsoft Video Capture Controls] Number=5880 Confirmed=X Filename=MSsrvs32.exe Description=Added by the SDBOT-AAK WORM! Source=Paul Collins Startup list [Microsoft Video Controls] Number=5881 Confirmed=X Filename=tskmsgr.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Virual Machine] Number=5882 Confirmed=X Filename=sms.exe Description=Added by the RBOT-SP WORM! Source=Paul Collins Startup list [Microsoft Visual SourceSafe] Number=5883 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Visual SourceSafe] Number=5884 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Visual Studio] Number=5885 Confirmed=X Filename=plscdksxg.exe Description=Added by the RBOT-AWV WORM! Source=Paul Collins Startup list [Microsoft Visual Studio VSA] Number=5886 Confirmed=X Filename=varpc32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Web Device] Number=5887 Confirmed=X Filename=wdevice.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft web update] Number=5888 Confirmed=X Filename=webmsn.exe Description=Added by the RBOT-EMQ WORM! Source=Paul Collins Startup list [Microsoft Webserver] Number=5889 Confirmed=U Filename=svctrl.exe Description=Personal web server program which enables you to create and host a web server from your computer. Not required for most people Source=Paul Collins Startup list [Microsoft Win Corp TLS Verification] Number=5890 Confirmed=X Filename=mswintls.exe Description=Added by the RBOT-GCT WORM! Source=Paul Collins Startup list [Microsoft WIN32 DOS] Number=5891 Confirmed=X Filename=MSdos32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft WIN32 Security] Number=5892 Confirmed=X Filename=MSsec32.exe Description=Added by the RBOT-DOQ TROJAN! Source=Paul Collins Startup list [MicroSoft Wind0ws Updater] Number=5893 Confirmed=X Filename=winsupdater.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows] Number=5894 Confirmed=X Filename=mstask0.exe Description=Added by the SDBOT.FQ WORM! Source=Paul Collins Startup list [Microsoft Windows] Number=5895 Confirmed=X Filename=atup Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows] Number=5896 Confirmed=X Filename=Microsoft Windows.hta Description=HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site! Source=Paul Collins Startup list [Microsoft Windows] Number=5897 Confirmed=X Filename=explorar.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows] Number=5898 Confirmed=X Filename=[path to file] Description=Added by the LI TROJAN! Source=Paul Collins Startup list [Microsoft Windows] Number=5899 Confirmed=X Filename=bootini.exe Description=Added by the VANEBOT-K WORM! Source=Paul Collins Startup list [Microsoft Windows 128bit Subsystem] Number=5900 Confirmed=X Filename=system12.exe Description=Added by the RANCK-CZ TROJAN! Source=Paul Collins Startup list [Microsoft Windows 16Bit] Number=5901 Confirmed=X Filename=mswinn16.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Windows 2000] Number=5902 Confirmed=X Filename=Winupdsdgm.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Microsoft Windows 32Bit] Number=5903 Confirmed=X Filename=mswinn32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows 64 Bit] Number=5904 Confirmed=X Filename=mswin32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Client Firewall] Number=5905 Confirmed=X Filename=msclt.exe Description=Added by the VANEBOT-F WORM! Source=Paul Collins Startup list [Microsoft Windows Communicator for NT/XP] Number=5906 Confirmed=X Filename=wincomm.exe Description=Added by the RBOT.ATH WORM! Source=Paul Collins Startup list [Microsoft Windows Control] Number=5907 Confirmed=X Filename=mswctl32.exe Description=Added by the RBOT.JP WORM! Source=Paul Collins Startup list [Microsoft Windows CSRSS] Number=5908 Confirmed=X Filename=csrss.exe Description=Added by the KALEL-A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Windows DHCP] Number=5909 Confirmed=X Filename=___r.exe Description=Added by the MASLAN.A or MASLAN.C WORMS! Source=Paul Collins Startup list [Microsoft Windows DLL 32-BIT] Number=5910 Confirmed=X Filename=msncheck32.exe Description=Added by the SDBOT-XX WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services] Number=5911 Confirmed=X Filename=mwindll.exe Description=Added by the SDBOT-VX WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5912 Confirmed=X Filename=newdll.exe Description=Added by the SDBOT-ZR WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5913 Confirmed=X Filename=newdll2.exe Description=Added by the SDBOT-ABD WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5914 Confirmed=X Filename=poker.exe Description=Added by the SDBOT-ZY WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5915 Confirmed=X Filename=poker3.exe Description=Added by the SDBOT-AAH WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5916 Confirmed=X Filename=proxy.exe Description=Added by the SDBOT-ZL WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5917 Confirmed=X Filename=windir32.exe Description=Added by the SDBOT.BHF WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5918 Confirmed=X Filename=windir32a.exe Description=Added by a variant of the SDBOT.BHF WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5919 Confirmed=X Filename=windll32.exe Description=Added by the SDBOT.BHD WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5920 Confirmed=X Filename=winDSL.exe Description=Added by the SDBOT-ZG WORM! Source=Paul Collins Startup list [Microsoft Windows DLL Services Configuration] Number=5921 Confirmed=X Filename=dllmanager32.exe Description=Added by the SDBOT-BTU WORM! Source=Paul Collins Startup list [Microsoft Windows DLLHandler] Number=5922 Confirmed=X Filename=bitpaint.exe Description=Added by the SDBOT.AHG WORM! Source=Paul Collins Startup list [Microsoft Windows Drivers] Number=5923 Confirmed=X Filename=windrv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows DVR] Number=5924 Confirmed=X Filename=windvr.exe Description=Added by the RBOT-AXD WORM! Source=Paul Collins Startup list [Microsoft Windows Explorer] Number=5925 Confirmed=X Filename=iexplorer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Explorer] Number=5926 Confirmed=X Filename=explorewin.exe Description=Added by the IRCBOT.WORM.212480.H WORM! Source=Paul Collins Startup list [Microsoft Windows Files Loader] Number=5927 Confirmed=X Filename=cgy32win.exe Description=Added by the RBOT-AXR WORM! Source=Paul Collins Startup list [Microsoft Windows Game Updater] Number=5928 Confirmed=X Filename=msgame32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows GUI] Number=5929 Confirmed=X Filename=Windowz.exe Description=Added by the RANDEX.AEV WORM! Source=Paul Collins Startup list [Microsoft Windows GUI] Number=5930 Confirmed=X Filename=msmonk32.exe Description=Added by the SDBOT-PE WORM! Source=Paul Collins Startup list [Microsoft Windows Kernel Services] Number=5931 Confirmed=X Filename=winkrnl386.exe Description=Added by the ZEBROXY TROJAN! Source=Paul Collins Startup list [Microsoft Windows Loader] Number=5932 Confirmed=X Filename=wloader.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Logon Process] Number=5933 Confirmed=X Filename=winlogon.exe Description=Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft Windows Media Player] Number=5934 Confirmed=X Filename=mediaplayer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Media Player] Number=5935 Confirmed=X Filename=wimp.exe Description=Added by the RBOT-FN WORM! Source=Paul Collins Startup list [Microsoft Windows Secure] Number=5936 Confirmed=X Filename=windocs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Secure] Number=5937 Confirmed=X Filename=windocs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Secure Server] Number=5938 Confirmed=X Filename=rpcxWindows.exe Description=Added by the RBOT-LL WORM! Source=Paul Collins Startup list [Microsoft Windows Secure Update] Number=5939 Confirmed=X Filename=rpcxwinupdt.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsoft Windows Securety] Number=5940 Confirmed=X Filename=wurguar.exe Description=Added by the RBOT-KY WORM! Source=Paul Collins Startup list [Microsoft Windows Security] Number=5941 Confirmed=X Filename=spvsper.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Security] Number=5942 Confirmed=X Filename=wscndrives.exe Description=Added by the RBOT-AJK WORM! Source=Paul Collins Startup list [Microsoft Windows Service] Number=5943 Confirmed=X Filename=winsys.exe Description=Added by the RBOT-ADP WORM! Source=Paul Collins Startup list [Microsoft Windows Service Pack] Number=5944 Confirmed=X Filename=winspkn.exe Description=Added by the RBOT-AYD WORM! Source=Paul Collins Startup list [Microsoft Windows Services] Number=5945 Confirmed=X Filename=msw32.exe Description=Added by the RBOT-FWQ WORM! Source=Paul Collins Startup list [Microsoft Windows Services Edt] Number=5946 Confirmed=X Filename=ssvvcchhoosst.exe Description=Added by the RBOT-FYF TROJAN! Source=Paul Collins Startup list [Microsoft Windows Services Edt] Number=5947 Confirmed=X Filename=dllrun32.exe Description=Added by the RBOT-GAF WORM! Source=Paul Collins Startup list [Microsoft Windows Session Manager Subsystem] Number=5948 Confirmed=X Filename=smss.exe Description=Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Microsoft Windows Socketx32 Services] Number=5949 Confirmed=X Filename=winsockx32.exe Description=Added by the RBOT-FWT WORM! Source=Paul Collins Startup list [Microsoft Windows Storage Machine Service] Number=5950 Confirmed=X Filename=winms.exe Description=Added by the RBOT-AHK WORM! Source=Paul Collins Startup list [Microsoft Windows System] Number=5951 Confirmed=X Filename=srwhost.exe Description=Added by a variant of the RBOT-ASW WORM! Source=Paul Collins Startup list [Microsoft Windows System] Number=5952 Confirmed=X Filename=syshost.exe Description=Added by the RBOT-ASW WORM! Source=Paul Collins Startup list [Microsoft Windows System Kernel] Number=5953 Confirmed=X Filename=kernel32.exe Description=Added by a variant of the IRC.BOT TROJAN! Source=Paul Collins Startup list [Microsoft Windows System Service Manager] Number=5954 Confirmed=X Filename=winsvc.exe Description=Added by the SPYBOT.LR WORM! Source=Paul Collins Startup list [Microsoft Windows Task Management] Number=5955 Confirmed=X Filename=mstasks.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Task Manger] Number=5956 Confirmed=X Filename=Mstosk.exe Description=Added by the SDBOT-WW WORM! Source=Paul Collins Startup list [Microsoft Windows Tasks Management] Number=5957 Confirmed=X Filename=taskmng.exe Description=Added by the RBOT-FXK WORM! Source=Paul Collins Startup list [Microsoft Windows Updata] Number=5958 Confirmed=X Filename=scvhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Updata] Number=5959 Confirmed=X Filename=windows.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5960 Confirmed=X Filename=rundlls.exe Description=Added by the HABRACK WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5961 Confirmed=X Filename=msoffice2.exe Description=Added by the RBOT-GB WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5962 Confirmed=X Filename=spools.exe Description=Added by the SDBOT.TD WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5963 Confirmed=X Filename=svchos.exe Description=Added by the SDBOT.AC WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5964 Confirmed=X Filename=svcshost.exe Description=Added by the FORBOT-CF WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5965 Confirmed=X Filename=svmhost.exe Description=Added by the FORBOT-CH WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5966 Confirmed=X Filename=svshost.exe Description=Added by the WOOTBOT.CJ WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5967 Confirmed=X Filename=msnmessenger.exe Description=Added by the SDBOT.AJ WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5968 Confirmed=X Filename=msnwun.exe Description=Added by the SDBOT-RM WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5969 Confirmed=X Filename=scvvhost.exe Description=Added by the FORBOT-DH WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5970 Confirmed=X Filename=swwhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5971 Confirmed=X Filename=MSNMSGR.EXE Description=Added by the SDBOT-WM WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5972 Confirmed=X Filename=svzhost.exe Description=Added by the FORBOT-EV WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5973 Confirmed=X Filename=sccvhost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5974 Confirmed=X Filename=scrhost.exe Description=Added by the RBOT-AOW WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5975 Confirmed=X Filename=mnswinsx.exe Description=Added by the RBOT-AWH WORM! Source=Paul Collins Startup list [MICROSOFT Windows update] Number=5976 Confirmed=X Filename=pdate.exe Description=Added by the RBOT.BZT WORM! Source=Paul Collins Startup list [Microsoft Windows Update] Number=5977 Confirmed=X Filename=srshost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update Application] Number=5978 Confirmed=X Filename=wuap.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update Logon] Number=5979 Confirmed=X Filename=win-logon.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Update Service] Number=5980 Confirmed=X Filename=wupdmgr32.exe Description=Added by the DOS.AUTOCAT TROJAN! Source=Paul Collins Startup list [Microsoft Windows Update XP64] Number=5981 Confirmed=X Filename=********.exe [* = random char] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5982 Confirmed=X Filename=winupdgm.exe Description=Added by the GAOBOT.BI WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5983 Confirmed=X Filename=WINIUPDATES.EXE Description=Added by the RBOT-KK WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5984 Confirmed=X Filename=WINUPDATE.EXE Description=Added by the SDBOT-PU WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5985 Confirmed=X Filename=TMNTSrv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5986 Confirmed=X Filename=win32upd.exe Description=Added by the RBOT-EC WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5987 Confirmed=X Filename=msnupdateit.exe Description=Added by the AGOBOT-RL WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5988 Confirmed=X Filename=windates.exe Description=Added by the SDBOT.TE WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5989 Confirmed=X Filename=spoolvs.exe Description=Added by the RBOT.ACQ WORM! Source=Paul Collins Startup list [Microsoft Windows Updater] Number=5990 Confirmed=X Filename=suvhost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows updaterD] Number=5991 Confirmed=X Filename=log32zx.exe Description=Added by the MYDOOM.W WORM! Source=Paul Collins Startup list [Microsoft Windows Updates] Number=5992 Confirmed=X Filename=explorer32.exe Description=Added by the SDBOT.VQ WORM! Source=Paul Collins Startup list [Microsoft Windows Updates] Number=5993 Confirmed=X Filename=wsap32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft Windows Updating System] Number=5994 Confirmed=X Filename=msresource.exe Description=Added by the RBOT-EAM WORM! Source=Paul Collins Startup list [Microsoft Windows W32 Services] Number=5995 Confirmed=X Filename=mssw32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft Windows WinSaSS Management] Number=5996 Confirmed=X Filename=winsass.exe Description=Added by the RBOT-APW WORM! Source=Paul Collins Startup list [Microsoft Windows WKS Service] Number=5997 Confirmed=X Filename= gt.exe Description=Added by the SDBOT.FV WORM! Source=Paul Collins Startup list [Microsoft Windows Workstation] Number=5998 Confirmed=X Filename=devcode.exe Description=Added by the RBOT-AWL WORM! Source=Paul Collins Startup list [Microsoft Windows XP Configuration Loader] Number=5999 Confirmed=X Filename=m32svco.exe Description=Added by the SDBOT.WORM!.48548 WORM! Source=Paul Collins Startup list [Microsoft WINGS32 Protocol] Number=6000 Confirmed=X Filename=WinSGR32.exe Description=Added by the RBOT-APU WORM! Source=Paul Collins Startup list [Microsoft WinRaR] Number=6001 Confirmed=X Filename=winrar.exe Description=Added by the RBOT-AEC WORM! Source=Paul Collins Startup list [Microsoft Winsock] Number=6002 Confirmed=X Filename=mswinsck.exe Description=Added by the RBOT-ANK WORM! Source=Paul Collins Startup list [Microsoft Winsock Service] Number=6003 Confirmed=X Filename=msusvc.exe Description=Added by the RBOT-ANS WORM! Source=Paul Collins Startup list [Microsoft Winsock Wrapper] Number=6004 Confirmed=X Filename=ws2_32s.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Microsoft WinSound] Number=6005 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6006 Confirmed=X Filename=mntcgf032.exe Description=Added by the RBOT-PF WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6007 Confirmed=X Filename=svh0st.exe Description=Added by the SPYBOT.DL WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6008 Confirmed=X Filename=syslx32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6009 Confirmed=X Filename=syswin32.exe Description=Added by the RBOT-HO WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6010 Confirmed=X Filename=spfix.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6011 Confirmed=X Filename=Winamp61.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6012 Confirmed=X Filename=Winupd32.exe Description=Added by the RBOT.MQ WORM! Source=Paul Collins Startup list [Microsoft WinUpdate] Number=6013 Confirmed=X Filename=WinNTinit32.exe Description=Added by the RBOT.VS WORM! Source=Paul Collins Startup list [Microsoft WinUpdates] Number=6014 Confirmed=X Filename=serm32.exe Description=Added by the RBOT.GE WORM! Source=Paul Collins Startup list [Microsoft WM] Number=6015 Confirmed=X Filename=mswm32.exe Description=Added by the BCKDR-AM TROJAN! Source=Paul Collins Startup list [Microsoft Word] Number=6016 Confirmed=X Filename=BootSector.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Microsoft Word Profissional] Number=6017 Confirmed=X Filename=csrss.exe Description=Added by the BANCBAN-DB TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "s1613" subfolder Source=Paul Collins Startup list [Microsoft Word Profissional] Number=6018 Confirmed=X Filename=Java Plug In close.exe Description=Added by the BANKER-EL TROJAN! Source=Paul Collins Startup list [Microsoft Word Profissional] Number=6019 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "protect" subfolder Source=Paul Collins Startup list [Microsoft Word Profissional] Number=6020 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "JavaVM" subfolder Source=Paul Collins Startup list [Microsoft Works Calendar Reminders] Number=6021 Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [Microsoft Works Portfolio] Number=6022 Confirmed=N Filename=WksSb.exe Description=The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program.Can be prevented from starting from a setting within Portfolio Source=Paul Collins Startup list [Microsoft Works Update Detection ] Number=6023 Confirmed=N Filename=wkdetect.exe Description=Checks for updates to MS Works Source=Paul Collins Startup list [Microsoft World Service] Number=6024 Confirmed=X Filename=winworld.exe Description=Added by an unidentified IRC worm with backdoor capability! Source=Paul Collins Startup list [Microsoft WPCEmail] Number=6025 Confirmed=X Filename=svchost.exe Description=Added by the SNIFFER-N TROJAN! Source=Paul Collins Startup list [Microsoft WWW] Number=6026 Confirmed=X Filename=free.exe Description=Added by a variant of the CWS.AK TROJAN! Source=Paul Collins Startup list [Microsoft Wxdate] Number=6027 Confirmed=X Filename=Syswu32.exe Description=Added by the SPYBOT.HZ WORM! Source=Paul Collins Startup list [Microsoft X Update] Number=6028 Confirmed=X Filename=wuamkoppnp.exe Description=Added by the RBOT-ANI WORM! Source=Paul Collins Startup list [microsoft xdaemon 2.0] Number=6029 Confirmed=X Filename=xdaemon.exe Description=Added by the DELF.D TROJAN! Source=Paul Collins Startup list [Microsoft XML Service] Number=6030 Confirmed=X Filename=msxmlx.exe Description=Added by the RBOT.KS WORM! Source=Paul Collins Startup list [Microsoft Xp Systems loader] Number=6031 Confirmed=X Filename=winsystem32xp.exe Description=Added by the KELVIR.W WORM! Source=Paul Collins Startup list [Microsoft Xp Systems loaders] Number=6032 Confirmed=X Filename=win32xpsys.exe Description=Added by the SPYBOT.NYT WORM! Source=Paul Collins Startup list [Microsoft XPSP Protocol] Number=6033 Confirmed=X Filename=xp386.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft xpsp2] Number=6034 Confirmed=X Filename=Networksystem.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Microsoft xpsp2] Number=6035 Confirmed=X Filename=xpsp2.exe Description=Added by the SDBOT-YQ WORM! Source=Paul Collins Startup list [Microsoft's System Module] Number=6036 Confirmed=X Filename=Sysmodule.exe Description=Added by the FJ TROJAN! Source=Paul Collins Startup list [Microsoft--Updates] Number=6037 Confirmed=X Filename=sxvhost.exe Description=Added by the RBOT-FH WORM! Source=Paul Collins Startup list [Microsoft-software] Number=6038 Confirmed=X Filename=****.exe [* = random char] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoft-Update] Number=6039 Confirmed=X Filename=wngard.exe Description=Added by the RBOT-JV WORM! Source=Paul Collins Startup list [Microsoft-Updates] Number=6040 Confirmed=X Filename=svxhost.exe Description=Added by the RBOT-CT WORM! Source=Paul Collins Startup list [microsoft420] Number=6041 Confirmed=X Filename=microsoft420.exe Description=Added by the MENACE.B WORM! Source=Paul Collins Startup list [Microsoft64] Number=6042 Confirmed=X Filename=antiv.exe Description=Added by the SOBER WORM! Source=Paul Collins Startup list [Microsoftf DDEs ContDLL] Number=6043 Confirmed=X Filename=rune.pif Description=Added by the RBOT-AGF WORM! Source=Paul Collins Startup list [Microsoftf DDEs ContrDL] Number=6044 Confirmed=X Filename=runm.pif Description=Added by the RBOT-AFQ WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6045 Confirmed=X Filename=lxes.exe Description=Added by the RBOT.BOF WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6046 Confirmed=X Filename=wees.exe Description=Added by a variant of the the RBOT.BOF WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6047 Confirmed=X Filename=soff.pif Description=Added by the RBOT-AKH WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6048 Confirmed=X Filename=why-.exe Description=Added by the RBOT-AMV WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6049 Confirmed=X Filename=msnn.exe Description=Added by the RBOT-AXT WORM! Source=Paul Collins Startup list [Microsoftf DDEs Control] Number=6050 Confirmed=X Filename=FEnR.exe Description=Added by the RBOT-AIM WORM! Source=Paul Collins Startup list [Microsoftkeysd] Number=6051 Confirmed=X Filename=systemproc.exe Description=Added by the FORBOT-BI WORM! Source=Paul Collins Startup list [Microsoftkeysd] Number=6052 Confirmed=X Filename=systemwin32s.exe Description=Added by the WOOTBOT.CO WORM! Source=Paul Collins Startup list [Microsoftkeysds] Number=6053 Confirmed=X Filename=lass32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MicrosoftKs] Number=6054 Confirmed=X Filename=Drivers.bat Description=Added by the SHUTDOWN-F TROJAN! Source=Paul Collins Startup list [microsoftm eegs cuntrol] Number=6055 Confirmed=X Filename=loor.pif Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsoftmsn32.exe] Number=6056 Confirmed=X Filename=microsoftmsn32.exe Description=Added by the CERTIF-C TROJAN! Source=Paul Collins Startup list [MicrosoftMultimediaTask] Number=6057 Confirmed=X Filename=Mmtask.exe Description=Adware downloader - not the valid MusicMatch Jukebox which shares the same filename Source=Paul Collins Startup list [MicrosoftNetwork Daemon for Win32] Number=6058 Confirmed=X Filename=NETD32.EXE Description=Added by the RANDEX.F WORM! Source=Paul Collins Startup list [MicrosoftOEM] Number=6059 Confirmed=X Filename=smvss.exe Description=Added by the DEDLER-G TROJAN! Source=Paul Collins Startup list [Microsofts media] Number=6060 Confirmed=X Filename=winmplayd.exe Description=Added by an undidentified WORM or TROJAN! Source=Paul Collins Startup list [Microsofts media] Number=6061 Confirmed=X Filename=wingtp.exe Description=Added by the RBOT-VO WORM! Source=Paul Collins Startup list [Microsofts MediaScope] Number=6062 Confirmed=X Filename=winmep.exe Description=Added by the RBOT-WB WORM! Source=Paul Collins Startup list [Microsofts MediaScope] Number=6063 Confirmed=X Filename=winmedplay.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsofts Security Manager] Number=6064 Confirmed=X Filename=****.exe [**** = random char] Description=Added by the RBOT-WH TROJAN! Source=Paul Collins Startup list [Microsofts Service] Number=6065 Confirmed=X Filename=lcsrv16.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Microsofts Updates] Number=6066 Confirmed=X Filename=lsasss.exe Description=Added by the RBOT-AEX WORM! Source=Paul Collins Startup list [Microsofts Updatez] Number=6067 Confirmed=X Filename=cmsssr.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Microsofts Updatez] Number=6068 Confirmed=X Filename=exploirez.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MicrosoftServiceManager] Number=6069 Confirmed=X Filename=mstask32.exe Description=Added by the YAHA.P WORM! Source=Paul Collins Startup list [MicrosoftServiceManager] Number=6070 Confirmed=X Filename=Wintsk32.exe Description=Added by the YAHA.U WORM! Source=Paul Collins Startup list [MicrosoftServiceManager] Number=6071 Confirmed=X Filename=EXPLORERE.EXE Description=Added by the YAHA.AB WORM! Source=Paul Collins Startup list [MicrosoftServiceManager] Number=6072 Confirmed=X Filename=msupdat.exe Description=Added by the YAHA.AA WORM! Source=Paul Collins Startup list [MicrosoftSourceSafe] Number=6073 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [MicrosoftSys] Number=6074 Confirmed=X Filename=SPOOLSYS.exe Description=Added by the TARNO.N TROJAN! Source=Paul Collins Startup list [MicrosoftUpdate] Number=6075 Confirmed=X Filename=syshelper.exe Description=Added by the WOOTBOT.AC WORM! Source=Paul Collins Startup list [MicrosoftUpdate] Number=6076 Confirmed=X Filename=WinUp32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [MicrosoftUpdates] Number=6077 Confirmed=X Filename=[path to trojan] Description=Added by the DELF-LO TROJAN! Source=Paul Collins Startup list [MicrosoftValue] Number=6078 Confirmed=X Filename=syscnfg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:\windows\fonts (or C:\winnt\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Microsoftvirus] Number=6079 Confirmed=X Filename=sysoverload.exe Description=Added by the FORBOT-AL WORM! Source=Paul Collins Startup list [MicrosoftWindows] Number=6080 Confirmed=X Filename=[various filenames] Description=MagicSearch - a CoolWebSearch parasite variant Source=Paul Collins Startup list [MicrosoftWindows] Number=6081 Confirmed=X Filename=a@26m.exe Description=Added by the KILLPAR-B TROJAN! Source=Paul Collins Startup list [MicrosoftXP Service Pack 2] Number=6082 Confirmed=X Filename=servicepack2.exe Description=Added by the RBOT.EMC WORM! Source=Paul Collins Startup list [Microsoftz turn Control] Number=6083 Confirmed=X Filename=aexl.exe Description=Added by the SDBOT.BCO WORM! Source=Paul Collins Startup list [Microsoftz turn Control] Number=6084 Confirmed=X Filename=read.pif Description=Added by the RBOT-AFS WORM! Source=Paul Collins Startup list [Microsoft� PID Lex] Number=6085 Confirmed=X Filename=PIDLex.exe Description=Added by the NIOVADOOR TROJAN! Source=Paul Collins Startup list [Microsoft� ActiveX Debugger NT] Number=6086 Confirmed=X Filename=setdebugnt.exe Description=Added by the BANCOS-CZ TROJAN! Source=Paul Collins Startup list [Microsoft� System Mapper] Number=6087 Confirmed=X Filename=SysMap.exe Description=Added by the MAPSY TROJAN! Source=Paul Collins Startup list [Microsoft� Windows� Operating System] Number=6088 Confirmed=U Filename=ehTray.exe Description=Enables the user to access Windows Messenger from within Windows Media Center Edition Source=Paul Collins Startup list [Microsoft� Windows� Operating System] Number=6089 Confirmed=N Filename=RunDLL32.exe [path] ehuihlp.dll, BootMediaCenter Description=Starts Windows Media Center every time Windows Vista (Home Premium or Ultimate) boots. Disable by unchecking the "Start Windows Media Center when Windows Starts" option via Windows Media Center -> Tasks -> Settings -> General -> Startup and Window Behaviour Source=Paul Collins Startup list [Microsoft� Windows� Operating System] Number=6090 Confirmed=N Filename=rundll32.exe [path] oobefldr.dll, ShowWelcomeCenter Description=Shows the Welcome Center every time you boot into Windows Vista Source=Paul Collins Startup list [Microsong] Number=6091 Confirmed=X Filename=svchosts11.exe Description=Added by the SDBOT-EV WORM! Source=Paul Collins Startup list [Microsot NT Support] Number=6092 Confirmed=X Filename=[random filename].exe Description=Added by the RBOT-CTI WORM! Source=Paul Collins Startup list [Microszoft Update Mach1nezs] Number=6093 Confirmed=X Filename=svchst.exe Description=Added by the RBOT-ED WORM! Source=Paul Collins Startup list [Microtek Scanner Finder] Number=6094 Confirmed=U Filename=ScannerFinder.exe Description=Monitors whether a scanner is present. Provided with Microtek scanners Source=Paul Collins Startup list [Microzoft_Ofiz] Number=6095 Confirmed=X Filename=KdzEregli.exe Description=Added by the AMUS.A WORM! Source=Paul Collins Startup list [Micrsoft CFG 32] Number=6096 Confirmed=X Filename=lrbzus32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Micrsoft Driver] Number=6097 Confirmed=X Filename=windrive.exe Description=Added by the SDBOT.AF TROJAN! Source=Paul Collins Startup list [Micrsoft Driver] Number=6098 Confirmed=X Filename=msdriver.exe Description=Added by the SDBOT-XD WORM! Source=Paul Collins Startup list [Micrsoft Internet Explorer] Number=6099 Confirmed=X Filename=IEXPL0RE.EXE Description=Added by the RBOT-AQV WORM! Note the number "0" in the filename Source=Paul Collins Startup list [Micsoft-Published-Software] Number=6100 Confirmed=X Filename=explrer.exe Description=Added by the RBOT-GFL WORM! Source=Paul Collins Startup list [Micsorosft Security Center] Number=6101 Confirmed=X Filename=wcnsfty.exe Description=Added by the RBOT-AHU WORM! Source=Paul Collins Startup list [MightyFAX Controller] Number=6102 Confirmed=N Filename=MFNTCTL.EXE Description=Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software" Source=Paul Collins Startup list [MigrationVendorSetupCaller] Number=6103 Confirmed=? Filename=rundll32.exe migrate.dll, CallVendorSetupDlls Description=?? Source=Paul Collins Startup list [Military Net Killer] Number=6104 Confirmed=X Filename=MNK.exe Description=Added by the MILLNET-A WORM! Source=Paul Collins Startup list [MilShieldSlave] Number=6105 Confirmed=U Filename=ShieldWorker.exe Description=Mil Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activities Source=Paul Collins Startup list [MimBoot] Number=6106 Confirmed=N Filename=mimboot.exe Description=Starts Musicmatch Jukebox at bootup - can be started manually Source=Paul Collins Startup list [Mincer] Number=6107 Confirmed=X Filename=Mincer.exe Description=Added by the MINCEME-A WORM! Source=Paul Collins Startup list [MINIBUG] Number=6108 Confirmed=X Filename=MINIBUG.EXE Description=Displays ads inside Weatherbug - see here Source=Paul Collins Startup list [MiniEYE-MiniREAD Launch] Number=6109 Confirmed=N Filename=ARLaunch.exe Description=eyeQ - improve your reading speed Source=Paul Collins Startup list [MINIFERT.EXE] Number=6110 Confirmed=N Filename=MINIFERT.EXE Description=Part of Backweb Source=Paul Collins Startup list [minilog] Number=6111 Confirmed=U Filename=MINILOG.EXE Description=If you don't have ZoneAlarm or ZoneAlarm Pro running you don't need this. This must be enabled if programs such as VisualZone Report utility or ZoneLog Analyzer are in use Source=Paul Collins Startup list [MiniMavis] Number=6112 Confirmed=N Filename=MiniMavis.exe Description=Mavis Beacon typing tutor Source=Paul Collins Startup list [minimo] Number=6113 Confirmed=X Filename=[path to file] Description=Added by the MOSUCK-X TROJAN! Source=Paul Collins Startup list [MiniNote] Number=6114 Confirmed=N Filename=MININOTE.EXE Description=Mini NoteTab was the first in the family of "NoteTab" text and HTML editors from Fookes Software Source=Paul Collins Startup list [Miniphone] Number=6115 Confirmed=? Filename=glophone.exe Description=VoiceGlo Glophone Voice over Internet Protocol (VOIP) communications software - "an affordable and convenient way to call friends and family throughout the world using a dial-up or broadband Internet connection on your computer" - is it required in startup? Source=Paul Collins Startup list [miniport] Number=6116 Confirmed=X Filename=usb2chk.exe Description=Added by the LAZAR-A TROJAN! Source=Paul Collins Startup list [MiniPortRt] Number=6117 Confirmed=X Filename=miniport_mp.exe Description=Malware - see here Source=Paul Collins Startup list [MiniServer.exe] Number=6118 Confirmed=X Filename=MiniServer.exe Description=Added by the LITTLEW-E TROJAN! Source=Paul Collins Startup list [MinMaxExtender] Number=6119 Confirmed=U Filename=Mmext.exe Description=MinMaxExtender - window handling tool Source=Paul Collins Startup list [Miosf Update] Number=6120 Confirmed=X Filename=wimsqaad.exe Description=Added by the SDBOT.AG TROJAN! Source=Paul Collins Startup list [Mirabilis ICQ] Number=6121 Confirmed=N Filename=NDetect.exe Description=If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Source=Paul Collins Startup list [Mirabilis ICQ] Number=6122 Confirmed=N Filename=icq.exe Description=If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Source=Paul Collins Startup list [Mirabilis ICQ] Number=6123 Confirmed=N Filename=ICQNet.exe Description=If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Source=Paul Collins Startup list [Miramar Systems, Inc.] Number=6124 Confirmed=U Filename=atmsg.exe Description=Miramar PC/Mac networking software Source=Paul Collins Startup list [Miranda IM] Number=6125 Confirmed=N Filename=miranda32.exe Description=Miranda instant messaging client Source=Paul Collins Startup list [Mirate Sp 2 Information] Number=6126 Confirmed=X Filename=miratesp2.exe Description=Added by the RBOT.QH WORM! Source=Paul Collins Startup list [Mircosoft DNS Service] Number=6127 Confirmed=X Filename=svchost.exe Description=Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder Source=Paul Collins Startup list [Mircosoft Sockets SP2] Number=6128 Confirmed=X Filename=mssck.exe Description=Added by the MYTOB.ET WORM! Source=Paul Collins Startup list [Mircosoft Update] Number=6129 Confirmed=X Filename=wuampkd.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mircrosoft Svchost32] Number=6130 Confirmed=X Filename=svchost32.exe Description=Added by the RBOT-AZW WORM! Source=Paul Collins Startup list [Mircrosoft Windows Config DLL] Number=6131 Confirmed=X Filename=rundllc32b.exe Description=Added by the RBOT-ZY WORM! Source=Paul Collins Startup list [miroVIDEO Tray Tool] Number=6132 Confirmed=N Filename=misitray.exe Description=Tool for quickly changing options for miro/Pinnacle capture cards during capture/playback/output. When this program is closed, another program (mv-ctrl) is also closed, but mv-ctrl does not have its own EXE file. Only needed when using the capture card, e.g. for the above actions Source=Paul Collins Startup list [MirrorFolderShell] Number=6133 Confirmed=U Filename=mrfshl.exe Description=MirrorFolder backup software Source=Paul Collins Startup list [Mirsoft sdcE] Number=6134 Confirmed=X Filename=taskmegr.exe Description=Added by the RBOT-AWY WORM! Source=Paul Collins Startup list [Mirsoft sdcE] Number=6135 Confirmed=X Filename=taskmegr.exe Description=Added by the RBOT.DFQ WORM! Source=Paul Collins Startup list [Miscrosoft Windows Explorer] Number=6136 Confirmed=X Filename=IEEXPLORER.exe Description=Reported as the SDBOT.YX WORM! Source=Paul Collins Startup list [misiCTRL] Number=6137 Confirmed=? Filename=misiCTRL.exe Description=Miro video driver related. Is it required? Source=Paul Collins Startup list [misiTRAY] Number=6138 Confirmed=? Filename=misiTRAY.exe Description=Miro video driver related. Is it required? Source=Paul Collins Startup list [Mismo] Number=6139 Confirmed=X Filename=win32x.exe Description=Added by the RBOT-JP WORM! Source=Paul Collins Startup list [Mixer] Number=6140 Confirmed=N Filename=Mixer.exe Description=C-Media Mixer - C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs Source=Paul Collins Startup list [Mixersel] Number=6141 Confirmed=N Filename=mixersel.exe Description=Configuration for Realtek audio devices Source=Paul Collins Startup list [Mixghost] Number=6142 Confirmed=N Filename=mixghost.exe Description=Management software for Altec Lansing speakers. If a change is needed, the user can launch it from the Start menu Source=Paul Collins Startup list [ml00!.exe] Number=6143 Confirmed=X Filename=ml00!.exe Description=Malware, detected by Panda Antivirus as Trj/Downloader.BWD Source=Paul Collins Startup list [ML1HelperStartUp] Number=6144 Confirmed=U Filename=ML1HEL~1.EXE Description=ScreenScenes "Midnight Lake" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [ML1HelperStartUp] Number=6145 Confirmed=U Filename=ML1Helper.exe Description=ScreenScenes "Midnight Lake" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [ml34] Number=6146 Confirmed=X Filename=[path to trojan] Description=Added by the MAILBOT-BH TROJAN! Source=Paul Collins Startup list [Mlcr0s0ftf DDEs C0ntr0i] Number=6147 Confirmed=X Filename=WAed.pif Description=Added by the RBOT-BJW WORM! Source=Paul Collins Startup list [mlibsysmc] Number=6148 Confirmed=X Filename=comzcinc.exe Description=Added by the SDBOT-CXS WORM! Source=Paul Collins Startup list [mload] Number=6149 Confirmed=X Filename=lxmstart.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [MM Install] Number=6150 Confirmed=? Filename=setup.exe Description=Possibly Money Manager from Moneysoft? Source=Paul Collins Startup list [MMB2] Number=6151 Confirmed=X Filename=explorer.exe Description=Added by an unidentified WORM or TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [MMC] Number=6152 Confirmed=X Filename=inisys.exe Description=Added by the OSCABOT-I WORM! Source=Paul Collins Startup list [mmcndmgr] Number=6153 Confirmed=X Filename=mmcndmgr.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [MMCWINMGMT] Number=6154 Confirmed=N Filename=winmgmt.exe Description=Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here Source=Paul Collins Startup list [mmemdrv] Number=6155 Confirmed=X Filename=mmemdrv.exe Description=Added by SecondSight spyware. Note - SecondSight is spyware that captures keystrokes and screen shots, and logs user activity on the compromised computer. The risk can then send the logged information to a remote attacker via email, must be manually installed Source=Paul Collins Startup list [MMERefresh] Number=6156 Confirmed=U Filename=MMERefresh.exe Description=Part of Digidesgin Protools. Refreshes your midi ports on the 002(R) (the 002R is a hardware audio/midi converter connected to your computer via firewire). Must be running in order to use the MIDI functionality of the Digi002R Source=Paul Collins Startup list [Mmessenger] Number=6157 Confirmed=X Filename=messenger.exe Description=Added by the AGOBOT.GM WORM! Source=Paul Collins Startup list [Mmgsvc] Number=6158 Confirmed=X Filename=mmgsvc.exe Description=Mmgsvc spyware Source=Paul Collins Startup list [MMhid] Number=6159 Confirmed=U Filename=mmhid.dll Description=This is the Human Interface Device Server for Win98, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case then re-enable it. Equivalent to Hidserv in Win98SE/2000/Me/XP Source=Paul Collins Startup list [MMHK] Number=6160 Confirmed=? Filename=mmhk.exe Description=A driver found on a Compaq Presario 800T notebook. Possibly something to do with multimedia hot keys? Source=Paul Collins Startup list [MMHotKey] Number=6161 Confirmed=N Filename=MMHotKey.exe Description=Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen Source=Paul Collins Startup list [MMicrosoft Security Management] Number=6162 Confirmed=X Filename=inetforn.exe Description=Added by the RBOT.AFZ WORM! Source=Paul Collins Startup list [MMKeybd] Number=6163 Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [Mmm] Number=6164 Confirmed=U Filename=Mmm.exe Description=Hace Mmm - free utility to configure your Windows menus and move and remove menu-items you never use Source=Paul Collins Startup list [mmod] Number=6165 Confirmed=X Filename=mmod.exe Description=eZula TopText adware Source=Paul Collins Startup list [mmpti] Number=6166 Confirmed=N Filename=m1mmpti.exe Description=Mpact Mediaware Properties Taskbar Icon - multimedia software icon for Chromatic Research Mpact video cards Source=Paul Collins Startup list [MMReminderService] Number=6167 Confirmed=N Filename=MMReminderService.exe Description=Mind Manager from Mindjet - "easy way to organize ideas and information". Registration reminder Source=Paul Collins Startup list [MMRun] Number=6168 Confirmed=? Filename=mmrun.exe Description=?? Source=Paul Collins Startup list [mmsys] Number=6169 Confirmed=? Filename=recover.exe Description=?? Source=Paul Collins Startup list [MMSystem] Number=6170 Confirmed=X Filename=RunDll32 Description=Added by the FUNNER-A WORM! Source=Paul Collins Startup list [MMTASK] Number=6171 Confirmed=Y Filename=mmtask.tsk Description=A check on the file's properties reveals "Multimedia background task support module". MMTASK is a very simple 16-bit program used by certain multimedia drivers (which are still 16-bit on Win9x) to perform background processing. Some soundcards need this to support MIDI, etc Source=Paul Collins Startup list [mmtask] Number=6172 Confirmed=N Filename=mmtask.exe Description=Part of MusicMatch Jukebox - digital music player / CD burner and ripper / music organizer / playlist creator Source=Paul Collins Startup list [MMtask Service] Number=6173 Confirmed=X Filename=mmtask.exe Description=Added by the BACKGAT.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename Source=Paul Collins Startup list [MMTray] Number=6174 Confirmed=N Filename=mm_tray.exe Description=MusicMatch Jukebox icon in the task tray - digital music player / CD burner and ripper / music organizer / playlist creator Source=Paul Collins Startup list [MMTray] Number=6175 Confirmed=N Filename=MMTray.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [MMTray2K] Number=6176 Confirmed=N Filename=MMTray2K.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [MMTrayLSI] Number=6177 Confirmed=N Filename=MMTrayLSI.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [mmusrstp] Number=6178 Confirmed=? Filename=procrun.exe Description=?? Source=Paul Collins Startup list [mmxp2passion.exe] Number=6179 Confirmed=X Filename=mmxp2passion.exe Description=MediaMotor adware Source=Paul Collins Startup list [mmxrun] Number=6180 Confirmed=X Filename=msosa.exe Description=Added by an unidentified TROJAN or WORM! Source=Paul Collins Startup list [mmxrun] Number=6181 Confirmed=X Filename=mswinindex.exe Description=TwoSeven spyware Source=Paul Collins Startup list [mnklins] Number=6182 Confirmed=X Filename=mnklins.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [MNPol] Number=6183 Confirmed=X Filename=mnpol.exe Description=Added by the DLUCA.B TROJAN! Source=Paul Collins Startup list [MNS] Number=6184 Confirmed=U Filename=MNS.exe Description=Mobile Net Switch enables you to use your computer on more then one network with the click of a button. It allows you to automatically select the correct drive mappings, printer settings, IP settings and much more Source=Paul Collins Startup list [mnsvc] Number=6185 Confirmed=X Filename=mnsvc.exe Description=Added by the AUTOUPDER TROJAN! Source=Paul Collins Startup list [mnsvcsp] Number=6186 Confirmed=X Filename=mnsvcsp.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Mobile Phone Suite] Number=6187 Confirmed=U Filename=MobilePhoneSuite.exe Description=Logitech Mobile Phone Suite Source=Paul Collins Startup list [mobile PhoneTools] Number=6188 Confirmed=U Filename=mPhonetools.exe Description=Motorola Phone Tools Source=Paul Collins Startup list [Mobipocket Reader Notifications] Number=6189 Confirmed=U Filename=readernotify.exe Description=Part of Mobipocket Reader - "Store all your eBooks, eNews & self-published eDocs on your PC. Download eBooks in Mobi format from your favorite ebookstores to read on your smartphone, PDA, laptop or on your desktop PC" Source=Paul Collins Startup list [mobsync] Number=6190 Confirmed=N Filename=mobsync.exe Description=MS Syncrhonization Manager - updates the network copy of materials that were edited offline, such as documents, calendars, and e-mail messages Source=Paul Collins Startup list [MOBSYNC32.EXE] Number=6191 Confirmed=X Filename=mobsync32.exe Description=Added by the FINERO TROJAN! Source=Paul Collins Startup list [MOD] Number=6192 Confirmed=N Filename=muamgr.exe Description=Using MicroAngelo On Display, you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system Source=Paul Collins Startup list [Modem] Number=6193 Confirmed=X Filename=locatesvc.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Modem Driverz Updates] Number=6194 Confirmed=X Filename=mdmdrv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MODEMBTR] Number=6195 Confirmed=U Filename=MODEMBTR.EXE Description=Modem Booster from inKline Global to improve ISP connections Source=Paul Collins Startup list [Modeminf] Number=6196 Confirmed=X Filename=Modeminf.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [ModemOnHold] Number=6197 Confirmed=U Filename=MOH.EXE Description=NetWaiting Modem-on-Hold Application Source=Paul Collins Startup list [ModemUtility] Number=6198 Confirmed=N Filename=mdmsetpe.exe Description=System Tray configuration icon for Aztech modems Source=Paul Collins Startup list [ModularConfig] Number=6199 Confirmed=X Filename=syscnfg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:\windows\fonts (or C:\winnt\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Module Call initialize] Number=6200 Confirmed=X Filename=RUNDLL32.EXE reg.dll, ondll_reg Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Modulo 00FE0F01 Host Internet] Number=6201 Confirmed=X Filename=syschost.exe Description=Added by the DELF-KW TROJAN! Source=Paul Collins Startup list [Money Express] Number=6202 Confirmed=N Filename=moneyexpress.exe Description=Part of MS Money. Available via Start -> Programs Source=Paul Collins Startup list [MoneyAgent] Number=6203 Confirmed=N Filename=money express.exe Description=Part of MS Money. Available via Start -> Programs Source=Paul Collins Startup list [MoneyAgent] Number=6204 Confirmed=N Filename=mnyexpr.exe Description=Microsoft Money Source=Paul Collins Startup list [MoneyStartUp] Number=6205 Confirmed=N Filename=Money Startup.exe Description=Microsoft Money Source=Paul Collins Startup list [MoneyStartUp10.0] Number=6206 Confirmed=N Filename=Activation.exe Description=Part of MS Money 2002. Available via Start -> Programs Source=Paul Collins Startup list [monitor] Number=6207 Confirmed=X Filename=monitor.exe Description=Browser hijacker, redirecting to NCM Search Source=Paul Collins Startup list [Monitor] Number=6208 Confirmed=U Filename=SD Monitor.exe Description="Transfer data quickly between your memory card and your computer with SanDisk's Readers, Writers and Adapters" Source=Paul Collins Startup list [Monitor Apache Servers] Number=6209 Confirmed=U Filename=ApacheMonitor.exe Description=Part of the Apache Web Server package. Useful only if you're running such a server on your PC. Available via Start -> Programs Source=Paul Collins Startup list [Monitor Helper] Number=6210 Confirmed=U Filename=monitor.exe Description=MyLittleSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Monitoring Service] Number=6211 Confirmed=X Filename=svchost.exe Description=Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "tasks" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Monitormgt] Number=6212 Confirmed=X Filename=Monitormgt.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [MonitorSD] Number=6213 Confirmed=U Filename=SDMonitor.exe Description=Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Source=Paul Collins Startup list [MONPluginSrIvcs] Number=6214 Confirmed=X Filename=n3monap23.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Monstersoundtray] Number=6215 Confirmed=N Filename=Freectrl.exe Description=Diamond Multimedia sound card control panel Source=Paul Collins Startup list [MonTest] Number=6216 Confirmed=X Filename=vccxzq.exe Description=Added by the SDBOT-EA WORM! Source=Paul Collins Startup list [MoodBook] Number=6217 Confirmed=U Filename=mb.exe Description=MoodBook is a free Windows utility that brings art to your desktop Source=Paul Collins Startup list [moon phase] Number=6218 Confirmed=N Filename=moon.exe Description=Moon Phase - tray icon that indicates the phases of the moon Source=Paul Collins Startup list [MoreResults] Number=6219 Confirmed=X Filename=MoreResults.exe Description=MoreResults adware Source=Paul Collins Startup list [Morpheus] Number=6220 Confirmed=N Filename=morpheus.exe Description=MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free, and a visitor quotes "I have seen no instance of any since using it" Source=Paul Collins Startup list [morphstb] Number=6221 Confirmed=X Filename=morphstb.exe Description=Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Stubby.c Source=Paul Collins Startup list [mosearch] Number=6222 Confirmed=X Filename=mosearch.exe Description=Fast Search in Office XP - similar to the new revision of the Find Fast feature in Office 2000. Fast Search uses the Indexing Services in Office XP to create a catalog of Office files on your computer's hard disk. As with Find Fast - a waste of resources. If it can't be disabled via MSCONFIG try here Source=Paul Collins Startup list [Motherboard Config] Number=6223 Confirmed=X Filename=Ati2xxx.exe Description=Added by the RBOT-AIK WORM! Source=Paul Collins Startup list [MotherBoard Sounds] Number=6224 Confirmed=X Filename=Sounds.exe Description=Added by the RBOT-AAP WORM! Source=Paul Collins Startup list [Motive SmartBridge] Number=6225 Confirmed=N Filename=mpbtn.exe Description=System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [Motive SmartBridge] Number=6226 Confirmed=N Filename=MotiveSB.exe Description=System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [Motive SmartBridge] Number=6227 Confirmed=N Filename=BTHelpNotifier.exe Description=System tray icon for help from BT Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [MotiveMonitor] Number=6228 Confirmed=U Filename=motmon.exe Description=Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used�the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required Source=Paul Collins Startup list [MotiveSB] Number=6229 Confirmed=N Filename=MotiveSB.exe Description=System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [MotMon] Number=6230 Confirmed=U Filename=motmon.exe Description=Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used�the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required Source=Paul Collins Startup list [motoin] Number=6231 Confirmed=X Filename=mm15201518.Stub.exe Description=Delfin Promulgate adware variant Source=Paul Collins Startup list [Motorola Desktop Suite] Number=6232 Confirmed=U Filename=DesktopSuite.exe Description=Related to Motorola Desktop Suite - PC software managing Motorola mobiles such as the A1000 Source=Paul Collins Startup list [Motorola Desktop Suite mRouter Config] Number=6233 Confirmed=U Filename=mRouterConfig.exe Description=Configuration for Intuwave's mRouter - "that enables easy connectivity between mobile devices and PCs across Bluetooth, Infrared, USB and serial cable connections". An integral component of Symbian OS that is provided to all Symbian licensees Source=Paul Collins Startup list [Mount Safe & Sound] Number=6234 Confirmed=U Filename=Fbmount.exe Description=From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start Source=Paul Collins Startup list [mouse] Number=6235 Confirmed=X Filename=mouse.exe Description=Added by the RBOT-AHJ WORM! Source=Paul Collins Startup list [Mouse 32A] Number=6236 Confirmed=N Filename=Mouse32A.exe Description=Mouse driver to control mouse functions from Azona. Available via Start -> Programs Source=Paul Collins Startup list [Mouse Suite 98 Daemon] Number=6237 Confirmed=N Filename=pelmiced.exe Description=Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Source=Paul Collins Startup list [Mouse Suite 98 Daemon] Number=6238 Confirmed=N Filename=ICO.EXE Description=Found on Sony Vaio and IBM Thinkpad (and possibly other) laptops and seems to be related to Mouse Suite 98 Daemon according to the properties. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Source=Paul Collins Startup list [mousebut] Number=6239 Confirmed=X Filename=mousebut.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [Mousecntl] Number=6240 Confirmed=X Filename=mousecntl.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [MouseCount] Number=6241 Confirmed=N Filename=MC.exe Description=MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required Source=Paul Collins Startup list [MouseDrv] Number=6242 Confirmed=X Filename=[path to worm] Description=Added by the ZOLOAD-B WORM! Source=Paul Collins Startup list [MouseDrv] Number=6243 Confirmed=X Filename=update.exe Description=Added by the ZOTOB.N WORM! Source=Paul Collins Startup list [mouseElf] Number=6244 Confirmed=U Filename=MC.exe Description=Genius NetScroll mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [mouseElf] Number=6245 Confirmed=U Filename=mouseElf.exe Description=System Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features Source=Paul Collins Startup list [MouseImp] Number=6246 Confirmed=U Filename=MImpHost.exe Description=MouseImp Pro - "A reliable assistant that turns your mouse into a simple, native but powerful controlling device" Source=Paul Collins Startup list [mousepad] Number=6247 Confirmed=X Filename=mousepad.exe Description=Added by the CLICKER TROJAN! Source=Paul Collins Startup list [Mousinfo] Number=6248 Confirmed=U Filename=mousinfo.exe Description=MS mouse information tool - for troubleshooting mouse problems Source=Paul Collins Startup list [MoussaEvil] Number=6249 Confirmed=X Filename=[path to file] Description=Added by the MUSANUB-A WORM! Source=Paul Collins Startup list [MoveSearch] Number=6250 Confirmed=X Filename=Search.exe Description=PigSearch adware Source=Paul Collins Startup list [Movielink Manager Uninstall] Number=6251 Confirmed=N Filename=msvcmm32.exe Description=Auto-update for Movielink - internet movie rental System Tray access Source=Paul Collins Startup list [MovieM] Number=6252 Confirmed=X Filename=lmovie.exe Description=Added by the BEAGLE.DS WORM! Source=Paul Collins Startup list [moviemk] Number=6253 Confirmed=X Filename=moviemk.exe Description=Added by the DWNLDR-GTB TROJAN! Source=Paul Collins Startup list [MovieNetworks] Number=6254 Confirmed=X Filename=MovieNetworks.exe Description=MovieNetworks will connect you by DOMESTIC PREMIUM RATE TELEPHONE NUMBER 900-xxx-xxxx. So you get xxx rated pictures and junk. And it will allow you to stay on the internet on their line and $$$ and remove the C:\Program Files\MovieNetworks directory Source=Paul Collins Startup list [Movieplace] Number=6255 Confirmed=X Filename=Movieplace.exe Description=MoviePlace malware Source=Paul Collins Startup list [Mozila] Number=6256 Confirmed=X Filename=mozila.exe Description=Added by the DELBOT-AJ WORM! Source=Paul Collins Startup list [Mozila Firefox] Number=6257 Confirmed=X Filename=firebox.exe Description=Added by the RBOT-AIP WORM! Source=Paul Collins Startup list [Mozilla Firefox] Number=6258 Confirmed=X Filename=F1REF0X.EXE Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mozilla Quick Launch] Number=6259 Confirmed=N Filename=Netscp6.exe Description=Netscape 6 and Mozilla browsers Source=Paul Collins Startup list [Mozilla Quick Launch] Number=6260 Confirmed=N Filename=Mozilla.exe Description=Netscape 6 and Mozilla browsers Source=Paul Collins Startup list [Mozy Status] Number=6261 Confirmed=U Filename=mozystat.exe Description=Mozy - free backup at a secure, remote location Source=Paul Collins Startup list [MP Tcloakss] Number=6262 Confirmed=X Filename=mptclock.exe Description=Added by the NACKBOT-B WORM! Source=Paul Collins Startup list [MP Tcloaxs] Number=6263 Confirmed=X Filename=mptcloaxs.exe Description=Added by the RANDEX.CT WORM! Source=Paul Collins Startup list [MP Tclockvv] Number=6264 Confirmed=X Filename=mptclock.exe Description=Added by the NACKBOT-A WORM! Source=Paul Collins Startup list [Mp3 Loader] Number=6265 Confirmed=X Filename=Sysdata.EXE Description=Added by the AVETTE-A VIRUS! Source=Paul Collins Startup list [MP3download] Number=6266 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [MPEO] Number=6267 Confirmed=U Filename=Csinsm32.exe Description=Automatic logging of installs from Norton CleanSweep - available via Start -> Programs Source=Paul Collins Startup list [MPFExe] Number=6268 Confirmed=Y Filename=mpf.exe Description=McAfee Personal Firewall Source=Paul Collins Startup list [MPFExe] Number=6269 Confirmed=Y Filename=MpfTray.exe Description=McAfee Personal Firewall Source=Paul Collins Startup list [MPFTray] Number=6270 Confirmed=Y Filename=MpfTray.exe Description=McAfee Personal Firewall Source=Paul Collins Startup list [MPL32 driver] Number=6271 Confirmed=X Filename=MPL32.exe Description=Added by the LOONY-M TROJAN! Source=Paul Collins Startup list [MPlay64] Number=6272 Confirmed=X Filename=mplay64.exe Description=Added by the MPLAY64 TROJAN! Source=Paul Collins Startup list [MplSetup] Number=6273 Confirmed=U Filename=MplSetup.exe Description=Used by Ricoh network printers to enable network printing from the client Source=Paul Collins Startup list [MPM Manager] Number=6274 Confirmed=X Filename=MPM.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [MPNet] Number=6275 Confirmed=X Filename=mpn.exe Description=Added by the DELBOT-W WORM! Source=Paul Collins Startup list [MPower] Number=6276 Confirmed=U Filename=MPower.exe Description=MPower from MindBeat. "Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your CPU load". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [mppdds] Number=6277 Confirmed=X Filename=mppdds.exe Description=Added by the PWS-AKZ TROJAN! Source=Paul Collins Startup list [mppds] Number=6278 Confirmed=X Filename=mppds.exe Description=Added by the LEGMIR.AQZ TROJAN! Source=Paul Collins Startup list [MPR MSG] Number=6279 Confirmed=X Filename=mprmsg32.exe Description=Added by the MYTOB.CF WORM! Source=Paul Collins Startup list [MPREXE] Number=6280 Confirmed=X Filename=MPREXE.EXE Description=Added by the OPASERV.T WORM! Note - this is not the legitimate Mprexe.exe system file Source=Paul Collins Startup list [MPREXE.exe] Number=6281 Confirmed=Y Filename=mprexe.exe Description=WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus Source=Paul Collins Startup list [MprHTML] Number=6282 Confirmed=X Filename=MprHTML.exe Description=Added by a variant of the VAGRNOCKER TROJAN! Source=Paul Collins Startup list [mprocessor] Number=6283 Confirmed=X Filename=mprocessor.exe Description=InstallDollars.com foistware Source=Paul Collins Startup list [MPSExe] Number=6284 Confirmed=U Filename=mscifapp.exe Description=McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering" Source=Paul Collins Startup list [MpsOnn] Number=6285 Confirmed=Y Filename=MpsOnn.exe Description=Canon printer driver Source=Paul Collins Startup list [MPT] Number=6286 Confirmed=? Filename=MPT.exe Description=?? Source=Paul Collins Startup list [MPtask Services] Number=6287 Confirmed=X Filename=mptask.exe Description=Added by the LALA or AOT TROJANS! Source=Paul Collins Startup list [MPTBox] Number=6288 Confirmed=N Filename=MPTBOX.EXE Description=Cannon Multi-Pass toolbox - a button bar Source=Paul Collins Startup list [mptsgsvc.exe] Number=6289 Confirmed=X Filename=mptsgsvc.exe Description=Hacker Tool - detected by DiamondCS TDS-3 anti-trojan as "HackTool.Win32.Hidd.j" Source=Paul Collins Startup list [MPXTray] Number=6290 Confirmed=N Filename=mpxptray.exe Description=Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause, next,previous) etc Source=Paul Collins Startup list [MP_STATUS_MONITOR] Number=6291 Confirmed=U Filename=monitr32.exe Description=Cannon Multi-Pass status monitor - your choice Source=Paul Collins Startup list [mqbkup] Number=6292 Confirmed=X Filename=mqbkup.exe Description=Added by the OPASERV.K WORM! Source=Paul Collins Startup list [mrsvctr] Number=6293 Confirmed=X Filename=mrsvctr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [mrtMngr] Number=6294 Confirmed=N Filename=mrtMngr.exe Description=Maintenance Release Task Manager for Intuit's QuickBooks or Quicken Source=Paul Collins Startup list [MRU-Blaster Scheduler] Number=6295 Confirmed=U Filename=scheduler.exe Description=Scheduler for MRU-Blaster - "a program made to do one large task - detect and clean MRU (most recently used) lists on your computer" Source=Paul Collins Startup list [MRU-Blaster Silent Clean] Number=6296 Confirmed=N Filename=mrublaster.exe Description=MRU-Blaster - performs silent cleaning of MRU lists at boot Source=Paul Collins Startup list [MRUBlaster] Number=6297 Confirmed=U Filename=indexcleaner.exe Description=MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder Source=Paul Collins Startup list [ms] Number=6298 Confirmed=X Filename=svhost32.exe Description=Added by the LEGMIR-AQO TROJAN! Source=Paul Collins Startup list [MS Auto-IPSec Protection] Number=6299 Confirmed=X Filename=MSASP32.exe Description=Added by the RBOT-AER WORM! Source=Paul Collins Startup list [MS Autoloader 32] Number=6300 Confirmed=X Filename=MSAuto32.exe Description=Added by the SPYBOT.BD WORM! Source=Paul Collins Startup list [Ms Builders] Number=6301 Confirmed=X Filename=Wupated.exe Description=Added by the AGOBOT-SS WORM! Source=Paul Collins Startup list [MS Config] Number=6302 Confirmed=X Filename=msdconfig.exe Description=Added by the RBOT-CZH WORM! Source=Paul Collins Startup list [MS Config Loader] Number=6303 Confirmed=X Filename=svchos1.exe Description=Added by the AGOBOT.R WORM! Source=Paul Collins Startup list [MS Config Loader] Number=6304 Confirmed=X Filename=MSWin32bck.exe Description=Added by the GAOBOT.AA WORM! Source=Paul Collins Startup list [MS Config Loader] Number=6305 Confirmed=X Filename=svcrhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS Config Service] Number=6306 Confirmed=X Filename=Msloader32.exe Description=Added by the RBOT-KJ WORM! Source=Paul Collins Startup list [MS Config v13] Number=6307 Confirmed=U Filename=lrbz32.exe Description=Added by the GAOBOT.AOL WORM! Source=Paul Collins Startup list [Ms configsu] Number=6308 Confirmed=X Filename=msconfigsu.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS Configuration] Number=6309 Confirmed=X Filename=MSFramer.exe Description=Added by the RANDEX.OL WORM! Source=Paul Collins Startup list [Ms Configuration] Number=6310 Confirmed=X Filename=microsoftsa32.exe Description=Added by the KELVIR.X WORM! Source=Paul Collins Startup list [MS DATABASE] Number=6311 Confirmed=X Filename=MSDATA32.EXE Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS Decryption Software] Number=6312 Confirmed=X Filename=active.exe Description=MediaTickets adware variant Source=Paul Collins Startup list [MS DirectX Sound Drivers] Number=6313 Confirmed=X Filename=msdrvdx.exe Description=Added by the RBOT.BCX WORM! Source=Paul Collins Startup list [MS DLL Library Manager] Number=6314 Confirmed=X Filename=dllsys64.exe Description=Added by the RANKY TROJAN! Source=Paul Collins Startup list [MS Domain Name Server Deamon] Number=6315 Confirmed=X Filename=MSDNSD32.exe Description=Added by the RBOT-CMZ WORM! Source=Paul Collins Startup list [MS Domain Name System] Number=6316 Confirmed=X Filename=MSWDNS32.exe Description=Added by the RBOT-GKY WORM! Source=Paul Collins Startup list [MS DVD DirectX Dll Drivers] Number=6317 Confirmed=X Filename=mdxdl.exe Description=Added by the SDBOT-XI WORM! Source=Paul Collins Startup list [MS DVD DirectX Sound Drivers] Number=6318 Confirmed=X Filename=msdrvdx.exe Description=Added by the SDBOT-XJ WORM! Source=Paul Collins Startup list [MS Explorer] Number=6319 Confirmed=X Filename=mexplore.exe Description=Added by the YAHA.AE WORM! Source=Paul Collins Startup list [MS FIREWALL] Number=6320 Confirmed=X Filename=msfrewall.exe Description=Added by the SDBOT-PU WORM! Source=Paul Collins Startup list [MS FIREWALL] Number=6321 Confirmed=X Filename=msfirewall.exe Description=Added by the SDBOT-QH WORM! Source=Paul Collins Startup list [MS HTML] Number=6322 Confirmed=X Filename=msHtml.exe Description=Added by the PESTDOOR.31 TROJAN! Source=Paul Collins Startup list [MS HTML] Number=6323 Confirmed=X Filename=mslat.exe Description=Added by the LATINUS.SVR TROJAN! Source=Paul Collins Startup list [MS HTML Location Class] Number=6324 Confirmed=X Filename=MSHTML32.exe Description=Added by the RBOT-YD WORM! Source=Paul Collins Startup list [MS Internet Executor 32] Number=6325 Confirmed=X Filename=MSIXEC32.exe Description=Added by the RBOT-AEQ WORM! Source=Paul Collins Startup list [MS Java Applets for Windows NT & XP] Number=6326 Confirmed=X Filename=javaapplet.exe Description=Added by the RBOT.BHG WORM! Source=Paul Collins Startup list [MS Java Applets for Windows NT, ME & XP] Number=6327 Confirmed=U Filename=javaapplets.exe Description=Added by the VANEBOT-B WORM! Source=Paul Collins Startup list [Ms Java for Windows 98, NT, ME & XP] Number=6328 Confirmed=X Filename=msjavames.exe Description=Added by the RBOT.BHJ WORM! Source=Paul Collins Startup list [Ms Java for Windows 98, NT, XP & ME] Number=6329 Confirmed=X Filename=msjavaxps.exe Description=Added by the BACKDOOR.GEN TROJAN! Source=Paul Collins Startup list [Ms Java for Windows NT] Number=6330 Confirmed=X Filename=MS32.exe Description=Added by the VANEBOT-H WORM! Source=Paul Collins Startup list [Ms Java for Windows NT] Number=6331 Confirmed=X Filename=msi32java.exe Description=Added by the VANEBOT-I WORM! Source=Paul Collins Startup list [Ms Java for Windows NT] Number=6332 Confirmed=X Filename=msjava.exe Description=Added by the VANEBOT-E WORM! Source=Paul Collins Startup list [MS Java for Windows NT, XP & ME] Number=6333 Confirmed=X Filename=xpjavams.exe Description=Added by the KASSBOT-V WORM! Source=Paul Collins Startup list [MS Java for Windows XP & NT] Number=6334 Confirmed=X Filename=javanet.exe Description=Added by the VANEBOT-A WORM! Source=Paul Collins Startup list [MS Java Service Wrapper for Windows NT & XP] Number=6335 Confirmed=U Filename=wrapper.exe Description=Added by the VANEBOT-D WORM! Source=Paul Collins Startup list [Ms Java Update For Windows NT/XP] Number=6336 Confirmed=X Filename=msijavaupdt32.exe Description=Added by the RANDEX.AF WORM! Source=Paul Collins Startup list [MS lsass Startup] Number=6337 Confirmed=X Filename=lsass135.exe Description=Added by the RBOT.WM WORM! Source=Paul Collins Startup list [MS management console] Number=6338 Confirmed=? Filename=mms.exe Description=Suspicious as the legitimate "Microsoft Management Console" is "mmc.exe" and not "mms.exe" and doesn't normally run at startup Source=Paul Collins Startup list [MS Microsoft Socket Deamon] Number=6339 Confirmed=X Filename=MSSCKD32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS MSN Menssenger 7.0] Number=6340 Confirmed=X Filename=MSMSN7.exe Description=Added by the RBOT-ACA WORM! Source=Paul Collins Startup list [MS MSN Menssenger 7.0] Number=6341 Confirmed=X Filename=MSEXPORT.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS Network Control] Number=6342 Confirmed=X Filename=mswin.exe Description=Added by the DUMBA TROJAN! Source=Paul Collins Startup list [ms ownage] Number=6343 Confirmed=X Filename=winPE.exe Description=Added by the RBOT-AJL WORM! Source=Paul Collins Startup list [MS PLUS INC] Number=6344 Confirmed=X Filename=wpad.exe Description=Added by the MYTOB-AN WORM! Source=Paul Collins Startup list [Ms Processe Manager] Number=6345 Confirmed=X Filename=msproc.exe Description=Added by the RBOT.ATO WORM! Source=Paul Collins Startup list [MS Real Player] Number=6346 Confirmed=X Filename=RealPlyr.exe Description=Added by the RBOT.MR WORM! Source=Paul Collins Startup list [MS Registry Service] Number=6347 Confirmed=X Filename=MSRMS32.exe Description=Added by the RBOT-AKP WORM! Source=Paul Collins Startup list [MS Remote Procedure Call] Number=6348 Confirmed=X Filename=msrpc32.exe Description=Added by the RBOT-QL WORM! Source=Paul Collins Startup list [MS Screen Saver] Number=6349 Confirmed=X Filename=scrsave.scr Description=Added by the RBOT-AGT WORM! Source=Paul Collins Startup list [MS Security] Number=6350 Confirmed=X Filename=systm.pif Description=Added by the RBOT-AQN WORM! Source=Paul Collins Startup list [MS Security Authority Service] Number=6351 Confirmed=X Filename=lsass.exe Description=Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [MS Security Hotfix] Number=6352 Confirmed=X Filename=service5.exe Description=Added by the GAOBOT.AG WORM! Source=Paul Collins Startup list [MS Security Update 993] Number=6353 Confirmed=X Filename=msident.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS service] Number=6354 Confirmed=X Filename=msservice.exe Description=Added by the RBOT-ZG WORM! Source=Paul Collins Startup list [MS Service Drivers] Number=6355 Confirmed=X Filename=winscv.exe Description=Added by the SDBOT-COG WORM! Source=Paul Collins Startup list [Ms sock for Windows NT] Number=6356 Confirmed=X Filename=winser.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS Sound Config 16bit] Number=6357 Confirmed=X Filename=sndcfg16.exe Description=Added by the SDBOT.MB TROJAN! Source=Paul Collins Startup list [Ms Sound Drivers] Number=6358 Confirmed=X Filename=msdrv.exe Description=Added by the SDBOT-WR WORM! Source=Paul Collins Startup list [Ms Spool32] Number=6359 Confirmed=X Filename=MS SPOOL32.EXE Description=Added by the ASASSIN TROJAN! Source=Paul Collins Startup list [MS SyS Restore] Number=6360 Confirmed=X Filename=sysrestore.exe Description=Added by the RBOT.XM WORM! Source=Paul Collins Startup list [MS Sys Security] Number=6361 Confirmed=X Filename=mswin.pif Description=Added by the RBOT-APJ WORM! Source=Paul Collins Startup list [MS System Call Function] Number=6362 Confirmed=X Filename=msscf32.exe Description=Added by the RBOT-GBZ WORM! Source=Paul Collins Startup list [Ms System Config] Number=6363 Confirmed=X Filename=Mscfg.exe Description=Added by the SDBOT-CCR WORM! Source=Paul Collins Startup list [Ms System Config] Number=6364 Confirmed=X Filename=pcedit.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MS System Security] Number=6365 Confirmed=X Filename=mswin32.pif Description=Added by the RBOT-AOX WORM! Source=Paul Collins Startup list [Ms task manager] Number=6366 Confirmed=X Filename=tskmgr.exe Description=Added by the SDBOT.CCD WORM! Source=Paul Collins Startup list [MS taskbar] Number=6367 Confirmed=X Filename=crssr.exe Description=Added by the RBOT-AGO WORM! Source=Paul Collins Startup list [MS taskbar] Number=6368 Confirmed=X Filename=nts.exe Description=Added by the RBOT-AGB WORM! Source=Paul Collins Startup list [MS taskbar] Number=6369 Confirmed=X Filename=taskbars.exe Description=Added by the RBOT.BRW WORM! Source=Paul Collins Startup list [MS Taskbars] Number=6370 Confirmed=X Filename=taskbars.exe Description=Added by the SDBOT-ACV WORM! Source=Paul Collins Startup list [MS taskmanager] Number=6371 Confirmed=X Filename=tskmgr.exe Description=Added by the RBOT-AKA WORM! Source=Paul Collins Startup list [MS UniX] Number=6372 Confirmed=X Filename=navupdate64.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6373 Confirmed=X Filename=win32ttb.exe Description=Added by the SPYBOT.OQ WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6374 Confirmed=X Filename=msmq2inst.exe Description=Added by the RBOT-YF WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6375 Confirmed=X Filename=msnupdate.exe Description=Added by the RBOT-AAM WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6376 Confirmed=X Filename=outlookexpressupdate.exe Description=Added by the RBOT-YU WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6377 Confirmed=X Filename=Win32Update.exe Description=Added by the RBOT-BAS WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6378 Confirmed=X Filename=Norton2005Update.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6379 Confirmed=X Filename=trmupdate.exe Description=Added by the RBOT-ACC WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6380 Confirmed=X Filename=WinGuard.exe Description=Added by the RBOT-ACL WORM! Source=Paul Collins Startup list [MS Unix Binary] Number=6381 Confirmed=X Filename=msnq3insller.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS Update] Number=6382 Confirmed=X Filename=syshost.exe Description=Added by the EVAMAN-F WORM! Source=Paul Collins Startup list [Ms Update WinServices NT/XP] Number=6383 Confirmed=X Filename=winservnt32.exe Description=Added by the VANEBOT-G WORM! Source=Paul Collins Startup list [MS Updates] Number=6384 Confirmed=X Filename=mscache.exe Description=Spyware web downloader Source=Paul Collins Startup list [MS Updates] Number=6385 Confirmed=X Filename=syshosts.exe Description=Added by the MYDOOM.Y WORM! Source=Paul Collins Startup list [MS Updates] Number=6386 Confirmed=X Filename=aupd.exe Description=Spyware web downloader Source=Paul Collins Startup list [MS Updating Utility] Number=6387 Confirmed=X Filename=msupdater.exe Description=Added by the RBOT-XR WORM! Source=Paul Collins Startup list [MS USB 2.0 Windows Support] Number=6388 Confirmed=X Filename=msusb32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Ms Valud Loader] Number=6389 Confirmed=X Filename=Svhots.exe Description=Added by the AGOBOT-SP WORM! Source=Paul Collins Startup list [ms window update] Number=6390 Confirmed=X Filename=******.exe [* = random character] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MS Windows AOL Driver] Number=6391 Confirmed=X Filename=MSAOLdrv.exe Description=Added by the RBOT-ASP WORM! Source=Paul Collins Startup list [MS windows Data list process] Number=6392 Confirmed=X Filename=MSDATLST.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [MS Windows procces 32] Number=6393 Confirmed=X Filename=msprocces.exe Description=Added by the RBOT-AEZ WORM! Source=Paul Collins Startup list [MS Windows Process Class] Number=6394 Confirmed=X Filename=MSPRCSS32.exe Description=Added by the RBOT-YQ WORM! Source=Paul Collins Startup list [MS Windows Process Init] Number=6395 Confirmed=X Filename=MSWPI32.exe Description=Added by the RBOT-ASQ WORM! Source=Paul Collins Startup list [MS Windows Security Updater] Number=6396 Confirmed=X Filename=updater.pif Description=Added by the RBOT-AKY WORM! Source=Paul Collins Startup list [MS Windows System Alert] Number=6397 Confirmed=X Filename=MSWSA32.exe Description=Added by the RBOT-BFN WORM! Source=Paul Collins Startup list [MS Windows Update] Number=6398 Confirmed=X Filename=scguard.exe Description=Added by the RBOT-YZ WORM! Source=Paul Collins Startup list [MS WINS Binary] Number=6399 Confirmed=X Filename=ign32.pif Description=Added by the RBOT-ASB WORM! Source=Paul Collins Startup list [ms************* [* = random digit]] Number=6400 Confirmed=X Filename=ms*************.exe [* = random digit] Description=WINBO adware Source=Paul Collins Startup list [Ms**.exe [* = random char]] Number=6401 Confirmed=X Filename=Ms**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Ms**32.exe [* = random char]] Number=6402 Confirmed=X Filename=Ms**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [MS-Connect] Number=6403 Confirmed=X Filename=arr.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-Connect] Number=6404 Confirmed=X Filename=cdm.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-Connect] Number=6405 Confirmed=X Filename=game.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-Connect] Number=6406 Confirmed=X Filename=msite18.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-Connect] Number=6407 Confirmed=X Filename=web.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-DOS Boot Service] Number=6408 Confirmed=X Filename=Boot32.pif Description=Added by the RBOT-AMF WORM! Source=Paul Collins Startup list [MS-DOS Security Service] Number=6409 Confirmed=X Filename=ms-dos.pif Description=Added by the RBOT-AMR WORM! Source=Paul Collins Startup list [MS-DOS Service] Number=6410 Confirmed=X Filename=MS-DOS.pif Description=Added by the RBOT-AII WORM! Source=Paul Collins Startup list [MS-DOS Windows Service] Number=6411 Confirmed=X Filename=MS-DOS.PIF Description=Added by the RBOT-AJW WORM! Source=Paul Collins Startup list [MS-HTML] Number=6412 Confirmed=X Filename=[random filename] Description=Added by the LATINUS.15 TROJAN! Source=Paul Collins Startup list [MS-patch] Number=6413 Confirmed=X Filename=msconfig32.exe Description=Added by the RBOT-AUF WORM! Source=Paul Collins Startup list [MS-patch] Number=6414 Confirmed=X Filename=mspatch32.exe Description=Added by the RBOT-AWF TROJAN! Source=Paul Collins Startup list [MS-RunKey] Number=6415 Confirmed=X Filename=arr.exe Description=MS-Connect dialler/hijacker Source=Paul Collins Startup list [ms2src] Number=6416 Confirmed=X Filename=ms2src.exe Description=Added by a TROJAN - see here Source=Paul Collins Startup list [MS32DLL] Number=6417 Confirmed=X Filename=achi.dll.vbs Description=Added by the ACHI-A TROJAN! Source=Paul Collins Startup list [MS32DLL] Number=6418 Confirmed=X Filename=Bha.dll.vbs Description=Added by the BUTSUR-A WORM! Source=Paul Collins Startup list [MS32DLL] Number=6419 Confirmed=X Filename=Bha.dll.vbs Description=Added by the BUTSUR-A WORM! Source=Paul Collins Startup list [MS7531] Number=6420 Confirmed=X Filename=ms7531.exe Description=Homepage hijacker Source=Paul Collins Startup list [MSACM] Number=6421 Confirmed=X Filename=msacm.exe Description=Added by the OPASERV-O WORM! Source=Paul Collins Startup list [msadcheck] Number=6422 Confirmed=X Filename=msadcheck32.exe Description=Browser hijacker, redirecting to search-system.com Source=Paul Collins Startup list [MSAdmin] Number=6423 Confirmed=X Filename=jdbgmrg.exe Description=Added by the DASMIN.A TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here Source=Paul Collins Startup list [MSAgent] Number=6424 Confirmed=X Filename=mshtm.exe Description=Browser hijacker - redirecting to buldog-search.com Source=Paul Collins Startup list [MSAgent] Number=6425 Confirmed=X Filename=hhnt.exe Description=Added by the AGENT.JI spyware Source=Paul Collins Startup list [MSAgentXP] Number=6426 Confirmed=X Filename=MSAgentXP.exe Description=Reported by Ewido Security Suite as TrojanDownloader.Reqlook.c Source=Paul Collins Startup list [msaim] Number=6427 Confirmed=U Filename=msaolim.exe Description=MessageSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [msappts32] Number=6428 Confirmed=X Filename=msappts32.exe Description=Added by the ELBURRO-A TROJAN! Source=Paul Collins Startup list [MsAudio] Number=6429 Confirmed=X Filename=explorer.exe Description=Added by the LEGMIR-BY TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [MsAudio] Number=6430 Confirmed=X Filename=MsVM_STI.EXE RunDll32 cmicnfg.cpl, CMICtrlWnd Description=Added by the LEGMIR-BY TROJAN! Note - this is not associated with C-Media based audio which uses a similar command entry (see here) Source=Paul Collins Startup list [MSbackups] Number=6431 Confirmed=X Filename=backups.exe Description=Added by the BANLOAD-TL TROJAN! Source=Paul Collins Startup list [MSBB] Number=6432 Confirmed=X Filename=msbb.exe Description=Advertising spyware Source=Paul Collins Startup list [msbcs] Number=6433 Confirmed=X Filename=msbcs.exe Description=Added by the DADOBRA-G TROJAN! Source=Paul Collins Startup list [MsBootMgr.exe] Number=6434 Confirmed=X Filename=MsBootMgr.exe Description=Added by the VERIFY TROJAN! Source=Paul Collins Startup list [msbsc] Number=6435 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-DF TROJAN! Source=Paul Collins Startup list [msccrt] Number=6436 Confirmed=X Filename=msccrt.exe Description=Added by the PWS-ALA TROJAN! Source=Paul Collins Startup list [mschkdf.exe] Number=6437 Confirmed=X Filename=mschkdf.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MSChoExE] Number=6438 Confirmed=X Filename=suge.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [msci] Number=6439 Confirmed=? Filename=mcinfo.exe Description=McAfee Internet Security related. What does it do and is it required? Source=Paul Collins Startup list [mscman] Number=6440 Confirmed=X Filename=mscman.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [mscn] Number=6441 Confirmed=U Filename=mscn.exe Description=Part of the SafeChildNet internet filtering program - required if you use it Source=Paul Collins Startup list [Mscnt] Number=6442 Confirmed=X Filename=mscnt.exe Description=Added by the DLUCA-C TROJAN! Source=Paul Collins Startup list [Mscolour] Number=6443 Confirmed=X Filename=mscolour.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [MSCommX] Number=6444 Confirmed=X Filename=mscommx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSCONFG32.EXE] Number=6445 Confirmed=X Filename=MSCONFG32.EXE Description=Added by the OPTIX.04.C TROJAN! Source=Paul Collins Startup list [MSConfig] Number=6446 Confirmed=N Filename=msconfig.exe Description=Entry that appears when you uncheck an item in the MSConfig Startup group, and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode Source=Paul Collins Startup list [MSConfig] Number=6447 Confirmed=X Filename=MSCONFIG32.EXE Description=Added by the SPYBOT.B WORM! Source=Paul Collins Startup list [msconfig] Number=6448 Confirmed=X Filename=msconfig.exe Description=CoolWebSearch parasite related. Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting Source=Paul Collins Startup list [Msconfig] Number=6449 Confirmed=X Filename=msconfig.exe Description=Added by the WINUR WORM! Note - this is not the real msconfig.exe as it's located in C:\winrun\ Source=Paul Collins Startup list [msconfig] Number=6450 Confirmed=X Filename=wins.exe Description=Added by the RBOT.PF WORM! Source=Paul Collins Startup list [MSConfig] Number=6451 Confirmed=X Filename=MSCONFIG35.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [msconfig] Number=6452 Confirmed=X Filename=scvhost.exe Description=Added by the AGENT-DSF TROJAN! Source=Paul Collins Startup list [msconfig] Number=6453 Confirmed=X Filename=winlog.exe Description=Added by the IRCBOT-TJ TROJAN! Source=Paul Collins Startup list [Msconfig] Number=6454 Confirmed=X Filename=icpldrvx.exe Description=Added by the BANLOAD.BFT TROJAN! Source=Paul Collins Startup list [msconfig] Number=6455 Confirmed=X Filename=msconfig.com Description=Added by the IRCBOT-SM WORM! Source=Paul Collins Startup list [Msconfig lptt01] Number=6456 Confirmed=X Filename=msconfig.exe Description=RapidBlaster variant (in a "msconfig" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name Source=Paul Collins Startup list [MSConfig Manager] Number=6457 Confirmed=X Filename=msupdate.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Msconfig ml097e] Number=6458 Confirmed=X Filename=msconfig.exe Description=RapidBlaster variant (in a "msconfig" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name Source=Paul Collins Startup list [msconfig service] Number=6459 Confirmed=X Filename=MSupdate32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [msconfig.exe] Number=6460 Confirmed=X Filename=proxy.exe Description=Added by a variant of the AGENT.AH downloader TROJAN! Source=Paul Collins Startup list [msconfig.exe] Number=6461 Confirmed=X Filename=uline.exe Description=Added by a variant of the AGENT.AH downloader TROJAN! Source=Paul Collins Startup list [msconfig38] Number=6462 Confirmed=X Filename=mssvcc.exe Description=Added by the RBOT-BJV WORM! Source=Paul Collins Startup list [MSConfig45] Number=6463 Confirmed=X Filename=MSConfig45.exe Description=Added by the SDBOT.OJ TROJAN! Source=Paul Collins Startup list [MSConfigr] Number=6464 Confirmed=X Filename=jdbgmrg.exe Description=Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here Source=Paul Collins Startup list [MSConfigReminder] Number=6465 Confirmed=N Filename=msconfig.exe Description=Entry that appears when you uncheck an item in the MSConfig Startup group, and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode Source=Paul Collins Startup list [MsConfigs] Number=6466 Confirmed=X Filename=MsConfigs.exe Description=Added by the ALCAN.A WORM! Source=Paul Collins Startup list [MSControl28] Number=6467 Confirmed=X Filename=crsss.exe Description=Added by the SPYBOT.AJX WORM! Source=Paul Collins Startup list [MSControl31] Number=6468 Confirmed=X Filename=winnsyst.exe Description=Added by the RBOT.CFY WORM! Source=Paul Collins Startup list [MSControl3d1] Number=6469 Confirmed=X Filename=isasse.exe Description=Added by the RBOT.CGU WORM! Source=Paul Collins Startup list [MSCORE] Number=6470 Confirmed=X Filename=syscnfg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:\windows\fonts (or C:\winnt\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Mscsgs] Number=6471 Confirmed=X Filename=MSCSGS.EXE Description=Added by the ZEZER WORM! Source=Paul Collins Startup list [Mscsgs32] Number=6472 Confirmed=X Filename=MSCSGS32.EXE Description=Added by the ZEZER WORM! Source=Paul Collins Startup list [mscsvc.exe] Number=6473 Confirmed=X Filename=mscsvc.exe Description=Added by the BANCOS.T TROJAN! Source=Paul Collins Startup list [Msctrl32] Number=6474 Confirmed=X Filename=Msctrl32.scr Description=Added by the REDIST WORM! Source=Paul Collins Startup list [MSCVT] Number=6475 Confirmed=X Filename=MSCVT.exe Description=Added by the SLIDESHOW WORM! Source=Paul Collins Startup list [MSDcom] Number=6476 Confirmed=X Filename=MSDcom.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [msdev] Number=6477 Confirmed=X Filename=msdev.exe Description=Added by the FORBOT-CR WORM! Source=Paul Collins Startup list [msdev] Number=6478 Confirmed=X Filename=msconfig.exe Description=Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting Source=Paul Collins Startup list [msdirect.exe] Number=6479 Confirmed=X Filename=msdirect.exe Description=Added by the CERTIF-L TROJAN! Source=Paul Collins Startup list [MSDLL] Number=6480 Confirmed=X Filename=syscnfg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:\windows\fonts (or C:\winnt\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Msdmxm] Number=6481 Confirmed=X Filename=msdmxm.exe Description=Added by the DLOAD-DC TROJAN! Source=Paul Collins Startup list [MSDN] Number=6482 Confirmed=X Filename=nese.exe Description=Added by the SDBOT.AHY WORM! Source=Paul Collins Startup list [MSDN for Windows NT & WinXP] Number=6483 Confirmed=X Filename=msdnxp.exe Description=Added by the IRCBOT-PE WORM! Source=Paul Collins Startup list [MSDN for Windows with NT's] Number=6484 Confirmed=X Filename=msdn-nt.exe Description=Added by the RBOT-EWD WORM! Source=Paul Collins Startup list [MSDN HELP] Number=6485 Confirmed=X Filename=msdn.exe Description=Added by the AGOBOT.AIB WORM! Source=Paul Collins Startup list [MSDOS Security Service] Number=6486 Confirmed=X Filename=msdos.pif Description=Added by the RBOT-AMP WORM! Source=Paul Collins Startup list [MSDOS Service] Number=6487 Confirmed=X Filename=MSDOS.PIF Description=Added by the RBOT-AIY WORM! Source=Paul Collins Startup list [MSDOS Windows Service] Number=6488 Confirmed=X Filename=MSDOS.PIF Description=Added by the RBOT-AKF WORM! Source=Paul Collins Startup list [Msdos32] Number=6489 Confirmed=X Filename=Msdos32.pif Description=Added by the RECORY WORM! Source=Paul Collins Startup list [msdos423] Number=6490 Confirmed=X Filename=msdos423.exe Description=Added by the MENACE.A WORM! Source=Paul Collins Startup list [MSDosdrv] Number=6491 Confirmed=N Filename=msdosdrv.exe Description=Added by the BACROS WORM! Source=Paul Collins Startup list [MSDTC] Number=6492 Confirmed=N Filename=msdtc.exe Description=MS Distributed Transaction Coordinator - handles transactions across multiple servers and is installed by MS Personal Web Server and MS SQL Server Source=Paul Collins Startup list [Msemu32] Number=6493 Confirmed=X Filename=Msemu32.exe Description=Unidentified spyware/adware/hijacker Source=Paul Collins Startup list [mservices.exe] Number=6494 Confirmed=X Filename=mservices.exe Description=Added by the SDBOT.WJ WORM! Source=Paul Collins Startup list [Msfind] Number=6495 Confirmed=X Filename=Msfind.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [MSFind32] Number=6496 Confirmed=X Filename=msfind32.exe Description=Added by the CAYAM WORM! Source=Paul Collins Startup list [msfindosa.exe] Number=6497 Confirmed=X Filename=msfindosa.exe Description=Added by the DOWNLOADER-BS TROJAN! Source=Paul Collins Startup list [MSFTP Service Config] Number=6498 Confirmed=X Filename=r3grun.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MSFWAVTSM] Number=6499 Confirmed=X Filename=FTPDev.exe Description=Added by the RBOT-ACF WORM! Source=Paul Collins Startup list [Msg Fixage] Number=6500 Confirmed=X Filename=msgfixed.exe Description=Added by the SDBOT.ZD WORM! Source=Paul Collins Startup list [MsgApi] Number=6501 Confirmed=X Filename=[path to file] Description=Added by the DEDLER-D TROJAN! Source=Paul Collins Startup list [msgb1] Number=6502 Confirmed=X Filename=msgb1.exe Description=Added by the DLUCA.GEN TROJAN! Source=Paul Collins Startup list [MsgCenterExe] Number=6503 Confirmed=N Filename=RealOneMessageCenter.exe Description=RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way Source=Paul Collins Startup list [msgex32] Number=6504 Confirmed=X Filename=msgex32.exe Description=Added by the APPFLET-A WORM! Source=Paul Collins Startup list [Msgmgr] Number=6505 Confirmed=X Filename=[path to worm] Description=Added by the BABYBEAR WORM! Source=Paul Collins Startup list [msgserv_] Number=6506 Confirmed=X Filename=Syss.exe Description=Added by the FANTA TROJAN! Source=Paul Collins Startup list [msgsm32] Number=6507 Confirmed=X Filename=msgsm32.exe Description=Added by the RBOT-ASG WORM! Source=Paul Collins Startup list [Msgsrv16] Number=6508 Confirmed=X Filename=Msgsrv16.exe Description=Added by the DELF family of TROJANS! Source=Paul Collins Startup list [MSGSRV32.exe] Number=6509 Confirmed=Y Filename=msgsrv32.exe Description=Windows 32-bit VxD Message Server. For more information on its function and why it's needed, see here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background Source=Paul Collins Startup list [Msgsvc32] Number=6510 Confirmed=X Filename=[worm filename] Description=Added by the NAUTICAL-A TROJAN! Source=Paul Collins Startup list [MsgSvcMgr32] Number=6511 Confirmed=X Filename=cmdzxdll.exe Description=Added by the RBOT-AEK WORM! Source=Paul Collins Startup list [msgsvr32] Number=6512 Confirmed=X Filename=msgsvr32.exe Description=Added by the DEADHAT.B WORM! Note - not to be confused with the valid "msgsrv32.exe" file which resides in the same directory (C:\Windows\System) on a Win9x/Me machine Source=Paul Collins Startup list [MSGTAG] Number=6513 Confirmed=U Filename=MSGTAG.exe Description=MSGTAG is an application that tells you when your emails have been received and opened Source=Paul Collins Startup list [Msgtray] Number=6514 Confirmed=X Filename=sys16.exe Description=Added by an unknown VIRUS! Source=Paul Collins Startup list [Mshelp32] Number=6515 Confirmed=X Filename=mshelp32.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [MSHT@] Number=6516 Confirmed=X Filename=MSHT@.EXE Description=Added by the MAGISTR.A VIRUS! Source=Paul Collins Startup list [mshtmll] Number=6517 Confirmed=X Filename=mshtmll.dll Description=Added by the DELF.BAS TROJAN! Source=Paul Collins Startup list [msident] Number=6518 Confirmed=X Filename=msident.exe Description=Unidentified adware or trojan Source=Paul Collins Startup list [msidle] Number=6519 Confirmed=X Filename=msidle.exe Description=Added by the OPASERV-O WORM! Source=Paul Collins Startup list [MsIdle32.exe] Number=6520 Confirmed=X Filename=MsIdle32.exe Description=Added by the VERIFY TROJAN! Source=Paul Collins Startup list [MSIdll] Number=6521 Confirmed=X Filename=winmp.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSIE Parsers] Number=6522 Confirmed=X Filename=MSIE32ab.exe Description=Added by the SDBOT.MV WORM! Source=Paul Collins Startup list [msiew] Number=6523 Confirmed=X Filename=mseiw.exe Description=Added by the LITTLOG TROJAN! Source=Paul Collins Startup list [MSIEXEC] Number=6524 Confirmed=X Filename=MSIEXEC32.exe Description=Added by the AINESEY.A WORM! Source=Paul Collins Startup list [MSIEXEC] Number=6525 Confirmed=X Filename=MSIEXEC.EXE Description=Added by the YOSENIO-A VIRUS! Source=Paul Collins Startup list [msiexecs.exe] Number=6526 Confirmed=X Filename=msiexecs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MSIMN32] Number=6527 Confirmed=X Filename=MSIMN32.EXE Description=Added by the CWS-M TROJAN! Source=Paul Collins Startup list [MSIN] Number=6528 Confirmed=? Filename=MSin.exe Description=?? Source=Paul Collins Startup list [Msinet] Number=6529 Confirmed=X Filename=Msinet.exe Description=Added by the RBOT-AOA WORM! Source=Paul Collins Startup list [MSInfo] Number=6530 Confirmed=X Filename=msinfo.exe Description=Added by the ALADINZ.M TROJAN! Source=Paul Collins Startup list [MSInfo] Number=6531 Confirmed=X Filename=AVBgle.exe Description=Added by the NETSKY.O WORM! Source=Paul Collins Startup list [MSInstall] Number=6532 Confirmed=X Filename=smvss.exe Description=Added by the DEDLER-G TROJAN! Source=Paul Collins Startup list [msjava service] Number=6533 Confirmed=X Filename=xpcd.exe Description=Added by the SDBOT.VM WORM! Source=Paul Collins Startup list [MSKAGENTEXE] Number=6534 Confirmed=U Filename=MskAgent.exe Description=McAfee Spamkiller Source=Paul Collins Startup list [MSKCES32] Number=6535 Confirmed=X Filename=[random filename] Description=Added by the CLONER TROJAN! Source=Paul Collins Startup list [MSKDetectorExe] Number=6536 Confirmed=U Filename=MSKDetct.exe Description=Part of McAfee Spamkiller Source=Paul Collins Startup list [MSKernel32] Number=6537 Confirmed=X Filename=MSKernel32.vbs Description=Added by the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [MSkernel32] Number=6538 Confirmed=X Filename=System.exe 4820 Description=Added by the TUXDER TROJAN! Source=Paul Collins Startup list [MSKExe] Number=6539 Confirmed=U Filename=spamkiller.exe Description=McAfee Spamkiller Source=Paul Collins Startup list [mskj] Number=6540 Confirmed=X Filename=mskj.exe Description=Added by the KAEMON TROJAN! Source=Paul Collins Startup list [MSKServerExe] Number=6541 Confirmed=U Filename=MSKSrvr.exe Description=Part of McAfee Spamkiller Source=Paul Collins Startup list [mslagent] Number=6542 Confirmed=X Filename=mslagent.exe Description=Added by the WINTRIM-F TROJAN! Source=Paul Collins Startup list [MSLARISSA] Number=6543 Confirmed=X Filename=MSLARISSA.pif Description=Added by the ASSIRAL.B WORM! Source=Paul Collins Startup list [MSLIB32] Number=6544 Confirmed=? Filename=mswatch32.exe Description=?? Source=Paul Collins Startup list [MSLog] Number=6545 Confirmed=X Filename=MicrosoftLog.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mslogon lptt01] Number=6546 Confirmed=X Filename=mslogon.exe Description=RapidBlaster variant (in a "Mslogon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Mslogon ml097e] Number=6547 Confirmed=X Filename=mslogon.exe Description=RapidBlaster variant (in a "Mslogon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [MsManager] Number=6548 Confirmed=X Filename=msmgr32.exe Description=Added by the YAHA.AF WORM! Source=Paul Collins Startup list [msmanager32] Number=6549 Confirmed=X Filename=msmngr32.exe Description=Added by the RANDON-R (or WOMANIZ.A) WORM! Source=Paul Collins Startup list [msmautoprotect] Number=6550 Confirmed=X Filename=msmssgs.exe Description=Added by the BIFROSE-AJ TROJAN! Source=Paul Collins Startup list [msmc] Number=6551 Confirmed=X Filename=mscpbo.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msmc] Number=6552 Confirmed=X Filename=msgdmf.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msmc] Number=6553 Confirmed=X Filename=msongn.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msmc] Number=6554 Confirmed=X Filename=msmc.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msmc] Number=6555 Confirmed=X Filename=ms****.exe [* = random char] Description=ClientMan parasite variant Source=Paul Collins Startup list [MSMcAfeee] Number=6556 Confirmed=X Filename=Avsynmgr32e.exe Description=Added by the FRAMAR TROJAN! Source=Paul Collins Startup list [MSMcAfeeh] Number=6557 Confirmed=X Filename=Avsynmgr32h.exe Description=Added by the FRANGO TROJAN! Source=Paul Collins Startup list [MSMcAfeeS] Number=6558 Confirmed=X Filename=Avsynmgr32S.exe Description=Added by the VOLAC or VOLAC.DR TROJANS! Source=Paul Collins Startup list [MSMessnger] Number=6559 Confirmed=X Filename=msnupd.exe Description=Added by the RBOT-ADY WORM! Source=Paul Collins Startup list [msmgr] Number=6560 Confirmed=? Filename=msmgr.exe Description=?? Source=Paul Collins Startup list [msMGR] Number=6561 Confirmed=X Filename=rtkmsg.exe Description=Added by the SDBOT-BPY WORM! Source=Paul Collins Startup list [Msmgt] Number=6562 Confirmed=X Filename=msmgt.exe Description=Total Velocity adware/hijacker Source=Paul Collins Startup list [MSMNTGNT] Number=6563 Confirmed=X Filename=MSMNTGNT.EXE Description=Added by the BANKER-IE TROJAN! Source=Paul Collins Startup list [MSMNTJBE] Number=6564 Confirmed=X Filename=MSMNTJBE.EXE Description=Added by the Bancos-EF TROJAN! Source=Paul Collins Startup list [MSMNTJNG] Number=6565 Confirmed=X Filename=MSMNTJNG.EXE Description=Added by the GRABER-G TROJAN! Source=Paul Collins Startup list [MSMNTMTS] Number=6566 Confirmed=X Filename=MSMNTMTS.EXE Description=Added by the BANKER-GZ TROJAN! Source=Paul Collins Startup list [msmon] Number=6567 Confirmed=X Filename=msmon.exe Description=Added by a variant of the GEMA.D TROJAN! Source=Paul Collins Startup list [MsMovies] Number=6568 Confirmed=X Filename=MsMovies.exe Description=Malware - recognized by Kaspersky antivirus as Trojan-Dropper.Win32.WinAD.h Source=Paul Collins Startup list [MsmqIntCert] Number=6569 Confirmed=? Filename=regsvr32 /s mqrt.dll Description=Microsoft Message Queue Server - Internal Certificate - see here for more info and here for a potential problem. Is it required? Source=Paul Collins Startup list [MSMSGNER] Number=6570 Confirmed=X Filename=[4-8 random letters].exe Description=Added by the FOWLDO-GEN TROJAN! Source=Paul Collins Startup list [msmsgr] Number=6571 Confirmed=X Filename=msmsgss.exe Description=Recognized by Kaspersky antivirus as RBOT.AJJ Source=Paul Collins Startup list [MSMSGS] Number=6572 Confirmed=U Filename=msmsgs.exe Description=Windows Messenger utility. If you don't use Windows Messenger, this can be annoying. Available via Start -> Programs. Go to Windows Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts" Source=Paul Collins Startup list [MSMsgs] Number=6573 Confirmed=X Filename=msmessgs.exe Description=Added by the SMALL-EW TROJAN! Source=Paul Collins Startup list [MsMsgSrv] Number=6574 Confirmed=X Filename=msmsgsrv.exe Description=Added by the CQO TROJAN! Source=Paul Collins Startup list [MSMsgSvc] Number=6575 Confirmed=X Filename=MSMSGSVC.exe Description=Browser hijacker, identified by some antiviruses as a variant of the StartPage.QC TROJAN! Source=Paul Collins Startup list [msmsngr] Number=6576 Confirmed=X Filename=msmsngr.exe Description=Added by the DOPBOT-B WORM! Source=Paul Collins Startup list [msn] Number=6577 Confirmed=X Filename=system32.exe Description=Added by the KITRO.A WORM! Source=Paul Collins Startup list [msn] Number=6578 Confirmed=X Filename=msnmsg.exe Description=Added by the RBOT-GO WORM! Source=Paul Collins Startup list [MSN] Number=6579 Confirmed=X Filename=msnmsgs.exe Description=Added by the RBOT-KL WORM! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Source=Paul Collins Startup list [MSN] Number=6580 Confirmed=X Filename=ctfmoons.exe Description=Added by the SPYBOT.HI WORM! Source=Paul Collins Startup list [MSN] Number=6581 Confirmed=X Filename=msnmesengers.exe Description=Added by the RBOT-ME WORM! Source=Paul Collins Startup list [MSN] Number=6582 Confirmed=X Filename=MSN.exe Description=Added by the MINIT WORM! Source=Paul Collins Startup list [MSN] Number=6583 Confirmed=X Filename=msnmsgr.exe Description=Added by the MYTOB or MYTOB.B WORMS! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility Source=Paul Collins Startup list [msn] Number=6584 Confirmed=X Filename=msnsvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MSN] Number=6585 Confirmed=X Filename=msn16.exe Description=Added by the SDBOT-VN WORM! Source=Paul Collins Startup list [MSN] Number=6586 Confirmed=X Filename=msnsgr.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [MSN 9.0 Plus] Number=6587 Confirmed=X Filename=[random letters].exe Description=Added by the RBOT-ALY WORM! Source=Paul Collins Startup list [MSN Administration For Windows] Number=6588 Confirmed=X Filename=msnadp32.exe Description=Added by the BROPIA.W WORM! Source=Paul Collins Startup list [MSN ang] Number=6589 Confirmed=X Filename=cssrss.exe Description=Added by the FORBOT-CE WORM! Source=Paul Collins Startup list [MSN BETA] Number=6590 Confirmed=X Filename=service.exe Description=Added by the RBOT.AUU WORM! Source=Paul Collins Startup list [MSN Checker] Number=6591 Confirmed=X Filename=msnchecker.exe Description=Added by the SDBOT-AGB WORM! Source=Paul Collins Startup list [Msn Config] Number=6592 Confirmed=X Filename=msngf.exe Description=Added by the RBOT-QG WORM! Source=Paul Collins Startup list [Msn Configuration Loader] Number=6593 Confirmed=X Filename=msngms.exe Description=Added by the KELVIR.T WORM! Source=Paul Collins Startup list [MSN Explorer] Number=6594 Confirmed=X Filename=msnexplorer.exe Description=Added by the AGENT-CAX TROJAN! Source=Paul Collins Startup list [MSN Explorer] Number=6595 Confirmed=X Filename=explorer..exe Description=Dropper for the Ciadoor.cb TROJAN! Source=Paul Collins Startup list [MSN Funny Images] Number=6596 Confirmed=X Filename=imsngsr.exe Description=Added by the AGOBOT-TT WORM! Source=Paul Collins Startup list [MSN Internet Access] Number=6597 Confirmed=N Filename=trayclnt.exe Description=Quick way to connect to MSN internet service - replaces "MSN Quick View" from V5.6 onwards Source=Paul Collins Startup list [MSN Manager] Number=6598 Confirmed=X Filename=cvss.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [MSN Manager] Number=6599 Confirmed=X Filename=mscmgr.exe Description=Unidentified malware - causes multiple browser windows to open Source=Paul Collins Startup list [MSN Message Background loader] Number=6600 Confirmed=X Filename=msnmesg.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN Messages] Number=6601 Confirmed=X Filename=msnmesg.exe Description=Added by the RBOT-ACN WORM! Source=Paul Collins Startup list [MSN Messanger] Number=6602 Confirmed=X Filename=msnmsng.exe Description=Added by the SDBOT.XN WORM! Source=Paul Collins Startup list [MSN messanger] Number=6603 Confirmed=X Filename=msnmsgsm.exe Description=Added by the RBOT-FMP WORM! Source=Paul Collins Startup list [MSN Messanger] Number=6604 Confirmed=X Filename=msnmsgsmn.exe Description=Added by the RBOT-FOQ WORM! Source=Paul Collins Startup list [Msn Messeng] Number=6605 Confirmed=X Filename=windns.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Msn Messenge] Number=6606 Confirmed=X Filename=IExplorer.exe Description=Added by the DELF-LL TROJAN! Source=Paul Collins Startup list [MSN messenger] Number=6607 Confirmed=X Filename=messenger.exe Description=Added by an unidentified TROJAN! Note - this is not the real MSN Messenger Source=Paul Collins Startup list [Msn Messenger] Number=6608 Confirmed=X Filename=msnmsgs.exe Description=Added by the LOONY-P TROJAN! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Source=Paul Collins Startup list [MSN Messenger] Number=6609 Confirmed=X Filename=Reosmsngr.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [MSN MESSENGER] Number=6610 Confirmed=X Filename=msmmsgr.exe Description=Added by the KELVIR.Q WORM! Source=Paul Collins Startup list [MSN Messenger] Number=6611 Confirmed=X Filename=msmsgs.exe Description=Added by the DLOADER-LN or ZLOB-C or ZLOBDROP-C TROJANS! Note - this particular msmsgs.exe file is located in the Windows\System32 or Winnt\System32 folder, and should not be mistaken for the MSN Messenger file of the same name! Source=Paul Collins Startup list [MSN Messenger] Number=6612 Confirmed=X Filename=msnmsgr.exe Description=Added by the AGOBOT.AOQ WORM! Note - this is not the valid MSN Messenger utility Source=Paul Collins Startup list [MSN Messenger] Number=6613 Confirmed=X Filename=msmsgs.exe Description=Added by the ZHOPA TROJAN! Note - this particular msmsgs.exe file is located in the Windows\System32 or Winnt\System32 folder, and should not be mistaken for the MSN Messenger file of the same name! Source=Paul Collins Startup list [MSN Messenger] Number=6614 Confirmed=X Filename=msnmsngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN Messenger] Number=6615 Confirmed=X Filename=IExplorer.exe Description=Added by the BANKER-EU TROJAN! Source=Paul Collins Startup list [Msn Messenger] Number=6616 Confirmed=X Filename=msnmsnr.exe Description=Added by the BANKER-GG TROJAN! Source=Paul Collins Startup list [MSN Messenger] Number=6617 Confirmed=X Filename=PIC1324.exe Description=Added by the CHOKE.C WORM! Source=Paul Collins Startup list [MSN Messenger] Number=6618 Confirmed=X Filename=explorer..exe Description=Dropper for the Ciadoor.cb TROJAN! Source=Paul Collins Startup list [MSN Messenger 32] Number=6619 Confirmed=X Filename=msniu.exe Description=Added by the RBOT-AWB WORM! Source=Paul Collins Startup list [MSN Messenger 323] Number=6620 Confirmed=X Filename=msniu3.exe Description=Added by the RBOT-AXB WORM! Source=Paul Collins Startup list [MSN Messenger 6.2] Number=6621 Confirmed=X Filename=tyd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN MESSENGER 9.0] Number=6622 Confirmed=X Filename=messengerr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN messenger service] Number=6623 Confirmed=X Filename=mssgs.exe Description=Added by an unidentified TROJAN! Note - this is not the real MSN Messenger Source=Paul Collins Startup list [MSN Messenger Service Starter] Number=6624 Confirmed=X Filename=msnmgsr.exe Description=Added by the RBOT-AOS WORM! Source=Paul Collins Startup list [Msn Messenger Update] Number=6625 Confirmed=X Filename=msnupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN Messenger User Controls] Number=6626 Confirmed=X Filename=msmsgr.exe Description=Added by the KELVIR.HI WORM! Source=Paul Collins Startup list [Msn Messengers] Number=6627 Confirmed=X Filename=MSNMSGR.EXE Description=Added by the RBOT.KX WORM! Source=Paul Collins Startup list [MSN MMISSENGER] Number=6628 Confirmed=X Filename=mssmmspgr.exe Description=Added by the KELVIR.AJ WORM! Source=Paul Collins Startup list [Msn Patch] Number=6629 Confirmed=X Filename=msndp.exe Description=Added by the RBOT.AAI WORM! Source=Paul Collins Startup list [Msn Patches] Number=6630 Confirmed=X Filename=msndr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Msn Plus Updater] Number=6631 Confirmed=X Filename=msnplus.exe Description=Added by the RBOT-MU WORM! Source=Paul Collins Startup list [Msn Processe Manager] Number=6632 Confirmed=X Filename=msni32.exe Description=Added by the RBOT-ADX WORM! Source=Paul Collins Startup list [MSN Quick View] Number=6633 Confirmed=N Filename=Msndc.exe Description=Quick way to connect to MSN internet service Source=Paul Collins Startup list [MSN Registry loader] Number=6634 Confirmed=X Filename=msmnwin.exe Description=Added by the KELVIR.FK WORM! Source=Paul Collins Startup list [MSN service] Number=6635 Confirmed=X Filename=msnmgr16.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSN Service] Number=6636 Confirmed=X Filename=amsnmsgrs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Msn Service] Number=6637 Confirmed=X Filename=matrixcam.exe Description=Added by the MYTOB.JH WORM! Source=Paul Collins Startup list [Msn Service] Number=6638 Confirmed=X Filename=raloded.exe Description=Added by the MYTOB-DY WORM! Source=Paul Collins Startup list [MSN service] Number=6639 Confirmed=X Filename=msnmsgr16.exe Description=Added by the RBOT-RZ WORM! Source=Paul Collins Startup list [MSN service] Number=6640 Confirmed=X Filename=NTDKRN.EXE Description=Added by the RBOT.UJ WORM! Source=Paul Collins Startup list [MSN Service Updates] Number=6641 Confirmed=X Filename=winproc.exe Description=Added by the KELVIR-BB WORM! Source=Paul Collins Startup list [MSN Service Utilities] Number=6642 Confirmed=X Filename=nkn.exe Description=Added by the KELVIR-BC WORM! Source=Paul Collins Startup list [MSN Start] Number=6643 Confirmed=X Filename=msnmsgr7.exe Description=Added by the RBOT-PH WORM! Source=Paul Collins Startup list [MSN Update] Number=6644 Confirmed=X Filename=mscon.exe Description=Added by the RBOT-QA WORM! Source=Paul Collins Startup list [MSN Update] Number=6645 Confirmed=X Filename=msn32.exe Description=Added by the RBOT.AHN WORM! Source=Paul Collins Startup list [MSN Update] Number=6646 Confirmed=X Filename=DLLCON.EXE Description=Added by the RBOT-EA WORM! Source=Paul Collins Startup list [Msn Update Manager (Sp2)] Number=6647 Confirmed=X Filename=MSMSGS.EXE Description=Added by the AGOBOT-NL WORM! Source=Paul Collins Startup list [Msn Update Service] Number=6648 Confirmed=X Filename=userx.exe Description=Added by the MYTOB.JF WORM! Source=Paul Collins Startup list [MSN Updater] Number=6649 Confirmed=X Filename=msnms.exe Description=Added by the FORBOT-CG WORM! Source=Paul Collins Startup list [Msn Updater] Number=6650 Confirmed=X Filename=msnplugins.exe Description=Added by the RBOT-HS WORM! Source=Paul Collins Startup list [Msn Updater] Number=6651 Confirmed=X Filename=windatemanager.exe Description=Added by the SDBOT.TS WORM! Source=Paul Collins Startup list [MSN UPDATERS] Number=6652 Confirmed=X Filename=virtualmemory.exe Description=Added by the RBOT-JK WORM! Source=Paul Collins Startup list [msn.exe] Number=6653 Confirmed=X Filename=son.exe Description=Added by the STARTPA-GS TROJAN! Source=Paul Collins Startup list [MSN32 X Service] Number=6654 Confirmed=X Filename=MSN32x.EXE Description=Added by an unidentified WORM! Source=Paul Collins Startup list [MSN8m Startup] Number=6655 Confirmed=X Filename=msn8m.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [msnager32] Number=6656 Confirmed=X Filename=svchostt.exe Description=Added by the WOMANIZ.E TROJAN! Source=Paul Collins Startup list [msnappau] Number=6657 Confirmed=N Filename=msnappau.exe Description=Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to "update" the toolbar Source=Paul Collins Startup list [Msnarrator] Number=6658 Confirmed=X Filename=msnarrator.exe Description=Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware Source=Paul Collins Startup list [MSNavWH] Number=6659 Confirmed=X Filename=MSWkwrH.exe Description=Added by the ANAV-A WORM! Source=Paul Collins Startup list [msndrvsys] Number=6660 Confirmed=X Filename=msndrvsys.exe Description=Added by the BROGGER-D TROJAN! Source=Paul Collins Startup list [MSNET] Number=6661 Confirmed=X Filename=msnet.exe Description=Added by the BOA WORM! Source=Paul Collins Startup list [MsnExplorer] Number=6662 Confirmed=X Filename=winagent.exe Description=Added by the EQ TROJAN! Source=Paul Collins Startup list [MsnExplorer] Number=6663 Confirmed=X Filename=MSEXPLOREN.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [MsnExplorer] Number=6664 Confirmed=X Filename=SHCH.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [MsnExplorer] Number=6665 Confirmed=X Filename=SVCHST.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [MsnExplorer] Number=6666 Confirmed=X Filename=msnexploren.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [MsnExplorer] Number=6667 Confirmed=X Filename=sdhch.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [MsnFixer] Number=6668 Confirmed=? Filename=msnfixjs.js Description=Located in the HPbinmsnfix directory of a HP PC Source=Paul Collins Startup list [MSNGrabber] Number=6669 Confirmed=X Filename=MSNgrabber.exe Description=Added by the ENVID.A WORM! Source=Paul Collins Startup list [msngta32] Number=6670 Confirmed=X Filename=msngta32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSNIA] Number=6671 Confirmed=N Filename=MSNIASVC.EXE Description=Added with MSN version 9. Resets certain internet settings upon bootup and can't be disabled via MSCONFIG Source=Paul Collins Startup list [msnload32.exe] Number=6672 Confirmed=X Filename=msnload32.exe Description=Added by the BANCOS.M TROJAN! Source=Paul Collins Startup list [MSNMESENGER] Number=6673 Confirmed=X Filename=Main.exe Description=Added by the PRORAT TROJAN! Source=Paul Collins Startup list [msnmessenger] Number=6674 Confirmed=X Filename=msnmessenger.exe Description=Added by the BANCBAN-KJ TROJAN! Source=Paul Collins Startup list [msnmsg] Number=6675 Confirmed=X Filename=asgag.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [msnmsg] Number=6676 Confirmed=X Filename=TBC.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [msnmsg] Number=6677 Confirmed=X Filename=msnmsg.exe Description=Added by the BANKER-CLX TROJAN! Source=Paul Collins Startup list [msnmsg.exe] Number=6678 Confirmed=X Filename=mscmd32.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [msnmsgq32] Number=6679 Confirmed=X Filename=msnmsgq.exe Description=Added by the TACTSLAY.H TROJAN! Source=Paul Collins Startup list [msnmsgq32] Number=6680 Confirmed=X Filename=msnmsgq32.exe Description=Added by the TACTSLAY.F TROJAN! Source=Paul Collins Startup list [msnmsgq32] Number=6681 Confirmed=X Filename=sssasasb32.exe Description=Added by the TACTSLAY.F TROJAN! Source=Paul Collins Startup list [msnmsgr] Number=6682 Confirmed=N Filename=msnmsgr.exe Description=MSN Messenger (now superseeded by Windows Live Messenger) utility. If you don't use MSN Messenger, this can be annoying. Available via Start -> Programs. Go to MS Messenger -> Tools -> Options -> Preferences and uncheck "Run this program when Windows starts" Source=Paul Collins Startup list [MsnMsgr] Number=6683 Confirmed=X Filename=MsnMsgrs.exe Description=Added by the NETSKY-AD WORM! Source=Paul Collins Startup list [MsnMsgr] Number=6684 Confirmed=X Filename=msnmsgr.exe Description=Added by the ANNEW-FAM WORM! Note - this is not the valid MSN Messenger utility Source=Paul Collins Startup list [msnmsgr32-.exe] Number=6685 Confirmed=X Filename=msnmsgr-.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [MSNMSGR5] Number=6686 Confirmed=X Filename=MSNMSGR5.exe Description=Added by the RBOT.PQ WORM! Source=Paul Collins Startup list [MSNMSGRE] Number=6687 Confirmed=X Filename=swef.bat Description=IRC backdoor TROJAN or WORM! Source=Paul Collins Startup list [MSNMSGRR] Number=6688 Confirmed=X Filename=swin.bat Description=IRC backdoor TROJAN or WORM! Source=Paul Collins Startup list [MSNMSGRS] Number=6689 Confirmed=X Filename=swe.bat Description=IRC worm or backdoor trojan! Source=Paul Collins Startup list [MSNMSGRS] Number=6690 Confirmed=X Filename=swiss.bat Description=IRC worm or backdoor trojan! Source=Paul Collins Startup list [MSNMSGRS1] Number=6691 Confirmed=X Filename=swed.bat Description=IRC backdoor TROJAN or WORM! Source=Paul Collins Startup list [msnmsgs.exe] Number=6692 Confirmed=X Filename=msnmsgs.exe Description=Added by the BANKER-HK TROJAN! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Source=Paul Collins Startup list [msnmsgsgs] Number=6693 Confirmed=X Filename=msnmsgsgs.exe Description=Added by the "Catal" alias Spy.Delitall.B backdoor TROJAN! Source=Paul Collins Startup list [msnmsgy] Number=6694 Confirmed=X Filename=[path to file] Description=Added by the BANKER-EQ TROJAN! Source=Paul Collins Startup list [msnnt] Number=6695 Confirmed=X Filename=winampb.exe Description=Chinese originated adware - detected by Kaspersky antivirus as Trojan.Win32.Agent.tl Source=Paul Collins Startup list [msnnt] Number=6696 Confirmed=X Filename=winampf.exe Description=Added by the SMALL.DTS TROJAN! Source=Paul Collins Startup list [MSNPluginSrIvcs] Number=6697 Confirmed=X Filename=n3vasap23.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [MSNPluginSrvcs] Number=6698 Confirmed=X Filename=p6.exe Description=Added by the SDBOT.AKJ or RBOT-VJ WORMS! Source=Paul Collins Startup list [MSNPluginSrvcs] Number=6699 Confirmed=X Filename=sagate.exe Description=Added by the SDBOT.AKJ WORM! Source=Paul Collins Startup list [MSNPlus] Number=6700 Confirmed=X Filename=msnplus.exe Description=Added by the BANKER-DAN TROJAN! Source=Paul Collins Startup list [MSNS PLUS XP2] Number=6701 Confirmed=X Filename=msdupd.exe Description=Added by the RBOT-BCE WORM! Source=Paul Collins Startup list [msnsched2] Number=6702 Confirmed=X Filename=msnsched2.exe Description=Added by the SPYBOT.NNT WORM! Source=Paul Collins Startup list [MSNService] Number=6703 Confirmed=X Filename=MSNService.exe Description=Added by the CARPET.C WORM! Source=Paul Collins Startup list [msnsgs] Number=6704 Confirmed=X Filename=msnsgs.exe Description=Added by the CHEUKO-B TROJAN! Source=Paul Collins Startup list [msnshed] Number=6705 Confirmed=X Filename=msnshed.exe Description=Added by the RBOT-YN WORM! Source=Paul Collins Startup list [msnsmgr] Number=6706 Confirmed=X Filename=MsnMsr.exe Description=Added by the LOONY-N TROJAN! Source=Paul Collins Startup list [msnsyslog] Number=6707 Confirmed=N Filename=msnappm.exe Description=Related to Messenger Applications. When you uninstall the trial version the msnappm keeps saying (You have xx days left) this is adware and it very annoying Source=Paul Collins Startup list [MSNSysRestore] Number=6708 Confirmed=X Filename=pc32.exe Description=Added by a variant of the MASTAK VIRUS! Source=Paul Collins Startup list [msnToolbaar] Number=6709 Confirmed=X Filename=msnmsgesc.exe Description=Added by the RBOT.BMF WORM! Source=Paul Collins Startup list [MSObject32] Number=6710 Confirmed=X Filename=MSObject32.js Description=Added by the PUN TROJAN! Source=Paul Collins Startup list [Msoffice] Number=6711 Confirmed=X Filename=msoffice.hta Description=Hijacker - redirecting to Searchdot.net Source=Paul Collins Startup list [MSOffice] Number=6712 Confirmed=X Filename=services.exe Description=Added by the DLOADER-EU TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "MSOffice" subfolder Source=Paul Collins Startup list [MSOffice32] Number=6713 Confirmed=X Filename=msjcf.exe Description=Added by the RAKER-A TROJAN! Source=Paul Collins Startup list [MSOfficeCfg] Number=6714 Confirmed=X Filename=msocfg.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [MSOfficeCfg] Number=6715 Confirmed=X Filename=navchk.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [MSOfficeCfg] Number=6716 Confirmed=X Filename=qservice.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [MSOfficeCfg] Number=6717 Confirmed=X Filename=shman.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [MSOfficeCfg] Number=6718 Confirmed=X Filename=ssvr.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [msoffwz] Number=6719 Confirmed=X Filename=msoffwz.EXE Description=Added by the BANCBAN-HQ TROJAN! Source=Paul Collins Startup list [msoft-updater23] Number=6720 Confirmed=X Filename=mssysstems.exe Description=Added by the RBOT-ATU WORM! Source=Paul Collins Startup list [msoft-updater23] Number=6721 Confirmed=X Filename=slssystem.exe Description=Added by the RBOT-ASR WORM! Source=Paul Collins Startup list [MSOleath32] Number=6722 Confirmed=X Filename=winss.exe Description=Added by the KATHER TROJAN! Source=Paul Collins Startup list [MSOOBD] Number=6723 Confirmed=X Filename=MSOOBD.EXE Description=Added by the MAGISTR.A VIRUS! Source=Paul Collins Startup list [mspaint.exe] Number=6724 Confirmed=X Filename=check32.exe Description=Added by the AGENT.AH TROJAN! Source=Paul Collins Startup list [Mspatch69] Number=6725 Confirmed=X Filename=[path to trojan] Description=Added by the MPROX TROJAN! Source=Paul Collins Startup list [Mspatch89] Number=6726 Confirmed=X Filename=cnqmax.exe Description=Added by the RANDEX.P WORM! Source=Paul Collins Startup list [MSPetServ] Number=6727 Confirmed=X Filename=PET32.EXE Description=Added by the IRCBOT-VE WORM! Source=Paul Collins Startup list [msping] Number=6728 Confirmed=X Filename=msping.exe Description=Added by the FLOODBLACK TROJAN! Source=Paul Collins Startup list [msping.exe] Number=6729 Confirmed=X Filename=msping.exe Description=Added by the MZ TROJAN! Source=Paul Collins Startup list [MSPluginSrvc] Number=6730 Confirmed=X Filename=p3.exe Description=Added by the RBOT-WV WORM! Source=Paul Collins Startup list [MSPLUS] Number=6731 Confirmed=X Filename=msplus32.exe Description=Added by the MYTOB-AM or MYTOB-CL WORMS! Source=Paul Collins Startup list [MSPP System Update 64] Number=6732 Confirmed=X Filename=wiaadmgr.exe Description=Recognized by Kaspersky antivirus as the RANKY.GEN TROJAN! Source=Paul Collins Startup list [MSPQFile] Number=6733 Confirmed=X Filename=MSA****.TMP Description=Homepage hijacker. See here for more information. **** can be anything Source=Paul Collins Startup list [MSPRO32] Number=6734 Confirmed=X Filename=[path to worm] Description=Added by the IBERIO WORM! Source=Paul Collins Startup list [MSPRO32] Number=6735 Confirmed=X Filename=pnp.exe Description=Added by the ZOTOB.O WORM! Source=Paul Collins Startup list [MSprotect.exe] Number=6736 Confirmed=X Filename=MSprotect.exe Description=Added by the DABYREV.A VIRUS! Source=Paul Collins Startup list [mspwr] Number=6737 Confirmed=U Filename=pupstman.exe Description="Transparent icon background" feature of Ashampoo'sPowerUp XP (WinNT/2K/XP) and PowerUp Deluxe (Win98/Me) Source=Paul Collins Startup list [mspwr] Number=6738 Confirmed=U Filename=pupxpman.exe Description=Related to Ashampoo's PowerUp XP Source=Paul Collins Startup list [mspwr] Number=6739 Confirmed=U Filename=pwrupst.exe Description=Ashampoo's PowerUp XP is a "tool for fine-tuning your Windows NT4, 2000, 2003 Server and XP configuration" Source=Paul Collins Startup list [mspwr] Number=6740 Confirmed=U Filename=PuXpMan2.exe Description=Related to Ashampoo's Magic Defrag Utility Source=Paul Collins Startup list [MSPY2002] Number=6741 Confirmed=N Filename=ImScInst.exe Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [msqssr] Number=6742 Confirmed=X Filename=msqssr.exe Description=Detected by Kaspersky as the DLUCA.GEN TROJAN! Source=Paul Collins Startup list [MSR] Number=6743 Confirmed=X Filename=msr.exe Description=Added by the AGOBOT.RT WORM! Source=Paul Collins Startup list [Msrc] Number=6744 Confirmed=X Filename=Msrc.exe Description=Added by the KRYPTONIC GHOST TROJAN! Source=Paul Collins Startup list [msrdc] Number=6745 Confirmed=X Filename=msrdc.exe Description=Added by the SDBOT-CXO WORM! Source=Paul Collins Startup list [msreg.exe] Number=6746 Confirmed=X Filename=msrege.exe Description=Added by the ZINX TROJAN! Source=Paul Collins Startup list [msReg32 Loader] Number=6747 Confirmed=X Filename=msreg32.exe Description=Added by the AGOBOT.IU WORM! Source=Paul Collins Startup list [MSREGIT] Number=6748 Confirmed=X Filename=Msgp.exe Description=Added by the KRYPGHOS.13 TROJAN! Source=Paul Collins Startup list [MSRegScan] Number=6749 Confirmed=U Filename=SGP.exe Description=SpyGator surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [MSRegScan] Number=6750 Confirmed=X Filename=SSDemo.exe Description=Supremespy spyware Source=Paul Collins Startup list [MSRegScan] Number=6751 Confirmed=U Filename=ETNKL.exe Description=ComKeylogger surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [MSRegSvc] Number=6752 Confirmed=X Filename=regsvc32.exe Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [msresear] Number=6753 Confirmed=X Filename=[path to trojan] Description=Added by the WEASYW-B TROJAN! Source=Paul Collins Startup list [msresearch] Number=6754 Confirmed=X Filename=msresearch.exe Description=TROJAN! - 180SearchAssistant adware related Source=Paul Collins Startup list [msresearch] Number=6755 Confirmed=X Filename=tool3.exe Description=Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe Source=Paul Collins Startup list [msrundll] Number=6756 Confirmed=X Filename=msrund1l32.exe Description=Added by the BINGHE TROJAN! Source=Paul Collins Startup list [msrunocx32] Number=6757 Confirmed=X Filename=msrunocx32.exe Description=Added by the SKUS WORM! Source=Paul Collins Startup list [MSSCDL] Number=6758 Confirmed=U Filename=MSSCDLL.exe Description=SpyCapture keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [msserv] Number=6759 Confirmed=X Filename=msserv.exe Description=Added by the BLACKLOG-A TROJAN! Source=Paul Collins Startup list [msserv] Number=6760 Confirmed=X Filename=lvsrev.exe Description=Added by the BROWMON-B TROJAN! Source=Paul Collins Startup list [msserv32] Number=6761 Confirmed=X Filename=msserv32.exe Description=Added by the RBOT-ACK WORM! Source=Paul Collins Startup list [msservice] Number=6762 Confirmed=X Filename=msserv.exe Description=Added by the HYD WORM! Source=Paul Collins Startup list [MSService_v1.0] Number=6763 Confirmed=X Filename=realsched.exe Description=EHU adware. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Source=Paul Collins Startup list [MSService_v1.0] Number=6764 Confirmed=X Filename=vfp02.exe Description=NewWeb adware Source=Paul Collins Startup list [mssfos] Number=6765 Confirmed=X Filename=sfool.exe Description=Added by the RANDEX.EUS WORM! Source=Paul Collins Startup list [MSSGisg] Number=6766 Confirmed=X Filename=[path to file] Description=Added by the RANKY.N TROJAN! Source=Paul Collins Startup list [MSShow] Number=6767 Confirmed=X Filename=MSShow.exe Description=Added by the QQROB-M TROJAN! Source=Paul Collins Startup list [MSSHVC] Number=6768 Confirmed=X Filename=MSSHVC.exe Description=Added by the NUFFY.A WORM! Source=Paul Collins Startup list [mssonfig] Number=6769 Confirmed=X Filename=winupdate.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [mssoul] Number=6770 Confirmed=X Filename=msmscc2.exe Description=Added by the DAPIZL.A banker WORM! (A "banker worm" is designed to pillage banking information and send it back to the perpetrators!) Source=Paul Collins Startup list [mssp3] Number=6771 Confirmed=X Filename=mssp22.exe Description=Added by the IBANK-D TROJAN! Source=Paul Collins Startup list [MSSQL] Number=6772 Confirmed=X Filename=Mssql.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [MSSQL for Windows NT & XP] Number=6773 Confirmed=X Filename=mssqlsnt.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Msstart] Number=6774 Confirmed=X Filename=msstart.exe Description=Added by the LIVUP.C TROJAN! Source=Paul Collins Startup list [MSStartOptimizer] Number=6775 Confirmed=X Filename=Iexpres.exe Description=Added by the DASMIN-E TROJAN! Source=Paul Collins Startup list [MSStartOptimizer] Number=6776 Confirmed=X Filename=WINUPD.EXE Description=Added by the DASMIN-E TROJAN! Source=Paul Collins Startup list [MSStartOptimizer] Number=6777 Confirmed=X Filename=SCVHOST.EXE Description=Added by the DASMIN-E TROJAN! Source=Paul Collins Startup list [msstask] Number=6778 Confirmed=X Filename=msstask.exe Description=Added by the MYPARTY WORM! Source=Paul Collins Startup list [mssurfer lptt01] Number=6779 Confirmed=X Filename=mssurfer.exe Description=RapidBlaster variant (in a "surfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [mssurfer ml097e] Number=6780 Confirmed=X Filename=mssurfer.exe Description=RapidBlaster variant (in a "surfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [mssvc] Number=6781 Confirmed=X Filename=[path to trojan] Description=Added by the PSK TROJAN! Source=Paul Collins Startup list [MSSVC] Number=6782 Confirmed=X Filename=svcsys.exe Description=Added by the FATOOS-C TROJAN! Source=Paul Collins Startup list [MSSVC.EXE] Number=6783 Confirmed=Y Filename=MSSVC.EXE Description=Stealthdisk - hides folders, files and applications. Will also encrypt them for better protection Source=Paul Collins Startup list [mssvc32] Number=6784 Confirmed=X Filename=mssvc32.exe Description=Added by the AGOBOT-ME WORM! Source=Paul Collins Startup list [mssync20] Number=6785 Confirmed=X Filename=mssync20.exe Description=Added by the LDPINC-QC TROJAN! Source=Paul Collins Startup list [mssys] Number=6786 Confirmed=X Filename=mssys.exe Description=Added by the MYSS.B TROJAN! Source=Paul Collins Startup list [mssysint] Number=6787 Confirmed=X Filename=Iexplore .exe Description=Added by the PWSTEAL.ABCHLP and PSPIDER.310.B TROJANS! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the ".exe" Source=Paul Collins Startup list [mssysint] Number=6788 Confirmed=X Filename=comime.exe Description=Added by the NETSNAKE-I TROJAN! Source=Paul Collins Startup list [mssyslanhelper] Number=6789 Confirmed=X Filename=msmsgri32.exe Description=Added by the RANDEX.D WORM! Source=Paul Collins Startup list [MsSystem] Number=6790 Confirmed=X Filename=msdos.exe Description=Adult content downloader - see here Source=Paul Collins Startup list [MsSystem] Number=6791 Confirmed=X Filename=mssys.exe Description=Added by the VANTA.A TROJAN! Source=Paul Collins Startup list [MSSYSTEM] Number=6792 Confirmed=X Filename=svcsys.exe Description=Added by the FATOOS-C TROJAN! Source=Paul Collins Startup list [Mstapi] Number=6793 Confirmed=U Filename=Mstapi.exe Description=Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Mstask] Number=6794 Confirmed=X Filename=mstask.exe Description=Added by the OPASERV.N WORM! Note - this is not the legitimate mstask.exe system file and the executable resides in C:\Windows or C:\WINNT Source=Paul Collins Startup list [mstask] Number=6795 Confirmed=X Filename=mstask.exe Description=Browser hijacker - redirecting to find-more.net. Note - this is not the legitimate mstask.exe system file Source=Paul Collins Startup list [MSTask] Number=6796 Confirmed=X Filename=run dll.exe Description=Yuupsearch adware Source=Paul Collins Startup list [MStask] Number=6797 Confirmed=X Filename=svchost.exe Description=Added by the LDPINCH-BV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder! Source=Paul Collins Startup list [MsTask] Number=6798 Confirmed=X Filename=wstask32.exe Description=Added by the MYTOB-FE WORM! Source=Paul Collins Startup list [Mstask32driver] Number=6799 Confirmed=X Filename=Mstask32.exe Description=Added by the LOONY-D TROJAN! Source=Paul Collins Startup list [MSTaskbar 32] Number=6800 Confirmed=X Filename=tbsvc32.exe Description=Added by the RBOT.BQZ WORM! Source=Paul Collins Startup list [mstasks] Number=6801 Confirmed=X Filename=mstasks.exe Description=Added by the MULTIDR-AY TROJAN! Source=Paul Collins Startup list [Mstcgww] Number=6802 Confirmed=? Filename=MSTCGWW.EXE Description=?? Source=Paul Collins Startup list [mstds.exe] Number=6803 Confirmed=X Filename=mstds.exe Description=Added by the IPTABLES TROJAN! Source=Paul Collins Startup list [mstg32.exe] Number=6804 Confirmed=X Filename=mstg32.exe Description=Added by the AGENT.BI TROJAN! Source=Paul Collins Startup list [MSTMON_N] Number=6805 Confirmed=N Filename=MSTMON_N.EXE Description=Generates an error message on startup if a Konica Minolta printer is not turned on and ready Source=Paul Collins Startup list [MSTMON_Q] Number=6806 Confirmed=N Filename=MSTMON_Q.exe Description=Generates an error message on startup if the Konica Minolta PagePro 1350W printer is not turned on and ready Source=Paul Collins Startup list [Mstng32] Number=6807 Confirmed=X Filename=MSTng32.exe Description=Added by the TANG WORM! Source=Paul Collins Startup list [mstsdsc.exe] Number=6808 Confirmed=X Filename=mstsdsc.exe Description=Added by the CIMUZ-CD TROJAN! Source=Paul Collins Startup list [msupd] Number=6809 Confirmed=X Filename=msupd.exe Description=Added by the IEACCESS DIALER! Source=Paul Collins Startup list [MSUpdate] Number=6810 Confirmed=X Filename=wupd.exe Description=Added by the ALADINZ.M TROJAN! Source=Paul Collins Startup list [MSUpdate] Number=6811 Confirmed=X Filename=svchosthlp.exe Description=Added by the BLASTER.T WORM! Source=Paul Collins Startup list [msupdate] Number=6812 Confirmed=X Filename=msupdate.exe Description=Added by the RBOT-MZ WORM! Source=Paul Collins Startup list [MSUpdate] Number=6813 Confirmed=X Filename=criticalUpdate.exe Description=Affilred adware Source=Paul Collins Startup list [msupdate] Number=6814 Confirmed=X Filename=update.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Msupdate] Number=6815 Confirmed=X Filename=expIorer.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Msupdate] Number=6816 Confirmed=X Filename=outIook.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Msupdate] Number=6817 Confirmed=X Filename=svchosts.exe Description=Added by a variant of the TACTSLAY TROJAN! Source=Paul Collins Startup list [Msupdate] Number=6818 Confirmed=X Filename=svcrhost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Msupdate] Number=6819 Confirmed=X Filename=svcshost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [MSupdate.exe] Number=6820 Confirmed=X Filename=N/A Description=CoolWebSearch parasite variant - resets home page to an adult content site Source=Paul Collins Startup list [MSUpdateDevKit] Number=6821 Confirmed=X Filename=axfd.exe Description=Added by the SDBOT-ZD WORM! Source=Paul Collins Startup list [MsUpdater System] Number=6822 Confirmed=X Filename=udpsys32.exe Description=Added by the RBOT.AAA WORM! Source=Paul Collins Startup list [MSupdater.exe] Number=6823 Confirmed=X Filename=N/A Description=CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin Source=Paul Collins Startup list [msupdater25] Number=6824 Confirmed=X Filename=lsasser.exe Description=Added by the RBOT-ATS WORM! Source=Paul Collins Startup list [msupdates] Number=6825 Confirmed=X Filename=msupdt.exe Description=Added by the RBOT-JO WORM! Source=Paul Collins Startup list [MSUpdSrv] Number=6826 Confirmed=X Filename=msupdsrv.exe Description=Browser hijacker, redirecting to a adult content site Source=Paul Collins Startup list [msurl] Number=6827 Confirmed=X Filename=msurl32.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [msuser32.exe] Number=6828 Confirmed=X Filename=msuser32.exe Description=Added by the ANDROV TROJAN! Source=Paul Collins Startup list [MsVBdll] Number=6829 Confirmed=X Filename=sys32dll.exe Description=Added by the AIMDES.B or AIMDES.C WORMS! Source=Paul Collins Startup list [MsVBdll] Number=6830 Confirmed=X Filename=MsVBdll.pif Description=Added by the AIMDES.A WORM! Source=Paul Collins Startup list [MSVBVM60] Number=6831 Confirmed=X Filename=MSVBVBM60.pif Description=Added by the SCOLD-B WORM! Source=Paul Collins Startup list [msvc32] Number=6832 Confirmed=X Filename=msvc32.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msvc32] Number=6833 Confirmed=X Filename=msvc32.exe Description=Added by the AGOBOT-NT WORM! Source=Paul Collins Startup list [msvcc] Number=6834 Confirmed=X Filename=msvchost.exe Description=Added by the XOMBE TROJAN! Source=Paul Collins Startup list [msvcc25] Number=6835 Confirmed=X Filename=svcchost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [msvcc25] Number=6836 Confirmed=X Filename=salvage.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [msvccc66] Number=6837 Confirmed=X Filename=svcchosst.exe Description=Added by the RBOT-GLS WORM! Source=Paul Collins Startup list [MSVersion] Number=6838 Confirmed=X Filename=INTERNETFEATURES.exe Description=Added by the POPMON.A TROJAN! - also known as PopMonster adware Source=Paul Collins Startup list [MSVersion] Number=6839 Confirmed=X Filename=clrschp038.exe Description=Added by the POPMON.A TROJAN! - also known as PopMonster adware Source=Paul Collins Startup list [msvhost] Number=6840 Confirmed=X Filename=aig.exe Description=Added by the AIMBOT-BC TROJAN! Source=Paul Collins Startup list [msvload32] Number=6841 Confirmed=X Filename=msvload32.exe Description=Added by the RBOT-ACI WORM! Source=Paul Collins Startup list [msvsc32] Number=6842 Confirmed=X Filename=msdev.exe Description=Added by the RBOT-GJ WORM! Source=Paul Collins Startup list [MSVsmt] Number=6843 Confirmed=X Filename=rpcxctx.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [MSVSync] Number=6844 Confirmed=X Filename=videosync.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [MSVXD] Number=6845 Confirmed=X Filename=MSVXD.EXE Description=Added by the DATOM.A WORM! Source=Paul Collins Startup list [mswave] Number=6846 Confirmed=X Filename=mswave.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [Mswavedll] Number=6847 Confirmed=X Filename=mswavedll.exe Description=Added by the CRYPTER-C TROJAN! Source=Paul Collins Startup list [MSwheel] Number=6848 Confirmed=U Filename=mswheel.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [MSWin] Number=6849 Confirmed=X Filename=mswin.exe Description=Added by the BANKER-CU TROJAN! Source=Paul Collins Startup list [Mswincfg] Number=6850 Confirmed=X Filename=Mswincfg32.exe Description=Added by the CYBRSPY.D TROJAN! Source=Paul Collins Startup list [MsWindows DRT Drivers] Number=6851 Confirmed=X Filename=wsdrt32.exe Description=Added by the RBOT.ALT WORM! Source=Paul Collins Startup list [MsWindows SSL Drivers] Number=6852 Confirmed=X Filename=mssl32.exe Description=Added by the SPYBOT.API WORM! Source=Paul Collins Startup list [MsWindows SysDate] Number=6853 Confirmed=X Filename=sysmsvc.exe Description=Added by the SPYBOT.FCD WORM! Source=Paul Collins Startup list [MSWindows Syspg] Number=6854 Confirmed=X Filename=mspg32.exe Description=Added by the RBOT-TB WORM! Source=Paul Collins Startup list [MSWindowsUpdate] Number=6855 Confirmed=X Filename=Systern.exe Description=Added by the RBOT-AFD WORM! Source=Paul Collins Startup list [MSWindowsUpdate] Number=6856 Confirmed=X Filename=mswinup.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Mswinpid32] Number=6857 Confirmed=X Filename=mswinpid32.exe Description=Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim! Source=Paul Collins Startup list [MSWinSrv] Number=6858 Confirmed=X Filename=MSWinSrv.exe Description=Added by the MTRON TROJAN! Source=Paul Collins Startup list [MSWinSrv32] Number=6859 Confirmed=X Filename=MSWinSrv32.exe Description=Added by the MTRON-B TROJAN! Source=Paul Collins Startup list [MSWinupd] Number=6860 Confirmed=U Filename=winupd.exe Description=Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJAN! Source=Paul Collins Startup list [MSWinupdate] Number=6861 Confirmed=X Filename=winupdate.exe Description=Added by the DLOADR-AAW TROJAN! Source=Paul Collins Startup list [MsWinVgr] Number=6862 Confirmed=X Filename=msvgr.exe Description=Added by the MYTOB.LE WORM! Source=Paul Collins Startup list [mswiz32] Number=6863 Confirmed=X Filename=mswiz32.exe Description=Added by the STRATIO-BG WORM! Source=Paul Collins Startup list [mswkork Service] Number=6864 Confirmed=X Filename=msework.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [msword] Number=6865 Confirmed=X Filename=msword.exe Description=Added by the RBOT-ADR WORM! Source=Paul Collins Startup list [mswspl] Number=6866 Confirmed=X Filename=[random filename] Description=Added by the SMALL.IQ TROJAN! Source=Paul Collins Startup list [mswspl] Number=6867 Confirmed=X Filename=searchbarcash.exe Description=SearchBarCash adware Source=Paul Collins Startup list [mswspl] Number=6868 Confirmed=X Filename=vnmispoisn downloader.exe Description=SearchBarCash adware variant Source=Paul Collins Startup list [mswspl] Number=6869 Confirmed=X Filename=plugin1.exe Description=Added by the SMALL.IQ TROJAN! Source=Paul Collins Startup list [msxct] Number=6870 Confirmed=X Filename=msxct.exe Description=eXact Advertising (NaviSearch, BargainBuddy, CashBack) adware Source=Paul Collins Startup list [Msy1 Startups] Number=6871 Confirmed=X Filename=msyj32.exe Description=Added by the AGOBOT-QQ WORM! Source=Paul Collins Startup list [msys lptt01] Number=6872 Confirmed=X Filename=msys.exe Description=RapidBlaster variant (in a "Msyss" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Msys32] Number=6873 Confirmed=X Filename=morfitwebentrance.exe Description=Morfit ADjectPager - "uses home page rental technology for generating revenues". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage Source=Paul Collins Startup list [MSysDrv] Number=6874 Confirmed=X Filename=msdrv.exe Description=Added by the VB.WF TROJAN! Source=Paul Collins Startup list [ms_anti_spyware] Number=6875 Confirmed=X Filename=mwfirewall.exe Description=Added by the GAMQOWI TROJAN! Source=Paul Collins Startup list [ms_anti_spywarebxp] Number=6876 Confirmed=X Filename=mwfirebpx.exe Description=Added by the SURILA-D TROJAN! Source=Paul Collins Startup list [ms_anti_spywarebxp] Number=6877 Confirmed=X Filename=mwfibpx.exe Description=Added by the SURILA-J TROJAN! Source=Paul Collins Startup list [MS_LARISSA] Number=6878 Confirmed=X Filename=MS_LARISSA.exe Description=Added by the ASSIRAL WORM! Source=Paul Collins Startup list [MS_NETD_WIN32] Number=6879 Confirmed=X Filename=netd32.EXE Description=Added by the RANDEX.F WORM! Source=Paul Collins Startup list [MS_SETUP.EXE] Number=6880 Confirmed=X Filename=MS_SETUP.EXE Description=Added by the CHARGE TROJAN! Source=Paul Collins Startup list [MS_Update Check] Number=6881 Confirmed=X Filename=wdfmgr.exe Description=Added by the AGOBOT-TB WORM! Source=Paul Collins Startup list [Mtr2] Number=6882 Confirmed=X Filename=mtr2.exe Description=Added by the KRYPTONIC GHOST TROJAN! Source=Paul Collins Startup list [MUAL] Number=6883 Confirmed=U Filename=mual.exe Description=Millesky video mail updater and launcher Source=Paul Collins Startup list [muamgr] Number=6884 Confirmed=N Filename=muamgr.exe Description=Using MicroAngelo On Display, you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system Source=Paul Collins Startup list [Mufix] Number=6885 Confirmed=? Filename=mufix.exe Description=Part of INFOConnect, web-based, enterprise client configuration, management, and deployment software, as used by ABSS (a financial management system used by the US military which will allow purchase request packages to be electronically submitted to contracting, and which also facilitates electronic receipt of items and EFT) - what does it do and is it required Source=Paul Collins Startup list [mule_st_key] Number=6886 Confirmed=X Filename=flec006.exe Description=Added by the BAGLE.AV TROJAN! Source=Paul Collins Startup list [Multi-function keyboard] Number=6887 Confirmed=U Filename=GWHotkey.exe Description=Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail, browser, volume and CD/DVD controls, etc) Source=Paul Collins Startup list [MultiCAM Initializer] Number=6888 Confirmed=U Filename=MCamBoot.exe Description=The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled Source=Paul Collins Startup list [Multimedia Codecs] Number=6889 Confirmed=X Filename=mcc.exe Description=Added by the DLOADER-MB TROJAN! Source=Paul Collins Startup list [Multimedia extensions] Number=6890 Confirmed=X Filename=mservice.exe Description=EasySearch adware Source=Paul Collins Startup list [Multimedia extensions] Number=6891 Confirmed=X Filename=[path to trojan] Description=Added by the SMUTSRCH-A TROJAN! Source=Paul Collins Startup list [Multimedia extensions] Number=6892 Confirmed=X Filename=mservice1.exe Description=Added by the DLOADR-AWD TROJAN! Source=Paul Collins Startup list [Multimedia KBD] Number=6893 Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [MULTIMEDIA KEYBOARD] Number=6894 Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [multiran] Number=6895 Confirmed=X Filename=multiran.exe Description=Added by the COSIAM-E TROJAN! Source=Paul Collins Startup list [MultiRes] Number=6896 Confirmed=U Filename=MultiRes.exe Description=MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP Source=Paul Collins Startup list [MUPS] Number=6897 Confirmed=U Filename=MUPS.exe Description=Lauches the Belkin Bulldog Plus Service - required if you want to access the UPS advanced functions Source=Paul Collins Startup list [murphy shield] Number=6898 Confirmed=Y Filename=lmgui.exe Description=Firewall part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Music01 Server] Number=6899 Confirmed=N Filename=Music01 Server.exe Description=J River Media Jukebox Source=Paul Collins Startup list [MusIRC (irc.music.com) client] Number=6900 Confirmed=X Filename=musirc4.71.exe Description=Added by the RANDEX.Q WORM! Source=Paul Collins Startup list [Mustek MDC 3000] Number=6901 Confirmed=? Filename=Mounter.exe Description=Related to software for the Mustek MDC 3000 digital camera - what does it do and is it required? Source=Paul Collins Startup list [MutexServiceEx] Number=6902 Confirmed=N Filename=Sys32Smm.exe Description=Webroot Sofware's discontinued "Privacy Master" Source=Paul Collins Startup list [MVRescue] Number=6903 Confirmed=U Filename=mvrescue Description=Related to Multivision Computers back up/restore program. Multivision Computers ceased operating in 2004 Source=Paul Collins Startup list [mvsyswina] Number=6904 Confirmed=X Filename=acsysiom.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [MW1HelperStartUp] Number=6905 Confirmed=U Filename=Mw1helper.exe Description=ScreenScenes "Magic Waterfall" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [MW1HelperStartUp] Number=6906 Confirmed=U Filename=MW1HEL~1.EXE Description=ScreenScenes "Magic Waterfall" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [mwavscan] Number=6907 Confirmed=U Filename=mwavscan.com Description=MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system, including memory, services, starup items and registry, or only scan files in a specified folder or drive Source=Paul Collins Startup list [MWLExe] Number=6908 Confirmed=U Filename=MwlGui.exe Description=Part of McAfee Wireless Protection for Wi-Fi users Source=Paul Collins Startup list [MWProEng] Number=6909 Confirmed=N Filename=MWProEng.exe Description=Logitech Mouseware Pro software - only required when using special functions Source=Paul Collins Startup list [MWSnap] Number=6910 Confirmed=N Filename=MWSnap.exe Description=MWSnap - screen capture utility. Start manually when required Source=Paul Collins Startup list [mwsoemon] Number=6911 Confirmed=X Filename=mwsoemon.exe Description=MyWebSearch parasite Source=Paul Collins Startup list [Mwsvm] Number=6912 Confirmed=X Filename=mwsvm.exe Description=SeekSeek search hijacker related - see here Source=Paul Collins Startup list [mxb2] Number=6913 Confirmed=X Filename=[path to worm] Description=Added by the IXBOT-G WORM! Source=Paul Collins Startup list [MxHLp32] Number=6914 Confirmed=X Filename=MxHLp32.exe Description=Added by a variant of the VAGRNOCKER TROJAN! Source=Paul Collins Startup list [MXO Auto Loader] Number=6915 Confirmed=U Filename=MXOaldr.exe Description=Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions Source=Paul Collins Startup list [MXOBG] Number=6916 Confirmed=U Filename=MXOALDR.EXE Description=Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions Source=Paul Collins Startup list [mxomssmenu] Number=6917 Confirmed=? Filename=maxmenumgr.exe Description=Related to Maxtor's One Touch series of external hard drives. What does it do and is it required? Source=Paul Collins Startup list [MxRunner] Number=6918 Confirmed=U Filename=MxRunner.exe Description=EasyUninstall from Aladdin Systems (formerly by Ontrack) Source=Paul Collins Startup list [My Agent] Number=6919 Confirmed=X Filename=msagent.exe Description=Added by the NEGASMS.A TROJAN! Source=Paul Collins Startup list [My App] Number=6920 Confirmed=X Filename=SMSSvc.exe Description=Added by the NEGASMS.A TROJAN! Source=Paul Collins Startup list [My Search Bar Eq] Number=6921 Confirmed=X Filename=S4BAREQ.EXE Description=MySearch parasite Source=Paul Collins Startup list [My Web Search Bar] Number=6922 Confirmed=X Filename=MWSBAR.DLL Description=MyWay - an IE Browser Helper Object used by adware WebSearch to add an IE toolbar to provide search features, and hijack browser search requests to its controlling servers run by MyWay Source=Paul Collins Startup list [My-disgo] Number=6923 Confirmed=U Filename=MyKey disgo.exe Description=Related to disgo pro. Program will synchronize data Source=Paul Collins Startup list [MyAccessMedia] Number=6924 Confirmed=X Filename=tmp**.exe [* = random char/digit] Description=My AccessMedia toolbar related, stealth installed! Source=Paul Collins Startup list [MyAgtTry] Number=6925 Confirmed=U Filename=MyAgtTry.exe Description=System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications Source=Paul Collins Startup list [Myapp] Number=6926 Confirmed=X Filename=[filename] Description=Added by the FATEE.B WORM! Source=Paul Collins Startup list [Myapp] Number=6927 Confirmed=X Filename=service.exe Description=Homepage hijacker Source=Paul Collins Startup list [MyAV] Number=6928 Confirmed=X Filename=avpguard.exe Description=Added by the NETSKY.J WORM! Source=Paul Collins Startup list [MyCIO Agent Service] Number=6929 Confirmed=Y Filename=myagtsvc.exe Description=McAfee VirusScan ASaP Agent service Source=Paul Collins Startup list [myCIO.com ASaP] Number=6930 Confirmed=U Filename=MyAgtTry.exe Description=System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications Source=Paul Collins Startup list [myCIO.com Splash] Number=6931 Confirmed=N Filename=Splash.exe Description=Splash screen for McAfee VirusScan ASaP on-line scanner Source=Paul Collins Startup list [MyCometCursor] Number=6932 Confirmed=X Filename=MYCOME~1.EXE Description=Comet Cursor adware Source=Paul Collins Startup list [MyDailyHoroscope] Number=6933 Confirmed=X Filename=MYDAIL~1.EXE Description=MyDailyHoroscope foistware Source=Paul Collins Startup list [MyDailyHoroscope] Number=6934 Confirmed=X Filename=MyDailyHoroscope.exe Description=MyDailyHoroscope foistware Source=Paul Collins Startup list [MyEmoticons] Number=6935 Confirmed=U Filename=MYEMOTICONS.EXE Description=MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail Source=Paul Collins Startup list [MyFastAccess] Number=6936 Confirmed=X Filename=myfastupdate.exe Description=My-Fast-Access toolbar updater Source=Paul Collins Startup list [myhuy] Number=6937 Confirmed=X Filename=huy.exe Description=Added by the BLASTER-C WORM! Source=Paul Collins Startup list [myhuy] Number=6938 Confirmed=X Filename=huy2.exe Description=Added by the BLASTER-L WORM! Source=Paul Collins Startup list [MyIE.exe] Number=6939 Confirmed=U Filename=MyIE.exe Description=MyIE2/Maxthon browser related Source=Paul Collins Startup list [MyLife] Number=6940 Confirmed=X Filename=CmdServ.exe Description=Added by the HOLAR.A WORM! Source=Paul Collins Startup list [myMh2] Number=6941 Confirmed=X Filename=iexpl0re.exe Description=Added by the DELF.FAI TROJAN! Source=Paul Collins Startup list [myNetWatchman] Number=6942 Confirmed=U Filename=nwclient.exe Description=Sends your firewall alerts to a website, which then filters them and forwards details of suspicious activities to the host ISP they originated from. Only needs to be running when your firewall is running Source=Paul Collins Startup list [MyPointsPointAlert] Number=6943 Confirmed=X Filename=wjview ...MyPointsPointAlertrun.exe Description="With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles". Dubious privacy policy Source=Paul Collins Startup list [MyPopupKiller] Number=6944 Confirmed=U Filename=mpk.exe Description=MyPopupKiller - popup killer Source=Paul Collins Startup list [myprint mileage] Number=6945 Confirmed=U Filename=mpm.exe Description=Reports battery status on a portable printer Source=Paul Collins Startup list [Mysee Alert] Number=6946 Confirmed=X Filename=Mysee Alert.exe Description=MySee Alert adware Source=Paul Collins Startup list [MyShares] Number=6947 Confirmed=X Filename=MyShares.exe Description=EHU adware Source=Paul Collins Startup list [MySLScan] Number=6948 Confirmed=X Filename=msvc32.exe Description=Added by the FORBOT-EH WORM! Source=Paul Collins Startup list [mysoft] Number=6949 Confirmed=X Filename=winexplor.exe Description=Browser hijacker, also detected as the STARTPA-JR TROJAN! Source=Paul Collins Startup list [MySoftware NewsFlash] Number=6950 Confirmed=N Filename=Newsflsh.exe Description=Runs in your task bar and receives alerts and release information on MySoftware products from Avenquest Source=Paul Collins Startup list [MySpaceIM] Number=6951 Confirmed=N Filename=MySpaceIM.exe Description=MySpaceIM internet messenger Source=Paul Collins Startup list [mysvcig38] Number=6952 Confirmed=X Filename=mysvcc.exe Description=Added by the RBOT-FOU WORM! Source=Paul Collins Startup list [mysvcig38] Number=6953 Confirmed=X Filename=recsl.exe Description=Added by a variant of the RBOT-FOU WORM! Source=Paul Collins Startup list [MyTam] Number=6954 Confirmed=X Filename=MyTam.exe Description=Covert Sys Exec malware variant Source=Paul Collins Startup list [MytekSystrayExePath] Number=6955 Confirmed=U Filename=MyTekSystray.exe Description=MyTek system tray - web site providing computer tech support in Australia Source=Paul Collins Startup list [MyTotalSearch Email Plugin] Number=6956 Confirmed=X Filename=mtsoemon.exe Description=MyTotalSearchBar adware Source=Paul Collins Startup list [MyVBApp] Number=6957 Confirmed=X Filename=SysNT.exe Description=ReferAd adware Source=Paul Collins Startup list [MyVBApp] Number=6958 Confirmed=X Filename=install.exe Description=Detected as Generic Downloader.s by McAfee, probable variant of ReferAd adware! Source=Paul Collins Startup list [MyVBApp] Number=6959 Confirmed=X Filename=setup.exe Description=Recognized by Kaspersky antivirus as the Clicker.Win32.VB.kb TROJAN! File location is in the Root folder (C:\), (D:\), etc Source=Paul Collins Startup list [MyVirt.exe] Number=6960 Confirmed=X Filename=MyVirt.exe Description=Added by the REMADM-C TROJAN! Source=Paul Collins Startup list [MyVitalAgent] Number=6961 Confirmed=U Filename=VtlAgent.exe Description=MyVitalAgent from Lucent Technologies. Replacement for Net.Medic, monitoring all popular internet transactions and alerting the user of the location of connection problems. Available via Start -> Programs Source=Paul Collins Startup list [MyWebSearch Email Plugin] Number=6962 Confirmed=X Filename=mwsoemon.exe Description=MyWebSearch parasite Source=Paul Collins Startup list [N2PTray] Number=6963 Confirmed=U Filename=Net2fone.exe Description=An Internet telephony application. Needed only if you have an account at Net2Phone, Inc Source=Paul Collins Startup list [NADaemon] Number=6964 Confirmed=N Filename=NADAEMON.EXE Description=Program by NetActive which appears to be piggybacked onto some Nvidia graphics cards software. They seem to look after "digital rights management". One user reports disabling it has no detrimental affect - not required Source=Paul Collins Startup list [Naggerrunkey] Number=6965 Confirmed=N Filename=nagger.exe Description=Packard Bell Free Internet Signup screen Source=Paul Collins Startup list [Naimagent_service] Number=6966 Confirmed=Y Filename=EPOAgentnaimas32.exe Description=Networked version of McAfee VirusScan. Installs, configures and updates the software and DAT (virus definition) files on local computers from a network server. A resource hog but required for DAT updates and if disabled can also cause random freezes and error messages Source=Paul Collins Startup list [Naimagent_UI] Number=6967 Confirmed=Y Filename=EPOAgentnaimag32.exe Description=Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan Source=Paul Collins Startup list [Naimagent_UI] Number=6968 Confirmed=Y Filename=naimag32.exe Description=Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan Source=Paul Collins Startup list [Name] Number=6969 Confirmed=X Filename=Iexplorer0.exe Description=Added by the THREADSYS TROJAN! Source=Paul Collins Startup list [Name Server] Number=6970 Confirmed=X Filename=mswins.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NAMEDPIPE SYSTEM] Number=6971 Confirmed=X Filename=namedpipe.exe Description=Added by the MYTOB-FH TROJAN! Source=Paul Collins Startup list [nano] Number=6972 Confirmed=X Filename=svchost.exe Description=Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [NAP32] Number=6973 Confirmed=X Filename=NAP32.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [Narrator] Number=6974 Confirmed=X Filename=******.exe [* = random char] Description=Added by the QOOLOGIC TROJAN! Source=Paul Collins Startup list [Narrator] Number=6975 Confirmed=U Filename=Narrator.exe Description=Associated with the Narrator accessibility feature on Windows XP. It is used to convert text to speech Source=Paul Collins Startup list [Natal] Number=6976 Confirmed=X Filename=Natal.scr Description=Added by the OPASERV.AE WORM! Source=Paul Collins Startup list [NAV] Number=6977 Confirmed=X Filename=RuxDLL32.exe Description=Added by the MAPSON.D WORM! Source=Paul Collins Startup list [NAV Agent] Number=6978 Confirmed=Y Filename=navapw32.exe Description=Norton Anti-Virus's background scanning process Source=Paul Collins Startup list [nAv AGENT] Number=6979 Confirmed=X Filename=N/A Description=Added by the RIOSYS MACRO! Note the lower-case "n" and "v" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes Source=Paul Collins Startup list [NAV Agent] Number=6980 Confirmed=X Filename=systems.exe Description=Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name Source=Paul Collins Startup list [NAV Agent] Number=6981 Confirmed=X Filename=winsnav.vbs Description=Added by the ANPES WORM! Source=Paul Collins Startup list [NAV Agent] Number=6982 Confirmed=X Filename=wmilib32.exe Description=Added by the VB-XU TROJAN! Source=Paul Collins Startup list [NAV Auto Prot] Number=6983 Confirmed=X Filename=navprot1.exe Description=Added by the RBOT.ZAC WORM! Source=Paul Collins Startup list [NAV Auto Protect] Number=6984 Confirmed=X Filename=msfwe1.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NAV Auto Protect] Number=6985 Confirmed=X Filename=navprotect.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NAV Auto Protect] Number=6986 Confirmed=X Filename=dnsserv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NAV Auto Protect] Number=6987 Confirmed=X Filename=mcafee32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [NAV Auto Update] Number=6988 Confirmed=X Filename=Navautoupdate.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [NAV Auto Updates] Number=6989 Confirmed=X Filename=csrssp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NAV Auto Updates] Number=6990 Confirmed=X Filename=navwindows.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NAV Auto Updates] Number=6991 Confirmed=X Filename=slserves.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NAV Auto Updates] Number=6992 Confirmed=X Filename=navupdaters.exe Description=Added by the RBOT-UN WORM! Source=Paul Collins Startup list [NAV Auto Updates] Number=6993 Confirmed=X Filename=navupdaterx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NAV CfgWiz] Number=6994 Confirmed=N Filename=cfgwiz.exe Description=Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it Source=Paul Collins Startup list [NAV Configuration Wizard] Number=6995 Confirmed=N Filename=cfgwiz.exe Description=Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it Source=Paul Collins Startup list [NAV DefAlert] Number=6996 Confirmed=U Filename=DefAlert.exe Description=Norton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis Source=Paul Collins Startup list [NAV Live Update] Number=6997 Confirmed=X Filename=[path to worm] Description=Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec Source=Paul Collins Startup list [NAV Scan Service] Number=6998 Confirmed=X Filename=NAVSCAN32.EXE Description=Added by the SDBOT.VG WORM! Source=Paul Collins Startup list [NavAgent32] Number=6999 Confirmed=X Filename=lasvr32.exe Description=Added by the FEMOT.D WORM! Source=Paul Collins Startup list [NavAgent32] Number=7000 Confirmed=X Filename=SCardSvr32.Exe Description=Added by the MOFEI.B WORM! Source=Paul Collins Startup list [navapp] Number=7001 Confirmed=X Filename=navapp.exe Description=NavExcel adware variant Source=Paul Collins Startup list [navapw32] Number=7002 Confirmed=Y Filename=navapw32.exe Description=Norton Anti-Virus's background scanning process Source=Paul Collins Startup list [NAVCheck] Number=7003 Confirmed=X Filename=navchk.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [NAVCheck] Number=7004 Confirmed=X Filename=shman.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [Naviscope] Number=7005 Confirmed=U Filename=naviscope.exe Description=Naviscope is a multipurpose browser enhancement that can speed up Web searches, lock out cookies, examine HTML send/receive headers, provide single-click network diagnostics, and much more Source=Paul Collins Startup list [NaviSearch] Number=7006 Confirmed=X Filename=nls.exe Description=NaviSearch, eXact Advertising variant Source=Paul Collins Startup list [NavLoad] Number=7007 Confirmed=N Filename=NAVBrowser.exe Description=Registration reminder for CorelDRAW 10 Source=Paul Collins Startup list [navman_20] Number=7008 Confirmed=X Filename=sysnav32.exe Description=Hijacker, possibly a CoolWebSearch parasite variant Source=Paul Collins Startup list [NAVMD25] Number=7009 Confirmed=? Filename=UpdtNv28.exe Description=Added by Symantec for updating the MicroDefs for their AV products - is it required? Source=Paul Collins Startup list [NAVNet] Number=7010 Confirmed=X Filename=***.tmp [* = random digit] Description=Unidentified adware Source=Paul Collins Startup list [navp.exe] Number=7011 Confirmed=X Filename=navp.exe Description=Added by the AGOBOT-OE WORM! Source=Paul Collins Startup list [NavPass] Number=7012 Confirmed=X Filename=NavPass.exe Description=Free system for gaining access to and downloading from adult content web-sites Source=Paul Collins Startup list [NavScan] Number=7013 Confirmed=X Filename=[filename] Description=Added by the OBSORB TROJAN! Source=Paul Collins Startup list [NAVSCAN32.EXE] Number=7014 Confirmed=X Filename=NAVSCAN32.exe Description=Added by the SDBOT-DO WORM! Source=Paul Collins Startup list [NAVSCANNER32] Number=7015 Confirmed=X Filename=NAVSCANNER32.EXE Description=Added by the RBOT.QC WORM! Source=Paul Collins Startup list [NAVUpd] Number=7016 Confirmed=X Filename=rundll32.exe navupd.dll, Startup Description=Added by the NAVU TROJAN! Source=Paul Collins Startup list [NAV_Update] Number=7017 Confirmed=X Filename=NAV_Update.exe Description=Unidentified WORM or TROJAN! Source=Paul Collins Startup list [nawadll32] Number=7018 Confirmed=X Filename=nawadll32.exe Description=Added by the SDBOT-ZI WORM! Source=Paul Collins Startup list [nawdll32] Number=7019 Confirmed=X Filename=nawdll32.exe Description=Added by the SDBOT-ZM WORM! Source=Paul Collins Startup list [NB Common Dialog Enhancements] Number=7020 Confirmed=N Filename=COMDLGEX.EXE Description=Part of McAfee Nuts & Bolts. With Common Dialog Enhancements, you can add MRU list box to open dialogs Source=Paul Collins Startup list [NB Start Menu] Number=7021 Confirmed=N Filename=STARTM.EXE Description=Part of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B Source=Paul Collins Startup list [NB Windows Patterns] Number=7022 Confirmed=N Filename=WINDBKGND.EXE Description=Part of McAfee Nuts & Bolts. With Background Patterns, you can change background patterns of wizard and dialog windows Source=Paul Collins Startup list [NBJ] Number=7023 Confirmed=U Filename=NBJ.exe Description=Ahead Nero BackItUp - backup program. Only required for if you have scheduled back-ups Source=Paul Collins Startup list [NbkCtrl] Number=7024 Confirmed=U Filename=NbkCtrl.exe Description=Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here Source=Paul Collins Startup list [NBKeyScan] Number=7025 Confirmed=U Filename=NBKeyScan.exe Description=This tool comes with a special version of Nero BackItUp for some external harddisks. Controls two buttons on the drive - one button power off the drive and the other directly calls Nero BackItUp to make a quick backup Source=Paul Collins Startup list [NBT System alias] Number=7026 Confirmed=X Filename=[path] repcale.exe [path] beird.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [nbustrce1D] Number=7027 Confirmed=? Filename=nbustrce1D.exe Description=Device driver, possibly CD/DVD - what exactly is it and is it required in startup? Source=Paul Collins Startup list [NC1565] Number=7028 Confirmed=X Filename=winntsrv -l -p10001 -d -e cmd.exe -L Description=Added by the NEWLEY-A WORM! Source=Paul Collins Startup list [Ncao] Number=7029 Confirmed=X Filename=osoa.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Ncao] Number=7030 Confirmed=X Filename=urpo.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [NCClient] Number=7031 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [NCD] Number=7032 Confirmed=N Filename=ncd.exe Description=Norton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path Source=Paul Collins Startup list [NCLAUNCH] Number=7033 Confirmed=? Filename=NCLAUNCH.exe Description=Part of SWF Studio from Northcode Inc. - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP. Is it required? Source=Paul Collins Startup list [nClient] Number=7034 Confirmed=X Filename=cnen.exe Description=Added by the DELBOT-AL WORM! Source=Paul Collins Startup list [NCS_SS] Number=7035 Confirmed=N Filename=Csinsm32.exe Description=Same as CleanSweep Smart Sweep-Internet Sweep Source=Paul Collins Startup list [NDAv] Number=7036 Confirmed=X Filename=csnss.exe Description=Added by the SERFLOG.C WORM! Source=Paul Collins Startup list [NDAv] Number=7037 Confirmed=X Filename=svhost.exe Description=Added by the SERFLOG.C WORM! Source=Paul Collins Startup list [NDDEAGNT] Number=7038 Confirmed=? Filename=NDDEAGNT.EXE Description=WinNT default process. Network Dynamic Data Exchange (DDE) Agent, handles requests for network DDE services Source=Paul Collins Startup list [NDIS Adapter] Number=7039 Confirmed=X Filename=ndis.exe Description=Added by the SDBOT.VF WORM! Source=Paul Collins Startup list [NDIS Adapter] Number=7040 Confirmed=X Filename=windows.exe Description=Added by the FORBOT-BR WORM! Source=Paul Collins Startup list [NDIS Adapter] Number=7041 Confirmed=X Filename=lsass2.exe Description=Added by the WOOTBOT.CW WORM! Source=Paul Collins Startup list [NDIS Adapter] Number=7042 Confirmed=X Filename=servenxpp.exe Description=Added by the FORBOT-GP WORM! Source=Paul Collins Startup list [ndlhosta] Number=7043 Confirmed=X Filename=uiremsyl.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Ndpldaemon] Number=7044 Confirmed=X Filename=[path to trojan] Description=Added by the RPCSDBOT-A TROJAN! Source=Paul Collins Startup list [NDplDeamon] Number=7045 Confirmed=X Filename=nstask32.exe Description=Added by the RANDEX.E WORM! Source=Paul Collins Startup list [NDplDeamon] Number=7046 Confirmed=X Filename=winlogin.exe Description=Added by the RANDEX.E WORM! Source=Paul Collins Startup list [NDPS] Number=7047 Confirmed=U Filename=DPMW32.EXE Description=Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature Source=Paul Collins Startup list [NDrv] Number=7048 Confirmed=X Filename=NDrv.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [NDSTray] Number=7049 Confirmed=U Filename=NDSTray.exe Description=ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have Source=Paul Collins Startup list [NDSTray.exe] Number=7050 Confirmed=U Filename=NDSTray.exe Description=ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have Source=Paul Collins Startup list [Ndtstat] Number=7051 Confirmed=X Filename=Ndtstat.exe Description=Added by a variant of the BANLOAD family of TROJANS! Source=Paul Collins Startup list [Necbar] Number=7052 Confirmed=N Filename=Necbar.exe Description=Nec Assistant; Ark's Navigator, a graphical interface for NEC computers Source=Paul Collins Startup list [NECMFK] Number=7053 Confirmed=Y Filename=necmfk.exe Description=NEC wireless keyboard driver Source=Paul Collins Startup list [Necutray] Number=7054 Confirmed=U Filename=Necutray.exe Description=Driver for external USB storage devices (hard drives, flsh disks, etc) Source=Paul Collins Startup list [neqprvfy.exe] Number=7055 Confirmed=? Filename=neqprvfy.exe Description=Appears to be related to the downloading of some application - possibly verifying updates? Source=Paul Collins Startup list [Nero] Number=7056 Confirmed=X Filename=shch.exe Description=Added by a variant of the EB TROJAN! Source=Paul Collins Startup list [Nero Checker] Number=7057 Confirmed=X Filename=nerocheck.exe Description=Added by the PROXY-X TROJAN! Note - this is not related to "Nero Burning Rom" CD writing software Source=Paul Collins Startup list [Nero DriveSpeed] Number=7058 Confirmed=N Filename=DRIVESPEED.EXE Description=Ahead Nero DriveSpeed - set the CD reading speed of a CD/DVD drive on-the-fly to reduce the noise on high-speed drives Source=Paul Collins Startup list [Nero Updater.6.12] Number=7059 Confirmed=X Filename=wmp9.exe Description=Added by the AGOBOT-AAG WORM! Source=Paul Collins Startup list [Nero.ma] Number=7060 Confirmed=X Filename=***.exe [*** = 2 to 3 digits] Description=Added by the JONBARR.D WORM! Source=Paul Collins Startup list [NeroAutoStartClient] Number=7061 Confirmed=X Filename=NeroASM.exe Description=Added by the AGOBOT.VG WORM! Source=Paul Collins Startup list [NeroCheck] Number=7062 Confirmed=U Filename=nerocheck.exe Description=Associated with "Nero Burning Rom" CD writing software. Checks for driver issues Source=Paul Collins Startup list [NeroCheck] Number=7063 Confirmed=X Filename=regedit.exe Description=Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD/DVD burning program. Also, it is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [NeroFil] Number=7064 Confirmed=X Filename=NeroFil.EXE Description=Added by the RBOT.EAM TROJAN! Source=Paul Collins Startup list [NeroFilterCheck] Number=7065 Confirmed=U Filename=NeroCheck.exe Description=Associated with "Nero Burning Rom" CD writing software. Checks for driver issues Source=Paul Collins Startup list [NeroHomeFirstStart] Number=7066 Confirmed=U Filename=NMFirstStart.exe Description=Associated with Nero Scout, added by version 7 of the Nero digital media suite (CD & DVD burning, authoring, etc). Thanks to Help2Go.com, if you feel this is draining more resources that necessary you can disable it by clicking here Source=Paul Collins Startup list [NeroLoader] Number=7067 Confirmed=X Filename=NeroLoader.exe Description=Added by the BANCBAN-EJ TROJAN! Source=Paul Collins Startup list [NeroNETTrayIcon] Number=7068 Confirmed=N Filename=NNServiceCtrl.exe Description=System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network Source=Paul Collins Startup list [NeroUpdater6.8] Number=7069 Confirmed=X Filename=winjava.exe Description=Added by the AGOBOT.AMK WORM! Source=Paul Collins Startup list [Net] Number=7070 Confirmed=X Filename=WINREG.EXE Description=Added by the ASSASIN.D TROJAN! Source=Paul Collins Startup list [Net Accelerator] Number=7071 Confirmed=U Filename=NetAccelerator.exe Description=Rizal NetAccelerator - "Optimizing Dial-Up, Lan, Cable, DSL, and Satellite connections do you want to speed up your Internet access up to 200% - 300% ???". Only required if you find it helps improve your performance Source=Paul Collins Startup list [Net Activity Diagram] Number=7072 Confirmed=U Filename=nad.exe Description=Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs Source=Paul Collins Startup list [NET Bios Stats] Number=7073 Confirmed=X Filename=ntbstats.exe Description=Added by the SDBOT-ZX WORM! Source=Paul Collins Startup list [NET DEMON] Number=7074 Confirmed=X Filename=ndemon.exe Description=Added by the AGOBOT-LA WORM! Source=Paul Collins Startup list [Net iD] Number=7075 Confirmed=U Filename=iid.exe Description="With the Net_iD program, you can easily and securely logon with a smart card into a domain, a virtual private network (VPN) or in Citrix and Terminal Server environments" Source=Paul Collins Startup list [Net**.exe [* = random char]] Number=7076 Confirmed=X Filename=Net**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Net**32.exe [* = random char]] Number=7077 Confirmed=X Filename=Net**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Net-It Launcher] Number=7078 Confirmed=N Filename=NILaunch.exe Description=Net-It - web publishing software Source=Paul Collins Startup list [NetAccelerator] Number=7079 Confirmed=U Filename=NetAccel.exe Description=NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster, browse faster, surf faster!. Only required if you find it helps improve your performance Source=Paul Collins Startup list [NetAdm7] Number=7080 Confirmed=X Filename=NETADM7.EXE Description=Added by the BANCOS.F TROJAN! Source=Paul Collins Startup list [Netapi] Number=7081 Confirmed=X Filename=Netapi.exe Description=Added by the NETDEVIL.14 TROJAN! Source=Paul Collins Startup list [netapi32] Number=7082 Confirmed=X Filename=netapi32.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [NetApp] Number=7083 Confirmed=X Filename=winserv.exe Description=Added by the SHADOWTHIEF TROJAN! Source=Paul Collins Startup list [Netbeans] Number=7084 Confirmed=X Filename=netbeans.exe Description=Added by the DELBOT-R WORM! Source=Paul Collins Startup list [Netbios Helper] Number=7085 Confirmed=X Filename=nbthlp.exe Description=Added by the BANKER.Y TROJAN! Source=Paul Collins Startup list [NetBiosSrvc] Number=7086 Confirmed=X Filename=HPSrvPrt.exe Description=Added by the SDBOT-COL WORM! Source=Paul Collins Startup list [netconfig] Number=7087 Confirmed=X Filename=netconfig.exe Description=Added by the NETWARE TROJAN! Source=Paul Collins Startup list [NetCruiser Dialer] Number=7088 Confirmed=U Filename=NCDialer.exe Description=NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected, dial and hangup at predefined times and automatic redialing of dropped connections" Source=Paul Collins Startup list [netdaemon] Number=7089 Confirmed=X Filename=netdaemon /v Description=Malware designed to "kill" a number of antispyware applications (SpyBot, Giant, SpyDoctor, SpySweeper, SpyHunter, Anvir, WinPatrol, and more) Source=Paul Collins Startup list [netdll32] Number=7090 Confirmed=X Filename=netdll32.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [netdllex] Number=7091 Confirmed=X Filename=netdllex.Exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [NetDy] Number=7092 Confirmed=X Filename=VisualGuard.exe Description=Added by the NETSKY.N or NETSKY.W WORMS! Source=Paul Collins Startup list [NETFP32.EXE] Number=7093 Confirmed=X Filename=NETFP32.EXE Description=Added by the AGENT.CD TROJAN! Source=Paul Collins Startup list [netfxupdate] Number=7094 Confirmed=? Filename=netfxupdate.exe Description=Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan Source=Paul Collins Startup list [NetFxUpdate_v1.0.3705] Number=7095 Confirmed=? Filename=netfxupdate.exe Description=Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan Source=Paul Collins Startup list [NETGEAR WG111T Smart Wizard] Number=7096 Confirmed=U Filename=wlan111t.exe Description=Configuration utility for the Netgear WG111T multi-rate Wireless USB 2.0 Adapter that "provides wireless access to your desktop or notebook PC through the computer's USB port" Source=Paul Collins Startup list [NetGuard] Number=7097 Confirmed=U Filename=NetGuard.exe Description=FBM Software ZeroSpyware 2004 spyware detector and remover - real time monitor Source=Paul Collins Startup list [nethost.exe] Number=7098 Confirmed=X Filename=[path to file] Description=Added by the PERDA-J TROJAN! Source=Paul Collins Startup list [Netlimiter] Number=7099 Confirmed=U Filename=Netlimiter.exe Description=Netlimiter - "An internet traffic control tool to monitor applications which access the internet and actively control their internet traffic. Use it o set (download/upload) speed limits for applications or even single connection. NetLimiter also allows you to share your internet connection bandwidth among all applications running on your PC." Source=Paul Collins Startup list [Netline User] Number=7100 Confirmed=N Filename=netchk.exe Description=Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game, for example Source=Paul Collins Startup list [NetLink] Number=7101 Confirmed=X Filename=netlink32.exe Description=Added by the GAOBOT.WO WORM! Source=Paul Collins Startup list [NetLogon] Number=7102 Confirmed=X Filename=userint.exe Description=Added by the SDBOT-BC WORM! Source=Paul Collins Startup list [NetManageImport] Number=7103 Confirmed=U Filename=nmcpdata.exe Description=NetManage business software related Source=Paul Collins Startup list [NetManagerService] Number=7104 Confirmed=X Filename=ntss.exe Description=Added by the BESTPICS.A TROJAN! Source=Paul Collins Startup list [NetMeter] Number=7105 Confirmed=X Filename=NetMeter.exe Description=NetRatings Premeter spyware Source=Paul Collins Startup list [NetMeter] Number=7106 Confirmed=X Filename=NielsenOnline.exe Description=Appears to have possible Malware functions, for more information see here Source=Paul Collins Startup list [NetMon] Number=7107 Confirmed=X Filename=netmon.exe Description=Added by the MIMAIL.M WORM! Source=Paul Collins Startup list [Netmonw] Number=7108 Confirmed=X Filename=Netmonw.exe Description=Added by the BDOOR-FX TROJAN! Source=Paul Collins Startup list [netmsg] Number=7109 Confirmed=U Filename=netmsg.exe Description=Net_Message is a small tool to send messages across the network, using the Windows Messenger Service, so there is no client install required to receive the messages. It has a number of other features as well Source=Paul Collins Startup list [NetPatrol] Number=7110 Confirmed=U Filename=winclient.exe Description=NetPatrol network monitoring software Source=Paul Collins Startup list [netpc32.exe] Number=7111 Confirmed=X Filename=netpc32.exe Description=Malware, probably a CoolWebSearch parasite variant Source=Paul Collins Startup list [NetPerSec] Number=7112 Confirmed=N Filename=NetPerSec.exe Description=NetPerSec - measures the real-time speed of your Internet connection Source=Paul Collins Startup list [NetPumper] Number=7113 Confirmed=N Filename=NetPumperIEProxy.exe Description=NetPumper download manager - bundles Cydoor and SaveNow adware, see here Source=Paul Collins Startup list [NetReach] Number=7114 Confirmed=X Filename=nrcheck.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Netropa Internet Receiver] Number=7115 Confirmed=X Filename=Netropa.exe Description=Netropa Internet Receiver. Shows a scrolling bar with the news. Major resource hog and flagged as spyware Source=Paul Collins Startup list [NetRun] Number=7116 Confirmed=U Filename=NetRun.exe Description=NetRun - will 'RUN' a 'List' of programs only when a internet connection is detected, and close/kill the same 'List' when the connection is lost Source=Paul Collins Startup list [Netscape Messenger] Number=7117 Confirmed=N Filename=NETSCAPE.EXE Description=In Netscape 6 (I know for sure with 6.2.1, maybe with 6.0) Netscape.exe is the main executable file for Netscape Navigator, Netscape Mail and News, and Netscape Messenger (the new name for the embedded AIM, no doubt to make it sound like Windows Messenger, the XP version of MSN Messenger). Basically, netscape.exe can be more than just Netscape Messenger, and Messenger can be more then just AIM in disguise, depending on the version of Netscape installed Source=Paul Collins Startup list [Netscp6] Number=7118 Confirmed=N Filename=Netscp6.exe Description=Netscape 6 Source=Paul Collins Startup list [NetScreen-Remote] Number=7119 Confirmed=U Filename=SafeCfg.exe Description=NetScreen Remote VPN client software Source=Paul Collins Startup list [NetService] Number=7120 Confirmed=X Filename=ntsvc.exe Description=Added by the QQPASS-DU TROJAN! Source=Paul Collins Startup list [netservices] Number=7121 Confirmed=X Filename=recall.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [netservices] Number=7122 Confirmed=X Filename=svchostn.exe Description=Added by the SDBOT.GI WORM! Source=Paul Collins Startup list [NETServices] Number=7123 Confirmed=X Filename=csxrs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NetShow Powerpoint Helper] Number=7124 Confirmed=U Filename=NSPPTHLP.EXE Description=If disabled, user created fonts can no longer be seen by other programs Source=Paul Collins Startup list [NetStart] Number=7125 Confirmed=X Filename=svchost.exe Description=Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a NETSTART subfolder Source=Paul Collins Startup list [NetStat Live] Number=7126 Confirmed=N Filename=Nsl.exe Description=AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data Source=Paul Collins Startup list [netsv32] Number=7127 Confirmed=X Filename=netsv32.exe Description=Added by the SDBOT-PX WORM! Source=Paul Collins Startup list [NettGain2000] Number=7128 Confirmed=Y Filename=WgwMngr.exe Description=Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so Source=Paul Collins Startup list [NettGain2000 Verifier] Number=7129 Confirmed=Y Filename=NettGain2000 Verifier.exe Description=Part of the Starband satellite client that attempts to optimize your satellite connection to increase speed Source=Paul Collins Startup list [NetTime] Number=7130 Confirmed=U Filename=NETTIME.EXE Description=From a visitor - "This is the executable for NetTime. It is started from the registry when you check the box to start at startup. NetTime allows you to synchronize your computers' clock with a server on your local net or the internet using any of several protocols, e.g. NTP." Source=Paul Collins Startup list [NetTurbo] Number=7131 Confirmed=U Filename=netturbo.exe Description=NetTurbo from SharewareOnline.com. "Accelerate Your Internet Connections by up to 600%". If you find it helps your connectivity leave it enabled Source=Paul Collins Startup list [Netunit32] Number=7132 Confirmed=X Filename=wunit32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [NETVISIONAdulti] Number=7133 Confirmed=X Filename=[random filename] Description=Trafficadvance dialer Source=Paul Collins Startup list [NETVISIONPasse-partout] Number=7134 Confirmed=X Filename=Passe-partout.exe Description=Added by the DIALCAR-M DIALER! Source=Paul Collins Startup list [NetWatch32] Number=7135 Confirmed=X Filename=netwatch.exe Description=Added by the MIMAIL.C WORM! Source=Paul Collins Startup list [Netword Agent] Number=7136 Confirmed=N Filename=nwant33.exe Description=An interesting browser utility that allows you to navigate by typing a single word or phrase (a "NetWord") related to what you're looking for into your browser's location field. It also puts an icon in the system tray icon that is a circle with the letter N in the center to access the menu faster. Available via Start -> Programs Source=Paul Collins Startup list [NetWork] Number=7137 Confirmed=X Filename=csrs.exe Description=Added by the AGOBOT.JJ WORM! Source=Paul Collins Startup list [Network Access] Number=7138 Confirmed=X Filename=winssh.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Network Administration] Number=7139 Confirmed=X Filename=NAS.exe Description=Added by the ANTILAM.20.Q TROJAN! Source=Paul Collins Startup list [Network Administration Service] Number=7140 Confirmed=X Filename=rsvc32.exe Description=Added by the RBOT.ABH WORM! Source=Paul Collins Startup list [Network Associates Error Reporting Service] Number=7141 Confirmed=U Filename=TBMon.exe Description=Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software Source=Paul Collins Startup list [Network Connections] Number=7142 Confirmed=X Filename=internat.exe Description=Added by the ZD TROJAN! Source=Paul Collins Startup list [network device driver] Number=7143 Confirmed=X Filename=msfirewall.exe Description=Added by the DELF-LB TROJAN! Source=Paul Collins Startup list [NetWork Device Switch] Number=7144 Confirmed=U Filename=NetDevSW.exe Description=Toshiba laptops with built-in Wi-Fi. Allows switching between Wi-Fi and internal ethernet. Only necessary if you have regular need to switch back and forward between these network interfaces. Located in Startup folder so make own shortcut to it and disable if not really necessary Source=Paul Collins Startup list [Network Host Controller] Number=7145 Confirmed=X Filename=[path to trojan] Description=Added by the WHISPER TROJAN! Source=Paul Collins Startup list [Network Host Service] Number=7146 Confirmed=X Filename=msmnart32.exe Description=Added by the RBOT-CJV WORM! Source=Paul Collins Startup list [Network Host Service] Number=7147 Confirmed=X Filename=[random]32.exe Description=Added by the RBOT-BAB WORM! Source=Paul Collins Startup list [Network Protocol Service] Number=7148 Confirmed=X Filename=wuamgrd.exe Description=Added by the RBOT.EA WORM! Source=Paul Collins Startup list [Network protocol service] Number=7149 Confirmed=X Filename=wintcp.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Network Security] Number=7150 Confirmed=X Filename=secsvc.exe Description=Added by the RBOT-ALX WORM! Source=Paul Collins Startup list [Network Security Guard] Number=7151 Confirmed=X Filename=**********.exe [* = random char] Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Network Security Guard] Number=7152 Confirmed=X Filename=[path to trojan] Description=Added by the COLEM-A TROJAN! Source=Paul Collins Startup list [Network Service] Number=7153 Confirmed=X Filename=svchost.exe Description=Added by the STARTPA-CC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Network Service] Number=7154 Confirmed=X Filename=svhost.exe Description=Added by the HACDEF-K TROJAN! Source=Paul Collins Startup list [Network Service] Number=7155 Confirmed=X Filename=MccTrayApp.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Network Service Manager] Number=7156 Confirmed=X Filename=netsvc.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Network Service Manager] Number=7157 Confirmed=X Filename=netsvc.exe Description=Added by a variant of the GAOBOT/AGOBOT WORM! Source=Paul Collins Startup list [NetworkAssociates Inc] Number=7158 Confirmed=X Filename=internet.exe Description=Added by the LOVGATE WORM! Source=Paul Collins Startup list [NetworkClient] Number=7159 Confirmed=X Filename=NetworkClient.exe Description=Added by the LEMUR WORM! Source=Paul Collins Startup list [NetworkKey] Number=7160 Confirmed=X Filename=netkey.exe Description=Added by the IRCBOT-AJ TROJAN! Source=Paul Collins Startup list [Networks Configurator] Number=7161 Confirmed=X Filename=NetConfs.exe Description=Added by the RBOT-OX WORM! Source=Paul Collins Startup list [Networks Controler] Number=7162 Confirmed=X Filename=Netsis.exe Description=Added by the RBOT-NG WORM! Source=Paul Collins Startup list [NetworkSetup] Number=7163 Confirmed=N Filename=dlink.exe Description=D-Link System Tray icon Source=Paul Collins Startup list [Netzip Smart Downloader] Number=7164 Confirmed=X Filename=npnzdad.exe Description=Advertising spyware Source=Paul Collins Startup list [NetZIPFolders] Number=7165 Confirmed=N Filename=nzfprop.exe Description=Netzip Classic zip file manager Source=Paul Collins Startup list [NeuroMedia(IESpeaker)] Number=7166 Confirmed=X Filename=NeuroMedia.exe Description=Part of an older freeware version of IESpeaker - a program that allows you to listen to web pages. NeuroMedia.exe only downloads advertisments. Not included in the paid-for version currently available Source=Paul Collins Startup list [NeuroSpeech OESpeaker] Number=7167 Confirmed=N Filename=OEMonitor.exe Description=Part of OESpeaker - a program that allows you to listen to long E-mails instead of reading them in Outlook Express. OEMonitor.exe checks whether OE is open or not Source=Paul Collins Startup list [New Csnm Manager] Number=7168 Confirmed=X Filename=csmn.exe Description=Added by the SDBOT.BZS WORM! Source=Paul Collins Startup list [New.net] Number=7169 Confirmed=X Filename=rundll32.exe NewDotNetStartup Newdot~2.exe Description=NewDotNet foistware Source=Paul Collins Startup list [New.net Startup] Number=7170 Confirmed=X Filename=rundll32 [path], NewDotNetStartup -s Description=NewDotNet foistware Source=Paul Collins Startup list [NEWDOT~1] Number=7171 Confirmed=X Filename=rundll32.exe NewDotNetStartup Newdot~2.exe Description=NewDotNet foistware Source=Paul Collins Startup list [Newman] Number=7172 Confirmed=X Filename=playavi.exe Description=Added by the LINEAGE-AT TROJAN! Note - This trojan file is found in the Windows\java or Winnt\java folder Source=Paul Collins Startup list [newname] Number=7173 Confirmed=X Filename=[path to trojan] Description=Added by the DRSMARTL-S TROJAN! Source=Paul Collins Startup list [News Service] Number=7174 Confirmed=? Filename=ispnews.exe Description=F-Secure antivirus related. However, is this particular item required? Source=Paul Collins Startup list [Newsalrt] Number=7175 Confirmed=N Filename=NEWSALRT.EXE Description=MSNBC News system tray utility to alert you to new news Source=Paul Collins Startup list [Newsgroup lptt01] Number=7176 Confirmed=X Filename=newsgroup.exe Description=RapidBlaster variant (in a "newsgroup" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Newsgroup ml097e] Number=7177 Confirmed=X Filename=newsgroup.exe Description=RapidBlaster variant (in a "newsgroup" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [NewsUpd] Number=7178 Confirmed=N Filename=newsupd.exe Description=For Creative Soundblaster Live! series soundcards. System tray application for News updates. Available via Start -> Programs. Also spyware - see here. Source=Paul Collins Startup list [NewtonKnowsUpd] Number=7179 Confirmed=X Filename=NewtKnow.exe ...NewtnUpd.dll, runkey Description=NewtonKnows hijacker Source=Paul Collins Startup list [NexusServer] Number=7180 Confirmed=U Filename=PNXSERVR.exe Description=Related to ProCoder 2.0 from Canopus. "ProCoder 2.0 software combines speed and flexibility into a streamlined video conversion tool for professionals. Featuring, extensive input/output options, advanced filtering, batch processing and an easy-to-use interface, ProCoder 2.0 is the ideal solution for high-quality multi-format video creation" Source=Paul Collins Startup list [NFM Service] Number=7181 Confirmed=U Filename=NPDOR9x.exe Description=Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required Source=Paul Collins Startup list [Nfo] Number=7182 Confirmed=X Filename=nfomon.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [nForce Tray Options] Number=7183 Confirmed=N Filename=sstray.exe Description=nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys Source=Paul Collins Startup list [NGClient] Number=7184 Confirmed=U Filename=ngctw32.exe Description=Symantec Ghost Server software - needed for a "a Ghost multicast" (transfer images to multiple machines). Can be launched manually Source=Paul Collins Startup list [ngpw36] Number=7185 Confirmed=X Filename=ngpw36.exe Description=AdBlaster adware variant Source=Paul Collins Startup list [NGServer] Number=7186 Confirmed=N Filename=ngserver.exe Description=Symantec/Norton Ghost Console service Source=Paul Collins Startup list [NI.UERSM_0001_N68M1602] Number=7187 Confirmed=N Filename=UERSM_0001_N68M1602NetInstaller.exe Description=ErrorSafe security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [NI.UWA6P_0001_N56M1001] Number=7188 Confirmed=X Filename=WinAntiVirusPro2006Installer.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [NI.UWA6P_0001_N69M0303] Number=7189 Confirmed=U Filename=WinAntiVirusPro2006Installer[1].exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [NI.UWA6P_0001_N73M1004] Number=7190 Confirmed=N Filename=WinAntiVirusPro2006FreeInstall.exe Description=WinAntiVirus Pro 2006 virus software - not recommended, see here Source=Paul Collins Startup list [NI.UWA6P_0001_N91M1807] Number=7191 Confirmed=N Filename=winantiviruspro2006freeinstall[1].exe Description=WinAntiVirus Pro 2006 virus software - not recommended, see here Source=Paul Collins Startup list [NI.UWA7P_0001_N91M0809] Number=7192 Confirmed=N Filename=winantiviruspro2007freeinstall[1].exe Description=WinAntiVirus Pro 2007 virus software - not recommended, see here Source=Paul Collins Startup list [NI.UWAS6_0001_N68M2301] Number=7193 Confirmed=X Filename=UWAS6_0001_N68M2301NetInstaller.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [NI.UWFX5] Number=7194 Confirmed=X Filename=UWFX5NetInstaller.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [NI.UWFX5T] Number=7195 Confirmed=X Filename=UWFX5TNetInstaller.exe Description=Added by the DOWNLDR-BO TROJAN! Source=Paul Collins Startup list [NI.UWFX5[various]] Number=7196 Confirmed=X Filename=[various filenames] Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here. Example filenames are UWFX5LP_0001_0802NetInstaller.exe, UWFX5V_0001_0802NetInstaller.exe, UWFX5_0001_N66M1101NETINSTALLER.EXE, 1D7C.tmp, WinFixerScannerInstall[1].exe Source=Paul Collins Startup list [NiceDownloads] Number=7197 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [Nielsen NetRatings] Number=7198 Confirmed=X Filename=insight.exe Description=NetRatings Premeter spyware Source=Paul Collins Startup list [NIHomeAM] Number=7199 Confirmed=U Filename=LiteClientAM.exe Description=A managed web based internet security service that provides comprehensive & total protection for laptops/desktops - regardless of how, when or where they connect to the Internet. Made by Netintelligence Ltd Source=Paul Collins Startup list [nikLaus] Number=7200 Confirmed=X Filename=nikLaus.exe Description=Added by the NIKLAS WORM! Source=Paul Collins Startup list [NInit] Number=7201 Confirmed=N Filename=NInit.exe Description=Norton Uninstall Deluxe. Monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging - not required Source=Paul Collins Startup list [nisserv] Number=7202 Confirmed=Y Filename=NISSERV.EXE Description=Norton Personal Firewall Source=Paul Collins Startup list [Nisum] Number=7203 Confirmed=Y Filename=NISUM.EXE Description=Norton Personal Firewall Source=Paul Collins Startup list [niSvcLoc] Number=7204 Confirmed=U Filename=niSvcLoc.exe Description=Related to National Instruments Corp. LabView Source=Paul Collins Startup list [NJG40] Number=7205 Confirmed=X Filename=NJG40.EXE Description=Added by the BANCOS.D TROJAN! Source=Paul Collins Startup list [NkbMonitor] Number=7206 Confirmed=N Filename=NkbMonitor.exe Description=Part of Nikon PictureProject - image management for Nikon digital cameras Source=Paul Collins Startup list [NkvMon.exe] Number=7207 Confirmed=N Filename=NkvMon.exe Description=Nikon View 5 - for transferring pictures from Nikon digital cameras Source=Paul Collins Startup list [NkVwMon.exe] Number=7208 Confirmed=N Filename=NkVwMon.exe Description=Nikon View - for transferring pictures from Nikon digital cameras Source=Paul Collins Startup list [NliaClient] Number=7209 Confirmed=U Filename=Netpia.exe Description=Netpia NLIA System - "In the existing Internet address system, the Domain Name System (DNS) layer runs on the IP address layer. In the NLIA system, however, the upper layer is implemented on DNS" Source=Paul Collins Startup list [NLS Keyboard] Number=7210 Confirmed=X Filename=keyboard.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [NLS Monitor] Number=7211 Confirmed=X Filename=nlsmon.exe Description=Added by the RBOT-AXJ WORM! Source=Paul Collins Startup list [nmapp] Number=7212 Confirmed=U Filename=nmapp.exe Description=Pure Networks "Network Magic eliminates common frustrations and saves time by simplifying and automating set up, management and repair of home networks, and makes printer and file sharing effortless" Source=Paul Collins Startup list [NMBgMonitor] Number=7213 Confirmed=U Filename=NMBgMonitor.exe Description=Associated with Nero Scout, added by version 7 of the Nero digital media suite (CD & DVD burning, authoring, etc). Thanks to Help2Go.com, if you feel this is draining more resources that necessary you can disable it by clicking here Source=Paul Collins Startup list [NMFirstStart] Number=7214 Confirmed=U Filename=NMFirstStart.exe Description=Associated with Nero Scout, added by version 7 of the Nero digital media suite (CD & DVD burning, authoring, etc). Thanks to Help2Go.com, if you feel this is draining more resources that necessary you can disable it by clicking here Source=Paul Collins Startup list [nmgr] Number=7215 Confirmed=X Filename=nnmgr.exe Description=Added by the Adware.FFToolBar adware toolbar Source=Paul Collins Startup list [NMSSvc] Number=7216 Confirmed=? Filename=NMSSVC.EXE Description=NIC Management Service - diagnostics program for Intel Pro family network cards Source=Paul Collins Startup list [NMSVC] Number=7217 Confirmed=Y Filename=nmSvc.exe Description=Covenant Eyes - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Disabling it means loss of internet connection until renabled - therefore required if you use it Source=Paul Collins Startup list [nMTaskBarService] Number=7218 Confirmed=? Filename=nMtsk.exe Description=Taskbar control for ISDN NetMod modem. What does it do and is it required? Source=Paul Collins Startup list [NNLL] Number=7219 Confirmed=U Filename=nnll.exe Description=Net Nanny internet filter Source=Paul Collins Startup list [nnqcouu] Number=7220 Confirmed=X Filename=nnqcouu.exe Description=The Abi Network adware Source=Paul Collins Startup list [NNSvc] Number=7221 Confirmed=U Filename=nnsvc.exe Description=Net Nanny internet filter Source=Paul Collins Startup list [No Credit Card] Number=7222 Confirmed=X Filename=plugin-[random].exe Description=Adult content pop-up dialler Source=Paul Collins Startup list [No-IP DUC] Number=7223 Confirmed=U Filename=DUC20.exe Description=Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available Source=Paul Collins Startup list [NoAds] Number=7224 Confirmed=U Filename=NoAds.exe Description=Blocks advertisement banners in Internet Explorer Source=Paul Collins Startup list [NoAdware] Number=7225 Confirmed=U Filename=NoAdware.exe Description=NoAdware - spyware remover. This version is not recommended - see here Source=Paul Collins Startup list [NoAdware3] Number=7226 Confirmed=U Filename=NoAdware3.exe Description=NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here Source=Paul Collins Startup list [NoAdware4] Number=7227 Confirmed=U Filename=NoAdware4.exe Description=NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here Source=Paul Collins Startup list [Nocana] Number=7228 Confirmed=X Filename=[path to worm] Description=Added by the ANACON-B WORM! Source=Paul Collins Startup list [NOD32 FiX] Number=7229 Confirmed=X Filename=regedt32.exe Description=NodFix is a is a potentially unwanted application. This application is given an (X) status because we does not and will not support Cracks or Warez. Do not delete the regedt32.exe as it is the legitimate Windows application. NodFix interferes with the default settings of the NOD32 AV application allowing to bypass its free using period as well as changes the default update server to that eval signatures thus allowing to update NOD32 without password. Note - to avoid interfering with the NOD32 application original settings no full cleanup can be provided Source=Paul Collins Startup list [Nod32 Free antivirus] Number=7230 Confirmed=X Filename=nod32krn.exe Description=Added by the RBOT-AAO WORM! Note - not the popular free NOD32 antivirus software, which shares the same filename Source=Paul Collins Startup list [Nod32 Service] Number=7231 Confirmed=X Filename=nod64.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Nod32 Service] Number=7232 Confirmed=X Filename=alserv32.exe Description=Added by the RBOT.DHN WORM! Source=Paul Collins Startup list [Nod32CC] Number=7233 Confirmed=U Filename=nod32cc.exe Description=Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button Source=Paul Collins Startup list [NOD32kernel] Number=7234 Confirmed=Y Filename=Nod32krn.exe Description=NOD32 antivirus Source=Paul Collins Startup list [nod32kui] Number=7235 Confirmed=Y Filename=nod32kui.exe Description=NOD32 antivirus Source=Paul Collins Startup list [NOD32POP3] Number=7236 Confirmed=Y Filename=Pop3scan.exe Description=POP3 E-mail part of Eset's NOD32 virus-scanner Source=Paul Collins Startup list [Nod3d2 Free antivirus] Number=7237 Confirmed=X Filename=N0D32KRN.EXE Description=Added by the RBOT-ABQ WORM! Source=Paul Collins Startup list [NodeMnger] Number=7238 Confirmed=? Filename=Nodemngr.exe Description=Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon? Source=Paul Collins Startup list [nodriver] Number=7239 Confirmed=X Filename=AUEKXRZ.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Noha] Number=7240 Confirmed=X Filename=aasd.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Nokia Check] Number=7241 Confirmed=X Filename=nokiacheck.exe Description=Added by the WORM_RBOT.CDC WORM! Source=Paul Collins Startup list [Nokia Connection Monitor] Number=7242 Confirmed=N Filename=NclConf.exe Description=Monitors the infrared port, the serial ports and the Bluetooth for a Nokia phone connection. It is installed by the Nokia PC Suite (and Nokia PC Connectivity SDK), and the tray icon shows if a phone has been connected. If you have a conflict with another program, such as TV tuner card remote control monitor, you can disable it, and run only when needed. Available via a desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [Nokia Tray Application] Number=7243 Confirmed=U Filename=NclTray.exe Description=Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." Synchronize the phone with, for example Outlook. You can also use it to browse your phone, edit the phone list and so on Source=Paul Collins Startup list [NOMAD Detector] Number=7244 Confirmed=U Filename=ctnmrun.exe Description=Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected Source=Paul Collins Startup list [NomdCheck] Number=7245 Confirmed=N Filename=nomdchek.exe Description=Part of Intel's Native Audio Source=Paul Collins Startup list [nomtray] Number=7246 Confirmed=U Filename=nomtray.exe Description=System Tray access to NetMotion Wireless options - including connectivity status (see here) Source=Paul Collins Startup list [Nord] Number=7247 Confirmed=X Filename=nordsys.exe Description=Added by the DREF-S WORM! Source=Paul Collins Startup list [Norman ZANDA] Number=7248 Confirmed=U Filename=ZLH.EXE Description=System Tray icon for Norman Antivirus Source=Paul Collins Startup list [NortE Antivirus] Number=7249 Confirmed=X Filename=norte.exe Description=Added by the RBOT.BQQ WORM! Source=Paul Collins Startup list [NortE Antivirus] Number=7250 Confirmed=X Filename=norten.exe Description=Added by the RBOT-AFF WORM! Source=Paul Collins Startup list [norten Software Intrenet] Number=7251 Confirmed=X Filename=norten.pif Description=Added by the RBOT-AWA WORM! Source=Paul Collins Startup list [Norton Antiviral Scanner] Number=7252 Confirmed=X Filename=navscnr.exe Description=Added by the DELBOT-K WORM! Source=Paul Collins Startup list [Norton Antivirus] Number=7253 Confirmed=X Filename=nortonav.exe Description=Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV! Source=Paul Collins Startup list [Norton Antivirus 2004] Number=7254 Confirmed=X Filename=SYMANTECAV2.EXE Description=Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV! Source=Paul Collins Startup list [Norton Antivirus 7.0a] Number=7255 Confirmed=X Filename=[path to file] Description=Added by the PERDA-B or RANCK-CT TROJANS! Source=Paul Collins Startup list [Norton Antivirus AV] Number=7256 Confirmed=X Filename=FVProtect.exe Description=Added by the NETSKY.P WORM! Note - this is not the popular AV software! Source=Paul Collins Startup list [Norton AntiVirus Sys] Number=7257 Confirmed=X Filename=NAVsys32.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Norton Antivirus Updater] Number=7258 Confirmed=X Filename=nortonav.exe Description=Added by the DELBOT-T WORM! Note - this is not the real Norton AV! Source=Paul Collins Startup list [Norton Auto Protect] Number=7259 Confirmed=X Filename=nava.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Norton Auto Protect] Number=7260 Confirmed=X Filename=crss32.exe Description=Added by the SDBOT.ATF WORM! Source=Paul Collins Startup list [Norton Auto-Protect] Number=7261 Confirmed=Y Filename=navapw32.exe Description=Norton Anti-Virus's background scanning process Source=Paul Collins Startup list [Norton Auto-Protect] Number=7262 Confirmed=X Filename=ccApp.exe Description=Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is "navapexe". This is also not the valid Norton AV file with the same filename Source=Paul Collins Startup list [Norton Auto-Protect] Number=7263 Confirmed=X Filename=SERVICES.exe Description=Added by the Ahker.B WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder. Also, this is not part of Norton AV Source=Paul Collins Startup list [Norton AV Preload] Number=7264 Confirmed=? Filename=Premend.exe Description=Norton Antivirus related. What does it do and is it required Source=Paul Collins Startup list [Norton AV Protection Startup] Number=7265 Confirmed=X Filename=Ati2xxx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Norton Crashguard Monitor] Number=7266 Confirmed=N Filename=cgmenu.exe Description=Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001 Source=Paul Collins Startup list [Norton Disk Doctor] Number=7267 Confirmed=N Filename=Ndd32.exe Description=Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, checking for disk errors. Better than ScanDisk but can be started manually via Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup folder as well Source=Paul Collins Startup list [Norton Drive Protection] Number=7268 Confirmed=X Filename=msdt32.exe Description=Added by the FORBOT-GB WORM! Note - this not a valid Norton program! Source=Paul Collins Startup list [Norton eMail Protect] Number=7269 Confirmed=Y Filename=POPROXY.EXE Description=Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it Source=Paul Collins Startup list [Norton Firewall] Number=7270 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-ET TROJAN! Source=Paul Collins Startup list [Norton Ghost 9.0] Number=7271 Confirmed=N Filename=GhostTray.exe Description=Norton Ghost tray icon - the application can be launched manually Source=Paul Collins Startup list [Norton Guard 32] Number=7272 Confirmed=X Filename=ntguard32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Norton Live Update Server] Number=7273 Confirmed=X Filename=cpsdv.exe Description=Added by the AGOBOT.EW TROJAN! Source=Paul Collins Startup list [Norton Live Updater] Number=7274 Confirmed=X Filename=Cavapsvc.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Norton Live Updater] Number=7275 Confirmed=X Filename=Sochost.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Norton Navigator Loader] Number=7276 Confirmed=N Filename=nnloader.exe Description=An older Norton utility for file management under Windows 95. More information here Source=Paul Collins Startup list [Norton Personal Firewall] Number=7277 Confirmed=X Filename=jah.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Norton Personal Firewall] Number=7278 Confirmed=X Filename=npfw.exe Description=Added by the RBOT-UI WORM! Source=Paul Collins Startup list [Norton Personal Firewall] Number=7279 Confirmed=X Filename=lah.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Norton Personal Firewall] Number=7280 Confirmed=X Filename=npfw32.exe Description=Added by the RBOT-UQ WORM! Source=Paul Collins Startup list [Norton Personal Firewall] Number=7281 Confirmed=Y Filename=IntroWiz.exe Description=Part of Norton Personal Firewall or Norton Internet Security Source=Paul Collins Startup list [Norton Program Scheduler] Number=7282 Confirmed=U Filename=nsched32.exe Description=Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95, WinNT(?), Win2K(?)) to schedule automatic tasks such as Norton Anti-Virus scans Source=Paul Collins Startup list [Norton Program Scheduler] Number=7283 Confirmed=U Filename=NPSsvc.exe Description=Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95, WinNT(?), Win2K(?)) to schedule automatic tasks such as Norton Anti-Virus scans Source=Paul Collins Startup list [Norton Program Scheduler Event Checker] Number=7284 Confirmed=? Filename=npscheck.exe Description=Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker Source=Paul Collins Startup list [Norton Protect] Number=7285 Confirmed=X Filename=npprotect.exe Description=Added by the RBOT-WW WORM! Source=Paul Collins Startup list [Norton protect] Number=7286 Confirmed=X Filename=nvsvc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Norton Protect Activies] Number=7287 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "D5133" subfolder Source=Paul Collins Startup list [Norton Service Driver] Number=7288 Confirmed=X Filename=wsul.exe Description=Added by the RBOT-ABI WORM! Source=Paul Collins Startup list [Norton Service Process] Number=7289 Confirmed=X Filename=navapvc.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Norton SpySweeper AutoUpdate] Number=7290 Confirmed=X Filename=navsw.exe Description=Added by the FORBOT-AS WORM! Source=Paul Collins Startup list [Norton System] Number=7291 Confirmed=X Filename=csrs.scr Description=Added by the BANLOA-AFM TROJAN! Source=Paul Collins Startup list [Norton System Doctor] Number=7292 Confirmed=N Filename=Sysdoc32.exe Description=Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, major resource hog and best started manually form Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup folder as well Source=Paul Collins Startup list [Norton SystemWorks] Number=7293 Confirmed=N Filename=cfgwiz.exe Description=Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it Source=Paul Collins Startup list [Norton Update] Number=7294 Confirmed=X Filename=ccUpdate.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Norton Update] Number=7295 Confirmed=X Filename=winsvc.exe Description=Added by the AGOBOT.ALP WORM! Source=Paul Collins Startup list [Norton Update] Number=7296 Confirmed=X Filename=cUpdate.exe Description=Added by the AGOBOT.APP WORM! Source=Paul Collins Startup list [Norton updated] Number=7297 Confirmed=X Filename=NVSV32.EXE Description=Added by the SDBOT.ABH WORM! Source=Paul Collins Startup list [Norton Updater] Number=7298 Confirmed=X Filename=winset.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Norton Updater] Number=7299 Confirmed=X Filename=lsa.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Norton Updater] Number=7300 Confirmed=X Filename=NortonUpdate.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Norton Updater] Number=7301 Confirmed=X Filename=ccUpdate.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Norton Updater] Number=7302 Confirmed=X Filename=navupdtr.exe Description=Added by the SDBOT.AXV WORM! Source=Paul Collins Startup list [Norton Wizzard] Number=7303 Confirmed=X Filename=nwiz.exe Description=Added by the GAOBOT.ADV WORM! Note - this is not the valid nVidia application that shares the same name Source=Paul Collins Startup list [norton32] Number=7304 Confirmed=X Filename=norton32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [NortonAntivirus] Number=7305 Confirmed=X Filename=LSASS.exe Description=Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Temp" subfolder of the Winnt or Windows folder. It also has nothing to do with Norton AV Source=Paul Collins Startup list [NortonAV] Number=7306 Confirmed=X Filename=norton_antivirus.exe Description=Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program Source=Paul Collins Startup list [nortonav] Number=7307 Confirmed=X Filename=CCUPD32.EXE Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [nortonp] Number=7308 Confirmed=X Filename=nortonp.exe Description=Added by the JD-A TROJAN! Source=Paul Collins Startup list [Nortons AV SYSTEM] Number=7309 Confirmed=X Filename=scvchost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Nortons AVS Systems] Number=7310 Confirmed=X Filename=arse.exe Description=Added by the RBOT.AWY WORM! Source=Paul Collins Startup list [nortonsantivirus] Number=7311 Confirmed=X Filename=ccEvtMngr.exe Description=Added by the HZDOOR-A TROJAN! Source=Paul Collins Startup list [NortonVPlus] Number=7312 Confirmed=X Filename=svchost.exe Description=Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Notebook Maximizer] Number=7313 Confirmed=U Filename=maximizer_startup.exe Description=Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency Source=Paul Collins Startup list [NotebookManager] Number=7314 Confirmed=? Filename=nbm.exe Description=Associated with Acer notebook PCs. What does it do and is it required? Source=Paul Collins Startup list [NOTEPAD] Number=7315 Confirmed=X Filename=NOTEPAD.exe Description=Added as the result of the RUSTY VIRUS! Note - not to be confused with the valid Windows "NOTEPAD" text editor! This malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [NotePad] Number=7316 Confirmed=X Filename=[worm filename] Description=Added by the SILLYFDC-G WORM! Source=Paul Collins Startup list [Notepad] Number=7317 Confirmed=X Filename=ntoepad.exe Description=Added by the DELBOT-AK WORM! Source=Paul Collins Startup list [Notepad lptt01] Number=7318 Confirmed=X Filename=notepad.exe Description=RapidBlaster variant (in a "Notepad" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name Source=Paul Collins Startup list [Notepad ml097e] Number=7319 Confirmed=X Filename=notepad.exe Description=RapidBlaster variant (in a "Notepad" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name Source=Paul Collins Startup list [notepad.exe] Number=7320 Confirmed=X Filename=upx.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [notepad.exe] Number=7321 Confirmed=X Filename=msmsgs.exe Description=Added by a variant of the FAKESPY-B TROJAN! Note - this particular msmsgs.exe file is located in the Windows\System32 or Winnt\System32 folder, and should not be mistaken for the MSN Messenger file of the same name! Source=Paul Collins Startup list [notepad.exe] Number=7322 Confirmed=X Filename=msmsgs.exe Description=Added by the ZLOB-I TROJAN! Note - not be mistaken for the MSN Messenger file of the same name! Source=Paul Collins Startup list [notepad.exe] Number=7323 Confirmed=X Filename=msmsgs.exe Description=Added by the ZLOB-I and ZLOB-H TROJANS! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! Source=Paul Collins Startup list [notepad2.exe] Number=7324 Confirmed=X Filename=popuper.exe Description=Added by the PUPER-E TROJAN! Source=Paul Collins Startup list [notes] Number=7325 Confirmed=X Filename=notepaad.exe Description=Added by the RBOT.BME WORM! Source=Paul Collins Startup list [Notification Utility] Number=7326 Confirmed=X Filename=altpayV2.exe Description=Reported by Ewido Security Suite as WeirWeb adware Source=Paul Collins Startup list [Notn] Number=7327 Confirmed=X Filename=Eber.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Notn] Number=7328 Confirmed=X Filename=wtta.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [NovaBackup * Tray Control] Number=7329 Confirmed=U Filename=NbkCtrl.exe Description=Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here. * represents the version number Source=Paul Collins Startup list [NovaPortal Single User Service] Number=7330 Confirmed=? Filename=NPSU.exe Description=?? Source=Paul Collins Startup list [NovastorSchedulerd] Number=7331 Confirmed=U Filename=SCHENGD.EXE Description=NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it Source=Paul Collins Startup list [NOYPI_KANG_ASTIG] Number=7332 Confirmed=X Filename=Exit to DosPrompt.pif Description=Added by the FILUKIN.A WORM! Source=Paul Collins Startup list [np] Number=7333 Confirmed=X Filename=upnp.exe Description=Added by the YABE.AE TROJAN! Source=Paul Collins Startup list [NPF Value] Number=7334 Confirmed=X Filename=NPFMONTR.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [NPFMonitor] Number=7335 Confirmed=? Filename=NPFMntor.exe Description=Norton AntiVirus Firewall Install Monitor. What does it do and is it required? Source=Paul Collins Startup list [NPROTECT] Number=7336 Confirmed=U Filename=nprotect.exe Description=Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid Source=Paul Collins Startup list [NPS Event Checker] Number=7337 Confirmed=? Filename=npscheck.exe Description=Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker Source=Paul Collins Startup list [NS] Number=7338 Confirmed=X Filename=ns.exe Description=Added by the AGOBOT-HS WORM! Source=Paul Collins Startup list [NSCheck] Number=7339 Confirmed=X Filename=NSCHECK.EXE Description=MarketScore parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [nscntrl] Number=7340 Confirmed=X Filename=nscntrl.exe Description=Added by the DLOAD-DC TROJAN! Source=Paul Collins Startup list [nsdcmd services] Number=7341 Confirmed=X Filename=nsdcmdav.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [nsdcmd vid process] Number=7342 Confirmed=X Filename=nsdcmdwin.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [nsdlua] Number=7343 Confirmed=X Filename=nsdlua.exe Description=All-In-One Telcom - adult content dialler Source=Paul Collins Startup list [nsdriver] Number=7344 Confirmed=X Filename=nssys32.exe Description=NetShagg adware Source=Paul Collins Startup list [nse] Number=7345 Confirmed=X Filename=nse.exe Description=Added by the AGOBOT-ML WORM! Source=Paul Collins Startup list [Nsengine] Number=7346 Confirmed=U Filename=Nsengine.exe Description=Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here Source=Paul Collins Startup list [NSHelper] Number=7347 Confirmed=U Filename=aexnsinstallhelper.exe Description=Altiris Express Notification Server Install helper - monitors integrity of the installation Source=Paul Collins Startup list [nssysconf] Number=7348 Confirmed=X Filename=[random filename] Description=Added by the VIVIA.A TROJAN! Source=Paul Collins Startup list [nstat] Number=7349 Confirmed=X Filename=netstat.exe Description=Adult content dialler Source=Paul Collins Startup list [NSupdate] Number=7350 Confirmed=X Filename=NSupdate.exe Description=Added by the Dial/Laet-B premium rate dialer! Source=Paul Collins Startup list [Nsv] Number=7351 Confirmed=X Filename=nsvsvc.exe Description=Delfin Promulgate adware Source=Paul Collins Startup list [nsvcin] Number=7352 Confirmed=X Filename=n20050308.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [Nsvdr] Number=7353 Confirmed=X Filename=nsvdr.exe Description=Adult content dialler Source=Paul Collins Startup list [nsys] Number=7354 Confirmed=U Filename=nsys.exe Description=NetSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [nsys32] Number=7355 Confirmed=X Filename=nsys32.exe Description=Added by the AGOBOT-SU WORM! Source=Paul Collins Startup list [NSystemMonitor] Number=7356 Confirmed=N Filename=Symmon.exe Description=Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging Source=Paul Collins Startup list [NT Kernel Patch] Number=7357 Confirmed=N Filename=ntkrnlpt.exe Description=FaxServe network fax software Source=Paul Collins Startup list [NT Logging Service] Number=7358 Confirmed=X Filename=Syslog32.exe Description=Added by the DONK.B WORM and variants! Source=Paul Collins Startup list [NT MICROSOFT SVCD] Number=7359 Confirmed=X Filename=ntvsvcd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NT security] Number=7360 Confirmed=X Filename=rundll32.com Description=Added by the RBOT-AJC WORM! Source=Paul Collins Startup list [NT Service] Number=7361 Confirmed=X Filename=NTOKSRNL.EXE Description=Added by the RBOT-AAG WORM! Source=Paul Collins Startup list [NT Services] Number=7362 Confirmed=X Filename=ntsvc.exe Description=Added by the AGOBOT.VJ WORM! Source=Paul Collins Startup list [Nt System Protocol] Number=7363 Confirmed=X Filename=ntsystem.exe Description=Added by the RBOT.DSB TROJAN! Source=Paul Collins Startup list [NT Virtual Machine] Number=7364 Confirmed=X Filename=[path to file] Description=Added by the SCAERBOT-A WORM! Source=Paul Collins Startup list [Nt**.exe [* = random char]] Number=7365 Confirmed=X Filename=Nt**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Nt**32.exe [* = random char]] Number=7366 Confirmed=X Filename=Nt**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [NT-Virtual Device Manager] Number=7367 Confirmed=X Filename=ntvdmn.exe Description=Added by the SDBOT-AAA WORM! Source=Paul Collins Startup list [Ntcheck] Number=7368 Confirmed=X Filename=mapserver.exe Description=Added by the TOMPAI-B WORM! Source=Paul Collins Startup list [NTCommLib3] Number=7369 Confirmed=X Filename=NTCommLib3.exe Description=Admess adware variant Source=Paul Collins Startup list [ntddetect] Number=7370 Confirmed=X Filename=ntddetect.exe Description=Added by the AGENT-CU TROJAN! Source=Paul Collins Startup list [NTdhcp] Number=7371 Confirmed=X Filename=NTdhcp.exe Description=Added by the QQROB-C TROJAN! Source=Paul Collins Startup list [NTdhcp] Number=7372 Confirmed=X Filename=CiKewl.exe Description=Added by the QQROB-N TROJAN! Source=Paul Collins Startup list [ntdll] Number=7373 Confirmed=X Filename=ntdll.exe Description=Added by the BIONET.404 TROJAN! Source=Paul Collins Startup list [ntdll.dll] Number=7374 Confirmed=X Filename=TrustCleaner.exe Description=Smitfraud variant Source=Paul Collins Startup list [NTDLM] Number=7375 Confirmed=X Filename=csrss.exe Description=Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Qossrv" subfolder Source=Paul Collins Startup list [Ntech.patchs] Number=7376 Confirmed=X Filename=[trojan filename] Description=Added by the LEMIR.G TROJAN! Source=Paul Collins Startup list [ntechin] Number=7377 Confirmed=X Filename=n20050308.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [nternet Explorer] Number=7378 Confirmed=X Filename=iexplore.exe Description=Added by the FORBOT-CT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [NTFS16] Number=7379 Confirmed=X Filename=ntfs16.exe Description=Added by the RBOT-LY WORM! Source=Paul Collins Startup list [NTFSCLUP] Number=7380 Confirmed=Y Filename=NTFSCLUP.EXE Description=Part of ConfigSafe- "checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiting" Source=Paul Collins Startup list [ntfsmonitorpro] Number=7381 Confirmed=X Filename=ntfs64.exe Description=Added by the FORBOT-EB WORM! Source=Paul Collins Startup list [NTFSS Microsoft System] Number=7382 Confirmed=X Filename=filees.exe Description=Added by the RBOT.GAB WORM! Source=Paul Collins Startup list [NTFSS MICROSOFT SYSTEM] Number=7383 Confirmed=X Filename=filess.exe Description=Added by the RBOT.AXZ WORM! Source=Paul Collins Startup list [ntl Netguard] Number=7384 Confirmed=Y Filename=RPS.exe Description=ntl Netguard - anti-virus a package of services, specifically designed to keep you safe and secure with their ntlworld online services Source=Paul Collins Startup list [ntldr] Number=7385 Confirmed=X Filename=ntldr.exe Description=Browser hijacker to search-control.com (TrojanDropper.Win32.Small.ig). In addition to Registry changes found by HijackThis, also creates the following system files: C:\WINDOWS\SYSTEM\ntldr.exe, C:\m.exe, C:\WINDOWS\Search-For-You.url, C:\n.bat, C:\q.exe, C:\r.bat Source=Paul Collins Startup list [ntlfreedom] Number=7386 Confirmed=N Filename=rundll32 [path] RyDial.dll, QuickStart Description=NTL Freedom dial-up ISP software - not required Source=Paul Collins Startup list [ntmsevt] Number=7387 Confirmed=X Filename=ntmsevt.exe Description=Added by the STOPED-B TROJAN Source=Paul Collins Startup list [NTP Server] Number=7388 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.F TROJAN! Source=Paul Collins Startup list [nTrayFw] Number=7389 Confirmed=Y Filename=ntrayfw.exe Description=Software interface for NVIDIA ActiveArmor - hardware firewall built into nVidia nForce motherboard chipsets Source=Paul Collins Startup list [NTrtc] Number=7390 Confirmed=N Filename=ntrtc.exe Description=Dell year 2000 tool to deal with non-standard applications. Only required on older Dell PCs that may need this support Source=Paul Collins Startup list [NTSet32] Number=7391 Confirmed=X Filename=services.exe Description=Added by the WINSPY-C TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "dll32" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [NTSF Microsoft System] Number=7392 Confirmed=X Filename=fylez.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7393 Confirmed=X Filename=wntsf.exe Description=Added by the RBOT.ATC WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7394 Confirmed=X Filename=fufffy.exe Description=Added by the RBOT-AEL WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7395 Confirmed=X Filename=ntssf.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7396 Confirmed=X Filename=scvhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7397 Confirmed=X Filename=winsis32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7398 Confirmed=X Filename=marya.exe Description=Added by the RBOT-AXY WORM! Source=Paul Collins Startup list [NTSF MICROSOFT SYSTEM] Number=7399 Confirmed=X Filename=sysman.exe Description=Added by the RBOT.EDP WORM! Source=Paul Collins Startup list [ntsmod] Number=7400 Confirmed=X Filename=ntsmod.exe Description=Adware downloader/installer, probably VX2/Look2Me related - also detected as the WIN32.VB.RL TROJAN! Source=Paul Collins Startup list [NTsocket] Number=7401 Confirmed=X Filename=NoeWinnt.exe Description=Added by the ATAKA-E TROJAN! Source=Paul Collins Startup list [NTsrv.exe] Number=7402 Confirmed=X Filename=NTsrv.exe Description=Added by a variant of the SERVU-O TROJAN! Source=Paul Collins Startup list [Ntsysv] Number=7403 Confirmed=X Filename=ntsysv.exe Description=Added by the MIFENG-E TROJAN! Source=Paul Collins Startup list [nTune] Number=7404 Confirmed=U Filename=nTune.exe Description=nVidia nTune - motherboard monitoring and overclocking utility for nVidia nForce chipset based motherboards Source=Paul Collins Startup list [ntupd32] Number=7405 Confirmed=X Filename=ntupd32.exe Description=Unidentified adware/spyware Source=Paul Collins Startup list [ntupdate] Number=7406 Confirmed=X Filename=dnsvc.exe Description=Added by the SDBOT-TC WORM! Source=Paul Collins Startup list [NTupdater] Number=7407 Confirmed=X Filename=[path to trojan] Description=Added by the DIGARIX-D TROJAN! Source=Paul Collins Startup list [NTVDM] Number=7408 Confirmed=U Filename=NTVDM.EXE Description=Windows NT Virtual DOS Machine (NTVDM) for running 16-bit tasks on the 32-bit OS's (Windows NT, 2K and XP). Required if hardware on a machine with these OS's needs 16-bit DOS drivers. You can find a bit more about NTVDM here Source=Paul Collins Startup list [ntvdmd] Number=7409 Confirmed=X Filename=ntvdmd.exe Description=Adware downloader - also detected as the DLOADER-YP TROJAN! Source=Paul Collins Startup list [ntvdscm] Number=7410 Confirmed=X Filename=ntvdscm.exe Description=Added by the SCKEYLOG-I TROJAN! Source=Paul Collins Startup list [ntx32] Number=7411 Confirmed=X Filename=ntx32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Numerical Xterm Agent] Number=7412 Confirmed=X Filename=0x32.exe Description=Added by the RBOT-FWP WORM! Source=Paul Collins Startup list [Numerical Xterm Agents] Number=7413 Confirmed=X Filename=2x32.exe Description=Added by the RBOT-FWY WORM! Source=Paul Collins Startup list [Numerical Xtermz Agent] Number=7414 Confirmed=X Filename=1x32.exe Description=Added by the RBOT-FWX WORM! Source=Paul Collins Startup list [NuTCSetupEnviron] Number=7415 Confirmed=Y Filename=ncoeenv.exe Description=Used by the MKS Toolkit for Enterprise Developers product. NuTCracker is a Unix runtime environment for Windows, so disabling this would be unwise if you are using NuTCracker or any 3rd party package that is using it. Since you might not know what is actually using it it's probably best left alone Source=Paul Collins Startup list [NvagNT] Number=7416 Confirmed=X Filename=nvagNT.exe Description=Added by the AGOBOT-RV WORM! Source=Paul Collins Startup list [nvc Win32] Number=7417 Confirmed=X Filename=nvcvc.exe Description=Added by the RBOT-ADD WORM! Source=Paul Collins Startup list [nvchost] Number=7418 Confirmed=X Filename=winlogon.exe Description=Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [NvClipRsv] Number=7419 Confirmed=X Filename=svchost.exe Description=Added by the DUMARU-K WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [NvClipRsv] Number=7420 Confirmed=X Filename=swchost.exe Description=Added by the DUMARU-AK WORM! Source=Paul Collins Startup list [NVCLOCK] Number=7421 Confirmed=? Filename=rundll32 nvclock.dll, fnNvclock Description=Overclocking utility for nVidia based graphics cards? Source=Paul Collins Startup list [NvColorInit] Number=7422 Confirmed=? Filename=rundll32.exe NvQtwk.dll, NvColorInit Description=Associated with Nvidia based graphics cards Source=Paul Collins Startup list [NVCOM] Number=7423 Confirmed=X Filename=NVCOM.exe Description=Added by the AGOBOT-SB WORM! Source=Paul Collins Startup list [NvCpl] Number=7424 Confirmed=U Filename=rundll32.exe NvCpl.dll, NvStartup Description=Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card Source=Paul Collins Startup list [NvCpl] Number=7425 Confirmed=X Filename=NvCpl.EXE Description=Added by the YANZ.B WORM! Source=Paul Collins Startup list [NvCpl] Number=7426 Confirmed=X Filename=[random filename] Description=Added by the AGOBOT-APJ WORM! Source=Paul Collins Startup list [NvCpl] Number=7427 Confirmed=X Filename=windowsp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [NvCpl] Number=7428 Confirmed=X Filename=rundl32.exe Description=Added by the AGOBOT-TO WORM! Note - the valid version of this entry has the command line as "rundll32.exe NvCpl.dll,NvStartup" Source=Paul Collins Startup list [NvCpl32Deamon] Number=7429 Confirmed=X Filename=nvcpl.exe Description=Added by the RPCSDBOT.B WORM! Source=Paul Collins Startup list [NvCplD] Number=7430 Confirmed=X Filename=m2gr32.exe Description="Switch" premium rate adult content dialler Source=Paul Collins Startup list [NvCplD] Number=7431 Confirmed=X Filename=ntcpl.exe Description=Switch adult content dialler Source=Paul Collins Startup list [NvCplDaemon] Number=7432 Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvCplDaemon Description=System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here) Source=Paul Collins Startup list [NvCplDaemon] Number=7433 Confirmed=U Filename=rundll32.exe NvCpl.dll, NvStartup Description=Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card Source=Paul Collins Startup list [NvCplDaemon] Number=7434 Confirmed=X Filename=msmsgrs.exe Description=Added by the DLOADER-YI TROJAN! Source=Paul Collins Startup list [NvCplDaemon32] Number=7435 Confirmed=X Filename=anvshell32.exe Description=Added by the XU TROJAN! Source=Paul Collins Startup list [NvCplDeamon] Number=7436 Confirmed=X Filename=nvdisp.exe Description=Added by the PEEPVIE-I TROJAN! Source=Paul Collins Startup list [NvCplDmn] Number=7437 Confirmed=X Filename=NAVSVC.EXE Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [NvCplScan] Number=7438 Confirmed=X Filename=msc32.exe Description=Added by the FORBOT-DD WORM! Source=Paul Collins Startup list [NvCplScan] Number=7439 Confirmed=X Filename=winasp.exe Description=Added by the FORBOT.BZ WORM! Source=Paul Collins Startup list [NvCplScan] Number=7440 Confirmed=X Filename=nvsc32.exe Description=Added by the BROPIA.N WORM! Source=Paul Collins Startup list [NvCplScan] Number=7441 Confirmed=X Filename=kav32.exe Description=Added by the FORBOT-EW WORM! Source=Paul Collins Startup list [nvctrl.exe] Number=7442 Confirmed=X Filename=nvctrl.exe Description=Added by the ZLOB.G TROJAN! Source=Paul Collins Startup list [nvd32 lptt01] Number=7443 Confirmed=X Filename=nvd32.exe Description=RapidBlaster variant (in a "nvd32" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [nvd32 ml097e] Number=7444 Confirmed=X Filename=nvd32.exe Description=RapidBlaster variant (in a "nvd32" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [NVHotkey] Number=7445 Confirmed=U Filename=rundll32.exe [path] nvHotkey.dll Description=Enables the use of "hot keys" for changing setting on Nvidia graphics Source=Paul Collins Startup list [Nvid] Number=7446 Confirmed=X Filename=[8 random charachters] Description=Unidentified adware Source=Paul Collins Startup list [Nvid32] Number=7447 Confirmed=X Filename=Nvid32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Nvidex32] Number=7448 Confirmed=X Filename=Nvidex32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [NVIDIA ActiveArmor] Number=7449 Confirmed=Y Filename=ntrayfw.exe Description=Software interface for NVIDIA ActiveArmor - hardware firewall built into nVidia nForce motherboard chipsets Source=Paul Collins Startup list [Nvidia Control Daemon] Number=7450 Confirmed=X Filename=nksvc32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Nvidia Control Panel] Number=7451 Confirmed=X Filename=ncsvc32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [NVIDIA Driver] Number=7452 Confirmed=X Filename=MSPMSPSU.EXE Description=Added by the WOOTBOT.Y WORM! Source=Paul Collins Startup list [nVidia Drivers] Number=7453 Confirmed=X Filename=nVidiaDrvers.exe Description=Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card Source=Paul Collins Startup list [NVIDIA nForce APU1 Utilities] Number=7454 Confirmed=N Filename=NVATray.exe Description=nVidia's nForce Audio Processing Unit (APU)- "provides 3D positional audio and DirectX 8.0 compatibility, and encodes and decodes Dolby Digital 5.1 audio in real time" Source=Paul Collins Startup list [NVIDIA nTune] Number=7455 Confirmed=U Filename=nTune.exe Description=nVidia nTune - motherboard monitoring and overclocking utility for nVidia nForce chipset based motherboards Source=Paul Collins Startup list [NVidia System Utility] Number=7456 Confirmed=U Filename=NVSystemUtility.exe Description=NVidia System Utility (now nTune) lets you adjust bus speeds, hardware voltages, memory controller timings, and fan speed as well as additional settings to increase performance aggressiveness and hardware voltages. Will also display a dynamic graph of CPU and system temperatures, hardware voltages, and memory bus speeds Source=Paul Collins Startup list [NVIDIA Video drivers] Number=7457 Confirmed=X Filename=video_32D.exe Description=Added by the AGOBOT.KV WORM! Source=Paul Collins Startup list [NVIDIA Video drivers] Number=7458 Confirmed=X Filename=video_32sD.exe Description=Added by the RBOT-BB WORM! Source=Paul Collins Startup list [Nvidia32] Number=7459 Confirmed=X Filename=nvidia32.exe Description=CoolWebSearch parasite variant - also detected as the HOSTS-B TROJAN! Source=Paul Collins Startup list [NvidiaQuickTweak] Number=7460 Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [nvidll32] Number=7461 Confirmed=X Filename=nvidll32.exe Description=Added by the RBOT-XK WORM! Source=Paul Collins Startup list [NVIEW] Number=7462 Confirmed=U Filename=rundll32.exe nview.dll, nViewLoadHook Description=This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers Source=Paul Collins Startup list [nviload32] Number=7463 Confirmed=X Filename=nviload32.exe Description=Added by the SDBOT-VT WORM! Source=Paul Collins Startup list [NvInitialize] Number=7464 Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvXTInit Description=Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled Source=Paul Collins Startup list [nvirundll] Number=7465 Confirmed=X Filename=nvirundll.exe Description=Added by the SPYBOT.NPS WORM! Source=Paul Collins Startup list [nvjxue] Number=7466 Confirmed=X Filename=nvjxue.exe Description=Added by the EYEVEG-J WORM! Source=Paul Collins Startup list [NVmax] Number=7467 Confirmed=Y Filename=NVmax.exe Description=NVmax is a old tweaking utility for NVidia graphics cards. In the startup list if the user chooses to overclock their card Source=Paul Collins Startup list [NVMCTRAY] Number=7468 Confirmed=N Filename=RUNDLL32.EXE ...NVMCTRAY.DLL, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [NvMediaCenter] Number=7469 Confirmed=U Filename=RunDLL32.exe NvMCTray.dll, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [NVMixerTray] Number=7470 Confirmed=N Filename=NVMixerTray.exe Description=System Tray access to audio controls from nVidia's motherboard ForceWare software Source=Paul Collins Startup list [nvmsgdwn] Number=7471 Confirmed=X Filename=NVMSGDWN.EXE Description=Added by the GRABER-D TROJAN! Source=Paul Collins Startup list [nvpatch] Number=7472 Confirmed=X Filename=napatch.exe Description=Added by the SASSER-F WORM! Source=Paul Collins Startup list [NvPvrNetMon] Number=7473 Confirmed=U Filename=NvPvrNetMon.exe Description=Network monitor for the Personal Video Recorder function of the NVIDIA ForceWare Multimedia application - "makes sure you don�t miss your favorite show. If you won�t be home to watch the show, just use the PVR to set future recordings" Source=Paul Collins Startup list [NVQuickTweak] Number=7474 Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [NVRaidService] Number=7475 Confirmed=N Filename=nvraidservice.exe Description=nVidia NVRaid - hard disk striping/mirroring utility for increased performance and reliability. Doesn't seem to be required if you have a RAID setup as there is no performance difference without it Source=Paul Collins Startup list [NVRotateSysTray] Number=7476 Confirmed=? Filename=nvsysrot.dll Description=Related to NVIDIA nView Control Panel. What does it do and is it required? Source=Paul Collins Startup list [NVRT] Number=7477 Confirmed=N Filename=nvrt.exe Description=NVRefreshTool is a utility that will automatically detect the maximum refresh rate at each resolution that your monitor supports Source=Paul Collins Startup list [NVRTClk] Number=7478 Confirmed=? Filename=NVRTClk.exe Description=Related to a Gigabyte video card. What does it do, and is it required? Source=Paul Collins Startup list [nvsv32.exe] Number=7479 Confirmed=X Filename=nvsv32.exe Description=Added by the FORBOT-DI WORM! Source=Paul Collins Startup list [nvsv32.exe] Number=7480 Confirmed=X Filename=cstr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [nvsv32.exe] Number=7481 Confirmed=X Filename=asr_fnt.exe Description=Added by the WOOTBOT.GE WORM! Source=Paul Collins Startup list [nvsv32.exe] Number=7482 Confirmed=X Filename=nvsv33.exe Description=Added by the WOOTBOT.FP WORM! Source=Paul Collins Startup list [NvSvc] Number=7483 Confirmed=N Filename=nvsvc.exe Description=NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active, but no adverse side effects with it disabled. NOTE: If using drivers other than nVidia's, such as Asus, this service may have been renamed to reflect that Source=Paul Collins Startup list [nvsvc] Number=7484 Confirmed=X Filename=nvsvc.exe Description=Added by the BANKER-HQ TROJAN! Note - this is not the valid NVIDIA Driver Helper Service and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [NVSVC] Number=7485 Confirmed=X Filename=nvsvc.exe Description=Added by the AGOBOT.ALX WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [nvsvca32] Number=7486 Confirmed=X Filename=nvsvca32.exe Description=Added by the TACTSLAY.E TROJAN! Source=Paul Collins Startup list [nvsvca32] Number=7487 Confirmed=X Filename=clfmon.exe Description=Added by the TACTSLAY.E TROJAN! Source=Paul Collins Startup list [NVSystem32] Number=7488 Confirmed=X Filename=nvscv32.exe Description=Added by the AGOBOT-NO WORM! Source=Paul Collins Startup list [NvUpdater] Number=7489 Confirmed=X Filename=nwiz32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [NvXplDeamon] Number=7490 Confirmed=X Filename=xstyles.exe Description=Added by the SMALL.AJ VIRUS! Source=Paul Collins Startup list [NWEReboot] Number=7491 Confirmed=? Filename=dummy.exe Description=?? Source=Paul Collins Startup list [nwiz] Number=7492 Confirmed=U Filename=nwiz.exe Description=Nvidia nView Wizard - present with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. If you use any of the special nView features available in the control panel leave this alone - otherwise you can disable it Source=Paul Collins Startup list [nwiz32] Number=7493 Confirmed=X Filename=nwiz32.exe Description=Added by the SINBANK-A TROJAN! Source=Paul Collins Startup list [Nwpopup] Number=7494 Confirmed=Y Filename=Nwpopup.exe Description=Broadcast message handler part of Novell Netware that displays server, printer and other messages Source=Paul Collins Startup list [nwrecmsg] Number=7495 Confirmed=U Filename=nwrecmsg.exe Description=Broadcast message handler part of Novell Netware that displays server, printer and other messages - can cause crashes Source=Paul Collins Startup list [nwss] Number=7496 Confirmed=U Filename=Sp0.exe Description=SpyOutside surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [NWTRAY] Number=7497 Confirmed=Y Filename=nwtray.exe Description=Novell Netware. Displays the red "N" tray icon which can be disabled (by right-click on the icon) but is also needed by the client Source=Paul Collins Startup list [oadaemon] Number=7498 Confirmed=? Filename=oadaemon.exe Description=Background process that establishes connection with a C3-1000 scanner and watch general status of the device and for scanner button presses. Can it be started manually? Source=Paul Collins Startup list [oahstifr] Number=7499 Confirmed=Y Filename=oahstifr.exe Description=Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." Source=Paul Collins Startup list [OAKSTART] Number=7500 Confirmed=U Filename=OAKSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. Source=Paul Collins Startup list [OAKTASK] Number=7501 Confirmed=N Filename=OAKTASK.EXE Description=Taskbar utility for a "control panel" for a CD-RW Source=Paul Collins Startup list [OASClnt] Number=7502 Confirmed=U Filename=oasclnt.exe Description=McAfee VirusScan On-Access Scan Client service Source=Paul Collins Startup list [Object Store Server] Number=7503 Confirmed=Y Filename=osserver.exe Description=Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." Source=Paul Collins Startup list [objtjprx] Number=7504 Confirmed=? Filename=objtjprx.exe Description=?? Source=Paul Collins Startup list [obsver] Number=7505 Confirmed=? Filename=obsver.exe Description=Part of LingoWare translating software - what does it do and is it required? Source=Paul Collins Startup list [OCAudioIni] Number=7506 Confirmed=N Filename=OCAudioIni.exe Description=One-click Audio Converter - allows you to convert files of multiple audio formats right from Windows Explorer Source=Paul Collins Startup list [ocraware] Number=7507 Confirmed=N Filename=ocraware.exe Description=Optical Character Recognition software as part of OmniPage Limited Edition - supplied with some scanners. Scan directly into most word processor applications, such as Word, WordPerfect, etc. Available via Start -> Programs Source=Paul Collins Startup list [Octoshape Streaming Services] Number=7508 Confirmed=U Filename=OctoshapeClient.exe Description=Octoshape Live Streaming - "is a revolutionary technology that will reduce your bandwidth cost and improve the quality in sound and picture" Source=Paul Collins Startup list [ocx32] Number=7509 Confirmed=X Filename=ocx32.exe Description=Added by the ASTEF or RESPAN WORMS! Source=Paul Collins Startup list [OCXUPDT32] Number=7510 Confirmed=X Filename=ocxupdt32.exe Description=Added by the AGOBOT-IF WORM! Source=Paul Collins Startup list [OD] Number=7511 Confirmed=X Filename=SYSCNTR.EXE Description=HotVideo dialler Source=Paul Collins Startup list [od-matrxx] Number=7512 Confirmed=X Filename=od-matrxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [od-stndxx] Number=7513 Confirmed=X Filename=od-stndxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [od-teenxx] Number=7514 Confirmed=X Filename=od-teenxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [ODBC BackUp] Number=7515 Confirmed=U Filename=fdxxl.exe Description=G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! Source=Paul Collins Startup list [oddworldz.exe] Number=7516 Confirmed=X Filename=oddworldz.exe Description=Added by the MULTIDR-EG TROJAN! Source=Paul Collins Startup list [Odometer] Number=7517 Confirmed=N Filename=Odometer.EXE Description=Mouse odometer - tracks how far your pointer/arrow has traveled on the screen. Shortcut available Source=Paul Collins Startup list [ODSPConfig] Number=7518 Confirmed=U Filename=ODSPConfig.exe Description=DsktopSurveil surveillance software. Uninstall this software if you did not install it yourself Source=Paul Collins Startup list [Oeloader] Number=7519 Confirmed=X Filename=Oeloader.exe Description=Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [OEM Tools 32] Number=7520 Confirmed=X Filename=tres32.exe Description=Added by the RBOT.QB WORM! Source=Paul Collins Startup list [OEM32 Tools] Number=7521 Confirmed=X Filename=sres32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [OEMCLEANUP] Number=7522 Confirmed=N Filename=oemreset.exe Description=Resets OEM installation settings at bootup. Not required unless you're new to PC's Source=Paul Collins Startup list [OEMRESET] Number=7523 Confirmed=U Filename=oemreset.exe Description=Resets OEM installation settings at bootup. Not required unless you're new to PC's Source=Paul Collins Startup list [OEMRUNONCE] Number=7524 Confirmed=U Filename=oemrun.exe Description=Windows Millennium file - used by setup when installing the OEM 'express' version of the operating system. Uncheck after setup has finished Source=Paul Collins Startup list [oeplugin] Number=7525 Confirmed=U Filename=bxOEPlugin.exe Description=noHTML for Outlook Express is an add-on that protects Outlook Express from email viruses and email scripts by converting incoming email messages from HTML format to simple text Source=Paul Collins Startup list [OEPowerPlugs] Number=7526 Confirmed=? Filename=winoeinit.exe Description=?? Source=Paul Collins Startup list [oepsrv] Number=7527 Confirmed=U Filename=oepsrv.exe Description=Outlook Express Protector is designed for controlling access to Outlook Express and its e-mail and address data bases Source=Paul Collins Startup list [OESET] Number=7528 Confirmed=X Filename=setup60.exe Description=Added by the WAREZDL.28672 TROJAN! Source=Paul Collins Startup list [OESpamTest] Number=7529 Confirmed=U Filename=OESpamTest.ExE Description=Kaspersky Anti-Spam Source=Paul Collins Startup list [OEXCheck] Number=7530 Confirmed=N Filename=EA2Check.exe Description=Express Assist from AJSystems.com. Utility for use with Outlook Express to backup, restore, synchronize amongst others Source=Paul Collins Startup list [oe_drop_spam] Number=7531 Confirmed=X Filename=oesrv.exe Description=Dropspam adware Source=Paul Collins Startup list [OE_OEM] Number=7532 Confirmed=Y Filename=TMAS_OEMon.exe Description=Related to Trend Micro PC-cillin - Internet Security 12 Source=Paul Collins Startup list [Offer Companion] Number=7533 Confirmed=X Filename=offers.exe Description=Adware Source=Paul Collins Startup list [Offers] Number=7534 Confirmed=X Filename=offers.exe Description=Adware Source=Paul Collins Startup list [Office] Number=7535 Confirmed=X Filename=Office.exe Description=Added by the KRAIMER.12 TROJAN! Source=Paul Collins Startup list [Office Mail] Number=7536 Confirmed=U Filename=off_mail.exe Description=Office Mail from Burrotech Ltd - "complete email solution for small/medium businesses, homes, schools and colleges. It is a small email server which forms the perfect gateway between your internal and external email" Source=Paul Collins Startup list [Office Mail Alerter] Number=7537 Confirmed=U Filename=om_Alerter.exe Description=Office Mail Alerter - "alert Office Mail users when they receive new emails" via a System Tray icon Source=Paul Collins Startup list [Office Monitor] Number=7538 Confirmed=X Filename=adv32.exe Description=Added by the SDBOT-CWO WORM! Source=Paul Collins Startup list [Office Monitorse] Number=7539 Confirmed=X Filename=[path to worm] Description=Added by the SDBOT-CZX WORM! Source=Paul Collins Startup list [Office Startup] Number=7540 Confirmed=N Filename=Osa.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Office Startup] Number=7541 Confirmed=X Filename=Exploer.exe Description=Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries Source=Paul Collins Startup list [Office Startup] Number=7542 Confirmed=N Filename=Osa9.exe Description=Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show Source=Paul Collins Startup list [Office SturtUp] Number=7543 Confirmed=X Filename=osa9.exe Description=Added by the CLICKER-EC TROJAN! Note - this trojan is located in the Windows or Winnt folder and should not be confused with the Microsoft office program, located in Program Files\Microsoft Office\... Source=Paul Collins Startup list [OfficeAgent] Number=7544 Confirmed=X Filename=expIorer.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [OfficeAgent] Number=7545 Confirmed=X Filename=outIook.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [OfficeAgent] Number=7546 Confirmed=X Filename=svcrhost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [OfficeAgent] Number=7547 Confirmed=X Filename=svcshost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [OfficeDeamon] Number=7548 Confirmed=X Filename=msorunner.exe Description=Added by a variant of the TACTSLAY TROJAN! Source=Paul Collins Startup list [OfficeGuard RegChecker] Number=7549 Confirmed=Y Filename=ogrc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [OfficeGuardUI] Number=7550 Confirmed=X Filename=svcss.exe Description=Added by the DEDLER-C TROJAN! Source=Paul Collins Startup list [officejet 6100] Number=7551 Confirmed=? Filename=hposol08.exe Description=Associated with a HP PSC2110 (and maybe others) all-in-one machine Source=Paul Collins Startup list [OFFICEKB] Number=7552 Confirmed=U Filename=kbdap32a.EXE Description=Micro Innovations keyboard management Source=Paul Collins Startup list [OfficeQuickAccess] Number=7553 Confirmed=X Filename=OfficeHost.vbs Description=Added by the PEXMOR WORM! Source=Paul Collins Startup list [Offices] Number=7554 Confirmed=X Filename=msnmgd32.exe Description=Added by the FORBOT-DV WORM! Source=Paul Collins Startup list [Offices Monitors] Number=7555 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-GKO WORM! Source=Paul Collins Startup list [Offices Monitorse] Number=7556 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-GKO WORM! Source=Paul Collins Startup list [Offices Monitorse] Number=7557 Confirmed=X Filename=algose32.exe Description=Added by the RBOT-GDD WORM! Source=Paul Collins Startup list [OfficeScan95] Number=7558 Confirmed=Y Filename=pccwin97.exe Description=Trend Micro antivirus OfficeScan Source=Paul Collins Startup list [OfficeScanNT Monitor] Number=7559 Confirmed=Y Filename=pccntmon.exe Description=Trend Micro OfficeScan Antivirus real-time scan monitor Source=Paul Collins Startup list [OFFICEXP] Number=7560 Confirmed=X Filename=OFFICEXP.exe Description=Added by the WOOTBOT.HE WORM! Source=Paul Collins Startup list [office_update] Number=7561 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-ZB TROJAN! Source=Paul Collins Startup list [OfotoNow USB Detection] Number=7562 Confirmed=N Filename=Rundll32.exe OFUSBS.DLL, WatchForConnection OfotoNow Description=Autodetects when a digital camera is attached to a USB port and launches OfotoNow image software. Available via Start -> Programs Source=Paul Collins Startup list [ogrc] Number=7563 Confirmed=Y Filename=ogrc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [Oil Change] Number=7564 Confirmed=N Filename=OCTray32.exe Description=From CyberMedia/Network Associates. Checks for updates to software installed on your PC. Available via Start -> Programs Source=Paul Collins Startup list [OIM] Number=7565 Confirmed=? Filename=oim.exe Description=Related to the O2 (was "genie") mobile phone service. What does it do and is it required? Source=Paul Collins Startup list [OKI LPR Utility] Number=7566 Confirmed=U Filename=okilpr.exe Description=OKI printer utility Source=Paul Collins Startup list [OLE] Number=7567 Confirmed=X Filename=[filename] Description=Added by the STAWIN or TARNO.D TROJANS! Source=Paul Collins Startup list [OLE Automation Server] Number=7568 Confirmed=X Filename=ole32aut.vbe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [oleaccrc] Number=7569 Confirmed=X Filename=oleaccrc.exe Description=Adware downloader - recognized by Kaspersky antivirus as TrojanDownloader.Agent.am Source=Paul Collins Startup list [OLEDb Service] Number=7570 Confirmed=X Filename=runoledb32.exe Description=Added by a variant of the SPYRE.B TROJAN! Source=Paul Collins Startup list [olehelp] Number=7571 Confirmed=X Filename=olehelp.exe Description=Added by the BOOKMARKER.D or BOOKMARKER.G TROJANS! Source=Paul Collins Startup list [OleLoader] Number=7572 Confirmed=X Filename=ole32.exe Description=Added by the DELF.BR TROJAN! Source=Paul Collins Startup list [olesvr] Number=7573 Confirmed=U Filename=olesvr.exe Description=Salfeld Child Control - parental control software Source=Paul Collins Startup list [Olive System] Number=7574 Confirmed=X Filename=Szchost.exe Description=Added by the MERCURYCAS.A TROJAN! Source=Paul Collins Startup list [Olympic] Number=7575 Confirmed=X Filename=IE4321.exe Description=Adult content premium rate dialer - also detected as SMALL.CZ Source=Paul Collins Startup list [Omf4] Number=7576 Confirmed=X Filename=OMF4.EXE Description=Added by the FREEMEGA TROJAN! Source=Paul Collins Startup list [OmgStartup] Number=7577 Confirmed=N Filename=omgstartup.exe Description=Sony program called OpenMG Jukebox - player and music organizer Source=Paul Collins Startup list [OmniHTTPd] Number=7578 Confirmed=U Filename=ohttpd.exe Description=OmniHTTPd web server from Omnicron Source=Paul Collins Startup list [OmniPage] Number=7579 Confirmed=N Filename=Opware32.exe Description=Part of OmniPage from Nuance (was Scansoft) - "the fastest, easiest way to turn paper documents into digital files you can edit". Links Word, via OLE, with OmniPage. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page". Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs Source=Paul Collins Startup list [OmniPass] Number=7580 Confirmed=U Filename=scureapp.exe Description=OmniPass from Softex Inc. - secure password management software Source=Paul Collins Startup list [OM_Monitor] Number=7581 Confirmed=U Filename=FirstStart.exe Description=Olympus Master - digital camera management tools Source=Paul Collins Startup list [OM_Monitor] Number=7582 Confirmed=U Filename=MONITOR.EXE Description=Olympus Master - digital camera management tools Source=Paul Collins Startup list [On Screen Display] Number=7583 Confirmed=U Filename=OSD.EXE Description=By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume, etc. Nice but not required if you don't adjust things regularly - can also freeze Source=Paul Collins Startup list [once] Number=7584 Confirmed=X Filename=help.exe Description=Identified as the DELF.LF by Ewido Security Suite Source=Paul Collins Startup list [One Touch Monitor] Number=7585 Confirmed=N Filename=OneTouchMonitor.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [One Touch Monitor] Number=7586 Confirmed=N Filename=1tou~2.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [One Touch Monitor] Number=7587 Confirmed=N Filename=ONETOU~2.EXE Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [OneCareUI] Number=7588 Confirmed=Y Filename=winssnotify.exe Description=Related to Windows OneCare Live from Microsoft Source=Paul Collins Startup list [OneTouch Monitor] Number=7589 Confirmed=N Filename=OneTouchMon.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [OneTouchMonitor] Number=7590 Confirmed=N Filename=OneTouchMonitor.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [OneTouchMonitor] Number=7591 Confirmed=N Filename=1tou~2.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [OneTouchMonitor] Number=7592 Confirmed=N Filename=ONETOU~2.EXE Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [ONETOU~2] Number=7593 Confirmed=N Filename=OneTouchMonitor.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [ONETOU~2] Number=7594 Confirmed=N Filename=1tou~2.exe Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [ONETOU~2] Number=7595 Confirmed=N Filename=ONETOU~2.EXE Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [Onflow] Number=7596 Confirmed=X Filename=onflow.exe Description=Onflow is a internet company that offers an online advertising program. Not required - uninstall Source=Paul Collins Startup list [OnfolioStorage] Number=7597 Confirmed=U Filename=onfserv.exe Description="Onfolio is the complete solution for collecting, organizing and sharing online content" Source=Paul Collins Startup list [online cdrom] Number=7598 Confirmed=? Filename=Active acid.exe Description=?? Source=Paul Collins Startup list [Online Service] Number=7599 Confirmed=X Filename=svchost.exe Description=Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [OnlinePCfix SmoothSurfer] Number=7600 Confirmed=U Filename=SS.exe Description=Smooth-Surfer - blocks banners, ads, popups, and cleans MRU and Recent file lists Source=Paul Collins Startup list [OnlineTime] Number=7601 Confirmed=N Filename=onlinetime.exe Description=OnlineTimer - monitors your Windows dial-up network and logs the time you spend online as well as the resulting costs Source=Paul Collins Startup list [online_party] Number=7602 Confirmed=X Filename=online_party.exe Description=Adult content dialler Source=Paul Collins Startup list [Onluna Sarvice] Number=7603 Confirmed=X Filename=sachost.exe Description=Added by the TOFGER-AA TROJAN! Source=Paul Collins Startup list [Onlune Sarvice] Number=7604 Confirmed=X Filename=sachost.exe Description=Added by the DAEMONI-J TROJAN! Source=Paul Collins Startup list [only23] Number=7605 Confirmed=X Filename=SCVHOST.exe Description=Added by the PUQ TROJAN! Source=Paul Collins Startup list [OnSrvr] Number=7606 Confirmed=X Filename=OnSrvr.exe Description=OnWebMedia adware Source=Paul Collins Startup list [oo4] Number=7607 Confirmed=X Filename=RunDLL32.EXE [path] oo4.dll, DllRun Description=BookedSpace parasite Source=Paul Collins Startup list [OOLHELPT] Number=7608 Confirmed=? Filename=OOLHELPT.exe Description=?? Source=Paul Collins Startup list [OP12 Reminder] Number=7609 Confirmed=N Filename=Ereg.exe Description=Registration reminder for OmniPage from Nuance (was Scansoft) Source=Paul Collins Startup list [OpAgent] Number=7610 Confirmed=U Filename=OpAgent.exe Description=Part of Nuance (was Scansoft) OmniPage Pro document conversion software Source=Paul Collins Startup list [Open Service Drivers] Number=7611 Confirmed=X Filename=opiater.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Open Site] Number=7612 Confirmed=X Filename=opnste.exe Description=OpenSite adware Source=Paul Collins Startup list [Open Site] Number=7613 Confirmed=X Filename=opensite.exe Description=OpenSite adware Source=Paul Collins Startup list [Open2Enter] Number=7614 Confirmed=X Filename=runme.exe Description=Adult content dialler Source=Paul Collins Startup list [Open2Enter] Number=7615 Confirmed=X Filename=runme2.exe Description=Adult content dialler Source=Paul Collins Startup list [OpenGL Drivers] Number=7616 Confirmed=X Filename=0penGLD.exe Description=Added by the YIMP-A WORM! Source=Paul Collins Startup list [OpenMstart] Number=7617 Confirmed=X Filename=mcmgr32.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [OpenMstart] Number=7618 Confirmed=X Filename=mmgr32.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [OpenMstart] Number=7619 Confirmed=X Filename=Snt.exe Description="Switch" premium rate adult content dialler Source=Paul Collins Startup list [OpenOffice.org *.*.*] Number=7620 Confirmed=N Filename=quickstart.exe Description=OpenOffice.org office suite quick start (where "*.*.*" is the version number) Source=Paul Collins Startup list [OpenOffice.org x] Number=7621 Confirmed=N Filename=QUICKS~1.EXE Description=Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number Source=Paul Collins Startup list [openvpn-gui] Number=7622 Confirmed=U Filename=openvpn-gui.exe Description="OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including remote access, site-to-site VPNs, WiFi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls" Source=Paul Collins Startup list [Openwares LiveUpdate] Number=7623 Confirmed=U Filename=LiveUpdate.exe Description=Web-update utility as used by various types of software - see here Source=Paul Collins Startup list [Operations Typhoon Rising Registration] Number=7624 Confirmed=N Filename=NOVG.EXE Description=Joint Operations registration reminder Source=Paul Collins Startup list [Operator] Number=7625 Confirmed=N Filename=?? Description=Media Pilot operator, in Win.ini. Locks port open Source=Paul Collins Startup list [Operator] Number=7626 Confirmed=U Filename=xtmop.exe Description=Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported Source=Paul Collins Startup list [OpiStat] Number=7627 Confirmed=N Filename=OPISTAT.EXE Description=OpiStat is a European Research Institute whose goal is to understand consumer needs and opinions better Source=Paul Collins Startup list [OPQFile] Number=7628 Confirmed=X Filename=regedit.exe /s ...rad03FA6.tmp Description=Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit Source=Paul Collins Startup list [opr] Number=7629 Confirmed=X Filename=opr.exe Description=MediaMotor adware Source=Paul Collins Startup list [OpScheduler] Number=7630 Confirmed=U Filename=OpScheduler.exe Description=Part of Nuance (was Scansoft) OmniPage Pro document conversion software Source=Paul Collins Startup list [opsql update check] Number=7631 Confirmed=X Filename=opsql.exe Description=Added by the RBOT-ACJ WORM! Source=Paul Collins Startup list [OPTIMIZER] Number=7632 Confirmed=X Filename=iexplore.exe Description=Added by the EVEVINC TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Optimum Online] Number=7633 Confirmed=X Filename=Netsurf.exe Description=OptimumOnline ISP software related spyware - displays advertising popups and collects information about user activity Source=Paul Collins Startup list [Optional Web Drivers For WIN32] Number=7634 Confirmed=X Filename=phqghume.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [OPTMOUSEMOUSE] Number=7635 Confirmed=U Filename=optmouse.exe Description=Related to a Samsung optical mouse Source=Paul Collins Startup list [Optus Cable Data Monitor] Number=7636 Confirmed=U Filename=datamonitor.exe Description=Allows Optus customers to monitor their actual data usage against Optus' "data allowance limits" Source=Paul Collins Startup list [OptusNetUsage] Number=7637 Confirmed=U Filename=OptusNet Usage Meter.exe Description=Designed specifically for OptusNet users who wish to have their connection monitored on a frequent basis. It can also estimate when you are going to hit your usage limit, and how far over your suggested limit you should be Source=Paul Collins Startup list [Opware12] Number=7638 Confirmed=N Filename=Opware12.exe Description=OmniPage from Nuance (was Scansoft) - version 12. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs Source=Paul Collins Startup list [Opware14] Number=7639 Confirmed=N Filename=Opware14.exe Description=OmniPage from Nuance (was Scansoft) - version 14. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs Source=Paul Collins Startup list [Opware15] Number=7640 Confirmed=N Filename=Opware15.exe Description=OmniPage from Nuance (was Scansoft) - version 14. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs Source=Paul Collins Startup list [OpwareSE2] Number=7641 Confirmed=N Filename=OpwareSE2.exe Description=Hardware bundled version of OmniPage from Nuance (was Scansoft). If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs Source=Paul Collins Startup list [OpwareSE4] Number=7642 Confirmed=N Filename=OpwareSE4.exe Description=Hardware bundled version of OmniPage from Nuance (was Scansoft). If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is available via Start -> Programs Source=Paul Collins Startup list [Oracle Web-to-Go] Number=7643 Confirmed=U Filename=webtogo.exe Description="Oracle Web-to-go, a component of Oracle9i Lite, consists of a collection of modules and services that facilitate development, deployment, and management of mobile Web applications" Source=Paul Collins Startup list [OrbitUpdate] Number=7644 Confirmed=X Filename=update.exe Description=Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [OrbitView] Number=7645 Confirmed=X Filename=view.exe Description=Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [OrderReminder] Number=7646 Confirmed=N Filename=OrderReminder.exe Description=The HP Order Reminder utility is installed with the HP LaserJet printer software and allows you to set specific times for reminders to check the current level of toner in the print cartridge - it also contains an Order Now link to a Web page that helps you order supplies online from a reseller of your choice Source=Paul Collins Startup list [orderShell] Number=7647 Confirmed=X Filename=order****.exe [* = random char] Description=Added by the DLOADR-UN TROJAN! Source=Paul Collins Startup list [order_Shell] Number=7648 Confirmed=X Filename=order_smey.exe Description=Added by the BANKSNIF-H TROJAN! Source=Paul Collins Startup list [org5.exe] Number=7649 Confirmed=? Filename=org5.exe Description=Lotus Organizer 5 application file, Lotus Organizer software. What does it do and is it required? Source=Paul Collins Startup list [OrgyCam] Number=7650 Confirmed=X Filename=OrgyCam.exe Description=Adult content dialler Source=Paul Collins Startup list [OrigRage128Tweaker] Number=7651 Confirmed=U Filename=RAGE128TWEAK.EXE Description=Third party tweaker for ATI Rage 128 Video cards from http://www.rageunderground.com Source=Paul Collins Startup list [ORiNOCO] Number=7652 Confirmed=U Filename=Cmluc.exe Description=Client Manager software for a Proxim ORiNOCO 11a/b/g wireless LAN PCI card Source=Paul Collins Startup list [OS Security] Number=7653 Confirmed=X Filename=mswind32.pif Description=Added by the RBOT-ASU WORM! Source=Paul Collins Startup list [OSA] Number=7654 Confirmed=X Filename=winword.exe Description=Added by the KANGAROO-A TROJAN! Source=Paul Collins Startup list [Osa32] Number=7655 Confirmed=X Filename=NTOSA32.exe Description=Added by the ANIG WORM! Source=Paul Collins Startup list [osCheck] Number=7656 Confirmed=? Filename=osCheck.exe Description=Part of Norton Antivirus. What does it do and is it required? Source=Paul Collins Startup list [OSD] Number=7657 Confirmed=U Filename=OSD.exe Description=By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume, etc. Nice but not required if you don't adjust things regularly - can also freeze Source=Paul Collins Startup list [OSS] Number=7658 Confirmed=X Filename=ossproxy.exe Description=MarketScore parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [OSS] Number=7659 Confirmed=X Filename=rk.exe Description=MarketScore parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [OSS] Number=7660 Confirmed=X Filename=rlvknlg.exe Description=MarketScore parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [OSSProxy] Number=7661 Confirmed=X Filename=OSSPROXY.EXE Description=MarketScore parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [OStivityInvAgt] Number=7662 Confirmed=U Filename=ostivity.exe Description=OStivity - "a desktop and server hardware and software asset/inventory solution for small to enterprise sized organizations that need to quickly gain knowledge of 'what's installed' without having to manually touch every computer in the company. The next time the computer logs into the network, a complete inventory (software and hardware) is taken of the system" Source=Paul Collins Startup list [Osus] Number=7663 Confirmed=X Filename=acao.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Osus] Number=7664 Confirmed=X Filename=rrup.exe Description=PurityScan/Clickspring adware. The executable is located in the user's "Application Data" folder or the Program Files\htwu folder Source=Paul Collins Startup list [otcx] Number=7665 Confirmed=X Filename=otcxxh.exe Description=Added by the CAROOL TROJAN! Source=Paul Collins Startup list [outlook] Number=7666 Confirmed=X Filename=outlook.exe Description=Added by the SDBOT-RU WORM! Source=Paul Collins Startup list [outlook] Number=7667 Confirmed=X Filename=outlook.exe Description=Added by the ALCRA.F WORM! Note - this is not the valid MS Office program which is found in Program Files\Microsoft Office\Office. This file is found in Program Files\Outlook Source=Paul Collins Startup list [Outlook Express Config] Number=7668 Confirmed=X Filename=*****.exe [* = random char] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Outlook Express Protocol] Number=7669 Confirmed=X Filename=look.exe Description=Added by the RBOT-ACS WORM! Source=Paul Collins Startup list [Outlook Mail Services] Number=7670 Confirmed=X Filename=express.exe Description=Added by the RBOT.CJN WORM! Source=Paul Collins Startup list [Outlook Mail Services] Number=7671 Confirmed=X Filename=outlook.exe Description=Added by the RBOT-BKA TROJAN! Note that the valid MS Outlook executeable is located in the Program Files\Microsoft Office\Office directory wheras this one is found in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [OutLooks] Number=7672 Confirmed=X Filename=InSane.exe Description=Added by the SWOOP TROJAN! Source=Paul Collins Startup list [Outpost Firewall] Number=7673 Confirmed=Y Filename=outpost.exe Description=Outpost personal firewall Source=Paul Collins Startup list [OutpostFeedBack] Number=7674 Confirmed=Y Filename=feedback.exe Description=Part of Outpost firewall by Agnitum. The feedback service is for reporting issues directly to Agnitum from within OP Source=Paul Collins Startup list [outpostupdate] Number=7675 Confirmed=X Filename=outpostupdate.exe Description=Added by the COSIAM-C TROJAN! Source=Paul Collins Startup list [Outwar] Number=7676 Confirmed=X Filename=syslaunch.exe Description=Outwar adware downloader Source=Paul Collins Startup list [OVCJ] Number=7677 Confirmed=? Filename=ovcj.exe Description=?? Source=Paul Collins Startup list [Overnet] Number=7678 Confirmed=N Filename=Overnet.exe Description=Overnet peer-to-peer (P2P) file sharing program Source=Paul Collins Startup list [ovyriwi] Number=7679 Confirmed=X Filename=telace.exe Description=Added by the SDBOT.BVS WORM! Source=Paul Collins Startup list [OWCCardbusTray] Number=7680 Confirmed=U Filename=ocbtray.exe Description=Icon in the system tray for safely removing PCMCIA cards. Only required if you have a laptop or desktop which includes a PCMCIA card interface Source=Paul Collins Startup list [OWCWebCamDV] Number=7681 Confirmed=U Filename=wcdvtray.exe Description=WebCamDV from Orange Micro, Inc - enables the user to use a DV camera connected via Firewire as a Webcam Source=Paul Collins Startup list [OWMngr] Number=7682 Confirmed=X Filename=OWMngr.exe Description=OnWebMedia/SearchSeekFind advertising foistware Source=Paul Collins Startup list [OxigenClientAdmin] Number=7683 Confirmed=U Filename=Oxigen.exe Description=Open University Oxigen screensaver admin client. Downloads the latest information from the net to display in the screen saver Source=Paul Collins Startup list [oz2] Number=7684 Confirmed=X Filename=oz2.exe Description=Added by the MYDOOM.W WORM! Source=Paul Collins Startup list [P0w3rF1Y] Number=7685 Confirmed=X Filename=svchost.exe Description=Added by the MM TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [P17Helper] Number=7686 Confirmed=U Filename=Rundll32 P17.dll, P17Helper Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [P2P NETWORKING] Number=7687 Confirmed=N Filename=P2P Networking.exe Description=Peer to Peer (P2P) sharing of files on the internet Source=Paul Collins Startup list [P2P Networking] Number=7688 Confirmed=N Filename=P2P Description=Peer to Peer (P2P) sharing of files on the internet Source=Paul Collins Startup list [p2p networking] Number=7689 Confirmed=X Filename=p2pnetworking.exe Description=Added by the RBOT-ECP WORM! Source=Paul Collins Startup list [P2P Networking2] Number=7690 Confirmed=X Filename= P2P Networking2.exe Description=P2P Networking2.exe is an advertising program by Joltid. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately Source=Paul Collins Startup list [P2P Networking3] Number=7691 Confirmed=N Filename=P2P Networking3.exe Description=P2P Networking, a component bundled with Kazaa that enables other applications to use Peer-to-Peer functionality. Not required - see here Source=Paul Collins Startup list [p2pnetwork] Number=7692 Confirmed=X Filename=p2pnetwork.exe Description=Added by the ALCAN.A WORM! Source=Paul Collins Startup list [p2pnetworking] Number=7693 Confirmed=X Filename=p2pnetworking.exe Description=Added by the RBOT-AFL WORM! Source=Paul Collins Startup list [P3p4chk] Number=7694 Confirmed=X Filename=P3p4chk.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [p4mx4] Number=7695 Confirmed=X Filename=p4mx4.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [PaciSoft] Number=7696 Confirmed=X Filename=pacis.exe Description=PacerD Media/Pacimedia.com adware installer Source=Paul Collins Startup list [Packard Bell EverSafe Tray Control] Number=7697 Confirmed=? Filename=TrayControl.exe Description=Packard Bell EverSafe software. What does it do, and is it required? Source=Paul Collins Startup list [PadTouch] Number=7698 Confirmed=N Filename=PadExe.exe Description=Toshiba Touch and Launch - offers easy movement and freedom of programs navigation with TouchPad Source=Paul Collins Startup list [Pagekeeper Jobs] Number=7699 Confirmed=U Filename=pkjobs.exe Description=PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bundled with scanners such has HP, Microtek, etc Source=Paul Collins Startup list [Pagekeeper Lite] Number=7700 Confirmed=U Filename=pkjobs.exe Description=PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bundled with scanners such has HP, Microtek, etc Source=Paul Collins Startup list [PAgent] Number=7701 Confirmed=X Filename=PAgent.exe Description=Scans your hard drive for the popular P2P file-sharing applications BearShare, Grokster, Kazaa, Limewire and Morpheus. After searching the entire local filesystem for any files with those names it connects to the DownloadWare servers and tells it what, if anything, is found Source=Paul Collins Startup list [Pagis Scheduler] Number=7702 Confirmed=N Filename=Monitor.exe Description=Scheduler for the Pagis scanning suite from Scansoft (now Nuance) Source=Paul Collins Startup list [pagmstart] Number=7703 Confirmed=? Filename=client.exe Description=?? Source=Paul Collins Startup list [Pagoo] Number=7704 Confirmed=N Filename=PAGOO.EXE Description=Pagoo - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem Source=Paul Collins Startup list [paint.exe] Number=7705 Confirmed=X Filename=shnlog.exe Description=Added by the PUPER-A TROJAN! Source=Paul Collins Startup list [PaintingRoom evidence monitor] Number=7706 Confirmed=X Filename=paintingroom.exe Description=Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you... Source=Paul Collins Startup list [PaintingRoom smile monitor] Number=7707 Confirmed=X Filename=paintingroom.exe Description=Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you... Source=Paul Collins Startup list [PAL Evidence Eliminator] Number=7708 Confirmed=N Filename=Cleaner.exe Description=PAL Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis Source=Paul Collins Startup list [Palm Desktop] Number=7709 Confirmed=N Filename=Palm.exe Description=Palm Desktop Software for use with Palm handheld devices. Available via Start -> Programs Source=Paul Collins Startup list [Palm MultiUser Config] Number=7710 Confirmed=? Filename=Configtool.exe Description=MultiUser configuration for a Palm PDA device?. Is it required? Source=Paul Collins Startup list [palmOne Registration] Number=7711 Confirmed=N Filename=register.exe Description=Registration reminder for Palm products Source=Paul Collins Startup list [PalNetaware] Number=7712 Confirmed=X Filename=pnetaware.exe Description=PalTalk adware - as included in Morpheus Source=Paul Collins Startup list [PaltalkNetaware.exe] Number=7713 Confirmed=N Filename=PALNETAW~1.EXE Description=Voice chat program. This program stores all buddy list info apparently on the server itself so you never lose your buddy list should you need to reinstall the program due for whatever reason or even reformat. Available via Start -> Programs. Delete the shortcut in Start -> Programs -> StartUp as well otherwise it will be reinstated Source=Paul Collins Startup list [pamela.exe] Number=7714 Confirmed=U Filename=pamela.exe Description=Pamela is a plug-in or add-on that adds features to Skype peer to peer voice service Source=Paul Collins Startup list [Panasonic Communications Utility] Number=7715 Confirmed=U Filename=Mfpscdl.exe Description=Port manager for Panasonic Panafax fax_machines Source=Paul Collins Startup list [Panasonic HotKey Manager] Number=7716 Confirmed=U Filename=HKEYAPP.EXE Description=HotKey management for Panasonic rugged mobile PCs Source=Paul Collins Startup list [Panda Antispam Server Service] Number=7717 Confirmed=U Filename=PasSrv.exe Description=AntiSpam software, part of Panda Platinum Internet Security Source=Paul Collins Startup list [Panda Cleaner] Number=7718 Confirmed=Y Filename=pavdr.exe Description=Panda software related - possibly Panda ActiveScan Source=Paul Collins Startup list [Panda Preventium+ Service] Number=7719 Confirmed=Y Filename=PREVSRV.EXE Description=Panda Antivirus Source=Paul Collins Startup list [Panda Scheduler] Number=7720 Confirmed=U Filename=pavsched.exe Description=Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you tend to forget then leave it Source=Paul Collins Startup list [Panda Software Intrenet] Number=7721 Confirmed=X Filename=panda.pif Description=Added by the RBOT-ATZ WORM! Source=Paul Collins Startup list [PandaAVEngine] Number=7722 Confirmed=X Filename=PandaAVEngine.exe Description=Added by the NETSKY.R WORM! Source=Paul Collins Startup list [PandaScheduler] Number=7723 Confirmed=U Filename=pavsched.exe Description=Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you tend to forget then leave it Source=Paul Collins Startup list [Pando] Number=7724 Confirmed=U Filename=Pando.exe Description="Pando is free software that lets you send and receive files and folders of any size* with your existing email address" Source=Paul Collins Startup list [Pantera] Number=7725 Confirmed=X Filename=pantera.exe Description=Added by the SDBOT.AYN WORM! Source=Paul Collins Startup list [Paperport] Number=7726 Confirmed=N Filename=runppdrv.exe Description=Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here Source=Paul Collins Startup list [PaperPort PTD] Number=7727 Confirmed=N Filename=pptd40nt.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [PaperQuote System Tray Icon] Number=7728 Confirmed=N Filename=PQTRAY.EXE Description=PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation Source=Paul Collins Startup list [Parallel Tasking] Number=7729 Confirmed=X Filename=ptask.exe Description=Added by the SMALL-CJ TROJAN! Source=Paul Collins Startup list [ParetoLogic Anti-Spyware] Number=7730 Confirmed=U Filename=Pareto_AS.exe Description="ParetoLogic Anti-Spyware delivers Active Protection in the form of real-time blocking" Source=Paul Collins Startup list [PartSeal] Number=7731 Confirmed=U Filename=PartSeal.exe Description=System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere Source=Paul Collins Startup list [Password Door Loader] Number=7732 Confirmed=U Filename=PDMonitor.exe Description=Password Door - password protection software Source=Paul Collins Startup list [Password Tracker Deluxe] Number=7733 Confirmed=U Filename=PwTrkr.exe Description="Password Tracker Deluxe stores passwords and usernames neatly and securely (encrypted) on your computer" Source=Paul Collins Startup list [PasteLister] Number=7734 Confirmed=N Filename=plister.exe Description=PasteLister - clipboard extender. Start manually when required Source=Paul Collins Startup list [PAS_Check] Number=7735 Confirmed=N Filename=udcpas.exe Description=DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks Source=Paul Collins Startup list [pas_check] Number=7736 Confirmed=N Filename=pasmon.exe Description=SystemDoctor is a security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [Patch] Number=7737 Confirmed=X Filename=patch.exe Description=Added by the NETBUS WORM! Source=Paul Collins Startup list [Patches Value] Number=7738 Confirmed=X Filename=WinGamed.exe Description=Added by the SDBOT.BR WORM! Source=Paul Collins Startup list [Path] Number=7739 Confirmed=? Filename=lide.exe Description=?? Source=Paul Collins Startup list [pathname] Number=7740 Confirmed=X Filename=pathname.exe Description=Added by the IRCCONTACT TROJAN! Source=Paul Collins Startup list [PathNvidiaTV] Number=7741 Confirmed=? Filename=patchnvidiaTVout.exe Description=Appears to be related to Nvidia Gigabyte Video card. Typical file location is the Program Files\Gigabyte\Nvidia folder Source=Paul Collins Startup list [PAV.EXE] Number=7742 Confirmed=X Filename=%Number% Description=Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number Source=Paul Collins Startup list [PAV.EXE] Number=7743 Confirmed=Y Filename=PAV.EXE Description=PER Antivirus Source=Paul Collins Startup list [PAVFIRES] Number=7744 Confirmed=Y Filename=PavFires.exe Description=Panda Antivirus Source=Paul Collins Startup list [PAVFNSVR] Number=7745 Confirmed=Y Filename=PavFnSvr.exe Description=Panda Antivirus Source=Paul Collins Startup list [Pavkre9x] Number=7746 Confirmed=Y Filename=pavkre9x.exe Description=Panda Antivirus Source=Paul Collins Startup list [PavProc] Number=7747 Confirmed=Y Filename=PavPrS9x.exe Description=Panda Antivirus Source=Paul Collins Startup list [PavProt] Number=7748 Confirmed=Y Filename=PavProt.exe Description=Panda Antivirus Source=Paul Collins Startup list [Pavprot9] Number=7749 Confirmed=Y Filename=Pavprot9.exe Description=Panda Antivirus Source=Paul Collins Startup list [PayTime] Number=7750 Confirmed=X Filename=paytime.exe Description=Added by the STARTPA-YR TROJAN! Source=Paul Collins Startup list [pbagent] Number=7751 Confirmed=U Filename=pbagent.exe Description=Probot keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [PBKScheduler] Number=7752 Confirmed=U Filename=PBKScheduler.exe Description=Scheduler for CyberLink PowerBackup - archiving/backup utility Source=Paul Collins Startup list [PC Alert III] Number=7753 Confirmed=U Filename=alert.exe Description=MSI PC Alert III - allows you to view your system and cpu temperature, fan rpm and more. Only required if you overclock Source=Paul Collins Startup list [PC Booster] Number=7754 Confirmed=U Filename=pcbooster.exe Description=PC Booster from inKline Global - "easy-to-use computer system optimizer that gives your system the extra speed and stability you want while ensuring that your computer is kept clean and in tip-top condition" Source=Paul Collins Startup list [PC Doc Pro - 3.1] Number=7755 Confirmed=U Filename=pcdocpro.exe Description=PC Doc Pro (now Win Doc Pro) - system health check and fix utility Source=Paul Collins Startup list [PC Dynamics SdwMon32] Number=7756 Confirmed=U Filename=sdwmon32.exe Description=SafeHouse "Personal Privacy" protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encrypted Source=Paul Collins Startup list [PC Pitstop Optimize Scheduler] Number=7757 Confirmed=U Filename=PCPOptimize.exe Description=PC Pitstop Optimize - "an application that will make your PC run faster, make it more stable, and clean up hard drive space" Source=Paul Collins Startup list [PC Spy Keylogger] Number=7758 Confirmed=U Filename=ToolKeylogger.exe Description=PCSpyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [PC-Config32] Number=7759 Confirmed=X Filename=corona.exe Description=Added by the CORONEX.A WORM! Source=Paul Collins Startup list [PC2X] Number=7760 Confirmed=X Filename=initial.bat Description=Added by the DWNLDR-FZZ TROJAN! Source=Paul Collins Startup list [pcAnywhere Agent] Number=7761 Confirmed=U Filename=pcamgt.exe Description=Part of pcAnywhere 9.0 or later. This process listens for incoming PC Anywhere connections if your PC is configured as a PC Anywhere host Source=Paul Collins Startup list [PCBG] Number=7762 Confirmed=Y Filename=PCBODYGUARD.EXE Description=PC Bodyguard from Calluna - protects system files and settings from being deleted, modified, etc Source=Paul Collins Startup list [PCBODYGUARD] Number=7763 Confirmed=Y Filename=PCBODYGUARD.EXE Description=PC Bodyguard from Calluna - protects system files and settings from being deleted, modified, etc Source=Paul Collins Startup list [PcBoost] Number=7764 Confirmed=U Filename=PcBoost.exe Description=PCBoost from PGWARE, LLC increases computer performance by allocating higher portions of CPU power to active applications and games Source=Paul Collins Startup list [PCCClient.exe] Number=7765 Confirmed=Y Filename=PCCClient.exe Description=PC-Cillin 2002 antivirus software Source=Paul Collins Startup list [pccguide.exe] Number=7766 Confirmed=Y Filename=pccguide.exe Description=PC-Cillin 2002 antivirus software Source=Paul Collins Startup list [PCCIOMON.EXE] Number=7767 Confirmed=Y Filename=PCCIOMON.EXE Description=PC-Cillin 2000 antivirus software. This is the actual virus-scanner Source=Paul Collins Startup list [PCClient.exe] Number=7768 Confirmed=Y Filename=PCClient.exe Description=Trend Micro PC-Cillin Internet Security Source=Paul Collins Startup list [PccPfw] Number=7769 Confirmed=Y Filename=PccPfw.exe Description=Trend Micro PC-Cillin Internet Security Source=Paul Collins Startup list [PcCtlCom] Number=7770 Confirmed=Y Filename=Pcctlcom.exe Description=Trend Micro PC-cillin Internet Security Source=Paul Collins Startup list [PCDRealtime] Number=7771 Confirmed=N Filename=realtime.exe Description=Apparently the monitoring device for PC Doctor Online. It provides a "free" examination on system files (i.e. registry), reports the number of errors it finds, and invites you to "order" the fee-based fixes from its web site Source=Paul Collins Startup list [PcEXPLODE] Number=7772 Confirmed=X Filename=specialfile.exe Description=Added by the RBOT.RH WORM! Source=Paul Collins Startup list [PCHbutton] Number=7773 Confirmed=N Filename=PCHbutton.exe Description=Used by HP Instant Support Source=Paul Collins Startup list [PCHealth] Number=7774 Confirmed=N Filename=pchschd.exe Description=This is a "scheduler" and does not turn off PC Health. For more information refer here Source=Paul Collins Startup list [PCHEasySearch] Number=7775 Confirmed=X Filename=STUpdate.exe Description=PCH EasySearch bar Source=Paul Collins Startup list [PCIMODEM] Number=7776 Confirmed=? Filename=pcimodem.exe Description=Associated with Lucent based Aztech MDP7800-U PCI modems. Is it required? Source=Paul Collins Startup list [PCLEPCI] Number=7777 Confirmed=U Filename=ppe.exe Description=Pinnacle Systems PCI Performance Enhancer. "This tool helps to increase the PCI Busmaster performance of all Pinnacle PCI boards." Source=Paul Collins Startup list [PClK] Number=7778 Confirmed=X Filename=PClK.exe Description=Added by the LEGMIR-BL TROJAN! Source=Paul Collins Startup list [PCMCIA Resource Monitor] Number=7779 Confirmed=? Filename=nvp2pmon.exe Description=NVIDIA nForce P2P Driver. What does it do and is it required? Source=Paul Collins Startup list [PCMMRealtime] Number=7780 Confirmed=U Filename=pcmm.exe Description=PC MightyMax - diagnostic program that identifies and fixes problems. However, some users report it does the opposite and messes up their systems (see here) and they also have problems removing it (see here) Source=Paul Collins Startup list [PCMService] Number=7781 Confirmed=U Filename=PCMService.exe Description=Part of Cyberlink's Power Cinema. Commonly distributed with the Dell MultiMedia software suite. It is used to watch movies, play music and even watch TV in a central location Source=Paul Collins Startup list [PCPitStopEraser] Number=7782 Confirmed=U Filename=PCPitStopErase.exe Description="PC PitStop Erase is both a free privacy scanner and paid tracks cleaner" Source=Paul Collins Startup list [PCPOptimize] Number=7783 Confirmed=U Filename=PCPOptimize.exe Description=PC Pitstop Optimize - "an application that will make your PC run faster, make it more stable, and clean up hard drive space" Source=Paul Collins Startup list [PCprot] Number=7784 Confirmed=X Filename=crcss.exe Description=Added by an unidentified WORM! Source=Paul Collins Startup list [pcqmqgn.exe] Number=7785 Confirmed=? Filename=pcqmqgn.exe Description=?? Source=Paul Collins Startup list [PCRecSA] Number=7786 Confirmed=U Filename=PCRecSA.exe Description=Part of the IBM/XPoint Rapid Restore backup utility. If you choose, you can use it to create a "clean" backup of your hard drive. The process involves the software partitioning your hard drive, making a compressed image of the working drive which will then allow you to revert to that should you need to Source=Paul Collins Startup list [pcServer] Number=7787 Confirmed=X Filename=server.exe Description=Ssppyy spyware Source=Paul Collins Startup list [PCShield] Number=7788 Confirmed=X Filename=regsvr32 [path] sfg_****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [PCStart] Number=7789 Confirmed=N Filename=Pcm25.exe Description=Runs as part of PCMonitor which is a program for monitoring your activity on your system. It makes screen dumps and key logging. It can hang-up your system because the screen dump page gets VERY big Source=Paul Collins Startup list [PCSuiteTrayApplication] Number=7790 Confirmed=N Filename=TrayApplication.exe Description=System Tray icon for Nokia PC Suite. PC Suite lets you synchronize, edit, and back up many of your phone's files on a compatible PC through a wireless or cable connection. PC Suite can also be launched through Start Menu Source=Paul Collins Startup list [PCSuiteTrayApplication] Number=7791 Confirmed=N Filename=LaunchApplication.exe Description=System Tray icon for Nokia PC Suite. PC Suite lets you synchronize, edit, and back up many of your phone's files on a compatible PC through a wireless or cable connection. PC Suite can also be launched through Start Menu Source=Paul Collins Startup list [Pcsv] Number=7792 Confirmed=X Filename=pcsvc.exe Description=Delfin Media Viewer or "Promulgate" adware Source=Paul Collins Startup list [PcSync] Number=7793 Confirmed=N Filename=PcSync.exe Description=If a Nokia phone has been connected, synchronises the phone with MS Outlook or other organiser software. It is installed by the Nokia PC Suite, and the tray icon shows if a phone has been connected. Available via a desktop shortcut or Start -> Programs Source=Paul Collins Startup list [PcSync] Number=7794 Confirmed=X Filename=PcSync.exe Description=Added by the RBOT-XJ WORM! Note - do not confuse with the Nokia application described here Source=Paul Collins Startup list [PCTAVApp] Number=7795 Confirmed=Y Filename=PCTAV.exe Description=Related to PC TOOLS Antivirus software Source=Paul Collins Startup list [PcThrust] Number=7796 Confirmed=U Filename=PcThrust.exe Description=PCThrust from SwiftDog - "increases computer performance by allocating higher portions of CPU power to active applications and games" Source=Paul Collins Startup list [pctspk] Number=7797 Confirmed=U Filename=pctspk.exe Description=Used for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use any of those functions Source=Paul Collins Startup list [PCTVOICE] Number=7798 Confirmed=U Filename=pctvoice.exe Description=The program PCTVoice is used by the modem to interface with your computer and also used for some V.80 functions for Video Conferencing. if you uncheck it, it comes back. It's better to leave it Source=Paul Collins Startup list [PCTVRemote] Number=7799 Confirmed=U Filename=remoterm.exe Description=Controls the remote control on some Pinnacle TV tuners Source=Paul Collins Startup list [PCWatch] Number=7800 Confirmed=U Filename=pcwatch.exe Description=PCWatch surveillance software. Uninstall this software if you did not install it yourself Source=Paul Collins Startup list [PDA Commander] Number=7801 Confirmed=X Filename=stisvc32.exe Description=Added by the AGOBOT-TX WORM! Source=Paul Collins Startup list [PdaNet Desktop] Number=7802 Confirmed=U Filename=PdaNetPC.exe Description=PdaNet from June Fabrics Technology Inc. Use Windows Mobile Smartphone or PocketPC Phone as wireless modem for your PC Source=Paul Collins Startup list [PDASCAN] Number=7803 Confirmed=X Filename=pdascan.exe Description=Added by the AGOBOT-QY WORM! Source=Paul Collins Startup list [PDDM] Number=7804 Confirmed=U Filename=pddm.exe Description=Patchlink Update - "core product of the leading patch and vulnerability management software solution for medium and large enterprise network security" Source=Paul Collins Startup list [PDEngine] Number=7805 Confirmed=U Filename=PDEngine.exe Description=PerfectDisk from Raxco - disk defragmenter. Only required if you schedule disk defragmenting at re-boot Source=Paul Collins Startup list [pdexplo] Number=7806 Confirmed=N Filename=PDEXPLO.EXE Description=PowerDesk Pro by PowerDesk Pro by Ontrack. Enhanced desktop and file manager. Available via Start -> Programs Source=Paul Collins Startup list [PDF Converter Registry Controller] Number=7807 Confirmed=? Filename=RegistryController.exe Description=Nuance (was Scansoft) PDF Converter Registry Controller related - what does it do and is it required? Source=Paul Collins Startup list [pdfFactory Dispatcher v1] Number=7808 Confirmed=U Filename=fppdis1a.exe Description=FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. "pdfFactory products offer a unique approach to PDF creation that is simpler, more effective and less expensive than that offered by other programs" Source=Paul Collins Startup list [pdfFactory Dispatcher v2] Number=7809 Confirmed=U Filename=fppdis2a.exe Description=FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. "pdfFactory products offer a unique approach to PDF creation that is simpler, more effective and less expensive than that offered by other programs" Source=Paul Collins Startup list [pdfFactory Pro Dispatcher v1] Number=7810 Confirmed=U Filename=fppdis1.exe Description=FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. "pdfFactory products offer a unique approach to PDF creation that is simpler, more effective and less expensive than that offered by other programs" Source=Paul Collins Startup list [pdfFactory Pro Dispatcher v3] Number=7811 Confirmed=U Filename=fppdis3a.exe Description=FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. "pdfFactory products offer a unique approach to PDF creation that is simpler, more effective and less expensive than that offered by other programs" Source=Paul Collins Startup list [pdfMachine dispatcher] Number=7812 Confirmed=U Filename=mapisnd.exe Description=pdfMachine Windows print driver Source=Paul Collins Startup list [pdfSaver3] Number=7813 Confirmed=N Filename=pdfSaver3.exe Description=PDF-XChange - create Adobe compatible PDF files from virtually any Windows software such as MS Word, Excel, AutoCAD, MS Publisher etc Source=Paul Collins Startup list [PDirect] Number=7814 Confirmed=N Filename=PDirect.exe Description=IBM Presentation Director software Source=Paul Collins Startup list [pdp Server] Number=7815 Confirmed=U Filename=ctpdpsrvr.exe Description=Included and setup with the drivers for my Compaq A3000 all-in-one printer/scanner - maybe for networking. Works fine without it - but may be needed when used over a network Source=Paul Collins Startup list [PDService.exe] Number=7816 Confirmed=U Filename=pdservice.exe Description=Related to Utimaco Safeware Easy. "Your electronic safe for protecting confidential data" Source=Paul Collins Startup list [PDVDServ] Number=7817 Confirmed=U Filename=PDVDServ.exe Description=Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [Pe2ckfnt SE] Number=7818 Confirmed=N Filename=chkfont.exe Description=Used to check whether the fonts are installed properly on your computer or not for a scanner. If you don't want to execute it, you can uncheck it in the startup menu Source=Paul Collins Startup list [PECarlin] Number=7819 Confirmed=X Filename=PECarlin.exe Description=Adware - see here Source=Paul Collins Startup list [Peeramid] Number=7820 Confirmed=? Filename=PService.exe Description=In a "Koptimizer" folder in Program Files. What does it do and is it required? Source=Paul Collins Startup list [PeerGuardian] Number=7821 Confirmed=U Filename=PeerGuardian_1.99b_pr14.exe Description=PeerGuardian - IP blocker for Windows. Used to protect privacy on P2P networks by blocking IP addresses specified in blocklists. Features support for multiple lists, a list editor, automatic blocklist updates, and blocking all of IPv4 (TCP, UDP, ICMP, etc) Source=Paul Collins Startup list [PeerGuardian] Number=7822 Confirmed=U Filename=pg2.exe Description=PeerGuardian - IP blocker for Windows. Used to protect privacy on P2P networks by blocking IP addresses specified in blocklists. Features support for multiple lists, a list editor, automatic blocklist updates, and blocking all of IPv4 (TCP, UDP, ICMP, etc) Source=Paul Collins Startup list [Pent@VALUE 3.2] Number=7823 Confirmed=U Filename=Pent@VALUE.exe Description=Pent@VALUE Digital Satellite Internet PC Receiver Source=Paul Collins Startup list [PeqBL100] Number=7824 Confirmed=X Filename=PEQBL100.exe Description=Added by the ENVID.D WORM! Source=Paul Collins Startup list [PER Email Protection] Number=7825 Confirmed=Y Filename=pavmail.exe Description=PER Antivirus Source=Paul Collins Startup list [PerfectPrint] Number=7826 Confirmed=N Filename=pfppop70.exe Description=Print engine used by Corel WordPerfect 7 and Presentations 7 Source=Paul Collins Startup list [PerfFont (Performance True Type Font)] Number=7827 Confirmed=X Filename=perfont.exe Description=Added by the MUTECH-E TROJAN! Source=Paul Collins Startup list [perfmon] Number=7828 Confirmed=U Filename=perfmon.vbs Description=MindStorm AnalyzerPro from Secure Associates. "A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices" Source=Paul Collins Startup list [Perfomance Monitor] Number=7829 Confirmed=X Filename=davcsync.exe Description=Added by the LAMUD-A WORM! Source=Paul Collins Startup list [Perfomance Settings] Number=7830 Confirmed=X Filename=svchost.exe Description=Added by the TOFGER-AP TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Performance] Number=7831 Confirmed=X Filename=MyHeart.exe Description=Added by the PESIN-D WORM! Source=Paul Collins Startup list [Performs peer to peer connection] Number=7832 Confirmed=X Filename=WinPTTP.exe Description=Added by the RBOT-GMI WORM! Source=Paul Collins Startup list [PersFw] Number=7833 Confirmed=Y Filename=PersFw.exe Description=Kerio or Tiny Personal Firewall Source=Paul Collins Startup list [Persistence] Number=7834 Confirmed=N Filename=igfxpers.exe Description=Part of Intels Common User Interface for chipsets with integrated graphics controllers - which allows user to change different driver properties through Windows User Interface. Not known exactly what it does but apparently it isn't required Source=Paul Collins Startup list [Personal Computer] Number=7835 Confirmed=X Filename=scvhost.exe Description=Added by the RBOT-AJE WORM! Source=Paul Collins Startup list [Personal Firwall] Number=7836 Confirmed=X Filename=ptmedsrv.exe Description=Added by the SDBOT.XY WORM! Source=Paul Collins Startup list [Pervasive.SQL Workgroup Engine] Number=7837 Confirmed=U Filename=W3dbsmgr.exe Description=Database Service Manager for Pervasive SQL 2000 Workgroup edition. Required if you use Pervasive SQL but it's recommended you start it manually before using it as it has a tendancy to crash/freeze if loaded with other applications at startup Source=Paul Collins Startup list [PestPatrol Control Center] Number=7838 Confirmed=U Filename=PPControl.exe Description=PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition Source=Paul Collins Startup list [PestPatrolCL] Number=7839 Confirmed=? Filename=PestPatrolCL.exe Description=PestPatrol's command line scanner, combines with the Windows Task scheduler and is required in cases where schedules for regular scanning are set Source=Paul Collins Startup list [PestTrap] Number=7840 Confirmed=N Filename=PestTrap.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Petit Larousse 2001] Number=7841 Confirmed=U Filename=HIPL2000Popup.exe Description=Popup dictionary tool Source=Paul Collins Startup list [Pex Sound Driver] Number=7842 Confirmed=X Filename=Today's Results.vbs Description=Added by the TRODE-A WORM! Source=Paul Collins Startup list [pex Sound driver 2] Number=7843 Confirmed=X Filename=Today's Results.vbs Description=Added by the TRODE-A WORM! Source=Paul Collins Startup list [PFW_CfgEngine] Number=7844 Confirmed=? Filename=PFWCFG~1.EXE Description=Personal Firewall related? Source=Paul Collins Startup list [PFW_PullSrv] Number=7845 Confirmed=? Filename=PULL.EXE Description=Personal Firewall related? Source=Paul Collins Startup list [PgMonitr] Number=7846 Confirmed=X Filename=PgMonitr.exe Description=Delfin Promulgate adware variant Source=Paul Collins Startup list [PGPSDKSVC] Number=7847 Confirmed=Y Filename=pgpsdkserv.exe Description=PGPsdkServ.exe is the new SDK service which is responsible for performing all PGP key management and cryptographic functions. This functionality was moved into a service to allow multiple modules simultaneous read/write access to the keyrings, among other things. As you can imagine, it is necessary for PGPsdkServ to be running in order to perform practically any PGP functionality Source=Paul Collins Startup list [PGPSERVICE] Number=7848 Confirmed=U Filename=pgpservice.exe Description=PGPservice.exe has two main purposes: (1) it handles a large part of the PGPnet functionality (along with the PGPnet driver) and (2) it allows efficient access to the PGP preferences database. The individual PGP modules normally access the preferences through PGPservice, but they are capable of a "fall-back" mode where they can handle such access on their own. Thus, if you are not running PGPnet, you may not immediately notice much of a difference if you disable PGPservice. If you are running PGPnet, you will notice a big difference Source=Paul Collins Startup list [PGPtray] Number=7849 Confirmed=N Filename=pgptray.exe Description=PGP 7.x. Provides icon tray shortcuts to PGP programs from Network Associates. Available via Start -> Programs Source=Paul Collins Startup list [PGQL] Number=7850 Confirmed=X Filename=pgql.exe Description=Added by the PQN TROJAN! Source=Paul Collins Startup list [PGStub.exe] Number=7851 Confirmed=X Filename=[various filenames] Description=Unidentified adware Source=Paul Collins Startup list [pgtaff] Number=7852 Confirmed=X Filename=pgtaff.exe Description=AdRotator adware variant Source=Paul Collins Startup list [phc700] Number=7853 Confirmed=U Filename=vphc700.exe Description=Related to the Philips SPC700NC web camera Source=Paul Collins Startup list [PhiBtn] Number=7854 Confirmed=Y Filename=PhiBtn.exe Description=Snapshot and Launch button application from Philips belonging to Philips SPC 900NC Camera Source=Paul Collins Startup list [Phime2002a] Number=7855 Confirmed=N Filename=TINTSETP.EXE Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [PHIME2002ASync] Number=7856 Confirmed=N Filename=TINTSETP.EXE Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [PHIME2004C] Number=7857 Confirmed=X Filename=CTFMDN.exe Description=Added by the DLOADR-AMV TROJAN! Source=Paul Collins Startup list [PHIME2OO2ASyst] Number=7858 Confirmed=X Filename=[path to trojan] Description=Added by the DBDOOR-B TROJAN! Source=Paul Collins Startup list [PhoneFree version 6.2] Number=7859 Confirmed=U Filename=PHONEF??.EXE Description=An Internet telephony application. Complicated registration and ad banners tailored to your profile - see here Source=Paul Collins Startup list [Photo Express Calendar Checker SE] Number=7860 Confirmed=N Filename=CALCHECK.EXE Description=If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper, Photo Express will replace the wallpaper automatically. Photo Express 2.0 has a calendar checker which checks the date on your system and updates your wallpaper accordingly Source=Paul Collins Startup list [Photo Loader supervisory] Number=7861 Confirmed=N Filename=Plauto.exe Description=Casio's Photo Loader software. Hook up your camera to the USB port, and it pops up and asks you if you want to load your pictures Source=Paul Collins Startup list [Photoshop] Number=7862 Confirmed=X Filename=svchost.exe Description=Added by the CDOPEN-E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "Program Files" folder Source=Paul Collins Startup list [PhotoShow Deluxe Media Manager] Number=7863 Confirmed=N Filename=mssysmgr.exe Description=Simple Star PhotoShow Deluxe photo editing and organizing software, makes it easy to send and share digital photos. Bundled with software from Nero, ComCast, SnapFish, MacroMedia and others Source=Paul Collins Startup list [PhotoWise QuickLink] Number=7864 Confirmed=N Filename=quicklnk.exe Description=Agfa PhotoWise - "PhotoWise QuickLinkTM lets you drag and drop photos right from the camera into your document (applications must be OLE-compliant). Use PhotoWise to print contact sheets and photographic prints. Create slide shows, screen savers, wallpaper and more." Source=Paul Collins Startup list [PhraseExpress] Number=7865 Confirmed=U Filename=phrase.exe Description="PhraseExpress organizes your frequently used text phrases and allows pasting them into any application" Source=Paul Collins Startup list [PIC SYSTEM] Number=7866 Confirmed=X Filename=picx.exe Description=Added by the MYTOB.LL WORM! Source=Paul Collins Startup list [Picasa Media Detector] Number=7867 Confirmed=N Filename=PicasaMediaDetector.exe Description=Media detector for Picasa's automatic photo organizer Source=Paul Collins Startup list [PicasaNet] Number=7868 Confirmed=N Filename=Hello.exe Description=Hello is an application that allows Blogger users to post digital photos and captions directly to their personal weblogs, or blogs Source=Paul Collins Startup list [Pickatag] Number=7869 Confirmed=N Filename=pickatag.exe Description=Pick-a-tag - "freeware utility for random selection of your taglines. This utility randomly picks a tagline out of a list of taglines. It will create a signature file which your mailer can use to place under your messages" Source=Paul Collins Startup list [PICPRTR] Number=7870 Confirmed=N Filename=PICPRTR.EXE Description=Program for viewing and measuring a variety of 3D CAD data formats Source=Paul Collins Startup list [picsvr] Number=7871 Confirmed=X Filename=picsvr.exe Description=Delfin Promulgate adware Source=Paul Collins Startup list [pictureBUZZTray] Number=7872 Confirmed=N Filename=swtray.exe Description=System Tray access to PictureBUZZ on-line printing software from Streetwise Software. If you use the software set the page you use as a favourite in your browser and run it manually Source=Paul Collins Startup list [PiDunHK] Number=7873 Confirmed=U Filename=PIDUNHK.EXE Description=Part of the Prodigy Internet software - part of the dialer/DUN. Presumably needed for users of that service otherwise you may not be able to connect, although you may try creating your own shortcut and see what happens Source=Paul Collins Startup list [pigglett] Number=7874 Confirmed=X Filename=pigglett.exe Description=Added by a variant of the SMALL.EP TROJAN! Source=Paul Collins Startup list [piiserviceOE] Number=7875 Confirmed=U Filename=N/A Description=Spam Inspector (nee Postal Inspector) from The Giant Company or iHateSpam from Sunbelt Software - spam filter add-ons for OE Source=Paul Collins Startup list [pilif] Number=7876 Confirmed=X Filename=pilif.exe Description=Added by the FILI WORM! Source=Paul Collins Startup list [Pinger] Number=7877 Confirmed=N Filename=pinger.exe Description=Pinger is the resident program for Toshiba updates. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification Source=Paul Collins Startup list [PingTimeout Institution] Number=7878 Confirmed=X Filename=pingchek.exe Description=Added by the SDBOT-VY WORM! Source=Paul Collins Startup list [PingTimeout Institution] Number=7879 Confirmed=X Filename=internal.exe Description=Added by the SDBOT.BMH WORM! Source=Paul Collins Startup list [PinnacleDriverCheck] Number=7880 Confirmed=Y Filename=PSDrvCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [Piolet] Number=7881 Confirmed=N Filename=piolet.exe Description=Piolet - peer-to-peer file sharing client Source=Paul Collins Startup list [PIPE SYSTEM] Number=7882 Confirmed=X Filename=pipe.exe Description=Added by the MYTOB-FF WORM! Source=Paul Collins Startup list [Piracy] Number=7883 Confirmed=N Filename=SysUtil.exe Description=Software Piracy Alert feature bundled with PGWare software. Cries foul when it detects an 'illegal' version. The alerts are reported to disappear as soon as the software is correctly registered. There are privacy issues though: "The Software includes a feature that assigns a unique order number to GameGain based on purchase information. The Software reports this number to us via the internet either when you run the Software or enter the registration number, or both. The Software may also identify and report to us your IP address, date and time of installation, registration and/or use. We use this information strictly to count the number of installations, detect unauthorized access or piracy of the Software, and develop rough statistical data regarding the geographic location of our users" Source=Paul Collins Startup list [PivotSoftware] Number=7884 Confirmed=N Filename=wpctrl.exe Description=PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [Pixel32] Number=7885 Confirmed=X Filename=Pixel32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Pixelpwr32] Number=7886 Confirmed=X Filename=Pixelpwr32.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Pixelsvr] Number=7887 Confirmed=X Filename=Pixelsvr.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [pjWebCam] Number=7888 Confirmed=U Filename=pjWebCam.exe Description=Webcam automation software that saves regular photos from webcam and can also act as HTTP server Source=Paul Collins Startup list [PK Guard] Number=7889 Confirmed=X Filename=pkguard32.exe Description=Added by the GUAPIM WORM! Source=Paul Collins Startup list [PK Services] Number=7890 Confirmed=X Filename=pksvc.exe Description=Added by the FORBOT-BW WORM! Source=Paul Collins Startup list [PktAnything] Number=7891 Confirmed=U Filename=PocketCompanion.exe Description=PocketAnything lets you save anything on your computer to your mobile, with one click Source=Paul Collins Startup list [Planl�gningsagent] Number=7892 Confirmed=U Filename=mstask.exe Description=Windows Task Scheduler (on Danish language versions of Windows) - displayed as a box with a stopwatch in the System Tray. Required if you have regularly scheduled tasks like defragmenting, ScanDisk, weekly virus scans and so on Source=Paul Collins Startup list [Plasdll service] Number=7893 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Playboy] Number=7894 Confirmed=X Filename=playavi.exe Description=Added by the GAMANLOCK TROJAN! Source=Paul Collins Startup list [PLEAPCPUCPL] Number=7895 Confirmed=U Filename=pleapu.exe Description=CPU Control Panel for the Powerleap CPU upgrade Source=Paul Collins Startup list [PLFFAP] Number=7896 Confirmed=? Filename=HotfixQ0306270.exe Description=Prolific Technology Inc. USB Flash Disk driver - is it required in startup? Source=Paul Collins Startup list [Plguni] Number=7897 Confirmed=N Filename=Plguni.exe Description=McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Source=Paul Collins Startup list [plmg.exe] Number=7898 Confirmed=U Filename=plmg.exe Description=Paragon Last Minute Bidder - auction assistant software Source=Paul Collins Startup list [PLoader] Number=7899 Confirmed=? Filename=umsd.exe Description=USB Mass Storage Disk related tray icon. Is it required? Source=Paul Collins Startup list [Plob] Number=7900 Confirmed=X Filename=kernel.com Description=Added by the OPTIXPRO.12 TROJAN! Source=Paul Collins Startup list [Plook] Number=7901 Confirmed=X Filename=plook.exe Description=AffiliateTarget.com alias PLook adware Source=Paul Collins Startup list [Pluck Tray] Number=7902 Confirmed=U Filename=PluckTray.exe Description=RSS (XML TAGS) reader program Source=Paul Collins Startup list [PluckSvr] Number=7903 Confirmed=? Filename=PluckUpdater.exe Description=Pluck Toolbar updater Source=Paul Collins Startup list [Plug And Play] Number=7904 Confirmed=X Filename=msnmsg.exe Description=Added by the RBOT-ID WORM! Source=Paul Collins Startup list [Pluto! Pager] Number=7905 Confirmed=X Filename=srvhandle.exe Description=Added by the REDPLUT VIRUS! Source=Paul Collins Startup list [PLXSTART] Number=7906 Confirmed=U Filename=PLXSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays the "Plextor Manager 2000" splash screen for Plextor CD-RW. Source=Paul Collins Startup list [PLXTASK] Number=7907 Confirmed=N Filename=PLXTASK.EXE Description=Taskbar utility for a "control panel" for a Plextor CD-RW. Has MVP 2000 (audio CD player), DiscDupe 2000 (self explanatory CD copying program) and AudioCapture 2000 (rips audio CDs into MP3 or WAV files) Source=Paul Collins Startup list [pm32ctrl] Number=7908 Confirmed=X Filename=pwr32crtl.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [pm32info] Number=7909 Confirmed=X Filename=pm32info.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [pmc] Number=7910 Confirmed=X Filename=764.exe Description=Adult content dialler Source=Paul Collins Startup list [pmcqt] Number=7911 Confirmed=X Filename=pmcqt.exe Description=Added by the DLUCA-V TROJAN! Source=Paul Collins Startup list [Pmedia] Number=7912 Confirmed=X Filename=winsrvc.exe Description=Internet marketing sofware from Permissioned Media Inc as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM! Source=Paul Collins Startup list [PmProxy] Number=7913 Confirmed=? Filename=PmProxy.exe Description=Associated with Analog Devices "SoundMAX" audio chipset - often built-in to motherboards. What does it do and is it required? Source=Paul Collins Startup list [pmr] Number=7914 Confirmed=X Filename=pmr.exe Description=PowerStrip foistware. Note - this is not the same as the video tweaking utility of the same name here Source=Paul Collins Startup list [PMT] Number=7915 Confirmed=U Filename=personalmoneytree.exe Description=According to the web site Personal Money Tree is an automatic cash rebate program. Note: Not recommended Source=Paul Collins Startup list [PMTSHOOT] Number=7916 Confirmed=N Filename=pmtshoot.exe Description=MS tool for troubleshooting power management problems Source=Paul Collins Startup list [PMXInit] Number=7917 Confirmed=U Filename=pmxinit.exe Description=Restores user display preferences Kyro2 based graphics cards. Not required unless you change the default settings - such as gamma Source=Paul Collins Startup list [PNAgent] Number=7918 Confirmed=N Filename=PNAgent.exe Description=PhatNoise Music Manager - manages WMA, MP3, WAV, etc music files Source=Paul Collins Startup list [PNP] Number=7919 Confirmed=X Filename=wuaaclt.exe Description=Added by the LILBRE-A WORM! Source=Paul Collins Startup list [PnP Driver] Number=7920 Confirmed=X Filename=playboy.exe Description=Added by the FORBOT-FR WORM! Source=Paul Collins Startup list [PNP FIX] Number=7921 Confirmed=X Filename=[worm filename] Description=Added by the RBOT-AKQ WORM! Source=Paul Collins Startup list [Pnpchk] Number=7922 Confirmed=U Filename=Pnpchk.exe Description=Aztech Labs Sound 3 PnP driver Source=Paul Collins Startup list [pnpsvc_lock] Number=7923 Confirmed=X Filename=******.exe [* = random digit] Description=Browser hijacker Source=Paul Collins Startup list [pnpsvc_lock] Number=7924 Confirmed=X Filename=startsvs.exe Description=Browser hijacker Source=Paul Collins Startup list [PNSetup] Number=7925 Confirmed=U Filename=PNSetup.exe Description=PopNot - pop-up killer Source=Paul Collins Startup list [PNtask Services] Number=7926 Confirmed=X Filename=pntask.exe Description=Added by the LALA.C TROJAN! Source=Paul Collins Startup list [pnvifj] Number=7927 Confirmed=X Filename=jusodl.exe Description=Added by the QQPASS.48436 TROJAN! Source=Paul Collins Startup list [Pocket Sheet Sync] Number=7928 Confirmed=U Filename=PSXLTRAY.EXE Description=Casio Pocket Sheet synchronization software Source=Paul Collins Startup list [Poet] Number=7929 Confirmed=X Filename=Poet.exe Description=Added by the DOEP.A WORM! Source=Paul Collins Startup list [Pofatch] Number=7930 Confirmed=X Filename=nstrue.exe Description=Added by the RANDEX.Z WORM! Source=Paul Collins Startup list [point32] Number=7931 Confirmed=U Filename=point32.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [POINTER] Number=7932 Confirmed=U Filename=point32.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Points Manager] Number=7933 Confirmed=X Filename=points manager.exe Description=Altnet TopSearch adware Source=Paul Collins Startup list [Pollon] Number=7934 Confirmed=X Filename=pollone.exe Description=Added by the SPYBOT.FW WORM! Source=Paul Collins Startup list [polo.exe] Number=7935 Confirmed=X Filename=polo.exe Description=Added by the AGENT-PE TROJAN! Source=Paul Collins Startup list [POP] Number=7936 Confirmed=X Filename=PopSrv***.exe Description=PeopleonPage foistware, bundled with Grokster where *** are random digits Source=Paul Collins Startup list [POP Manager] Number=7937 Confirmed=X Filename=popmgr.exe Description=Added by the BCKDR-PYV TROJAN! Source=Paul Collins Startup list [Pop-Up Smasher] Number=7938 Confirmed=U Filename=PopupSmasher.exe Description=Pop-Up Smasher - pop-up killer Source=Paul Collins Startup list [Pop-Up Stopper] Number=7939 Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [Pop-Up_Blocker] Number=7940 Confirmed=U Filename=Popup.exe Description=A Tweak-XP component, blocks advertisement pop-up windows in Internet Explorer. Can be enabled/disabled via Tweak-XP -> Internet Tweaks Source=Paul Collins Startup list [Pop-Up_Scanner] Number=7941 Confirmed=U Filename=Popupscn.exe Description=Panicware popup blocker Source=Paul Collins Startup list [pop06ap] Number=7942 Confirmed=X Filename=pop06ap2.exe Description=MediaMotor adware Source=Paul Collins Startup list [pop06apelt] Number=7943 Confirmed=X Filename=thiselt.exe Description=ZenoSearch adware Source=Paul Collins Startup list [pop3 Server] Number=7944 Confirmed=U Filename=config.cfg Description=Part of HTML2POP3 - "Convert Webmail to POP3.Is also included a SMTP/POP3 tunneling system that allow send and receive email in a private network HTTP PROXY based. All connection are plugin based. Over 250 email server supported and tested" Source=Paul Collins Startup list [pop3trap.exe] Number=7945 Confirmed=Y Filename=pop3trap.exe Description=PC-Cillin 2000 antivirus software -> E-mail scanner Source=Paul Collins Startup list [PopeSvr] Number=7946 Confirmed=X Filename=PopeSvr.exe Description=Added by the LEGMIR-AJ TROJAN! Source=Paul Collins Startup list [PopMark] Number=7947 Confirmed=X Filename=WinTask.exe Description="Pop Marketing" adware Source=Paul Collins Startup list [PopNot] Number=7948 Confirmed=U Filename=PopNot.exe Description=PopNot - pop-up killer Source=Paul Collins Startup list [PopOops] Number=7949 Confirmed=U Filename=PopOops.exe Description=PopOops - pop-up killer Source=Paul Collins Startup list [Popopen] Number=7950 Confirmed=U Filename=popopen.exe Description=PopOpen makes your windows spring open with animation effects Source=Paul Collins Startup list [Poproxy] Number=7951 Confirmed=Y Filename=POPROXY.EXE Description=Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it Source=Paul Collins Startup list [popsrv146] Number=7952 Confirmed=X Filename=popsrv146.exe Description=AproposMedia adware Source=Paul Collins Startup list [PopSubtract] Number=7953 Confirmed=U Filename=PopSub.exe Description=PopSubtract - pop-up killer Source=Paul Collins Startup list [Popup Ad Filter] Number=7954 Confirmed=U Filename=PopFilter.exe Description=Popup Ad Filter - pop-up killer Source=Paul Collins Startup list [Popup and Advertisement Killers] Number=7955 Confirmed=U Filename=adkillers.exe Description=Added by the RBOT-DDH WORM! Source=Paul Collins Startup list [Popup Blocker System] Number=7956 Confirmed=X Filename=PopUpBlocker.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Popup Blocker System326a Monitoring] Number=7957 Confirmed=X Filename=PopUpBlocker6a.exe Description=Added by the RBOT.AUH WORM! Source=Paul Collins Startup list [Popup Blocker System8 Monitoring] Number=7958 Confirmed=X Filename=PopUpBlocker8.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Popup Blocker Updater] Number=7959 Confirmed=X Filename=regsvr32 [path] veev****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [PopUp Buster+] Number=7960 Confirmed=U Filename=popupbuster.exe Description=PopUp Buster - free Pop-up blocker Source=Paul Collins Startup list [Popup Defence Updater] Number=7961 Confirmed=X Filename=regsvr32 [path] pdf****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [Popup Defender] Number=7962 Confirmed=U Filename=PD.exe Description=Popup Defender - pop-up killer Source=Paul Collins Startup list [Popup Terminator] Number=7963 Confirmed=U Filename=GLADManager.exe Description=Popup Terminator - pop-up killer Source=Paul Collins Startup list [PopupEliminator] Number=7964 Confirmed=U Filename=Popup Eliminator.exe Description=Popup Eliminator - pop-up killer Source=Paul Collins Startup list [PopUpKiller] Number=7965 Confirmed=U Filename=PopUpKiller.exe Description=PopUpKiller - pop-up killer Source=Paul Collins Startup list [popuppers] Number=7966 Confirmed=X Filename=newpop63.exe Description=Medload adware Source=Paul Collins Startup list [popuppers64] Number=7967 Confirmed=X Filename=a64sddd.exe Description=Popuppers adware, also detected as the LOWZONE-AA TROJAN! Source=Paul Collins Startup list [popuppers65] Number=7968 Confirmed=X Filename=[path to file] Description=Medload adware Source=Paul Collins Startup list [PopUpStopperCompanion] Number=7969 Confirmed=U Filename=PSComp.exe Description=PopupStopper Companion popup blocker Source=Paul Collins Startup list [PopUpStopperFreeEdition] Number=7970 Confirmed=U Filename=PSFREE.EXE Description=Panicware's Pop-Up Stopper - free limited features version Source=Paul Collins Startup list [PopUpStopperProfessional] Number=7971 Confirmed=U Filename=PopUpStopperProfessional.exe Description=Panicware's Pop-Up Stopper - paid for version Source=Paul Collins Startup list [PopupVanish] Number=7972 Confirmed=U Filename=PopupVanish.exe Description=Pop-up blocker Source=Paul Collins Startup list [PopUpWasher] Number=7973 Confirmed=U Filename=PopUpWasher.exe Description=PopUpWasher pop-up killer Source=Paul Collins Startup list [PopUpWatch] Number=7974 Confirmed=N Filename=PopUpWatch.exe Description=BPS spyware remover - not recommended, see here Source=Paul Collins Startup list [POS-Partnerbatchprocessor] Number=7975 Confirmed=? Filename=BATCH.EXE Description=VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut? Source=Paul Collins Startup list [Post-It(r) Software] Number=7976 Confirmed=N Filename=Psnotes.exe Description=Pop-up "yellow" notes on screen. Available via Start -> Programs Source=Paul Collins Startup list [POW!] Number=7977 Confirmed=U Filename=pow.exe Description=Pop-up killer Source=Paul Collins Startup list [Power Scan] Number=7978 Confirmed=X Filename=powerscan.exe Description=Foistware by Integrated Search Technologies - the people behind ISTBar adware Source=Paul Collins Startup list [Power2GoExpress] Number=7979 Confirmed=U Filename=Power2GoExpress.exe Description=Power2GoExpress - all media disc burning software Source=Paul Collins Startup list [PowerBar] Number=7980 Confirmed=N Filename=Powerbar.exe Description=Part of Cyberlink's PowerDVD software. Not sure what exactly it does, but not required in startup Source=Paul Collins Startup list [PowerChute] Number=7981 Confirmed=Y Filename=Pwrchute.exe Description="During a power outage, if you're not available to save your files & close down Windows....PowerChute will do that for you. PowerChute will save your application files, close your applications and shut down your computer just like you would...otherwise, the APC UPS (Uninterruptible Power Supply) unit would go to battery until it wore down, then your computer would shutoff" Source=Paul Collins Startup list [PowerChute] Number=7982 Confirmed=X Filename=Pwrchute.exe Description=Added by the LAZAR-A TROJAN! Note - this is located in the Program Files\APC_Power directory Source=Paul Collins Startup list [PowerDOCSAPIHost] Number=7983 Confirmed=U Filename=papihost.exe Description=Hummingbird PowerDOCS - "delivers powerful enterprise document management functionality via a tightly integrated Microsoft WinNT/98/2K environment" Source=Paul Collins Startup list [PowerDVD] Number=7984 Confirmed=N Filename=PowerDVD.exe Description=Launches Cyberlink's PowerDVD software and creates a system tray icon. If enabled, PowerDVD will open automatically when a DVD movie is inserted. Launch manually Source=Paul Collins Startup list [PowerKey] Number=7985 Confirmed=U Filename=PowerKey.exe Description=Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Source=Paul Collins Startup list [PowerManagement] Number=7986 Confirmed=X Filename=Rundlll.exe Description=Added by the SURDUX TROJAN! Source=Paul Collins Startup list [PowerManager] Number=7987 Confirmed=X Filename=Svchost.exe Description=Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [PowerPanel] Number=7988 Confirmed=Y Filename=POWPANEL.EXE Description=Power management utility on notebooks/laptops - automatically switches modes when running on battery Source=Paul Collins Startup list [PowerPanel Personal Edition User Interaction] Number=7989 Confirmed=U Filename=pppeuser.exe Description=CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - "is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system, components, peripherals, and most importantly, your data" Source=Paul Collins Startup list [PowerPrifile] Number=7990 Confirmed=X Filename=rundl132 kenel.dll, PowerProfileEnable Description=Added by the INMOTA WORM! Source=Paul Collins Startup list [PowerPro] Number=7991 Confirmed=U Filename=powerpro.exe Description=Part of the power professional program that loads the floating menu bar. Can be accessed from Start -> Programs, but I'd leave it alone if you use this program Source=Paul Collins Startup list [PowerProf] Number=7992 Confirmed=X Filename=PowerProf.exe Description=Added by the LOREX.B TROJAN! Source=Paul Collins Startup list [PowerProfile] Number=7993 Confirmed=X Filename=mfcp30.exe Description=Added by the RINDAS-A TROJAN! Source=Paul Collins Startup list [PowerQuest Startup Utility] Number=7994 Confirmed=N Filename=PQINIT.EXE Description=From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set up, it does nothing (except waste bytes and cycles). I disabled it using msconfig.exe with no problems" Source=Paul Collins Startup list [PowerReg Scheduler] Number=7995 Confirmed=N Filename=PowerReg Scheduler.exe Description=PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others Source=Paul Collins Startup list [PowerReg SchedulerV2] Number=7996 Confirmed=N Filename=PowerReg SchedulerV2.exe Description=PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others Source=Paul Collins Startup list [PowerReg SchedulerV3] Number=7997 Confirmed=N Filename=PowerReg SchedulerV3.exe Description=PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others Source=Paul Collins Startup list [POWERR~1] Number=7998 Confirmed=? Filename=POWERR~1.exe Description=Power monitoring? Source=Paul Collins Startup list [PowerS] Number=7999 Confirmed=? Filename=PowerS.exe Description=ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required? Source=Paul Collins Startup list [PowerSet] Number=8000 Confirmed=? Filename=Regedit.exe /s ...PowerSet_8100_CU.REG Description=Appears to be Toshiba power management related Source=Paul Collins Startup list [PowerStrip] Number=8001 Confirmed=N Filename=powerstrip.exe Description=PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings Source=Paul Collins Startup list [PowerStrip] Number=8002 Confirmed=N Filename=PSTRIP.EXE Description=PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings Source=Paul Collins Startup list [PowerTools Tray Icon] Number=8003 Confirmed=U Filename=pttray.exe Description=PowerTools - add-on for AOL Source=Paul Collins Startup list [Powertweak] Number=8004 Confirmed=U Filename=PT2.EXE Description="Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the system) can be configured." This item is added to startup if 'Use predefined settings' is enabled in the programs options Source=Paul Collins Startup list [Powertweak] Number=8005 Confirmed=U Filename=PTCTRL.EXE Description="Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the system) can be configured." This item is added to startup if 'Configure system at logon' is enabled in the programs options Source=Paul Collins Startup list [Power_Gear] Number=8006 Confirmed=U Filename=BatteryLife.exe Description=Power management for all Asus notebook. Useful but not critical Source=Paul Collins Startup list [PP Gamma] Number=8007 Confirmed=U Filename=ppgamma.exe Description=Profile Prism software that allows monitor calibration and can generate ICC profiles for digital cameras Source=Paul Collins Startup list [PP****usb] Number=8008 Confirmed=N Filename=FBDirect.exe Description=Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs Source=Paul Collins Startup list [PP2000 Instaupdate] Number=8009 Confirmed=U Filename=PPInupdt.exe Description=Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually Source=Paul Collins Startup list [PP2000 Real Time Scan] Number=8010 Confirmed=Y Filename=PPVstop.exe Description=Protector Plus anti-virus software - real time scanner Source=Paul Collins Startup list [PP2000 Taskbar Control] Number=8011 Confirmed=Y Filename=PPTbc.exe Description=Protector Plus anti-virus software - system tray access Source=Paul Collins Startup list [PP3100b] Number=8012 Confirmed=N Filename=flatbed.exe Description=Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop Source=Paul Collins Startup list [ppass] Number=8013 Confirmed=U Filename=Antispy.exe Description=AntiSpy firewall - "program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide" Source=Paul Collins Startup list [PPControl] Number=8014 Confirmed=U Filename=PPControl.exe Description=PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition Source=Paul Collins Startup list [PPCRunonce] Number=8015 Confirmed=U Filename=PPCRunOnce.exe Description=Related to PeoplePC ISP software - may display advertising, see here Source=Paul Collins Startup list [PPHIDPAD] Number=8016 Confirmed=U Filename=pphidpad.exe Description=PenPower Chinese handwriting recognition software Source=Paul Collins Startup list [PPK Setup(Server)] Number=8017 Confirmed=U Filename=SEServe.exe Description=Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button, collect your e-mail automatically with one key stroke. You can also program your PPK to turn on your SuperSlim Notebook at a predetermined time and perform simple tasks - completely unattended" Source=Paul Collins Startup list [PPMemCheck] Number=8018 Confirmed=U Filename=ppmemcheck.exe Description=PPMemCheck - used to be part of PestPatrol before CA's acquisition Source=Paul Collins Startup list [PPPOEO] Number=8019 Confirmed=X Filename=pingppac.exe Description=Added by the SPYBOT.KHC WORM! Source=Paul Collins Startup list [PProTray] Number=8020 Confirmed=N Filename=pprotray.exe Description=Part of the power professional program. Loads the System Tray control Source=Paul Collins Startup list [PPScheduler] Number=8021 Confirmed=? Filename=PPScheduler.exe Description=Nuance (was ScanSoft) PaperPort Scheduler - what does it do and is it required? Source=Paul Collins Startup list [PPSVC] Number=8022 Confirmed=U Filename=[path to file] Description=PC Police surveillance software that logs keystrokes, files looked at, applications used, and chats on either MSN, Yahoo, ICQ or AOL. This information can then be transmitted to a remote user. Uninstall this software if you did not install it yourself Source=Paul Collins Startup list [PPSYS] Number=8023 Confirmed=U Filename=ppsys.exe Description=PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself Source=Paul Collins Startup list [pptd40nt] Number=8024 Confirmed=N Filename=pptd40nt.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [PPUpdate] Number=8025 Confirmed=U Filename=ppupdater.exe Description=PPUpdater - updater that used to be part of PestPatrol before CA's acquisition Source=Paul Collins Startup list [PPWWebCap] Number=8026 Confirmed=N Filename=PPWebCap.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [pqhelper] Number=8027 Confirmed=X Filename=pqhelper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [PractiSearch] Number=8028 Confirmed=U Filename=PSearch.exe Description=PractiSearch web search software Source=Paul Collins Startup list [Praize Messenger] Number=8029 Confirmed=U Filename=itLoad.exe Description=Praize IM Christian chat instant messenger Source=Paul Collins Startup list [Prayer] Number=8030 Confirmed=U Filename=PTW.EXE Description=Islamic Adhan program (call fpr daily prayers) Source=Paul Collins Startup list [prdtect] Number=8031 Confirmed=X Filename=prdtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [PreAnnotate] Number=8032 Confirmed=? Filename=PreAnntt.exe Description=Genius Wizard Pen Tablet driver related. Is it required? Source=Paul Collins Startup list [Precision Time Clock Checker] Number=8033 Confirmed=N Filename=PrecisionTime.exe Description=Precision Time 2.0. Checks your computer clock time against the Naval Observatory or some other source to assure accurate time Source=Paul Collins Startup list [PrecisionTime] Number=8034 Confirmed=X Filename=PrecisionTime.exe Description=PrecisionTime - clock synchronizing software containg spyware by Claria/GAIN. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [precpop2] Number=8035 Confirmed=X Filename=starter.exe Description=PrecisionPop adware Source=Paul Collins Startup list [Prein] Number=8036 Confirmed=X Filename=APP****.tmp [* = random char or digit] Description=Unidentified adware Source=Paul Collins Startup list [Preload] Number=8037 Confirmed=Y Filename=Preload.exe Description=Millenium Multi-Function Keyboard driver Source=Paul Collins Startup list [PreloadApp] Number=8038 Confirmed=? Filename=hphprld.exe Description=HP PhotoSmart printers related. What does it do and is it required? Source=Paul Collins Startup list [Premeter] Number=8039 Confirmed=X Filename=nrpr.exe Description=NetRatings Premeter spyware Source=Paul Collins Startup list [Premeter] Number=8040 Confirmed=X Filename=prmt.exe Description=NetRatings Premeter spyware Source=Paul Collins Startup list [Preview AdService] Number=8041 Confirmed=X Filename=PrevAdServ.exe Description=Windupdates adware variant Source=Paul Collins Startup list [PrevX] Number=8042 Confirmed=X Filename=prevx.exe Description=Added by the IRCBOT-TF WORM! Note - this worm is located in the System (Win9x/Me) or System32 (XP/WinNT/2K) directory and is not the PrevX Home intrusion prevention software Source=Paul Collins Startup list [PrevxHome] Number=8043 Confirmed=Y Filename=SAGUI.exe Description=PrevX Home intrusion prevention software Source=Paul Collins Startup list [PrevxOne] Number=8044 Confirmed=Y Filename=PXConsole.exe Description=Prevx intrusion prevention software Source=Paul Collins Startup list [PrevxPro] Number=8045 Confirmed=Y Filename=SAGUI.exe Description=PrevX Home intrusion prevention software Source=Paul Collins Startup list [prgtect] Number=8046 Confirmed=X Filename=prgtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [Price Patrol] Number=8047 Confirmed=N Filename=neo.exe Description=Price Patrol by Half.com - internet shopping companion for finding the best on-line prices Source=Paul Collins Startup list [PrimaLauncher] Number=8048 Confirmed=? Filename=Launcher.exe Description=Associated with PrimaScan scanners. Is it required? Source=Paul Collins Startup list [Primax 3D Mouse] Number=8049 Confirmed=U Filename=3dmoused.exe Description=Enables the scroll button on the Primax 3-D Scroll mouse Source=Paul Collins Startup list [Primsta] Number=8050 Confirmed=? Filename=Primsta.exe Description=Linksys Wireless CompactFlash Card driver related. Is it required? Source=Paul Collins Startup list [Print Driver Helper Service] Number=8051 Confirmed=X Filename=crsrr.exe Description=Added by the AGENT-BC TROJAN! Source=Paul Collins Startup list [Print Master Event Reminder] Number=8052 Confirmed=N Filename=PMremind.exe Description=Print Master Gold - calander feature that pops up reminders, such as birthdays Source=Paul Collins Startup list [Print Screen Deluxe] Number=8053 Confirmed=N Filename=psdeluxe.exe Description=Utility allows "Print Scrn" or "Print Screen" key to capture, print or save the current window Source=Paul Collins Startup list [Print Services] Number=8054 Confirmed=X Filename=spolserv32.exe Description=Added by the RBOT.ZP WORM! Source=Paul Collins Startup list [print sharing] Number=8055 Confirmed=X Filename=start.bat Description=Added by the ZCREW TROJAN! Source=Paul Collins Startup list [print sharing] Number=8056 Confirmed=X Filename=[path] hidden32.exe [path] explorer.exe Description=Added by the ZCREW.B TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [Print Spooler] Number=8057 Confirmed=X Filename=Spoolsv.exe Description=Added by the CIADOOR.B TROJAN! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [Print Spooler] Number=8058 Confirmed=X Filename=spoolsvc32.exe Description=Added by the SDBOT.BB TROJAN! Source=Paul Collins Startup list [Print Spooler] Number=8059 Confirmed=X Filename=spools.exe Description=Added by the RBOT-LD WORM! Source=Paul Collins Startup list [Print Spooler] Number=8060 Confirmed=X Filename=spool.exe Description=Added by the IS TROJAN! Source=Paul Collins Startup list [Print Spooler] Number=8061 Confirmed=X Filename=spoolsv32.exe Description=Added by the RBOT.SW WORM! Source=Paul Collins Startup list [Printer] Number=8062 Confirmed=N Filename=Spyassault.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Printer] Number=8063 Confirmed=X Filename=[path to file] Description=Added by the LOWTAPER TROJAN! Source=Paul Collins Startup list [Printer] Number=8064 Confirmed=X Filename=dipset.exe Description=Added by a variant of the FBSR TROJAN! Source=Paul Collins Startup list [printer] Number=8065 Confirmed=U Filename=SpyAssaultScanner.exe Description=SpyAssault keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [printer] Number=8066 Confirmed=N Filename=SpyAssaultScanner.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Printer] Number=8067 Confirmed=X Filename=vmmon32.exe Description=Added by the RBOT-CSB WORM! Source=Paul Collins Startup list [Printer Monitor] Number=8068 Confirmed=X Filename=webprinter.exe Description=Added by the IRCBOT-Z TROJAN! Source=Paul Collins Startup list [Printer Spool] Number=8069 Confirmed=X Filename=updater.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Printer spool Service] Number=8070 Confirmed=X Filename=spool.exe Description=Added by the RBOT-ACP WORM! Source=Paul Collins Startup list [printer spooler] Number=8071 Confirmed=X Filename=commonaccess.exe Description=Added by the DELF-LB TROJAN! Source=Paul Collins Startup list [Printer Spooler Subsystem] Number=8072 Confirmed=X Filename=spoolss.exe Description=Added by a variant of the RBOT WORM! - Note - this is NOT the legitimate Windows spoolss.exe process, located in the Winnt/System32 or Windows\System32 folder, and which should NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [Printer Update] Number=8073 Confirmed=? Filename=CFGREG.EXE Description=Maybe a registration reminder or automatically updates drivers or application software for a printer? Source=Paul Collins Startup list [PrinterSpool] Number=8074 Confirmed=X Filename=[path] RESTORE.EXE [path] SPOOL.EXE Description=Added by the ALADINZ.K TROJAN! Source=Paul Collins Startup list [Printing Driver] Number=8075 Confirmed=X Filename=msprint.exe Description=Added by the RBOT.JH WORM! Source=Paul Collins Startup list [Printkey2000] Number=8076 Confirmed=N Filename=printkey2000.exe Description=Screen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required Source=Paul Collins Startup list [PrintMngr] Number=8077 Confirmed=X Filename=system.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [printnow] Number=8078 Confirmed=N Filename=printnow.exe Description=PrintNow - a utility that primarily allows "Print Srceen" or "Alt+Print Screen" screenshots to be sent directly to a printer Source=Paul Collins Startup list [PrinTray] Number=8079 Confirmed=N Filename=Printray.exe Description=Lexmark/Compaq printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. See also LexmarkPrintray and CompaqPrinTray Source=Paul Collins Startup list [PrintScreen] Number=8080 Confirmed=N Filename=UNWISE.EXE Description=Gadwin PrintScreen - utility to capture, print or save the current window Source=Paul Collins Startup list [Printscreen 95] Number=8081 Confirmed=N Filename=PRT95MIN.EXE Description=Printscreen 95 - utility to capture, print or save the current window Source=Paul Collins Startup list [PrintSpoolSv] Number=8082 Confirmed=X Filename=System.exe Description=Added by the BDOOR-S TROJAN! Source=Paul Collins Startup list [PRISMSTA.EXE] Number=8083 Confirmed=U Filename=PRISMSTA.EXE Description=Creates a system tray icon for accessing information about Intersil Prism Wireless Settings. Intersil silicon is used by Trendware/Trendnet for example Source=Paul Collins Startup list [PRISMSVR] Number=8084 Confirmed=U Filename=PRISMSVR.EXE Description=Configuration and settings utility for PRISM chipset based wireless modems such as the 2Wire Wireless Gateway (2701HG) and Siemens Gigaset USB Adapter Source=Paul Collins Startup list [Privacy Eraser Pro] Number=8085 Confirmed=N Filename=PrivacyEraser.exe Description=Privacy Eraser Pro - protects your Internet privacy by cleaning up all Internet history tracks and past computer activities Source=Paul Collins Startup list [PrivacyKeyboard] Number=8086 Confirmed=U Filename=PrivacyKeyboard.exe Description=PrivacyKeyboard is a product "that can provide every computer with strong protection against ALL types of keylogging programs and keylogging hardware devices, both known and unknown, currently in use or presently being developed worldwide" Source=Paul Collins Startup list [PrivacyScanner] Number=8087 Confirmed=X Filename=pscan.exe Description=Privacy Champion, a stealth installed 'Privacy Scanner'. It purportedly scans your PC for links to adult content websites, and then offers to "clean" them. Produces loads of False Positives as goad to purchase Source=Paul Collins Startup list [PrivateNet] Number=8088 Confirmed=X Filename=[various filenames] Description=Premium rate adult content dialler Source=Paul Collins Startup list [Privoxy] Number=8089 Confirmed=U Filename=privoxy.exe Description=Privoxy - web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk Source=Paul Collins Startup list [PrizeSurfer] Number=8090 Confirmed=X Filename=prizesurfer.exe Description="PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware Source=Paul Collins Startup list [prjtect] Number=8091 Confirmed=X Filename=prjtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prktect] Number=8092 Confirmed=X Filename=prktect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prltect] Number=8093 Confirmed=X Filename=prltect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prmt] Number=8094 Confirmed=X Filename=prmt.exe Description=NetRatings Premeter spyware Source=Paul Collins Startup list [prmtect] Number=8095 Confirmed=X Filename=prmtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [PrnSys Executable] Number=8096 Confirmed=U Filename=PrnSys.exe Description=Print screen utility bundled with some HP printer software - not required, but your choice if you like that feature Source=Paul Collins Startup list [pro] Number=8097 Confirmed=X Filename=[path to file] Description=Added by the SPYWAD-F TROJAN! Source=Paul Collins Startup list [pro] Number=8098 Confirmed=X Filename=SpySheriff.exe Description=Added by the SPYWAD-I TROJAN! Source=Paul Collins Startup list [Pro PCL Status Monitor] Number=8099 Confirmed=U Filename=PENGSS.EXE Description=Xerox printer/fax/copier status monitor (PCL = printer control language) Source=Paul Collins Startup list [ProAntiVirus] Number=8100 Confirmed=X Filename=ProAntiVirus.exe Description=Added by the RBOT-FTP WORM! Source=Paul Collins Startup list [ProArt] Number=8101 Confirmed=? Filename=ProArt.exe Description=?? Source=Paul Collins Startup list [Proc992] Number=8102 Confirmed=X Filename=[path to file] Description=Added by the IXBOT-C WORM! Source=Paul Collins Startup list [Proc993] Number=8103 Confirmed=X Filename=wqxfne.exe Description=Added by the IXBOT-D WORM! Source=Paul Collins Startup list [process.exe] Number=8104 Confirmed=X Filename=process.exe Description=Added by the BANCOS.P TROJAN! Source=Paul Collins Startup list [ProcessGovernor] Number=8105 Confirmed=U Filename=processgovernor.exe Description=ProcessGuvernor "helps regulate the CPU load on a computer running Microsoft Windows. It keeps single programs from hijacking the computer's performance and effectively causing a freeze for several minutes. ProcessGovernor automatically adjusts process priorities according to a predefined ruleset" Source=Paul Collins Startup list [ProcessSupervisorGUI] Number=8106 Confirmed=U Filename=ProcessSupervisor.exe Description=Process Supervisor "is a technology designed to automatically configure and manage processes on one or more computers for the goal of maintaining system stability and responsiveness, restricting executables from running, and logging of program executions" Source=Paul Collins Startup list [ProcessTamer] Number=8107 Confirmed=U Filename=ProcessTamerTray.exe Description=Mouser's Software Process Tamer "is a tiny (140k) and super efficient utility for Microsoft Windows XP/2K/NT that runs in your system tray and constantly monitors the cpu usage of other processes" Source=Paul Collins Startup list [procmon] Number=8108 Confirmed=X Filename=procmon.exe Description=Added by the BIONET.40A TROJAN! Source=Paul Collins Startup list [Prodigy DSL] Number=8109 Confirmed=? Filename=EnterNetDUN.Exe Description=Prodigy EnterNet DUN PPPoE Client - is it required? Source=Paul Collins Startup list [ProdikeysAutorun] Number=8110 Confirmed=N Filename=Prodload.exe Description=Creative Prodikeys software. "an interactive music entertainment device which not only functions as a full-featured, ergonomic �QWERTY� keyboard but also comes equipped with 37 touch-sensitive music keys and accessible music controls for endless entertainment at your desktop. Coupled with the Sound Blaster audio card, you can explore a wide array of realistic instrument sounds and have non-stop fun making music right at your desktop" Source=Paul Collins Startup list [ProDsl] Number=8111 Confirmed=N Filename=ProDsl.exe Description=Intel Pro/DSL 2100 modem connection manager. Available via Start -> Programs Source=Paul Collins Startup list [Profile] Number=8112 Confirmed=X Filename=Profile.vbs Description=Added by the WHITEHO VIRUS or TRAPPY WORM! Source=Paul Collins Startup list [Profiler] Number=8113 Confirmed=N Filename=Profiler.exe Description=Enables the "Profiler" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs Source=Paul Collins Startup list [profiler] Number=8114 Confirmed=X Filename=liteout.exe Description=Added by the ZAPCHAS-G WORM! Source=Paul Collins Startup list [profiler] Number=8115 Confirmed=X Filename=prof.exe Description=Added by the ZAPCHAS-G WORM! Source=Paul Collins Startup list [Prog] Number=8116 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Prog] Number=8117 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [Program File] Number=8118 Confirmed=X Filename=Progmon.exe Description=Added by the PEEPER TROJAN! Source=Paul Collins Startup list [Program in Windows] Number=8119 Confirmed=X Filename=iexplore.exe Description=Added by the LOVGATE-W WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System32 folder Source=Paul Collins Startup list [Program Neighborhood Agent] Number=8120 Confirmed=U Filename=pnagent.exe Description=Citrix Program Neighborhood Agent Source=Paul Collins Startup list [ProgramWindow] Number=8121 Confirmed=? Filename=more comp.exe Description=?? Source=Paul Collins Startup list [projselector] Number=8122 Confirmed=N Filename=projselector.exe Description=Roxio Project Selector - can be started manually Source=Paul Collins Startup list [Promon.exe] Number=8123 Confirmed=N Filename=promon.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [PromulGate] Number=8124 Confirmed=X Filename=PgMonitr.exe Description=Delfin Promulgate adware variant Source=Paul Collins Startup list [PRONoMgr.exe] Number=8125 Confirmed=N Filename=PRONoMgr.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [PRONoMgrWired] Number=8126 Confirmed=U Filename=PRONoMgr.exe Description=Intel's Pro 100 Ethernet card manager Source=Paul Collins Startup list [Propel Accelerator] Number=8127 Confirmed=U Filename=PropelAC.exe Description=Propel Internet Accelerator Source=Paul Collins Startup list [ProPort Startup] Number=8128 Confirmed=U Filename=ProPort.exe Description=Proport is a port monitor/protector. Monitors an infinite amount of ports for trojans and nukes. Some additional features are auto connection-kill, and IP resolving Source=Paul Collins Startup list [ProSiteFinder] Number=8129 Confirmed=X Filename=prositefinder.exe Description=180Solutions adware related Source=Paul Collins Startup list [Prote��o de tela] Number=8130 Confirmed=X Filename=ssmaze.scr Description=Added by the BANCBAN-FB TROJAN! Source=Paul Collins Startup list [Protect] Number=8131 Confirmed=U Filename=SHVRTF.EXE Description=PC Angel takes a 5-second snapshot of the current system registry each time the PC boots up. In the event of a crash, PC ANGEL will retrieve everything up to the minute before the crash or the last known stable registry Source=Paul Collins Startup list [protect] Number=8132 Confirmed=X Filename=protect.scr Description=Added by the DLOADER-TQ TROJAN! Source=Paul Collins Startup list [Protected Storage] Number=8133 Confirmed=X Filename=RUNDLL32.EXE MSSIGN30.DLL ondll_reg Description=Added by the LOVGATE-W WORM! Source=Paul Collins Startup list [Protection] Number=8134 Confirmed=X Filename=[path] runtask.exe [path] protection.exe Description=Added by a variant of the AGENT.3.AU TROJAN! Source=Paul Collins Startup list [Protection] Number=8135 Confirmed=X Filename=Protection.exe Description=Added by the FEBELNECK-A WORM! Source=Paul Collins Startup list [Protection] Number=8136 Confirmed=X Filename=Firewall.exe Description=Added by the ELIPTER.A or ELIPTER.B WORMS! Source=Paul Collins Startup list [Protection] Number=8137 Confirmed=X Filename=IExplore .exe Description=Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the ".exe" Source=Paul Collins Startup list [Protection] Number=8138 Confirmed=X Filename=Norton Internet Security.exe Description=Added by the ELITPER.E WORM! Source=Paul Collins Startup list [ProtocolDiskChk] Number=8139 Confirmed=X Filename=ssrms.exe Description=Added by the ML TROJAN! Source=Paul Collins Startup list [ProtocolDiskChk] Number=8140 Confirmed=X Filename=svcvlw32.exe Description=Added by the STINX-Y TROJAN! Source=Paul Collins Startup list [ProtocolEventTsk] Number=8141 Confirmed=X Filename=csrwjd.exe Description=Added by STINX-N TROJAN! Source=Paul Collins Startup list [Provan Security] Number=8142 Confirmed=X Filename=psecure.exe Description=Added by the RBOT.BRV WORM! Source=Paul Collins Startup list [proxim_orinoco_11abg] Number=8143 Confirmed=Y Filename=orinoco.exe Description=Proxim ORiNOCO 11a/b/g PCI Card wireless configuration utility Source=Paul Collins Startup list [PROXOMITRON] Number=8144 Confirmed=N Filename=PROXOMITRON.EXE Description=HTML proxy Source=Paul Collins Startup list [PROXOMITRON] Number=8145 Confirmed=N Filename=PROXOM~1.EXE Description=HTML proxy Source=Paul Collins Startup list [ProxyWay] Number=8146 Confirmed=U Filename=proxyway.exe Description=ProxyWay anonymous proxy surfing software Source=Paul Collins Startup list [PRPCMonitor] Number=8147 Confirmed=U Filename=PRPCUI.exe Description=Intel� SpeedStep� interface. This automatically detects whether a mobile PC is using battery or AC power. When using battery power, SpeedStep scales the processor clock frequency and voltage to reduce the power it needs by 40% Source=Paul Collins Startup list [prqtect] Number=8148 Confirmed=X Filename=prqtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prrtect] Number=8149 Confirmed=X Filename=prrtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prstect] Number=8150 Confirmed=X Filename=prstect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prtcct] Number=8151 Confirmed=X Filename=prtcct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prttect] Number=8152 Confirmed=X Filename=prttect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [PrU Async Service] Number=8153 Confirmed=X Filename=[path to worm] Description=Added by the IRCBot-UG WORM! Source=Paul Collins Startup list [prutcct] Number=8154 Confirmed=X Filename=prutcct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutdct] Number=8155 Confirmed=X Filename=prutdct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutgct] Number=8156 Confirmed=X Filename=prutgct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [pruthct] Number=8157 Confirmed=X Filename=pruthct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutict] Number=8158 Confirmed=X Filename=prutict.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutlct] Number=8159 Confirmed=X Filename=prutlct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutpct] Number=8160 Confirmed=X Filename=prutpct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prutsct] Number=8161 Confirmed=X Filename=prutsct.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prvtect] Number=8162 Confirmed=X Filename=prvtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [prxtect] Number=8163 Confirmed=X Filename=prxtect.exe Description=Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications, like Ad-Aware and SpyBot S&D. Note - has been seen using alternative file names like prttect.exe, prmtect.exe and so forth! Source=Paul Collins Startup list [ps1] Number=8164 Confirmed=X Filename=ps1.exe Description=PacerD Media/Pacimedia.com adware Source=Paul Collins Startup list [PS2] Number=8165 Confirmed=U Filename=ps2.exe Description=Multimedia Keyboard companion on HP computers. If this is prevented from starting, then some keyboard functionality will be lost. Source=Paul Collins Startup list [psaload32] Number=8166 Confirmed=X Filename=psaload32.exe Description=Added by the RBOT-ADL WORM! Source=Paul Collins Startup list [PSC main] Number=8167 Confirmed=X Filename=sttool32.exe Description=Added by the OBFUSCATED.EV TROJAN! Source=Paul Collins Startup list [PSCastor] Number=8168 Confirmed=X Filename=PSCastor.exe Description=Added by the PSCastor TROJAN! Source=Paul Collins Startup list [PSCMain] Number=8169 Confirmed=X Filename=pscmain2.exe Description=Added by the OBFUSCATED.EV TROJAN! Source=Paul Collins Startup list [PSD Tools Channel] Number=8170 Confirmed=X Filename=ChannelUp.exe Description=BuddyLinks adware Source=Paul Collins Startup list [PSDrvCheck] Number=8171 Confirmed=Y Filename=PSDrvCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [PService] Number=8172 Confirmed=X Filename=svcnow32.exe Description=Added by the SPYBOT-DJ TROJAN! Source=Paul Collins Startup list [PSFree] Number=8173 Confirmed=U Filename=PSFree.exe Description=Pop-Up Stopper Free from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [PSGuard] Number=8174 Confirmed=X Filename=PSGuard.exe Description=Variant of the SmitFraud alias FAKEALE-C TROJAN! Source=Paul Collins Startup list [PSGuard spyware remover] Number=8175 Confirmed=X Filename=PSGuard.exe Description=Variant of the SmitFraud alias FAKEALE-C TROJAN! Source=Paul Collins Startup list [pshower] Number=8176 Confirmed=X Filename=pshwr.exe Description=SafeSurfing adware variant Source=Paul Collins Startup list [PSIMSVC] Number=8177 Confirmed=Y Filename=PSIMSVC.exe Description=Panda Antivirus Source=Paul Collins Startup list [PSIWin2.3 Connection Server] Number=8178 Confirmed=N Filename=Psconsv.exe Description=Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs Source=Paul Collins Startup list [pskl] Number=8179 Confirmed=U Filename=keyspy.exe Description=KeyboardLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [PSLister] Number=8180 Confirmed=X Filename=PSLister.exe Description=Added by PurityScan C adware Source=Paul Collins Startup list [PsMFCard] Number=8181 Confirmed=U Filename=PsMFCard.exe Description=Component of the Toshiba Controls. Provides power-saving functions for the PCMCIA slots. Through the Power Save Mode Properties dialogue, the user can select from 3 PCMCIA power options - On, Auto1 and Auto2. Disabling this item has no adverse effects, except disabling the ability to reduce power consumption by powering-down the PCMCIA slots when not in use Source=Paul Collins Startup list [PSNotify] Number=8182 Confirmed=Y Filename=psnotify.exe Description=Pharos SignUp Vx - "PC reservation and management application that addresses the PC scheduling needs of public libraries and higher education labs and libraries" Source=Paul Collins Startup list [PSof1] Number=8183 Confirmed=X Filename=PSof1.exe Description=PacerD Media/Pacimedia.com adware installer Source=Paul Collins Startup list [PSoft1] Number=8184 Confirmed=X Filename=psoft1.exe Description=PacerD Media/Pacimedia.com adware installer Source=Paul Collins Startup list [PsPCCard] Number=8185 Confirmed=Y Filename=PsPCCard.EXE Description=Background Power Saving task found on Toshiba laptops and which handles turning Power Saving ON and OFF on any inserted PC Card (PCMCIA card). Only ever disable if you do not use any power saving or hibernation settings (ie: they are all OFF) Source=Paul Collins Startup list [PspContr] Number=8186 Confirmed=U Filename=pspcontr.exe Description=Driver/controller for the Philips SpeechMike 6174. As the Philips FreeSpeech application is no longer supported it can be disabled but the Mike can still be used for certain functions using this driver Source=Paul Collins Startup list [PSQLLauncher] Number=8187 Confirmed=Y Filename=launcher.exe Description=IBM ThinkVantage Fingerprint Software Source=Paul Collins Startup list [PsSound] Number=8188 Confirmed=U Filename=PsSound.exe Description=On a Toshiba laptop. Operates your sound in one of 4 modes, off, on , on only with powerr, same as #3 but longer delay Source=Paul Collins Startup list [pst] Number=8189 Confirmed=U Filename=memaker2.exe Description=SpymodePCSpy surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [PSTORES] Number=8190 Confirmed=? Filename=PSTORES.EXE Description=Part of Windows Services Protected Storage? Source=Paul Collins Startup list [ptfb] Number=8191 Confirmed=N Filename=ptfb.exe Description=Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" Source=Paul Collins Startup list [Ptipbmf] Number=8192 Confirmed=? Filename=rundll32.exe ptipbmf.dll, SetWriteCacheMode Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller Source=Paul Collins Startup list [PtiuPbmd] Number=8193 Confirmed=U Filename=Rundll32.exe ptipbm.dll, SetWriteBack Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Tells the drivers that the connected Drives should use the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller Source=Paul Collins Startup list [PTRGMYGK] Number=8194 Confirmed=X Filename=rundll32.exe ptmg1v.dll, DllRunMain Description=Added by an unidentified TROJAN, WORM or other malware! Source=Paul Collins Startup list [ptrun32] Number=8195 Confirmed=U Filename=ptrun32.exe Description=Parent Tools for AIM Source=Paul Collins Startup list [PTRUN32] Number=8196 Confirmed=U Filename=ptr32w.exe Description=ParentTools surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [Ptsnoop] Number=8197 Confirmed=N Filename=Ptsnoop.exe Description=These descriptions I've come across - all valid as far as I can see :- (1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it (2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see here for more info(3) Apparently the people who put it out claim it's a driver for a Voice modems (don't know who they are though - Ed) Note: If using AOL and you disable this you may lose your connection or lock up (4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'PTSNOOP and the System.ini tab under drivers='path'ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists (5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems (6) Karen Kenworthy's Snooper - "logs the start and stop time of all programs run under Windows" Source=Paul Collins Startup list [pttrun] Number=8198 Confirmed=U Filename=pttrun.exe Description=Transmeta Crusoe processor related. Reduces application launch times and makes the computer "more responsive" Source=Paul Collins Startup list [PtUDFApp] Number=8199 Confirmed=N Filename=PtUDFApp.exe Description=Sony abCD program, included on the CD Xtreme install CD, used to format CD-RWs for packet writing (similar to DirectCD). Available via Start -> Programs. Note that you must add a /T switch to the command line to get it to load to the taskbar Source=Paul Collins Startup list [PUAC v2.0.7] Number=8200 Confirmed=U Filename=Puac.exe Description="Peter's Ultimate Alarm Clock" Source=Paul Collins Startup list [Public Microsoft ODBC] Number=8201 Confirmed=X Filename=ODBC32*.exe [* = random char] Description=Added by the MASLAN.D WORM! Source=Paul Collins Startup list [pumcfgp] Number=8202 Confirmed=U Filename=proxycfg.exe Description="GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser" Source=Paul Collins Startup list [Pure Networks Port Magic] Number=8203 Confirmed=N Filename=PortAOL.exe Description=Pure Networks Port Magic, as available in the latest version of the AOL� 9.0 Optimized SE software; automatically configures most in-home Internet gateways, improving access and performance for applications such as instant messaging, online gaming, and streaming music and video. See here Source=Paul Collins Startup list [Purgative] Number=8204 Confirmed=U Filename=PURGATIVE100.EXE Description=AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack Source=Paul Collins Startup list [Purgatory] Number=8205 Confirmed=X Filename=Purga.exe Description=Added by the PORGORY-B WORM! Source=Paul Collins Startup list [Push Client] Number=8206 Confirmed=N Filename=pull.exe Description=Client software from Interwise that MS use for their webcasts Source=Paul Collins Startup list [Push The Freakin' Button] Number=8207 Confirmed=N Filename=ptfb.exe Description=Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" Source=Paul Collins Startup list [PUSH6599] Number=8208 Confirmed=N Filename=PUSH6599.EXE Description=Scan button monitor for Relysis Episode MF6599 USB scanner as you can start scanning manually via the scanning software Source=Paul Collins Startup list [PutA!!] Number=8209 Confirmed=X Filename=PutA!!.exe Description=Added by the OPASERV.L WORM! Source=Paul Collins Startup list [PutAS!] Number=8210 Confirmed=X Filename=PutA!!.com Description=Added by the OPASERV.Z WORM! Source=Paul Collins Startup list [putil] Number=8211 Confirmed=X Filename=[filename] Description=Added by the LDPINCH TROJAN! Source=Paul Collins Startup list [PV92TRAY] Number=8212 Confirmed=U Filename=PV92Tray.exe Description=PCtel HSP V.92 modem configuration utility Source=Paul Collins Startup list [PVModule] Number=8213 Confirmed=X Filename=pvmodule.exe Description=Adperform.com/adoptim.com adware, file located in a Program Files\PrintView folder and detected by AntiVir antivirus as TR/Dldr.Agent.alb. NOTE: the 'real' PrintView installs in a C:\CBR folder instead! Source=Paul Collins Startup list [PVR] Number=8214 Confirmed=N Filename=PVR.exe Description=Pocket Voice Recorder - freeware sound recorder that records from microphone and any other input line available with your sound card Source=Paul Collins Startup list [PVUnInst1] Number=8215 Confirmed=U Filename=PVUnInst1.exe Description=Privacy View - privacy software that ensures that all your private computer files, photos, documents, and websites remain secure from prying eyes Source=Paul Collins Startup list [Pwr32ctr] Number=8216 Confirmed=X Filename=Pwr32ctr.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Pwr32ctrl] Number=8217 Confirmed=X Filename=Pwr32ctrl.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Pwr32mgt] Number=8218 Confirmed=X Filename=Pwr32mgt.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [PWRESET] Number=8219 Confirmed=U Filename=pwreset.exe Description=Related to the Avaya IP Softphone Source=Paul Collins Startup list [PWRISOVM.EXE] Number=8220 Confirmed=N Filename=PWRISOVM.EXE Description=PowerISO - a powerful CD/DVD image file processing tool Source=Paul Collins Startup list [PWRMGRTR] Number=8221 Confirmed=Y Filename=PWRMGRTR.DLL Description=Power Manager - background monitor module for IBM ThinkPad laptops. Leave it alone to ensure proper power management functions Source=Paul Collins Startup list [Pwrmonit] Number=8222 Confirmed=Y Filename=Rundll32 PwrMonit.dll Description=IBM's proprietary 'battery maximiser' and power monitoring software for laptops Source=Paul Collins Startup list [Pwroff] Number=8223 Confirmed=X Filename=Pwroff.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Pwrsave] Number=8224 Confirmed=U Filename=Pwrsave.exe Description=Toshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power Source=Paul Collins Startup list [Pwruplogin] Number=8225 Confirmed=? Filename=pulogin.exe Description=?? Source=Paul Collins Startup list [PwrupTweakMe] Number=8226 Confirmed=U Filename=PUPXPTWK.EXE Description=Ashampoo's PowerUp XP is a "tool for fine-tuning your Windows NT4, 2000, 2003 Server and XP configuration". Boot-up options won't work if disabled Source=Paul Collins Startup list [PWS Tray] Number=8227 Confirmed=U Filename=PwsTray.exe Description=Microsoft's Personal Web Server, an application which allows PCs to behave as web servers (allows you to test your .asp pages on your own PC without having to load them onto the internet). Available via Start -> Programs Source=Paul Collins Startup list [p_981116] Number=8228 Confirmed=N Filename=p_981116.exe Description=Win32 cabinet self extractor. More info here Source=Paul Collins Startup list [Q152404] Number=8229 Confirmed=N Filename=wsript.exe Q152404.VBS Description=Appears to run Scandisk at bootup on NEC PCs Source=Paul Collins Startup list [q36i36O] Number=8230 Confirmed=X Filename=lms2cenu.exe Description=Added by the SECONDTHOUGHT VIRUS! Source=Paul Collins Startup list [QAGENT] Number=8231 Confirmed=N Filename=qagent.exe Description=Quicken program is controlled by a separate utility program called the Quicken Download Manager (also known as Qagent). When Quicken Download Manager option is enabled, background downloading takes advantage of unused bandwidth to download current financial information anytime your computer is connected to the Internet Source=Paul Collins Startup list [qappsrvc32.exe] Number=8232 Confirmed=X Filename=qappsrvc32.exe Description=Recognized by Kaspersky antivirus as Trojan-Proxy.Win32.Webber.m Source=Paul Collins Startup list [QBCD autorun] Number=8233 Confirmed=N Filename=autorun.exe Description=Quick Books CD Source=Paul Collins Startup list [qbkupdbs] Number=8234 Confirmed=X Filename=mqbkup.exe Description=Added by the OPASERV.K WORM! Source=Paul Collins Startup list [qbotd] Number=8235 Confirmed=X Filename=[random filename] Description=Added by the BOTTEN TROJAN! Source=Paul Collins Startup list [qBrowse] Number=8236 Confirmed=? Filename=qbrowse.exe Description=?? Source=Paul Collins Startup list [QBRSR] Number=8237 Confirmed=X Filename=QuickBrowser.exe Description=top-banners.com adware Source=Paul Collins Startup list [Qchex Tray Icon] Number=8238 Confirmed=U Filename=Qchex.exe Description=Related to G7 Productivity Systems Check Software Source=Paul Collins Startup list [QCTRAY] Number=8239 Confirmed=U Filename=Qctray.exe Description=System Tray icon providing access to the "IBM Access Connections" wizard on ThinkPad laptops and also allows to change the network environment. Not the same as QCWLIcon, which is pertinent only to the Wireless LAN Source=Paul Collins Startup list [QCWLICON] Number=8240 Confirmed=U Filename=Qcwlicon.exe Description=Used by IBM Thinkpad laptops with built-in wireless card (802.11). System Tray icon that provides a shortcut to "Wireless Connection Status" and allows to turn WL on and off Source=Paul Collins Startup list [QD FastAndSafe] Number=8241 Confirmed=N Filename=QDCSFS.exe Description=Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually Source=Paul Collins Startup list [QDM] Number=8242 Confirmed=U Filename=QdmStart.exe Description=QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU, temperatures, BIOS information, etc. Only required if you overclock system components and need to monitor temperatures, etc Source=Paul Collins Startup list [QDMStart] Number=8243 Confirmed=U Filename=QdmStart.exe Description=QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU, temperatures, BIOS information, etc. Only required if you overclock system components and need to monitor temperatures, etc Source=Paul Collins Startup list [Qdsafe] Number=8244 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Qexplo] Number=8245 Confirmed=? Filename=Qexplo.exe Description=?? Source=Paul Collins Startup list [qgqqft] Number=8246 Confirmed=X Filename=[path to Trojan] Description=Added by the RANKY.T TROJAN! Source=Paul Collins Startup list [QH Live Update Scheduler] Number=8247 Confirmed=Y Filename=UPSCHD.EXE Description=Quick Heal Anti-Virus Source=Paul Collins Startup list [QH Office 2K Check] Number=8248 Confirmed=Y Filename=O2KCHECK.EXE Description=Quick Heal Anti-Virus MS Office documents virus checker Source=Paul Collins Startup list [QlbCtrl] Number=8249 Confirmed=U Filename=QlbCtrl.exe Description=HP Quick Launch Buttons control center on their laptops Source=Paul Collins Startup list [QMusic] Number=8250 Confirmed=? Filename=QMAgent.exe Description=?? Source=Paul Collins Startup list [QNPlus] Number=8251 Confirmed=N Filename=QNPlus.exe Description=Quick Notes Plus by Conceptworld - sticky notes tool Source=Paul Collins Startup list [Qoeloader] Number=8252 Confirmed=U Filename=Qoeloader.exe Description=Qurb 2.0 anti-spam tool for Outlook/Outlook Express. Required when supporting OE but not for Outlook. Shortcut available via Start -> Programs Source=Paul Collins Startup list [QPService] Number=8253 Confirmed=U Filename=QPService.exe Description=HP QuickPlay - "brings your favorite music and movies to life with the touch of a button" Source=Paul Collins Startup list [QQ] Number=8254 Confirmed=X Filename=sendmess.exe Description=Added by the SEMES TROJAN! Source=Paul Collins Startup list [QQ.exe] Number=8255 Confirmed=X Filename=QQ.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the Tencent QQ Asian instant messanger program and resides in the Windows folder Source=Paul Collins Startup list [QQKAV] Number=8256 Confirmed=X Filename=scvhsot.exe Description=Added by the QQROB.ARQ WORM! Source=Paul Collins Startup list [QQServer] Number=8257 Confirmed=X Filename=QQ.exe Description=Added by the DOWNLDR-AN TROJAN! Source=Paul Collins Startup list [qservices] Number=8258 Confirmed=X Filename=qservice.exe Description=Added by the PROGENT-A TROJAN! Source=Paul Collins Startup list [QSort2000] Number=8259 Confirmed=N Filename=QSORT.EXE Description=Utility that sorts your Start menu and Favourites in alphanumerical order. Not required - at any time you can right-click on these lists and choose "Sort by Name" Source=Paul Collins Startup list [QT4HPOT] Number=8260 Confirmed=U Filename=OneTouch.exe Description=Hewlett Packard One Touch keyboard driver. Required if you use the additional keys Source=Paul Collins Startup list [QTaskStartup] Number=8261 Confirmed=U Filename=qtask.exe Description=Feature of Quicken.com Brokerage to customize and display Desktop Alerts and icon. It is not required for the Quicken Program to run correctly, it is only required for the Desktop Alerts feature Source=Paul Collins Startup list [QTime] Number=8262 Confirmed=X Filename=nrchk.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [QTSTUB.EXE] Number=8263 Confirmed=N Filename=Qtstub.exe Description=Part of an old version of the Quick Tax application. It enables Quick Tax Calendar Popup to show tax calendar reminders Source=Paul Collins Startup list [QTSvc] Number=8264 Confirmed=X Filename=msocfg.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [QTSvc] Number=8265 Confirmed=X Filename=navchk.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [QTSvc] Number=8266 Confirmed=X Filename=shman.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [QTSvc] Number=8267 Confirmed=X Filename=ssvr.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [qttask] Number=8268 Confirmed=N Filename=Qttask.exe Description=System Tray access to Apple's "Quick Time" viewer from version 5 onwards Source=Paul Collins Startup list [QtVprMtx] Number=8269 Confirmed=U Filename=QTVPRMTX.EXE Description=Multimedia keyboard driver from Dritek System Inc Source=Paul Collins Startup list [Quantifier Security] Number=8270 Confirmed=X Filename=qsecue.exe Description=Added by the SPYBOT.UOL WORM! Source=Paul Collins Startup list [QUBCity] Number=8271 Confirmed=? Filename=qtp.exe Description=?? Source=Paul Collins Startup list [Queensla] Number=8272 Confirmed=? Filename=Queensla.exe Description=?? Source=Paul Collins Startup list [Quick Controls] Number=8273 Confirmed=U Filename=Astrotoolbar.exe Description=Gateway Astro Screen and Sound Controls tray icon Source=Paul Collins Startup list [Quick Heal Firewall Pro] Number=8274 Confirmed=U Filename=qhfw.exe Description=Quick Heal Firewall Pro Source=Paul Collins Startup list [Quick Heal Messenger] Number=8275 Confirmed=U Filename=QHM32.EXE Description=Quick Heal Anti-Virus Messenger - keeps you informed about the latest threats, hoaxes etc Source=Paul Collins Startup list [Quick Heal On-Line Protection] Number=8276 Confirmed=Y Filename=Cateye.exe Description=Quick Heal - virus scanner Source=Paul Collins Startup list [Quick Heal Startup Scan] Number=8277 Confirmed=Y Filename=QHSTRT32.EXE Description=Quick Heal - virus scanner Source=Paul Collins Startup list [Quick Shelf xx] Number=8278 Confirmed=N Filename=qushelfxx.exe Description=Places an icon in the system tray for launching MS Bookshelf. Available via Start -> Programs"xx" represents the version number - ie, 98, 99 Source=Paul Collins Startup list [Quick Startup] Number=8279 Confirmed=Y Filename=Fquick32.exe Description=For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone Source=Paul Collins Startup list [Quick Time Task] Number=8280 Confirmed=N Filename=qttask.exe Description=System Tray access to Apple's "Quick Time" viewer from version 5 onwards Source=Paul Collins Startup list [Quick View Plus] Number=8281 Confirmed=N Filename=QVP32.EXE Description=Quick View Plus from Inso Corporation. Multiple file type viewer. Available via Start -> Programs Source=Paul Collins Startup list [QuickBooks Delivery Agent] Number=8282 Confirmed=N Filename=QBDAGENT.EXE Description=As far QAGENT but for QuickBooks. Can also have the version number in the name Source=Paul Collins Startup list [Quickbooks Update Agent] Number=8283 Confirmed=N Filename=qbupdate.exe Description=Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not Source=Paul Collins Startup list [QuickCamPro] Number=8284 Confirmed=U Filename=QuickCamPro.exe Description=System Tray for Picture Capture utility that can run unattended. Pictures every 30 seconds for example, auto FTP Upload, etc Source=Paul Collins Startup list [quicken] Number=8285 Confirmed=X Filename=quicken.exe Description=CoolWebSearch Therealsearch parasite variant Source=Paul Collins Startup list [quicken] Number=8286 Confirmed=X Filename=Winrar.exe Description=CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR! Source=Paul Collins Startup list [quicken] Number=8287 Confirmed=X Filename=Waol.exe Description=CoolWebSearch Therealsearch parasite variant Source=Paul Collins Startup list [Quicken Scheduled Updates] Number=8288 Confirmed=N Filename=bagent.exe Description=Quicken background downloading module Source=Paul Collins Startup list [Quicken Startup] Number=8289 Confirmed=N Filename=QWDLLS.EXE Description=Quicken option to load DLLs at startup Source=Paul Collins Startup list [QuickenSEMessage] Number=8290 Confirmed=N Filename=Qsemsg.exe Description=Quicken option Source=Paul Collins Startup list [QuickFinder Scheduler] Number=8291 Confirmed=N Filename=QFSCHD100.exe Description=Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products) Source=Paul Collins Startup list [QuickFinder Scheduler] Number=8292 Confirmed=N Filename=QFSched.exe Description=Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products) Source=Paul Collins Startup list [QuickLaunchEr] Number=8293 Confirmed=Y Filename=QuickLaunchEr.Exe Description=QuickLaunchEr - allows you to quickly launch programs from an icon in the system tray Source=Paul Collins Startup list [Quicklink III] Number=8294 Confirmed=N Filename=QL.EXE Description=HP fax program and only needs to be in the start-up group if you allow your phone to automatically answer your phone in fax mode, that is, to receive faxes after a certain number of rings. Available via Start -> Programs Source=Paul Collins Startup list [Quicknote] Number=8295 Confirmed=N Filename=quicknote.exe Description=JC&MB Quicknote Virtual Scrapbook Source=Paul Collins Startup list [QuickPassword] Number=8296 Confirmed=U Filename=agquickp.exe Description=Smart card-based authentication and digital signature client software Source=Paul Collins Startup list [QuickRes] Number=8297 Confirmed=N Filename=QUICKRES.EXE Description=Utility to quickly change desktop resolution - left over from Win95 Power Toys. In Win98 and above incorporated via Control Panel -> Display. Not required unless you have to change resolutions on a regular basis Source=Paul Collins Startup list [quickset] Number=8298 Confirmed=N Filename=quickset.exe Description=Dell taskbar icon allowing you to quickly change settings Source=Paul Collins Startup list [Quicktime] Number=8299 Confirmed=X Filename=qttasks.exe Description=Added by the ADCLICK-AK TROJAN! Source=Paul Collins Startup list [Quicktime] Number=8300 Confirmed=X Filename=shch.exe Description=Added by a variant of the EB TROJAN! Source=Paul Collins Startup list [Quicktime Mediaplayer] Number=8301 Confirmed=X Filename=winmplyer32.exe Description=Added by the RBOT-PM WORM! Source=Paul Collins Startup list [Quicktime Mediaplayr] Number=8302 Confirmed=X Filename=wnmplyr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Quicktime Pro 3.0] Number=8303 Confirmed=X Filename=winuodps.exe Description=Added by the GAOBOT.BH WORM! Source=Paul Collins Startup list [QuickTime Task] Number=8304 Confirmed=N Filename=Qttask.exe Description=System Tray access to Apple's "Quick Time" viewer from version 5 onwards Source=Paul Collins Startup list [QuickTime Task] Number=8305 Confirmed=X Filename=qttasks.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Quicktime Task] Number=8306 Confirmed=X Filename=[random filename] Description=Trafficadvance dialer Source=Paul Collins Startup list [QuickTime Update Completion x] Number=8307 Confirmed=N Filename=quicktimeupdatehelper.exe Description=Different numbers caused by number of launches. So if 3 updates are made separately, 3 would appear (in theory) Source=Paul Collins Startup list [QuicktimeMngr] Number=8308 Confirmed=X Filename=QUICKTIMEMNGR.EXE Description=Added by the WOOTBOT.AW WORM! Source=Paul Collins Startup list [QuickTimeUpdate] Number=8309 Confirmed=X Filename=QuickUpdate.exe Description=Added by the BIFROSE-CW TROJAN! Source=Paul Collins Startup list [Quicktlme] Number=8310 Confirmed=X Filename=ru.exe Description=Adult content dialler Source=Paul Collins Startup list [QuickTV] Number=8311 Confirmed=U Filename=QuickTV.exe Description=Infra-red remote control driver for the AVerTV Studio TV tuner/personal video recoder from AVerMedia. Required if you use the remote control Source=Paul Collins Startup list [Quickzip] Number=8312 Confirmed=X Filename=Ls.exe Description=MsConnect browser hijacker and dialler Source=Paul Collins Startup list [QuickZip] Number=8313 Confirmed=X Filename=lu.exe Description=MsConnect browser hijacker and dialler Source=Paul Collins Startup list [QuikShield] Number=8314 Confirmed=N Filename=qkshield.exe Description=QuikShield popup blocker - reportedly stealth installed, see here Source=Paul Collins Startup list [QuikSync] Number=8315 Confirmed=N Filename=QUIKSYNC.EXE Description=Used by Iomega drives. Available via Start -> Programs Source=Paul Collins Startup list [qwe] Number=8316 Confirmed=X Filename=qwe.exe Description=Added by the LINEAGE-F TROJAN! Source=Paul Collins Startup list [QWERTY] Number=8317 Confirmed=? Filename=qwerty.exe Description=Possibly adult content related adware Source=Paul Collins Startup list [qwertybot.exe] Number=8318 Confirmed=X Filename=qwertybot.exe Description=Added by the AGENT.ALF TROJAN! Source=Paul Collins Startup list [QWS3270 Sessions] Number=8319 Confirmed=U Filename=sessions.exe Description=QWS3270 Secure terminal emulation software Source=Paul Collins Startup list [R] Number=8320 Confirmed=X Filename=[path] rundll32.exe msprt.dll Description=Chinese originated browser hijacker - redirecting to 4199.com Source=Paul Collins Startup list [RA Server] Number=8321 Confirmed=X Filename=Slave.exe Description=Added by the RA TROJAN! Source=Paul Collins Startup list [RabbitWannaHome] Number=8322 Confirmed=X Filename=rabbit.exe Description=Added by the MIMAIL.S WORM! Source=Paul Collins Startup list [Rabo Session Monitor] Number=8323 Confirmed=Y Filename=RaboSessionMon.exe Description=Related to RaboBank electronic banking software Source=Paul Collins Startup list [RaConfig2500] Number=8324 Confirmed=N Filename=RaConfig2500.exe Description=RaLink wireless LAN configuration utility Source=Paul Collins Startup list [RadarSync] Number=8325 Confirmed=N Filename=RadarSync.exe Description=Radarsync utility comes from DFI with their latest motherboards, e.g., DFI LanParty Ultra - checks for BIOS and driver updates periodically Source=Paul Collins Startup list [RadBoot] Number=8326 Confirmed=U Filename=RadBoot.exe Description=RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings Source=Paul Collins Startup list [Radio365Agent] Number=8327 Confirmed=U Filename=Radio365TrayAgent.exe Description=Radio365 - create playlists and broadcast live straight from your PC! Source=Paul Collins Startup list [RadioSvr] Number=8328 Confirmed=U Filename=RadioSvr.EXE Description=Used to configure wire less networks. Windows automatically detects the Wireless network and it configures the network Source=Paul Collins Startup list [RAID Event Monitor] Number=8329 Confirmed=U Filename=iaanotif.exe Description=IAA Event Monitor User Notification Tool - part of Intel� Application Accelerator - "a performance software package for desktop PCs using select Intel� chipsets" that "replaces the ATA drivers that come with Windows with drivers optimized for desktop and mobile PCs." If you use the RAID version it's required to notify you if a RAID 1 disk has failed Source=Paul Collins Startup list [RaidTool] Number=8330 Confirmed=U Filename=raid_tool.exe Description=VIA V-RAID Tool - hard disk striping/mirroring utility for increased performance and reliability Source=Paul Collins Startup list [Rainlendar] Number=8331 Confirmed=U Filename=Rainlendar.exe Description=Rainlendar is a customizable calendar that displays the current month Source=Paul Collins Startup list [Rainlendar2] Number=8332 Confirmed=U Filename=Rainlendar2.exe Description=Rainlendar is a customizable calendar that displays the current month Source=Paul Collins Startup list [RAM Idle Professional] Number=8333 Confirmed=U Filename=RAM_XP.exe Description=RAM Idle LE - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other applications. In addition, RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows." MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [RAMASST] Number=8334 Confirmed=U Filename=RAMASST.exe Description=Optionally installed with some DVD drives (LG, Panasonic, etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. It does not affect your ability to burn CDs. If you do not have this program running, you may have some compatibility issues with burnt DVDs Source=Paul Collins Startup list [RamBooster2] Number=8335 Confirmed=X Filename=rb.exe Description=Added by the AKAK TROJAN! Source=Paul Collins Startup list [RAMDef] Number=8336 Confirmed=U Filename=ramdef.exe Description=Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [RAMDrive] Number=8337 Confirmed=U Filename=RDTask.exe Description=Virtual Hard Drive (Ram Drive) from Farstone - takes a portion of your system memory (RAM) and uses it to simulate a hard disk drive Source=Paul Collins Startup list [RamIdle] Number=8338 Confirmed=U Filename=ramidle.exe Description=RAM Idle LE - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other applications. In addition, RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows." MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [RAMpage] Number=8339 Confirmed=U Filename=RAMpage.exe Description=Small Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray icon, or by setting a threshold that activates the program automatically, or by having it run automatically when an application exits. RAMpage is free, and open source Source=Paul Collins Startup list [Randex virus built for IRBMe] Number=8340 Confirmed=X Filename=irbme.exe Description=Added by the RANDEX.RH WORM! Source=Paul Collins Startup list [random] Number=8341 Confirmed=X Filename=random.exe Description=Added by the DLOADER-KM TROJAN! Source=Paul Collins Startup list [Random Interface Network] Number=8342 Confirmed=X Filename=rst.exe Description=Added by the DELBOT-P WORM! Source=Paul Collins Startup list [Random Interface Network Manager] Number=8343 Confirmed=X Filename=rinsv.exe Description=Added by the DELBOT-L WORM! Source=Paul Collins Startup list [Random Unique ID] Number=8344 Confirmed=X Filename=[worm filename] Description=Added by the XROVE-A WORM! Source=Paul Collins Startup list [RandomWin32] Number=8345 Confirmed=X Filename=mgnwin32.exe Description=Added by the SDBOT-DV WORM! Source=Paul Collins Startup list [rant] Number=8346 Confirmed=Y Filename=rant.exe Description=Added by the RBOT-ZB WORM! Source=Paul Collins Startup list [RapApp] Number=8347 Confirmed=Y Filename=RAPAPP.EXE Description=Application protection component of BlackICE PC Protection (was Defender) firewall, informing you of any modifications to programs, files or folders and detecting unknown programs trying to launch Source=Paul Collins Startup list [Rapdata] Number=8348 Confirmed=X Filename=ravsecs.exe Description=Added by the QQPASS-V TROJAN! Source=Paul Collins Startup list [Rapdatae] Number=8349 Confirmed=X Filename=rabseuser.exe Description=Added by the QQPASS-S TROJAN! Source=Paul Collins Startup list [Rapdatybs] Number=8350 Confirmed=X Filename=ravseteyns.exe Description=Added by the PWS-ACP TROJAN! Source=Paul Collins Startup list [Rapid Restore] Number=8351 Confirmed=U Filename=rrpcsb.exe Description=XPoint "Rapid Restore PC" - a "Managed Recovery� solution that enables IT Administrators to protect the corporate image, while offloading personal data backup and recovery chores to the end user" Source=Paul Collins Startup list [RapidBlaster] Number=8352 Confirmed=X Filename=rb32.exe Description=RapidBlaster parasite. Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Raptelnet] Number=8353 Confirmed=X Filename=ravspeger.exe Description=Added by the QQPASS-AA TROJAN! Source=Paul Collins Startup list [Raptelt] Number=8354 Confirmed=X Filename=ravspegtl.exe Description=Added by the QQPASS-AB TROJAN! Source=Paul Collins Startup list [Raptor Mobile] Number=8355 Confirmed=Y Filename=vpnservices.exe Description=Symantec VPN Client used to connect to corporate networks. If unchecked, must be uninstalled using Add/Remove Programs as it tightly integrates into networking Source=Paul Collins Startup list [RasCon Remote Access Service Manager] Number=8356 Confirmed=X Filename=rasmngr.exe Description=Added by the SPYBOT.EM WORM! Source=Paul Collins Startup list [rasctrs] Number=8357 Confirmed=X Filename=rasctrs.exe Description=Hijacker, also detected as the ADWAHECK TROJAN! Source=Paul Collins Startup list [Rase] Number=8358 Confirmed=X Filename=boln.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [rasman] Number=8359 Confirmed=X Filename=rasman32.exe Description=Added by the BCKDR-QGN TROJAN! Source=Paul Collins Startup list [RasMan.exe] Number=8360 Confirmed=X Filename=RasMan.exe Description=Added by the FEUTEL-H TROJAN! Source=Paul Collins Startup list [rate.exe] Number=8361 Confirmed=X Filename=i11r54n4.exe Description=Added by the BEAGLE.E WORM and variants! Source=Paul Collins Startup list [rate.exe] Number=8362 Confirmed=X Filename=********.exe [* = random char] Description=Unidentified adware Source=Paul Collins Startup list [RAV8Tray] Number=8363 Confirmed=Y Filename=ravtray8.exe Description=RAV anti-virus related Source=Paul Collins Startup list [RavAv] Number=8364 Confirmed=X Filename=RavMon.exe Description=Added by the BDOOR-DIJ TROJAN! Note - this file is located in the %WinDir% directory, and must NOT be confused with the legitimate RAV antivirus file of the same name! Source=Paul Collins Startup list [RavAv] Number=8365 Confirmed=X Filename=RavMonE.exe Description=Added by the RJUMPF-F WORM! Source=Paul Collins Startup list [RavAv] Number=8366 Confirmed=X Filename=AdobeR.exe Description=Added by the RJUMP.D WORM! Source=Paul Collins Startup list [RAVEN_VLZS.EXE] Number=8367 Confirmed=X Filename=RAVEN_VLZS.EXE Description=DownloadReceiver parasite - no longer in existence Source=Paul Collins Startup list [RavMon] Number=8368 Confirmed=Y Filename=RavMon.exe Description=RAV AntiVirus Source=Paul Collins Startup list [ravshell] Number=8369 Confirmed=X Filename=expl0rer.exe Description=Added by the DLOADER.MAR TROJAN! Source=Paul Collins Startup list [Ravshell] Number=8370 Confirmed=X Filename=explore3.exe Description=Added by the PAKES.HZ TROJAN! Source=Paul Collins Startup list [Ravshell] Number=8371 Confirmed=X Filename=IEXPLORER.EXE Description=Added by the AGENT.URZ TROJAN! Source=Paul Collins Startup list [Ravshell] Number=8372 Confirmed=X Filename=rund1132.exe Description=Added by the AGENT.OKZ TROJAN! Source=Paul Collins Startup list [Ravshell] Number=8373 Confirmed=X Filename=svch0st.exe Description=Added by the NSPM.PU TROJAN! Source=Paul Collins Startup list [ravtask] Number=8374 Confirmed=X Filename=rund1132.exe Description=Added by the DLOADER.IYT TROJAN! Source=Paul Collins Startup list [ravtask] Number=8375 Confirmed=X Filename=svch0st.exe Description=Added by the LINEAG-AIN TROJAN! Source=Paul Collins Startup list [RavTime] Number=8376 Confirmed=X Filename=Mstray.exe Description=Added by the WUKILL.A WORM! Source=Paul Collins Startup list [RavTimer] Number=8377 Confirmed=X Filename=RavTimer.exe Description=RAV AntiVirus Source=Paul Collins Startup list [RavTimer] Number=8378 Confirmed=X Filename=explores.exe Description=Added by the HOMEY-A TROJAN! Source=Paul Collins Startup list [RavTimeXP] Number=8379 Confirmed=X Filename=[worm filename] Description=Added by the WULLIK.B WORM! Source=Paul Collins Startup list [RavTimeXP] Number=8380 Confirmed=X Filename=Virus Description=Added by the CAGER.A WORM! Source=Paul Collins Startup list [RavTimXP] Number=8381 Confirmed=X Filename=[worm filename] Description=Added by the WULLIK.B WORM! Source=Paul Collins Startup list [RavUptets] Number=8382 Confirmed=X Filename=agetlke.exe Description=Added by the QQPASS-AK TROJAN! Source=Paul Collins Startup list [RavUptkt] Number=8383 Confirmed=X Filename=agetlktz.exe Description=Added by the QQPASS-AJ TROJAN! Source=Paul Collins Startup list [RavUptpe] Number=8384 Confirmed=X Filename=ravsesur.exe Description=Added by the QQPASS-T TROJAN! Source=Paul Collins Startup list [rav_temp.exe] Number=8385 Confirmed=? Filename=rav_temp.exe Description=?? Source=Paul Collins Startup list [RAX SYSTEM] Number=8386 Confirmed=X Filename=scrigz.exe Description=Added by the MYTOB.KR WORM! Source=Paul Collins Startup list [Ray Process Killer] Number=8387 Confirmed=N Filename=Prkill.exe Description=Ray Process Killer - clicking right mouse button produces popup menu with current active tasks. You can choose any task and click "Ok" to terminate it. Use CTRL+ALT+DEL instead Source=Paul Collins Startup list [razer] Number=8388 Confirmed=U Filename=razerhid.exe Description=Razer mouse driver Source=Paul Collins Startup list [rb32 lptt01] Number=8389 Confirmed=X Filename=rb32.exe Description=RapidBlaster variant (in a "RapidBlaster" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [rb32 ml097e] Number=8390 Confirmed=X Filename=rb32.exe Description=RapidBlaster variant (in a "RapidBlaster" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [rbenh ml***e] Number=8391 Confirmed=X Filename=rbenh.exe Description=RapidBlaster variant (in a "RBEnhance" folder in Program Files) where *** represents random digits. Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [RBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Server] Number=8392 Confirmed=X Filename=glossary.exe Description=Added by the VANEBOT-J WORM! Source=Paul Collins Startup list [Rcf Driver] Number=8393 Confirmed=X Filename=rcf.exe Description=Added by the RANDEX.BLD WORM! Source=Paul Collins Startup list [rCron] Number=8394 Confirmed=X Filename=rcron.exe Description="Switch" adult content dialler Source=Paul Collins Startup list [rCron] Number=8395 Confirmed=X Filename=dservice.exe Description=Switch premium rate adult content dialer Source=Paul Collins Startup list [RCScheduleCheck] Number=8396 Confirmed=U Filename=RCSCHED.EXE Description=Scheduler for VCOM's Recovery Commander - which "can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running" Source=Paul Collins Startup list [RCSync] Number=8397 Confirmed=X Filename=RCSync.exe Description=PrizeSurfer related. "PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware Source=Paul Collins Startup list [RCSystem] Number=8398 Confirmed=U Filename=DLLML.exe RCSystem Description=Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [RDClient] Number=8399 Confirmed=U Filename=RDCLIENT.EXE Description=Remote Disconnection Utility from Twiga. Used for connecting and disconnecting dial up connections on a network - only needed if there is a shared internet connection Source=Paul Collins Startup list [RDLL] Number=8400 Confirmed=X Filename=RunDll16.exe Description=Added by the SDBOT.F TROJAN! Source=Paul Collins Startup list [rdvs] Number=8401 Confirmed=X Filename=[worm filename] Description=Added by the ULTIMAX WORM! Source=Paul Collins Startup list [Reactor3] Number=8402 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.A WORM! Source=Paul Collins Startup list [Reactor5] Number=8403 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.D WORM! Source=Paul Collins Startup list [Reactor6] Number=8404 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.C WORM! Source=Paul Collins Startup list [Reactor7] Number=8405 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.B WORM! Source=Paul Collins Startup list [Reactor8] Number=8406 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.E WORM! Source=Paul Collins Startup list [Reactor9] Number=8407 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.E WORM! Source=Paul Collins Startup list [readdb40] Number=8408 Confirmed=X Filename=rundll32.exe [path] readdb40.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [REAL] Number=8409 Confirmed=N Filename=realjbox.exe Description=Real Jukebox - MP3 and music files player Source=Paul Collins Startup list [Real Internet Player] Number=8410 Confirmed=X Filename=Reaiplay.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Real player updater] Number=8411 Confirmed=X Filename=realupd.exe Description=Added by the PARLAY TROJAN! Source=Paul Collins Startup list [real scheduler.hta] Number=8412 Confirmed=X Filename=RealAudio.exe Description=Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player Source=Paul Collins Startup list [Real Spy Monitor] Number=8413 Confirmed=U Filename=Winrsm.exe Description=Realspy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Real Statics Agent] Number=8414 Confirmed=X Filename=ccreal.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Real-Tens] Number=8415 Confirmed=X Filename=Real-Tens.exe Description=DownloadWare adware Source=Paul Collins Startup list [RealAudio] Number=8416 Confirmed=X Filename=RealAudio.exe Description=Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player Source=Paul Collins Startup list [Realaudio Player] Number=8417 Confirmed=X Filename=realaudio32.exe Description=Added by the AGOBOT.AFR WORM! Source=Paul Collins Startup list [RealDownload] Number=8418 Confirmed=N Filename=RealPlay.exe Description=Download manager. Available via Start -> Programs Source=Paul Collins Startup list [RealDownload Express] Number=8419 Confirmed=X Filename=npnzdad.exe Description=Advertising spyware Source=Paul Collins Startup list [Reality Fusion GameCam SE] Number=8420 Confirmed=N Filename=RFTRay.exe Description=Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs Source=Paul Collins Startup list [RealJukeboxSystray] Number=8421 Confirmed=N Filename=tsystray.exe Description=System Tray icon for RealJukebox Source=Paul Collins Startup list [realone_nt2003] Number=8422 Confirmed=X Filename=moniker.exe Description=Added by the SNONE.A WORM! Source=Paul Collins Startup list [RealP1ayer] Number=8423 Confirmed=X Filename=[path to file] Description=Added by the RPLAY.A TROJAN! Note that the name has a number "1" in place of the second lower case "L" Source=Paul Collins Startup list [realplay] Number=8424 Confirmed=N Filename=realplay.exe Description=System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences Source=Paul Collins Startup list [realplay lptt01] Number=8425 Confirmed=X Filename=realplay.exe Description=RapidBlaster variant (in a "RealPlay" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name Source=Paul Collins Startup list [realplay ml097e] Number=8426 Confirmed=X Filename=realplay.exe Description=RapidBlaster variant (in a "RealPlay" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name Source=Paul Collins Startup list [RealPlayer Ath Check] Number=8427 Confirmed=X Filename=rnathchk.exe Description=Added by the MYTOB.AG WORM! Source=Paul Collins Startup list [Realplayer Codec Support] Number=8428 Confirmed=X Filename=realsched.exe Description=Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Source=Paul Collins Startup list [Realplayer One] Number=8429 Confirmed=X Filename=realplay.exe Description=Added by the RBOT-NK WORM! Source=Paul Collins Startup list [Realplayer.exe] Number=8430 Confirmed=X Filename=Realplayer.exe Description=Added by the DELF.CNV TROJAN! Source=Paul Collins Startup list [RealPlayer2] Number=8431 Confirmed=N Filename=MsgCenterExe Description=RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way Source=Paul Collins Startup list [RealPlayerUpdater] Number=8432 Confirmed=X Filename=realupd32.exe Description=Added by the LOHAV-T TROJAN! Source=Paul Collins Startup list [Realpopup] Number=8433 Confirmed=? Filename=Realpopup.exe Description=RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor" Source=Paul Collins Startup list [Realsched] Number=8434 Confirmed=N Filename=realsched.exe Description=Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry Source=Paul Collins Startup list [RealSPEED] Number=8435 Confirmed=U Filename=RealSPEED.Exe Description=RealSPEED - tweaking utility to speed-up your internet connection Source=Paul Collins Startup list [Realtime Audio Engine] Number=8436 Confirmed=U Filename=mmrtkrnl.exe Description=Associated with ALCATech BPM Studio Source=Paul Collins Startup list [Realtime Monitor] Number=8437 Confirmed=Y Filename=realmon.exe Description=Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates Source=Paul Collins Startup list [RealTimeUpdate] Number=8438 Confirmed=? Filename=RealTimeUpdate.exe Description=Product description in properties is "InternetExplorerCommunicationAgent Module" ? Source=Paul Collins Startup list [realtpsk] Number=8439 Confirmed=X Filename=realsched.exe Description=Chinese originated adware - detected by Panda antivirus as NewWeb. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Source=Paul Collins Startup list [RealTray] Number=8440 Confirmed=N Filename=RealPlay.exe Description=System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences Source=Paul Collins Startup list [RealUpdater] Number=8441 Confirmed=X Filename=realupd.exe Description=Added by the PARLAY or MITGLIEDER.I TROJANS! Source=Paul Collins Startup list [RebateNation0] Number=8442 Confirmed=X Filename=RebateNation0.exe Description=RebateNation adware Source=Paul Collins Startup list [Reboot] Number=8443 Confirmed=N Filename=Reboot.exe Description=MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards Source=Paul Collins Startup list [Recguard] Number=8444 Confirmed=Y Filename=recguard.exe Description=On HP computers, Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled, it is possible to knock that completely out and force the customer to send the PC back to HP for a re-image, possibly at the customer's expense Source=Paul Collins Startup list [Reclip] Number=8445 Confirmed=N Filename=reclip.exe Description=Reclip Popup Clipboard manager Source=Paul Collins Startup list [Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B}] Number=8446 Confirmed=X Filename=RH.DLL Description=SmartPops search hijacker Source=Paul Collins Startup list [Recover] Number=8447 Confirmed=N Filename=N/A Description=Added during the installation of Comcast High Speed Internet software. During installation the system reboots and if the disk is removed a screen appears asking for the disk to be re-inserted to complete installation. Not required once installion is complete Source=Paul Collins Startup list [recover.bmp.exe] Number=8448 Confirmed=X Filename=Rundll.exe Description=Added by the ANAFTP-01 TROJAN! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [RecoverFromReboo] Number=8449 Confirmed=N Filename=RECOVE~1.EXE Description=Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry Source=Paul Collins Startup list [RecoverFromReboo] Number=8450 Confirmed=N Filename=RecoverFromReboot.exe Description=Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry Source=Paul Collins Startup list [RecoverFromReboot] Number=8451 Confirmed=N Filename=RECOVE~1.EXE Description=Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry Source=Paul Collins Startup list [RecoverFromReboot] Number=8452 Confirmed=N Filename=RecoverFromReboot.exe Description=Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched, this entry may be left in the registry Source=Paul Collins Startup list [Recoveru system] Number=8453 Confirmed=X Filename=svchast.exe Description=Added by a variant of the LINEAGE-AV TROJAN! Source=Paul Collins Startup list [Recoveru systems] Number=8454 Confirmed=X Filename=svchost.exe Description=Added by a variant of the SDBOT WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! ! This file is located in the "temp" folder Source=Paul Collins Startup list [RecShe] Number=8455 Confirmed=N Filename=RecSche.exe Description=Recording scheduler for WatchTV Capture Card (TV Tuner card) Source=Paul Collins Startup list [Recycle Bin Handler] Number=8456 Confirmed=X Filename=recycler.exe Description=Added by the SHUCKBOT-A TROJAN! Source=Paul Collins Startup list [Recycle Bin Handler 2005] Number=8457 Confirmed=X Filename=system.exe Description=Added by the HO TROJAN! Source=Paul Collins Startup list [RecycleSTR] Number=8458 Confirmed=X Filename=msreg32.exe Description=Added by the RBOT-TC WORM! Source=Paul Collins Startup list [Red Flag] Number=8459 Confirmed=N Filename=redflag.exe Description=PMS prediction program with modes for guys and girls - no longer available Source=Paul Collins Startup list [Red Swoosh EDN Client] Number=8460 Confirmed=U Filename=RSEDNClient.exe Description=Red Swoosh - mechanism used by web sites to allow you to download files from those sites quicker and more efficiently via P2P. Note from the license agreement they automatically update the software, can download other published content that it feels may interest you without your knowledge and share non-personally identifiable information with others in the network - but you must agree to this when installing the software Source=Paul Collins Startup list [redirect] Number=8461 Confirmed=X Filename=redirect*.exe Description=Dotcomtoolbar/Linksummary hijacker installer - where * is a random digit Source=Paul Collins Startup list [Redline Taskbar] Number=8462 Confirmed=N Filename=taskbar.exe Description=Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards Source=Paul Collins Startup list [REEGRUN] Number=8463 Confirmed=X Filename=[path to file] Description=Added by the SECDROP.AI TROJAN Source=Paul Collins Startup list [Reek 32 Server] Number=8464 Confirmed=X Filename=reek32.exe Description=Added by the RANDEX.AL WORM! Source=Paul Collins Startup list [Referee] Number=8465 Confirmed=U Filename=referee.exe Description=MediaComm's monitor for file association changes. Stop rogue programs from screwing your settings either on installation or whenever they run Source=Paul Collins Startup list [Refresh] Number=8466 Confirmed=N Filename=Refresh.exe Description=(Iomega) Refresh - loads the Iomega desktop icons at startup Source=Paul Collins Startup list [Reg] Number=8467 Confirmed=X Filename=Reg.hta Description=Passon homepage hi-jacker Source=Paul Collins Startup list [Reg Check] Number=8468 Confirmed=? Filename=lpt.exe Description=Related to Supanet ISP software - what does it do and is it required? Source=Paul Collins Startup list [reg run] Number=8469 Confirmed=X Filename=Systen.exe Description=Added by the BANCOS-BS TROJAN! Source=Paul Collins Startup list [Reg Service] Number=8470 Confirmed=X Filename=winsy.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Reg Service] Number=8471 Confirmed=X Filename=winslogon.exe Description=Added by the AGOBOT-SC WORM! Source=Paul Collins Startup list [Reg Service] Number=8472 Confirmed=X Filename=ipcfg.exe Description=Added by the AGOBOT-SO WORM! Source=Paul Collins Startup list [Reg Service] Number=8473 Confirmed=X Filename=REGSRV32.EXE Description=Added by the RBOT.ZW WORM! Source=Paul Collins Startup list [Reg Service] Number=8474 Confirmed=X Filename=WinnConfig.exe Description=Added by the AGOBOT-PF WORM! Source=Paul Collins Startup list [Reg Service] Number=8475 Confirmed=X Filename=NT32.exe Description=Added by the AGOBOT.G TROJAN! Source=Paul Collins Startup list [Reg Services] Number=8476 Confirmed=X Filename=Winboot32.exe Description=Added by the RBOT.PB WORM! Source=Paul Collins Startup list [reg1.reg] Number=8477 Confirmed=X Filename=vuamgard.exe Description=Added by a variant of the IRC.BOT TROJAN! Source=Paul Collins Startup list [reg2.0] Number=8478 Confirmed=U Filename=SVCH0ST.EXE Description=eSpyNow surveillance software. Uninstall this software unless you put it there yourself. Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [Reg32] Number=8479 Confirmed=X Filename=Reg32.exe Description=Hijacker - redirecting to only-virgins.com Source=Paul Collins Startup list [reg32] Number=8480 Confirmed=X Filename=reg32.exe Description=Added by the NOUPDATE.B TROJAN! Source=Paul Collins Startup list [Reg32] Number=8481 Confirmed=X Filename=reg33.exe Description=CoolWebSearch parasite variant - also detected as the STARTPA-M TROJAN! Source=Paul Collins Startup list [Regcheck] Number=8482 Confirmed=X Filename=~CAB001.EXE Description=Added by the CYBRSPY.13A or CYBRSPY.13B TROJANS! Source=Paul Collins Startup list [regcheck] Number=8483 Confirmed=X Filename=[path to file] Description=Added by the SERVPAM TROJAN! Source=Paul Collins Startup list [RegCleaner] Number=8484 Confirmed=X Filename=SYSio32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - do not confuse this with the popular RegCleaner registry cleaner freeware Source=Paul Collins Startup list [RegCompres] Number=8485 Confirmed=X Filename=Regcpm32.exe Description=Added by the POLDO.B TROJAN! Source=Paul Collins Startup list [RegCompres] Number=8486 Confirmed=X Filename=REGCPM32.EXE Description=Added by the DASMIN-E TROJAN! Source=Paul Collins Startup list [Regcxdinaf] Number=8487 Confirmed=X Filename=REGCXDINAF.EXE Description=Added by the BANCOS-BW TROJAN! Source=Paul Collins Startup list [Regcxn] Number=8488 Confirmed=X Filename=Regcxn.exe Description=Added by the COIBOA-D TROJAN! Source=Paul Collins Startup list [regdefend] Number=8489 Confirmed=U Filename=regdefend.exe Description="RegDefend is a configurable, kernel based registry protection system, designed to intercept selected changes before they occur, thus also preventing malicious software like viruses, trojans and worms from using the registry to their advantage" Source=Paul Collins Startup list [RegDone] Number=8490 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [RegDone] Number=8491 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [RegDone Ex] Number=8492 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [RegDoneEx] Number=8493 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [regedit] Number=8494 Confirmed=X Filename=regedit.exe Description=Added by the BRID.A WORM! Note - this is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [REGEDIT] Number=8495 Confirmed=X Filename=Regsrv32.com Description=Added by the SOUTHGHOST WORM! Source=Paul Collins Startup list [regedit] Number=8496 Confirmed=X Filename=autoexe.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [regedit] Number=8497 Confirmed=X Filename= svchost.exe ccRegVfy Description=Added by the HOTWORD.B TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [RegEdit32] Number=8498 Confirmed=X Filename=RegEdit32.exe Description=Added by the VOUMIT-A WORM! Note - this is not the legitimate regedit32.exe application which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder Source=Paul Collins Startup list [Regexit] Number=8499 Confirmed=X Filename=runlli32.exe Description=Added by the QQPASS-U TROJAN! Source=Paul Collins Startup list [Regexit] Number=8500 Confirmed=X Filename=Updadv.exe Description=Added by the QQPASS-N TROJAN! Source=Paul Collins Startup list [RegFreeze] Number=8501 Confirmed=U Filename=regfreeze.exe Description=RegFreeze anti-spyware software Source=Paul Collins Startup list [reggsdg] Number=8502 Confirmed=X Filename=spoolserv.exe Description=Added by the SDBOT-MS WORM! Source=Paul Collins Startup list [RegHelp] Number=8503 Confirmed=U Filename=svchosts.exe Description=SpyGraphica spy software - "Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world." Source=Paul Collins Startup list [reginfo32] Number=8504 Confirmed=? Filename=reginfo32.exe Description=?? Source=Paul Collins Startup list [Register Manager] Number=8505 Confirmed=X Filename=RegistryManage.exe Description=Added by the SDBOT.AYH WORM! Source=Paul Collins Startup list [Register MediaRing Talk] Number=8506 Confirmed=N Filename=register.exe Description=If you don't want to register MediaRing and be reminded about it every bootup disable it Source=Paul Collins Startup list [Register SeqChk] Number=8507 Confirmed=? Filename=regsvr32.exe ..csseqchk.dll Description=?? Source=Paul Collins Startup list [RegisterDropHandler] Number=8508 Confirmed=U Filename=REGIST~1.EXE Description=Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation Source=Paul Collins Startup list [Registration Service] Number=8509 Confirmed=X Filename=toker.exe Description=Added by the SDBOT-BB WORM! Source=Paul Collins Startup list [Registration-Studio 8] Number=8510 Confirmed=N Filename=RegTool.exe Description=Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems Source=Paul Collins Startup list [Registry] Number=8511 Confirmed=X Filename=wscript.exe [path] ShakiraPics.jpg.vbs Description=Added by the VBSWG.AQ WORM! Source=Paul Collins Startup list [Registry] Number=8512 Confirmed=U Filename=class0117[random].exe Description=Blackbox captures emails and chat logs, and monitors Internet activity - remove if you didn't intentionally install it Source=Paul Collins Startup list [Registry Checkup] Number=8513 Confirmed=X Filename=winreg.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Registry Checkup System326a Monitor] Number=8514 Confirmed=X Filename=Winregs326a.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Registry Integrity Checker] Number=8515 Confirmed=X Filename=regintmon.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Registry Integritycheck] Number=8516 Confirmed=X Filename=WCPDT.EXE Description=Added by the AGOBOT-RF WORM! Source=Paul Collins Startup list [Registry Loader] Number=8517 Confirmed=X Filename=regloadr.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Registry Loader] Number=8518 Confirmed=X Filename=winhlpp32.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Registry oidet] Number=8519 Confirmed=X Filename=win32.exe Description=Added by the RBOT.BMT WORM! Source=Paul Collins Startup list [Registry Protector] Number=8520 Confirmed=X Filename=regprotect.exe Description=Added by the ARIVER.A WORM! Source=Paul Collins Startup list [Registry Scanner] Number=8521 Confirmed=X Filename=regscanr.exe Description=Added by a variant of the OPTIX TROJAN! Source=Paul Collins Startup list [Registry Server] Number=8522 Confirmed=X Filename=regsrv32.exe Description=Added by the RBOT-GM WORM! Source=Paul Collins Startup list [Registry Service] Number=8523 Confirmed=X Filename=REGSRV32.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Registry Service] Number=8524 Confirmed=X Filename=resvs.exe Description=Added by the DELBOT-I WORM! Source=Paul Collins Startup list [Registry Services] Number=8525 Confirmed=X Filename=Registry.exe Description=Added by the CILE TROJAN! Source=Paul Collins Startup list [Registry Startup Check] Number=8526 Confirmed=X Filename=checkreg.exe Description=Added by the REMLOAD-A or DANMEC-B TROJANS! Source=Paul Collins Startup list [Registry System16 Checkup Monitor] Number=8527 Confirmed=X Filename=SystemReg16.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Registry System166 Checkup Monitor] Number=8528 Confirmed=X Filename=SystemReg166.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Registry Value Name] Number=8529 Confirmed=X Filename=roses.exe Description=Added by the RBOT-AFT WORM! Source=Paul Collins Startup list [Registry Value Name] Number=8530 Confirmed=X Filename=service.exe Description=Added by the RBOT-AHT WORM! Source=Paul Collins Startup list [Registry Value Name] Number=8531 Confirmed=X Filename=winapi32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Registry Value Name Start] Number=8532 Confirmed=X Filename=MsPMSPSa.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [RegistryCheck] Number=8533 Confirmed=X Filename=rundll32.exe chkreg.dll, CheckRegistry Description=Ulubione adult content dialer Source=Paul Collins Startup list [RegistryChk] Number=8534 Confirmed=X Filename=winbackup.exe Description=Added by the MERTIAN WORM! Source=Paul Collins Startup list [RegistryMechanic] Number=8535 Confirmed=U Filename=RegMech.exe Description=Registry Mechanic - "you can safely clean and repair Windows registry problems with a few simple mouse clicks! Problems with the Windows registry are a common cause of Windows crashes and error messages" Source=Paul Collins Startup list [RegistryMonitor] Number=8536 Confirmed=X Filename=registry.pif Description=Affilred adware Source=Paul Collins Startup list [REGIST~1] Number=8537 Confirmed=U Filename=REGIST~1.EXE Description=Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation Source=Paul Collins Startup list [Regkey for autostart] Number=8538 Confirmed=X Filename=winservice.exe Description=Added by the RBOT-NU WORM! Source=Paul Collins Startup list [RegKillTray] Number=8539 Confirmed=U Filename=RegKillTray.exe Description=DVD region killer part of CloneDVD from Elaborate Bytes AG. Copies the main movie, Special Features and/or the original menu onto a DVD Recordable or onto your harddisk Source=Paul Collins Startup list [Regmonitor] Number=8540 Confirmed=X Filename=regmaping.exe Description=Added by the BEAGLE.DO WORM! Source=Paul Collins Startup list [REGMSYS] Number=8541 Confirmed=X Filename=[path to file] Description=Added by the LOWZONE-AX TROJAN! Source=Paul Collins Startup list [RegMutex] Number=8542 Confirmed=X Filename=lexplore_.exe Description=Added by the MSNOPT-A TROJAN! Source=Paul Collins Startup list [RegPowerClean] Number=8543 Confirmed=N Filename=RegPowerClean.exe Description=RegistryPowerCleaner is a security risk that may give exaggerated reports of errors in the registry of the compromised computer Source=Paul Collins Startup list [RegProt] Number=8544 Confirmed=Y Filename=Regprot.exe Description=RegistryProt from Diamond Computer Systems - protects the system registry against changes Source=Paul Collins Startup list [Regptmens] Number=8545 Confirmed=X Filename=REGPTMENS.EXE Description=Added by the BANCOS-ED TROJAN! Source=Paul Collins Startup list [Regro] Number=8546 Confirmed=X Filename=rundll132.exe Description=Added by the OKARAG TROJAN! Source=Paul Collins Startup list [RegRun] Number=8547 Confirmed=X Filename=mActiveX.exe Description=Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS! Source=Paul Collins Startup list [REGRUN] Number=8548 Confirmed=X Filename=winfix22490.exe Description=Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS! Source=Paul Collins Startup list [REGRUN] Number=8549 Confirmed=X Filename=[path to trojan] Description=Added by the LOWZONE-AH TROJAN! Source=Paul Collins Startup list [REGRUN] Number=8550 Confirmed=X Filename=regeditt.exe Description=Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS! Source=Paul Collins Startup list [REGRUN] Number=8551 Confirmed=X Filename=sory.exe Description=Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS! Source=Paul Collins Startup list [REGRUN] Number=8552 Confirmed=X Filename=dialer.exe Description=Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS! Source=Paul Collins Startup list [RegRun WinBait] Number=8553 Confirmed=U Filename=winbait.exe Description=Part of RegRun - used to detect unknown viruses. RegRun compares winbait.exe with the original copy called winbait.org and warns if the files are different.. Source=Paul Collins Startup list [Regrun2] Number=8554 Confirmed=Y Filename=WatchDog.exe Description=Greatis Software's RegRun security suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's, viruses, etc Source=Paul Collins Startup list [REGRUNM] Number=8555 Confirmed=X Filename=autoprotect.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Regrx] Number=8556 Confirmed=X Filename=rundll32.exe Description=Added by the WAYIC-A TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). The file is located in C:\Windows Source=Paul Collins Startup list [Regscan] Number=8557 Confirmed=X Filename=regscanr.exe Description=Added by the OPTIX-SE TROJAN! Source=Paul Collins Startup list [RegScan] Number=8558 Confirmed=X Filename=DLLSRV32.EXE Description=Added by the AGOBOT.AEW WORM! Source=Paul Collins Startup list [RegScan] Number=8559 Confirmed=X Filename=Regscan.exe Description=Added by the TALEX TROJAN! Source=Paul Collins Startup list [RegServer] Number=8560 Confirmed=? Filename=regserve.exe Description=Related to XGI Technology's Volari graphics cards - what does it do and is it required? Source=Paul Collins Startup list [regservices.exe] Number=8561 Confirmed=X Filename=regservices.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [RegShave] Number=8562 Confirmed=N Filename=regshave.exe Description=Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BEFORE attempting to uninstall the Fuji software or the uninstall may not work correctly Source=Paul Collins Startup list [regsrv] Number=8563 Confirmed=X Filename=regsrv.exe Description=Added by the OPTIXPRO.11 TROJAN! Source=Paul Collins Startup list [regsrv] Number=8564 Confirmed=X Filename=scvhost.exe Description=Added by the AGOBOT.E WORM! Source=Paul Collins Startup list [regsrvc] Number=8565 Confirmed=X Filename=regsrvc.exe Description=Added by the STOPED-A TROJAN! Source=Paul Collins Startup list [Regsv] Number=8566 Confirmed=X Filename=regsv.exe Description=Search hijacker - redirecting to scheo.com Source=Paul Collins Startup list [Regsvc] Number=8567 Confirmed=X Filename=regsv.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [regsvc32] Number=8568 Confirmed=X Filename=regsvc32.exe Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [regsvr] Number=8569 Confirmed=X Filename=regsvr.exe Description=Added by the WEBMONEY-G TROJAN! Source=Paul Collins Startup list [REGSVR32] Number=8570 Confirmed=U Filename=regsvr32.exe ctasio.dll Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [RegSvr32] Number=8571 Confirmed=X Filename=msmsgs.exe Description=Added by the ZLOB.B TROJAN! Source=Paul Collins Startup list [regsync] Number=8572 Confirmed=X Filename=regsync.exe Description=SafeSurfing adware Source=Paul Collins Startup list [regtmlp] Number=8573 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [RegTweak] Number=8574 Confirmed=U Filename=RegTwk.exe Description=Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options, custom display modes, refresh rates and overclocking all through an easy to use interface Source=Paul Collins Startup list [RegVer] Number=8575 Confirmed=X Filename=REGVER.EXE Description=Added by the LATINUS.16 TROJAN! Source=Paul Collins Startup list [RegVfy32] Number=8576 Confirmed=X Filename=Regverif32.exe Description=Added by the SYGYP.A WORM! Source=Paul Collins Startup list [RegWrite] Number=8577 Confirmed=X Filename=csrss.exe Description=Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Windows\Media folder Source=Paul Collins Startup list [Regx10EXE] Number=8578 Confirmed=Y Filename=atix10.exe Description=ATI Remote Wonder� - PC wireless remote control driver. Required if you use it Source=Paul Collins Startup list [reg_key] Number=8579 Confirmed=X Filename=FUKULAMER.exe Description=Added by the BEAGLE.AH WORM! Source=Paul Collins Startup list [reg_key] Number=8580 Confirmed=X Filename=loader_name.exe Description=Added by the BEAGLE.Y or BEAGLE.Z or BEAGLE.AA WORMS! Source=Paul Collins Startup list [Reg_WFT] Number=8581 Confirmed=X Filename=Regsysw.com Description=Added by the WILSEF VIRUS! Source=Paul Collins Startup list [Reg_WFT] Number=8582 Confirmed=X Filename=scanreg32.com Description=Added by the SENNASPY-F TROJAN! Source=Paul Collins Startup list [ReleaseRAM] Number=8583 Confirmed=U Filename=RRAM.exe Description="Release RAM allows your computer to run faster and uses your computer's RAM more efficiently". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [reload] Number=8584 Confirmed=X Filename=reload.vbs Description=Added by the LOVELETTER.AS VIRUS! Source=Paul Collins Startup list [Reload] Number=8585 Confirmed=X Filename=reload.exe Description=Added by the LAZAR TROJAN! Source=Paul Collins Startup list [RemHelp] Number=8586 Confirmed=N Filename=Remhelp.exe Description=BT Voyager ADSL Modem Help related Source=Paul Collins Startup list [Reminder] Number=8587 Confirmed=N Filename=reminder.exe Description=From MS Money. Reminds you of your bills Source=Paul Collins Startup list [Reminder] Number=8588 Confirmed=N Filename=Remind_XP.exe Description=HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list Source=Paul Collins Startup list [Reminder-cpqXXXXX] Number=8589 Confirmed=N Filename=remind32.exe Description=Compaq printer Registration Source=Paul Collins Startup list [Reminder-hpcXXXXX] Number=8590 Confirmed=N Filename=remind32.exe Description=HP CD-Writer Registration Source=Paul Collins Startup list [Reminder-ranXXXXX] Number=8591 Confirmed=N Filename=remind32.exe Description=Registration reminder widget for Rand Mcnally maps Source=Paul Collins Startup list [reminder-ScanSoft Product Registration] Number=8592 Confirmed=N Filename=remind32.exe Description=Registration reminder for ScanSoft products such as PaperPort Source=Paul Collins Startup list [RemindMe] Number=8593 Confirmed=U Filename=RemindMe.exe Description=Remind-Me - calendar software Source=Paul Collins Startup list [Remind_XP] Number=8594 Confirmed=N Filename=Remind_XP.exe Description=HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list Source=Paul Collins Startup list [Remndr] Number=8595 Confirmed=X Filename=CsRemnd.exe Description=CasinoOnline foistware Source=Paul Collins Startup list [Remote] Number=8596 Confirmed=U Filename=Remote.exe Description=Remote Control driver for LifeView internal and external TV products Source=Paul Collins Startup list [Remote Access] Number=8597 Confirmed=U Filename=rnaapp.exe Description=Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie, analogue 56K modem) and terminates after the connection is closed Source=Paul Collins Startup list [Remote Access Slave] Number=8598 Confirmed=X Filename=Synchost.exe Description=Added by the RIPJAC TROJAN! Source=Paul Collins Startup list [Remote Control] Number=8599 Confirmed=N Filename=Rc.exe Description=Hinet Hi-Five ISP software Source=Paul Collins Startup list [Remote Controller] Number=8600 Confirmed=N Filename=TVRMVCR.EXE Description=ProLink PlayTVpro TV tuner software Source=Paul Collins Startup list [Remote Desktop Computing] Number=8601 Confirmed=U Filename=marspc.exe Description=Marspc Remote Desktop Computing Source=Paul Collins Startup list [Remote Desktop Help Session Manager] Number=8602 Confirmed=X Filename=WinRDH.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Remote Management Agent] Number=8603 Confirmed=U Filename=zenrc32.exe Description=Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation Source=Paul Collins Startup list [remote master] Number=8604 Confirmed=U Filename=remote master.exe Description=Required if you want your ASUS Remote control to work at all. Available via Start -> Programs Source=Paul Collins Startup list [Remote Procedure Call] Number=8605 Confirmed=X Filename=winrpc.exe Description=Added by the RBOT-KM WORM! Source=Paul Collins Startup list [Remote Procedure Call] Number=8606 Confirmed=X Filename=winsysrpc.exe Description=Added by the SDBOT-PS WORM! Source=Paul Collins Startup list [Remote Procedure Call For Windows 32bit] Number=8607 Confirmed=X Filename=rpc.exe Description=Added by the RBOT-MD WORM! Source=Paul Collins Startup list [Remote Procedure Call Locator] Number=8608 Confirmed=X Filename=RUNDLL32.EXE reg678.dll ondll_reg Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Remote Procedure Calls] Number=8609 Confirmed=X Filename=mswinrpc.exe Description=Added by the RBOT.KJ WORM! Source=Paul Collins Startup list [Remote Procedure Calls] Number=8610 Confirmed=X Filename=mswinc.exe Description=Added by the RBOT-IT WORM! Source=Paul Collins Startup list [Remote Procedure Calls] Number=8611 Confirmed=X Filename=win.exe Description=Added by the SDBOT-QI WORM! Source=Paul Collins Startup list [Remote Update Monitor] Number=8612 Confirmed=Y Filename=imonitor.exe Description=Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer Source=Paul Collins Startup list [RemoteAgent] Number=8613 Confirmed=Y Filename=RAUAgent.exe Description=Trend Micro's Office Scan Client, see here - "Its Web-based management console gives administrators transparent access to desktop and mobile clients to coordinate automatic deployment of security policies and software updates" Source=Paul Collins Startup list [RemoteCenter] Number=8614 Confirmed=U Filename=RcMan.exe Description=Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats Source=Paul Collins Startup list [RemoteControl] Number=8615 Confirmed=U Filename=rmctrl.exe Description=Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [RemoteControl] Number=8616 Confirmed=U Filename=PDVDServ.exe Description=Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [Remote_Agent] Number=8617 Confirmed=N Filename=RemoteAgent.exe Description=Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs Source=Paul Collins Startup list [REMOVE ME] Number=8618 Confirmed=X Filename=windos.exe Description=Added by the SDBOT.EE WORM! Source=Paul Collins Startup list [Removecpl] Number=8619 Confirmed=N Filename=Removecpl.exe Description=Related to a Belkin 54Mbps Wireless Utility Control Panel applet Source=Paul Collins Startup list [Removed.exe] Number=8620 Confirmed=X Filename=Removed.exe Description=GatorCheat - adware downloader Source=Paul Collins Startup list [RemStart] Number=8621 Confirmed=? Filename=remstart.exe Description=Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required? Source=Paul Collins Startup list [RenolB] Number=8622 Confirmed=? Filename=ib.exe Description=?? Source=Paul Collins Startup list [Replay Center] Number=8623 Confirmed=U Filename=ReplayRadio.exe Description=Replay Radio - "makes it easy to automatically record your favorite radio shows, so you can listen wherever and whenever you like" Source=Paul Collins Startup list [Replicator] Number=8624 Confirmed=U Filename=PTReplicator.exe Description=Replicator from Karen's powertools. "Automatically backup files, directories, even entire drives!" Source=Paul Collins Startup list [RepliGo Assistant] Number=8625 Confirmed=U Filename=RepliGoMon.exe Description=Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device" Source=Paul Collins Startup list [ReproPRD] Number=8626 Confirmed=U Filename=PrdUsb.exe Description=Thrustmaster Corporation Presets application - a game controller driver, presumably necessary for certain functions to work Source=Paul Collins Startup list [requester] Number=8627 Confirmed=X Filename=requester.*.exe Description=Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit, examples: requester.5.exe, requester.10.exe Source=Paul Collins Startup list [Requester] Number=8628 Confirmed=X Filename=requester.11.exe Description=Added by the MUQUEST TROJAN! Source=Paul Collins Startup list [Required Service Drivers] Number=8629 Confirmed=X Filename=micront.exe Description=Added by the RBOT-ABD WORM! Source=Paul Collins Startup list [resagnt] Number=8630 Confirmed=X Filename=restun.exe Description=Adware downloader, identified by Panda antivirus as Trojan.Downloader.ALQ Source=Paul Collins Startup list [reseurce] Number=8631 Confirmed=X Filename=[path to trojan] Description=Added by the LINEAGE-AI TROJAN! Source=Paul Collins Startup list [reseurce] Number=8632 Confirmed=X Filename=svchost.exe Description=Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Resolution Assistant] Number=8633 Confirmed=N Filename=matcli.exe Description=Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [Resource Meter] Number=8634 Confirmed=N Filename=rsrcmtr.exe Description=Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes Source=Paul Collins Startup list [Restart Watch] Number=8635 Confirmed=? Filename=Watch.exe Description=Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required? Source=Paul Collins Startup list [Restart WSC Setting] Number=8636 Confirmed=U Filename=wscrestp.exe Description=WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes Source=Paul Collins Startup list [Restart_VS] Number=8637 Confirmed=? Filename=Viewsonic.exe Description=Could be a left-over from the installation of a Viewsonic flat panel display Source=Paul Collins Startup list [RestoreDesktop] Number=8638 Confirmed=U Filename=RestoreDesktop.exe Description=Softwarium Restore Desktop "is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change" Source=Paul Collins Startup list [RestoreIT!] Number=8639 Confirmed=Y Filename=VBPTASK.EXE Description=RestoreIT! from FarStone "allows you to recover instantly your files, system configuration, and even your operating system, to any point in time prior to the data loss or system failure" Source=Paul Collins Startup list [restory] Number=8640 Confirmed=X Filename=restory.exe Description=Added by the RETSAM TROJAN! Source=Paul Collins Startup list [Resume Copy] Number=8641 Confirmed=U Filename=copyfstq.exe Description=Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function Source=Paul Collins Startup list [ResumeFixClocks] Number=8642 Confirmed=U Filename=resumefix.exe Description=Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards Source=Paul Collins Startup list [retime] Number=8643 Confirmed=X Filename=retime.exe Description=Added by the GIPMA TROJAN! Source=Paul Collins Startup list [RetrieverScheduler] Number=8644 Confirmed=U Filename=retrieverscheduler.exe Description=80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network file systems, giving users one point of fast, accurate search for all personal information". Real-time scheduler - shortcut available Source=Paul Collins Startup list [RetroExpress] Number=8645 Confirmed=U Filename=RetroExpress.exe Description=EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices Source=Paul Collins Startup list [RevoTaskbarApp] Number=8646 Confirmed=U Filename=RevoTask.exe Description=Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available Source=Paul Collins Startup list [RexSyMon] Number=8647 Confirmed=N Filename=rexsymon.exe Description=Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC Source=Paul Collins Startup list [RF] Number=8648 Confirmed=X Filename=EC.exe Description=Added by the LINEAGE-U TROJAN! Source=Paul Collins Startup list [rfagent] Number=8649 Confirmed=U Filename=rfagent.exe Description=Registry First Aid - scans the Windows registry for orphan file/folder references, finds these files or folders on your drives that may have been moved from their initial locations, and then corrects your registry entries to match the located files or folders Source=Paul Collins Startup list [rforce] Number=8650 Confirmed=X Filename=EXP1ORER.EXE Description=Added by the DROPPER.KN TROJAN! Note the number "1" in the filename rather than letter "L". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN! Source=Paul Collins Startup list [RFTray] Number=8651 Confirmed=N Filename=RFTRay.exe Description=Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs Source=Paul Collins Startup list [rfw] Number=8652 Confirmed=Y Filename=Rfw.exe Description=RAV AntiVirus Source=Paul Collins Startup list [rfwydg] Number=8653 Confirmed=? Filename=rfwydg.exe Description=?? Source=Paul Collins Startup list [RFX_auto_upgrade] Number=8654 Confirmed=N Filename=rundll32.exe npvpg005.dll Description=A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade Source=Paul Collins Startup list [Rg2catbd] Number=8655 Confirmed=X Filename=Rg2catbd.exe Description=Added by a variant of the BANLOAD family of TROJANS! Source=Paul Collins Startup list [RH] Number=8656 Confirmed=U Filename=rh32.exe Description=EuroFonts - adds Euro symbols to pre-Euro computers Source=Paul Collins Startup list [Rhino] Number=8657 Confirmed=X Filename=[random name]32.exe Description=Added by the BOFRA.A WORM! Source=Paul Collins Startup list [RhinoBlocker] Number=8658 Confirmed=U Filename=RhinoBlocker.exe Description=RhinoBlocker - pop-up stopper Source=Paul Collins Startup list [RHPTray] Number=8659 Confirmed=N Filename=RHPTray.exe Description=System tray access to Red Hot Pawn - online chess Source=Paul Collins Startup list [RHSI SHS] Number=8660 Confirmed=N Filename=SHS.exe Description=Rogers Hi-Speed Internet software. "Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail, the Self-Healing Software (SHS.exe) will automatically repair your settings to get you up and running in a flash" Source=Paul Collins Startup list [RichMedia] Number=8661 Confirmed=X Filename=HBHelper.dll Description=HenBang adware Source=Paul Collins Startup list [RichMedia] Number=8662 Confirmed=X Filename=rundll32.exe [path] hbcast.dll, WaitWindows Description=Henbang adware variant Source=Paul Collins Startup list [richup] Number=8663 Confirmed=X Filename=richup.exe Description=SafeSurfing adware Source=Paul Collins Startup list [RightFAX Print-to-Fax Driver] Number=8664 Confirmed=U Filename=FaxCtrl.exe Description=Part of RightFAX from Captaris - "the proven market leader in fax server and document delivery software" Source=Paul Collins Startup list [Ring Central Fax] Number=8665 Confirmed=U Filename=rcenterrll.exe Description=Only needed if you want a PC to answer faxes automatically Source=Paul Collins Startup list [rIOphosIs] Number=8666 Confirmed=X Filename=rIOPHosIs.vBS Description=Added by the RIOSYS MACRO! Source=Paul Collins Startup list [Riorad Manager] Number=8667 Confirmed=N Filename=riomgr.exe Description="Riorad Explorer is hands-down the most advanced Windows software companion for your Rio MP3 player" Source=Paul Collins Startup list [RivaTuner] Number=8668 Confirmed=U Filename=RivaTuner.exe Description=RivaTuner for tweaking nVidia graphics cards. Required if you make any changes Source=Paul Collins Startup list [RivaTunerStartupDaemon] Number=8669 Confirmed=U Filename=RivaTuner.exe Description=RivaTuner for tweaking nVidia graphics cards. Required if you make any changes Source=Paul Collins Startup list [RjLyraInstaller] Number=8670 Confirmed=? Filename=setup.exe Description=?? Source=Paul Collins Startup list [rmalt] Number=8671 Confirmed=X Filename=[random filename] Description=Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe, Keygen.exe, Keygen-Serial.exe, Photoshop.CS2.KeyGen.exe and more Source=Paul Collins Startup list [rmctrl] Number=8672 Confirmed=U Filename=rmctrl.exe Description=Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [rmdrfje.dll] Number=8673 Confirmed=X Filename=rundll32.exe [path] rmdrfje.dll Description=Added by the DLOADR-ANM TROJAN! Source=Paul Collins Startup list [rmmon] Number=8674 Confirmed=N Filename=mprmmon.exe Description=Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card Source=Paul Collins Startup list [RMremote] Number=8675 Confirmed=? Filename=RmRemote.exe Description=Remote control driver for REALmagic Xcard. Is it required? Source=Paul Collins Startup list [rn4d] Number=8676 Confirmed=X Filename=dirote.exe Description=Added by the MAROON.A TROJAN! Source=Paul Collins Startup list [Rnaomflt] Number=8677 Confirmed=U Filename=naomf.exe Description=Naomi internet filtering software Source=Paul Collins Startup list [RNBc Test] Number=8678 Confirmed=X Filename=wf32vbs.exe Description=Added by the RBOT-AGR WORM! Source=Paul Collins Startup list [RNBc Test] Number=8679 Confirmed=X Filename=bvldv32.exe Description=Added by the RBOT-AJF WORM! Source=Paul Collins Startup list [RNBOStart] Number=8680 Confirmed=U Filename=sentstrt.exe Description=Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools Source=Paul Collins Startup list [RNBz Test] Number=8681 Confirmed=X Filename=wf32vbc.exe Description=Added by the RBOT-AEY WORM! Source=Paul Collins Startup list [RNDc Test] Number=8682 Confirmed=X Filename=wf32b.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [rndll2] Number=8683 Confirmed=? Filename=rndll2.exe Description=May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within? Source=Paul Collins Startup list [rngmf] Number=8684 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.C TROJAN! Source=Paul Collins Startup list [Rnudll32] Number=8685 Confirmed=X Filename=tadxtr.exe Description=Added by the QQPASS-O TROJAN! Source=Paul Collins Startup list [rnxqh] Number=8686 Confirmed=? Filename=rnxqh.exe Description=?? Source=Paul Collins Startup list [Roam04] Number=8687 Confirmed=X Filename=ActiveX.exe Description=Added by the ROAMER-A TROJAN! Source=Paul Collins Startup list [RoboForm] Number=8688 Confirmed=N Filename=RoboTaskBarIcon.exe Description=Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin Source=Paul Collins Startup list [RoboFormWatcher] Number=8689 Confirmed=N Filename=RoboFormWatcher.exe Description=Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs Source=Paul Collins Startup list [Rocket.Time] Number=8690 Confirmed=U Filename=RocketTime.exe Description=Rocket.Time - time synchronization software from Rocket Software Source=Paul Collins Startup list [Roflcopteur] Number=8691 Confirmed=X Filename=seman.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [roketpipe] Number=8692 Confirmed=? Filename=rpclient.exe Description=?? Source=Paul Collins Startup list [Rollback] Number=8693 Confirmed=U Filename=RollbackTray.exe Description=Added by the RollBack Rx system restore program Source=Paul Collins Startup list [rollbk] Number=8694 Confirmed=X Filename=dsm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [rollbk] Number=8695 Confirmed=X Filename=msmpatch.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [rollbk] Number=8696 Confirmed=X Filename=svosm.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [rollbk] Number=8697 Confirmed=X Filename=sysup.exe Description=Added by the SERFLOG.B WORM! Source=Paul Collins Startup list [romahere] Number=8698 Confirmed=X Filename=matrixhere.exe Description=SuperSpider hijacker - a CoolWebSearch parasite variant Source=Paul Collins Startup list [romahere2] Number=8699 Confirmed=X Filename=************.exe [* = random char] Description=SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! Source=Paul Collins Startup list [romahere3] Number=8700 Confirmed=X Filename=************.exe [* = random char] Description=SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! Source=Paul Collins Startup list [Root_Machine] Number=8701 Confirmed=X Filename=[path to trojan] Description=Added by the BANCBAN-DI TROJAN! Source=Paul Collins Startup list [ROOT_Machine] Number=8702 Confirmed=X Filename=winlogon.exe Description=Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Windows\inf or Winnt\inf folder Source=Paul Collins Startup list [ROUTD] Number=8703 Confirmed=? Filename=ROUTD.exe Description=?? Source=Paul Collins Startup list [RoxAssist] Number=8704 Confirmed=N Filename=RoxAssist.exe Description=Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize, the applications in Easy CD & DVD Creator will not recognize your recorder. After running this program you should receive the message "Engine initialized successfully with full recorder support". If you do not receive the message, update your Virus software and then check and clean your system for viruses. After the removal of any viruses, uninstall and then reinstall Easy CD & DVD Creator (use "Add Remove Programs" in "Control Panel"). Can be run manually Source=Paul Collins Startup list [Roxio Engine] Number=8705 Confirmed=? Filename=MSMNGR32.EXE Description=Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN! Source=Paul Collins Startup list [RoxioAudioCentral] Number=8706 Confirmed=N Filename=RxMon.exe Description=Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound editor - integrated in a single application". Not required for Roxio to work properly. Source=Paul Collins Startup list [RoxioDragToDisc] Number=8707 Confirmed=N Filename=DrgToDsc.exe Description=Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly Source=Paul Collins Startup list [RoxioEngineUtility] Number=8708 Confirmed=Y Filename=EngUtil.exe Description=Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking Source=Paul Collins Startup list [RoxWatchTray] Number=8709 Confirmed=N Filename=RoxWatchTray.exe Description=System Tray icon installed by Roxio Easy Media Creator 8 and which allows you to configure your watched folders or to turn the �Watched Folders� feature of Roxio ON or OFF Source=Paul Collins Startup list [RP32] Number=8710 Confirmed=U Filename=rp32.exe Description=Unicenter Remote Control (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems Source=Paul Collins Startup list [RPC] Number=8711 Confirmed=X Filename=MSschost.exe Description=Added by a variant of the GAOBOT/AGOBOT WORM! Source=Paul Collins Startup list [RPC Patcher] Number=8712 Confirmed=X Filename=[path to worm] Description=Added by the BOLGI WORM! Source=Paul Collins Startup list [RPC Service] Number=8713 Confirmed=X Filename=[random filename] Description=Added by the AAD TROJAN! Source=Paul Collins Startup list [rpc Win32] Number=8714 Confirmed=X Filename=shost32.exe Description=Added by the RBOT-ABL WORM! Source=Paul Collins Startup list [rpc Win32] Number=8715 Confirmed=X Filename=spoolscv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [rpcc] Number=8716 Confirmed=X Filename=rpcc.exe Description=Added by the SPAMMIT-E TROJAN! Source=Paul Collins Startup list [rpcda Win32] Number=8717 Confirmed=X Filename=rpcda.exe Description=Added by the RBOT-AE WORM! Source=Paul Collins Startup list [RPCser32g] Number=8718 Confirmed=X Filename=services.exe Description=Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [RPCserr32g] Number=8719 Confirmed=X Filename=winlogon.exe Description=Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [RPCserv32] Number=8720 Confirmed=X Filename=services.exe Description=Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [RPCserv32g] Number=8721 Confirmed=X Filename=services.exe Description=Added by the BOBAX.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [RPCserv32g] Number=8722 Confirmed=X Filename=CSRSS.EXE Description=Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [RPCserv32g] Number=8723 Confirmed=X Filename=MSDEFR.EXE Description=Added by the BOBAX.AD WORM! Source=Paul Collins Startup list [RPCserv32g] Number=8724 Confirmed=X Filename=NB32EXT2.EXE Description=Added by the BOBAX.AD WORM! Source=Paul Collins Startup list [RPCserv32g] Number=8725 Confirmed=X Filename=WINLOGON.EXE Description=Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [RPCSS.exe] Number=8726 Confirmed=Y Filename=rpcss.exe Description=Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se, a program may need it to communicate with other components of itself. You could delete the program but if any abnormalities occur soon after then reinstall. Under NT, deleting this critical system component will disable the OS. For a more detailed explanation see here Source=Paul Collins Startup list [RpcxWindows Extensions] Number=8727 Confirmed=X Filename=rpcxwinex.exe Description=Added by the RBOT.ACP WORM! Source=Paul Collins Startup list [Rr2] Number=8728 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAG-ADI TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). This file is located in an "addins" sub-folder Source=Paul Collins Startup list [RRMedic] Number=8729 Confirmed=X Filename=rrmedic.exe Description=Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there internet connection Source=Paul Collins Startup list [rscmpt] Number=8730 Confirmed=U Filename=rscmpt.exe Description=Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status Source=Paul Collins Startup list [rsmb] Number=8731 Confirmed=X Filename=rsmb.exe Description=Added by the WAREZOV.C WORM! Source=Paul Collins Startup list [rsMenu] Number=8732 Confirmed=U Filename=rsMenu.exe Description=Synchronizes a Casio PDA with MS Outlook Source=Paul Collins Startup list [RSPC Driver] Number=8733 Confirmed=X Filename=[random filename].exe Description=Added by the RBOT-SN WORM! Source=Paul Collins Startup list [RSPC Driver D] Number=8734 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [RSRCMTZ] Number=8735 Confirmed=? Filename=RSRCMTZ.exe Description=?? Source=Paul Collins Startup list [RSS] Number=8736 Confirmed=X Filename=rundll32 RSSToolbar.dll, DllRunMain Description="Related Sites" toolbar - SearchAndClick hijacker variant Source=Paul Collins Startup list [RssReader] Number=8737 Confirmed=U Filename=RssReader.exe Description=RssReader - a free RSS reader able to display any RSS and Atom news feed (XML) Source=Paul Collins Startup list [RSync] Number=8738 Confirmed=X Filename=netsync.exe Description=SafeSurfing adware Source=Paul Collins Startup list [rtasks] Number=8739 Confirmed=N Filename=rtasks.exe Description=WinAntiVirus Pro 2007 virus software - not recommended, see here Source=Paul Collins Startup list [rtcdll] Number=8740 Confirmed=U Filename=rtcdll.exe Description=RTCDLL is "Real Time Communication" and is associated with Windows Messenger (the IM application, not messenger service). It is only necessary if you use Windows Messenger. Most people use MSN Messenger instead, so it is not required in those cases Source=Paul Collins Startup list [RTHDCPL] Number=8741 Confirmed=U Filename=RTHDCPL.EXE Description=Realtek HD Audio Sound Effect Manager Source=Paul Collins Startup list [RtHDVCpl] Number=8742 Confirmed=U Filename=RtHDVCpl.exe Description=High definition audio codec driver from Realtek Semiconductor Source=Paul Collins Startup list [RtlMon.exe] Number=8743 Confirmed=N Filename=RtlMon.exe Description=Monitor for RealTek network card Source=Paul Collins Startup list [RTMonitor] Number=8744 Confirmed=Y Filename=RTMonitor.exe Description=Cheyenne (now eTrust) antivirus Source=Paul Collins Startup list [rtos] Number=8745 Confirmed=X Filename=rtos.exe Description=IRC trojan Source=Paul Collins Startup list [RTStartMute] Number=8746 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [rtvscn95] Number=8747 Confirmed=Y Filename=RTVSCN95.EXE Description=Real-time virus scanner component of Norton Anti-Virus Corporate Edition Source=Paul Collins Startup list [RtWLan] Number=8748 Confirmed=U Filename=RtWLan.exe Description=Configuration utility for the Netgear WG111 54 Mbps Wireless USB 2.0 Adapter that "provides wireless access to your desktop or notebook PC through the computer's USB port" Source=Paul Collins Startup list [Ruby13] Number=8749 Confirmed=X Filename=Ruby13.exe Description=Added by the MEXER.E WORM! Source=Paul Collins Startup list [Ruby14] Number=8750 Confirmed=X Filename=Ruby14.exe Description=Added by the FIGHTRUB-A WORM! Source=Paul Collins Startup list [ruin] Number=8751 Confirmed=X Filename=system32.exe Description=Added by the DELF-JM TROJAN! Source=Paul Collins Startup list [RuLaunch] Number=8752 Confirmed=U Filename=RuLaunch.exe Description=Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Source=Paul Collins Startup list [run] Number=8753 Confirmed=X Filename=Autoexec.com Description=Added by the HOLCAS.A WORM! Source=Paul Collins Startup list [run] Number=8754 Confirmed=X Filename=inetinfo.exe Description=Added by the BINGHE TROJAN! Source=Paul Collins Startup list [Run] Number=8755 Confirmed=X Filename=help.exe Description=Identified as the DELF.LF by Ewido Security Suite Source=Paul Collins Startup list [run] Number=8756 Confirmed=X Filename=[path] rundll32.exe rsrc.dll Description=Browser hijacker of Chinese origin, redirecting to 4199.com Source=Paul Collins Startup list [Run Msn Messenger] Number=8757 Confirmed=X Filename=msnmgr.exe Description=Added by the AGOBOT.HA WORM! Source=Paul Collins Startup list [Run MSupdt32] Number=8758 Confirmed=X Filename=wscript MSupdt32.vbs Description=Added by the CASER WORM! Source=Paul Collins Startup list [Run Nintendo Wi-Fi USB Connector Registration Tool] Number=8759 Confirmed=U Filename=NintendoWFCReg.exe Description=Related to Wi-Fi USB Connector from Nintendo Source=Paul Collins Startup list [Run POPFile in background] Number=8760 Confirmed=U Filename=perl.exe Description=POPFile - E-mail spam blocker Source=Paul Collins Startup list [Run POPFile in background] Number=8761 Confirmed=U Filename=wperl.exe Description=POPFile - E-mail spam blocker Source=Paul Collins Startup list [Run Services as Application] Number=8762 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8763 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8764 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8765 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8766 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8767 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8768 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run Services as Application] Number=8769 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Run StartupMonitor] Number=8770 Confirmed=U Filename=StartupMonitor.exe Description=Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu Source=Paul Collins Startup list [Run TaskMrg] Number=8771 Confirmed=X Filename=csrss.exe Description=Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows folder Source=Paul Collins Startup list [run windows] Number=8772 Confirmed=X Filename=servic.bat Description=Added by the REBOOT-AP TROJAN! Source=Paul Collins Startup list [Run XP Service Pack] Number=8773 Confirmed=X Filename=xpservicepack.exe Description=Added by the SDBOT.AQA WORM! Source=Paul Collins Startup list [Run05] Number=8774 Confirmed=X Filename=rundll_32.exe Description=Added by the BANCOS-DT TROJAN! Source=Paul Collins Startup list [run32] Number=8775 Confirmed=X Filename=run32dll.exe Description=Added by the SDBOT-CWB WORM! Source=Paul Collins Startup list [run32dll] Number=8776 Confirmed=X Filename=WINClock.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [run32dll] Number=8777 Confirmed=X Filename=task32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Run32dll] Number=8778 Confirmed=X Filename=ocxdll.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [run=] Number=8779 Confirmed=N Filename=cmmpu.exe Description=MIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI) Source=Paul Collins Startup list [run=] Number=8780 Confirmed=N Filename=hpfsched Description=HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature Source=Paul Collins Startup list [run=] Number=8781 Confirmed=N Filename=lxdboxcp.exe Description=Lexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS Source=Paul Collins Startup list [run=] Number=8782 Confirmed=N Filename=pcfix2k.exe Description=pcfix2k splash screen Source=Paul Collins Startup list [run=] Number=8783 Confirmed=X Filename=ptlseq.cpl Description=PhoenixNet BIOS adware. See here Source=Paul Collins Startup list [run=] Number=8784 Confirmed=U Filename=ramsys.exe Description=Advanced Startup Manager from Rays Lab Source=Paul Collins Startup list [run=] Number=8785 Confirmed=? Filename=wallflip.exe Description=Desktop wallpaper changer? Source=Paul Collins Startup list [run=] Number=8786 Confirmed=X Filename=svcinit.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [run=] Number=8787 Confirmed=X Filename=fntldr.exe Description=CoolWebSearch Tapicfg parasite variant Source=Paul Collins Startup list [run=] Number=8788 Confirmed=Y Filename=smsrun16.exe Description=Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1, Windows for Workgroups, Win95, or OS/2 to create program groups on the client and then launch SMS client programs Source=Paul Collins Startup list [run=] Number=8789 Confirmed=? Filename=win.ini Description=?? Source=Paul Collins Startup list [run=] Number=8790 Confirmed=X Filename=RAVMOND.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [run=] Number=8791 Confirmed=X Filename=real.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [run=] Number=8792 Confirmed=X Filename=dec25.exe Description=Added by the ATAK.F WORM! Source=Paul Collins Startup list [run=] Number=8793 Confirmed=? Filename=LXBTppls.exe Description=Reportedly part of Lexmark printer software - what does it do and is it required? Source=Paul Collins Startup list [run=] Number=8794 Confirmed=N Filename=fmedia.exe Description=FMedia FaxWorks related - can be run manually Source=Paul Collins Startup list [run=] Number=8795 Confirmed=Y Filename=wswpd.exe Description=Used with some models of Panasonic, Epson and NEC printers - required for printer to work Source=Paul Collins Startup list [run=] Number=8796 Confirmed=X Filename=cyxid98.exe Description=Unidentified malware Source=Paul Collins Startup list [run=] Number=8797 Confirmed=X Filename=info32.exe Description=CoolWebSearch Tapicfg parasite variant Source=Paul Collins Startup list [run=] Number=8798 Confirmed=X Filename=mouse_configurator.win Description=Added by the GAGGLE.E WORM! Source=Paul Collins Startup list [run=] Number=8799 Confirmed=X Filename=RegistryReminder.exe Description=Added by the APSTROJAN.OB TROJAN! Source=Paul Collins Startup list [run=] Number=8800 Confirmed=X Filename=sec5dec.exe Description=Added by the ATAK.G WORM! Source=Paul Collins Startup list [run=] Number=8801 Confirmed=X Filename=wmplayer.exe Description=CoolWebSearch Smartsearch parasite variant Source=Paul Collins Startup list [run=] Number=8802 Confirmed=X Filename=Autoexec.com Description=Added by the HOLCAS.A WORM! Source=Paul Collins Startup list [run=] Number=8803 Confirmed=X Filename=htmlsync.exe Description=Searchforfree.info browser hijacker Source=Paul Collins Startup list [run=] Number=8804 Confirmed=X Filename=msoffice.exe Description=Added by the ADWARELOADER TROJAN! Note - do not confuse with the legitimate Microsoft Office file, which would typically be located in the Program Files\Microsoft Office\Office folder! Source=Paul Collins Startup list [run=] Number=8805 Confirmed=X Filename=DRDOOM.EXE Description=Added by the SEMAPI-A WORM! Source=Paul Collins Startup list [run=] Number=8806 Confirmed=X Filename=svhost.exe Description=Added by the ADMINCASH.B TROJAN! Source=Paul Collins Startup list [run=] Number=8807 Confirmed=X Filename=dllreg.exe Description=Added by the DUMARU-L TROJAN! Source=Paul Collins Startup list [run=] Number=8808 Confirmed=X Filename=mdm.exe Description=Added by the PROXY-GG TROJAN! Source=Paul Collins Startup list [run=] Number=8809 Confirmed=X Filename=Celine.scr Description=Added by the CELINE-A TROJAN! Source=Paul Collins Startup list [run=] Number=8810 Confirmed=X Filename=services.exe Description=Added by the KREPPER-N TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "inet10066" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [RunAlert] Number=8811 Confirmed=U Filename=AService.exe Description=MSI MOtherboard PC Alert III - MSI motherboard monitoring software. Only required if you "overclock" your system Source=Paul Collins Startup list [runAP] Number=8812 Confirmed=N Filename=runAP.exe Description=Not required but what is it? Source=Paul Collins Startup list [runapp] Number=8813 Confirmed=X Filename=icqchk.exe Description=Added by the BOMKA TROJAN! Source=Paul Collins Startup list [Runapp32] Number=8814 Confirmed=X Filename=Runapp32.exe Description=Added by the NEODURK TROJAN! Source=Paul Collins Startup list [RunCA] Number=8815 Confirmed=Y Filename=InvokeSvc3.exe Description=Wireless-G USB Wireless Network Adapter related - would appear to be required Source=Paul Collins Startup list [Rund11] Number=8816 Confirmed=X Filename=Rund11.EXE Description=Added by the MARIO-C WORM! Source=Paul Collins Startup list [rund1132] Number=8817 Confirmed=X Filename=rund1132.exe Description=Added by the DOPBOT-A WORM! Source=Paul Collins Startup list [Rund1132.exe] Number=8818 Confirmed=X Filename=Rund1132.exe Description=Added by the STARTPA-HS TROJAN! Source=Paul Collins Startup list [Rund1l32] Number=8819 Confirmed=X Filename=Winfi1e32.exe Description=Added by the MERTIAN WORM! Source=Paul Collins Startup list [Rundil32] Number=8820 Confirmed=X Filename=runlli32.exe Description=Added by the QQPASS-U TROJAN! Source=Paul Collins Startup list [Rundil32] Number=8821 Confirmed=X Filename=Updadv.exe Description=Added by the QQPASS-N TROJAN! Source=Paul Collins Startup list [rundl332] Number=8822 Confirmed=X Filename=math.exe ...pluged.exe Description=Added by the DOOMJUICE WORM! Source=Paul Collins Startup list [rundli32] Number=8823 Confirmed=X Filename=rundli32.exe Description=Added by the LADE WORM! Source=Paul Collins Startup list [RunDLL] Number=8824 Confirmed=X Filename=rundll32.exe bridge.dll, Load Description=Flingstone.com browser hijacker Source=Paul Collins Startup list [Rundll] Number=8825 Confirmed=X Filename=Rundll~.exe Description=Added by the DELF-KT TROJAN! Source=Paul Collins Startup list [Rundll] Number=8826 Confirmed=X Filename=rundll32.exe [random file name].dll "taskmon" Description=Added by the MYTOB.IG WORM! Source=Paul Collins Startup list [RunDll] Number=8827 Confirmed=X Filename=RunDll.exe Description=Added by the QQPASS-AH TROJAN! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [rundll***] Number=8828 Confirmed=X Filename=die.exe [path] mdll.exe Description=Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 Source=Paul Collins Startup list [rundll***] Number=8829 Confirmed=X Filename=die.exe [path] secure.bat Description=Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 Source=Paul Collins Startup list [rundll***] Number=8830 Confirmed=X Filename=die.exe [path] secure.exe Description=Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 Source=Paul Collins Startup list [rundll***] Number=8831 Confirmed=X Filename=die.exe [path] ttg.exe Description=Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946 Source=Paul Collins Startup list [Rundll16] Number=8832 Confirmed=X Filename=Rundll16.exe Description=Added by a number of VIRUSES, WORMS and TROJANS! Source=Paul Collins Startup list [Rundll32] Number=8833 Confirmed=X Filename=Rundll32.exe Description=Added by the DVLDR TROJAN! Note - this is not the valid "Rundll32.exe" as it's in the Windows\Fonts directory Source=Paul Collins Startup list [RUNDLL32] Number=8834 Confirmed=N Filename=RUNDLL32.EXE NvQtwk, NvCplDaemon Description=System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here) Source=Paul Collins Startup list [RunDLL32] Number=8835 Confirmed=N Filename=RunDLL32.exe NvMCTray.dll, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [rundll32] Number=8836 Confirmed=U Filename=Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings Description=Loads default settings for Leadtek Winfast graphics cards Source=Paul Collins Startup list [RunDLL32] Number=8837 Confirmed=X Filename=winupdate.exe Description=Added by an unidentified TROJAN! - possibly a BMBOT variant Source=Paul Collins Startup list [Rundll32] Number=8838 Confirmed=X Filename=Windows.exe Description=Added by the QQPASS.E TROJAN! Source=Paul Collins Startup list [Rundll32] Number=8839 Confirmed=U Filename=Rundll32.exe ptipbm.dll, SetWriteBack Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Tells the drivers that the connected Drives should use the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller Source=Paul Collins Startup list [rundll32] Number=8840 Confirmed=X Filename=[path to worm] Description=Added by the AUTEX WORM! Source=Paul Collins Startup list [rundll32] Number=8841 Confirmed=? Filename=rundll32.exe ptipbmf.dll, SetWriteCacheMode Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller Source=Paul Collins Startup list [rundll32] Number=8842 Confirmed=X Filename=rundll32.exe Description=Added by the SANKER WORM! Note that the valid "rundll32.exe" resides in C:\Windows\System32 wheras this version resides in C:\Windows Source=Paul Collins Startup list [rundll32] Number=8843 Confirmed=X Filename=csrss.exe Description=Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows folder Source=Paul Collins Startup list [rundll32] Number=8844 Confirmed=U Filename=RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Description=Associated with BlueTooth software, and registers the "Infrared Port properties" Control Panel applet. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup Source=Paul Collins Startup list [RUNDLL32] Number=8845 Confirmed=X Filename=rundl32.exe Description=Added by the DEMOTRY-A WORM! Source=Paul Collins Startup list [rundll32] Number=8846 Confirmed=X Filename=rundll32.exe Description=Added by the AGENT-EZ TROJAN! Note - the real rundll32.exe resides in the System (9x/Me) or System32 (NT/2K/XP) folder whereas this file is found in a "SHELLEXT" subfolder Source=Paul Collins Startup list [Rundll32] Number=8847 Confirmed=X Filename=RUNDDLL32.EXE Description=Added by the STARTPAGE.AXH TROJAN! Source=Paul Collins Startup list [Rundll32 cmicnfg] Number=8848 Confirmed=N Filename=Rundll32 cmicnfg.cpl, CMICtrlWnd Description=System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [RunDll32 essprops] Number=8849 Confirmed=Y Filename=RunDll32 essprops.cpl, TaskbarIconWnd Description=Associated with a Logitech mouse - required for proper operation Source=Paul Collins Startup list [Rundll32 P17] Number=8850 Confirmed=U Filename=Rundll32 P17.dll, P17Helper Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [Rundll32.exe] Number=8851 Confirmed=X Filename=Proyecto1.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [Rundll32.exe] Number=8852 Confirmed=X Filename=Root.exe Description=Added by the GRUEL WORM! Source=Paul Collins Startup list [Rundll32_7] Number=8853 Confirmed=X Filename=rundll32.exe MSIEFR40.DLL, DllRunServer Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Rundll32_8] Number=8854 Confirmed=X Filename=rundll32.exe inetp60.dll, DllRunServer Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Rundll32_8] Number=8855 Confirmed=X Filename=rundll32.exe 1.dll, DllRunServer Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [rundll64] Number=8856 Confirmed=X Filename=[path to worm] Description=Added by the AUTEX WORM! Source=Paul Collins Startup list [RundllSvr] Number=8857 Confirmed=X Filename=Rundll.exe Description=Added by the HUAYU WORM! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [Rundllsystem32] Number=8858 Confirmed=X Filename=Rundllsystem32.exe Description=Added by the NETDEVIL.B TROJAN! Source=Paul Collins Startup list [Rundnm] Number=8859 Confirmed=X Filename=Rundnm.exe Description=Added by the DELF-HA TROJAN! Source=Paul Collins Startup list [RUNGogoTools] Number=8860 Confirmed=X Filename=LaunchAdware.exe Description=GoGoTools adware Source=Paul Collins Startup list [RUNGogoTools] Number=8861 Confirmed=X Filename=GoGoLaunch.exe Description=GoGoTools adware Source=Paul Collins Startup list [RUNHYPER] Number=8862 Confirmed=X Filename=hyperx.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [runing] Number=8863 Confirmed=X Filename=win.exe Description=Added by the DELF-LC TROJAN! Source=Paul Collins Startup list [RUNLOAD] Number=8864 Confirmed=X Filename=l0ad.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [RUNLOUD] Number=8865 Confirmed=X Filename=loud.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Runmarc8mManager] Number=8866 Confirmed=U Filename=marc8m95.exe Description=MARC Sound System Manager for the Marc 8 MIDI sound card - allows for easy adjustment of the settings Source=Paul Collins Startup list [Runner] Number=8867 Confirmed=X Filename=lsass.exe [trojan filename] Description=Added by the DROWSY-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located the Winnt or Windows folder Source=Paul Collins Startup list [Runner] Number=8868 Confirmed=X Filename=csrss.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Runner] Number=8869 Confirmed=X Filename=lsass.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Runner] Number=8870 Confirmed=X Filename=svchost.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [runner1] Number=8871 Confirmed=X Filename=updater.exe Description=Added by the CRYPT.ULPM.GEN TROJAN! Source=Paul Collins Startup list [RunOnce] Number=8872 Confirmed=U Filename=RUNONCE.EXE Description=Part of MS Data Access Components - only required if you use these Source=Paul Collins Startup list [RunOnceEx] Number=8873 Confirmed=X Filename=sms.exe Description=Identified as the DELF.LF by Ewido Security Suite Source=Paul Collins Startup list [RunProg] Number=8874 Confirmed=X Filename=Server.exe Description=Added by the OPTIX.04.A TROJAN! Source=Paul Collins Startup list [RunProg] Number=8875 Confirmed=X Filename=wini.exe Description=Added by the OPTIX.04.D TROJAN! Source=Paul Collins Startup list [runreper] Number=8876 Confirmed=X Filename=viewer.exe Description=Added by the REPER.A VIRUS! Source=Paul Collins Startup list [runs] Number=8877 Confirmed=X Filename=run.exe Description=Added by the RBOT-BWF WORM! Source=Paul Collins Startup list [RunSearvices] Number=8878 Confirmed=X Filename=tread.exe Description=Identified as the DELF.LF by Ewido Security Suite Source=Paul Collins Startup list [RunServices] Number=8879 Confirmed=X Filename=runsvc32.exe Description=Added by the AGOBOT.QJ WORM! Source=Paul Collins Startup list [runSubvalues] Number=8880 Confirmed=X Filename=[path to file] Description=Added by the DLOADER-QY TROJAN! Source=Paul Collins Startup list [RunSysd32] Number=8881 Confirmed=U Filename=RunSysd32.exe Description=DesktopShield2000 by St�phane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within Source=Paul Collins Startup list [Runtime Process] Number=8882 Confirmed=X Filename=Csrss.exe Description=Added by the CIADOOR-J TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Runtt1] Number=8883 Confirmed=X Filename=Internat.exe Description=Added by the LINEAGE-R TROJAN! Source=Paul Collins Startup list [Runtt1] Number=8884 Confirmed=X Filename=Internet.exe Description=Added by the LINEAGE-Q TROJAN! Source=Paul Collins Startup list [RunWin] Number=8885 Confirmed=X Filename=[path to file] Description=Added by the BANKER-ES TROJAN! Source=Paul Collins Startup list [runwin32] Number=8886 Confirmed=X Filename=runwin32.exe Description=Added by the ESEARCH-A TROJAN! Source=Paul Collins Startup list [RUNWIN32] Number=8887 Confirmed=X Filename=runwin32.exe Description=Added by the VB-AET TROJAN! Source=Paul Collins Startup list [RunWindowsUpdate] Number=8888 Confirmed=X Filename=uptodate.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Run[0]] Number=8889 Confirmed=X Filename=syscnfg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:\windows\fonts (or C:\winnt\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Run_cd] Number=8890 Confirmed=X Filename=Run_cd.exe Description=Added by the GHOST.23 TROJAN! Source=Paul Collins Startup list [run_pbnext] Number=8891 Confirmed=Y Filename=PBNext.exe Description=PBNext is virtual phone system which offers the same functionality as expensive PBX hardware Source=Paul Collins Startup list [Rupsw32] Number=8892 Confirmed=U Filename=Rupsw32.exe Description=MegaTec Rups, UPS monitoring software - monitor and control DB9 UPS running on either Windows & Novell NetWare (with RUPS 2000) or Unix (with RUPS for Unix / Plus) operating systems Source=Paul Collins Startup list [RUSBHOLoader] Number=8893 Confirmed=? Filename=rundll32.exe RUSBHOLoader.dll, AutoRegister Description=?? Source=Paul Collins Startup list [RVC6Player] Number=8894 Confirmed=X Filename=tskdbg.exe Description=Added by the ZAPCHAS-M TROJAN! Source=Paul Collins Startup list [rvde] Number=8895 Confirmed=X Filename=N/A Description=Related to li-speed**** Source=Paul Collins Startup list [RVP] Number=8896 Confirmed=X Filename=bpc.exe Description=Spyware included with the latest version of Grokster. Also see here Source=Paul Collins Startup list [rx] Number=8897 Confirmed=X Filename=rundll32.exe Description=Added by the Lineage-BP TROJAN! Note - this is not the legitimate Windows process (Which is found in the Windows folder for 9x\Me and the System32 folder for NT\2K\XP). This file is found in the Windows or Winnt folder Source=Paul Collins Startup list [rx] Number=8898 Confirmed=X Filename=explore.exe Description=Added by the ZHENGTU-A TROJAN! Source=Paul Collins Startup list [RxMon] Number=8899 Confirmed=N Filename=rxmon9x.exe Description=Part of Dell Resolution Assistant - "a diagnostic program that allows you to contact Dell. When factory-installed by Dell, it allowed you to perform hardware and software diagnostics that provided alerts to potential problems and enabled real-time communication with Dell RA techs. You can now use RA only to contact Dell by e-mail" Source=Paul Collins Startup list [RxUser] Number=8900 Confirmed=N Filename=RxUser.exe Description=Part of Dell Resolution Assistant - "a diagnostic program that allows you to contact Dell. When factory-installed by Dell, it allowed you to perform hardware and software diagnostics that provided alerts to potential problems and enabled real-time communication with Dell RA techs. You can now use RA only to contact Dell by e-mail" Source=Paul Collins Startup list [rzt] Number=8901 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAGE.BDP TROJAN! Source=Paul Collins Startup list [r_server] Number=8902 Confirmed=Y Filename=r_server.exe Description=Radmin - remote admistrator server Source=Paul Collins Startup list [r_server] Number=8903 Confirmed=X Filename=service.exe Description=Added by the MULTIDR-CP TROJAN! Source=Paul Collins Startup list [S] Number=8904 Confirmed=X Filename=svhost.exe Description=Added by the AGOBOT-LN WORM! Source=Paul Collins Startup list [S0undMan] Number=8905 Confirmed=X Filename=svch0st.exe Description=Added by the LOVGATE.AB WORM! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [S24EvMon] Number=8906 Confirmed=? Filename=S24EvMon.exe Description=Event Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required? Source=Paul Collins Startup list [S3 Internal Chip] Number=8907 Confirmed=X Filename=s3serv.exe Description=Added by the AGOBOT-DD WORM! Source=Paul Collins Startup list [S3apphk] Number=8908 Confirmed=N Filename=S3apphk.exe Description=A tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems Source=Paul Collins Startup list [S3Hotkey] Number=8909 Confirmed=U Filename=s3hotkey.exe Description=Hotkey system tray icon to enable switching between monitors. Found on laptops with an S3 Twister integrated graphics card Source=Paul Collins Startup list [S3Mon] Number=8910 Confirmed=? Filename=S3Mon.exe Description=S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required? Source=Paul Collins Startup list [S3TRAY] Number=8911 Confirmed=N Filename=S3Tray.exe Description=S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display Source=Paul Collins Startup list [s3tray2] Number=8912 Confirmed=? Filename=s3tray2.exe Description=Same as the s3tray entry in this table? Source=Paul Collins Startup list [S3TRAYHP] Number=8913 Confirmed=? Filename=S3trayhp.exe Description=S3 Video driver related. What does it do and is it required? Source=Paul Collins Startup list [S4F] Number=8914 Confirmed=U Filename=S4F.exe Description=FilterPak from S4F, Inc - internet filtering software Source=Paul Collins Startup list [s4helper] Number=8915 Confirmed=X Filename=s4helper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [SA] Number=8916 Confirmed=? Filename=Sa3.exe Description=Logitech QuickCam driver. Is it required? Source=Paul Collins Startup list [SA Service] Number=8917 Confirmed=? Filename=SAservice.exe Description=Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required? Source=Paul Collins Startup list [Sa3dsrv] Number=8918 Confirmed=N Filename=Sa3dsrv.exe Description=3D sound extension for Windows Source=Paul Collins Startup list [saap] Number=8919 Confirmed=X Filename=saap.exe Description=NCase adware Source=Paul Collins Startup list [Sabreserver] Number=8920 Confirmed=N Filename=SABSERV.EXE Description=Airline reservation software from Sabre. Available via Start -> Programs Source=Paul Collins Startup list [sac] Number=8921 Confirmed=X Filename=sac.exe Description=NCase adware Source=Paul Collins Startup list [SACC] Number=8922 Confirmed=X Filename=sacc.exe Description=SurfAccuracy adware Source=Paul Collins Startup list [SAClient] Number=8923 Confirmed=N Filename=RegCon.exe Description=AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected, you're immediately notified by e-mail, pager, or text messaging Source=Paul Collins Startup list [Safe] Number=8924 Confirmed=X Filename=SafeWin.exe Description=Added by the FOCOSENHA TROJAN! Source=Paul Collins Startup list [Safe] Number=8925 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-DT TROJAN! Source=Paul Collins Startup list [SafeGuard Popup Blocker Updater] Number=8926 Confirmed=X Filename=regsvr32 [path] sfgupd.dll Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [SafeGuard Popup Blocker Updater (required)] Number=8927 Confirmed=X Filename=regsvr32 [path] sfg****.dll [* = ramdom char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [SafeGuard Popup Updater (required)] Number=8928 Confirmed=X Filename=regsvr32 [path] sfg****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [SafeGuard Popup Updater (required)] Number=8929 Confirmed=X Filename=regsvr32 [path] PDF****.dll [* = random char] Description=SafeguardProtect/Veevo hijacker Source=Paul Collins Startup list [SafeHouseSystemTray] Number=8930 Confirmed=U Filename=SDWTRAY.EXE Description=SafeHouse "Personal Privacy" system tray icon - PP protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encrypted Source=Paul Collins Startup list [SafeInstall.exe] Number=8931 Confirmed=N Filename=SAFEIN~1.EXE Description=Monitors a download and ensures an newer version of a file isn't replaced by an older one Source=Paul Collins Startup list [SafeOFF] Number=8932 Confirmed=N Filename=SafeOff.exe Description=Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation Source=Paul Collins Startup list [SafeSearch] Number=8933 Confirmed=X Filename=safesearch.exe Description=SafeSearch.A adware Source=Paul Collins Startup list [SafeSurfingUpdate] Number=8934 Confirmed=X Filename=SSUpdate.exe Description=MoneyTree parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [SafetyNet] Number=8935 Confirmed=U Filename=ipcTray.exe Description=Safety.Net from Netveda - "offers Internet security, content security and advanced Internet firewall protection for all your LAN computers, and trust controls to block unwanted or harmful applications from accessing the network" Source=Paul Collins Startup list [SafetyNet_Notifier] Number=8936 Confirmed=U Filename=ipcLn.exe Description=Safety.Net from Netveda - "offers Internet security, content security and advanced Internet firewall protection for all your LAN computers, and trust controls to block unwanted or harmful applications from accessing the network" Source=Paul Collins Startup list [Safeworld] Number=8937 Confirmed=U Filename=Freedom.exe Description=SafeWorld Internet Security - now no longer available Source=Paul Collins Startup list [Sagate Security Firewall] Number=8938 Confirmed=X Filename=sagate.exe Description=Added by the GAOBOT.BOW WORM! Source=Paul Collins Startup list [SAgent2ExePath] Number=8939 Confirmed=N Filename=SAgent2.exe Description=Seiko Epson printer status agent. Disable if printer is not used often Source=Paul Collins Startup list [SAGENTSERVICE] Number=8940 Confirmed=U Filename=Sagent.exe Description=TinySpyAgent commercial keystroke logger. Uninstall this software if you did not install it yourself Source=Paul Collins Startup list [sagnt] Number=8941 Confirmed=X Filename=sagnt.exe Description=Adware web downloader Source=Paul Collins Startup list [SAHagent] Number=8942 Confirmed=X Filename=Sahagent.exe Description=ShopAtHomeSelect parasite Source=Paul Collins Startup list [SAHBundle] Number=8943 Confirmed=X Filename=bundle.exe Description=ShopAtHomeSelect parasite Source=Paul Collins Startup list [SAHBundle] Number=8944 Confirmed=X Filename=shop1003.exe Description=ShopAtHomeSelect parasite Source=Paul Collins Startup list [saie] Number=8945 Confirmed=X Filename=saie.exe Description=NCase adware Source=Paul Collins Startup list [SAIMON] Number=8946 Confirmed=U Filename=SaiMon.exe Description=Saitek joystick driver Source=Paul Collins Startup list [sain] Number=8947 Confirmed=X Filename=sain.exe Description=NCase adware Source=Paul Collins Startup list [sais] Number=8948 Confirmed=X Filename=sais.exe Description=NCase adware Source=Paul Collins Startup list [SaiSmart] Number=8949 Confirmed=? Filename=SaiSmart.exe Description="Smart Button Special Sauce" - included with the latest software for Saitek game controllers. Related to the "S", "Shift" or "Smart" button and gives gamers extra features on the buttons. Only required if you use this feature Source=Paul Collins Startup list [SaitekAutoConfigure] Number=8950 Confirmed=U Filename=saicnfig.exe Description=Configuration for Saitek game controllers Source=Paul Collins Startup list [Sakemsneql] Number=8951 Confirmed=X Filename=simenu.exe Description=Added by the SDBOT.BTO WORM! Source=Paul Collins Startup list [salm] Number=8952 Confirmed=X Filename=salm.exe Description=180Search adware Source=Paul Collins Startup list [salm] Number=8953 Confirmed=X Filename=salm.exe Description=NCase adware Source=Paul Collins Startup list [Sam-sung] Number=8954 Confirmed=X Filename=Sam-sung.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [SAMcal] Number=8955 Confirmed=U Filename=SAMcal.exe Description=SamCal - calendar/reminder program Source=Paul Collins Startup list [Sametime Connect] Number=8956 Confirmed=U Filename=Connect.exe Description=IBM Lotus Sametime - instant messaging and Web conferencing software Source=Paul Collins Startup list [Samsong] Number=8957 Confirmed=X Filename=Samsong.exe Description=Added by the SDBOT.BNE WORM! Source=Paul Collins Startup list [Samsung] Number=8958 Confirmed=X Filename=Samsungs.exe Description=Added by an IRC TROJAN variant! Source=Paul Collins Startup list [SandboxieControl] Number=8959 Confirmed=U Filename=Control.exe Description=SandBoxie - allows data to be read from the hard drive by an application but never written back unless you allow it Source=Paul Collins Startup list [SandIcon] Number=8960 Confirmed=N Filename=SandIcon.exe Description=SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds, but once the software sees there's no reader, you get back the resources Source=Paul Collins Startup list [SANS Service] Number=8961 Confirmed=X Filename=sansv.exe Description=Added by the VANEBOT-AH WORM! Source=Paul Collins Startup list [sapp] Number=8962 Confirmed=X Filename=sapp.exe Description=NCase adware Source=Paul Collins Startup list [SaskTel Accelerated Dial-up] Number=8963 Confirmed=U Filename=sasktelgui.exe Description="Experience faster surfing, downloading and e-mail by adding SaskTel Accelerated Dial-up Internet" Source=Paul Collins Startup list [saSyncMgr] Number=8964 Confirmed=X Filename=rundll32.exe sasync.dll, SyncWait Description=Browser hijacker - redirecting to Searchant.com Source=Paul Collins Startup list [SATARaid] Number=8965 Confirmed=U Filename=SATARaid.exe Description=RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives Source=Paul Collins Startup list [satmat] Number=8966 Confirmed=X Filename=satmat.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [sau] Number=8967 Confirmed=X Filename=sau.exe Description=180Solutions adware related Source=Paul Collins Startup list [SAUpdate] Number=8968 Confirmed=U Filename=SAUpdate.exe Description=Big Brother from Quest Software. System and network monitor Source=Paul Collins Startup list [SAutoLaunchExe] Number=8969 Confirmed=U Filename=SAutoLaunchExe.exe Description=Sharp Zaurus PDA related, needed to synchronize information with a Desktop or Notebook Source=Paul Collins Startup list [SAVAgent] Number=8970 Confirmed=Y Filename=SAVAgent.exe Description=Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly, e.g. automatically updating PCs used by dial-in home or out-of-office users Source=Paul Collins Startup list [Save] Number=8971 Confirmed=X Filename=Save.exe Description=WhenU.Save adware Source=Paul Collins Startup list [SaveDate] Number=8972 Confirmed=X Filename=SaveStartDate.Exe Description=Unidentified adware Source=Paul Collins Startup list [Savenow] Number=8973 Confirmed=X Filename=SaveNow.exe Description=WhenU.Save adware Source=Paul Collins Startup list [Savenow] Number=8974 Confirmed=X Filename=savenow.exe Description=Added by the SPREDA.B VIRUS! Source=Paul Collins Startup list [SAW] Number=8975 Confirmed=X Filename=saw.exe Description=SmartAdware adware Source=Paul Collins Startup list [Say The Time 5.0] Number=8976 Confirmed=U Filename=SAYTIME.EXE Description=This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularly Source=Paul Collins Startup list [SB] Number=8977 Confirmed=U Filename=SB.exe Description=Acer Soft Button on Acer Tablet PCs Source=Paul Collins Startup list [SB Audigy 2 Startup Menu] Number=8978 Confirmed=N Filename=/l:eng Description=Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it's easily available using the search function Source=Paul Collins Startup list [SB Watchdog] Number=8979 Confirmed=X Filename=SBWatchdog.exe Description=Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank Source=Paul Collins Startup list [SB13mini] Number=8980 Confirmed=X Filename=RYZO32.EXE Description=Added by the SPYBOT-EJ WORM! Source=Paul Collins Startup list [SBAutoUpdate] Number=8981 Confirmed=U Filename=sbautoupdate.exe Description=SpywareBlaster auto-updater Source=Paul Collins Startup list [SBC Self Support Tool] Number=8982 Confirmed=U Filename=matcli.exe Description=matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. The SBC Self Support Tool is required to run with the Help and Support program. If you uncheck SBC and and then run Help and Support it will add another SBC entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [SBC Yahoo! Connection Manager] Number=8983 Confirmed=N Filename=ConnectionManager.exe Description=Used to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection Source=Paul Collins Startup list [SBCSTray] Number=8984 Confirmed=U Filename=SBCSTray.exe Description=System Tray access to CounterSpy anti-spyware from Sunbelt Software Source=Paul Collins Startup list [SBDrvDet] Number=8985 Confirmed=U Filename=SBDrv.exe Description=Detects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one Source=Paul Collins Startup list [sbdrvdet] Number=8986 Confirmed=N Filename=sbdrvdet.exe Description=Checks to see if Creative sound card driver should be updated Source=Paul Collins Startup list [SBHC] Number=8987 Confirmed=X Filename=sbhc.exe Description=SuperBar parasite - uninstall available here Source=Paul Collins Startup list [SBMPOP] Number=8988 Confirmed=X Filename=SBMPop.exe Description=SearchByMedia adware Source=Paul Collins Startup list [SBMX] Number=8989 Confirmed=N Filename=sbmx.exe Description=SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only) Source=Paul Collins Startup list [sbss Launcher] Number=8990 Confirmed=X Filename=sbss.exe Description=SideBySide adware Source=Paul Collins Startup list [SbUsb AudCtrl] Number=8991 Confirmed=U Filename=RunDll32 sbusbdll.dll, RCMonitor Description=Control for Soundblaster MP3 external (USB) sound card Source=Paul Collins Startup list [sc] Number=8992 Confirmed=N Filename=scrubxp.exe Description=ScrubXP - utility that deletes safe to remove files, cookies, browsing history, etc Source=Paul Collins Startup list [sc] Number=8993 Confirmed=U Filename=sc.exe Description=Watchdog 2.0 Software - monitoring program Source=Paul Collins Startup list [sc] Number=8994 Confirmed=U Filename=run.exe Description=All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes, remembers addresses of Internet pages visited, and maintains a log file listing all applicationsrun on the computer. It can create screenshots and record sounds from the computer's microphone to a sound file Source=Paul Collins Startup list [sc23exec] Number=8995 Confirmed=? Filename=sc23exec.exe Description=Possibly related to a digital camera Source=Paul Collins Startup list [SC3300CC] Number=8996 Confirmed=Y Filename=SC3300CC.exe Description=SiPix digital camera Twain device driver Source=Paul Collins Startup list [scain] Number=8997 Confirmed=X Filename=s030109.Stub.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [ScamDisk] Number=8998 Confirmed=X Filename=SVOHOST.exe Description=Added by the LEWOR.D WORM! Source=Paul Collins Startup list [scan] Number=8999 Confirmed=X Filename=mscman.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [Scan Detector] Number=9000 Confirmed=? Filename=Pmxdetect.exe Description=Associated with PrimaScan scanners. Is it required? Source=Paul Collins Startup list [Scan Register] Number=9001 Confirmed=X Filename=ssms.exe Description=Added by the RBOT-AT WORM! Source=Paul Collins Startup list [Scan Wizard] Number=9002 Confirmed=? Filename=button.exe Description=Associated with ScanWizard as supplied with Microtek scanners - see also Scanner Detector or SDetect. What does it do and is it required? Source=Paul Collins Startup list [ScanDisc] Number=9003 Confirmed=X Filename=satan.exe Description=Added by the GREGSTAR TROJAN! Source=Paul Collins Startup list [ScanDisk] Number=9004 Confirmed=X Filename=ScanDisk.exe Description=Added by the GANDA.A WORM! Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checker Source=Paul Collins Startup list [scands32.exe] Number=9005 Confirmed=X Filename=scands32.exe Description=Added by a variant of the ADCLICKER TROJAN! Source=Paul Collins Startup list [Scandsk2] Number=9006 Confirmed=X Filename=scandsk2.exe Description=Added by the AGOBOT-PK WORM! Source=Paul Collins Startup list [scandskx.exe] Number=9007 Confirmed=X Filename=scandskx.exe Description=Added by the DLOADR-ARM TROJAN! Source=Paul Collins Startup list [ScanFile] Number=9008 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [ScanInicio] Number=9009 Confirmed=Y Filename=Inicio.exe Description=Part of Panda Antivirus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active Source=Paul Collins Startup list [Scanner Detector] Number=9010 Confirmed=N Filename=SDetect.exe Description=ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button Source=Paul Collins Startup list [Scanner File Utility] Number=9011 Confirmed=Y Filename=NsCatCom.exe Description=Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation Source=Paul Collins Startup list [ScanPanel] Number=9012 Confirmed=? Filename=ScanPanel.exe Description=Trust Easy Webscan scanner related - what does it do and is it required? Source=Paul Collins Startup list [Scanreg] Number=9013 Confirmed=X Filename=[filename] Description=Added by the QQPASS.E TROJAN! Source=Paul Collins Startup list [ScanRegistry] Number=9014 Confirmed=X Filename=nsrvnt.exe Description=Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe Source=Paul Collins Startup list [ScanRegistry] Number=9015 Confirmed=X Filename=scanregv.exe Description=Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe Source=Paul Collins Startup list [ScanRegistry] Number=9016 Confirmed=Y Filename=Scanregw.exe Description=Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:\Windows or C:\Winnt) Source=Paul Collins Startup list [ScanRegistry] Number=9017 Confirmed=X Filename=Scanregw.exe Description=Added by the STATOR WORM! Not to be confused with the legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%\System (where %windir% is the Windows directory - C:\Windows or C:\Winnt). Runs from the registry RunServices key as opposed to the Run key Source=Paul Collins Startup list [ScanRegistry] Number=9018 Confirmed=X Filename=N/A Description=Added by the DINOXI or DINOXI.B WORMS! Source=Paul Collins Startup list [ScanRegistry] Number=9019 Confirmed=X Filename=scanregw.exe Description=Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in the System (9x/ME) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [ScanRegistry] Number=9020 Confirmed=X Filename=update.exe Description=Added by the DWNLDR-FZY TROJAN! Source=Paul Collins Startup list [ScanSpyware v *] Number=9021 Confirmed=N Filename=Scanner.exe Description=Spyware remover (where * = the version number) - not recommended, see here Source=Paul Collins Startup list [scApp] Number=9022 Confirmed=X Filename=scApp.exe Description=Added by the STANDO-E WORM! Source=Paul Collins Startup list [SCardSvr] Number=9023 Confirmed=N Filename=scardsvr.exe Description=Related to SmartCard readers and sometimes uses lots of system resources Source=Paul Collins Startup list [SCardSvr] Number=9024 Confirmed=X Filename=SCardSvr32.Exe Description=Added by the MOFEI.B WORM! Source=Paul Collins Startup list [SCDEmuApp.exe] Number=9025 Confirmed=U Filename=SCDEmuApp.exe Description=Related to PowerISO - CD/DVD image file processing tool Source=Paul Collins Startup list [scheck45] Number=9026 Confirmed=X Filename=scheck45.exe Description=Related to unknown malware - hidden installer associated with it Source=Paul Collins Startup list [schedm] Number=9027 Confirmed=U Filename=schedm.exe Description=Part of Antivir PersonalEdition Classic anti-virus Source=Paul Collins Startup list [ScheduIe] Number=9028 Confirmed=X Filename=nrchk.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [ScheduIr] Number=9029 Confirmed=X Filename=msexploren.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ScheduIr] Number=9030 Confirmed=X Filename=shch.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ScheduIr] Number=9031 Confirmed=X Filename=svchst.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ScheduIr] Number=9032 Confirmed=X Filename=winagent.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Schedule] Number=9033 Confirmed=U Filename=Schedule.exe Description=Scheduler for Mercury Ez View TV Tuner Card Source=Paul Collins Startup list [Scheduled Maintenance] Number=9034 Confirmed=N Filename=Scheduled_Maintenance.exe Description=Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs Source=Paul Collins Startup list [Scheduler] Number=9035 Confirmed=X Filename=expIorer.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9036 Confirmed=X Filename=MSMSGS.EXE Description=Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in the Windows\System32\Config or Winnt\System32\Config folder, and should not be mistaken for the MSN Messenger file of the same name! Source=Paul Collins Startup list [Scheduler] Number=9037 Confirmed=X Filename=outIook.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9038 Confirmed=X Filename=svcrhost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9039 Confirmed=X Filename=svcshost.exe Description=Added by the TACTSLAY.A TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9040 Confirmed=X Filename=winagent.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9041 Confirmed=U Filename=Scheduler daemon.exe Description=Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleanings Source=Paul Collins Startup list [Scheduler] Number=9042 Confirmed=X Filename=msnexploren.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9043 Confirmed=X Filename=sdhch.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [Scheduler] Number=9044 Confirmed=X Filename=svchst.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [Scheduler Service] Number=9045 Confirmed=X Filename=wsass.exe Description=Added by the LIOTEN.KX WORM! Source=Paul Collins Startup list [SchedulerMgr] Number=9046 Confirmed=X Filename=navchk.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [Scheduling Agent] Number=9047 Confirmed=X Filename=Scheduler.exe Description=Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect Source=Paul Collins Startup list [SchedulingAgant] Number=9048 Confirmed=X Filename=MMTASK.EXE Description=Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename Source=Paul Collins Startup list [SchedulingAgent] Number=9049 Confirmed=U Filename=mstask.exe Description=MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans Source=Paul Collins Startup list [SchedulingAgent] Number=9050 Confirmed=U Filename=mstinit.exe Description=MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans Source=Paul Collins Startup list [SchedulingAgent] Number=9051 Confirmed=X Filename=N/A Description=Added by the DINOXI or DINOXI.B WORMS! Source=Paul Collins Startup list [Schmaili] Number=9052 Confirmed=U Filename=Schmaili.exe Description=Schmaili - insert animated smilies into your e-mail Source=Paul Collins Startup list [schost] Number=9053 Confirmed=X Filename=[path to trojan] Description=Added by the TJSERV.D TROJAN! Source=Paul Collins Startup list [SchSvr] Number=9054 Confirmed=N Filename=SchSvr.exe Description=WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [SCHWIZEX] Number=9055 Confirmed=Y Filename=SCHWIZEX.EXE Description=Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot Source=Paul Collins Startup list [ScManager] Number=9056 Confirmed=X Filename=scman.exe Description=Added by the FORBOT-CW WORM! Source=Paul Collins Startup list [scopedll] Number=9057 Confirmed=X Filename=scopedll.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [Scotia OnLine Recovery] Number=9058 Confirmed=N Filename=etdirrcv.exe Description=Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process Source=Paul Collins Startup list [Scotia OnLine Security v*.* Recovery] Number=9059 Confirmed=N Filename=etdirrcv.exe Description=Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process Source=Paul Collins Startup list [Scr] Number=9060 Confirmed=X Filename=scr.scr Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [ScrapPad] Number=9061 Confirmed=N Filename=Scrappad.exe Description=ScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper Source=Paul Collins Startup list [scrbmk] Number=9062 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-VP TROJAN! Source=Paul Collins Startup list [Screen Calendar] Number=9063 Confirmed=U Filename=scrcal.exe Description=Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler Source=Paul Collins Startup list [Screen Guard] Number=9064 Confirmed=U Filename=launch.exe Description=Part of Access Denied security and privacy software Source=Paul Collins Startup list [Screen Guard Message Scan] Number=9065 Confirmed=U Filename=sgms.exe Description=Part of Access Denied security and privacy software Source=Paul Collins Startup list [Screen Saver] Number=9066 Confirmed=X Filename=scrnsaver.scr Description=Added by the RBOT-AGP WORM! Source=Paul Collins Startup list [Screen Saver Control] Number=9067 Confirmed=N Filename=FSScrCtl.exe Description=Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon Source=Paul Collins Startup list [ScreenHunter 4.0 Free] Number=9068 Confirmed=N Filename=ScreenHunter.exe Description="ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots" Source=Paul Collins Startup list [ScreenPrint32] Number=9069 Confirmed=N Filename=ScreenPrint32.exe Description=ScreenPrint32 screen capture software - can be launched manually Source=Paul Collins Startup list [screxe] Number=9070 Confirmed=? Filename=scruser2k.exe Description=?? Source=Paul Collins Startup list [script] Number=9071 Confirmed=? Filename=script.bat Description=Maybe associated with DOS on a Win9x machine Source=Paul Collins Startup list [ScriptBlocking] Number=9072 Confirmed=Y Filename=SBServ.exe Description=Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information Source=Paul Collins Startup list [ScriptSentry] Number=9073 Confirmed=Y Filename=Scriptsentry.exe Description=Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly Source=Paul Collins Startup list [Scroll-In-Mouse V2.0] Number=9074 Confirmed=U Filename=SCROLL.EXE Description=Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features Source=Paul Collins Startup list [scrss] Number=9075 Confirmed=X Filename=scrss.exe Description=Added by the HACDEF-R TROJAN! Source=Paul Collins Startup list [scrsvc] Number=9076 Confirmed=X Filename=scrsvc.exe Description=Added by the AGENT-DS TROJAN! Source=Paul Collins Startup list [ScrSvr] Number=9077 Confirmed=X Filename=ScrSvr.exe Description=Added by the OPASERV WORM! Source=Paul Collins Startup list [ScrSvrOld] Number=9078 Confirmed=X Filename=[worm filename] Description=Added by the OPASERV WORM! Source=Paul Collins Startup list [Scsi] Number=9079 Confirmed=Y Filename=Scsi.exe Description=SCSI Miniport driver Source=Paul Collins Startup list [sctrlmgr] Number=9080 Confirmed=X Filename=sescmgr.exe Description=Added by a variant of the DWNLDR-GAH TROJAN! Source=Paul Collins Startup list [scvhost] Number=9081 Confirmed=X Filename=svzhost.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [scvhost] Number=9082 Confirmed=U Filename=scvhost.exe Description=Wiretap surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [scvhost loader] Number=9083 Confirmed=X Filename=ixplore.exe Description=Added by the SDBOT-CY TROJAN! Source=Paul Collins Startup list [scvhost.exe] Number=9084 Confirmed=X Filename=scvhost.exe Description=Added by the LOHAV-N TROJAN! Source=Paul Collins Startup list [sd32info] Number=9085 Confirmed=X Filename=sd32info.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [SDaemon] Number=9086 Confirmed=U Filename=sdaemon.exe Description=PC Security from Tropical Software. 'PC Security� 5.1 is the ultimate in computer security, offering multiple locking systems for the Windows environment and internet. Lock files, monitor programs' activities, even detect intruders! PC Security� offers flexible and complete password protection, "Drag and Drop" support, plus many other handy features' Source=Paul Collins Startup list [SDAutoLiveupdate] Number=9087 Confirmed=U Filename=LiveUpdateSD.exe Description=Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Source=Paul Collins Startup list [SDAv] Number=9088 Confirmed=X Filename=csnss.exe Description=Added by the SERFLOG.C WORM! Source=Paul Collins Startup list [SDAv] Number=9089 Confirmed=X Filename=svhost.exe Description=Added by the SERFLOG.C WORM! Source=Paul Collins Startup list [sdchosts32] Number=9090 Confirmed=X Filename=vbdd.exe Description=Added by the RANKY.AG TROJAN! Source=Paul Collins Startup list [SDClientMonitor] Number=9091 Confirmed=? Filename=sdclientmonitor.exe Description=Related to LANDesk Management Suite from LANDesk Software Ltd. What does it do and is it required? Source=Paul Collins Startup list [SDetect] Number=9092 Confirmed=N Filename=SDetect.exe Description=ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button Source=Paul Collins Startup list [sdfsdfsdf] Number=9093 Confirmed=X Filename=sp2update.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [SDIN Adapter] Number=9094 Confirmed=X Filename=sdin.exe Description=Added by the FORBOT-AP WORM! Source=Paul Collins Startup list [SDJobCheck] Number=9095 Confirmed=? Filename=triggusr.exe Description=Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup? Source=Paul Collins Startup list [SDK Codre Function22] Number=9096 Confirmed=X Filename=sdkimddprovment2.exe Description=Added by the SDBOT-YJ WORM! Source=Paul Collins Startup list [SDK Core Component] Number=9097 Confirmed=X Filename=sdkcore.exe Description=Added by the SDBOT-WC WORM! Source=Paul Collins Startup list [SDK Core Function] Number=9098 Confirmed=X Filename=sdkimprovment.exe Description=Added by the RBOT.BHL WORM! Source=Paul Collins Startup list [SDK Core Function2] Number=9099 Confirmed=X Filename=sdkimprovment2.exe Description=Added by the SPYBOT.OGX WORM! Source=Paul Collins Startup list [Sdk**.exe [* = random char]] Number=9100 Confirmed=X Filename=Sdk**.exe [* = random char] Description=Sdk**.exe [* = random char] Source=Paul Collins Startup list [Sdk**.exe [* = random char]] Number=9101 Confirmed=X Filename=Sdk**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Sdk**32.exe [* = random char]] Number=9102 Confirmed=X Filename=Sdk**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [SDKcore Update Components2] Number=9103 Confirmed=X Filename=SDKC0R3.exe Description=Added by the RBOT-ABA WORM! Source=Paul Collins Startup list [sdkupdate22] Number=9104 Confirmed=X Filename=SDK0mCORE.exe Description=Added by the FORBOT-DT WORM! Source=Paul Collins Startup list [SDPhotoBar.exe] Number=9105 Confirmed=N Filename=SDPhotoBar.exe Description=SmartDraw Photo (now FotoFinsh) - "organize, enhance, print, and share your photos. It's also a powerful graphic editor for creating images and web graphics" Source=Paul Collins Startup list [SDR6_Check] Number=9106 Confirmed=N Filename=udcsdr.exe Description=DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks Source=Paul Collins Startup list [sdrss] Number=9107 Confirmed=X Filename=sdrss.exe Description=Added by the SDBOT-SQ WORM! Source=Paul Collins Startup list [sds20] Number=9108 Confirmed=U Filename=svchost.exe Description=InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this should not be confused with the svchost.exe system process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder! This file is located in a "sds20" folder Source=Paul Collins Startup list [SDTray] Number=9109 Confirmed=U Filename=sdtray.exe Description=RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic, confidential and digitally signed Source=Paul Collins Startup list [SDTray] Number=9110 Confirmed=U Filename=SDTrayApp.exe Description=Spyware Doctor spyware remover - system tray access Source=Paul Collins Startup list [sdxsys32] Number=9111 Confirmed=X Filename=sdxsys32.exe Description=Added by the BROGGER-A TROJAN! Source=Paul Collins Startup list [sealmon] Number=9112 Confirmed=U Filename=sealmon.exe Description=SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Email Source=Paul Collins Startup list [Search Bar] Number=9113 Confirmed=X Filename=taskbar.exe Description=Added by the OPANKI-F WORM! Source=Paul Collins Startup list [Search Hook] Number=9114 Confirmed=? Filename=srchhook.exe Description=?? Source=Paul Collins Startup list [Search Page] Number=9115 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [Search-Exe] Number=9116 Confirmed=X Filename=SE.exe Description=Search-Exe hijacker Source=Paul Collins Startup list [Search.vbs] Number=9117 Confirmed=X Filename= Description=Hijacker Source=Paul Collins Startup list [searchbar] Number=9118 Confirmed=X Filename=vnmispoisn downloader.exe Description=SearchBarCash adware variant Source=Paul Collins Startup list [SearchEnhancement] Number=9119 Confirmed=X Filename=scbar.exe Description=SCBar foistware Source=Paul Collins Startup list [searchnav] Number=9120 Confirmed=X Filename=searchnav.exe Description=SearchNav adware - IEFeatures/Popnav variant Source=Paul Collins Startup list [SearchNavVersion] Number=9121 Confirmed=X Filename=searchnavversion.exe Description=SearchNav adware - IEFeatures/Popnav variant Source=Paul Collins Startup list [SearchNet_Up] Number=9122 Confirmed=X Filename=ServeUp.exe Description=SearchNet adware Source=Paul Collins Startup list [SearchSetter] Number=9123 Confirmed=X Filename=searchsetter[1].exe Description=Browser hijacker - redirecting to FindWhateverNow.com Source=Paul Collins Startup list [SearchSquire[number]] Number=9124 Confirmed=X Filename=SearchSquire[number].exe Description=SearchSquire adware Source=Paul Collins Startup list [SearchUpgrader] Number=9125 Confirmed=X Filename=SearchUpgrader.exe Description=Hijacker Source=Paul Collins Startup list [Secboot] Number=9126 Confirmed=X Filename=w32tm.exe Description=Added by the HAXDOOR.D TROJAN! Source=Paul Collins Startup list [secboot] Number=9127 Confirmed=X Filename=mszx23.exe Description=Added by a variant of the HAXDOOR.BC TROJAN! Source=Paul Collins Startup list [secboot] Number=9128 Confirmed=X Filename=vtd 16.exe Description=Added by the HAXDOOR-AE TROJAN! Source=Paul Collins Startup list [Second Copy 2000] Number=9129 Confirmed=U Filename=SecCopy.exe Description=Related to Second Copy� - a files/folders backup utility Source=Paul Collins Startup list [SecondChance] Number=9130 Confirmed=U Filename=sctray.exe Description=Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash Source=Paul Collins Startup list [Secret] Number=9131 Confirmed=X Filename=Secret.exe Description=Added by the DELF-LW TROJAN! Source=Paul Collins Startup list [Secret-Crush] Number=9132 Confirmed=X Filename=start.exe Description=Hijacker that may reset your browser's home page and/or search settings to point to undesired sites Source=Paul Collins Startup list [SECRETMAKER] Number=9133 Confirmed=U Filename=secretmaker.exe Description=Secretmaker is a combonation of eight privacy-defending programs, including Spam Fighter Pro, Worm Hunter, Pop-Up Killer, Banner Blocker, Cookie Eraser, Privacy Protector, History Cleaner, and Garbage Cleaner Source=Paul Collins Startup list [SecretSmileys] Number=9134 Confirmed=U Filename=ss.exe Description="Secret Smileys is an add-on for AIM that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as logging of IM conversations, and it gets rid of that annoying advertisement on your buddy list window" Source=Paul Collins Startup list [secserv.exe] Number=9135 Confirmed=X Filename=secserv.exe Description=Reported by Panda as an EasySearch Adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer Source=Paul Collins Startup list [secsvc32] Number=9136 Confirmed=X Filename=secsvcnt.exe Description=Added by the GLOBAL PATROL TROJAN! Source=Paul Collins Startup list [Secsys] Number=9137 Confirmed=U Filename=Secsys.exe Description=UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself! Source=Paul Collins Startup list [secure] Number=9138 Confirmed=X Filename=secure.exe Description=DealHelper adware Source=Paul Collins Startup list [secure] Number=9139 Confirmed=X Filename=svshost.exe Description=Added by the RBOT-AFO WORM! Source=Paul Collins Startup list [secure socket layer] Number=9140 Confirmed=X Filename=wins32a.exe Description=Added by an IRCBOT TROJAN! Source=Paul Collins Startup list [Secure Socket Layer Certification] Number=9141 Confirmed=X Filename=sslcert.exe Description=Added by the VANEBOT-AN WORM! Source=Paul Collins Startup list [Secure System] Number=9142 Confirmed=X Filename=integitor.exe Description=Added by the AGOBOT.ACI WORM! Source=Paul Collins Startup list [SecureClean4RegManager] Number=9143 Confirmed=N Filename=scregmanager4.exe Description=WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data, MRUs, temp files and more. Can be started manually Source=Paul Collins Startup list [SecureClean4Tray] Number=9144 Confirmed=N Filename=sctray4.exe Description=WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data, MRUs, temp files and more. Can be started manually Source=Paul Collins Startup list [SecureCleanIEClean] Number=9145 Confirmed=N Filename=SCIEClean.exe Description=SecureClean - scans your system for hidden temporary files, deleted email messages, Internet histories and caches Source=Paul Collins Startup list [SecureItPro] Number=9146 Confirmed=U Filename=Secureitpro470p.exe Description=SecureIt Pro - lock your computer when you're not there, to stop malicious users from accessing your desktop Source=Paul Collins Startup list [SecureLogin] Number=9147 Confirmed=X Filename=Mslg32.exe Description=Added by the REDZED WORM! Source=Paul Collins Startup list [SecureOnlineAccountNumbers] Number=9148 Confirmed=U Filename=SOAN.exe Description=Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions Source=Paul Collins Startup list [Security] Number=9149 Confirmed=X Filename=WindowsSecurityUpdate.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Security Accounts Manager SM] Number=9150 Confirmed=X Filename=samsm.exe Description=Added by the SPYBOT.JE WORM! Source=Paul Collins Startup list [Security Agent] Number=9151 Confirmed=X Filename=securag.exe Description=Added by the BANCBAN-F TROJAN! Source=Paul Collins Startup list [Security Agent Manager] Number=9152 Confirmed=X Filename=mssams.exe Description=Added by the RBOT-SV WORM! Source=Paul Collins Startup list [Security Center] Number=9153 Confirmed=X Filename=AppControl.exe Description=Added by the SDBOT.CFT WORM! Source=Paul Collins Startup list [Security iGuard] Number=9154 Confirmed=N Filename=Security iGuard.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Security Manager] Number=9155 Confirmed=U Filename=SecurityManager.exe Description=A ComCast Internet software suite that provides a variety of features (firewall, popup blocker, parental controls etcetera) to help ensure your computer is secure, and your information is kept private Source=Paul Collins Startup list [Security Patch] Number=9156 Confirmed=X Filename=scmss.exe Description=Added by the RBOT-ZW WORM! Source=Paul Collins Startup list [Security Patch] Number=9157 Confirmed=X Filename=WinUpdate32.exe Description=Added by the SDBOT-BM WORM! Source=Paul Collins Startup list [Security Patches] Number=9158 Confirmed=X Filename=msnkn.exe Description=Added by the RBOT.WW WORM! Source=Paul Collins Startup list [Security Patches] Number=9159 Confirmed=X Filename=WinLab32.exe Description=Added by the SDBOT-KB WORM! Source=Paul Collins Startup list [security service] Number=9160 Confirmed=X Filename=syss.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Security Service] Number=9161 Confirmed=X Filename=secsvc.exe Description=Added by the RBOT-GGF WORM! Source=Paul Collins Startup list [Security Service Process] Number=9162 Confirmed=X Filename=svhost.exe Description=Added by the AGOBOT-LC WORM! Source=Paul Collins Startup list [securw] Number=9163 Confirmed=X Filename=Nctrup.exe Description=Added by the NOPIR.A WORM! Source=Paul Collins Startup list [SECWIZ98] Number=9164 Confirmed=Y Filename=SECWIZ98.EXE Description=Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here Source=Paul Collins Startup list [seekmo] Number=9165 Confirmed=X Filename=seekmo.exe Description=Seekmo Search, a 180Solutions adware variant - also see here Source=Paul Collins Startup list [seeve] Number=9166 Confirmed=X Filename=seeve.exe Description=Medload adware Source=Paul Collins Startup list [Select server] Number=9167 Confirmed=X Filename=slcsvr.exe Description=Added by the DLOADER-WD TROJAN! Source=Paul Collins Startup list [SelfHostUtil] Number=9168 Confirmed=? Filename=slefhost.exe Description=?? Source=Paul Collins Startup list [seli] Number=9169 Confirmed=X Filename=[path to file] Description=Added by the LOWZONE-AS TROJAN! Source=Paul Collins Startup list [SemanticInsight] Number=9170 Confirmed=X Filename=SemanticInsight.exe Description=Added by RXToolbar ADAWARE! Software that displays pop-up/pop-under advertisements when the primary user interface is not visible Source=Paul Collins Startup list [SeMS] Number=9171 Confirmed=U Filename=SeMS.exe Description=PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone Source=Paul Collins Startup list [Sen] Number=9172 Confirmed=X Filename=tlii.exe Description=Recognized by Kaspersky antivirus as Win32.PurityScan.ah. This file is usually found in the Program Files\bama folder Source=Paul Collins Startup list [Sensiva] Number=9173 Confirmed=U Filename=Sensiva.exe Description=Symbol Commander makes the use of your PC, laptop, Tablet PC, and Pocket PC much easier and much faster. It recognizes your handwriting with unparalled performance and executes commands in a snap. Just by using your mouse, pen, or touchpad, simply draw symbols to execute actions instantly Source=Paul Collins Startup list [SENTRY] Number=9174 Confirmed=X Filename=SENTRY.exe Description=From IP Insight. Allows website owners "to instantly determine the precise geographic location, connection speed and detailed demographics of every visitor to your website". Will be detected by most firewalls and the majority of home users should disable it Source=Paul Collins Startup list [Sepate Security Firewall] Number=9175 Confirmed=X Filename=sepate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [septpop06apsept] Number=9176 Confirmed=X Filename=septpop06apsept.exe Description=MediaMotor.Popupwithcast adware Source=Paul Collins Startup list [Serials] Number=9177 Confirmed=X Filename=serials.exe Description=Any one of a variety of worms and trojans Source=Paul Collins Startup list [SernellApp.pcx] Number=9178 Confirmed=X Filename=csrss.exe Description=Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "D5133" subfolder Source=Paul Collins Startup list [serpe] Number=9179 Confirmed=X Filename=formatsys.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [serpe] Number=9180 Confirmed=X Filename=msmbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [serpe] Number=9181 Confirmed=X Filename=serbw.exe Description=Added by the SERFLOG.A WORM! Source=Paul Collins Startup list [serrdctl.exe] Number=9182 Confirmed=Y Filename=serrdctl.exe Description="Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems Source=Paul Collins Startup list [serrv] Number=9183 Confirmed=X Filename=serrv.exe Description=Added by the WAREZOV.DC WORM! Source=Paul Collins Startup list [SERV PacK2] Number=9184 Confirmed=X Filename=nerx.exe Description=Added by the SDBOT-ACP WORM! Source=Paul Collins Startup list [Serv-U] Number=9185 Confirmed=N Filename=serv-u32.exe Description=FTP server Source=Paul Collins Startup list [Serv-U] Number=9186 Confirmed=X Filename=wssdsu.exe Description=Added by the MANIFEST TROJAN! Source=Paul Collins Startup list [server] Number=9187 Confirmed=X Filename=server.exe Description=Added by the DELTAD.A WORM! Source=Paul Collins Startup list [server] Number=9188 Confirmed=X Filename=system.exe Description=Added by the METHS-A TROJAN! Source=Paul Collins Startup list [server] Number=9189 Confirmed=X Filename=server.exe Description=Added by the SINGU-Q TROJAN! Source=Paul Collins Startup list [Server Backbone] Number=9190 Confirmed=X Filename=server05.exe Description=Added by the RBOT-ZM WORM! Source=Paul Collins Startup list [Server Runtime Process] Number=9191 Confirmed=X Filename=wbemstest.exe Description=Added by the SDBOT-DDB WORM! Source=Paul Collins Startup list [SERVER.EXE] Number=9192 Confirmed=X Filename=SERVER.EXE Description=Added by the BUSHTRO122 or SMOKODOOR TROJANS! Source=Paul Collins Startup list [serverex] Number=9193 Confirmed=X Filename=Server.txt.vbs Description=Added by the DELTAD.A WORM! Source=Paul Collins Startup list [Service] Number=9194 Confirmed=X Filename=service.exe Description=Added by the ALADINZ.H TROJAN! Source=Paul Collins Startup list [Service] Number=9195 Confirmed=X Filename=[trojan filename] Description=Added by the KAITEX.E TROJAN! Source=Paul Collins Startup list [Service] Number=9196 Confirmed=X Filename=services.exe Description=Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Service] Number=9197 Confirmed=X Filename=SYSNT.exe Description=Added by the CHA TROJAN! Source=Paul Collins Startup list [Service] Number=9198 Confirmed=X Filename=Service.pif Description=Added by the ASSIRAL-C WORM! Source=Paul Collins Startup list [service] Number=9199 Confirmed=X Filename=wN2S.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Service Cleaner] Number=9200 Confirmed=X Filename=filen.exe Description=Added by the RBOT.BRH WORM! Source=Paul Collins Startup list [Service Connection] Number=9201 Confirmed=N Filename=sccenter.exe Description=For Compaq PC's. Part of Backweb Source=Paul Collins Startup list [Service Connection] Number=9202 Confirmed=N Filename=bwtray.exe Description=For Compaq PC's. Part of Backweb Source=Paul Collins Startup list [Service Controller] Number=9203 Confirmed=X Filename=Csrrs.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Service Controller] Number=9204 Confirmed=X Filename=service.exe Description=Added by the PREVERT TROJAN! Source=Paul Collins Startup list [Service Drivers] Number=9205 Confirmed=X Filename=msnpg.exe Description=Added by the RBOT.BMD WORM! Source=Paul Collins Startup list [Service Drivers] Number=9206 Confirmed=X Filename=PC.EXE Description=Added by the SDBOT-WK WORM! Source=Paul Collins Startup list [Service Drivers] Number=9207 Confirmed=X Filename=Compt.exe Description=Added by the RBOT-ZJ WORM! Source=Paul Collins Startup list [Service Drivers] Number=9208 Confirmed=X Filename=abl.exe Description=Added by the SDBOT-YX WORM! Source=Paul Collins Startup list [Service Drivers] Number=9209 Confirmed=X Filename=MSNMEssenger.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Service Host] Number=9210 Confirmed=X Filename=[filename].exe Description=Added by the TORVEL.B WORM! Source=Paul Collins Startup list [Service Host] Number=9211 Confirmed=X Filename=spoolxx.exe Description=Added by the TORVEL WORM! Source=Paul Collins Startup list [Service Host] Number=9212 Confirmed=X Filename=svchost.exe Description=Added by the DAOSER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Services\{C922CCC4-CF61-4589-A0D1-828160704853} subfolder Source=Paul Collins Startup list [Service Host] Number=9213 Confirmed=X Filename=svchost.exe Description=Added by the DAOSER-C TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Services\[random] subfolder Source=Paul Collins Startup list [Service Host ] Number=9214 Confirmed=X Filename=svchost.exe Description=Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Service Host Driver] Number=9215 Confirmed=X Filename=svchost.exe Description=Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Service Host Process] Number=9216 Confirmed=X Filename=spoolsvc.exe Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [Service Manager] Number=9217 Confirmed=N Filename=sqlmangr.exe Description=SQL Server Service Manager - provides tray access to SQL server, the server agent and MSDTC. Available via Start -> Programs Source=Paul Collins Startup list [Service Manager] Number=9218 Confirmed=X Filename=SERVICEMGR.EXE Description=Added by the PASSMAIL-D VIRUS! Source=Paul Collins Startup list [Service Manager] Number=9219 Confirmed=X Filename=dxsound.exe Description=Added by the PROXY-GRIC TROJAN! Source=Paul Collins Startup list [service manager] Number=9220 Confirmed=X Filename=service.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [Service Monitor] Number=9221 Confirmed=X Filename=msnfilen.exe Description=Added by the RBOT-ALE WORM! Source=Paul Collins Startup list [Service Monitor] Number=9222 Confirmed=X Filename=javams32.exe Description=Added by the DELF-NK TROJAN! Source=Paul Collins Startup list [Service Monitor] Number=9223 Confirmed=X Filename=javams64.exe Description=Added by the SDBOT-AFO WORM! Source=Paul Collins Startup list [Service Monitor] Number=9224 Confirmed=X Filename=msnserve.exe Description=Added by the SPYBOT.YQW WORM! Source=Paul Collins Startup list [Service Monitor] Number=9225 Confirmed=X Filename=WinOcx.exe Description=Added by the RBOT-AQJ WORM! Source=Paul Collins Startup list [Service Monitor] Number=9226 Confirmed=X Filename=csnss.exe Description=Added by the RBOT.EEH WORM! Source=Paul Collins Startup list [Service Monitor] Number=9227 Confirmed=X Filename=filen.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Service Pack] Number=9228 Confirmed=X Filename=[various filenames] Description=Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif Source=Paul Collins Startup list [Service Pack DLL Runtime] Number=9229 Confirmed=X Filename=spdll32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Service Process] Number=9230 Confirmed=X Filename=SVCHOST.EXE Description=Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Service Process] Number=9231 Confirmed=X Filename=winset.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Service Process] Number=9232 Confirmed=X Filename=service.exe Description=Added by the DCMBOT-C TROJAN! Source=Paul Collins Startup list [Service Process] Number=9233 Confirmed=X Filename=smss.exe Description=Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder Source=Paul Collins Startup list [Service Process] Number=9234 Confirmed=X Filename=smss.exe Description=Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in "config" subfolder Source=Paul Collins Startup list [Service Process] Number=9235 Confirmed=X Filename=svchost.exe Description=Added by the DCMBOT-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder Source=Paul Collins Startup list [Service Registry NT Save] Number=9236 Confirmed=X Filename=jdbgmgrnt.exe Description=Added by the BANCOS-CG TROJAN! Source=Paul Collins Startup list [Service Registry NT Save] Number=9237 Confirmed=X Filename=taskmgrnt.exe Description=Added by the BANCOS-BY TROJAN! Source=Paul Collins Startup list [Service Registry NT Save] Number=9238 Confirmed=X Filename=regeditnt.exe Description=Added by the BANCOS-BM TROJAN! Source=Paul Collins Startup list [Service Scheduler] Number=9239 Confirmed=X Filename=scheduler.exe Description=Added by the AGOBOT-PH WORM! Source=Paul Collins Startup list [Service System] Number=9240 Confirmed=X Filename=kernels32.exe Description=Added by the BANCOS-DA TROJAN! Source=Paul Collins Startup list [Service System] Number=9241 Confirmed=X Filename=windowsXP.exe Description=Added by the BANCOS-EL TROJAN! Source=Paul Collins Startup list [Service System] Number=9242 Confirmed=X Filename=kgbfsm344.exe Description=Added by the BANCOS-FS TROJAN! Source=Paul Collins Startup list [Service System] Number=9243 Confirmed=X Filename=wernell87.exe Description=Added by the BANCOS-FJ TROJAN! Source=Paul Collins Startup list [service updaer] Number=9244 Confirmed=X Filename=qualityz.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! - probably a SPYBOT variant Source=Paul Collins Startup list [Service.exe] Number=9245 Confirmed=X Filename=Service.exe Description="servedby.advertising" popup generator Source=Paul Collins Startup list [service32] Number=9246 Confirmed=X Filename=service32.exe Description=Added by the AGOBOT-ST WORM! Source=Paul Collins Startup list [ServiceConfig] Number=9247 Confirmed=U Filename=ispbeg.exe Description=Comcast Transition Wizard. On June 30th, 2003 it will migrate E-mail and web pages from AT&T Broadband Internet to Comcast High-Speed Internet. Until then it will run at startup and then terminate - hence the U recommendation Source=Paul Collins Startup list [serviceconnect] Number=9248 Confirmed=X Filename=serviceconnect.exe Description=Added by the AGOBOT.AIR WORM! Source=Paul Collins Startup list [ServiceLayer] Number=9249 Confirmed=Y Filename=ServiceLayer.exe Description=Nokia Connectivity Library support task that is needed by NCLTRAY and by the Nokia Connection Manager for either to work properly Source=Paul Collins Startup list [servicemng] Number=9250 Confirmed=X Filename=service.exe Description=Added by the TAME-C WORM! Source=Paul Collins Startup list [services] Number=9251 Confirmed=X Filename=start.bat Description=Added by the ZCREW TROJAN! Source=Paul Collins Startup list [Services] Number=9252 Confirmed=X Filename=[path to trojan] Description=Added by the METEORSHELL TROJAN! Source=Paul Collins Startup list [Services] Number=9253 Confirmed=X Filename=back32.exe ...service.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Back32.exe is the baddie whose purpose is to HIDE the MIRC32 server in service.exe Source=Paul Collins Startup list [Services] Number=9254 Confirmed=X Filename=services.exe Description=Added by a number of VIRUSES, WORMS and TROJANS! Note - this is not the legitimate services.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Services] Number=9255 Confirmed=X Filename=winread.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Services] Number=9256 Confirmed=X Filename=windns.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Services] Number=9257 Confirmed=X Filename=mshost.exe Description=Added by the LANFILT-J TROJAN! Source=Paul Collins Startup list [services] Number=9258 Confirmed=X Filename=Svchosts.exe Description=Added by the SDBOT.N WORM! Source=Paul Collins Startup list [Services] Number=9259 Confirmed=X Filename=csrss.exe Description=Added by a variant of the RANKY.U TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Services] Number=9260 Confirmed=X Filename=scks32.exe Description=Added by a Proxy Trojan variant Source=Paul Collins Startup list [Services] Number=9261 Confirmed=X Filename=sockys32.exe Description=Added by the RANKY.L TROJAN! Source=Paul Collins Startup list [Services] Number=9262 Confirmed=X Filename=sys.exe Description=Added by a Proxy Trojan variant Source=Paul Collins Startup list [services] Number=9263 Confirmed=X Filename=windows32.exe Description=Added by the FLYVB-C WORM! Source=Paul Collins Startup list [services] Number=9264 Confirmed=X Filename=socks.exe Description=Added by the WIN32.SMALL.N TROJAN! Source=Paul Collins Startup list [Services] Number=9265 Confirmed=X Filename=services.exe Description=Added by the ZINCITE.A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Services] Number=9266 Confirmed=X Filename=[path to trojan] Description=Added by the RANCK-DB TROJAN! Source=Paul Collins Startup list [Services] Number=9267 Confirmed=X Filename=iexplore.exe Description=Added by the MOGI WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Services] Number=9268 Confirmed=X Filename=svchost.exe Description=Added by the REPER-B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Services] Number=9269 Confirmed=X Filename=sysamp.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Services] Number=9270 Confirmed=X Filename=prosys32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Services] Number=9271 Confirmed=X Filename=iexplorer.exe Description=Added by an unidentified WORM or TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) Source=Paul Collins Startup list [Services] Number=9272 Confirmed=X Filename=iexploler.exe Description=Added by the RANCK-LT TROJAN! Source=Paul Collins Startup list [Services] Number=9273 Confirmed=X Filename=iexpolere.exe Description=Added by the RANCK.LU TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9274 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9275 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9276 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9277 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9278 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9279 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9280 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Administrator] Number=9281 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Services Controller] Number=9282 Confirmed=X Filename=lsassa.exe Description=Added by the CIADOOR.122 VIRUS! Source=Paul Collins Startup list [Services Controller] Number=9283 Confirmed=X Filename=services.exe Description=Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Services Host] Number=9284 Confirmed=X Filename=Scchost.exe Description=Added by the DONK WORM! Source=Paul Collins Startup list [Services Host] Number=9285 Confirmed=X Filename=svchost32.exe Description=Added by the AGOBOT-TG WORM! Source=Paul Collins Startup list [Services Logon] Number=9286 Confirmed=X Filename=services.exe Description=Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! By default this file is located in Documents and Settings\[user name]\Templates Source=Paul Collins Startup list [Services Process] Number=9287 Confirmed=X Filename=services.exe Description=Spyware - recognized by Kaspersky antivirus as Small.X TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Services Process] Number=9288 Confirmed=X Filename=smss.exe Description=Added by the SMALL-EK TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder Source=Paul Collins Startup list [Services Startup] Number=9289 Confirmed=X Filename=services.exe Description=Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! By default this file is located in Documents and Settings\[user name]\Templates Source=Paul Collins Startup list [Services Startup] Number=9290 Confirmed=X Filename=svhost33.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Services.dll] Number=9291 Confirmed=X Filename=smss.exe Description=Added by the SOBER-L WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a msagent\system subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Services.EXE] Number=9292 Confirmed=X Filename=services.exe Description=Added by the KAZPING WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [services.exe] Number=9293 Confirmed=X Filename=Services.exe Description=Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Services004] Number=9294 Confirmed=X Filename=[worm filename] Description=Added by the BUGBROS WORM! Source=Paul Collins Startup list [services32] Number=9295 Confirmed=X Filename=mc-110-12-0000079.exe Description=Added by the TrojanDownloader.Agent.rv TROJAN! Source=Paul Collins Startup list [services32] Number=9296 Confirmed=X Filename=mc-58-12-0000120.exe Description="Shorty" adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [services32] Number=9297 Confirmed=X Filename=mc-58-12-0000140.exe Description="Shorty" adware - also detected as the AGENT.FD TROJAN! Source=Paul Collins Startup list [Services32 Startup] Number=9298 Confirmed=X Filename=win32dll.exe Description=Added by the SDBOT-XO WORM! Source=Paul Collins Startup list [ServicesLoad] Number=9299 Confirmed=X Filename=lsass.exe Description=Added by the DEARIS-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [ServicesLog] Number=9300 Confirmed=X Filename=ccapp32.exe Description=Added by the RBOT-AMX WORM! Source=Paul Collins Startup list [Servicewin] Number=9301 Confirmed=X Filename=Hide32.exe Description=Added by the MSNVB-D WORM! Source=Paul Collins Startup list [Servicing] Number=9302 Confirmed=X Filename=hostd.exe Description=Added by the SDBOT.BUI WORM! Source=Paul Collins Startup list [Servicio Local] Number=9303 Confirmed=X Filename=svhost.exe Description=Added by the SPYBOT.BGX WORM! Source=Paul Collins Startup list [servics] Number=9304 Confirmed=X Filename=servics.exe Description=Added by the SINGU-J TROJAN! Source=Paul Collins Startup list [SERVlCE] Number=9305 Confirmed=X Filename=SERVlCE.EXE Description=Added by the AGOBOT-UB WORM! Source=Paul Collins Startup list [ServUTrayIcon] Number=9306 Confirmed=? Filename=ServUTray.exe Description=System Tray icon for Serv-U FTP server. Is it required? Source=Paul Collins Startup list [SES Service] Number=9307 Confirmed=X Filename=sesvc.exe Description=Added by the SDBOT-CZU WORM! Source=Paul Collins Startup list [Session Client] Number=9308 Confirmed=U Filename=sescli.exe Description=SurfSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Session Manager Subsystem] Number=9309 Confirmed=X Filename=smssa.exe Description=Added by the RBOT-AGS WORM! Source=Paul Collins Startup list [SESync] Number=9310 Confirmed=X Filename=sed.exe Description=DownloadWare adware Source=Paul Collins Startup list [SetDefaultMIDI] Number=9311 Confirmed=? Filename=MIDIDef.exe Description=Related to a Soundblaster Audigy soundcards. What does it do and is it required? Source=Paul Collins Startup list [SetDefaultPrinter] Number=9312 Confirmed=Y Filename=cloaker.exe Description=Used by HP and Compaq computers to hide the windows of programs passed as arguments to it Source=Paul Collins Startup list [setdefprt] Number=9313 Confirmed=N Filename=setdefprt.exe Description=Used to set a Brother MFC printer/copier/scanner as the default printer after installation Source=Paul Collins Startup list [SetDefPrt] Number=9314 Confirmed=N Filename=BrStDvPt.exe Description=Used to set a Brother MFC printer/copier/scanner as the default printer after installation Source=Paul Collins Startup list [SetecCertUtil] Number=9315 Confirmed=U Filename=Certutil.exe Description=Setec Web and Email Security. Setec PKI smart card software. The PKI technology enables secure and reliable user identification in services offered through Internet, mobile handsets and digital TV Source=Paul Collins Startup list [setFTPBack] Number=9316 Confirmed=X Filename=createsw.exe Description=Added by the FTP_BMAIL TROJAN! Source=Paul Collins Startup list [SetHook] Number=9317 Confirmed=N Filename=SetHook.exe Description=Fellowes Neato CD label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" Source=Paul Collins Startup list [SETI@home] Number=9318 Confirmed=N Filename=SETI@home.exe Description=SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data Source=Paul Collins Startup list [seticlient] Number=9319 Confirmed=N Filename=SETI@home.exe Description=SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data Source=Paul Collins Startup list [SetIcon] Number=9320 Confirmed=N Filename=SetIcon.exe Description=Installed by a 6-in-1 (4 Media Card slots, a floppy drive and a USB connection) device. Constantly updates the icons for the four Media Card slots that it has and is a resource hog Source=Paul Collins Startup list [SetiQueue] Number=9321 Confirmed=N Filename=Setiqu~1.exe Description=Provides work unit buffering for Seti@Home clients - see here for more details Source=Paul Collins Startup list [SetiSpy] Number=9322 Confirmed=N Filename=SetiSpy.exe Description=SETI Spy is a little program to "spy" on the progress and performance of the SETI@home client. Called a "spy" because it is unobtrusive as possible Source=Paul Collins Startup list [SetPoint] Number=9323 Confirmed=X Filename=SetPoint.exe Description=Added by the RBOT-BWI WORM! Note - this is not the valid Logitech Setpoint mouse and keyboard entry that uses the same filename and is located in the Logitech\Setpoint sub-folder of Program Files. This file is located in the System (9x/Me) or System32 (NT/2K/XP/Vista) folder Source=Paul Collins Startup list [SetPoint] Number=9324 Confirmed=U Filename=Setpoint.exe Description=Logitech SetPoint Event Manager for their range of mice and keyboards. Required if you want to use the advanced features of these devices and is located in the Logitech\Setpoint sub-folder of Program Files Source=Paul Collins Startup list [SETPOINT Logitech Inc] Number=9325 Confirmed=X Filename=KHALMNP.exe Description=Added by the RBOT-AAX WORM! Source=Paul Collins Startup list [SetRefresh] Number=9326 Confirmed=? Filename=SetRefresh.exe Description=Found on a Compaq PC. Video refresh rate utility? Is it required? Source=Paul Collins Startup list [Setting] Number=9327 Confirmed=X Filename=sysweb.exe Description=Added by the SDBOT.GEN TROJAN! Source=Paul Collins Startup list [setup] Number=9328 Confirmed=N Filename=hphprld.exe ....setup.exe Description=HP DeskJet Setup - printers function normally without it Source=Paul Collins Startup list [Setup experation] Number=9329 Confirmed=X Filename=svchost.exe Description=Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [setupa] Number=9330 Confirmed=X Filename=runt32.exe Description=Added by the QQPASS-K TROJAN! Source=Paul Collins Startup list [setupdata] Number=9331 Confirmed=X Filename=rnll32.exe Description=Added by the QQPASS-AC TROJAN! Source=Paul Collins Startup list [SetupICWDesktop] Number=9332 Confirmed=N Filename=icwconn1.exe Description=Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway Source=Paul Collins Startup list [setupuser] Number=9333 Confirmed=X Filename=regedit.exe setupuser.log Description=Regfile in disguise - another CoolWebSearch parasite variant Source=Paul Collins Startup list [setuzp] Number=9334 Confirmed=? Filename=setuzp.exe Description=?? Source=Paul Collins Startup list [SetVrc] Number=9335 Confirmed=X Filename=setvrc.exe Description=Added by the HUNTOCX WORM! Source=Paul Collins Startup list [Sex Teris] Number=9336 Confirmed=X Filename=st01b.exe Description=Added by the REPAD WORM! Source=Paul Collins Startup list [Sexnow] Number=9337 Confirmed=X Filename=Sexnow.exe Description=Added by the SENOW-B premium rate adult content dialler Source=Paul Collins Startup list [Sexy_Blondes] Number=9338 Confirmed=X Filename=Sexy_Blondes.exe Description=Added by the Sexy DIALER!. Related also to Hot Tarts DIALER! Source=Paul Collins Startup list [Sexy_sg] Number=9339 Confirmed=X Filename=Sexy_sg.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [sf] Number=9340 Confirmed=X Filename=sf.exe Description=SurfEnhance adware component Source=Paul Collins Startup list [SFIGUI] Number=9341 Confirmed=N Filename=SFIGUI.EXE Description=Sonic Focus - "enhances music, movie and game sound by analyzing compressed audio streams in realtime, then restoring and enriching audio back to its original performance qualities" Source=Paul Collins Startup list [sfita] Number=9342 Confirmed=X Filename=sfita.exe Description=Added by the FAVADD-H TROJAN! Also known as SurfEnhance adware Source=Paul Collins Startup list [SFP] Number=9343 Confirmed=N Filename=vzSFPWin.EXE Description=Verizon Online Support Center - prompts for online updates Source=Paul Collins Startup list [sfpc] Number=9344 Confirmed=U Filename=sfpc.exe Description=Spy4PC surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [SFtrb Service] Number=9345 Confirmed=X Filename=cftrb32.exe Description=Added by the SOBIG.D WORM! Source=Paul Collins Startup list [SfWinStartInfo] Number=9346 Confirmed=U Filename=sfWinStartupInfo.exe Description=

SFIRM32 Online Banking software Source=Paul Collins Startup list [Sgecrypt] Number=9347 Confirmed=U Filename=Sgecrypt.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [Sgeecview] Number=9348 Confirmed=U Filename=Ecview.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [sginst] Number=9349 Confirmed=U Filename=sginst.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [SGTBox] Number=9350 Confirmed=? Filename=SGTBox.exe Description=Canon scanner driver. Is it required? Source=Paul Collins Startup list [sgtray] Number=9351 Confirmed=U Filename=sgtray.exe Description=StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups Source=Paul Collins Startup list [Shadow] Number=9352 Confirmed=Y Filename=Shadow.exe Description="NTI Shadow 3 is an award-winning easy-to-use backup application that automatically protects your photo, music, video, and various data files. It makes data restoration as easy as dragging and dropping files from one place to another" Source=Paul Collins Startup list [ShadowUser Pro Edition] Number=9353 Confirmed=U Filename=ShadowUser.exe Description="StorageCraft� ShadowUser� provides easy to use desktop security and protection for Windows operating systems. ShadowUser is the best way to prevent unwanted changes to PCs and laptops" Source=Paul Collins Startup list [shambl3r] Number=9354 Confirmed=X Filename=cnf.bat Description=Added by the REMABL WORM! Source=Paul Collins Startup list [shambl3r*] Number=9355 Confirmed=X Filename=shambl3r.exe Description=Added by the REMABL WORM! where * is 2 to 11 Source=Paul Collins Startup list [Shania] Number=9356 Confirmed=X Filename=Shania.vbs Description=Added by the SHANIA VIRUS! - NOTE: this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Share-to-Web Namespace Daemon] Number=9357 Confirmed=N Filename=hpgs2wnd.exe Description=HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites. In other words an application that allows users to upload scanned images to their personal webpages if desired. Available via Start -> Programs Source=Paul Collins Startup list [Shareaza] Number=9358 Confirmed=N Filename=Shareaza.exe Description=Shareaza P2P client Source=Paul Collins Startup list [Shareaza] Number=9359 Confirmed=U Filename=bindata.exe Description=Shareaza P2P client related Source=Paul Collins Startup list [sharedprem] Number=9360 Confirmed=X Filename=sharedprem.exe Description=Added by the MAKECALL TROJAN! Source=Paul Collins Startup list [Sharing and Mapping Software] Number=9361 Confirmed=Y Filename=DShmap.exe Description=Intel AnyPoint internet sharing software. Now discontinued Source=Paul Collins Startup list [SharkEject] Number=9362 Confirmed=N Filename=AEJCT32.exe Description=Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded, there is a desktop icon so this isn't required Source=Paul Collins Startup list [SharpTray] Number=9363 Confirmed=U Filename=SharpTray.exe Description=Part of Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents" Source=Paul Collins Startup list [Shcenter] Number=9364 Confirmed=N Filename=chcenter.exe Description=IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" Source=Paul Collins Startup list [SheduIer] Number=9365 Confirmed=X Filename=svchst.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SheduIer] Number=9366 Confirmed=X Filename=shch.exe Description=Added by the EB TROJAN! Source=Paul Collins Startup list [SheduIer] Number=9367 Confirmed=X Filename=winagent.exe Description=Added by the EB TROJAN! Source=Paul Collins Startup list [Shedule Connection] Number=9368 Confirmed=X Filename=arpo412.exe Description=Added by the PPDOOR-R WORM! Source=Paul Collins Startup list [Sheduler] Number=9369 Confirmed=X Filename=nerocheck.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [Shell] Number=9370 Confirmed=X Filename=Shell32.exe Description=Added by the BADSECTOR TROJAN! Source=Paul Collins Startup list [Shell] Number=9371 Confirmed=X Filename=ray.exe Description=Homepage hijacker re-directing browsers to adult content websites Source=Paul Collins Startup list [Shell] Number=9372 Confirmed=X Filename=Tray.exe Description=Homepage hijacker re-directing browsers to adult content websites Source=Paul Collins Startup list [Shell] Number=9373 Confirmed=X Filename=wmedia16.exe Description=Added by the GOLDUN TROJAN! Source=Paul Collins Startup list [Shell] Number=9374 Confirmed=X Filename=Open32.exe Description=Added by the SMALL-DL TROJAN! Source=Paul Collins Startup list [Shell] Number=9375 Confirmed=X Filename=Explorer.exe sound_drive16.exe Description=Added by the GP TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder Source=Paul Collins Startup list [Shell] Number=9376 Confirmed=X Filename=Explorer.exe, msmsgs.exe Description=Added by the ZLOB TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Shell] Number=9377 Confirmed=X Filename=Explorer.exe [path] svchost.exe Description=Added by the DOYORG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [shell] Number=9378 Confirmed=X Filename=explorer.exe Description=Added by the KAKKEYS TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder Source=Paul Collins Startup list [Shell] Number=9379 Confirmed=X Filename=iexplore.exe Description=Added by the KIPIS-U TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder Source=Paul Collins Startup list [Shell] Number=9380 Confirmed=X Filename=ibm0000*.exe [* = digit] Description=Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe, ibm00002.exe, ibm00005.exe and so on Source=Paul Collins Startup list [Shell] Number=9381 Confirmed=X Filename=taskmrg.exe Description=Added by the BANCBAN-FT TROJAN! Source=Paul Collins Startup list [Shell] Number=9382 Confirmed=X Filename=Explorer.exe winupdate.exe Description=Added by the AGENT-FD TROJAN! Source=Paul Collins Startup list [Shell] Number=9383 Confirmed=X Filename=ibm[RANDOM 5 DIGIT NUMBER].exe Description=Added by the ANSERIN TROJAN! Source=Paul Collins Startup list [Shell] Number=9384 Confirmed=X Filename=svchost.exe Description=Added by the GOLDSPY-B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Shell] Number=9385 Confirmed=X Filename=ibm00001.dll Description=Added by the TORPIG-Q TROJAN! Source=Paul Collins Startup list [Shell API32] Number=9386 Confirmed=X Filename=svcnet.exe Description=Added by the TIBICK.C WORM! Source=Paul Collins Startup list [Shell Extension] Number=9387 Confirmed=X Filename=spollsv.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [Shell Tray Window] Number=9388 Confirmed=X Filename=ShellTraywnd.exe Description=Added by the STULTDOR-A TROJAN! Source=Paul Collins Startup list [shell update] Number=9389 Confirmed=X Filename=shellexec.exe Description=Added by the AGOBOT-TH WORM! Source=Paul Collins Startup list [Shell32] Number=9390 Confirmed=X Filename=Shell32.vbs Description=Added by the SCAFENE WORM! Source=Paul Collins Startup list [shell32] Number=9391 Confirmed=X Filename=ntldrt.exe Description=Added by the JLOK-A WORM! Source=Paul Collins Startup list [Shell32] Number=9392 Confirmed=X Filename=iexplore.exe Description=Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [ShellApi] Number=9393 Confirmed=X Filename=SHELLMSN.EXE Description=Added by the NETDEV.B TROJAN! Source=Paul Collins Startup list [Shellapi32] Number=9394 Confirmed=X Filename=Shellapi32.exe Description=Added by the NETDEVIL (or NERTE) TROJAN! Source=Paul Collins Startup list [Shellapi32] Number=9395 Confirmed=X Filename=mcvsrte.exe Description=Added by an unidentified WORM! Note - do not confuse with the McAfee SecurityCenter file of the same name Source=Paul Collins Startup list [ShellCommand] Number=9396 Confirmed=X Filename=[path to file] Description=Added by the REMCON-A TROJAN! Source=Paul Collins Startup list [Shelldaemon] Number=9397 Confirmed=X Filename=Shelldaemon.exe Description=Added by a variant of the AGENT.ALN TROJAN! Source=Paul Collins Startup list [ShellEx] Number=9398 Confirmed=X Filename=ShellEx.exe Description=Added by the ANAKHA TROJAN! Source=Paul Collins Startup list [ShellN] Number=9399 Confirmed=X Filename=isca.exe Description=Added by the IBILL.Z TROJAN! Source=Paul Collins Startup list [ShellOS] Number=9400 Confirmed=X Filename=A+++.exe Description=Added by the AV TROJAN! Source=Paul Collins Startup list [ShellRun] Number=9401 Confirmed=X Filename=lexplore_.exe Description=Added by the MSNOPT-A TROJAN! Source=Paul Collins Startup list [ShellRun32] Number=9402 Confirmed=X Filename=iexplore.exe Description=Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Shellspl] Number=9403 Confirmed=X Filename=lsas.exe Description=Added by the YALER-A TROJAN! Source=Paul Collins Startup list [Shellspl] Number=9404 Confirmed=X Filename=spools.exe Description=Added by the PROXAGE-A TROJAN! Source=Paul Collins Startup list [shellsystem] Number=9405 Confirmed=X Filename=shellsystem.exe Description=Added by the UPCHAN TROJAN! Source=Paul Collins Startup list [shhost] Number=9406 Confirmed=X Filename=shhost.exe Description=Added by the AGENT.CE TROJAN! Source=Paul Collins Startup list [shicoxp] Number=9407 Confirmed=N Filename=shicoxp.exe Description=Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows Explorer Source=Paul Collins Startup list [Shine] Number=9408 Confirmed=X Filename=Shine.exe Description=Added by the HAPPYLOW (or NISHE-A) VIRUS! Source=Paul Collins Startup list [SHINITV] Number=9409 Confirmed=? Filename=shinitv.exe Description=?? Source=Paul Collins Startup list [Shmgrate.exe] Number=9410 Confirmed=X Filename=ibot4.exe Description=Added by the GASTER TROJAN! Source=Paul Collins Startup list [ShockmachineReminder] Number=9411 Confirmed=N Filename=SmReminder.exe Description="Shockmachine is a stand-alone application that lets users collect Macromedia Shockwave and Flash titles and play them offline". Could be a registration reminder for the trial version Source=Paul Collins Startup list [Shockwave] Number=9412 Confirmed=X Filename=csrss.exe Description=Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Shockwave Init] Number=9413 Confirmed=N Filename=SWINIT.EXE Description=Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs Source=Paul Collins Startup list [Shockwave Support] Number=9414 Confirmed=X Filename=FlashPlayer.exe Description=Added by the DELF-DRA WORM! Source=Paul Collins Startup list [ShortKeys 99] Number=9415 Confirmed=N Filename=SHORTKEY.EXE Description=ShortKeys from Insight Software Solutions - allows you to program keys with text strings Source=Paul Collins Startup list [sHotKey] Number=9416 Confirmed=Y Filename=sHotKey.exe Description=Special function key manager for Chicony keyboards - see here Source=Paul Collins Startup list [Showbehind] Number=9417 Confirmed=X Filename=SHOWBEHIND.EXE Description=Advertisement display which can be stopped here Source=Paul Collins Startup list [ShowFF] Number=9418 Confirmed=X Filename=ShowFF.exe Description=Added by the Adware.FFToolBar adware toolbar Source=Paul Collins Startup list [ShowIcon_Justrams_USB Product Driver v2.12r012] Number=9419 Confirmed=? Filename=shwicon.exe Description=Related to Just Rams USB product driver. Is it required? Source=Paul Collins Startup list [ShowIcon_PNY_PNY Attach�] Number=9420 Confirmed=U Filename=shwicon.exe Description=PNY Attach� USB flash memory stick System Tray icon - shows when the device is plugged in Source=Paul Collins Startup list [ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051] Number=9421 Confirmed=? Filename=shwicon.exe Description=Card reader for memory cards from digital cameras. Is it required? Source=Paul Collins Startup list [ShowLOMControl] Number=9422 Confirmed=U Filename=[strange symbol] Description=Note that there is a strange symbol in the command field. HKLM\Software\Microsoft\Windows\Current Version\Run\ShowLOMControl Reg_DWORD 0x00000001 (1) LOM = LAN on Motherboard.It mean Show "LAN on Motherboard" Control.On systems where you can install an external LAN interface, it will warn you that you already have a built-in LAN interface. Appears to be a feature on certain Dell systems Source=Paul Collins Startup list [Showme] Number=9423 Confirmed=X Filename=Ruden.vbs Description=Added by the HANDLE-A VIRUS! Source=Paul Collins Startup list [ShowWnd] Number=9424 Confirmed=U Filename=ShowWnd.exe Description=Found on Gateway computers (and maybe others) - see here. "Showwnd is included with the Chicony keyboard software and is used by the software to stop the keyboard driver's taskbar entry from reappearing. It is not necessary to remove the keyboard software, however if you wish it can be removed through Add or Remove Programs" Source=Paul Collins Startup list [SHPC32] Number=9425 Confirmed=U Filename=SHPC32.exe Description=Port monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabled Source=Paul Collins Startup list [ShStatEXE] Number=9426 Confirmed=Y Filename=SHSTAT.EXE Description=From McAfee VirusScan NT 4.x. Handles program communication among VShield components, displays VShield icon. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [Shutdownaware] Number=9427 Confirmed=U Filename=shutdownaware.exe Description=Loaded by the SWEEX 6-in-1 Media Card Reader to properly manage the reader while it is connected to your system Source=Paul Collins Startup list [ShutDownPro] Number=9428 Confirmed=U Filename=ShutDownPro.exe Description=ShutDownPro - shutdown, reboot, logoff your System with one mouse click Source=Paul Collins Startup list [Si Meter] Number=9429 Confirmed=N Filename=SIMETER.EXE Description=Si Meter - keep track of things like CPU activity, network activity and speed, hard-drive activity, hard-drive space, system memory, running processes, or just date and time Source=Paul Collins Startup list [si91e44b] Number=9430 Confirmed=X Filename=rundll32.exe [path] si91e44b.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [SIA2006] Number=9431 Confirmed=U Filename=SIA2006.exe Description=Part of Steganos Internet Anonym privacy software Source=Paul Collins Startup list [SIAPRO6] Number=9432 Confirmed=U Filename=sia.exe Description=Steganos Internet Anonym privacy software Source=Paul Collins Startup list [Sicom] Number=9433 Confirmed=X Filename=Sicom.exe Description=Added by the NETLIP WORM! Source=Paul Collins Startup list [SideACT] Number=9434 Confirmed=U Filename=SideACT.exe Description=SideACT organizer software Source=Paul Collins Startup list [Sidebar] Number=9435 Confirmed=U Filename=Sidebar.exe Description=If you are running Windows Vista it is a part of the operating system. But on other versions of Windows it can be a part of Searchcentrix hijacker Source=Paul Collins Startup list [SIDEBAR] Number=9436 Confirmed=N Filename=dsidebar.exe Description="Desktop Sidebar provides you with instant access to the information you most desire by grabbing data from your PC and the internet. The result is a dynamic visual display you configure and control" Source=Paul Collins Startup list [Sidebar] Number=9437 Confirmed=U Filename=sidebar.exe Description=Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available Source=Paul Collins Startup list [SideWinderTrayV4] Number=9438 Confirmed=N Filename=SWTrayV4.exe Description=MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs Source=Paul Collins Startup list [SigmaTel Audio] Number=9439 Confirmed=N Filename=setup.exe Description=Sigmatel audio driver Source=Paul Collins Startup list [SigmatelSysTrayApp] Number=9440 Confirmed=N Filename=stsystra.exe Description=System tray program for the Sigmatel Audio sound card. Often found on Dell computers Source=Paul Collins Startup list [SigmatelSysTrayApp] Number=9441 Confirmed=N Filename=sttray.exe Description=System tray program for the Sigmatel Audio sound card. Often found on Dell computers Source=Paul Collins Startup list [SigX] Number=9442 Confirmed=? Filename=sigx.exe Description=?? Source=Paul Collins Startup list [SigXC] Number=9443 Confirmed=X Filename=SigX.exe Description=SigX is a "dynamic signature image generated based on whatever data your computer sends it though our SigX program. It can display your current Mp3, current OS, Free Ram, your current time and more" Source=Paul Collins Startup list [Simcast] Number=9444 Confirmed=N Filename=SimcastAlerts.exe Description=Simcast is a free service that allows you to subscribe to information on a large variety of topics. Alerts will appear on your desktop when a channel that you have subscribed to has something to say Source=Paul Collins Startup list [SimpLite-MSN] Number=9445 Confirmed=U Filename=SimpLite-MSN.exe Description=Required if you use the SimpLite add-on to MSN Messenger (SimpLite adds encryption to the instant messaging service) Source=Paul Collins Startup list [Singapore] Number=9446 Confirmed=X Filename=singapore.exe Description=Adds a blue crescent to the taskbar and when double-clicked displays an adult-content web-site. Also known to drop your internet connection and dial an international telephone number. See here for more information. Must be disabled in MSCONFIG before un-installing or it re-instates itself Source=Paul Collins Startup list [SIPPS] Number=9447 Confirmed=U Filename=SIPPS\SIPPS.exe Description=Web.de Internet phone utility Source=Paul Collins Startup list [SiS Dns] Number=9448 Confirmed=X Filename=dnssvc.exe Description=Added by the DLOADER-UE TROJAN! Source=Paul Collins Startup list [SiS KHooker] Number=9449 Confirmed=N Filename=khooker.exe Description=SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required Source=Paul Collins Startup list [SiS Mpc Service] Number=9450 Confirmed=X Filename=mpcsvc.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [SiS Mpc Service] Number=9451 Confirmed=X Filename=mpcsvc.exe Description=Added by the CIAFOOR-CJ TROJAN! Source=Paul Collins Startup list [SiS Tray] Number=9452 Confirmed=U Filename=sistray.exe Description=System Tray icon for SiS based graphics. Note - this resides in C:\Windows\System Source=Paul Collins Startup list [SiS Windows KeyHook] Number=9453 Confirmed=U Filename=keyhook.exe Description=SIS graphics cards related: "Super VGA Keyboard Daemon" - hooks into the keyboard processing chain in order to enable hotkey settings Source=Paul Collins Startup list [SiS7012Utility] Number=9454 Confirmed=Y Filename=SiSAudUt.exe Description=SiS Corporation sound card driver Source=Paul Collins Startup list [SISAM10M] Number=9455 Confirmed=? Filename=SISAM10M.exe Description=?? Source=Paul Collins Startup list [SiSAudio] Number=9456 Confirmed=N Filename=MP_S3.exe Description=WinME patch for an older SiS 961 chipset FERR bug. Enable if you have audio problems Source=Paul Collins Startup list [siscolor] Number=9457 Confirmed=U Filename=color.exe Description=Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable the on-board Source=Paul Collins Startup list [siService.exe] Number=9458 Confirmed=U Filename=siService.exe Description=Spam Inspector - anti email spam software Source=Paul Collins Startup list [SiSPower] Number=9459 Confirmed=? Filename=Rundll32.exe SiSPower.dll, ModeAgent Description=Responsible for power management for SIS chipsets - is it required? Source=Paul Collins Startup list [SiSRaid] Number=9460 Confirmed=U Filename=SRaid.exe Description=Related to the SIS Raid system from Silicon Integrated Systems Source=Paul Collins Startup list [SiSSetCDfmt] Number=9461 Confirmed=? Filename=SiSSetCDfmt.exe Description=Related to a Silicon Integrated Systems Corp (SiS) product? Source=Paul Collins Startup list [SISSoundman] Number=9462 Confirmed=? Filename=Soundman.exe Description=Related to a Silicon Integrated Systems Corp (SiS) product? Source=Paul Collins Startup list [SiSSWLED] Number=9463 Confirmed=U Filename=sisswled.exe Description=System Tray utility for SiS 900 network cards Source=Paul Collins Startup list [sistrai.exe] Number=9464 Confirmed=X Filename=sistrai.exe Description=Added by the PROVA TROJAN! Source=Paul Collins Startup list [sistray] Number=9465 Confirmed=X Filename=sistray.exe Description=Added by the PROVA TROJAN! Source=Paul Collins Startup list [sistray] Number=9466 Confirmed=U Filename=sistray.exe Description=System Tray icon for SiS based graphics. Note - this resides in C:\Windows\System Source=Paul Collins Startup list [Sistray32] Number=9467 Confirmed=X Filename=remotehost.pif Description=Added by the HOLCAS.A WORM! Source=Paul Collins Startup list [Sistray32] Number=9468 Confirmed=X Filename=win.bat Description=Added by the JUMPRED.A WORM! Source=Paul Collins Startup list [Sistray32] Number=9469 Confirmed=X Filename=virus.exe Description=Added by the TOMETA-C TROJAN! Source=Paul Collins Startup list [sistry] Number=9470 Confirmed=X Filename=sistry.exe Description=Added by the CEBE WORM! Source=Paul Collins Startup list [SiSUSBRG] Number=9471 Confirmed=N Filename=SiSUSBrg.exe Description=SiS USB Registry Patch File - fixes the undetectable problem with SiS USB controller on Windows XP Source=Paul Collins Startup list [SiteAdvisor] Number=9472 Confirmed=U Filename=SiteAdv.exe Description=SiteAdvisor from McAfee warns you before you interact with a dangerous Web site Source=Paul Collins Startup list [sixtysix] Number=9473 Confirmed=X Filename=sixtypopsix.exe Description=Medload adware Source=Paul Collins Startup list [SK51] Number=9474 Confirmed=U Filename=SK51.EXE Description=SaveKeys keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SK60] Number=9475 Confirmed=U Filename=SK60.EXE Description=SaveKeys keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SK9910DM] Number=9476 Confirmed=U Filename=SK9910DM.EXE Description=Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [SKDAEMON] Number=9477 Confirmed=U Filename=SKDAEMON.EXE Description=Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [skinkers] Number=9478 Confirmed=U Filename=skinkers.exe Description=Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's "Desktop Ozzy" and Arsenal's "Desktop Wenger" - see here. Leave enabled if you want to receive messages Source=Paul Collins Startup list [sks-32] Number=9479 Confirmed=X Filename=SKS32P~1.EXE Description=SpyKeySpy logs keystrokes and sends the stolen information to a configurable email address Source=Paul Collins Startup list [Skunk] Number=9480 Confirmed=X Filename=Skunk.exe Description=Added by the SUNK-A WORM! Note - this file is found in the root folder (C:\), (D:\), etc Source=Paul Collins Startup list [SkyBlaster Scheduler] Number=9481 Confirmed=Y Filename=SSFSch.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [skynetave.exe] Number=9482 Confirmed=X Filename=skynetave.exe Description=Added by the SASSER.D WORM! Source=Paul Collins Startup list [SkynetRevenge] Number=9483 Confirmed=X Filename=winlogon.scr Description=Added by the NETSKY.AA WORM! Source=Paul Collins Startup list [Skype] Number=9484 Confirmed=N Filename=Skype.exe Description="Skype is free and simple software that will enable you to make free calls anywhere in the world in minutes" Source=Paul Collins Startup list [SkypeMate] Number=9485 Confirmed=N Filename=SkypeMate.exe Description=SkypeMate acts as a bridge between networks of VoIP and PSTN Source=Paul Collins Startup list [SkypeStartup] Number=9486 Confirmed=X Filename=Skype.exe Description=Added by the PYKSE-A WORM! Source=Paul Collins Startup list [SkySurfer Management Service] Number=9487 Confirmed=Y Filename=SmaServ.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [SkyTel] Number=9488 Confirmed=U Filename=SkyTel.exe Description=Process associated with Realtek Voice Manager for some of their audio chipsets Source=Paul Collins Startup list [sl4 rules] Number=9489 Confirmed=X Filename=rbot32.exe Description=Added by the SDBOT-QC WORM! Source=Paul Collins Startup list [slack12] Number=9490 Confirmed=X Filename=mfcee.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Slayhacker734] Number=9491 Confirmed=X Filename=slay7383.exe Description=Added by the SIKBOT-A TROJAN! Source=Paul Collins Startup list [SleepManager] Number=9492 Confirmed=N Filename=SleepMgr.exe Description=This program locates free contiguous disk spaces and allocates them for storing BASE MEMORY, EXTENDED MEMORY, VIDEO MEMORY, and SM RAM. It helps the computer come out of hibernate mode Source=Paul Collins Startup list [Slibe.com] Number=9493 Confirmed=U Filename=Sliber.EXE Description=Sliber - freeware screen capturing & online sharing tool Source=Paul Collins Startup list [SlickRun] Number=9494 Confirmed=U Filename=sr.exe Description="SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords), so C:\Program Files\Outlook Express\msimn.exe becomes MAIL" Source=Paul Collins Startup list [slide] Number=9495 Confirmed=X Filename=Iexplore.exe Description=Added by the GASLIDE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which should not appear in Msconfig/Startup unless you add it manually! Source=Paul Collins Startup list [slimp3] Number=9496 Confirmed=N Filename=SliMP3 Server.exe Description=Slimp3 Server - "presents an entirely new way of accessing and enjoying your music collection. Instead of storing your music on CDs or memory cards, the SliMP3 uses your home network to access the music stored on your PC" Source=Paul Collins Startup list [Slingshot] Number=9497 Confirmed=N Filename=SLINGS~1.EXE Description=Atomica Slingshot - "reference tool with access to dictionary and encyclopedia terms, bios, technical terms, history, geography, and much more". Now superseed by 1-Click Answers Source=Paul Collins Startup list [slipcore] Number=9498 Confirmed=Y Filename=slipcore.exe Description=Core module for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server Source=Paul Collins Startup list [slipgui] Number=9499 Confirmed=Y Filename=slipgui.exe Description=User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server Source=Paul Collins Startup list [SlipStream] Number=9500 Confirmed=Y Filename=slipcore.exe Description=Core module for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server Source=Paul Collins Startup list [slmss] Number=9501 Confirmed=X Filename=slmss.exe Description=SeekSeek search hijacker related - see here Source=Paul Collins Startup list [sload] Number=9502 Confirmed=X Filename=sload.exe Description=Win SynchroAd adware, also detected as DLOADER-QG TROJAN! Source=Paul Collins Startup list [slvchost32] Number=9503 Confirmed=X Filename=slvchost32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [sm] Number=9504 Confirmed=X Filename=sa_exe.exe Description=Added by the OLFEB.A TROJAN! Source=Paul Collins Startup list [sm] Number=9505 Confirmed=X Filename=sf_exe.exe Description=Added by the OLFEB.A TROJAN! Source=Paul Collins Startup list [sm] Number=9506 Confirmed=X Filename=sm_exe.exe Description=Added by the OLFEB.A TROJAN! Source=Paul Collins Startup list [sm] Number=9507 Confirmed=X Filename=sr_exe.exe Description=Added by the LUKUSPAM TROJAN! Source=Paul Collins Startup list [SM1BG] Number=9508 Confirmed=N Filename=SM1BG.EXE Description=USB driver for downloading from within Napster to portable MP3 players. Only required at startup if you use it all the time - otherwise start it manually when required Source=Paul Collins Startup list [SM1NINT] Number=9509 Confirmed=N Filename=SM1NINT.exe Description=Cypress USB Mass Storage Driver Notification Icon Application - tray notification for Cypress base memory sticks and external storage devices for Win98 Source=Paul Collins Startup list [SM56 Helper Win32 Utility] Number=9510 Confirmed=N Filename=sm56hlpr.exe Description=Helper utility for Motorola based SM56 software modems - resides in the System Tray Source=Paul Collins Startup list [Sm56acl] Number=9511 Confirmed=N Filename=sm56hlpr.exe Description=Helper utility for Motorola based SM56 software modems - resides in the System Tray Source=Paul Collins Startup list [sman] Number=9512 Confirmed=X Filename=app***.tmp [* = digit] Description=Unidentified adware Source=Paul Collins Startup list [Smapp] Number=9513 Confirmed=N Filename=smtray.exe Description=System Tray access for the Compaq/ADI SoundMAX integrated digital audio controller Source=Paul Collins Startup list [Smart Card Service] Number=9514 Confirmed=N Filename=ScardSvr.exe Description=For Smart Card readers. Known to cause problems, especially for Windows 2000 users - see here. Probably not required unless you use such a device regularly Source=Paul Collins Startup list [Smart Connect Monitor] Number=9515 Confirmed=U Filename=SCMon.exe Description=Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio Source=Paul Collins Startup list [Smart Connect Setup] Number=9516 Confirmed=U Filename=SCSetup.exe Description=Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio Source=Paul Collins Startup list [Smart Keyboard] Number=9517 Confirmed=U Filename=Smartkbd.exe Description=Netropa Smart Keyboard driver Source=Paul Collins Startup list [Smart Label O Server] Number=9518 Confirmed=N Filename=ssloserv.exe Description=Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Source=Paul Collins Startup list [Smart Label RFViewer] Number=9519 Confirmed=N Filename=SSLFVIEW.EXE Description=Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Source=Paul Collins Startup list [Smart Start UP] Number=9520 Confirmed=N Filename=PnPDetect.exe Description=Part of Presto! Mr.Photo - "an ideal program for creating, sharing, and manag-ing digital images and videos" Source=Paul Collins Startup list [Smart Touch] Number=9521 Confirmed=U Filename=STouch.exe Description=Related to Plustek OpticSlim scanner Source=Paul Collins Startup list [Smart Type Assistant] Number=9522 Confirmed=N Filename=sta.exe Description=Smart Type Assistant - a complex typing automation tool, intended to make your work faster and safer Source=Paul Collins Startup list [Smartalec] Number=9523 Confirmed=U Filename=pcaccel.exe Description=Smartalec PC Accelerator - system optimization utility Source=Paul Collins Startup list [SmartBarXP] Number=9524 Confirmed=N Filename=SmartBarXP.exe Description=SmartBarXP is a bar that runs down the side of your screen, and can be configured to display interactive panels known as 'panes'. These panes include media players, slideshow and image viewing panes, a virtual desktop manager, and live news, weather and stock feeds to mention but a few Source=Paul Collins Startup list [sMaRTcaPs] Number=9525 Confirmed=N Filename=SMARTC~1.EXE Description=sMaRTcaPs from Phoebus LLC - enables you to configure the time needed to depress Caps Lock, Num Lock & Insert keys Source=Paul Collins Startup list [Smarthruengine] Number=9526 Confirmed=U Filename=QS.exe Description=Samsung smarthru software, used with Lexmark Z82 or Samsung multifunction printers Source=Paul Collins Startup list [SmartPCXL] Number=9527 Confirmed=U Filename=pcaccel.exe Description=Smartalec PC Accelerator - system optimization utility Source=Paul Collins Startup list [SmartSync Pro] Number=9528 Confirmed=U Filename=SmartSync.exe Description=Related to CompanionLink Software Inc. Synchronization solutions for ACT!, GoldMine, Lotus Notes and Microsoft Outlook Source=Paul Collins Startup list [SMax4] Number=9529 Confirmed=N Filename=SMax4.exe Description=System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel Source=Paul Collins Startup list [SMax4PNP] Number=9530 Confirmed=U Filename=SMax4PNP.exe Description=SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments Source=Paul Collins Startup list [smbdpmi] Number=9531 Confirmed=? Filename=smbdpmi.exe Description=IBM Netfinity Director and Universal Management Services related. What does it do and is it required? Source=Paul Collins Startup list [smc] Number=9532 Confirmed=Y Filename=smc.exe Description=Sygate Firewall Source=Paul Collins Startup list [smc] Number=9533 Confirmed=Y Filename=spfsmc.exe Description=Sygate Firewall Source=Paul Collins Startup list [SMC Service] Number=9534 Confirmed=Y Filename=smc.exe Description=Sygate Firewall Source=Paul Collins Startup list [SMC Service] Number=9535 Confirmed=Y Filename=spfsmc.exe Description=Sygate Firewall Source=Paul Collins Startup list [smcserv] Number=9536 Confirmed=X Filename=winsrv.exe Description=Added by the AGOBOT-OU WORM! Source=Paul Collins Startup list [SmcService] Number=9537 Confirmed=Y Filename=smc.exe Description=Sygate Firewall Source=Paul Collins Startup list [SmcServices] Number=9538 Confirmed=Y Filename=smc.exe Description=Sygate Firewall Source=Paul Collins Startup list [SmcServices] Number=9539 Confirmed=Y Filename=spfsmc.exe Description=Sygate Firewall Source=Paul Collins Startup list [Smcsta.exe] Number=9540 Confirmed=? Filename=Smcsta.exe Description=SMC Networks wireless PCI card driver. Is it required? Source=Paul Collins Startup list [SmcSVR] Number=9541 Confirmed=X Filename=SmcSVR.exe Description=Added by the LEGMIR.JU TROJAN! Source=Paul Collins Startup list [Smiley District] Number=9542 Confirmed=X Filename=plugin.exe Description=Smiley District adware Source=Paul Collins Startup list [Smith Micro try] Number=9543 Confirmed=N Filename=smiptray.exe Description=Smith Micro shared files. Comes with D-Link web cam Source=Paul Collins Startup list [smodul] Number=9544 Confirmed=U Filename=smodule.exe Description=UserMonitor from Neuber. Teachers can broadcast screen to other screens, see students screens in a network and detect unauthorized software Source=Paul Collins Startup list [SmoothView] Number=9545 Confirmed=X Filename=SmoothView.exe Description=TOSHIBA Zooming Utility - allows "automatic" zoom feature in some appications, like IE, MS-Office, WMPlayer, Adobe Reader and also desktop icons Source=Paul Collins Startup list [SMPAutoStart] Number=9546 Confirmed=U Filename=smpdemo.exe Description=Smart Phone Recorder demo from KenGolf.com. Answering Machine, Caller ID, Call Recording Source=Paul Collins Startup list [smres] Number=9547 Confirmed=X Filename=smres.exe Description=Added by the AGOBOT-UA WORM! Source=Paul Collins Startup list [SMS Application Launcher] Number=9548 Confirmed=U Filename=LAUNCH32.EXE Description=Microsoft Systems Management Server - used to manage computers on a network remotely Source=Paul Collins Startup list [SMS Client Service] Number=9549 Confirmed=U Filename=clisvc95.exe Description=When the SMS Client service starts on a domain controller, the Client service modifies the SMSCliToknAcct & user account group membership, user rights, and account comment. The Client service then waits for the synchronization of the comment to verify that the account and user rights are properly set for this account. This account is used to obtain a token to start the SMS Client processes, such as the Software Inventory and Software Distribution agents (MS Systems Management Server) Source=Paul Collins Startup list [Sms System32] Number=9550 Confirmed=X Filename=SmsSystem32.exe Description=Unidentified malware Source=Paul Collins Startup list [SMS Win9x Message Agent] Number=9551 Confirmed=U Filename=?? Description=This program assigns a user to a Systems Management Server site Source=Paul Collins Startup list [SMS Win9x Message Agent] Number=9552 Confirmed=U Filename=SMSMsg.exe Description=This program assigns a user to a Systems Management Server site Source=Paul Collins Startup list [Smserial] Number=9553 Confirmed=N Filename=sm56hlpr.exe Description=Helper utility for Motorola based SM56 software modems - resides in the System Tray Source=Paul Collins Startup list [SMSI Loader] Number=9554 Confirmed=N Filename=SMLoader.exe Description=Smith Micro HotFax - fax software Source=Paul Collins Startup list [smsm] Number=9555 Confirmed=X Filename=smsm.exe Description=Added by the BANKER-CO TROJAN! Source=Paul Collins Startup list [smsrv] Number=9556 Confirmed=X Filename=smsrv.exe Description=Added by the AGOBOT-SX WORM! Source=Paul Collins Startup list [SMSS] Number=9557 Confirmed=X Filename=smss.exe Description=Added by the FLOOD.F TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Catroot" subfolder Source=Paul Collins Startup list [smss] Number=9558 Confirmed=X Filename=[path to smss.exe] Description=Added by the ALADINZ.F TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [smss] Number=9559 Confirmed=X Filename=smss.exe Description=Added by the AGENT-TR TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [smss] Number=9560 Confirmed=X Filename=smss.exe Description=Added by the BOROBOT-J TROJAN and variants! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Smss] Number=9561 Confirmed=X Filename=ssms.exe Description=Added by the RBOT.OP WORM! Source=Paul Collins Startup list [smss.exe] Number=9562 Confirmed=X Filename=csrss.exe Description=Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [smssLevel4] Number=9563 Confirmed=X Filename=smss.exe Description=Unidentified malware! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in Program Files\Windows Media Player\Skins\WindowsMediaSkin\Data\Level4 folder Source=Paul Collins Startup list [SMSSS] Number=9564 Confirmed=X Filename=smsss.exe Description=Added by the SDBOT.ZD WORM! Source=Paul Collins Startup list [SMSSS Loader] Number=9565 Confirmed=X Filename=smsss.exe Description=Added by the AGOBOT.MQ WORM! Source=Paul Collins Startup list [SMSSU] Number=9566 Confirmed=X Filename=SMSSU.EXE Description=Hijacker, detected by Norton antivirus as Trojan.StartPage.O Source=Paul Collins Startup list [smsys] Number=9567 Confirmed=X Filename=Explorer.exe Description=Added by the CLICKER-C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a "Template" subfolder Source=Paul Collins Startup list [smsys] Number=9568 Confirmed=X Filename=vi.exe Description=Adult content dialler Source=Paul Collins Startup list [SMSystemAnalyzer] Number=9569 Confirmed=U Filename=SMSystemAnalyzer.exe Description=Part of the Iolo System Mechanic optimization tool Source=Paul Collins Startup list [sms_msn] Number=9570 Confirmed=X Filename=sms_msn.exe Description=Added by an unknown WORM or TROJAN! Source=Paul Collins Startup list [sms_msn40] Number=9571 Confirmed=X Filename=sms_msn40.exe Description=Added by an unknown WORM or TROJAN infection Source=Paul Collins Startup list [Smt] Number=9572 Confirmed=U Filename=SMT.exe Description=Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself Source=Paul Collins Startup list [SMToolbar] Number=9573 Confirmed=N Filename=SMToolbar.exe Description=StartMake.com toolbar Source=Paul Collins Startup list [SMTP32 Mailing Protocol] Number=9574 Confirmed=X Filename=smtp32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SmWizard] Number=9575 Confirmed=? Filename=SmWizard.exe Description=SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? Source=Paul Collins Startup list [SN Messenger] Number=9576 Confirmed=X Filename=msnmsgr.exe Description=Added by the RBOT-AVP WORM! Source=Paul Collins Startup list [snapple] Number=9577 Confirmed=X Filename=snapple.exe Description=Added by the FORBOT-EG WORM! Source=Paul Collins Startup list [snbr] Number=9578 Confirmed=? Filename=snbr.exe Description=?? Source=Paul Collins Startup list [snbupt] Number=9579 Confirmed=X Filename=snbupt.exe Description=UpSpiralBar adware Source=Paul Collins Startup list [sncntr] Number=9580 Confirmed=X Filename=sncntr.exe Description=Added by the DLUCA-I TROJAN! Source=Paul Collins Startup list [SNCT511] Number=9581 Confirmed=? Filename=vsnct511.exe Description=Unidentified "Snapshot Viewer"- what does it do and is it required? Source=Paul Collins Startup list [snd332] Number=9582 Confirmed=X Filename=snd332.exe Description=Added by the B1LD0 AIM WORM! Source=Paul Collins Startup list [Sndcompat] Number=9583 Confirmed=X Filename=Sndcompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [sndmi13] Number=9584 Confirmed=U Filename=vsndmi13.exe Description=Driver for DualCam cameras - that combine the best features of a digital still camera and a webcam Source=Paul Collins Startup list [SNDMon] Number=9585 Confirmed=U Filename=SNDMon.exe Description=Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual updates but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is disabled on one of the computers � then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation Source=Paul Collins Startup list [Sndsaver] Number=9586 Confirmed=X Filename=Sndsaver.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [sndsrvc] Number=9587 Confirmed=? Filename=SNDSRVC.EXE Description=Part of Norton Personal Firewall and Norton Internet Security - what does it do and is it required? Source=Paul Collins Startup list [SNInstall] Number=9588 Confirmed=X Filename=[various filenames] Description=Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe Source=Paul Collins Startup list [Snippet] Number=9589 Confirmed=U Filename=SnippingTool.exe Description=The Snipping Tool (part of the Experience Pack for Tablet PC) allows you to easily "cut out" anything on screen and share it with other people. The whole screen becomes an "inkable" surface that you can add comments to and mark up however you like. You can then save that annotated image to use later, or send it to someone else in an E-mail message Source=Paul Collins Startup list [SNM] Number=9590 Confirmed=U Filename=SNM.exe Description=SpyNoMore anti-spyware Source=Paul Collins Startup list [SnoopFreeUI] Number=9591 Confirmed=U Filename=SnoopFreeUI.exe Description=Anti-keylogging software made by SnoopFree Software Source=Paul Collins Startup list [SNP Generic Host Process] Number=9592 Confirmed=X Filename=svchost.exe Description=Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [snp2std] Number=9593 Confirmed=N Filename=vsnp2std.exe Description=Digital camera related Source=Paul Collins Startup list [snpstd] Number=9594 Confirmed=? Filename=vsnpstd.exe Description=Sonix PC Camera Monitor MFC Application. What does it do and is it required? Source=Paul Collins Startup list [SNPSTD2] Number=9595 Confirmed=? Filename=vsnpstd2.exe Description=CameraMonitor MFC Application. Appears to be related to a USB connection to a digital camera -is it required? Source=Paul Collins Startup list [snpstd3] Number=9596 Confirmed=Y Filename=vsnpstd3.exe Description=Sonix Inc. Camera Monitor MFC Application Source=Paul Collins Startup list [Snsicon] Number=9597 Confirmed=N Filename=Snsicon.exe Description=Launches a screensaver program from Second Nature Source=Paul Collins Startup list [SNSS.EXE] Number=9598 Confirmed=X Filename=SNSS.EXE Description=Added by the Nunci premium rate dialer Source=Paul Collins Startup list [snvc] Number=9599 Confirmed=X Filename=snvc.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [SO5 Integrator Pass One] Number=9600 Confirmed=? Filename=sointgr.exe Description=StarOffice 5. See here for more details Source=Paul Collins Startup list [SO5 Integrator Pass Two] Number=9601 Confirmed=? Filename=sointgr.exe Description=StarOffice 5. See here for more details Source=Paul Collins Startup list [Soar] Number=9602 Confirmed=X Filename=Rwon.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Social Security Agency] Number=9603 Confirmed=X Filename=rpcxsocsa.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sock32] Number=9604 Confirmed=X Filename=sock32.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [Socket Utility] Number=9605 Confirmed=X Filename=svchostz.exe Description=Added by the DAEMONI-E TROJAN! Source=Paul Collins Startup list [Socket Utility] Number=9606 Confirmed=X Filename=socket.exe Description=Added by the DAEMONI-E TROJAN! Source=Paul Collins Startup list [Socket Utility] Number=9607 Confirmed=X Filename=svchostz.exe Description=Added by the DAEMONI-E TROJAN! Source=Paul Collins Startup list [SoDA Startup] Number=9608 Confirmed=Y Filename=SodaStartup.exe Description=Used by the IBM Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software Source=Paul Collins Startup list [soffice] Number=9609 Confirmed=N Filename=SOFFICE.EXE Description=Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory). Source=Paul Collins Startup list [Soft Profile Inc] Number=9610 Confirmed=X Filename=hxdef.exe... Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [softIce Update 32] Number=9611 Confirmed=X Filename=wininits.exe Description=Added by the RBOT-ANB WORM! Source=Paul Collins Startup list [SoftickPPP] Number=9612 Confirmed=U Filename=PPPGate.exe Description=Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer Source=Paul Collins Startup list [SOFTinst] Number=9613 Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [SoftStuff Wallpaper Changer] Number=9614 Confirmed=U Filename=softstrt.exe Description=AzureBay wallpaper changer Source=Paul Collins Startup list [Software] Number=9615 Confirmed=X Filename=software.exe Description=Added by the CRABTON-B TROJAN! Source=Paul Collins Startup list [SoftwareStation] Number=9616 Confirmed=U Filename=station.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [Solo Sentry] Number=9617 Confirmed=Y Filename=Solosent.exe Description=Solo Antivirus Source=Paul Collins Startup list [SoloSchedule] Number=9618 Confirmed=U Filename=Solocfg.exe Description=Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis Source=Paul Collins Startup list [SoloSysCheck] Number=9619 Confirmed=U Filename=Syscheck.exe Description=Solo antivirus System Integrity Check - Monitors system registry, system.ini, win.ini and startup to protect you from new Internet Worms and Backdoors Source=Paul Collins Startup list [somatic] Number=9620 Confirmed=X Filename=somatic.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [Sonic A3D Control] Number=9621 Confirmed=N Filename=vrtxctrl.exe Description=Sound related options Source=Paul Collins Startup list [Sonic RecordNow!] Number=9622 Confirmed=X Filename=smsc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [SoniqueQuickStart] Number=9623 Confirmed=N Filename=sqstart.exe Description=Quickstart for the discontinued Sonique audio player. Available via Start -> Programs Source=Paul Collins Startup list [SonnReg] Number=9624 Confirmed=? Filename=SonnReg.exe Description=Now superseeded by ColorWizzard - 3Deep corrected lighting, shading and color for all your 2D and 3D games. Possibly a registration reminder? Source=Paul Collins Startup list [SonudMan] Number=9625 Confirmed=X Filename=SonudMan.exe Description=Added by the STARTPAGE.Q TROJAN! Source=Paul Collins Startup list [SonudMan] Number=9626 Confirmed=X Filename=WNILOGON.exe Description=Added by the QQROB-DC TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [SonudMon] Number=9627 Confirmed=X Filename=SonudMon.exe Description=Added by the LEWOR-J TROJAN! Source=Paul Collins Startup list [SonyPowerCfg] Number=9628 Confirmed=U Filename=SPMgr.exe Description=Related to Sony VAIO Power Management Module installed on laptops and provides additional configuration options for these devices. This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [Soot] Number=9629 Confirmed=? Filename=rcea.exe Description=?? Source=Paul Collins Startup list [sophagnt] Number=9630 Confirmed=? Filename=sophagnt.exe Description=Possibly related to Sophocles Screenwriting Software? Source=Paul Collins Startup list [SOProc_RegSoAlertWxLiteNnAj] Number=9631 Confirmed=X Filename=rundll32 shell32.dll, ShellExec_RunDLL [path] soproc.exe Description=Advertising by SoftwareOnline - monitors your browsing habits and distributes the data back to the author's servers for analysis Source=Paul Collins Startup list [SOS] Number=9632 Confirmed=X Filename=SOS.exe Description=Added by the PHILIS VIRUS! Source=Paul Collins Startup list [SoSyncMonitor] Number=9633 Confirmed=? Filename=SoSyncMonitor.exe Description=SuperOffice related. What does it do and is it required? Source=Paul Collins Startup list [Sound Loader] Number=9634 Confirmed=X Filename=sndloader.exe Description=Added by the AGOBOT-BV WORM! Source=Paul Collins Startup list [Sound services] Number=9635 Confirmed=X Filename=SOUND32.EXE Description=Added by the AGOBOT.GG WORM! Source=Paul Collins Startup list [Sound System] Number=9636 Confirmed=X Filename=WinSound1.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [soundcontrl] Number=9637 Confirmed=X Filename=soundcontrl.exe Description=Added by the GAOBOT.AFJ WORM! Source=Paul Collins Startup list [sounddrv] Number=9638 Confirmed=X Filename=sndbdrv3104.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [SoundFusion] Number=9639 Confirmed=? Filename=rundll32 cwcprops.cpl Description=Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? Source=Paul Collins Startup list [SoundFusion] Number=9640 Confirmed=? Filename=rundll32 hercplgs.cpl, BootEntryPoint Description=Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? Source=Paul Collins Startup list [SoundFusion] Number=9641 Confirmed=? Filename=RunDll32 cwaprops.cpl, C25CrystalControlWnd Description=Control panel item for a Terratec soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? Source=Paul Collins Startup list [SoundMam] Number=9642 Confirmed=X Filename=SVOHOST.exe Description=Added by the QQROB-AAL TROJAN! Source=Paul Collins Startup list [soundman] Number=9643 Confirmed=N Filename=soundman.exe Description=System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel Source=Paul Collins Startup list [SOUNDMAN Microsoft Help] Number=9644 Confirmed=X Filename=soun.pif Description=Added by the RBOT-AIU WORM! Source=Paul Collins Startup list [SoundMAX] Number=9645 Confirmed=N Filename=SMax4.exe Description=System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel Source=Paul Collins Startup list [SoundMAX] Number=9646 Confirmed=X Filename=SoundMAX.exe Description=Added by the RIZON-A WORM! Note - this file is placed in the Startup folder itself, and has NO relation to SoundMax sound cards! Source=Paul Collins Startup list [SoundMax Audio Drivers] Number=9647 Confirmed=X Filename=SndMAX.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [SoundMAXPnP] Number=9648 Confirmed=U Filename=SMax4PNP.exe Description=SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments Source=Paul Collins Startup list [soundmix] Number=9649 Confirmed=X Filename=soundmix.exe Description=Added by the AGENT.PGV WORM! Source=Paul Collins Startup list [SoundMixer] Number=9650 Confirmed=X Filename=smvss.exe Description=Added by the DEDLER-G TROJAN! Source=Paul Collins Startup list [Soundmx] Number=9651 Confirmed=X Filename=Soundmx.exe Description=CoolWebSearch Tapicfg parasite variant Source=Paul Collins Startup list [soundtask] Number=9652 Confirmed=X Filename=soundtask.exe Description=Added by the AGOBOT-MD WORM! Source=Paul Collins Startup list [soundtasks] Number=9653 Confirmed=X Filename=soundtasks.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [soundtctrls] Number=9654 Confirmed=X Filename=soundtctrls.exe Description=Added by the AGOBOT-ZV WORM! Source=Paul Collins Startup list [SoundView] Number=9655 Confirmed=X Filename=msdview32.exe Description=Trojan downloader Source=Paul Collins Startup list [sounofts] Number=9656 Confirmed=X Filename=sounofts.exe Description=Added by the AGOBOT-ND WORM! Source=Paul Collins Startup list [sountskmanager] Number=9657 Confirmed=X Filename=sountaskmgr Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [SourcePath] Number=9658 Confirmed=N Filename=gwreg.exe Description=Used to update Gateway registry settings for System Restoration Kit and Web update programs Source=Paul Collins Startup list [sp] Number=9659 Confirmed=X Filename=sp.reg Description=IE search hijacker - changes the default search to http://www.gocybersearch.com/ Source=Paul Collins Startup list [sp] Number=9660 Confirmed=X Filename=regedit-s .... sp.dll Description=Malicious javascript annoyance that changes the default search engine in IE to one of many including "topsearcher". See here for more and a fix Source=Paul Collins Startup list [sp] Number=9661 Confirmed=X Filename=se.dll, DllInstall Description=Added by the Startpage.M hijacker Source=Paul Collins Startup list [sp] Number=9662 Confirmed=X Filename=rundll32 (Path to Trojan DLL), DllInstall Description=Added by the ABLANK-W and ABLANK-Z TROJANS! Source=Paul Collins Startup list [SP TimeSync] Number=9663 Confirmed=U Filename=SP TimeSync.exe Description=SP TimeSync lets you synchronize your computer's clock with any Internet atomic clock (time server) Source=Paul Collins Startup list [SP00LSV] Number=9664 Confirmed=X Filename=Sp00lsv.exe Description=Added by the GRAYBIRD.E TROJAN! Source=Paul Collins Startup list [SP2 Connection Patcher] Number=9665 Confirmed=U Filename=SP2ConnPatcher.exe Description=Changes limit of concurrent TCP connections of Windows Service Pack 2 Source=Paul Collins Startup list [SP2 data] Number=9666 Confirmed=X Filename=[path] repcale.exe [path] apc.exe Description=Added by a variant of the RANDON.AN WORM! Source=Paul Collins Startup list [SP2 Firewall/Internet Updater] Number=9667 Confirmed=X Filename=crssrs.exe Description=Added by the RBOT.BJO WORM! Source=Paul Collins Startup list [sp2chk.exe] Number=9668 Confirmed=X Filename=sp2chk.exe Description=Added by the ALUROOT.A TROJAN! Source=Paul Collins Startup list [sp2ctr] Number=9669 Confirmed=X Filename=sp2ctr.exe Description=Added by the DLUCA-M TROJAN! Source=Paul Collins Startup list [sp2fwxp] Number=9670 Confirmed=X Filename=sp2fwxp.exe Description=Added by the SMALL.ABW TROJAN! Source=Paul Collins Startup list [sp2update] Number=9671 Confirmed=X Filename=sp2update.exe Description=SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer Source=Paul Collins Startup list [Spam Blocker for Outlook Express] Number=9672 Confirmed=X Filename=SBInst.exe Description=HotBar related Source=Paul Collins Startup list [SPAM FIREWALL] Number=9673 Confirmed=X Filename=mfirewall.exe Description=Added by the SDBOT.AOU WORM! Source=Paul Collins Startup list [Spam Sleuth] Number=9674 Confirmed=U Filename=SpamSleuth.exe Description=Spam Sleuth E-mail spam detection program Source=Paul Collins Startup list [SpamBlocker] Number=9675 Confirmed=X Filename=SbOEAddOn.exe Description=Related to Hotbar's Weather Forecast tool for your desktop Source=Paul Collins Startup list [SPAMfighter Agent] Number=9676 Confirmed=U Filename=SFAgent.exe Description=SPAMfighter anti email spam filter Source=Paul Collins Startup list [spamihilator] Number=9677 Confirmed=U Filename=spamihilator.exe Description=Spamihilator - spam filter Source=Paul Collins Startup list [SpamPal] Number=9678 Confirmed=U Filename=spampal.exe Description=SpamPal - anti-spam tool Source=Paul Collins Startup list [SpamSubtract] Number=9679 Confirmed=U Filename=SpamSubtract.exe Description=Intermute SpamSubtract - junk email detection and removal program Source=Paul Collins Startup list [Spark] Number=9680 Confirmed=U Filename=Spark.exe Description=Spark instant messaging server Source=Paul Collins Startup list [spc_w] Number=9681 Confirmed=N Filename=hcm.exe Description=NetZero Search Enhancement related Source=Paul Collins Startup list [spc_w] Number=9682 Confirmed=N Filename=blspc.exe Description=NetZero Search Enhancement related Source=Paul Collins Startup list [spc_w] Number=9683 Confirmed=N Filename=nzspc.exe Description=NetZero Search Enhancement related Source=Paul Collins Startup list [Spdstart] Number=9684 Confirmed=N Filename=Spdstart.exe Description=Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications, such as Word and Excel." Source=Paul Collins Startup list [Speaking Clock Deluxe] Number=9685 Confirmed=U Filename=SpClDlx.exe Description=Speaking Clock Deluxe - turns your computer into a speaking clock with several languages. It can also keep track of up to 50 alarms that can be set to a time and a date, and be repeated daily, weekly, monthly and yearly Source=Paul Collins Startup list [Special Firewall Service] Number=9686 Confirmed=X Filename=avguard.exe Description=Added by the NETSKY.G WORM! Source=Paul Collins Startup list [SpecialOffers] Number=9687 Confirmed=X Filename=SpecialOffers*.exe [* = digit] Description=SpecialOffers adware Source=Paul Collins Startup list [SpecialOffers] Number=9688 Confirmed=X Filename=SpecialOffers.exe Description=SpecialOffers adware Source=Paul Collins Startup list [specific] Number=9689 Confirmed=X Filename=specixic.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Speed racer] Number=9690 Confirmed=N Filename=CTSRReg.exe Description=Software for a Creative sound card Source=Paul Collins Startup list [Speed Tec] Number=9691 Confirmed=U Filename=speedtec.exe Description=Accel SpeedTec from Montana Software speeds up your modem. SpeedTec modifies the Internet Protocol settings in the Windows registry to speed downloads on all modems. If you find this improves your connectivity and download speeds leave this enabled Source=Paul Collins Startup list [SpeedBoss] Number=9692 Confirmed=X Filename=[worm filename] Description=Added by the OPASERV.AD WORM! Source=Paul Collins Startup list [SpeedItUp] Number=9693 Confirmed=U Filename=SPEEDITUP.EXE Description=Speed It Up - "all in one Speed Booster designed to significantly increase the speed of your computer and boost your PC available memory" Source=Paul Collins Startup list [Speedkey] Number=9694 Confirmed=U Filename=SPEEDKEY.EXE Description=Additional keyboard shortcuts on MS programmable keyboard Source=Paul Collins Startup list [SpeedMeter] Number=9695 Confirmed=U Filename=SpeedMeter.exe Description=Application measuring upload and download speed Source=Paul Collins Startup list [SpeedOptimizer] Number=9696 Confirmed=U Filename=spo.exe Description=SpeedOptimizer is designed to optimize and speed-up your Internet data transmission including browsing, streaming, downloading, uploading and e-mail communication Source=Paul Collins Startup list [SpeedswitchXP] Number=9697 Confirmed=U Filename=SpeedswitchXP.exe Description=SpeedswitchXP is a CPU frequency control for notebooks running Windows XP Source=Paul Collins Startup list [Speedtouch USB Diagnostics] Number=9698 Confirmed=U Filename=Dragdiag.exe Description=For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line) Source=Paul Collins Startup list [SpeedUpMyPC] Number=9699 Confirmed=U Filename=SpeedUpMyPC.exe Description=SpeedUpMyPC "automatically fine-tunes all your resources including hardware, system settings and internet usage to operate at peak performance at all times" Source=Paul Collins Startup list [Spees1] Number=9700 Confirmed=X Filename=speedy.scr Description=Added by the OPASERV.Y WORM! Source=Paul Collins Startup list [Spees2] Number=9701 Confirmed=X Filename=Speedy.bat Description=Added by the OPASERV.AD WORM! Source=Paul Collins Startup list [Spees3] Number=9702 Confirmed=X Filename=SPEEDY.PIF Description=Added by the OPASERV.AD WORM! Source=Paul Collins Startup list [Spellex Anywhere] Number=9703 Confirmed=N Filename=sa.exe Description=Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used Source=Paul Collins Startup list [SpIDerMail] Number=9704 Confirmed=Y Filename=spiderml.exe Description=DrWeb antivirus Spider Mail e-mail scanner Source=Paul Collins Startup list [Spinner Plus] Number=9705 Confirmed=N Filename=spinner.exe Description="Spinner Plus lets you listen to over 100 channels of music broadcast from Spinner.com. Spinner Plus uses RealNetwork's G2 technology to provide high-quality online audio. The technology adjusts the audio streaming to match your Internet connection speed, which helps eliminate sound distortion or choppiness". Available via Start -> Programs Source=Paul Collins Startup list [SPINX] Number=9706 Confirmed=X Filename=Wscript.exe OXNEY.B.VBS Description=Added by the YENO.B and YENO.C WORMS! Source=Paul Collins Startup list [SPnt] Number=9707 Confirmed=X Filename=SPnt.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SpokeSysTray] Number=9708 Confirmed=U Filename=SpokeSysTray.exe Description=Spoke Software client application. Spoke "uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private, secure relationship network for each user without any additional manual data entry" Source=Paul Collins Startup list [spolsvr2] Number=9709 Confirmed=X Filename=spolsvr2.exe Description=Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [spoo1sv] Number=9710 Confirmed=X Filename=spoo1sv.exe Description=Added by the SOULJET TROJAN! Source=Paul Collins Startup list [Spool] Number=9711 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.R TROJAN! Source=Paul Collins Startup list [Spool] Number=9712 Confirmed=X Filename=wys.exe Description=WhileUSurf adware Source=Paul Collins Startup list [SPOOL Configuration] Number=9713 Confirmed=X Filename=spoolsvc.exe Description=Added by the SDBOT-KD WORM! Source=Paul Collins Startup list [Spool Loader] Number=9714 Confirmed=N Filename=spool.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Spool LoadKIt] Number=9715 Confirmed=X Filename=spoolv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Spool lptt01] Number=9716 Confirmed=X Filename=spool.exe Description=RapidBlaster variant (in a "spool" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Spool Manager] Number=9717 Confirmed=X Filename=spoolsrv.exe Description=Added by the BANKER-FR TROJAN! Source=Paul Collins Startup list [Spool ml097e] Number=9718 Confirmed=X Filename=spool.exe Description=RapidBlaster variant (in a "spool" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Spool32] Number=9719 Confirmed=X Filename=pool32.exe Description=Added by the ASSASIN-F TROJAN! Source=Paul Collins Startup list [spoolax] Number=9720 Confirmed=X Filename=[path to trojan] Description=Added by the PERDA-D TROJAN! Source=Paul Collins Startup list [Spooler Service] Number=9721 Confirmed=X Filename=Spoolsrv.exe Description=Added by the JOINER.C1 TROJAN! Source=Paul Collins Startup list [Spooler Sub System Process] Number=9722 Confirmed=X Filename=SPOOL32.EXE Description=Added by the YAB.A TROJAN! Source=Paul Collins Startup list [Spooler Subsystem] Number=9723 Confirmed=X Filename=spoolsub.exe Description=Added by the SDBOT-ABG TROJAN! Source=Paul Collins Startup list [Spooler SubSystem App] Number=9724 Confirmed=X Filename=spoolsvc.exe Description=Added by the POEBOT-J WORM! Source=Paul Collins Startup list [Spooler SubSystem App] Number=9725 Confirmed=X Filename=spooIsv.exe Description=Added by the LINKBOT.M WORM! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9726 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9727 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9728 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9729 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9730 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9731 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9732 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler SubSystem Application] Number=9733 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Spooler Subsytem App] Number=9734 Confirmed=X Filename=spoolsvc.exe Description=Added by the SDBOT-MM WORM! Source=Paul Collins Startup list [SpoolerSubSystemProcess] Number=9735 Confirmed=X Filename=SpooI32.exe Description=Added by the EHKS.21 keylogger! Note - the "I" between "o" and "3" is a capital "i" not a lower case "L" Source=Paul Collins Startup list [Spools Service Controller] Number=9736 Confirmed=X Filename=spools.exe Description=Added by the KASSBOT-C WORM! Source=Paul Collins Startup list [spoolserv] Number=9737 Confirmed=X Filename=spoolserv.exe Description=Added by the SDBOT-PN WORM! Source=Paul Collins Startup list [SpoolService] Number=9738 Confirmed=X Filename=spolsv.exe Description=Added by the AGOBOT-CS WORM! Source=Paul Collins Startup list [Spoolsv] Number=9739 Confirmed=X Filename=Spoolsv.exe Description=Added by the CIADOOR.121 VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [spoolsv] Number=9740 Confirmed=X Filename=scvhosts.exe Description=Added by the SMALL-AW TROJAN! Source=Paul Collins Startup list [spoolsv] Number=9741 Confirmed=X Filename=svchost.exe Description=Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "HELP" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [spoolsv] Number=9742 Confirmed=X Filename=spoclsv.exe Description=Added by the Fujacks-M WORM! Source=Paul Collins Startup list [spoolsv manager] Number=9743 Confirmed=X Filename=SpoolMgr.exe Description=Added by the ASSIRAL WORM! Source=Paul Collins Startup list [spoolsv service] Number=9744 Confirmed=X Filename=spoolsv32.exe Description=Added by the RBOT-AHP WORM! Source=Paul Collins Startup list [SPOOLSV32] Number=9745 Confirmed=X Filename=SPOOLSV32.EXE Description=Added by the CWS-I or HAZIF-B TROJANS! Source=Paul Collins Startup list [spoolsvc] Number=9746 Confirmed=X Filename=spoolsvc.exe Description=Added by the DROPPER-AT TROJAN! Source=Paul Collins Startup list [spoolsvr32] Number=9747 Confirmed=X Filename=csmss.exe Description=Added by the AGENT-AU TROJAN! Source=Paul Collins Startup list [spoolsvr32] Number=9748 Confirmed=X Filename=csmss32.exe Description=Added by a variant of the AGENT-AU TROJAN! Source=Paul Collins Startup list [spoolsvs.exe] Number=9749 Confirmed=X Filename=spoolsvs.exe Description=Added by the DLOADER-RK TROJAN! Source=Paul Collins Startup list [SPOOLSVU] Number=9750 Confirmed=X Filename=SPOOLSVU.EXE Description=Added by the STARTPAGE.K hijacker Source=Paul Collins Startup list [spoolsvv] Number=9751 Confirmed=X Filename=spoolsvv.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [Spoolvs] Number=9752 Confirmed=X Filename=spoolvs.exe Description=Added by the SDBOT.AUS WORM! Source=Paul Collins Startup list [Spore] Number=9753 Confirmed=X Filename=MsNews.vbs Description=Added by the SPORE.A WORM! Source=Paul Collins Startup list [Spore.b] Number=9754 Confirmed=X Filename=Scmhlpr.vbs Description=Added by the SPORE.B WORM! Source=Paul Collins Startup list [SPP] Number=9755 Confirmed=? Filename=run.exe Description=?? Source=Paul Collins Startup list [spp] Number=9756 Confirmed=X Filename=regedit -s spp.reg Description=IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/ Source=Paul Collins Startup list [sppbridge] Number=9757 Confirmed=? Filename=sppbridge.exe Description=Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? Source=Paul Collins Startup list [SprintPort] Number=9758 Confirmed=? Filename=SprintPortA.exe Description=Novatel wireless modem related. What does it do and is it required? Source=Paul Collins Startup list [SpriteService] Number=9759 Confirmed=U Filename=SpriteService.exe Description=Sprite Backup is a backup application for Windows Mobile Pocket PC or Smartphone Source=Paul Collins Startup list [SPSTEALT] Number=9760 Confirmed=U Filename=SmartProtectorPro.exe Description=Smart Protector Pro - internet privacy tool that erases tracks, MRU lists, etc Source=Paul Collins Startup list [spstore] Number=9761 Confirmed=? Filename=storesp.exe Description=Softprobe - program designed to provide managers with an analysis of an individuals computer use who are under their supervision. This program is NOT related to Winpup Source=Paul Collins Startup list [Spy Blocker] Number=9762 Confirmed=U Filename=spyblocker.exe Description=SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all Source=Paul Collins Startup list [Spy Protector] Number=9763 Confirmed=U Filename=SpyProtector.exe Description=Included in the full version of Security Task Manager, Spy Protector prevents keyboard and mouse monitoring, warns when the registry is changed and eliminates internet activity and work traces Source=Paul Collins Startup list [Spy-Control] Number=9764 Confirmed=N Filename=Spy-Control.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Spy-Keylogger] Number=9765 Confirmed=U Filename=skl.exe Description=SpyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SpyAxe] Number=9766 Confirmed=N Filename=spyaxe.exe Description=Spyware remover - not recommended, see here. For removal instructions see here Source=Paul Collins Startup list [SpyBan] Number=9767 Confirmed=N Filename=SpyBan.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyBlast] Number=9768 Confirmed=X Filename=SpyBlast.exe Description=Spyware killer that is in effect autoinstalled foistware, targeted by SpyBot, among others Source=Paul Collins Startup list [SpyBlocker] Number=9769 Confirmed=U Filename=spyblocker.exe Description=SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all Source=Paul Collins Startup list [SpyBlocs] Number=9770 Confirmed=N Filename=SpyBlocs.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyBlocs3.0] Number=9771 Confirmed=N Filename=SpyBlocs3.0.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpybotSD TeaTimer] Number=9772 Confirmed=Y Filename=TeaTimer.exe Description=TeaTimer is a permanent process and registry monitor of the Spybot S&D system protector which perpetually monitors the processes called/initiated. Detects processes wanting to start and gives you options on how to deal with this process in the future Source=Paul Collins Startup list [SpyBotSnD] Number=9773 Confirmed=U Filename=Spybotsd.exe Description=Spybot - Search & Destroy - free multi-spyware removal tool from Safer Networking Ltd. Source=Paul Collins Startup list [Spybott lptt01] Number=9774 Confirmed=X Filename=spybott.exe Description=RapidBlaster variant (in a "Spybott" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Spybott ml097e] Number=9775 Confirmed=X Filename=spybott.exe Description=RapidBlaster variant (in a "Spybott" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [SpyClean] Number=9776 Confirmed=X Filename=1ClickSpyClean.exe Description=1 Click Spy Clean uses a database that was stolen from SpybotS&D. Not recommended, see here Source=Paul Collins Startup list [SpyCop ScanCheck] Number=9777 Confirmed=U Filename=MAIN.EXE Description=SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Source=Paul Collins Startup list [SpyEmergency] Number=9778 Confirmed=U Filename=SpyEmergency.exe Description=SpyEmergency security software from Netgate Source=Paul Collins Startup list [SpyEx] Number=9779 Confirmed=X Filename=Winllogo.exe Description=Added by the PRSKEY-A WORM! Source=Paul Collins Startup list [SpyFighterMonitor] Number=9780 Confirmed=N Filename=SpyFighter.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyFighterUpdate] Number=9781 Confirmed=N Filename=AutoUpdate.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyHealer] Number=9782 Confirmed=N Filename=SpyHealer.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyHeals] Number=9783 Confirmed=X Filename=SpyHeals.exe Description=Smitfraud variant Source=Paul Collins Startup list [SpyHunter] Number=9784 Confirmed=N Filename=SpyHunter.exe Description=Enigma SpyHunter - not recommended, see note Source=Paul Collins Startup list [Spykiller] Number=9785 Confirmed=U Filename=Spykiller.exe Description=Spyware remover - older versions are not recommended, see here Source=Paul Collins Startup list [SpyNuker] Number=9786 Confirmed=X Filename=Spynuker.exe Description=A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-mail marketers 'TrekData' and 'Blue Haven Media', who distribute spyware through ActiveX drive-by-download on web pages Source=Paul Collins Startup list [SpyOnThis Monitor] Number=9787 Confirmed=N Filename=SpyOnThisMonitor.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyQuake2.com] Number=9788 Confirmed=N Filename=Spy-Quake2.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpySheriff] Number=9789 Confirmed=X Filename=SpySheriff.exe Description=SpySheriff malware Source=Paul Collins Startup list [SpySpotter] Number=9790 Confirmed=N Filename=SpySpotter.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpyStopper] Number=9791 Confirmed=U Filename=spystopper.exe Description=SpyStopper - blocks intrusive spyware, Web bugs, worms, scripts, advertisements, and cookies. Protects you from being profiled and tracked Source=Paul Collins Startup list [SpySubtract] Number=9792 Confirmed=U Filename=SpySub.exe Description=SpySubtract - multi spyware removal tool Source=Paul Collins Startup list [SpySweeper] Number=9793 Confirmed=U Filename=SpySweeper.exe Description=Spy Sweeper - detects and removes spyware Source=Paul Collins Startup list [SpySweeperEnterprise] Number=9794 Confirmed=U Filename=SpySweeperUI.exe Description=User interface for Spy Sweeper Enterprise edition - "a centrally managed, scalable enterprise solution that provides best of breed protection against all types of malicious spyware, adware, and other harmful intruders" Source=Paul Collins Startup list [SpyTrooper] Number=9795 Confirmed=X Filename=SpyTrooper.exe Description=SpyTrooper - malware posing as a spyware remover, see here Source=Paul Collins Startup list [Spyware] Number=9796 Confirmed=N Filename=Spyware.exe Description=BPS spyware remover - not recommended, see here Source=Paul Collins Startup list [Spyware Begone] Number=9797 Confirmed=U Filename=SpywareBeGone.exe Description=Spyware BeGone - spyware removal utility. Previously not recommended, see here Source=Paul Collins Startup list [Spyware Begone] Number=9798 Confirmed=U Filename=freescan.exe Description=Spyware BeGone - spyware removal utility. Previously not recommended, see here Source=Paul Collins Startup list [Spyware Doctor] Number=9799 Confirmed=U Filename=spydoctor.exe Description=Spyware Doctor spyware remover Source=Paul Collins Startup list [Spyware Doctor] Number=9800 Confirmed=U Filename=swdoctor.exe Description=Spyware Doctor spyware remover Source=Paul Collins Startup list [Spyware Guard Control Panel] Number=9801 Confirmed=U Filename=spywar~1.exe Description=

"SpywareGuard provides a real-time protection solution against spyware" Source=Paul Collins Startup list [Spyware Nuker] Number=9802 Confirmed=U Filename=swn2.exe Description=Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here Source=Paul Collins Startup list [Spyware Nuker Installer] Number=9803 Confirmed=U Filename=SpywareNukerInstaller.exe Description=Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here Source=Paul Collins Startup list [Spyware remover] Number=9804 Confirmed=X Filename=Remove_spyware.exe Description=Unidentified, but not known to belong to any known spyware remover, and strongly suspected to be adware related! Source=Paul Collins Startup list [Spyware Scanner] Number=9805 Confirmed=U Filename=AseScanner.exe Description=Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here Source=Paul Collins Startup list [SpyWare Shield] Number=9806 Confirmed=U Filename=Shield.exe Description=Acronis Privacy Expert Spyware Shield prevents spyware and other suspicious programs from being installed on PCs Source=Paul Collins Startup list [Spyware Slayer] Number=9807 Confirmed=N Filename=SpywareSlayer.Exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Spyware Soft Stop] Number=9808 Confirmed=N Filename=Spyware Soft Stop.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Spyware Stormer] Number=9809 Confirmed=N Filename=SpywareStormer.Exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [Spyware Vanisher] Number=9810 Confirmed=U Filename=FreeScanner.exe Description=Spyware Vanisher - spyware removal utility. Previously not recommended, see here Source=Paul Collins Startup list [Spyware X-terminator] Number=9811 Confirmed=U Filename=SpywareX.exe Description=Spyware X-terminator - spyware remover Source=Paul Collins Startup list [Spyware-Cop] Number=9812 Confirmed=N Filename=Spyware-Cop.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareBot] Number=9813 Confirmed=N Filename=SpywareBot.exe Description=Spyware remover - not recommended, see note Source=Paul Collins Startup list [spywarefighterguard] Number=9814 Confirmed=U Filename=spfprc.exe Description=Spyware Fighter - anti spyware program Source=Paul Collins Startup list [SpywareGuard] Number=9815 Confirmed=U Filename=sgmain.exe Description=

"SpywareGuard provides a real-time protection solution against spyware" Source=Paul Collins Startup list [SpywareGuard] Number=9816 Confirmed=X Filename=winproc32.exe Description=Startpage adware Trojan Source=Paul Collins Startup list [SpywareGuard] Number=9817 Confirmed=X Filename=deinst_qfe001.exe Description=Added by a variant of the Win32.Small TROJAN! - Do NOT confuse with the legitimate SpywareGuard application Source=Paul Collins Startup list [Spywareguard lptt01] Number=9818 Confirmed=X Filename=Spywareguard.exe Description=RapidBlaster variant (in a "Spyguard" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Spywareguard ml097e] Number=9819 Confirmed=X Filename=Spywareguard.exe Description=RapidBlaster variant (in a "Spyguard" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [SpywareGuardPlus] Number=9820 Confirmed=X Filename=winmm64.exe Description=StartPage.ht homepage hijacker Source=Paul Collins Startup list [SpywareKilla] Number=9821 Confirmed=N Filename=SpywareKilla.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareLocked] Number=9822 Confirmed=N Filename=SpywareLocked.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareLocked 3.5] Number=9823 Confirmed=N Filename=SpywareLocked 3.5.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareNo] Number=9824 Confirmed=N Filename=SpywareNo.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareQuake] Number=9825 Confirmed=N Filename=SpywareQuake.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SpywareStrike] Number=9826 Confirmed=N Filename=SpywareStrike.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [SPYWATCH] Number=9827 Confirmed=N Filename=SpyWatch.exe Description=BPS spyware remover - not recommended, see here Source=Paul Collins Startup list [SQConfigChecker] Number=9828 Confirmed=X Filename=cc.exe Description=Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [SQInstaller] Number=9829 Confirmed=X Filename=SQInstaller.exe Description=Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [SQL Server] Number=9830 Confirmed=N Filename=scm.exe Description=SQL Server Service Control Manager. Available via Start -> Programs Source=Paul Collins Startup list [SQL Server Service] Number=9831 Confirmed=X Filename=sql.exe Description=Added by the RBOT-ADF Source=Paul Collins Startup list [sqservices] Number=9832 Confirmed=X Filename=wins32.exe Description=Added by the PROGENT-B TROJAN! Source=Paul Collins Startup list [SQUpdatesChecker] Number=9833 Confirmed=X Filename=uc.exe Description=Xupiter SQWire toolbar related. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [sqvynikp] Number=9834 Confirmed=X Filename=sqvynikp.exe Description=Free_Scratch_Cards foistware Source=Paul Collins Startup list [SR Agent] Number=9835 Confirmed=Y Filename=AGENTSVC.EXE Description=Related to Secure Resolutions - desktop virus protection Source=Paul Collins Startup list [Sr Agent] Number=9836 Confirmed=Y Filename=SrLogon.exe Description=Related to Secure Resolutions - desktop virus protection Source=Paul Collins Startup list [sr1exe] Number=9837 Confirmed=? Filename=updtSup3.exe Description=Found on a Dell computer, in a Documents and SettingsAll UsersApplication DataDellAlert2 subfolder Source=Paul Collins Startup list [sr64] Number=9838 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT.X TROJAN! Source=Paul Collins Startup list [SrchfstUpdate] Number=9839 Confirmed=X Filename=srchupdt.exe Description=SearchFast adware downloader Source=Paul Collins Startup list [sre] Number=9840 Confirmed=X Filename=rundll32.exe sre.dll, Register Description=CoolWebSearch parasite variant - also detected by Kaspersky antivirus as Trojan.Downloader.Agent.Fc Source=Paul Collins Startup list [srePostpone] Number=9841 Confirmed=? Filename=rundll32.exe [path] srescan.dll, DoSpecialAction Description=Related to ZoneAlarm. What does it do and is it required? Source=Paul Collins Startup list [SRFirstRun] Number=9842 Confirmed=? Filename=rundll32 srclient.dll, CreateFirstRunRp Description=Created by execution of the Windows XP sr.inf file, which installs the Windows XP System Restore feature, needed for example when installing System Restore into Windows Server 2003. Does this indeed need to run at every bootup? Source=Paul Collins Startup list [Srmclean] Number=9843 Confirmed=U Filename=srmclean.exe Description=Srmclean helps in the installation and execution of the SoundMax SoftPaq for Compaq/ADI SoundMax Integrated Digital Audio. According to Compaq - "If you disable the entry from loading into startup, then you will not be able to use the features of the sound card" Source=Paul Collins Startup list [SRNG] Number=9844 Confirmed=X Filename=srng.exe Description=ShopNavSearch.Srng search hijacker Source=Paul Collins Startup list [SRP Startup] Number=9845 Confirmed=U Filename=srrpro.exe Description=System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium "features". This is enabled if you tick the "Remove unnecessary System Restore information on startup" box. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [SRS Applet] Number=9846 Confirmed=Y Filename=SrsTray.Exe Description=S3 Sonic Vibes sound card drivers - if disabled you loose sound Source=Paul Collins Startup list [SRS Audio Sandbox] Number=9847 Confirmed=U Filename=SRSSSC.exe Description=SRS Audio Sandbox "provide amazing audio immersion and maximum thump for a personalized audio experience!" Source=Paul Collins Startup list [srshost.exe] Number=9848 Confirmed=X Filename=srshost.exe Description=Added by a variant of the RBOT-ASW WORM! Source=Paul Collins Startup list [Srv RPCrom] Number=9849 Confirmed=X Filename=NClienti386.exe Description=Added by the WATSOON.A TROJAN! Source=Paul Collins Startup list [Srv32] Number=9850 Confirmed=X Filename=Srv32.exe Description=Added by the OPASERV.J WORM! Source=Paul Collins Startup list [Srv32] Number=9851 Confirmed=X Filename=Srv32.exe Description=Added by the OPASERV.S WORM! Source=Paul Collins Startup list [Srv32 spool service] Number=9852 Confirmed=X Filename=runsrv32.exe Description=Topantispyware.com malware - recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b Source=Paul Collins Startup list [Srv32 spool service] Number=9853 Confirmed=X Filename=spoolsrv32.exe Description=Added by the SPYRE.B TROJAN! Source=Paul Collins Startup list [Srv32 spool service] Number=9854 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADER-LB TROJAN! Source=Paul Collins Startup list [Srv325] Number=9855 Confirmed=X Filename=Srv325.exe Description=Added by the AGOBOT-PR WORM! Source=Paul Collins Startup list [Srv32Old] Number=9856 Confirmed=X Filename=[worm filename].PIF Description=Added by the OPASERV.J WORM! Source=Paul Collins Startup list [Srv32Win] Number=9857 Confirmed=U Filename=SpyAgent4.exe Description=SpyAgent - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [Srv32Win] Number=9858 Confirmed=U Filename=Svchost.exe Description=Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! Source=Paul Collins Startup list [Srv32Win] Number=9859 Confirmed=U Filename=sysdiag.exe Description=SpyAgent surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [srv32win] Number=9860 Confirmed=U Filename=win16dll.exe Description=Screenspy captures screenshots silently. If you didn't install this yourself remove it Source=Paul Collins Startup list [Srvce Pack Updte] Number=9861 Confirmed=X Filename=svcpack.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [srvexc.exe] Number=9862 Confirmed=X Filename=srvexc.exe Description=Added by the SERVSAX TROJAN! Source=Paul Collins Startup list [srvprc] Number=9863 Confirmed=U Filename=srvprc.exe Description=ActMon surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [srxTray] Number=9864 Confirmed=N Filename=srxTray.exe Description=Titan FTP Server - FTP server Source=Paul Collins Startup list [SsAAD.exe] Number=9865 Confirmed=? Filename=SsAAD.exe Description=Sony SonicStage software related - "Atrac Hard Disk Monitor". What does it do and is it required? Source=Paul Collins Startup list [ssate.exe] Number=9866 Confirmed=X Filename=irun4.exe Description=Added by the BEAGLE.J WORM! Source=Paul Collins Startup list [ssate.exe] Number=9867 Confirmed=X Filename=winsys.exe Description=Added by the BEAGLE.K WORM! Source=Paul Collins Startup list [SSBkgdUpdate] Number=9868 Confirmed=N Filename=SSBkgdupdate.exe Description=ScanSoft OmniPage auto updater. Can be disabled using the main program's options. Note - if you have a Soundblaster Audigy2 ZS soundcard installed on your computer and the volume of your soundsystem is turned on extremely high disabling this will solve the problem Source=Paul Collins Startup list [SSC Service Utility] Number=9869 Confirmed=U Filename=ssc_serv.exe Description=SSC Service Utility is a printer utility for refilled Epson cartridges Source=Paul Collins Startup list [SSCFBTN.EXE] Number=9870 Confirmed=U Filename=SSCFBTN.EXE Description=Samsung smarthru software,used with Lexmark Z82 or Samsung multifunction printers Source=Paul Collins Startup list [sscRun] Number=9871 Confirmed=Y Filename=SSCRun.exe Description=AOL's firewall Source=Paul Collins Startup list [SSC_UserPrompt] Number=9872 Confirmed=Y Filename=UsrPrmpt.exe Description=Part of Symantec's AntiVirus suite and comes usually with a product update, if not on the system already. Required for essential applications to work properly Source=Paul Collins Startup list [Ssd] Number=9873 Confirmed=Y Filename=Std.exe Description=Stealthdisk - file and folder hiding/locking utility Source=Paul Collins Startup list [ssdiag] Number=9874 Confirmed=? Filename=ssdiag.exe Description=Equinox (now Avocent) "Configuration and DOS Diagnostic for DOS and Windows platforms" Source=Paul Collins Startup list [SSDPSRV] Number=9875 Confirmed=N Filename=ssdpsrv.exe Description=Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program, open Add/Remove Programs, select either Communications (Me) or Networking Services (XP), and remove the checkmark next to Universal Plug and Play Source=Paul Collins Startup list [ssgrate.exe] Number=9876 Confirmed=X Filename=system.exe Description=Added by the MITGLIEDER.C TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9877 Confirmed=X Filename=irun.exe Description=Added by the MITGLIEDER.D TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9878 Confirmed=X Filename=irun4.exe Description=Added by the MITGLIEDER.F TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9879 Confirmed=X Filename=sysdoor.exe Description=Added by the MITGLIEDER.N TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9880 Confirmed=X Filename=winerdir.exe Description=Added by the MITGLIEDER.O TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9881 Confirmed=X Filename=winsystems.exe Description=Added by the BAGLEDL-J TROJAN! Source=Paul Collins Startup list [ssgrate.exe] Number=9882 Confirmed=X Filename=wintems.exe Description=Added by the MITGLIEDER.Q TROJAN! Source=Paul Collins Startup list [SSh32] Number=9883 Confirmed=U Filename=SSh32.exe Description=2Spy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SSK Service] Number=9884 Confirmed=X Filename=winssk32.exe Description=Added by the SOBIG.E WORM! Source=Paul Collins Startup list [SSL] Number=9885 Confirmed=X Filename=svchost.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [SSL Manager] Number=9886 Confirmed=X Filename=amsnmsgs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ssmmgr] Number=9887 Confirmed=U Filename=ssmmgr.exe Description=Samsung printer monitor - for checking ink levels, etc. Source=Paul Collins Startup list [ssms.exe] Number=9888 Confirmed=X Filename=SSMS.EXE Description=Added by the GISMOR WORM! Source=Paul Collins Startup list [SSPY] Number=9889 Confirmed=U Filename=SSYTEM.EXE Description=SurfingSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [sssasasb32] Number=9890 Confirmed=X Filename=sssasasb32.exe Description=Added by the TACTSLAY.F TROJAN! Source=Paul Collins Startup list [sssasasb32] Number=9891 Confirmed=X Filename=msnmsgq32.exe Description=Added by the TACTSLAY.F TROJAN! Source=Paul Collins Startup list [sstata] Number=9892 Confirmed=X Filename=dwdas.exe Description=Added by the DASDA TROJAN! Source=Paul Collins Startup list [sstata] Number=9893 Confirmed=X Filename=[path to trojan] Description=Added by the RANCK-DF TROJAN! Source=Paul Collins Startup list [SStb.exe] Number=9894 Confirmed=X Filename=SStb.exe Description=Adpowerzone.com "ServerSide" keyword hijacker Source=Paul Collins Startup list [sstray] Number=9895 Confirmed=N Filename=sstray.exe Description=nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys Source=Paul Collins Startup list [SSUpdate] Number=9896 Confirmed=X Filename=SSUpdate.exe Description=MoneyTree parasite - ActiveX control used to download premium-rate dialers Source=Paul Collins Startup list [ssvchost] Number=9897 Confirmed=X Filename=ssvchost.exe Description=Added by the HELIOS.B TROJAN! Source=Paul Collins Startup list [SSWPlauncher] Number=9898 Confirmed=X Filename=comet.exe Description=Comet Cursor adware Source=Paul Collins Startup list [Stacmon] Number=9899 Confirmed=N Filename=Stacmon.exe Description=Installed with the drivers for a SigmaTel C-Major Audio card (on a Dell Inspiron 600m PC for example). Appears as though it can be disabled with no ill effects Source=Paul Collins Startup list [StacSysTray] Number=9900 Confirmed=N Filename=StacSysTray.exe Description=System Tray control panel for SigmaTel C-Major on-board audio - as used on some Dell and Packard Bell PCs Source=Paul Collins Startup list [staeck12] Number=9901 Confirmed=X Filename=mfcee.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [standalone.exe] Number=9902 Confirmed=X Filename=standalone.exe Description=Added by the AGOBOT-ADS WORM! Source=Paul Collins Startup list [StarSkin] Number=9903 Confirmed=U Filename=starskin.exe Description=StarSkin allows you to change the view and appearance of your Windows XP box with the use of publically available themes Source=Paul Collins Startup list [Start] Number=9904 Confirmed=Y Filename=Quick95.exe Description=For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone Source=Paul Collins Startup list [Start] Number=9905 Confirmed=X Filename=windows.vbs Description=Homepage hijacker Source=Paul Collins Startup list [start] Number=9906 Confirmed=? Filename=start.exe Description=?? Source=Paul Collins Startup list [start] Number=9907 Confirmed=X Filename=sdcc.exe Description=Added by the AGENT.CSX TROJAN! Source=Paul Collins Startup list [Start aThx Roll] Number=9908 Confirmed=X Filename=f0mered.exe Description=Added by the RBOT.AAV WORM! Source=Paul Collins Startup list [start extracting] Number=9909 Confirmed=X Filename=spoolvse.exe Description=Added by the RBOT-XF WORM! Source=Paul Collins Startup list [start extracting] Number=9910 Confirmed=X Filename=spoolvs.exe Description=Added by the RBOT.AKC WORM! Source=Paul Collins Startup list [Start Getright] Number=9911 Confirmed=N Filename=getright.exe Description=See Getright Tray Icon Source=Paul Collins Startup list [Start It Upping] Number=9912 Confirmed=X Filename=svchosets.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Start Network Scanner Tool] Number=9913 Confirmed=U Filename=sdFTP.exe Description=Part of Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents" Source=Paul Collins Startup list [Start Page] Number=9914 Confirmed=X Filename=http://find.naupoint.com Description=Naupoint browser hijacker Source=Paul Collins Startup list [Start Page] Number=9915 Confirmed=X Filename=svcnt32.exe Description=Homepage hijacker, also detected as Trojan-Downloader.Win32.Delf.ks Source=Paul Collins Startup list [Start RF Wireless Keyboard] Number=9916 Confirmed=Y Filename=ktrexe.exe Description=Yuanxun Electronics RF wireless keyboard driver Source=Paul Collins Startup list [Start RF Wireless Mouse] Number=9917 Confirmed=Y Filename=cm20.exe Description=Yuanxun Electronics RF wireless mouse driver Source=Paul Collins Startup list [Start Service] Number=9918 Confirmed=U Filename=upssrv.exe Description=Cyber Power PowerPanelPlus software. "During a power failure the system automatically saves and closes open files within the battery backup time and safely powers down your computer" Source=Paul Collins Startup list [Start Up Cop] Number=9919 Confirmed=U Filename=startcop.exe Description=StartUp Cop - startup manager Source=Paul Collins Startup list [start uploading] Number=9920 Confirmed=X Filename=smsss.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Start Upping] Number=9921 Confirmed=X Filename=taskmrg.exe Description=Added by the RBOT-MA WORM! Source=Paul Collins Startup list [Start Upping] Number=9922 Confirmed=X Filename=SVCHOSTES.EXE Description=Added by the RBOT-NB WORM! Source=Paul Collins Startup list [Start Upping] Number=9923 Confirmed=X Filename=taksmgr.exe Description=Added by the RBOT-QK WORM! Source=Paul Collins Startup list [Start Upping] Number=9924 Confirmed=X Filename=mcrt32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Start Upping] Number=9925 Confirmed=X Filename=windupds.exe Description=Added by the SDBOT.AFH WORM! Source=Paul Collins Startup list [Start Upping] Number=9926 Confirmed=X Filename=windupdts.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Start Upping] Number=9927 Confirmed=X Filename=xdcc.exe Description=Added by the SPYBOT.OY WORM! Source=Paul Collins Startup list [Start Upping] Number=9928 Confirmed=X Filename=spoolnt.exe Description=Added by the RBOT-TM WORM! Source=Paul Collins Startup list [Start Uppings] Number=9929 Confirmed=X Filename=svcchosts.exe Description=Added by the SDBOT.VY WORM! Source=Paul Collins Startup list [Start Uppings] Number=9930 Confirmed=X Filename=mssupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Start Wingman Profiler] Number=9931 Confirmed=N Filename=lwtest.exe Description=Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer, it's best to leave it unchecked Source=Paul Collins Startup list [Start Wingman Profiler] Number=9932 Confirmed=N Filename=lwemon.exe�� Description=Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer, it's best to leave it unchecked Source=Paul Collins Startup list [Startacc] Number=9933 Confirmed=U Filename=startacc.exe Description=Launches Webroot's Accelerate 2000 software that "speeds up your Internet connection by up to 300%". Leave enabled if you find it improves internet connection Source=Paul Collins Startup list [StartCCC] Number=9934 Confirmed=N Filename=CLIStart.exe Description=Puts the ATI Catalyst� Control Center Icon/Shortcut on the System Tray - available via Start -> Programs Source=Paul Collins Startup list [StartEAK] Number=9935 Confirmed=Y Filename=StartEAK.exe Description=Easy Access Button Support for Compaq PCs. Required if you use these Source=Paul Collins Startup list [startemdoit] Number=9936 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADR-AVP TROJAN! Source=Paul Collins Startup list [Starter] Number=9937 Confirmed=X Filename=scvhosting.exe Description=Added by the SDBOT.RU WORM! Source=Paul Collins Startup list [starter] Number=9938 Confirmed=X Filename=scvhostingg.exe Description=Added by the FORBOT-FB WORM! Source=Paul Collins Startup list [starter] Number=9939 Confirmed=X Filename=iexplore.exe Description=Added by the FORBOT-DU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [StartFoxie] Number=9940 Confirmed=U Filename=StartFoxie.exe Description=Foxie Suite from Softonic International. "This suite of free tools comes in the form of an Internet Explorer add-on and includes a mix of powerful security enhancements" Source=Paul Collins Startup list [startkey] Number=9941 Confirmed=X Filename=svcmgr.exe Description=Added by the HIPPER-B TROJAN! Source=Paul Collins Startup list [startkey] Number=9942 Confirmed=X Filename=update.exe Description=Added by the BIFROSE-DG TROJAN! Source=Paul Collins Startup list [startkey] Number=9943 Confirmed=X Filename=XMCHAI.EXE Description=Added by the BIFROSE-AO TROJAN! Source=Paul Collins Startup list [startkey] Number=9944 Confirmed=X Filename=explore32.exe Description=Added by the MT TROJAN! Source=Paul Collins Startup list [startkey] Number=9945 Confirmed=X Filename=CKOTS.exe Description=Added by the BIFROSE-HM TROJAN! Source=Paul Collins Startup list [StartKey] Number=9946 Confirmed=X Filename=pligde.exe Description=Added by the BIFROSE.E TROJAN! Source=Paul Collins Startup list [startkey] Number=9947 Confirmed=X Filename=RunWinRaR.exe Description=Added by a variant of the BIFROSE-LV TROJAN! Source=Paul Collins Startup list [startkey] Number=9948 Confirmed=X Filename=Mysia.exe Description=Added by the CEP TROJAN! Source=Paul Collins Startup list [startkey] Number=9949 Confirmed=X Filename=explorer.exe Description=Added by the MLD TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder Source=Paul Collins Startup list [startkey] Number=9950 Confirmed=X Filename=furzi.exe Description=Added by the BIFROSE-OK TROJAN! Source=Paul Collins Startup list [startkey] Number=9951 Confirmed=X Filename=krnl.exe Description=Added by the BIFROSE-S TROJAN! Source=Paul Collins Startup list [startkey] Number=9952 Confirmed=X Filename=royale.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [startkey] Number=9953 Confirmed=X Filename=rtfmsv.exe Description=Added by the EDEPOL-C TROJAN! Source=Paul Collins Startup list [startkey] Number=9954 Confirmed=X Filename=scvhost.exe Description=Added by the BIFROSE-PM TROJAN! Source=Paul Collins Startup list [startkey] Number=9955 Confirmed=X Filename=server.exe Description=Added by the BIFROSE-DB TROJAN! Source=Paul Collins Startup list [startkey] Number=9956 Confirmed=X Filename=win32i.exe Description=Added by the BIFROSE-R TROJAN! Source=Paul Collins Startup list [startkey] Number=9957 Confirmed=X Filename=winampXP.exe Description=Added by the BIFROSE-OY TROJAN! Source=Paul Collins Startup list [startkey] Number=9958 Confirmed=X Filename=svchost32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [startkey] Number=9959 Confirmed=X Filename=winlogin.exe Description=Added by the BIFROSE-PM TROJAN! Source=Paul Collins Startup list [startkey] Number=9960 Confirmed=X Filename=winlogin.exe Description=Added by the BIFROSE-PM TROJAN! Source=Paul Collins Startup list [startkey] Number=9961 Confirmed=X Filename=antivir.exe Description=Added by the BIFROSE-TO TROJAN! Source=Paul Collins Startup list [startl.exe] Number=9962 Confirmed=N Filename=startl.exe Description=Lingocom LingoWare - translates any application into your language Source=Paul Collins Startup list [StartMenu] Number=9963 Confirmed=X Filename=deamon.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [StartMenu] Number=9964 Confirmed=X Filename=msgaol.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [StartMenu] Number=9965 Confirmed=X Filename=s_menu.exe Description=Added by the TACTSLAY.C TROJAN! Source=Paul Collins Startup list [StartMenu] Number=9966 Confirmed=X Filename=browse.exe Description=Added by the DROWSY-C TROJAN! Source=Paul Collins Startup list [startpage] Number=9967 Confirmed=X Filename=startpage.exe Description=Browser hijacker - redirecting to pages2start.com Source=Paul Collins Startup list [STARTPAGE] Number=9968 Confirmed=U Filename=start1.exe Description=NoSpy.org - prevents spyware from changing your startpage and other browser properties. The start1.exe file is located in a NOSPY.ORG folder Source=Paul Collins Startup list [StartStop] Number=9969 Confirmed=U Filename=STARTSTOP.EXE Description=StartStop from TFI Technology - startup manager Source=Paul Collins Startup list [StartSurfing] Number=9970 Confirmed=U Filename=STARTS.exe Description=Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Windows, Mouse Traps, Window Resizing, and scripts that attempt to record your personal information. Available via Start -> Programs Source=Paul Collins Startup list [Startup] Number=9971 Confirmed=N Filename=?? Description=Related to an Iomega drive Source=Paul Collins Startup list [Startup] Number=9972 Confirmed=X Filename=WinlogonStartup Description=Unidentified malware Source=Paul Collins Startup list [Startup] Number=9973 Confirmed=X Filename=mirc.exe Description=Added by the FLOOD-EU TROJAN! An uninstall option for mirc.exe can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as mIRC. This one puts 10 files in the Windows or Winnt folder Source=Paul Collins Startup list [Startup Configuration] Number=9974 Confirmed=X Filename=[six character filename] Description=Added by the RBOT-ARV WORM! Source=Paul Collins Startup list [Startup Configuration] Number=9975 Confirmed=X Filename=wztoid.exe Description=Added by the RBOT-ASD WORM! Source=Paul Collins Startup list [Startup Launcher GUI] Number=9976 Confirmed=? Filename=GUI.exe Description=Startup manager? Source=Paul Collins Startup list [Startup Manager Scanner] Number=9977 Confirmed=U Filename=StartupMonitor.exe Description=Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans, adult-dialers, and other scumware Source=Paul Collins Startup list [Startup Scan] Number=9978 Confirmed=Y Filename=Sensor.EXE Description=AntiVirus Quick Heal - scheduling agent Source=Paul Collins Startup list [Startup Update] Number=9979 Confirmed=X Filename=Cvshost.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [StartupBin] Number=9980 Confirmed=X Filename=iwnujdss.exe Description=Added by the SDBOT-XZ WORM! Source=Paul Collins Startup list [StartupMonitor] Number=9981 Confirmed=U Filename=StartupMonitor.exe Description=Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu Source=Paul Collins Startup list [startwin] Number=9982 Confirmed=X Filename=startwin.exe Description=Added by the ANTIMAN.A WORM! Source=Paul Collins Startup list [startwindowskeyuser] Number=9983 Confirmed=X Filename=rundle2.exe Description=Added by the JAVAKILLER TROJAN! Source=Paul Collins Startup list [Stat 'n' Perf] Number=9984 Confirmed=N Filename=StatnPerf.exe Description=Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes Source=Paul Collins Startup list [StatBar] Number=9985 Confirmed=X Filename=STATBAR.exe Description=StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory, CPU, uptime, and much more). Due to the sheer number of resources (over 60%) consumed by this program, it is unsuitable for Windows 95/98/SE/Me Source=Paul Collins Startup list [State Service] Number=9986 Confirmed=X Filename=csrss.exe Description=Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [StationPlaylistStudio] Number=9987 Confirmed=U Filename=SPLStudio.exe Description=StationPlaylist Studio - "simple to use on-air broadcast playback software for the studio and/or DJ" for small to medium sized radio broadcasters, and internet webcasters Source=Paul Collins Startup list [Statistics] Number=9988 Confirmed=X Filename=statslist.exe Description=Added by the OPANKI-S WORM! Source=Paul Collins Startup list [Status Monitor] Number=9989 Confirmed=N Filename=BrMfcWnd.exe Description=Brother scanner status monitor - can be started manually Source=Paul Collins Startup list [Status Monitor XE] Number=9990 Confirmed=N Filename=ENGSS.EXE Description=The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs Source=Paul Collins Startup list [StatusClient] Number=9991 Confirmed=? Filename=StatusClient.exe Description=Part of Hewlett Packard network printer drivers Source=Paul Collins Startup list [StatusClient 2.6] Number=9992 Confirmed=? Filename=StatusClient.exe Description=Part of Hewlett Packard network printer drivers Source=Paul Collins Startup list [StatusView] Number=9993 Confirmed=N Filename=StatusView.exe Description=Status View intra-office messaging Source=Paul Collins Startup list [Stay Connected!] Number=9994 Confirmed=N Filename=StayCon.exe Description=More than just a pinger, actually simulates online activity. Supports AOL, NetZero, MSN, ATT WorldNet, CompuServe and many other ISPs as well. Available via Start -> Programs Source=Paul Collins Startup list [StayAlive] Number=9995 Confirmed=U Filename=StayAlive.Exe Description=Part of RealSPEED - tweaking utility to speed-up your internet connection. Stay connected even after a period of inactivity on the net Source=Paul Collins Startup list [StayAlive] Number=9996 Confirmed=U Filename=sa.exe Description=StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work." Source=Paul Collins Startup list [STBVision] Number=9997 Confirmed=? Filename=STBVisn.exe Description=Related to the STB Velocity graphics card. What does it do and is it required? Source=Paul Collins Startup list [STBWEBTV] Number=9998 Confirmed=N Filename=STBWEBTV.EXE Description=Used to display TV on your PC Source=Paul Collins Startup list [stcinstaller] Number=9999 Confirmed=X Filename=id53.exe Description=Added by the SCTHOUGHT.L TROJAN! Source=Paul Collins Startup list [stcloader] Number=10000 Confirmed=X Filename=stcloader.exe Description=Popup adware by 2ndThought software Source=Paul Collins Startup list [stcloader] Number=10001 Confirmed=X Filename=STCLOA~1.exe Description=Popup adware by 2ndThought software Source=Paul Collins Startup list [STCLOA~1] Number=10002 Confirmed=X Filename=stcloader.exe Description=Popup adware by 2ndThought software Source=Paul Collins Startup list [STCLOA~1] Number=10003 Confirmed=X Filename=STCLOA~1.exe Description=Popup adware by 2ndThought software Source=Paul Collins Startup list [STCPO] Number=10004 Confirmed=Y Filename=STCPO.exe Description=Sophos Sweep antivirus software Source=Paul Collins Startup list [StdAFX] Number=10005 Confirmed=X Filename=stdafx.exe Description=Added by the DELBOT-AF WORM! Source=Paul Collins Startup list [stdlib] Number=10006 Confirmed=X Filename=[filename] Description=Added by the PERDA-E TROJAN! Source=Paul Collins Startup list [STDSB] Number=10007 Confirmed=Y Filename=STDSB.exe Description=Scrollbar driver for notebooks. If taken out of the Startup, it will not provide scrolling Source=Paul Collins Startup list [Stealth Anonymizer 2.5] Number=10008 Confirmed=U Filename=stealth25.exe Description=Now named Stealther - proxy server agent that lets you travel the Internet with maximum possible privacy Source=Paul Collins Startup list [stealth.dcom.exe] Number=10009 Confirmed=X Filename=stealth.dcom.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.ddos.exe] Number=10010 Confirmed=X Filename=stealth.ddos.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.exe] Number=10011 Confirmed=X Filename=stealth.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.injector.exe] Number=10012 Confirmed=X Filename=stealth.injector.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.stat.exe] Number=10013 Confirmed=X Filename=stealth.stat.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.wm.exe] Number=10014 Confirmed=X Filename=stealth.wm.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [stealth.worm.exe] Number=10015 Confirmed=X Filename=stealth.worm.exe Description=Added by the THEALS.A WORM! Source=Paul Collins Startup list [Steam] Number=10016 Confirmed=N Filename=steam.exe Description=Valve Software's STEAM broadband game client. Steam is Valve's new way of getting games into your hands ASAP. Games like Half-Life, Counter-Strike, and Counter-Strike: Condition Zero are all being made available through Steam. Steam games are automatically kept up-to-date with the latest content and revisions. Steam also includes an instant-message client which even works while you're in-game Source=Paul Collins Startup list [steam] Number=10017 Confirmed=X Filename=steam.exe Description=Added by the RBOT-AJT WORM! Note - the file steam.exe will be found in the Windows\System folder and is not associated with Valve Software's game client Source=Paul Collins Startup list [SteFanie] Number=10018 Confirmed=X Filename=SteFanie.vbs Description=Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders Source=Paul Collins Startup list [stgclean] Number=10019 Confirmed=? Filename=w32main2.exe Description=Related to IBM Standard Software Installer. What does it do and is it required? Source=Paul Collins Startup list [Stickies] Number=10020 Confirmed=N Filename=STICKIES.EXE Description=Stickies - utility that allows you to put yellow "Post-It" type messages on your desktop and can be used to set reminders. Available via Start -> Programs Source=Paul Collins Startup list [Sticky Notes] Number=10021 Confirmed=N Filename=stikynot.exe Description=Microsoft Sticky Notes - virtual sticky notes tool Source=Paul Collins Startup list [Sticky Pad] Number=10022 Confirmed=U Filename=StickyPad.exe Description=Sticky Pad from Green Eclipse. Place sticky notes on your desktop Source=Paul Collins Startup list [StickyNote] Number=10023 Confirmed=N Filename=StickyNote.exe Description=Utility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs Source=Paul Collins Startup list [StillImageMonitor] Number=10024 Confirmed=U Filename=Stimon.exe Description=Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners Source=Paul Collins Startup list [stisrv] Number=10025 Confirmed=X Filename=stisrv.exe Description=Added by the RBOT.BQF WORM! Source=Paul Collins Startup list [stlbdist] Number=10026 Confirmed=X Filename=rundll32exe stlbdist.DLL, DllRunMain Description=Hijacker pointing to www.searchandclick.com Source=Paul Collins Startup list [stlbupdt] Number=10027 Confirmed=X Filename=rundll32.exe stlbupdt.DLL, DllRunMain Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [STManager] Number=10028 Confirmed=N Filename=drst.exe Description=Dr. SpeedTouch is some sort of diagnostics software which sends out information to a server which then relays the information back to the program to test the network to see if the SpeedTouch ADSL modem connection is working properly. Not required if connected via Ethernet (and probably USB). Can cause a slow down in Win2K - see here Source=Paul Collins Startup list [stmha] Number=10029 Confirmed=X Filename=wkfxi.js Description=Added by the SPETH WORM! Source=Paul Collins Startup list [stonedrv] Number=10030 Confirmed=X Filename=stonedrv.exe Description=Added by the COSIMA-K TROJAN! Source=Paul Collins Startup list [StopSignSsTsMon] Number=10031 Confirmed=U Filename=sstsmon.dll, VerifyStatus Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [StopSignStatus] Number=10032 Confirmed=U Filename=stopsinfo.dll Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [STOPzilla] Number=10033 Confirmed=U Filename=Stopzilla.exe Description=StopZilla! - pop-up killer Source=Paul Collins Startup list [STOPzilla Service] Number=10034 Confirmed=U Filename=SZNTSVC.EXE Description=StopZilla! - pop-up killer Source=Paul Collins Startup list [StorageGuard] Number=10035 Confirmed=U Filename=sgtray.exe Description=StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups Source=Paul Collins Startup list [STPMGR] Number=10036 Confirmed=? Filename=STPMGR.EXE Description=Part of SafeTP which is transparent FTP security software. Does it need to be running permanently or can it be started manually via Start -> Programs Source=Paul Collins Startup list [stratas] Number=10037 Confirmed=X Filename=xmconfig.exe Description=Added by the RBOT-AHR WORM! Source=Paul Collins Startup list [stratas] Number=10038 Confirmed=X Filename=lockx.exe Description=Added by the SDBOT-ADD WORM! Source=Paul Collins Startup list [Stratas] Number=10039 Confirmed=X Filename=ggfig.exe Description=Added by the OPANKI.W WORM! Source=Paul Collins Startup list [StreamAppliance] Number=10040 Confirmed=X Filename=wuauclt14.exe Description=Added by the RBOT-GMB WORM! Source=Paul Collins Startup list [StreamAppliance] Number=10041 Confirmed=X Filename=wuauclt16.exe Description=Added by the RBOT-GME WORM! Source=Paul Collins Startup list [Streamload Downloader] Number=10042 Confirmed=N Filename=SlDB.exe Description=Downloader for MediaMax (was Streamload) - "gives you a private and secure place to upload, store, access, and share your personal videos, photos, movies, music, and files" Source=Paul Collins Startup list [Streamload Uploader] Number=10043 Confirmed=N Filename=StreamMgr.exe Description=Uploader for MediaMax (was Streamload) - "gives you a private and secure place to upload, store, access, and share your personal videos, photos, movies, music, and files" Source=Paul Collins Startup list [StreamZap Remote] Number=10044 Confirmed=U Filename=zremote.exe Description=StreamZap PC Remote - control Windows Media Player, iTunes, RealPlayer, Winamp, PowerPoint, MusicMatch Jukebox, and many other multimedia applications Source=Paul Collins Startup list [StrgSync.exe] Number=10045 Confirmed=U Filename=StrgSync.exe Description=SimpleTech Inc's StorageSync backup software - backs up an entire PC, or selected files and folders Source=Paul Collins Startup list [strmsnmgrs] Number=10046 Confirmed=X Filename=msnxmsgrsc.exe Description=Added by the SDBOT.JDR WORM! Source=Paul Collins Startup list [strmsnmsgr] Number=10047 Confirmed=X Filename=msnmsgrs.exe Description=Added by the RBOT-ACQ WORM! Source=Paul Collins Startup list [strmsnmsgrs] Number=10048 Confirmed=X Filename=msnmsgrsc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [strmsnnms] Number=10049 Confirmed=X Filename=msnmegrs.exe Description=Added by the SDBOT-YU TROJAN! Source=Paul Collins Startup list [strmsnnrs] Number=10050 Confirmed=X Filename=msnmcgrs.exe Description=Added by the RBOT-ACT TROJAN! Source=Paul Collins Startup list [strmsoums] Number=10051 Confirmed=X Filename=msnmegrse.exe Description=Added by the SDBOT-ZK TROJAN! Source=Paul Collins Startup list [Strng32] Number=10052 Confirmed=X Filename=strngbox.exe Description=Added by the STRANO WORM! Source=Paul Collins Startup list [StrokeIt] Number=10053 Confirmed=U Filename=strokeit.exe Description=StrokeIt is an "advanced mouse gesture recognition engine and command processor" Source=Paul Collins Startup list [strtas] Number=10054 Confirmed=X Filename=lock1.exe Description=Added by the SDBOT-ADQ WORM! Source=Paul Collins Startup list [strtas] Number=10055 Confirmed=X Filename=lockx.exe Description=Added by the SDBOT-AEB WORM! Source=Paul Collins Startup list [strtas] Number=10056 Confirmed=X Filename=l074.exe Description=Added by the AGENT-II TROJAN! Source=Paul Collins Startup list [strtas] Number=10057 Confirmed=X Filename=loc1.exe Description=Added by the RBOT-AZU TROJAN! Source=Paul Collins Startup list [strto] Number=10058 Confirmed=X Filename=strto.exe Description=Added by the KILLPROC-F TROJAN! Source=Paul Collins Startup list [strto] Number=10059 Confirmed=X Filename=[path to trojan] Description=Added by the KILLAV-AP TROJAN! Source=Paul Collins Startup list [Sts] Number=10060 Confirmed=X Filename=iwnujdss2.exe Description=Added by the SDBOT-YI WORM! Source=Paul Collins Startup list [Stubbish] Number=10061 Confirmed=X Filename=Stubbish.exe Description=Added by the STUBBOT-A WORM! Source=Paul Collins Startup list [StubPath] Number=10062 Confirmed=X Filename=Sservice.exe Description=Added by the PRORAT TROJAN! Source=Paul Collins Startup list [stup] Number=10063 Confirmed=X Filename=138762763.exe Description=Added by the FIRESPY-A TROJAN! It will attempt to register the dropped component as a Firefox plugin and begin monitoring the user's browsing habits, stealing information including monitoring and logging information from Web forms Source=Paul Collins Startup list [StupAssist] Number=10064 Confirmed=N Filename=StupAssist.exe Description=Associated with Nikon digital cameras Source=Paul Collins Startup list [stxrmsgms] Number=10065 Confirmed=X Filename=mstats.exe Description=Added by the IRCBOT-AE TROJAN! Source=Paul Collins Startup list [StyleXP] Number=10066 Confirmed=U Filename=StyleXP.exe Description=StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot, therefore uninstall it if you don't want it Source=Paul Collins Startup list [SubAH] Number=10067 Confirmed=X Filename=SubAH.exe Description=Added by the SUBAH TROJAN! Source=Paul Collins Startup list [Subliminal Power] Number=10068 Confirmed=U Filename=Subliminal.exe Description=Subliminal Power - displays subliminal messages of your choice on your computer screen Source=Paul Collins Startup list [Subtract the Ads] Number=10069 Confirmed=N Filename=AdSub.exe Description=Removes adverts from web pages. Although useful - not required Source=Paul Collins Startup list [suck] Number=10070 Confirmed=X Filename=l0ad.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Suitcase Startup] Number=10071 Confirmed=U Filename=Suitcase.exe Description=Suitcase - system font manager start up utility. Used for dynamic managment of fonts on your system Source=Paul Collins Startup list [Suite] Number=10072 Confirmed=X Filename=SuiteOffices.exe Description=Added by the LAZAR TROJAN! Source=Paul Collins Startup list [SULFNBJ.EXE] Number=10073 Confirmed=X Filename=SULFNBJ.EXE Description=Added by the PE_MAGISTR.DAM VIRUS! Source=Paul Collins Startup list [Sun Java Console for Windows NT & XP] Number=10074 Confirmed=X Filename=jconsole.exe Description=Added by the VANEBOT-C WORM! Source=Paul Collins Startup list [Sunasdtserv] Number=10075 Confirmed=U Filename=Sunasdtserv.exe Description=CounterSpy by Sunbelt Software - adware/spyware protection Source=Paul Collins Startup list [sunasServ] Number=10076 Confirmed=U Filename=sunasServ.exe Description=CounterSpy by Sunbelt Software - adware/spyware protection Source=Paul Collins Startup list [SunJavaSched] Number=10077 Confirmed=X Filename=ccEvtMngr.exe Description=Added by the SDBOT-YP WORM! Source=Paul Collins Startup list [SunJavaSched Updater] Number=10078 Confirmed=X Filename=avamx.exe Description=Added by the RBOT-ABJ WORM! Source=Paul Collins Startup list [SunJavaUpdate] Number=10079 Confirmed=X Filename=smvss.exe Description=Added by the DEDLER-G TROJAN! Source=Paul Collins Startup list [SunJavaUpdateSched] Number=10080 Confirmed=N Filename=jusched.exe Description=Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel Source=Paul Collins Startup list [SunJavaUpdateSched] Number=10081 Confirmed=X Filename=scvhost.exe Description=Added by the SDBOT-AVX WORM! Source=Paul Collins Startup list [SunJavaUpdateSched] Number=10082 Confirmed=X Filename=javamx.exe Description=Added by the SDBOT-WI WORM! Source=Paul Collins Startup list [Sunkist] Number=10083 Confirmed=U Filename=shwicon98.exe Description=Card reader for memory cards from digital cameras, etc Source=Paul Collins Startup list [Sunkist2k] Number=10084 Confirmed=U Filename=shwicon2k.exe Description=Card reader for memory cards from digital cameras, etc Source=Paul Collins Startup list [SunKistEM] Number=10085 Confirmed=U Filename=shwiconem.exe Description=Used by your computer to communicate with your Alcor Micro Multimedia Card Reader - necessary if you're using this software Source=Paul Collins Startup list [SuNotification] Number=10086 Confirmed=U Filename=suatshut.exe Description=ShadowSurfer - "provides a safe computing environment by creating a virtual twin of your PC. Restore the pre-ShadowMode system state no matter what changes have occurred to your PC" Source=Paul Collins Startup list [SunProtectionServer] Number=10087 Confirmed=U Filename=SunProtectionServer.exe Description=CounterSpy antispyware software Source=Paul Collins Startup list [SunServer] Number=10088 Confirmed=U Filename=SunServer.exe Description=CounterSpy antispyware software Source=Paul Collins Startup list [SupaDial] Number=10089 Confirmed=? Filename=SupaDial.exe Description=SupaNet.com modem driver related - is it required? Source=Paul Collins Startup list [Supastatus] Number=10090 Confirmed=N Filename=status.exe Description=Supanet ISP software Source=Paul Collins Startup list [supdate2.dll] Number=10091 Confirmed=X Filename=rundll32.exe [path] supdate2.dll Description=Added by the ZLOB-VL TROJAN! Source=Paul Collins Startup list [super] Number=10092 Confirmed=X Filename=fuckbx.exe Description=Added by the LINEAGE-H TROJAN! Source=Paul Collins Startup list [super] Number=10093 Confirmed=X Filename=super.exe Description=Added by the AGOBOT-QT WORM! Source=Paul Collins Startup list [Super Popup Blocker] Number=10094 Confirmed=U Filename=popkill.exe Description=Saga Super Popup Blocker - pop-up stopper Source=Paul Collins Startup list [Super X Desktop Version 3.4] Number=10095 Confirmed=U Filename=SXDesk.exe Description=Super X Desktop - virtual desktop manager Source=Paul Collins Startup list [SuperAdBlocker] Number=10096 Confirmed=U Filename=SAdBlock.exe Description=SuperAdBlocker Source=Paul Collins Startup list [SUPERAntiSpyware] Number=10097 Confirmed=U Filename=SUPERAntiSpyware.exe Description="SUPERAntiSpyware is the most thorough scanner on the market. Our Multi-Dimensional Scanning and Process Interrogation Technology will detect spyware that other products miss! SUPERAntiSpyware will remove ALL the Spyware, NOT just the easy ones!" Source=Paul Collins Startup list [SuperBar.Component] Number=10098 Confirmed=X Filename=[path to services.exe] Description=Added by the SMALL-AQ TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder Source=Paul Collins Startup list [SuperBar.Component] Number=10099 Confirmed=X Filename=services.exe Description=FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder Source=Paul Collins Startup list [Supercleaner] Number=10100 Confirmed=U Filename=Supercleaner.exe Description=Supercleaner - all in one disk cleaner for your computer Source=Paul Collins Startup list [SuperCool Compress Backup] Number=10101 Confirmed=U Filename=Main.exe Description="SuperCool Zip Backup software is a data backup,restore and file synchronization program" Source=Paul Collins Startup list [SuperHeissSex] Number=10102 Confirmed=X Filename=SuperHeissSex.exe Description=Added by the HeissSex premium rate adult content dialer! Source=Paul Collins Startup list [supernews12] Number=10103 Confirmed=X Filename=newsd32.exe Description=Adware, also detected as the DLOADER-JN TROJAN! Source=Paul Collins Startup list [Supernova] Number=10104 Confirmed=X Filename=[worm filename] Description=Added by the SURNOVA (or SUPOVA) WORM! Source=Paul Collins Startup list [superproxy] Number=10105 Confirmed=X Filename=superproxy.exe Description=Added by the DELBACK-B TROJAN! Source=Paul Collins Startup list [SuperRam] Number=10106 Confirmed=U Filename=SuperRam.exe Description=SuperRam memory manager. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See SuperRam article and make up your own mind Source=Paul Collins Startup list [superslut] Number=10107 Confirmed=X Filename=msslut32.exe Description=Added by the SLUTER-A WORM! Source=Paul Collins Startup list [SuperSpamKiller Pro] Number=10108 Confirmed=U Filename=Ssk.exe Description=SuperSpamKiller Pro email spam blocker Source=Paul Collins Startup list [Supervisor.exe] Number=10109 Confirmed=X Filename=Supervisor.exe Description=Has been reported to be associated with various antitrojan software like ATS and PC Doorguard. If so it's required in Startup - any further information is welcome Source=Paul Collins Startup list [support-reverse-smileys] Number=10110 Confirmed=X Filename=[trojan filename] Description=Added by the LITEBOT TROJAN! Source=Paul Collins Startup list [supporter5] Number=10111 Confirmed=X Filename=supporter5.exe Description=Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the web-site is dead Source=Paul Collins Startup list [SureCleanProfessional] Number=10112 Confirmed=U Filename=SRClean.exe Description=SureClean PC and Internet tracks cleaner Source=Paul Collins Startup list [Sureshotpopupkiller] Number=10113 Confirmed=U Filename=Stopthepop.exe Description=Stop-the-Pop-Up popup blocker Source=Paul Collins Startup list [Sureshotpopupkiller] Number=10114 Confirmed=U Filename=pusak.exe Description=Stop-the-Pop-Up popup blocker Source=Paul Collins Startup list [SurfAccuracy] Number=10115 Confirmed=X Filename=sacc.exe Description=SurfAccuracy adware Source=Paul Collins Startup list [SurfBuddy] Number=10116 Confirmed=X Filename=rundll32 [path] sbuddy.dll Description=SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps! Source=Paul Collins Startup list [SurfChoice] Number=10117 Confirmed=U Filename=SCMan.exe Description=SCMan is a utility that can control services on WinNT from the command line. This utility can create, start, pause, stop, delete services. Furthermore it can retrieve a service's current state, get the displayname for a service and vice versa Source=Paul Collins Startup list [Surfer lptt01] Number=10118 Confirmed=X Filename=surfer.exe Description=RapidBlaster variant (in a "mssurfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Surfer ml097e] Number=10119 Confirmed=X Filename=surfer.exe Description=RapidBlaster variant (in a "mssurfer" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [SurfHelper] Number=10120 Confirmed=U Filename=SurfHelp.exe Description=Related to SurfHelper - a free tool to remove popup windows, clear history, control window properties of IE, and more Source=Paul Collins Startup list [SurfinGuard Pro] Number=10121 Confirmed=U Filename=winsfcm.exe Description=SurfinGuard Pro from Finjan - internet protection software, protects against all malicious code delivered through executables, scripting files, ActiveX and Java Source=Paul Collins Startup list [SurfSecret] Number=10122 Confirmed=U Filename=ss2-full.exe Description="House-cleaning utility that enables you to keep your computer usage to yourself. Runs quietly from the system tray, eliminating tell-tale files at a regular interval of your choosing. You can set it to clear your Internet cache files, cookies, history, temp folder, etc. It can also clear the history of your Run and Find menus, in addition to the AOL cache" Source=Paul Collins Startup list [SurfSideKick 2] Number=10123 Confirmed=X Filename=Ssk.exe Description=SurfSideKick adware Source=Paul Collins Startup list [SurfSideKick 3] Number=10124 Confirmed=X Filename=Ssk.exe Description=SurfSideKick adware Source=Paul Collins Startup list [SurfStream] Number=10125 Confirmed=U Filename=SurfStream.exe Description=Conceiva "SurfStream lets you surf the Web faster. It contains a fully featured proxy server that lets you surf the Web significantly faster. It also blocks all pop-up windows and banner ads from Web pages. An intelligent tune-up tool automatically analyzes and optimizes your computer's Internet connection and TCP/IP settings" Source=Paul Collins Startup list [Surs] Number=10126 Confirmed=X Filename=awab.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Surveysa] Number=10127 Confirmed=N Filename=surveysa.exe Description=Found on Sony laptops, it brings up a prompt to take a survey. It goes away if you fill out the survey or you choose "never prompt me again" but keeps popping if you either exit out of it or select "take survey later" Source=Paul Collins Startup list [suScheduler] Number=10128 Confirmed=U Filename=UCLauncher.exe Description=Related to Lenovo ThinkVantage Technologies. ThinkVantage Technologies help make ThinkPad/ThinkCentre PCs less dependent on IT staff Source=Paul Collins Startup list [Susp] Number=10129 Confirmed=X Filename=Susp.exe Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [susse] Number=10130 Confirmed=X Filename=hpsw.exe Description=LinkMaker adware Source=Paul Collins Startup list [Sustem] Number=10131 Confirmed=X Filename=explorer.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [SustemUpdate] Number=10132 Confirmed=X Filename=explorer.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [SV00LSV] Number=10133 Confirmed=X Filename=SV00LSV.EXE Description=Added by the GRAYBIRD-C TROJAN! Source=Paul Collins Startup list [SVA Player] Number=10134 Confirmed=X Filename=SVAplayer.exe Description=QuickFlicks Streaming Player malware Source=Paul Collins Startup list [Svc] Number=10135 Confirmed=X Filename=svc.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [SVC] Number=10136 Confirmed=U Filename=svchost.exe Description=ElfSpy keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! Source=Paul Collins Startup list [SVC Service] Number=10137 Confirmed=X Filename=svcinit.exe Description=Added by the SINIT TROJAN! Source=Paul Collins Startup list [SVC Service] Number=10138 Confirmed=X Filename=svcinit.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [SVC Service] Number=10139 Confirmed=X Filename=svcpack.exe Description=CoolWebSearch Svcinit parasite variant Source=Paul Collins Startup list [SVC Service] Number=10140 Confirmed=X Filename=svc32.pif Description=Added by the RBOT-ASC WORM! Source=Paul Collins Startup list [SVC Socks] Number=10141 Confirmed=X Filename=mstaskm.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Svced] Number=10142 Confirmed=X Filename=Svced.exe Description=Added by the DELF.F TROJAN! Source=Paul Collins Startup list [SvcH0st] Number=10143 Confirmed=X Filename=msexploren.exe Description=Added by the BACKDOOR-CGZ TROJAN! Source=Paul Collins Startup list [SvcH0st] Number=10144 Confirmed=X Filename=SHCH.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [SvcH0st] Number=10145 Confirmed=X Filename=SVCHST.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [SvcH0st] Number=10146 Confirmed=X Filename=WINAGENT.EXE Description=Added by the EB TROJAN! Source=Paul Collins Startup list [SVCH0ST] Number=10147 Confirmed=X Filename=spoo1sv.exe Description=Added by the HF TROJAN! Source=Paul Collins Startup list [SVCH0ST] Number=10148 Confirmed=X Filename=SVCH0ST.EXE Description=Added by the IK TROJAN! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [SvcH0st] Number=10149 Confirmed=X Filename=msnexploren.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [SvcH0st] Number=10150 Confirmed=X Filename=sdhch.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [SVCH0TS] Number=10151 Confirmed=X Filename=sp00lvs.exe Description=Added by the LINEAGE-AZ TROJAN! Source=Paul Collins Startup list [svchast] Number=10152 Confirmed=X Filename=svchast.exe Description=Added by the LINEAGE-AV TROJAN! Source=Paul Collins Startup list [svchctrl] Number=10153 Confirmed=X Filename=svchctrl.exe Description=Added by the COBFINN TROJAN! Source=Paul Collins Startup list [svchos] Number=10154 Confirmed=X Filename=svchos.exe Description=Added by the EZIBOT-B TROJAN! Source=Paul Collins Startup list [SVCHOST] Number=10155 Confirmed=X Filename=svchost.exe Description=System1060 homepage hi-jacker. Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "System1060" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [svchost] Number=10156 Confirmed=X Filename=svchost.exe Description=Added by many TROJANS amd WORMS, such as MORB or TARNO. Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [SVCHOST] Number=10157 Confirmed=X Filename=mrowyekdc.exe Description=Added by the GOTORM WORM! Source=Paul Collins Startup list [svchost] Number=10158 Confirmed=X Filename=Svch0st.exe Description=Added by the GRAYBIRD and GRAYBIRD.B TROJANS! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [svchost] Number=10159 Confirmed=X Filename=[path to trojan] Description=Added by the HAZZER TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [svchost] Number=10160 Confirmed=X Filename=ADMAGIC.EXE Description=Added by the SMIBAG WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Svchost] Number=10161 Confirmed=X Filename=winhost.exe Description=Added by the LOLAWEB.A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Svchost] Number=10162 Confirmed=X Filename=svchost.exe Description=Added by the MOZE-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [SVCHOST] Number=10163 Confirmed=X Filename=var.txt.exe Description=Added by the LDPINCH.C TROJAN! Source=Paul Collins Startup list [Svchost] Number=10164 Confirmed=X Filename=svchosl.pif Description=Added by the INZAE.A or INZAE.B WORMS! Source=Paul Collins Startup list [svchost] Number=10165 Confirmed=X Filename=[path] SETUP.EXE Description=Added by the SETCLO WORM! Source=Paul Collins Startup list [SVCHOST] Number=10166 Confirmed=X Filename=scvhost.exe Description=Added by the MYTOB.E or MYTOB.G WORMS! Source=Paul Collins Startup list [SVCHOST] Number=10167 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB.F or MYTOB.H WORMS! Source=Paul Collins Startup list [svchost] Number=10168 Confirmed=X Filename=olehelp.exe Description=Added by the BOOKMARKER.G TROJAN! Source=Paul Collins Startup list [SVCHOST] Number=10169 Confirmed=X Filename=updater32.exe Description=Added by the RANTS.A WORM! Source=Paul Collins Startup list [SVCHOST] Number=10170 Confirmed=X Filename=SPOOLSV.EXE Description=Added by the BAITAP-A WORM! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [SvcHost] Number=10171 Confirmed=X Filename=svchost32.exe Description=Added by the AGOBOT-TM WORM! Source=Paul Collins Startup list [svchost] Number=10172 Confirmed=X Filename=svchost.exe Description=Added by the BANCBAN-HL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [svchost] Number=10173 Confirmed=X Filename=[path to explorer.exe] Description=Added by the UNREAL-A TROJAN! Source=Paul Collins Startup list [svchost] Number=10174 Confirmed=X Filename=rundll16.exe Description=Added by the STARTPA-PB TROJAN! Source=Paul Collins Startup list [Svchost] Number=10175 Confirmed=X Filename=svchost.exe Description=Added by the ADCLICK-AX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files\Internet Explorer folder Source=Paul Collins Startup list [svchost] Number=10176 Confirmed=X Filename=svchost.exe Description=Added by the ES TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder Source=Paul Collins Startup list [svchost] Number=10177 Confirmed=X Filename=svchost.exe Description=Added by the DLOADER-EV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programas" folder Source=Paul Collins Startup list [svchost] Number=10178 Confirmed=X Filename=winhelp.exe Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [SVCHOST] Number=10179 Confirmed=X Filename=MDM.EXE Description=Added by the LCJUMP-A WORM! Note - this is not the valid Machine Debug Manager which shares the same filename Source=Paul Collins Startup list [Svchost] Number=10180 Confirmed=X Filename=svchots.exe Description=Added by the RBOT.ADK WORM! Source=Paul Collins Startup list [svchost] Number=10181 Confirmed=X Filename=ying.exe Description=Constructor VC2000 malware Source=Paul Collins Startup list [SVCHOST Generic application] Number=10182 Confirmed=X Filename=svchost.exe Description=Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [svchost Netware Manager] Number=10183 Confirmed=X Filename=svchost.exe Description=Added by the EXVID.A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Svchost Windows Remote Services] Number=10184 Confirmed=X Filename=svhost.exe Description=Added by the IRCBOT-IV WORM! Source=Paul Collins Startup list [svchost.exe] Number=10185 Confirmed=X Filename=svchost32.exe Description=CoolWebSearch Svchost32 parasite variant Source=Paul Collins Startup list [SVCHOST.EXE] Number=10186 Confirmed=X Filename=SVCHOST.EXE Description=Added by the WRMSCAN-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [svchost.exe] Number=10187 Confirmed=X Filename=[path to executeable] Description=Added by the BANKER-MO TROJAN! Source=Paul Collins Startup list [svchost.exe] Number=10188 Confirmed=X Filename=svchost.exe Description=Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "drivers" subfolder Source=Paul Collins Startup list [svchost.exe] Number=10189 Confirmed=X Filename=swchost.exe Description=Added by the SADELPHI-A TROJAN! Source=Paul Collins Startup list [svchost1] Number=10190 Confirmed=X Filename=svchost1.exe Description=Added by the AGOBOT.ZZ WORM! Source=Paul Collins Startup list [SvcHost32] Number=10191 Confirmed=X Filename=svchost32.exe Description=Added by the MIMAIL.I or MIMAIL.J WORMS! Source=Paul Collins Startup list [svchost64] Number=10192 Confirmed=X Filename=svchost64.exe Description=Added by the SDBOTER.G VIRUS! Source=Paul Collins Startup list [svchosta] Number=10193 Confirmed=X Filename=svchosta.exe Description=Added by the SNIFFER-I TROJAN! Source=Paul Collins Startup list [svchostb] Number=10194 Confirmed=X Filename=svchostb.exe Description=Added by the SNIFFER-J TROJAN! Source=Paul Collins Startup list [svchostdll.scr] Number=10195 Confirmed=X Filename=svchostdll.scr Description=Added by the BANCBAN-FM TROJAN! Source=Paul Collins Startup list [SvcHosto] Number=10196 Confirmed=X Filename=v1rg1n.exe Description=Added by the AGOBOT-TK WORM! Source=Paul Collins Startup list [svchostr] Number=10197 Confirmed=X Filename=svchostr.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [svchosts] Number=10198 Confirmed=X Filename=svchosts.exe Description=Added by the BANCBAN-DC or BANKER-ED TROJANS! Source=Paul Collins Startup list [svchosts.exe] Number=10199 Confirmed=X Filename=svchosts.exe Description=Added by the AGOBOT-JN WORM! Source=Paul Collins Startup list [svchosts.scr] Number=10200 Confirmed=X Filename=svchosts.scr Description=Added by the BANCBAN-DQ TROJAN and variants! Source=Paul Collins Startup list [SVCHOT] Number=10201 Confirmed=X Filename=SVCHOT.exe Description=Added by the QQROB-U TROJAN! Source=Paul Collins Startup list [svchst] Number=10202 Confirmed=X Filename=svchst.exe Description=Added by the KBROY-C TROJAN! Source=Paul Collins Startup list [svcinfo] Number=10203 Confirmed=X Filename=svcinfo.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [Svclhost] Number=10204 Confirmed=X Filename=svcchost.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [SvcManager] Number=10205 Confirmed=X Filename=restore3.exe Description=Added by the AGENT-DSS TROJAN! Source=Paul Collins Startup list [svcmon] Number=10206 Confirmed=U Filename=svcmon.exe Description=PersonInspect surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [svcroot] Number=10207 Confirmed=X Filename=svcroot.exe Description=Added by the KEYLOG-AC TROJAN! Source=Paul Collins Startup list [svcshare] Number=10208 Confirmed=X Filename=winampXP.exe Description=Added by the FUJACKS-J VIRUS! Source=Paul Collins Startup list [svcshare] Number=10209 Confirmed=X Filename=spoclsv.exe Description=Added by the FUJACKS-A VIRUS! Source=Paul Collins Startup list [SvcSys] Number=10210 Confirmed=X Filename=[path to file] Description=Added by the BANCOS.Z TROJAN! Source=Paul Collins Startup list [Svcsys Registry Manager] Number=10211 Confirmed=X Filename=svcsysreg.exe Description=Recognized by Kaspersky antivirus as Trojan-Clicker.Agent.cv Source=Paul Collins Startup list [svcsys32] Number=10212 Confirmed=X Filename=svcsys32.exe Description=Added by the AGOBOT-LL WORM! Source=Paul Collins Startup list [svctask] Number=10213 Confirmed=X Filename=svctask.exe Description=Added by the CHUCKYB-A TROJAN! Source=Paul Collins Startup list [svcwinprocess32] Number=10214 Confirmed=X Filename=[path to worm] Description=Added by the UPERING WORM! Source=Paul Collins Startup list [svhoost] Number=10215 Confirmed=X Filename=checksys.exe Description=Added by a downloader TROJAN of Chinese origin! Source=Paul Collins Startup list [SVHOST] Number=10216 Confirmed=X Filename=svhost.exe Description=Added by the MYDOOM.I WORM! Source=Paul Collins Startup list [SVHOST] Number=10217 Confirmed=X Filename=SVHOST.EXE Description=Added by the ZORI.A VIRUS! Source=Paul Collins Startup list [Svhost Loader] Number=10218 Confirmed=X Filename=svshost.exe Description=Added by the AGOBOT.G WORM! Source=Paul Collins Startup list [svhost updates] Number=10219 Confirmed=X Filename=Svhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [svhost windows services] Number=10220 Confirmed=X Filename=svhost8.exe Description=Added by the RBOT-WQ WORM! Source=Paul Collins Startup list [SVIDC32M] Number=10221 Confirmed=? Filename=SVIDC32M.exe Description=?? Source=Paul Collins Startup list [sVideo2] Number=10222 Confirmed=X Filename=vxdrun6.exe Description="Switch" premium rate adult content dialler Source=Paul Collins Startup list [sviload32] Number=10223 Confirmed=X Filename=sviload32.exe Description=Added by the RBOT-AAS WORM! Source=Paul Collins Startup list [SVM Pop] Number=10224 Confirmed=? Filename=svmpop.exe Description=?? Source=Paul Collins Startup list [svnlitup32] Number=10225 Confirmed=X Filename=svnlitup32.exe Description=Added by the RBOT.CBJ WORM! Source=Paul Collins Startup list [svnloader] Number=10226 Confirmed=X Filename=svnload32.exe Description=Added by the RBOT-ACU WORM! Source=Paul Collins Startup list [svphost.exe] Number=10227 Confirmed=X Filename=svphost.exe Description=Added by the AGENT.CS TROJAN! Source=Paul Collins Startup list [SVPWUTIL] Number=10228 Confirmed=U Filename=SVPWUTIL.exe SVPwUTIL Description=Part of Toshiba Hardware Setup Source=Paul Collins Startup list [svrrun] Number=10229 Confirmed=X Filename=svrrun.exe Description=Adware hailing from Deskwizz.com Source=Paul Collins Startup list [svsekin] Number=10230 Confirmed=X Filename=svsekt.exe Description=Added by the QQPASS.G TROJAN! Source=Paul Collins Startup list [svshost] Number=10231 Confirmed=X Filename=svshost.exe Description=Added by the CHODE-H WORM! Source=Paul Collins Startup list [svshost] Number=10232 Confirmed=X Filename=messenger.exe Description=Added by the LOONY-G TROJAN! Source=Paul Collins Startup list [Svshost Update Service] Number=10233 Confirmed=X Filename=svcbind.exe Description=Added by the MYTOB.LH WORM! Source=Paul Collins Startup list [svshost32] Number=10234 Confirmed=X Filename=msgrsv32.exe Description=Added by the RANKY.AJ TROJAN! Source=Paul Collins Startup list [svshost32] Number=10235 Confirmed=X Filename=svshost32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [svshostdriver] Number=10236 Confirmed=X Filename=svshost.exe Description=Added by the SDBOT-HN TROJAN! Source=Paul Collins Startup list [svtcin] Number=10237 Confirmed=X Filename=n20050308.a.Stub.EXE Description=Added by the N20050308 TROJAN! Source=Paul Collins Startup list [svwin32] Number=10238 Confirmed=X Filename=unninst32.exe Description=Added by the AGOBOT-NF WORM! Source=Paul Collins Startup list [SVX Control Service] Number=10239 Confirmed=X Filename=svxhost.exe Description=Added by the FORBOT-K WORM! Source=Paul Collins Startup list [SW20] Number=10240 Confirmed=U Filename=sw20.exe Description=Related to MSI's Dynamic Overclocking Technology Source=Paul Collins Startup list [SW24] Number=10241 Confirmed=U Filename=sw24.exe Description=Related to MSI's Dynamic Overclocking Technology Source=Paul Collins Startup list [Swap Nut] Number=10242 Confirmed=N Filename=javaw.exe Description=javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut, a peer-to-peer file sharing and searching utility developed and marketed by File Metrics, Inc. Users can search for and find almost any type of digital file (audio, video, photos etc.) through a secure peer-to-peer network Source=Paul Collins Startup list [SWCaller] Number=10243 Confirmed=X Filename=SWcaller.exe Description=Swporta homepage hijacker Source=Paul Collins Startup list [SWCaller] Number=10244 Confirmed=X Filename=Swcaller2.exe Description=Swporta homepage hijacker Source=Paul Collins Startup list [Swchost] Number=10245 Confirmed=X Filename=Swhost.exe Description=Added by the MP TROJAN! Source=Paul Collins Startup list [SWClient] Number=10246 Confirmed=U Filename=swsys.exe Description=ActivMonAgent keyboard logger/monitoring program - remove unless you installed it yourself Source=Paul Collins Startup list [swcroot] Number=10247 Confirmed=X Filename=swcroot.exe Description=Added by the SOLENO-A TROJAN! Source=Paul Collins Startup list [SWd] Number=10248 Confirmed=N Filename=winwd.exe Description=PC Security from Tropical Software - lock files, password protect, etc Source=Paul Collins Startup list [Sweep95] Number=10249 Confirmed=Y Filename=ICLOAD95.EXE Description=Part of Sophos ant-virus sofware Source=Paul Collins Startup list [SweetIM] Number=10250 Confirmed=N Filename=SweetIM.exe Description=vSweetIM - send fancier smiley-faces and IM graphics to friends who are using MSN Messenger. They are only able to see these advanced smiley-faces if they also have SweetIM installed Source=Paul Collins Startup list [Swf32] Number=10251 Confirmed=X Filename=AVupdate.exe Description=Added by the MERKUR.E WORM! Source=Paul Collins Startup list [Swf32] Number=10252 Confirmed=X Filename=_backup.exe Description=Added by the SYMTEN WORM! Source=Paul Collins Startup list [swg] Number=10253 Confirmed=U Filename=GoogleToolbarNotifier.exe Description=Companion to the Google Toolbar that lets you keep Google as your default search engine and prevents this setting from being changed without your consent. Shouldn't remain in memory after the feature is disabled as it's a bug - see here Source=Paul Collins Startup list [SwimSuitNetwork] Number=10254 Confirmed=X Filename=SwimSuitNetwork.exe Description=Advertising spyware Source=Paul Collins Startup list [swingsys] Number=10255 Confirmed=X Filename=SWINGSYS.EXE Description=Added by the BANCOS-CX TROJAN! Source=Paul Collins Startup list [Switch Off] Number=10256 Confirmed=U Filename=swoff.exe Description=Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer, disconnect your current dialup connection, lock workstation, etc Source=Paul Collins Startup list [Switchboard.com Toolbar] Number=10257 Confirmed=N Filename=AtHoc.exe Description=Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com Source=Paul Collins Startup list [Switcher] Number=10258 Confirmed=U Filename=Switcher.exe Description="On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN, Bluetooth, both) when turning the wireless switch on if disabled)" Source=Paul Collins Startup list [switp] Number=10259 Confirmed=X Filename=switpa.exe Description=OfferAgent adware component Source=Paul Collins Startup list [SWL] Number=10260 Confirmed=U Filename=rundll32.exe [path] SWL.dll rdl Description=StealthWeblog surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [SWN2] Number=10261 Confirmed=U Filename=swnxt.exe Description=Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here Source=Paul Collins Startup list [sws.exe] Number=10262 Confirmed=X Filename=[random filename] Description=Haldex type adult content dialler Source=Paul Collins Startup list [sws.exe] Number=10263 Confirmed=X Filename=gd-dial.exe Description=Globaldialer adult content premium rate dialer Source=Paul Collins Startup list [SwTray] Number=10264 Confirmed=N Filename=SWTRAY.EXE Description=MS SideWinder game controller system tray icon. Available via Start -> Programs. May have the version number after it Source=Paul Collins Startup list [SWTrayV4] Number=10265 Confirmed=N Filename=SWTrayV4.exe Description=MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs Source=Paul Collins Startup list [SXGDSENU] Number=10266 Confirmed=? Filename=sxgdsenu.exe Description=Yamaha SXG soundcard driver Source=Paul Collins Startup list [SxgTkBar] Number=10267 Confirmed=N Filename=sxgtkbar.exe Description=Yamaha SXG soundcard utility - gives quick and easy access via the system tray bar to diagnostics and configuration Source=Paul Collins Startup list [Sxplog] Number=10268 Confirmed=? Filename=sxpstub.exe Description=Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup? Source=Paul Collins Startup list [sxrrv] Number=10269 Confirmed=X Filename=sxrrv.pif Description=Added by the VAX-A TROJAN! Source=Paul Collins Startup list [SyBot v2.1 By Sky-Dancer] Number=10270 Confirmed=X Filename=HPSV.exe Description=Added by the ZOTOB.I WORM! Source=Paul Collins Startup list [SYDNEY] Number=10271 Confirmed=X Filename=[file path] Description=Added by the SYNEY WORM! Source=Paul Collins Startup list [syelimS-esreveR-troppuS] Number=10272 Confirmed=X Filename=[filename] Description=Added by the LITBOT.C TROJAN! Source=Paul Collins Startup list [Syga432te Pe432rsonal Firewall] Number=10273 Confirmed=X Filename=MrNo4236.exe Description=Added by the RBOT-AQY WORM! Source=Paul Collins Startup list [Sygaete Personal Firewall] Number=10274 Confirmed=X Filename=SyGate.exe Description=Added by the RBOT-GLX WORM! Source=Paul Collins Startup list [Sygate Peral Firewall] Number=10275 Confirmed=X Filename=Syga.exe Description=Added by the RBOT-AQK WORM! Source=Paul Collins Startup list [Sygate Personal 3] Number=10276 Confirmed=X Filename=svrv.exe Description=Added by the RBOT-XD WORM! Source=Paul Collins Startup list [Sygate Personal Block] Number=10277 Confirmed=X Filename=Studio.exe Description=Added by the RBOT-TW WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10278 Confirmed=X Filename=Win32x.exe Description=Added by the RBOT-KZ WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10279 Confirmed=X Filename=system32.exe Description=Added by the RBOT.VI WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10280 Confirmed=X Filename=sysgut.exe Description=Added by the SDBOT.WM WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10281 Confirmed=X Filename=Sygate.exe Description=Added by the RBOT-PN WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10282 Confirmed=X Filename=Mcafeeupdate.exe Description=Added by the RBOT.YN WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10283 Confirmed=X Filename=Sygate32.exe Description=Added by the RBOT.ATW WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10284 Confirmed=X Filename=MSNSRV32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10285 Confirmed=X Filename=service.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10286 Confirmed=X Filename=t1ktik.exe Description=Added by the RBOT-VP WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10287 Confirmed=X Filename=host32.exe Description=Added by the RBOT.ALD WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10288 Confirmed=X Filename=sexy.exe Description=Added by the RBOT-XY WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10289 Confirmed=X Filename=sys.exe Description=Added by the RBOT-ZC WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10290 Confirmed=X Filename=syserror.exe Description=Added by the RBOT.UC WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10291 Confirmed=X Filename=hostserv.exe Description=Added by the RBOT.BKO WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10292 Confirmed=X Filename=msnmsgrs.exe Description=Added by the RBOT.XN WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10293 Confirmed=X Filename=Sygat.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10294 Confirmed=X Filename=wins.exe Description=Added by the RBOT.AOB WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10295 Confirmed=X Filename=winxpstat.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10296 Confirmed=X Filename=Syga.exe Description=Added by the RBOT-AQD WORM! Source=Paul Collins Startup list [Sygate Personal Firewall] Number=10297 Confirmed=X Filename=svchots.exe Description=Added by the RBOT.ABT WORM! Source=Paul Collins Startup list [Sygate Personal Firewall Start] Number=10298 Confirmed=X Filename=services32.exe Description=Added by the RBOT-MB WORM! Source=Paul Collins Startup list [Sygate Personal Firewall Start] Number=10299 Confirmed=X Filename=servic.exe Description=Added by the RBOT-RY WORM! Source=Paul Collins Startup list [Sygate Personal Port] Number=10300 Confirmed=X Filename=crss.exe Description=Added by the RBOT-PX WORM! Source=Paul Collins Startup list [Sygate Personal Port Blocker] Number=10301 Confirmed=X Filename=volume.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personal Port Blocker] Number=10302 Confirmed=X Filename=winupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Sygate Personals Firewalls] Number=10303 Confirmed=X Filename=ccsrn.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SyGateService] Number=10304 Confirmed=U Filename=sgserv95.exe Description=SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs Source=Paul Collins Startup list [Symantec] Number=10305 Confirmed=X Filename=ccapp.exe Description=Added by the REATLE WORM! Note - this is not a Symantec file Source=Paul Collins Startup list [Symantec Anti Virus] Number=10306 Confirmed=X Filename=symantec32.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Symantec Antivirus professional] Number=10307 Confirmed=X Filename=dfrgfrat.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Symantec Autoscan] Number=10308 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AJO WORM! Source=Paul Collins Startup list [Symantec Configuration Loader] Number=10309 Confirmed=X Filename=ccApp32.exe Description=Added by a variant of the GAOBOT WORM! Source=Paul Collins Startup list [Symantec Core LC] Number=10310 Confirmed=Y Filename=symlcsvc.exe Description=Part of Norton AntiVirus 2004. What does it do? Source=Paul Collins Startup list [Symantec Fax Starter Edition Port] Number=10311 Confirmed=N Filename=OLFSNT40.EXE Description=Offers a virtual printer as a fax machine. Can be run via a desktop shortcut Source=Paul Collins Startup list [Symantec NetDriver Monitor] Number=10312 Confirmed=U Filename=SNDMon.exe Description=Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual updates but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is disabled on one of the computers � then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation Source=Paul Collins Startup list [Symantec NetDriver Warning] Number=10313 Confirmed=U Filename=SNDWarn.exe Description=Part of Symantec Live Update - displays the warning when you need to update the firewall database Source=Paul Collins Startup list [Symantec Secure Server] Number=10314 Confirmed=X Filename=svrhost.exe Description=Added by the IRCBOT-UB TROJAN! Source=Paul Collins Startup list [Symantec Security] Number=10315 Confirmed=X Filename=symantec32.exe Description=Added by the RANDEX.PR or RANDEX.YR WORMS! Source=Paul Collins Startup list [Symantec Security Addon] Number=10316 Confirmed=X Filename=nvsvc.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here Source=Paul Collins Startup list [Symantec Security Routine Addon for Microsoft Windows] Number=10317 Confirmed=X Filename=navpxaw32.exe Description=Added by the AGOBOT-GJ TROJAN! Source=Paul Collins Startup list [Symantec Service] Number=10318 Confirmed=X Filename=ccApp.exe Description=Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename Source=Paul Collins Startup list [SymantecFilterCheck] Number=10319 Confirmed=X Filename=svhost.exe Description=Added by the BANKER-EEO TROJAN! Source=Paul Collins Startup list [SymAV] Number=10320 Confirmed=X Filename=SymAV.exe Description=Added by the NETSKY.U WORM! Source=Paul Collins Startup list [SymKeepAlive] Number=10321 Confirmed=U Filename=CKA.exe Description=Part of Norton SystemWorks 2003 - keeps a dial-up modem connection alive Source=Paul Collins Startup list [Symlcs] Number=10322 Confirmed=X Filename=[path to file] Description=Added by the YASPY-A TROJAN! Source=Paul Collins Startup list [Symmetrical Network] Number=10323 Confirmed=X Filename=symmec.exe Description=Added by the DELBOT-N WORM! Source=Paul Collins Startup list [SymRun] Number=10324 Confirmed=X Filename=N/A Description=Added by the KANGAROO-A TROJAN! Source=Paul Collins Startup list [SymRun] Number=10325 Confirmed=X Filename=ccApps.exe Description=Added by the KAGEN-A TROJAN! Source=Paul Collins Startup list [SymTray - Norton SystemWorks] Number=10326 Confirmed=N Filename=SYMTRAY.EXE Description=Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus, Norton Utilities and Norton CleanSweep - mentioned elsewhere here. Personally I only have Norton eMail Protect running which doesn't need SymTray Source=Paul Collins Startup list [Synaptics Pointing Device Driver] Number=10327 Confirmed=U Filename=SynTPEnh.exe Description=Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll Source=Paul Collins Startup list [Sync Data] Number=10328 Confirmed=U Filename=Hndsync.exe Description=Pocket Real Estate - mobile synchronization manager Source=Paul Collins Startup list [Sync Server] Number=10329 Confirmed=X Filename=drwatsoon.exe Description=Added by the WATSOON.A TROJAN! Source=Paul Collins Startup list [Sync-It] Number=10330 Confirmed=U Filename=Syncit.exe Description=Sync-It - synchronizes the system clock with time servers on the internet Source=Paul Collins Startup list [SyncAgent] Number=10331 Confirmed=U Filename=syncagent.exe Description=Ghost Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Synchronization Manage] Number=10332 Confirmed=X Filename=rservers.exe Description=Added by the FORBOT-FM WORM! Source=Paul Collins Startup list [Synchronization Manager] Number=10333 Confirmed=N Filename=mobsync.exe Description=Find more information about its use here Source=Paul Collins Startup list [syncman] Number=10334 Confirmed=X Filename=winsync.exe Description=Added by the MANCSYN-A TROJAN! Source=Paul Collins Startup list [SyncManager] Number=10335 Confirmed=X Filename=msorunner.exe Description=Added by a variant of the TACTSLAY TROJAN! Source=Paul Collins Startup list [SyncMon] Number=10336 Confirmed=X Filename=adslcomdos.exe Description=Added by the CLUNKY-A TROJAN! Source=Paul Collins Startup list [SyncMon] Number=10337 Confirmed=X Filename=fixcomdos.exe Description=Added by the CLUNKY-B TROJAN! Source=Paul Collins Startup list [SynSetup] Number=10338 Confirmed=? Filename=SynTP.tmp RunOnce.exe Description=Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required? Source=Paul Collins Startup list [Syntax] Number=10339 Confirmed=X Filename=windows32.exe Description=Added by the SDBOT.CQ WORM! Source=Paul Collins Startup list [Syntax Script] Number=10340 Confirmed=X Filename=systacq.exe Description=Added by the SDBOT.AI WORM! Source=Paul Collins Startup list [SynTPEnh] Number=10341 Confirmed=U Filename=syntpenh.exe Description=Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll Source=Paul Collins Startup list [SynTPLpr] Number=10342 Confirmed=Y Filename=syntplpr.exe Description=Synaptics touchpad driver helper. Required for touchpad features to work Source=Paul Collins Startup list [sys] Number=10343 Confirmed=X Filename=regedit /s sys.reg Description=Hijacker Source=Paul Collins Startup list [sys] Number=10344 Confirmed=X Filename=regedit sysdllwm.reg Description=CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN! Source=Paul Collins Startup list [Sys Ren] Number=10345 Confirmed=X Filename=SysRen.exe Description=Part of FlashEnhancer adware Source=Paul Collins Startup list [sys************* [* = random digit]] Number=10346 Confirmed=X Filename=sys*************.exe [* = random digit] Description=WINBO adware Source=Paul Collins Startup list [Sys**.exe [* = random char]] Number=10347 Confirmed=X Filename=Sys**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Sys**32.exe [* = random char]] Number=10348 Confirmed=X Filename=Sys**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Sys-Stat] Number=10349 Confirmed=X Filename=wuapdxe.exe Description=Added by the SDBOT.HK WORM! Source=Paul Collins Startup list [sys008] Number=10350 Confirmed=X Filename=sys008.exe Description=Hijacker, also detected as the STARTPA-GK TROJAN! Source=Paul Collins Startup list [sys009] Number=10351 Confirmed=X Filename=sys009.exe Description=Added by the STARTPA-ZB TROJAN! Source=Paul Collins Startup list [sys201] Number=10352 Confirmed=X Filename=sys209.exe Description=Added by the STARTPA-ZY TROJAN! Source=Paul Collins Startup list [Sys29] Number=10353 Confirmed=X Filename=win***32.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [sys32] Number=10354 Confirmed=X Filename=sys32.exe Description=Added by the FLUX.E TROJAN! Source=Paul Collins Startup list [sys32] Number=10355 Confirmed=X Filename=sysx32.exe Description=Added by the KVEX-A VIRUS! Source=Paul Collins Startup list [sys32cmd] Number=10356 Confirmed=U Filename=sys32win.exe Description=Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [sys32dll] Number=10357 Confirmed=X Filename=sys32dll.exe Description=Added by the AIMDES.B WORM! Source=Paul Collins Startup list [sys32sql] Number=10358 Confirmed=U Filename=sys32win.exe Description=Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [sys33] Number=10359 Confirmed=X Filename=sys33.exe Description=Added by the AGOBOT-WJ WORM! Source=Paul Collins Startup list [SysA] Number=10360 Confirmed=X Filename=win***32.exe [* = random char] Description=EliteBar adware Source=Paul Collins Startup list [SysAgent] Number=10361 Confirmed=U Filename=SysAgent.exe Description=SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of Source=Paul Collins Startup list [SysAI] Number=10362 Confirmed=X Filename=SysAI.exe Description=AproposMedia adware Source=Paul Collins Startup list [SysATW] Number=10363 Confirmed=X Filename=sysatw.exe Description=Added by the VANEBOT-AM WORM! Source=Paul Collins Startup list [SysBkup] Number=10364 Confirmed=U Filename=[path to file] Description=Keyspy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Sysbot] Number=10365 Confirmed=U Filename=sysbot.exe Description=Spector - spying (or monitoring) software to record internet activity Source=Paul Collins Startup list [syscfg] Number=10366 Confirmed=X Filename=syscfg32.exe Description=Added by the KWBOT.S WORM! Source=Paul Collins Startup list [syscfg34.exe] Number=10367 Confirmed=X Filename=syscfg34.exe Description=Added by the ELECTRON WORM! Source=Paul Collins Startup list [Syscheck] Number=10368 Confirmed=X Filename=win.hta Description=Browser hijacker Source=Paul Collins Startup list [syscheck] Number=10369 Confirmed=X Filename=iexplorer.exe Description=Added by the AGENT.DM TROJAN! Source=Paul Collins Startup list [sysclx] Number=10370 Confirmed=X Filename=ntldrt.exe Description=Added by the JLOK-A WORM! Source=Paul Collins Startup list [syscm] Number=10371 Confirmed=X Filename=Syscm.exe Description=Vanish adware Source=Paul Collins Startup list [SysComp] Number=10372 Confirmed=? Filename=mssdnl.com Description=Unknown but suspect as *.com are not usually run at start up and the name isn't recognized Source=Paul Collins Startup list [syscon] Number=10373 Confirmed=X Filename=syscon.exe Description=Added by the APRILCONE.A WORM! Source=Paul Collins Startup list [syscon lptt01] Number=10374 Confirmed=X Filename=syscon.exe Description=RapidBlaster variant (in a "Syscon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [syscon ml097e] Number=10375 Confirmed=X Filename=syscon.exe Description=RapidBlaster variant (in a "Syscon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [sysconfig] Number=10376 Confirmed=X Filename=iexplorer.exe Description=Added by the CULT.C WORM! Source=Paul Collins Startup list [SysConfig] Number=10377 Confirmed=X Filename=syscfg35.exe Description=Added by the KAZMOR.C WORM! Source=Paul Collins Startup list [sysconfig] Number=10378 Confirmed=X Filename=iexplorer.exe Description=Added by the CULT.H WORM! Source=Paul Collins Startup list [SysConfig] Number=10379 Confirmed=X Filename=wincfg32.exe Description=Added by the SDBOT.ZD WORM! Source=Paul Collins Startup list [Sysconfig] Number=10380 Confirmed=U Filename=Stealth KeySpy.exe Description=StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Syscpy] Number=10381 Confirmed=X Filename=Syscpy.exe Description=Firewall-bypassing, proxied spam relayer. Detected by Symantec as the HOGLE TROJAN! Source=Paul Collins Startup list [SysCtl] Number=10382 Confirmed=X Filename=sysctl.exe Description=Added by the AOK TROJAN! Source=Paul Collins Startup list [Sysctrls] Number=10383 Confirmed=X Filename=procdll.exe Description=Added by the WEEDBOTZ.14 TROJAN! Source=Paul Collins Startup list [Sysctrls] Number=10384 Confirmed=X Filename=winupdate.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [sysdat.dll] Number=10385 Confirmed=X Filename=sysdat.dll.exe Description=Added by the NISHICA 1.1 TROJAN! Source=Paul Collins Startup list [SysData] Number=10386 Confirmed=X Filename=[path to file] Description=Added by the RANCK-BA TROJAN! Source=Paul Collins Startup list [SysDeskqqfx] Number=10387 Confirmed=X Filename=qqfx.exe Description=Added by the QQPASS.H TROJAN! Source=Paul Collins Startup list [SysDeskqqfx] Number=10388 Confirmed=X Filename=Runddll32.exe Description=Added by the CHANGGAME TROJAN! Source=Paul Collins Startup list [SysDesktop] Number=10389 Confirmed=X Filename=fswanQQ.exe Description=Added by the QQSEND-A TROJAN! Source=Paul Collins Startup list [sysdir] Number=10390 Confirmed=X Filename=winrun.exe Description=Added by the WINBUR.B WORM! Source=Paul Collins Startup list [sysdll] Number=10391 Confirmed=X Filename=[trojan filename] Description=Added by the HUGESOT TROJAN! Source=Paul Collins Startup list [Sysdpt] Number=10392 Confirmed=X Filename=sysdpt.exe Description=CRYPT trojan downloader Source=Paul Collins Startup list [sysdxvid] Number=10393 Confirmed=X Filename=sysdxvid.exe Description=Added by the DLUCA-S TROJAN! Source=Paul Collins Startup list [sysemls] Number=10394 Confirmed=X Filename=sysem.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [SysEQ] Number=10395 Confirmed=X Filename=svclgx32.exe Description=Added by the IRCBOT-AC TROJAN! Source=Paul Collins Startup list [sysfiler] Number=10396 Confirmed=X Filename=sysfiler.exe Description=Added by the RETSAM TROJAN! Source=Paul Collins Startup list [SYSfit] Number=10397 Confirmed=X Filename=SYSfit.exe Description=AdShooter adware variant Source=Paul Collins Startup list [sysflg32] Number=10398 Confirmed=X Filename=sysflg32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [sysformat] Number=10399 Confirmed=X Filename=sysformat.exe Description=Added by the BAGLE-BK WORM! Source=Paul Collins Startup list [sysfrcx] Number=10400 Confirmed=X Filename=sysfrcx.exe Description=Added by the KEYLOG-SCLOG TROJAN! Source=Paul Collins Startup list [syshelp] Number=10401 Confirmed=X Filename=syshelp.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [sysin] Number=10402 Confirmed=X Filename=[path to file] Description=Added by the DSRC-A TROJAN! Source=Paul Collins Startup list [sysinfo] Number=10403 Confirmed=X Filename=sysinfo.exe Description=Added by the BEDRILL TROJAN! Source=Paul Collins Startup list [sysinfo.exe] Number=10404 Confirmed=X Filename=sysinfo.exe Description=Added by the BEAGLE.V WORM! Source=Paul Collins Startup list [SysInit] Number=10405 Confirmed=X Filename=wininit32.exe Description=Added by the XABOT WORM! Source=Paul Collins Startup list [sysinit] Number=10406 Confirmed=X Filename=services.exe Description=Added by the NEWLFRM-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "golumm" subfolder Source=Paul Collins Startup list [Sysino] Number=10407 Confirmed=X Filename=lsess.exe Description=Added by the FORBOT-BF WORM! Source=Paul Collins Startup list [sysint16] Number=10408 Confirmed=X Filename=sysint16.exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [Syskey] Number=10409 Confirmed=X Filename=sysinit.exe Description=Added by the BEAGLE.AX WORM! Source=Paul Collins Startup list [Syslib] Number=10410 Confirmed=X Filename=Syslib.exe Description=Adult content related downloader trojan Source=Paul Collins Startup list [Syslog lptt01] Number=10411 Confirmed=X Filename=Syslog.exe Description=RapidBlaster variant (in a "Syslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Syslog ml097e] Number=10412 Confirmed=X Filename=Syslog.exe Description=RapidBlaster variant (in a "Syslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [syslogin.exe] Number=10413 Confirmed=X Filename=syslogin.exe Description=Added by the BAGZ-B WORM! Source=Paul Collins Startup list [Sysman] Number=10414 Confirmed=U Filename=Sysman.exe Description=KeyTrap is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [sysme] Number=10415 Confirmed=X Filename=sysme.exe Description=Added by the PSW_STEALER_C TROJAN! Source=Paul Collins Startup list [sysmem] Number=10416 Confirmed=X Filename=mmsete.exe Description=Added by the NOPIR.C WORM! Source=Paul Collins Startup list [sysmem] Number=10417 Confirmed=X Filename=outlookrem.exe Description=Added by the NOPIR-C WORM! Source=Paul Collins Startup list [SysMemory manager] Number=10418 Confirmed=X Filename=mdms.exe Description=Added by the CIMUZ-D TROJAN! Source=Paul Collins Startup list [SysMetrix] Number=10419 Confirmed=U Filename=SysMetrix.exe Description=SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics Source=Paul Collins Startup list [sysMett1] Number=10420 Confirmed=X Filename=explorer.exe Description=Added by the LEGMIR-Y TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [sysmini] Number=10421 Confirmed=X Filename=sysmini.exe Description=Added by the ADLOAD.DD TROJAN! Source=Paul Collins Startup list [sysmngr32] Number=10422 Confirmed=X Filename=sys64mnger.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [sysmntrc] Number=10423 Confirmed=X Filename=sysmntrc.exe Description=Added by the BANCOS-FX TROJAN! Source=Paul Collins Startup list [sysmod] Number=10424 Confirmed=X Filename=sysmod.exe Description=Added by the SPYBOT-DU WORM! Source=Paul Collins Startup list [sysmon] Number=10425 Confirmed=X Filename=sysmon.exe Description=Added by the BIZEX WORM! Source=Paul Collins Startup list [Sysmon] Number=10426 Confirmed=X Filename=rpcmon.exe Description=Added by the RANDEX.ATX WORM! Source=Paul Collins Startup list [sysmon] Number=10427 Confirmed=X Filename=sysmon44.exe Description=Added by a variant of the BACKDOOR-CBA TROJAN! Source=Paul Collins Startup list [SysMon] Number=10428 Confirmed=X Filename=wowexece.exe Description=Added by the MULAN-A TROJAN! Source=Paul Collins Startup list [Sysmon] Number=10429 Confirmed=X Filename=SystemMonitor.exe Description=Added by the NUJAMA-A WORM! Source=Paul Collins Startup list [sysmon12] Number=10430 Confirmed=X Filename=[various filenames] Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [SysmonLog] Number=10431 Confirmed=X Filename=mslog.exe Description=Added by the AGENT.AOV TROJAN! Source=Paul Collins Startup list [sysmonnt] Number=10432 Confirmed=X Filename=sysmonnt.exe Description=SearchPounder sends keywords typed into HTML forms and popular Internet search engines to a remote server Source=Paul Collins Startup list [SysMonXP] Number=10433 Confirmed=X Filename=SysMonXP.exe Description=Added by the NETSKY.Q WORM! Source=Paul Collins Startup list [sysnate] Number=10434 Confirmed=X Filename=sysnate.exe Description=Added by the MEDIAS TROJAN! Source=Paul Collins Startup list [Sysnet] Number=10435 Confirmed=X Filename=snuninst.exe Description=Unidentified adware Source=Paul Collins Startup list [sysnet] Number=10436 Confirmed=X Filename=sysnet.exe Description=CasClient adware - also detected as the CMAPP TROJAN! Source=Paul Collins Startup list [sysobj.exe] Number=10437 Confirmed=X Filename=sysobj.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [SysOps] Number=10438 Confirmed=X Filename=SysOps Description=Added by the MSNCORRUPT TROJAN! Source=Paul Collins Startup list [syspare] Number=10439 Confirmed=X Filename=syspare.exe Description=Added by the BIFROSE-AN TROJAN! Source=Paul Collins Startup list [syspath] Number=10440 Confirmed=X Filename=drv.exe Description=Added by the SOBER WORM! Source=Paul Collins Startup list [sysPersonalFirewall] Number=10441 Confirmed=X Filename=msnmssgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [sysPersonalFirewall] Number=10442 Confirmed=X Filename=system.exe Description=Added by the WOOTBOT.FH WORM! Source=Paul Collins Startup list [sysPersonalFirewall] Number=10443 Confirmed=X Filename=tskm0nitor.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SysPilot] Number=10444 Confirmed=U Filename=fdxxl.exe Description=G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! Source=Paul Collins Startup list [sysPnP] Number=10445 Confirmed=X Filename=bootconf.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com; see for example here Source=Paul Collins Startup list [SysPnP] Number=10446 Confirmed=X Filename=rundll32 setupapi, InstallHinfSection.... oemsyspnp.inf Description=Search hijacker - see here Source=Paul Collins Startup list [syspol] Number=10447 Confirmed=X Filename=syspol.exe Description=Added by the DREMN-B TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [SysPool] Number=10448 Confirmed=Y Filename=Mssvc.exe Description=StealthDisk - hides folders, files and applications. Will also encrypt them for better protection Source=Paul Collins Startup list [SysPool] Number=10449 Confirmed=X Filename=MSSVC32.EXE Description=Added by the BANCBAN-IO TROJAN! Source=Paul Collins Startup list [SysProtect] Number=10450 Confirmed=X Filename=System.exe Description=Added by the NETSPY TROJAN! Source=Paul Collins Startup list [SysProtect] Number=10451 Confirmed=X Filename=syp.exe Description=SysProtect is detected as a "potentially unwanted program". It purports to be an system repair/maintenance application, but requires paid registration before any issues found can be fixed. Many of the "invalid" items found appear suspect. This has been reported to be distributed in wild via trojan Vundo. Other incarnations of this software exist with the same model and similar web presences (for example WinFixer). For more information see here Source=Paul Collins Startup list [syspw32.exe] Number=10452 Confirmed=X Filename=syspw32.exe Description=Added by the APPFLET.A WORM! Source=Paul Collins Startup list [Sysqq] Number=10453 Confirmed=X Filename=LSESS.exe Description=Added by the FORBOT-BF WORM! Source=Paul Collins Startup list [SysR] Number=10454 Confirmed=X Filename=sysmd.exe Description=Ulubione adult content dialer Source=Paul Collins Startup list [SysReg] Number=10455 Confirmed=X Filename=SysReg.exe Description=Added by the CHEKIN TROJAN! Source=Paul Collins Startup list [SysReg] Number=10456 Confirmed=X Filename=SysReg.exe Description=SearchSeekFind textual marketing foistware Source=Paul Collins Startup list [Sysres] Number=10457 Confirmed=X Filename=Sysres.exe Description=Added by the LOGMOD.A TROJAN! Source=Paul Collins Startup list [SysRes] Number=10458 Confirmed=X Filename=TASKMANAGER.exe Description=Added by the ELIPTER.A or ELIPTER.B WORMS! Source=Paul Collins Startup list [SysRes] Number=10459 Confirmed=X Filename=WWE DIVAS.exe Description=Added by the ELIPTER.D WORM! Source=Paul Collins Startup list [SysRes] Number=10460 Confirmed=X Filename=IExpIore .exe Description=Added by the ELITPER.E WORM! Source=Paul Collins Startup list [Syss] Number=10461 Confirmed=X Filename=ehuupdate.exe Description=EHU adware Source=Paul Collins Startup list [SysScan] Number=10462 Confirmed=X Filename=bvt.exe Description=Added by the AUTOUPDER TROJAN! Source=Paul Collins Startup list [SysSearch] Number=10463 Confirmed=X Filename=Regedit.exe -s [path] pcsearch.reg Description=Added by the StartPage-FN browser hijacker Source=Paul Collins Startup list [SysSearch] Number=10464 Confirmed=X Filename=REGEDIT.EXE -s [path] sysreg.reg Description=Added by the STARTPA-ME TROJAN! Source=Paul Collins Startup list [SysSense] Number=10465 Confirmed=U Filename=SysSense.exe Description="SysSense is your personal desktop Google AdSense monitor. It keeps your current Google AdSense information in the Windows system tray". Google AdSense account required Source=Paul Collins Startup list [sysser] Number=10466 Confirmed=X Filename=[path to file] Description=Added by the RAHACK WORM! Source=Paul Collins Startup list [SysService] Number=10467 Confirmed=X Filename=SysService.exe Description=Added by the DELF family of TROJANS! Source=Paul Collins Startup list [SysService] Number=10468 Confirmed=U Filename=SERVICES.EXE Description=NSKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SysService32] Number=10469 Confirmed=X Filename=SysService32.exe Description=Added by the KINDAL VIRUS! Source=Paul Collins Startup list [SysService32] Number=10470 Confirmed=X Filename=ln32k.dll Description=Added by the KINDAL VIRUS! Source=Paul Collins Startup list [SysService32l] Number=10471 Confirmed=X Filename=systask32l.exe Description=Added by the THEUG WORM! Source=Paul Collins Startup list [SYSsfitb] Number=10472 Confirmed=X Filename=SYSsfitb.exe Description=Searchforit browser hijacker Source=Paul Collins Startup list [SySSL] Number=10473 Confirmed=X Filename=sysl.exe Description=Added by the RBOT-CKH WORM! Source=Paul Collins Startup list [SysStart] Number=10474 Confirmed=X Filename=***sysi6.exe [* = random char] Description=ZenoSearch adware. Note - the most frequent filenames appear to be jdisysi6.exe, hjisysi6.exe, ffgsysi6.exe but there are others Source=Paul Collins Startup list [SysStart] Number=10475 Confirmed=X Filename=1.exe Description=ZenoSearch adware Source=Paul Collins Startup list [SysStart] Number=10476 Confirmed=X Filename=[adware filename] Description=ZenoSearch adware Source=Paul Collins Startup list [SysStrt] Number=10477 Confirmed=X Filename=systemc.exe Description=Added by the AGOBOT-QA TROJAN! Source=Paul Collins Startup list [syst] Number=10478 Confirmed=X Filename=syst.exe Description=Added by the DUMB.A "Joke" virus Source=Paul Collins Startup list [System] Number=10479 Confirmed=X Filename=run322.exe Description=Added by the LANFILT TROJAN! Source=Paul Collins Startup list [System] Number=10480 Confirmed=X Filename=system.exe Description=Added by various WORMS and TROJANS! Source=Paul Collins Startup list [system] Number=10481 Confirmed=X Filename=regedit -s system.dll Description=Homepage hijacker Source=Paul Collins Startup list [system] Number=10482 Confirmed=X Filename=systemsearch.hta Description=Jetseeker.com hijacker Source=Paul Collins Startup list [System] Number=10483 Confirmed=X Filename=dcomx.exe Description=Added by the CIREBOT TROJAN! Source=Paul Collins Startup list [system] Number=10484 Confirmed=X Filename=Explorer.exe Description=Added by the GRAYBIRD TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [System] Number=10485 Confirmed=X Filename=YPager.exe Description=Added by the JUNTADOR.K TROJAN! Note - this is not Yahoo! Messenger Source=Paul Collins Startup list [system] Number=10486 Confirmed=X Filename=outlook.exe Description=Added by the MIMAIL.Q WORM! Note that the valid MS Outlook executeable is located in the Program Files\Microsoft Office\Office directory wheras this one is found in the Windows or Winnt directory Source=Paul Collins Startup list [System] Number=10487 Confirmed=X Filename=Atira.exe Description=Added by the KOTIRA VIRUS! Source=Paul Collins Startup list [SYSTEM] Number=10488 Confirmed=X Filename=lsas.exe Description=Added by the SPYBOT.CJ WORM! Source=Paul Collins Startup list [System] Number=10489 Confirmed=X Filename=kernels32.exe Description=Added by the DLOADER-FC TROJAN! Source=Paul Collins Startup list [System] Number=10490 Confirmed=U Filename=sysctrl.exe Description=Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance, those copies will be identified as spyware Source=Paul Collins Startup list [System] Number=10491 Confirmed=X Filename=csrss.exe Description=Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [System] Number=10492 Confirmed=X Filename=svchost.exe Description=Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [system] Number=10493 Confirmed=X Filename=lsasse.exe Description=Added by the RBOT-YL WORM! Source=Paul Collins Startup list [System] Number=10494 Confirmed=X Filename=systray.exe Description=Added by the PISABOY-A TROJAN! Note - this is not the legitimate systray.exe process Source=Paul Collins Startup list [System] Number=10495 Confirmed=X Filename=abcdefg.exe Description=Added by the HARWIG-B WORM! Source=Paul Collins Startup list [System] Number=10496 Confirmed=X Filename=cber.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [System] Number=10497 Confirmed=X Filename=serwin.exe Description=Added by the LDPINCH-BN TROJAN! Source=Paul Collins Startup list [System] Number=10498 Confirmed=X Filename=svch�st.exe Description=Added by the LDPINCH-BF TROJAN! Source=Paul Collins Startup list [System] Number=10499 Confirmed=X Filename=system.exe (74295303) Description=Added by the IU WORM! Source=Paul Collins Startup list [System] Number=10500 Confirmed=X Filename=WINL0G0N.EXE Description=Added by the BANCOS-DB TROJAN! Source=Paul Collins Startup list [System] Number=10501 Confirmed=X Filename=wumgrd32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System] Number=10502 Confirmed=X Filename=SPOOLSU.EXE Description=Added by the BANKER-FC TROJAN! Source=Paul Collins Startup list [System] Number=10503 Confirmed=X Filename=system23.exe Description=Added by the LEBREAT-D WORM! Source=Paul Collins Startup list [System] Number=10504 Confirmed=X Filename=windowsps.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SYSTEM] Number=10505 Confirmed=X Filename=d.exe Description=Added by the MYTOB.LP WORM! Source=Paul Collins Startup list [System] Number=10506 Confirmed=X Filename=inetinfo.exe Description=Added by the PARDROP-A TROJAN! Source=Paul Collins Startup list [system] Number=10507 Confirmed=X Filename=services.exe Description=Added by the DELF-LQ TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "HELP" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [SYSTEM] Number=10508 Confirmed=X Filename=VSSMON.exe Description=Added by the RBOT-AWW TROJAN! Source=Paul Collins Startup list [SYSTEM] Number=10509 Confirmed=X Filename=wiinlogon.exe Description=Added by the RBOT-AVG WORM! Source=Paul Collins Startup list [System] Number=10510 Confirmed=X Filename=kernels64.exe Description=Added by the VIXUP-S TROJAN! Source=Paul Collins Startup list [system] Number=10511 Confirmed=X Filename=lsass.exe Description=Added by the SATILOLER.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files\Common Files\system folder Source=Paul Collins Startup list [System] Number=10512 Confirmed=X Filename=smss.exe Description=Added by the AGENT.AEP TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [System] Number=10513 Confirmed=X Filename=winupd.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [system] Number=10514 Confirmed=X Filename=messenger.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [System] Number=10515 Confirmed=X Filename=kernels1118.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [System] Number=10516 Confirmed=X Filename=wsscntfy.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [SYSTEM] Number=10517 Confirmed=X Filename=windmupdr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [system] Number=10518 Confirmed=X Filename=svcr.exe Description=Added by the SPYONE TROJAN! Source=Paul Collins Startup list [System] Number=10519 Confirmed=X Filename=kernels88.exe Description=Added by the TIBS-PP TROJAN! Source=Paul Collins Startup list [System] Number=10520 Confirmed=X Filename=kernels8.exe Description=Added by the TIBS.AI TROJAN! Source=Paul Collins Startup list [System] Number=10521 Confirmed=X Filename=OeApi.vbs Description=Added by the AGUI WORM! Source=Paul Collins Startup list [System] Number=10522 Confirmed=X Filename=Updaterun.exe Description=Added by the QQHELP-DX TROJAN! Source=Paul Collins Startup list [System] Number=10523 Confirmed=X Filename=Zap.exe Description=Added by the MSNVB-D WORM! Source=Paul Collins Startup list [System 64 Driver for Games] Number=10524 Confirmed=X Filename=sys64dvr.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [System Applications Profile] Number=10525 Confirmed=X Filename=sap.exe Description=Added by the RBOT-QF WORM! Source=Paul Collins Startup list [System Backup] Number=10526 Confirmed=X Filename=msystem.exe Description=Adult content dialler Source=Paul Collins Startup list [System backup] Number=10527 Confirmed=X Filename=[random filename] Description=Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted, examples: web.exe, soft.exe, msxmidi.exe, wmplayer.exe, as well as completely random ones such as 9a2de006.exe, 36c75e3c.exe and so on Source=Paul Collins Startup list [System Backup Services] Number=10528 Confirmed=X Filename=backups32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Boot Check] Number=10529 Confirmed=X Filename=sysload3.exe Description=Added by the FUBALCA WORM! Source=Paul Collins Startup list [System Buffer Application] Number=10530 Confirmed=X Filename=buffer32.exe Description=Added by the SDBOT-UD WORM! Source=Paul Collins Startup list [System Cache] Number=10531 Confirmed=X Filename=SysCache.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [System Check] Number=10532 Confirmed=U Filename=Rundll32.exe SysDll32.dll, SystemCheck Description=XPCSpy Pro keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [system check] Number=10533 Confirmed=X Filename=updater.exe Description=Unidentified adware downloader Source=Paul Collins Startup list [System Check] Number=10534 Confirmed=X Filename=win_klr32.exe Description=Added by the DELF-DRA WORM! Source=Paul Collins Startup list [System Checking] Number=10535 Confirmed=X Filename=wasul.exe Description=Added by the RBOT.BHM WORM! Source=Paul Collins Startup list [System Config] Number=10536 Confirmed=X Filename=BF3.EXE Description=Added by the SPYBOT-DT WORM! Source=Paul Collins Startup list [System Config Manager] Number=10537 Confirmed=X Filename=crss.exe Description=Added by the AGOBOT.GH WORM! Source=Paul Collins Startup list [System Config Manager] Number=10538 Confirmed=X Filename=smssl.exe Description=Added by the AGOBOT-ZJ WORM! Source=Paul Collins Startup list [System Configuration] Number=10539 Confirmed=X Filename=iexplore.exe Description=Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [System Configuration] Number=10540 Confirmed=X Filename=syscfg32.exe Description=Added by the MYTOB.EA WORM! Source=Paul Collins Startup list [system configure] Number=10541 Confirmed=X Filename=svchost.exe Description=Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [System CPL manager] Number=10542 Confirmed=X Filename=[random filename] Description=Added by the RBOT-SR WORM! Source=Paul Collins Startup list [System CSRSS Patch] Number=10543 Confirmed=X Filename=scrtkfg.exe Description=Added by the RBOT-ADA WORM! Source=Paul Collins Startup list [System Database administration] Number=10544 Confirmed=X Filename=systemDA.exe Description=Added by the DERDERO.B WORM! Source=Paul Collins Startup list [System Database Administration Support Process] Number=10545 Confirmed=X Filename=sysdasp.exe Description=Added by the DERDERO.C WORM! Source=Paul Collins Startup list [System Diagnostics] Number=10546 Confirmed=X Filename=sysdiag32.exe Description=Added by the SDBOT.GEN TROJAN! Source=Paul Collins Startup list [System DLF] Number=10547 Confirmed=N Filename=cpqdiaga.exe Description=Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs Source=Paul Collins Startup list [System DLL Resources] Number=10548 Confirmed=U Filename=sysdll.exe Description=SnapKey is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [System Document Application] Number=10549 Confirmed=X Filename=nmod.exe Description=Added by the SDBOT-ABB WORM! Source=Paul Collins Startup list [System Document Application] Number=10550 Confirmed=X Filename=msdocument.exe Description=Added by the RANDEX.COX WORM! Source=Paul Collins Startup list [System Document Application] Number=10551 Confirmed=X Filename=wins.exe Description=Added by the SDBOT.AUB WORM! Source=Paul Collins Startup list [System Download Manager] Number=10552 Confirmed=X Filename=SysMgr.exe Description=Added by the RBOT.CIG WORM! Source=Paul Collins Startup list [System driver] Number=10553 Confirmed=X Filename=Messenger.exe Description=Added by the WOOTBOT.GI WORM! Source=Paul Collins Startup list [System Drivers] Number=10554 Confirmed=X Filename=wingmt.exe Description=Added by the SDBOT-MG WORM! Source=Paul Collins Startup list [System Drivers] Number=10555 Confirmed=X Filename=cpsq32.exe Description=Added by the SDBOT.AXH WORM! Source=Paul Collins Startup list [System Efficiency Monitor] Number=10556 Confirmed=X Filename=mscedit32.exe Description=Added by the SDBOT.P TROJAN! Source=Paul Collins Startup list [System Efficiency Monitor] Number=10557 Confirmed=X Filename=mscommand.exe Description=Added by the KWBOT.P WORM! Source=Paul Collins Startup list [System Efficiency Monitor] Number=10558 Confirmed=X Filename=msedit32.exe Description=Added by the STEPH-B WORM! Source=Paul Collins Startup list [System Event Manager] Number=10559 Confirmed=X Filename=secsvc.exe Description=Added by the RBOT.BMY WORM! Source=Paul Collins Startup list [System Executable DLL Library] Number=10560 Confirmed=X Filename=EXECDLL32.exe Description=Added by the RANDEX.AZ WORM! Source=Paul Collins Startup list [System Failure Statistic] Number=10561 Confirmed=X Filename=cnstat.exe Description=Added by the RBOT-LF WORM! Source=Paul Collins Startup list [System File Drivers] Number=10562 Confirmed=X Filename=nvsysvc32.exe Description=Added by the AGOBOT.WJ WORM! Source=Paul Collins Startup list [system firewall] Number=10563 Confirmed=X Filename=makeini32.exe Description=Added by the AGOBOT-PS WORM! Source=Paul Collins Startup list [System Firewalls] Number=10564 Confirmed=X Filename=commandprompt32.exe Description=Added by the RBOT.BJT WORM! Source=Paul Collins Startup list [System Guard] Number=10565 Confirmed=X Filename=mhguard.exe Description=Added by the RBOT-AGU WORM! Source=Paul Collins Startup list [System Handler] Number=10566 Confirmed=X Filename=LSASS.EXE Description=Added by the NIMOS WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [system handler] Number=10567 Confirmed=X Filename=srvhandle.exe Description=Added by the REDPLUT VIRUS! Source=Paul Collins Startup list [System Host Manager] Number=10568 Confirmed=X Filename=syshost.exe Description=Added by the BANWORM-C WORM! Source=Paul Collins Startup list [System Host Service] Number=10569 Confirmed=X Filename=svchost.exe Description=Added by the CONE.F WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "tasks" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [System Information Manager] Number=10570 Confirmed=X Filename=Navcpe.exe Description=Added by the SDBOT-QB WORM! Source=Paul Collins Startup list [System Information Manager] Number=10571 Confirmed=X Filename=Msbb.exe Description=Added by a variant of the BACKDOOR.IRC.BOT TROJAN! Source=Paul Collins Startup list [System Initialization] Number=10572 Confirmed=X Filename=msmsgri32.exe Description=Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS! Source=Paul Collins Startup list [System Initialization] Number=10573 Confirmed=X Filename=payload.dat Description=Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS! Source=Paul Collins Startup list [System Kernal Support] Number=10574 Confirmed=X Filename=system.exe Description=Added by the SDBOT.BWV WORM! Source=Paul Collins Startup list [System Kernel] Number=10575 Confirmed=X Filename=lsass.exe Description=Added by the VBBOT-G TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [System LifeGuard Scheduler] Number=10576 Confirmed=U Filename=Slsched.exe Description=System LifeGuard scheduler Source=Paul Collins Startup list [System Log Event] Number=10577 Confirmed=X Filename=csrss32.exe Description=Added by the AGOBOT-JI WORM! Source=Paul Collins Startup list [System Management Service] Number=10578 Confirmed=X Filename=smsc.exe Description=Added by the RBOT-ANN WORM! Source=Paul Collins Startup list [System Manager] Number=10579 Confirmed=X Filename=svchost.exe Description=Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [system manager] Number=10580 Confirmed=X Filename=System.exe Description=Added by the FORBOT-BO WORM! Source=Paul Collins Startup list [System Manager] Number=10581 Confirmed=X Filename=winsrv32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [System Manager] Number=10582 Confirmed=X Filename=sysmng.exe Description=Added by the TAME-C WORM! Source=Paul Collins Startup list [System Manager Updates] Number=10583 Confirmed=X Filename=winsvc.exe Description=Added by the AGOBOT.AEM WORM! Source=Paul Collins Startup list [System Mechanic Popup Blocker] Number=10584 Confirmed=U Filename=PopupBlocker.exe Description=Popup blocker part of Iolo System Mechanic utility suite Source=Paul Collins Startup list [System Mechanic Popup Stopper] Number=10585 Confirmed=U Filename=Popupstopper.exe Description=Popup stopper part of Iolo System Mechanic utility suite Source=Paul Collins Startup list [System Mechanic Professional Update [Incinerator.dll]] Number=10586 Confirmed=N Filename=SysMech4.exe /REREG: [path] Incinerator.dll Description=Iolo System Mechanic "Incinerator" feature securely deletes files and folders from your PC so they can never be recovered again Source=Paul Collins Startup list [SYSTEM MESSAGER] Number=10587 Confirmed=X Filename=wmisg.exe Description=Added by the MYTOB.ES WORM! Source=Paul Collins Startup list [System Messaging Queue] Number=10588 Confirmed=X Filename=SMCSS.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Messenger] Number=10589 Confirmed=X Filename=SYSMSG32.EXE Description=Added by the SPYBOT-DK WORM! Source=Paul Collins Startup list [System Monitor] Number=10590 Confirmed=U Filename=SYSMON.EXE Description=Comes with some Aopen motherboards. Monitors CPU temp, voltage and fan speed. Warns if any become abnormal Source=Paul Collins Startup list [System Monitor] Number=10591 Confirmed=X Filename=Sysmon16.exe Description=Added by the SDBOT TROJAN! Source=Paul Collins Startup list [System MScvb] Number=10592 Confirmed=X Filename=mscvb32.exe Description=Added by the SOBIG.C WORM! Source=Paul Collins Startup list [System Net] Number=10593 Confirmed=X Filename=sys32.exe Description=Added by the FORBOT-FX WORM! Source=Paul Collins Startup list [System Net Database] Number=10594 Confirmed=X Filename=sysnd.exe Description=Added by the RBOT-AAW WORM! Source=Paul Collins Startup list [System Networking] Number=10595 Confirmed=X Filename=sysnet.exe Description=Added by the RBOT.API WORM! Source=Paul Collins Startup list [System Power Managment] Number=10596 Confirmed=X Filename=svcnost.exe Description=Added by the DREF-I WORM! Source=Paul Collins Startup list [System Process] Number=10597 Confirmed=X Filename=csrss.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [System Process] Number=10598 Confirmed=X Filename=lsass.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [System Process] Number=10599 Confirmed=X Filename=svchost.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [System Process] Number=10600 Confirmed=X Filename=CSRSR.exe Description=Added by the AGOBOT-SQ WORM! Source=Paul Collins Startup list [System Profile] Number=10601 Confirmed=X Filename=Regsrv.exe Description=Added by a variant of the OPTIX TROJAN! Source=Paul Collins Startup list [System Reboot] Number=10602 Confirmed=X Filename=rebootsys.exe Description=Added by the RBOT-WU WORM! Source=Paul Collins Startup list [System Redirect] Number=10603 Confirmed=X Filename=sysbho.exe Description=Downloader trojan, "Melkosoft" adware related Source=Paul Collins Startup list [System Restore] Number=10604 Confirmed=X Filename=svcnet.exe Description=Added by the TIBICK WORM! Source=Paul Collins Startup list [System Restore Data] Number=10605 Confirmed=X Filename=[path] repcale.exe [path] beird.exe Description=Added by the RANDON.AN WORM! Source=Paul Collins Startup list [System Service] Number=10606 Confirmed=X Filename=MSREXE.EXE Description=Added by the AML TROJAN! Source=Paul Collins Startup list [system service] Number=10607 Confirmed=X Filename=spoolcrv.cpl Description=Added by the INSPIR.11 TROJAN! Source=Paul Collins Startup list [System Service] Number=10608 Confirmed=X Filename=systems.exe Description=Added by the AGOBOT.VZ WORM! Source=Paul Collins Startup list [System Service] Number=10609 Confirmed=X Filename=coderxt.exe Description=Added by the RBOT-ALD WORM! Source=Paul Collins Startup list [System Service] Number=10610 Confirmed=X Filename=exp0lrer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Service] Number=10611 Confirmed=X Filename=servicent.exe Description=Added by the RBOT-AJI WORM! Source=Paul Collins Startup list [System service] Number=10612 Confirmed=X Filename=system.exe Description=Added by the BANCOS.AA TROJAN! Source=Paul Collins Startup list [System Service] Number=10613 Confirmed=X Filename=msnwindows.exe Description=Added by the SPYBOT.YCL WORM! Source=Paul Collins Startup list [System Service] Number=10614 Confirmed=X Filename=servicez.exe Description=Added by the RBOT-AOY WORM! Source=Paul Collins Startup list [System Service] Number=10615 Confirmed=X Filename=msnxpexe.exe Description=Added by the RBOT-AUA WORM! Source=Paul Collins Startup list [System Service] Number=10616 Confirmed=X Filename=teskmangr.exe Description=Added by the RBOT-AUV WORM! Source=Paul Collins Startup list [System Service] Number=10617 Confirmed=X Filename=backup.exe Description=Added by the PACKBOT.AA WORM! Source=Paul Collins Startup list [System Service] Number=10618 Confirmed=X Filename=serious.exe Description=Added by the RBOT-FMV WORM! Note - deactivates the Microsoft Internet Connection Firewall (ICF) Source=Paul Collins Startup list [SYSTEM service helper] Number=10619 Confirmed=X Filename=svchelper.exe Description=Added by the MONKBD-A WORM! Source=Paul Collins Startup list [SYSTEM service helper] Number=10620 Confirmed=X Filename=syshelp.exe Description=Added by a variant of the MONKBD-A WORM! Source=Paul Collins Startup list [System service**] Number=10621 Confirmed=X Filename=pokapoka**.exe Description=EliteBar adware - where ** represents the numbers 61 to 79 Source=Paul Collins Startup list [System service62] Number=10622 Confirmed=X Filename=System service62 Description=pokapoka62.exe Source=Paul Collins Startup list [System service78] Number=10623 Confirmed=X Filename=[path to file] Description=Added by the ELITEBAR-T and ELITEBAR-U TROJANS! Source=Paul Collins Startup list [System service79] Number=10624 Confirmed=X Filename=[path to file] Description=Added by the ELITEBAR-V TROJAN! Source=Paul Collins Startup list [System Services] Number=10625 Confirmed=X Filename=[random file name] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Services] Number=10626 Confirmed=X Filename=connection.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [System Services] Number=10627 Confirmed=X Filename=svcsenes.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Services] Number=10628 Confirmed=X Filename=svcsenes32a.exe Description=Added by the RBOT-AFG WORM! Source=Paul Collins Startup list [System Services] Number=10629 Confirmed=X Filename=ssms.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Session Manager] Number=10630 Confirmed=X Filename=smss.exe Description=Added by the KALEL-E WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [System settings] Number=10631 Confirmed=X Filename=burndl32.exe Description=Added by the SDBOT-ZO WORM! Source=Paul Collins Startup list [System Setup] Number=10632 Confirmed=X Filename=rpcxcmod.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [System Soap Pro] Number=10633 Confirmed=X Filename=soap.exe Description=System Soap Pro internet cleaning software. Bundles foistware like Httper and Zipclix - best avoided Source=Paul Collins Startup list [system spool] Number=10634 Confirmed=X Filename=syspools.exe Description=Added by the DREF-T WORM/VIRUS! Source=Paul Collins Startup list [System startup] Number=10635 Confirmed=U Filename=charmapx.exe Description=Only required if using an oriental language Source=Paul Collins Startup list [System Startup] Number=10636 Confirmed=X Filename=Voltio.exe Description=Added by the RBOT.NJ WORM! Source=Paul Collins Startup list [System Startup] Number=10637 Confirmed=X Filename=kimochi.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Startup Manager] Number=10638 Confirmed=X Filename=smcss.exe Description=Added by the RBOT.AMD WORM! Source=Paul Collins Startup list [System Stats] Number=10639 Confirmed=X Filename=SystemStats.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [System Support] Number=10640 Confirmed=X Filename=syscfg.exe Description=Added by the RBOT-AGQ WORM! Source=Paul Collins Startup list [System Support] Number=10641 Confirmed=X Filename=system32.exe Description=Added by the RBOT-AHA WORM! Source=Paul Collins Startup list [System Support] Number=10642 Confirmed=X Filename=syssql.exe Description=Added by the RBOT-AUH WORM! Source=Paul Collins Startup list [System Support] Number=10643 Confirmed=X Filename=torrent.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Terminal] Number=10644 Confirmed=X Filename=SYSTEM2.EXE Description=Added by the SPYBOT-BZ TROJAN! Source=Paul Collins Startup list [System time updator] Number=10645 Confirmed=X Filename=CSysTime.exe Description=Added by the RANDEX.S WORM! Source=Paul Collins Startup list [System Toolkit] Number=10646 Confirmed=X Filename=Systools.exe Description=Added by the RONOPER-G WORM! Source=Paul Collins Startup list [System Tray] Number=10647 Confirmed=X Filename=msccn32.exe Description=Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com! Note - this is not the legitimate systray.exe process Source=Paul Collins Startup list [System Tray] Number=10648 Confirmed=X Filename=systray.exe Description=Added by the FAN-A WORM! Source=Paul Collins Startup list [System Tray Services] Number=10649 Confirmed=X Filename=spooles32.exe Description=Added by the AGOBOT.ZH WORM! Source=Paul Collins Startup list [System Tray32] Number=10650 Confirmed=X Filename=SysTray32.exe Description=Added by the REPAD WORM! Source=Paul Collins Startup list [System Unix] Number=10651 Confirmed=X Filename=syscfg32.exe Description=Added by the RBOT-ZD WORM! Source=Paul Collins Startup list [system updata] Number=10652 Confirmed=X Filename=updata.exe Description=Added by the LINEAGE-C TROJAN! Source=Paul Collins Startup list [System Update] Number=10653 Confirmed=X Filename=[filename].exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [System Update] Number=10654 Confirmed=X Filename=[random filename] Description=Added by the KORGO.W or KORGO.X WORMS! Source=Paul Collins Startup list [System Update] Number=10655 Confirmed=X Filename=wupdmgr.exe Description=Added by the SOROMO-A TROJAN! Source=Paul Collins Startup list [System Update] Number=10656 Confirmed=X Filename=[random filename] Description=Added by the SOROMO-A TROJAN! Source=Paul Collins Startup list [System Update] Number=10657 Confirmed=X Filename=wauluclt.exe Description=Added by the SDBOT.EF WORM! Source=Paul Collins Startup list [System Update] Number=10658 Confirmed=X Filename=[path to trojan] Description=Added by the AUTOTROJ-D TROJAN! Source=Paul Collins Startup list [System Update] Number=10659 Confirmed=X Filename=mssetupconf.exe Description=Added by the RBOT.DLC WORM! Source=Paul Collins Startup list [System Update Application] Number=10660 Confirmed=Y Filename=msbuffer.exe Description=Added by the SDBOT.AFF WORM! Source=Paul Collins Startup list [System Update Service] Number=10661 Confirmed=X Filename=wmiprvsa.exe Description=Added by the AGOBOT-RG TROJAN! Source=Paul Collins Startup list [System Update Service] Number=10662 Confirmed=X Filename=winupd32.exe Description=Added by the ADTODA-A TROJAN! Source=Paul Collins Startup list [System Update Service] Number=10663 Confirmed=X Filename=system.pif Description=Added by the RBOT-ALL WORM! Source=Paul Collins Startup list [System Update Service] Number=10664 Confirmed=X Filename=update.pif Description=Added by the SPYBOT.WOE WORM! Source=Paul Collins Startup list [System Update2] Number=10665 Confirmed=X Filename=explorer.exe Description=Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [System Update2] Number=10666 Confirmed=X Filename=services.exe Description=Added by the AUTOTROJ-C TROJAN!Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [System Update2] Number=10667 Confirmed=X Filename=svchost.exe Description=Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [System Update2] Number=10668 Confirmed=X Filename=system.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10669 Confirmed=X Filename=taskman.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10670 Confirmed=X Filename=taskmon.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10671 Confirmed=X Filename=update.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10672 Confirmed=X Filename=webcheck.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10673 Confirmed=X Filename=wininet.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10674 Confirmed=X Filename=winlogon.exe Description=Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [System Update2] Number=10675 Confirmed=X Filename=winspool.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Update2] Number=10676 Confirmed=X Filename=wupdmgr.exe Description=Added by the AUTOTROJ-C TROJAN! Source=Paul Collins Startup list [System Updater Service] Number=10677 Confirmed=X Filename=wmiprvsw.exe Description=Added by the GAOBOT.AFC WORM! Source=Paul Collins Startup list [System Updates] Number=10678 Confirmed=X Filename=winsci.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System Updates] Number=10679 Confirmed=X Filename=szwi.exe Description=Added by the RBOT-AXE WORM! Source=Paul Collins Startup list [System Updates] Number=10680 Confirmed=U Filename=unve.exe Description=Added by the RBOT-AWG TROJAN! Source=Paul Collins Startup list [System Updates] Number=10681 Confirmed=X Filename=wmkl.exe Description=Added by the RBOT-AYJ WORM! Source=Paul Collins Startup list [System Updates 4] Number=10682 Confirmed=X Filename=mssysfix.exe Description=Added by the RBOT-ADU WORM! Source=Paul Collins Startup list [System Updates Manager] Number=10683 Confirmed=X Filename=winserv32.exe Description=Added by the AGOBOT-AGA WORM! Source=Paul Collins Startup list [System Updates Service] Number=10684 Confirmed=X Filename=updates.pif Description=Added by the RBOT-AMA WORM! Source=Paul Collins Startup list [System Uptime Server] Number=10685 Confirmed=X Filename=SYSENTRY.EXE Description=Added by the RBOT.LK WORM! Source=Paul Collins Startup list [System Uptime Server] Number=10686 Confirmed=X Filename=SYSENTRY32.EXE Description=Added by the RBOT.LK WORM! Source=Paul Collins Startup list [system xp] Number=10687 Confirmed=X Filename=acdsee demo.exe Description=Added by the SALGA.A WORM! Source=Paul Collins Startup list [System-Config] Number=10688 Confirmed=X Filename=msptmf32.com Description=Added by the LIOTEN.FA WORM! Source=Paul Collins Startup list [System-Service] Number=10689 Confirmed=X Filename=EXPLORER.SCR Description=Added by the BENJAMIN.A WORM! KaZaA file-sharing users beware! Source=Paul Collins Startup list [System-Stat] Number=10690 Confirmed=X Filename=systats.exe Description=Added by the SDBOT.RA WORM! Source=Paul Collins Startup list [system.] Number=10691 Confirmed=X Filename=system..exe Description=Added by the OPTIXPRO.13.C TROJAN! Source=Paul Collins Startup list [system...] Number=10692 Confirmed=X Filename=system...exe Description=Added by the OPTIXPRO.13.C TROJAN! Source=Paul Collins Startup list [System.exe] Number=10693 Confirmed=X Filename=System.exe Description=Added by various WORMS and TROJANS! Source=Paul Collins Startup list [System132] Number=10694 Confirmed=X Filename=Csrtss.exe Description=Added by the LANFILT-I TROJAN! Source=Paul Collins Startup list [system23] Number=10695 Confirmed=X Filename=notPad.exe Description=Added by the ESTEEMS.D TROJAN! Source=Paul Collins Startup list [System32] Number=10696 Confirmed=X Filename=system.exe Description=Added by the BUSHTRO122 TROJAN! Source=Paul Collins Startup list [System32] Number=10697 Confirmed=X Filename=System32.exe Description=Added by any number of WORMS or TROJANS! Source=Paul Collins Startup list [System32] Number=10698 Confirmed=U Filename=sysdiag.exe Description=SpyAgent surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [System32] Number=10699 Confirmed=X Filename=system32,1.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [system32] Number=10700 Confirmed=X Filename=NeT-BoT.exe Description=Added by the AGOBOT-LJ WORM! Source=Paul Collins Startup list [System32] Number=10701 Confirmed=X Filename=lsasss.exe Description=Added by the RBOT-XW WORM! Source=Paul Collins Startup list [System32] Number=10702 Confirmed=X Filename=crsvvc.exe Description=Added by the RBOT.BLY WORM! Source=Paul Collins Startup list [system32] Number=10703 Confirmed=X Filename=QQGame.exe Description=Added by the QQPASS-AC TROJAN! Source=Paul Collins Startup list [System32] Number=10704 Confirmed=X Filename=[worm filename] Description=Added by the NAUTICAL-A TROJAN! Source=Paul Collins Startup list [System32 PCI Manager] Number=10705 Confirmed=X Filename=syspci32.exe Description=Added by the RBOT-AFR WORM! Source=Paul Collins Startup list [System32 PCI Manager] Number=10706 Confirmed=X Filename=syspci32.exe Description=Added by the RBOT-AFR WORM! Source=Paul Collins Startup list [System32 TCP Manager] Number=10707 Confirmed=X Filename=systcpm.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [System32 TCP Manager] Number=10708 Confirmed=X Filename=systerm.exe Description=Added by the RBOT.AFD WORM! Source=Paul Collins Startup list [System32 Temp Service] Number=10709 Confirmed=X Filename=systmp.exe Description=Added by the RBOT-AET WORM! Source=Paul Collins Startup list [system32.dll] Number=10710 Confirmed=X Filename=systeminit.exe Description=CoolWebSearch parasite variant - re-directing to your-search.info Source=Paul Collins Startup list [system32.dll] Number=10711 Confirmed=X Filename=sysdll32.exe Description=CoolWebSearch parasite variant. Redirecting to wholeworldmarket.com, most likely other domains as well Source=Paul Collins Startup list [system32.exe] Number=10712 Confirmed=X Filename=services32.exe Description=Added by a variant of the BACKDOOR.IRC.BOT TROJAN! Source=Paul Collins Startup list [system32.exe] Number=10713 Confirmed=X Filename=system32.exe Description=Added by the GRAYBIRD.P TROJAN! Source=Paul Collins Startup list [System32Check] Number=10714 Confirmed=X Filename=[random].exe Description=Added by the CHAST-A TROJAN! Source=Paul Collins Startup list [System32Dll] Number=10715 Confirmed=X Filename=DLL32SYS.EXE Description=Added by the SPYBOT-CZ WORM! Source=Paul Collins Startup list [System32Ex] Number=10716 Confirmed=X Filename=System32Ex.exe Description=Added by the IRCCONTACT TROJAN! Source=Paul Collins Startup list [System32kfvw�] Number=10717 Confirmed=U Filename=sysdiag.exe Description=SpyAgent surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [System33] Number=10718 Confirmed=X Filename=FB_PNU.EXE Description=Added by the NICHELLO-A WORM! Source=Paul Collins Startup list [system34.exe] Number=10719 Confirmed=X Filename=system34.exe Description=Added by the DWNLDR-FXY TROJAN! Source=Paul Collins Startup list [System4224411] Number=10720 Confirmed=X Filename=Virus Description=Added by the CAGER.A WORM! Source=Paul Collins Startup list [System4224411] Number=10721 Confirmed=X Filename=Systemdll.exe Description=Added by the YUSUFALI-B WORM! Source=Paul Collins Startup list [system43.exe] Number=10722 Confirmed=X Filename=system43.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [System64] Number=10723 Confirmed=X Filename=inet.exe Description=Added by the DENGLE-A TROJAN! Source=Paul Collins Startup list [SystemAdministration] Number=10724 Confirmed=X Filename=Wincmp32.exe Description=Added by the ASYLUM TROJAN! Source=Paul Collins Startup list [SystemAgent] Number=10725 Confirmed=U Filename=Sage.exe Description="Microsoft Plus! System Agent automatically tunes your system, performing tasks such as disk optimization and error correction. It can also run any application at prescheduled times" Source=Paul Collins Startup list [SystemB] Number=10726 Confirmed=X Filename=MessengerStopper.exe Description=MessStopper adware Source=Paul Collins Startup list [SystemBackup] Number=10727 Confirmed=X Filename=mtx.exe Description=Added by the MTX VIRUS/WORM! Source=Paul Collins Startup list [SystemBackup] Number=10728 Confirmed=X Filename=MicroLog.exe Description=Added by the MICROLOG.A TROJAN! Source=Paul Collins Startup list [SystemBoot] Number=10729 Confirmed=? Filename=ladies.htm Description=Unknown but sounds very suspicious?? Source=Paul Collins Startup list [SystemBoot] Number=10730 Confirmed=X Filename=Mshta.exe ...filename.hta Description=Adult content dialler Source=Paul Collins Startup list [Systemboot] Number=10731 Confirmed=X Filename=msnsngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SystemCheck] Number=10732 Confirmed=X Filename=Systemcheck.exe Description=Added by the LAVITS WORM! Source=Paul Collins Startup list [SystemCheck] Number=10733 Confirmed=X Filename=services.exe Description=Added by the SOBER-M WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Config\system subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [SystemCheck] Number=10734 Confirmed=X Filename=svchost.exe Description=Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:\DriverLoad folder Source=Paul Collins Startup list [SystemCheck] Number=10735 Confirmed=X Filename=SysCheckBop32.exe Description=WINBO adware Source=Paul Collins Startup list [SystemChecker] Number=10736 Confirmed=X Filename=Syschk.exe Description=Added by the GALIL.F WORM! Source=Paul Collins Startup list [SystemCONF98i] Number=10737 Confirmed=X Filename=SystemCONF98i.exe Description=Added by the GLITCH TROJAN! Source=Paul Collins Startup list [SystemDebug] Number=10738 Confirmed=X Filename=Sysdeb32.exe Description=Added by the SYSBUG TROJAN! Source=Paul Collins Startup list [SystemDll] Number=10739 Confirmed=X Filename=SystemDll.exe Description=Added by the LOXOSCAM TROJAN! Source=Paul Collins Startup list [systemdll32.exe] Number=10740 Confirmed=X Filename=systemdll32.exe Description=Added by the FEUTEL-F TROJAN! Source=Paul Collins Startup list [SystemDoctor 2006 Free] Number=10741 Confirmed=N Filename=sd2006.exe Description=SystemDoctor is a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [SystemDriver] Number=10742 Confirmed=X Filename=csrss.exe Description=Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a \addins\explorer subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [SystemDriverCheck] Number=10743 Confirmed=X Filename=svchost.exe Description=Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:\DriverLoad folder Source=Paul Collins Startup list [SystemDriverLoad] Number=10744 Confirmed=X Filename=svchost.exe Description=Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a C:\DriverLoad folder Source=Paul Collins Startup list [systemdrv] Number=10745 Confirmed=X Filename=ms32sys.exe Description=Added by an unidentified WORM or TROJAN - most likely GAOBOT variant Source=Paul Collins Startup list [SystemEmergency] Number=10746 Confirmed=X Filename=[various filenames] Description=CoolWebSearch Smartsearch parasite variant Source=Paul Collins Startup list [SystemExplorer] Number=10747 Confirmed=X Filename=explore.exe Description=Homepage hijacker - file located in the "Services" folder in Common Files Source=Paul Collins Startup list [SystemFile] Number=10748 Confirmed=X Filename=SystemFile.exe Description=Added by the DULLDOOR-A TROJAN! Source=Paul Collins Startup list [SystemFTP] Number=10749 Confirmed=X Filename=VSENMB.exe Description=Malware (ie, malicious software). Also changes the system.ini Shell line to read Shell=Explorer.exe VSENMB.exe, and it hacks the Winstart.bat as well Source=Paul Collins Startup list [SystemGent] Number=10750 Confirmed=X Filename=CVT.exe Description=Added by the BRONTOK-H WORM! Source=Paul Collins Startup list [SystemGuardAlerter] Number=10751 Confirmed=? Filename=SystemGuardAlerter.exe Description=Part of the Iolo System Mechanic maintenance software. What does it do? Source=Paul Collins Startup list [SystemInit] Number=10752 Confirmed=X Filename=iservc.exe Description=Added by the FIZZER WORM! Source=Paul Collins Startup list [Systemiom Updater] Number=10753 Confirmed=X Filename=Systemiom.exe Description=Added by the SPYBOT.TY WORM! Source=Paul Collins Startup list [SystemKey] Number=10754 Confirmed=U Filename=rundll32.exe [path] SystemKey.dll rdl Description=Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SystemLoad32] Number=10755 Confirmed=X Filename=sysload32.exe Description=Added by the MIMAIL.E WORM! Source=Paul Collins Startup list [SystemManager] Number=10756 Confirmed=X Filename=Sysman32.exe Description=Added by the DOWNLOADER-BW.B TROJAN! Source=Paul Collins Startup list [SystemMap32] Number=10757 Confirmed=X Filename=Netisp32.vbs Description=Added by the REDIST.C WORM! Source=Paul Collins Startup list [SystemMD] Number=10758 Confirmed=X Filename=md.exe Description=Homepage hijacker Source=Paul Collins Startup list [SystemMgr] Number=10759 Confirmed=X Filename=Ir32_a.exe Description=Added by the MAGANIA-OU TROJAN! Source=Paul Collins Startup list [SystemMonitor] Number=10760 Confirmed=X Filename=Sysmon32.exe Description=Added by the AIDID.A WORM! Source=Paul Collins Startup list [SystemNetwork] Number=10761 Confirmed=X Filename=NETSERV.EXE Description=Added by the NETCONTROL VIRUS! Source=Paul Collins Startup list [SystemNetwork] Number=10762 Confirmed=X Filename=sysnet.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SystemNT] Number=10763 Confirmed=X Filename=SystemNT.exe Description=Added by the PWSVB-EG TROJAN! Source=Paul Collins Startup list [SystemProcEvent] Number=10764 Confirmed=X Filename=csrwnd.exe Description=Added by the IRCBOT.I TROJAN! Source=Paul Collins Startup list [systemr] Number=10765 Confirmed=X Filename=d11host.exe Description=Added by the GX TROJAN! Source=Paul Collins Startup list [systemr] Number=10766 Confirmed=X Filename=gedit.exe Description=Added by the ADCLICK-AQ TROJAN! Source=Paul Collins Startup list [SystemReg] Number=10767 Confirmed=? Filename=PROCES.EXE Description=?? Source=Paul Collins Startup list [SystemReg] Number=10768 Confirmed=X Filename=svchost.exe Description=Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [SystemReg] Number=10769 Confirmed=X Filename=WINREG.EXE Description=Added by the DEWIN.A TROJAN! Source=Paul Collins Startup list [Systems] Number=10770 Confirmed=X Filename=scchost.exe Description=Added by the DAEMOZ.A TROJAN! Source=Paul Collins Startup list [Systems] Number=10771 Confirmed=X Filename=svch0st.exe Description=Added by the MYDOOM.BI WORM! Source=Paul Collins Startup list [Systems] Number=10772 Confirmed=X Filename=Systems.exe Description=Added by the BANKBOA-A TROJAN! Source=Paul Collins Startup list [Systems] Number=10773 Confirmed=X Filename=itDDD.exe Description=Added by the DLOADER-PP TROJAN! Source=Paul Collins Startup list [Systems] Number=10774 Confirmed=X Filename=sescmgr.exe Description=Added by the DWNLDR-GAH TROJAN! Source=Paul Collins Startup list [Systems] Number=10775 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADR-SW TROJAN! Source=Paul Collins Startup list [Systems] Number=10776 Confirmed=X Filename=sysmon.exe Description=Added by the VIXUP-BI WORM! Source=Paul Collins Startup list [Systems Backups] Number=10777 Confirmed=X Filename=windrives.exe Description=Added by the AGOBOT-RB WORM! Source=Paul Collins Startup list [Systems Restart] Number=10778 Confirmed=X Filename=slchost.exe Description=Added by the MULTIDROP.C TROJAN! Source=Paul Collins Startup list [Systems Restart] Number=10779 Confirmed=X Filename=spchost.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Systems Restart] Number=10780 Confirmed=X Filename=Rundll32.exe beem.dll, DllRegisterServer Description=Browser hijacker - the file serves to register a dll implemented as a browser plugin Source=Paul Collins Startup list [Systems Restart] Number=10781 Confirmed=X Filename=Rundll32.exe snim.dll, DllRegisterServer Description=Added by the Startpage.I hijacker Source=Paul Collins Startup list [Systems Restart] Number=10782 Confirmed=X Filename=Rundll32.exe zolk.dll, DllRegisterServer Description=Added by a variant of the STARTPAGE.J TROJAN! Source=Paul Collins Startup list [Systems.exe] Number=10783 Confirmed=U Filename=Systems.exe Description=Keyboard Spectator - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [systems.exe] Number=10784 Confirmed=U Filename=systems.exe Description=KGBSpy is a commercial surveillance software program. It logs keystrokes, Web sites visited, and clipboard activity. It also has a screen capture logger and can be run automatically in a silent, undetectable mode Source=Paul Collins Startup list [SystemSafe] Number=10785 Confirmed=U Filename=Syssafe.exe Description=System Safety Monitor - system monitoring tool with additional application firewalling Source=Paul Collins Startup list [SYSTEMSars32] Number=10786 Confirmed=X Filename=csrss.exe Description=Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [SystemSAS] Number=10787 Confirmed=X Filename=System32.exe Description=Added by the KWBOT.C WORM! Source=Paul Collins Startup list [systemscroot] Number=10788 Confirmed=X Filename=systembin.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [SystemSearch] Number=10789 Confirmed=X Filename=regedit.exe -s c:\ie.reg Description=Installs a Seachxl.com browser page hijack Source=Paul Collins Startup list [SystemSearch] Number=10790 Confirmed=X Filename=regedit.exe -s c:\sys.reg Description=Installs a i--search.com browser page hijack Source=Paul Collins Startup list [SystemService] Number=10791 Confirmed=X Filename=msocfg.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SystemService] Number=10792 Confirmed=X Filename=navchk.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SystemService] Number=10793 Confirmed=X Filename=qservice.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SystemService] Number=10794 Confirmed=X Filename=shman.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [SystemService] Number=10795 Confirmed=U Filename=nsserver.exe Description=NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [SystemSettingf] Number=10796 Confirmed=X Filename=TRUG.vbs Description=Added by the TRUG.B MACRO! Source=Paul Collins Startup list [SystemSuite Task Manager] Number=10797 Confirmed=U Filename=MXTASK.EXE Description=vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro Source=Paul Collins Startup list [SystemTasks] Number=10798 Confirmed=X Filename=filez.exe Description=Adult content dialler Source=Paul Collins Startup list [SystemTasks] Number=10799 Confirmed=X Filename=sexypicz.exe Description=Adult content dialler Source=Paul Collins Startup list [SystemTasks] Number=10800 Confirmed=X Filename=loaded.exe Description=Adult content dialler Source=Paul Collins Startup list [SystemTools] Number=10801 Confirmed=X Filename=kernels32.exe Description=Added by the DLOADER-FC TROJAN! Source=Paul Collins Startup list [SystemTools] Number=10802 Confirmed=X Filename=kernels1118.exe Description=Added by the SMALL.DGK TROJAN! Source=Paul Collins Startup list [SystemTools] Number=10803 Confirmed=X Filename=kernels8.exe Description=Added by the FNG TROJAN! Source=Paul Collins Startup list [SystemTools] Number=10804 Confirmed=X Filename=kernels88.exe Description=Added by the TIBS-PP TROJAN! Source=Paul Collins Startup list [Systemtra] Number=10805 Confirmed=X Filename=Systra.exe Description=Added by the LOVGATE-W WORM! Source=Paul Collins Startup list [SystemTra] Number=10806 Confirmed=X Filename=CDPlay.EXE Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [SystemTray] Number=10807 Confirmed=U Filename=SysTray.Exe Description=SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [SystemTray] Number=10808 Confirmed=X Filename=SystemTray.exe Description=Added by the BIGFOOT TROJAN! Note - this is not the legitimate systray.exe process Source=Paul Collins Startup list [SystemTray] Number=10809 Confirmed=X Filename=SysTray.exe Description=Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the "Properties" reveal it to be a Microsoft file Source=Paul Collins Startup list [SystemTraySD] Number=10810 Confirmed=U Filename=SDSystemTray.exe Description=Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Source=Paul Collins Startup list [SystemTraySR] Number=10811 Confirmed=U Filename=SRSystemTray.exe Description=Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here Source=Paul Collins Startup list [SystemUpd] Number=10812 Confirmed=N Filename=SystemUpd.exe Description=Updater for Swapoo.com, a kind of Napster for games Source=Paul Collins Startup list [SystemWideHook for Windows NT] Number=10813 Confirmed=X Filename=%WinHook32.exe Description=Added by the MYDOOM.AC WORM! Source=Paul Collins Startup list [SystemWizard Sniffer] Number=10814 Confirmed=U Filename=Sniffer.exe Description=SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC Source=Paul Collins Startup list [systemyom Updater] Number=10815 Confirmed=X Filename=systemyom.exe Description=Added by a variant of the BACKDOOR.IRC.BOT TROJAN! Source=Paul Collins Startup list [SYSTEMZ Patch] Number=10816 Confirmed=X Filename=SYSZ.exe Description=Added by the ALADINZ.P TROJAN! Source=Paul Collins Startup list [System_Messages] Number=10817 Confirmed=U Filename=pprsen.exe Description=TerminatorX - "offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA, messenger programs, chat rooms and the like" Source=Paul Collins Startup list [systen32.exe] Number=10818 Confirmed=X Filename=systen32.exe Description=Added by the AQP TROJAN! Source=Paul Collins Startup list [Systes] Number=10819 Confirmed=X Filename=jrdtifkkxbbsa.exe Description=Added by the RBOT-ADC WORM! Source=Paul Collins Startup list [Systesms.exe] Number=10820 Confirmed=X Filename=systesms.exe Description=Added by the RBOT-HI WORM! Source=Paul Collins Startup list [Systest] Number=10821 Confirmed=U Filename=Systest.exe Description=Clean Space internet evidence eliminator Source=Paul Collins Startup list [systhread] Number=10822 Confirmed=X Filename=winkernal.exe Description=Added by the LIAMED WORM! Source=Paul Collins Startup list [SysTime] Number=10823 Confirmed=X Filename=systime.exe Description=CoolWebSearch parasite variant - also detected as the STARTPA-FL TROJAN! Source=Paul Collins Startup list [Systmesy] Number=10824 Confirmed=X Filename=Systmesy.exe Description=Added by the RBOT-KQ WORM! Source=Paul Collins Startup list [Systoan32] Number=10825 Confirmed=X Filename=systoan.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [systr] Number=10826 Confirmed=X Filename=SYSERVER.exe Description=Added by the VB-DQY WORM! Source=Paul Collins Startup list [systr2] Number=10827 Confirmed=X Filename=SERVICE.exe Description=Added by the VB-DQY WORM! Source=Paul Collins Startup list [systr32] Number=10828 Confirmed=? Filename=systr32.exe Description=?? Source=Paul Collins Startup list [systrans] Number=10829 Confirmed=X Filename=[path to trojan] Description=Added by the STARTPA-GZ TROJAN! Source=Paul Collins Startup list [systrax] Number=10830 Confirmed=? Filename=systrax.exe Description=?? Source=Paul Collins Startup list [Systray] Number=10831 Confirmed=X Filename=Systray_.Exe Description=Added by the KERGEZ.A WORM! Source=Paul Collins Startup list [Systray] Number=10832 Confirmed=X Filename=[filename.exe] Description=Winfavorites adware Source=Paul Collins Startup list [SYSTRAY] Number=10833 Confirmed=X Filename=UNMT.EXE Description=Added by the DLOADER-LQ TROJAN! Source=Paul Collins Startup list [SysTray] Number=10834 Confirmed=U Filename=SysTray.Exe Description=SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [SysTray] Number=10835 Confirmed=X Filename=Snnpapi.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Systray] Number=10836 Confirmed=X Filename=w32explorer.exe Description=Added by the RBOT-AJY WORM! Source=Paul Collins Startup list [Systray] Number=10837 Confirmed=X Filename=SteFanie.vbs Description=Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders Source=Paul Collins Startup list [Systray] Number=10838 Confirmed=X Filename=KAT.vbs Description=Added by the SOAD-D WORM! Source=Paul Collins Startup list [SysTray] Number=10839 Confirmed=X Filename=svhost.exe Description=Added by the RAJILO-A WORM! Source=Paul Collins Startup list [Systray driver] Number=10840 Confirmed=X Filename=systray.exe Description=Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process Source=Paul Collins Startup list [SystrayServices] Number=10841 Confirmed=X Filename=Msxpw.exe Description=Added by the CITOR WORM! Source=Paul Collins Startup list [systree] Number=10842 Confirmed=X Filename=systree Description=Added by the BANCOS.L TROJAN! Source=Paul Collins Startup list [Systrsy] Number=10843 Confirmed=X Filename=Systrsy.exe Description=Added by the CDTRAY TROJAN! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Systry] Number=10844 Confirmed=X Filename=[path to worm] Description=Added by the AUTEX WORM! Source=Paul Collins Startup list [SYStry] Number=10845 Confirmed=X Filename=spoolsvr.exe Description=Added by the SDBOT.GN WORM! Source=Paul Collins Startup list [Systryt] Number=10846 Confirmed=X Filename=[path to worm] Description=Added by the AUTEX WORM! Source=Paul Collins Startup list [SystUphes] Number=10847 Confirmed=X Filename=algesetp.exe Description=Added by the QQPASS-AM TROJAN! Source=Paul Collins Startup list [Systweak Ad and Popup Blocker] Number=10848 Confirmed=U Filename=adblock.exe Description=Ad and popup blocker part of Advanced System Optimizer from Systweak Source=Paul Collins Startup list [Systweak Memory Optimizer] Number=10849 Confirmed=U Filename=memtuneup.exe Description=Part of SysTweak Advanced System Optimizer Source=Paul Collins Startup list [sysu] Number=10850 Confirmed=X Filename=sysu.exe Description=Dynamic Desktop Media adware - see here Source=Paul Collins Startup list [sysug32.exe] Number=10851 Confirmed=X Filename=sysug32.exe Description=Added by an unidentified TROJAN or WORM! Source=Paul Collins Startup list [SysUpd] Number=10852 Confirmed=X Filename=Sysupd.exe Description=VirtuMonde adware Source=Paul Collins Startup list [sysupdate] Number=10853 Confirmed=X Filename=cmman32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Sysvupex] Number=10854 Confirmed=X Filename=Sysvupex.exe Description=Added by the MEDIAS TROJAN! Source=Paul Collins Startup list [sysvx] Number=10855 Confirmed=X Filename=sysvx_.exe Description=Added by the LOOSKY-BX TROJAN! Source=Paul Collins Startup list [SysW8] Number=10856 Confirmed=U Filename=csta.exe Description=Clean Space internet evidence eliminator Source=Paul Collins Startup list [SYSWB6] Number=10857 Confirmed=U Filename=SYSWB6.exe Description=Part of We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content, while filtering out sites that contain adult content. Works in conjunction with Winkb6 and both files are needed to run We-Blocker Source=Paul Collins Startup list [SysWin] Number=10858 Confirmed=X Filename=SysWin.exe Description=Added by the IRCCONTACT TROJAN! Source=Paul Collins Startup list [syswin] Number=10859 Confirmed=X Filename=v6.exe Description=Added by the AGENT-ECM TROJAN! Source=Paul Collins Startup list [syswin32] Number=10860 Confirmed=X Filename=syswin32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Syswindow] Number=10861 Confirmed=X Filename=Syswindow.exe Description=Added by the COW TROJAN! Source=Paul Collins Startup list [SysWy] Number=10862 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAGE-JH TROJAN! Note - this file is found in the C:\Windows\System folder, and is not to be confused with the legitimate rundll32.exe file, always located in the Windows folder on Win98/ME systems, and in the Winnt\System32 or Windows\System32 folder in WinXP/NT/2K! Source=Paul Collins Startup list [sysX3] Number=10863 Confirmed=X Filename=sys22.exe Description=Added by the RANTS.C WORM! Source=Paul Collins Startup list [sysygm32] Number=10864 Confirmed=X Filename=syscxd32.exe Description=Added by the IRCBOT-PC TROJAN! Source=Paul Collins Startup list [sysygm64] Number=10865 Confirmed=X Filename=winrxd64.exe Description=Added by the IRCBOT-RK TROJAN! Source=Paul Collins Startup list [SYS_CLEAN] Number=10866 Confirmed=X Filename=Service.exe Description=Added by the FLOPCOPY WORM! Source=Paul Collins Startup list [Sys_Run] Number=10867 Confirmed=X Filename=ghost.exe Description=Added by the LINEAGE-N TROJAN! Source=Paul Collins Startup list [sys_Runtt1] Number=10868 Confirmed=X Filename=explorer.exe Description=Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder Source=Paul Collins Startup list [SyztMy] Number=10869 Confirmed=X Filename=expiorer.exe Description=Added by the LINEAG-AIN TROJAN! Source=Paul Collins Startup list [SZMsgSvc.exe] Number=10870 Confirmed=U Filename=SZMsgSvc.exe Description=StopZilla! - pop-up killer Source=Paul Collins Startup list [t] Number=10871 Confirmed=X Filename=xclean.exe Description=FlashEnhancer adware Source=Paul Collins Startup list [T-DSL SpeedMgr] Number=10872 Confirmed=N Filename=speedmgr.exe Description=T-Online ISP SpeedManager - shows upload and download speed. Also checks for updates automatically Source=Paul Collins Startup list [T3Console] Number=10873 Confirmed=U Filename=T3Console.exe Description=Related to T3 Security Suite - prevents unauthorized or inappropriate access to your PC and data Source=Paul Collins Startup list [Taakcontrole] Number=10874 Confirmed=U Filename=taskmon.exe Description=Task Monitor (on Dutch language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase) Source=Paul Collins Startup list [Taba] Number=10875 Confirmed=X Filename=stte.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Tablet] Number=10876 Confirmed=N Filename=Tablet.exe Description=Loads the tablet drivers for the Wacom Graphics Tablet. This can be unchecked in msconfig without problems if you don't need the tablet functional all the time. Create your own shortcut if you need to run it ad hoc. If you forget to run it before running Paint Shop Pro & Adobe Photo Shop) you may find the following: (1) Paint Shop Pro (version 7.04) - (a) Browse function will NOT work (program freezes) (b) On program exit, PSP does not terminate (you have to CTRL+ALT+DEL to close it) (2) Photo Shop (version 6.01) - (a) Program functions slowdown (d) On program exit it takes noticeably longer to shut down (like 30-45 seconds) Source=Paul Collins Startup list [tablet s] Number=10877 Confirmed=Y Filename=tablet s Description=Starts the Wacom Penabled driver on Acer Tablet PCs (tablet icon with a green check appears during startup if successful) Source=Paul Collins Startup list [Tablet Task] Number=10878 Confirmed=X Filename=tabletsk32.exe Description=Added by the RBOT-AJB WORM! Source=Paul Collins Startup list [TabletTip] Number=10879 Confirmed=U Filename=tabtip.exe Description=The Microsoft Tablet PC Input Panel converts handwriting to text dynamically, and you can make corrections quickly and easily before inserting text Source=Paul Collins Startup list [TabletWizard] Number=10880 Confirmed=U Filename=SPLSHWRP.EXE Description=Microsoft Tablet PC Component Source=Paul Collins Startup list [TabUserW] Number=10881 Confirmed=Y Filename=TabUserW.exe Description=Wacom pen tablet driver Source=Paul Collins Startup list [TAcelMgr] Number=10882 Confirmed=? Filename=TAcelMgr.exe Description=TOSHIBA Acceleration Utilities related. What does it do and is it required? Source=Paul Collins Startup list [Tad] Number=10883 Confirmed=N Filename=tad.exe Description=From Turtle Beach's Santa Cruz on a Dell WinME system. Not required - works fine without it including keyboard hot controls for volume and mute Source=Paul Collins Startup list [Taesk managers] Number=10884 Confirmed=X Filename=tase.pif Description=Added by the RBOT-AYK TROJAN! Source=Paul Collins Startup list [TAG] Number=10885 Confirmed=? Filename=tag.exe Description=?? Source=Paul Collins Startup list [Tahni Deskmate] Number=10886 Confirmed=N Filename=Tahni.exe Description=Tahni Deskmate - "Interactive cartoon character that lives on your Windows desktop" Source=Paul Collins Startup list [TakeMP3] Number=10887 Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=MatrixDialer related Source=Paul Collins Startup list [TAKSMGN] Number=10888 Confirmed=X Filename=taskmr.exe Description=Added by the RBOT-AHS WORM! Source=Paul Collins Startup list [talk] Number=10889 Confirmed=X Filename=talk.bat Description=Added by the TIOTUA-G WORM! Source=Paul Collins Startup list [TalkingReminder] Number=10890 Confirmed=N Filename=TALKINGREMINDER.EXE Description=Talking Reminder from Software River Solutions - talking calendar reminder Source=Paul Collins Startup list [talknow] Number=10891 Confirmed=? Filename=talknow.exe Description=Could it be related to this or something similar? Source=Paul Collins Startup list [Tango] Number=10892 Confirmed=? Filename=Setup.exe Description=Tango Broadband access software. Is it required? Source=Paul Collins Startup list [TangoManager] Number=10893 Confirmed=? Filename=TangoManager.exe Description=Tango Broadband access software. Is it required? Source=Paul Collins Startup list [TANG_INA_MO] Number=10894 Confirmed=X Filename=AutoRun.bat Description=Added by the FILUKIN.A WORM! Source=Paul Collins Startup list [Tapicfg] Number=10895 Confirmed=X Filename=Tapicfg.exe Description=CoolWebSearch Tapicfg parasite variant Source=Paul Collins Startup list [Tapisys] Number=10896 Confirmed=X Filename=tss.exe Description=Added by the SMALL TROJAN! Source=Paul Collins Startup list [TapiTNA] Number=10897 Confirmed=U Filename=TapiTNA.exe Description=Telephony Location Selector allowing mobile users to change dialling locations - part of the Win95 Power Toys Source=Paul Collins Startup list [Tardis] Number=10898 Confirmed=U Filename=Tardis.exe Description=Tardis - time synchronization software Source=Paul Collins Startup list [Task] Number=10899 Confirmed=X Filename=tasker.exe Description=Added by the MYDOOM.R WORM! Source=Paul Collins Startup list [Task Bar] Number=10900 Confirmed=X Filename=TASKBAR.EXE Description=Added by the FRETHEM.J WORM! Source=Paul Collins Startup list [Task BarClient] Number=10901 Confirmed=? Filename=TaskBarClient.exe Description=Responsible for creating the System Tray icon and associated display system for the Starband satellite always on internet service Source=Paul Collins Startup list [Task BarSvr] Number=10902 Confirmed=? Filename=TaskBarSvr.exe Description=Part of the Starband satellite always on internet service. Not included on the current system. What does it do and is it needed? Source=Paul Collins Startup list [Task Catcher] Number=10903 Confirmed=U Filename=tasktrap.exe Description=Task Catcher - utility that will block unwanted programs from running Source=Paul Collins Startup list [Task Catcher Real-Time Detector] Number=10904 Confirmed=U Filename=tasktrap.exe Description=Task Catcher - utility that will block unwanted programs from running Source=Paul Collins Startup list [Task Commander] Number=10905 Confirmed=X Filename=regsvc32.exe Description=Added by the AGOBOT-RX WORM! Source=Paul Collins Startup list [Task Debugger] Number=10906 Confirmed=X Filename=sysdll.exe Description=Added by the RBOT-CQ WORM! Source=Paul Collins Startup list [Task Help] Number=10907 Confirmed=X Filename=wualcts.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Task Manager] Number=10908 Confirmed=X Filename=taskmngr.exe Description=Added by the RBOT.Y WORM! Source=Paul Collins Startup list [Task Manager] Number=10909 Confirmed=X Filename=taskman.exe Description=Added by the FORBOT-T WORM! Source=Paul Collins Startup list [Task Manager] Number=10910 Confirmed=X Filename=prcview.exe Description=Added by the AGOBOT-RT WORM! Source=Paul Collins Startup list [Task manager] Number=10911 Confirmed=X Filename=taskemngr.exe Description=Added by the RBOT-AGA WORM! Source=Paul Collins Startup list [Task manager] Number=10912 Confirmed=X Filename=TikTo.exe Description=Added by the RBOT.LV WORM! Source=Paul Collins Startup list [Task manager] Number=10913 Confirmed=X Filename=taskmngr.exe Description=Added by the RBOT-AYZ WORM! Source=Paul Collins Startup list [Task Manager] Number=10914 Confirmed=X Filename=svchost.exe Description=Added by the SOHANA-P WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Task Manager] Number=10915 Confirmed=X Filename=taskmng.exe Description=Added by the TIOTUA-E WORM! Source=Paul Collins Startup list [Task Monitoring Service] Number=10916 Confirmed=X Filename=svchost.exe Description=Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "tasks" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Task Scheduler Engine] Number=10917 Confirmed=X Filename=schedsvc32.exe Description=Added by the RBOT-ASJ WORM! Source=Paul Collins Startup list [task service] Number=10918 Confirmed=X Filename=taskservices.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Task service] Number=10919 Confirmed=X Filename=taskmgs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [TASK SETUP] Number=10920 Confirmed=X Filename=tasksetup.exe Description=Added by the RBOT-YR WORM! Source=Paul Collins Startup list [Taskbar] Number=10921 Confirmed=N Filename=Taskbar.exe Description=Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards Source=Paul Collins Startup list [TaskBar] Number=10922 Confirmed=N Filename=CTLTask.exe Description=Creative SoundBlaster Audigy Taskbar - used to choose between different types of EAX Effects, not required in startup. NOTE: if you get a ctltask.exe error message while installing the Audigy drivers, see this Microsoft Knowledge Base article Source=Paul Collins Startup list [Taskbar Display Controls] Number=10923 Confirmed=N Filename=RunDLL deskcp16.dll, QUICKRES_RUNDLLENTRY Description=Only appears in MSCONFIG if you have a Display Settings icon in the System Tray allowing resolution changes on the fly. Can also be disabled under Control Panel -> Display -> Settings -> Advanced -> General. Also appears if you have Win95 with the QuickRes "Powertoy" installed Source=Paul Collins Startup list [Taskbar Service] Number=10924 Confirmed=X Filename=taskbar.svc Description=Unidentified adware Source=Paul Collins Startup list [Taskbar System] Number=10925 Confirmed=X Filename=tasksys.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Taskbar++] Number=10926 Confirmed=N Filename=TaskbarPP.exe Description=Taskbar++ is a software that allows you to sort (move) the buttons of the Windows taskbar by Drag & Drop Source=Paul Collins Startup list [Taskbell.exe] Number=10927 Confirmed=X Filename=Rund1.exe Description=Added by the YIPID TROJAN! Source=Paul Collins Startup list [taskdir] Number=10928 Confirmed=X Filename=taskdir.exe Description=Added by the LAGER.AQ TROJAN! Source=Paul Collins Startup list [TaskList] Number=10929 Confirmed=X Filename=tasklist32.exe Description=Added by the BANCOS-DX TROJAN! Source=Paul Collins Startup list [TaskMan] Number=10930 Confirmed=X Filename=rundll32.exe Description=Added by the DVLDR TROJAN! Note - this is not the valid "rundll32.exe" as it's in the Windows\Fonts directory Source=Paul Collins Startup list [taskmanager] Number=10931 Confirmed=X Filename=taskmgr.com Description=Added by the BEREB WORM! Source=Paul Collins Startup list [taskmanager] Number=10932 Confirmed=X Filename=taskmanager.exe Description=Added by the AGOBOT-TF WORM! Source=Paul Collins Startup list [TaskManager] Number=10933 Confirmed=X Filename=[path to trojan] Description=Added by the LDPINCH-CF TROJAN! Source=Paul Collins Startup list [taskmanger] Number=10934 Confirmed=X Filename=taskmanger.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Taskmgo] Number=10935 Confirmed=X Filename=[path to file] Description=Added by the BANCBAN-T TROJAN! Source=Paul Collins Startup list [Taskmgr] Number=10936 Confirmed=X Filename=Taskmgr.exe Description=System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory Source=Paul Collins Startup list [Taskmgr] Number=10937 Confirmed=X Filename=tskmgr32.exe Description=Homepage hi-jacker Source=Paul Collins Startup list [taskmgr] Number=10938 Confirmed=X Filename=taskmgr.exe Description=Added by the Startpage.G hijacker. Note - this is NOT the Windows Task Manager file! Source=Paul Collins Startup list [Taskmgr] Number=10939 Confirmed=X Filename=system.exe Description=Added by the PAKES.G TROJAN! Source=Paul Collins Startup list [taskmgr] Number=10940 Confirmed=X Filename=explorer.exe Description=Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System folder Source=Paul Collins Startup list [taskmgr] Number=10941 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT-ENV TROJAN! Source=Paul Collins Startup list [taskmgr] Number=10942 Confirmed=X Filename=taskmanager.exe Description=Added by the BCKDR-QHT TROJAN! Source=Paul Collins Startup list [taskmgr.exe] Number=10943 Confirmed=N Filename=taskmgr.exe Description=Windows Task Manager in Windows XP. If run from the Startup folder, the tray icon will be put to the system tray after boot. Useful to check if XP has finished running the delayed services after boot. Available via a desktop shortcut Source=Paul Collins Startup list [taskmgr.exe] Number=10944 Confirmed=X Filename=paint.exe Description=Added by a variant of the AGENT.AH downloader TROJAN! Source=Paul Collins Startup list [taskmgr.exe] Number=10945 Confirmed=X Filename=mirc.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [taskmgr.exe] Number=10946 Confirmed=X Filename=paintms.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [TASKMGRU] Number=10947 Confirmed=X Filename=TASKMGRU.EXE Description=Added by the CWS-M TROJAN! Source=Paul Collins Startup list [taskmngr] Number=10948 Confirmed=X Filename=[path] msnve.exe [path] task.exe Description=Added by the FLOOD-EK TROJAN! Source=Paul Collins Startup list [taskmngr lptt01] Number=10949 Confirmed=X Filename=taskmngr.exe Description=RapidBlaster variant (in a "Taskmngr" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [taskmngr ml097e] Number=10950 Confirmed=X Filename=taskmngr.exe Description=RapidBlaster variant (in a "Taskmngr" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [TaskMon] Number=10951 Confirmed=X Filename=taskmon.exe Description=Added by the MYDOOM.A or MYDOOM.J WORMS! Note - this is not the legitimate Win9x/Me file of the same name which resides in C:\Windows as this version resides in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP). It is not normally on a WinXP system Source=Paul Collins Startup list [Taskmon driver] Number=10952 Confirmed=X Filename=winampa.exe Description=Added by the LOONY-I TROJAN! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a "Winamp" subdirectory of the Program Files directory whereas this file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [taskmone] Number=10953 Confirmed=X Filename=taskmone.exe Description=Added by the SINGU-S TROJAN! Source=Paul Collins Startup list [TaskMonitor] Number=10954 Confirmed=U Filename=taskmon.exe Description=The Task Monitor checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase) Source=Paul Collins Startup list [TaskMrg] Number=10955 Confirmed=X Filename=csrss.exe Description=Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [taskmrg.exe] Number=10956 Confirmed=X Filename=taskimg.exe Description=Added by the DLOADER-QZ TROJAN! Source=Paul Collins Startup list [taskopen.exe] Number=10957 Confirmed=X Filename=taskopen.exe Description=Added by the HIDD.C TROJAN! Source=Paul Collins Startup list [TaskPlus] Number=10958 Confirmed=N Filename=TASKPLUS0.EXE Description=Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN Source=Paul Collins Startup list [TaskPlus] Number=10959 Confirmed=N Filename=TASKPL~1.EXE Description=Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN Source=Paul Collins Startup list [TaskReg] Number=10960 Confirmed=X Filename=[random filename] Description=Added by the CBLAD WORM! Source=Paul Collins Startup list [TaskS manager] Number=10961 Confirmed=X Filename=taskmgrs.exe Description=Added by the AGOBOT.QU WORM! Source=Paul Collins Startup list [Taskschd] Number=10962 Confirmed=X Filename=TRAYWND.EXE Description=Added by the LITMUS.002 TROJAN! Source=Paul Collins Startup list [TaskScheduler] Number=10963 Confirmed=U Filename=TaskSch.exe Description=ProSeries accounting software related Source=Paul Collins Startup list [taskswitch] Number=10964 Confirmed=N Filename=taskswitch.exe Description=ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen Source=Paul Collins Startup list [TaskSwitchXP] Number=10965 Confirmed=U Filename=TaskSwitchXP.exe Description="TaskSwitchXP from NTWind Software. Advanced task management utility that picks up where the standard Windows Alt Tab switcher leaves off. It provides the same functionality, and adds visual styles to the dialog and also enhances it by displaying thumbnail preview of the application that will be switched to" Source=Paul Collins Startup list [tasksys] Number=10966 Confirmed=X Filename=tasksys.vbs Description=Added by the BYRON WORM! Source=Paul Collins Startup list [Tasktray] Number=10967 Confirmed=N Filename=CTLTray.exe Description=Installed with the Sound Blaster Audigy range of soundcards. Allows you to set EAX effects or equalizer settings for the Sound Blaster Audigy from a systray icon. Also allows you to launch the Taskbar via right-click -> Show Taskbar. The tasktray can be accessed via Start -> Programs -> Creative -> Sound Blaster Audigy -> Taskbar Source=Paul Collins Startup list [Tasmgr] Number=10968 Confirmed=X Filename=Taskmgr.bat Description=Added by the YPSAN.G WORM! Source=Paul Collins Startup list [tat] Number=10969 Confirmed=X Filename=tatss.exe Description=Delfin Promulgate adware variant Source=Paul Collins Startup list [Tau monitor] Number=10970 Confirmed=Y Filename=Taumon.exe Description="Tauscan is a powerful Trojan Horse detection and removal engine capable of catching every known type of backdoor that can threaten your system" Source=Paul Collins Startup list [TAudEffect] Number=10971 Confirmed=? Filename=TAudEff.exe Description=TOSHIBA Notebook related. What does it do and is it required? Source=Paul Collins Startup list [TB2PROEXE] Number=10972 Confirmed=U Filename=tb2start.exe Description=Timbuktu Pro - remote desktop access software Source=Paul Collins Startup list [TBC Pro] Number=10973 Confirmed=U Filename=tbcpro.exe Description=TitleBarClock Pro - displays Day, Time, Date, Month, Year, FreeMem, and FreeDriveSpace on the right side of the title bar in any main window that has the mouse or keyboard focus Source=Paul Collins Startup list [TBC.exe] Number=10974 Confirmed=U Filename=TBC.exe Description=TitleBarClock software Source=Paul Collins Startup list [tbctray] Number=10975 Confirmed=N Filename=tbctray.exe Description=Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TBLFUNC] Number=10976 Confirmed=Y Filename=tblmouse.exe Description=Aiptek HyperPen graphics tablet driver Source=Paul Collins Startup list [tbon] Number=10977 Confirmed=X Filename=tbon.exe Description=BestOffers adware Source=Paul Collins Startup list [TBPanel] Number=10978 Confirmed=U Filename=TBPanel.exe Description=Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TBPS] Number=10979 Confirmed=X Filename=TBPS.exe Description=WebSearch Toolbar - HuntBar hijacker, toolbar installer variant Source=Paul Collins Startup list [TBTray] Number=10980 Confirmed=N Filename=tbtray.exe Description=VLSI/QSound ThunderBird PCI Control Panel. System Tray access to the settings for this and related soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TB_setup] Number=10981 Confirmed=? Filename=TB_ANI~1.EXE Description=?? Source=Paul Collins Startup list [TB_setup] Number=10982 Confirmed=X Filename=tb_setup.exe Description=HuntBar hijacker, toolbar installer Source=Paul Collins Startup list [tcactive] Number=10983 Confirmed=Y Filename=tca.exe Description=Part of The Cleaner from MooSoft - stops virus trojans before they can do any damage Source=Paul Collins Startup list [TCASUTIEXE] Number=10984 Confirmed=N Filename=tcaudiag.exe Description=3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs Source=Paul Collins Startup list [TCASUTIEXE] Number=10985 Confirmed=N Filename=TCASUTI.exe Description=Associated with the 3COM diagnostic module (3COM NIC Doctor).�No further information is available Source=Paul Collins Startup list [TCAUDIAG -off] Number=10986 Confirmed=N Filename=tcaudiag.exe Description=3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs Source=Paul Collins Startup list [TCDPbtn] Number=10987 Confirmed=? Filename=TCDPbtn.exe Description=Found on a Toshiba laptop Source=Paul Collins Startup list [TCDPlay] Number=10988 Confirmed=? Filename=TCDPlay.drv Description=Found on a Toshiba laptop - sounds like the driver for the CD-ROM but why doesn't it use the standard Windows drivers - any comments? Source=Paul Collins Startup list [TClock] Number=10989 Confirmed=U Filename=TCLOCK.EXE Description=Kazubon TClock. Utility that amongst other things synchronizes your system clock with Internet time servers. Available via Start -> Programs Source=Paul Collins Startup list [TClock.exe] Number=10990 Confirmed=X Filename=tclock_install.exe Description=TClock - distributed and installed without user permission by other rogue software or malware. TClock contains no uninstall facility through Windows. As TClock is of dubious origin and usefulness, it should be terminated and removed if detected Source=Paul Collins Startup list [TClockEx] Number=10991 Confirmed=U Filename=TCLOCKEX.EXE Description=Puts a configurable time/date display in the tray (and other features). Freeware by Dale Nurden and is popular on cover disks Source=Paul Collins Startup list [tcmonitor] Number=10992 Confirmed=U Filename=tcm.exe Description=Part of The Cleaner from MooSoft - warns of changes to the registry Source=Paul Collins Startup list [TCOYFReminder] Number=10993 Confirmed=U Filename=tcoyftray.exe Description=My ParenTime Fertility Planner Reminder. The calendar provides a quick overview of the status of your fertility Source=Paul Collins Startup list [Tcp Application Manager] Number=10994 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=10995 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=10996 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=10997 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=10998 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=10999 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=11000 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Tcp Application Manager] Number=11001 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [tcp checker] Number=11002 Confirmed=X Filename=tcpcheck.exe Description=Added by the VBBOT-A TROJAN! Source=Paul Collins Startup list [TCP Internet Services] Number=11003 Confirmed=X Filename=TCPSVC32.EXE Description=Added by the SPYBOT.X TROJAN! Source=Paul Collins Startup list [TCP Monitoring] Number=11004 Confirmed=X Filename=LanNSvc.exe Description=Added by the RANDEX.AAS WORM! Source=Paul Collins Startup list [tcpipmon] Number=11005 Confirmed=X Filename=tcpipmon.exe Description=Added by the CLICKER-EF TROJAN! Source=Paul Collins Startup list [tcpippui] Number=11006 Confirmed=X Filename=tcpippui.exe Description=Added by the RBOT-APS WORM! Source=Paul Collins Startup list [tcpippui32] Number=11007 Confirmed=X Filename=tcpippui32.exe Description=Added by the RBOT-ART WORM! Source=Paul Collins Startup list [TCPServer] Number=11008 Confirmed=X Filename=TCPServer.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [TCPXP Update] Number=11009 Confirmed=X Filename=tcpxp.exe Description=Added by the RBOT-UL WORM! Source=Paul Collins Startup list [TCtryIOHook] Number=11010 Confirmed=? Filename=TCtrlIOHook.exe Description=Toshiba laptop related. What does it do and is it required? Source=Paul Collins Startup list [tcupdater] Number=11011 Confirmed=X Filename=tcupdater.exe Description=Topconverting.com/180Search adware updater Source=Paul Collins Startup list [TDispVol] Number=11012 Confirmed=U Filename=TDispVol.exe Description=Used on Toshiba computers to make the Fn key have control over the volume on/off Source=Paul Collins Startup list [TDKSTART] Number=11013 Confirmed=U Filename=TDKSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. Source=Paul Collins Startup list [TDKTASK] Number=11014 Confirmed=N Filename=TDKTASK.EXE Description=Taskbar utility for a "control panel" for a CD-RW Source=Paul Collins Startup list [TDockNUndock] Number=11015 Confirmed=? Filename=N/A Description=Found on a Toshiba laptop - for use with a docking station? Source=Paul Collins Startup list [TDS3] Number=11016 Confirmed=U Filename=TDS-3.exe Description=DiamondCS TDS-3 antitrojan. Can be used to scan on demand, but required in startup if you prefer real time protection Source=Paul Collins Startup list [TDspOff] Number=11017 Confirmed=? Filename=Tdspoff.exe Description=Found on a Toshiba laptop Source=Paul Collins Startup list [Teach In Box] Number=11018 Confirmed=N Filename=teachbox.exe Description=Tutoring program that comes with a SystemAX Computer Source=Paul Collins Startup list [Tech-In-A-Box] Number=11019 Confirmed=Y Filename=techbox.exe Description=Tech-in-a-Box "provides easy-to-use tools for various system maintenance tasks. From backup and restore to diagnostics and repairs, Tech-in-a-Box is your tool to stay up and running" Source=Paul Collins Startup list [Telechips,Mass] Number=11020 Confirmed=U Filename=patch.exe Description=Removable disk driver for the Muro MP3 player Source=Paul Collins Startup list [Telemeter 3.0] Number=11021 Confirmed=N Filename=telemeter3.exe Description=Internet connection bandwidth meter from a user ISP Source=Paul Collins Startup list [Telepath] Number=11022 Confirmed=Y Filename=telepath.exe Description=Drivers for the WinModem versions of the US Robotics "Telepath" series - as supplied to Gateway for instance. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [Telnet] Number=11023 Confirmed=X Filename=Telnet.exe Description=Added by the VOUMIT-A WORM! Note - this is not the legitimate telnet.exe application which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder Source=Paul Collins Startup list [Telnet24] Number=11024 Confirmed=X Filename=[random filename] Description=Added by the RBOT-ARD WORM! Source=Paul Collins Startup list [TELUS Security service] Number=11025 Confirmed=Y Filename=freedom.exe Description=Freedom Internet Security & Privacy - anti-virus, personal firewall and parental control. It also blocks ads, safeguards your personal information, encrypts your passwords, and much more. No longer available for sale Source=Paul Collins Startup list [TempCom] Number=11026 Confirmed=X Filename=[randomname].com Description=Added by the TRAXG WORM! Source=Paul Collins Startup list [tempx] Number=11027 Confirmed=X Filename=tempx.exe Description=Added by the TEMPEX.A TROJAN! Source=Paul Collins Startup list [Tencent QQ] Number=11028 Confirmed=X Filename=Rund1132.exe qq.dll, Rundll32 Description=Added by the QQPASS.F TROJAN! Source=Paul Collins Startup list [Terminal Services] Number=11029 Confirmed=X Filename=mstscc.exe Description=Added by the SDBOT-CZW WORM! Source=Paul Collins Startup list [Terminal Update] Number=11030 Confirmed=X Filename=biosefui.exe Description=Added by the PPDOOR-O TROJAN! Source=Paul Collins Startup list [Terminate Popup] Number=11031 Confirmed=X Filename=ZPU.exe Description=Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here Source=Paul Collins Startup list [Terminate Popup] Number=11032 Confirmed=X Filename=FPUK.exe Description=Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here Source=Paul Collins Startup list [TEscKey] Number=11033 Confirmed=U Filename=TEscKey.exe Description=Toshiba Escape Key handler. Enables you to program and use the <FN><Esc> key combination to perform a specific function Source=Paul Collins Startup list [Tesco.net] Number=11034 Confirmed=N Filename=rundll32 [path] RyDial.dll, QuickStart Description=Tesco.net dial-up ISP software - not required Source=Paul Collins Startup list [Tesla] Number=11035 Confirmed=? Filename=TESLA.EXE Description=?? Source=Paul Collins Startup list [test] Number=11036 Confirmed=X Filename=i love you.exe Description=Added by the SINGU-T TROJAN! Source=Paul Collins Startup list [Testing 123] Number=11037 Confirmed=X Filename=msdata.dat Description=Added by the NITS.A WORM! Source=Paul Collins Startup list [testit.exe] Number=11038 Confirmed=X Filename=testit.exe Description=ISTBar adware Source=Paul Collins Startup list [TExBUtil Registry] Number=11039 Confirmed=? Filename=TExBUtil.exe Description=?? Source=Paul Collins Startup list [TextAloud] Number=11040 Confirmed=N Filename=TextAloudMP3.exe Description=TextAloud MP3 - convert text into spoken words and MP3s Source=Paul Collins Startup list [Textbridge Instant Access OCR] Number=11041 Confirmed=N Filename=telepath.exe Description=TextBridge from Nuance (was Scansoft). OCR (optical character recognition) software for scanning documents into popular editing applications. Available via Start -> Programs Source=Paul Collins Startup list [TEXTCONV] Number=11042 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [TEXTCONV] Number=11043 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [TFncKy] Number=11044 Confirmed=U Filename=TFncky.exe Description=Deals with the <Fn> - <Function> key combinations on a Toshiba laptop Source=Paul Collins Startup list [TFNF5] Number=11045 Confirmed=U Filename=TFNF5.exe Description=Toshiba Hotkey Utility for Display Devices. By pressing <FN> + <F5>, a window appears showing the displays that can be chosen � LCD, LCD + CRT, CRT, TV Source=Paul Collins Startup list [tfswctrl] Number=11046 Confirmed=Y Filename=tfswctrl.exe Description=Drive letter access to a UDF packet writer for CD-RW - from HP, Veritas an others. Similar to Roxio's DirectCD and does the same thing. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones" Source=Paul Collins Startup list [TFTP***] Number=11047 Confirmed=X Filename=tftp*** Description=Added by a variant of the SPYBOT WORM! where *** can be any number Source=Paul Collins Startup list [TFunckey] Number=11048 Confirmed=U Filename=TFuncKey.exe Description=Deals with the <Fn> - <Function> key combinations on a Toshiba laptop Source=Paul Collins Startup list [TgAddServer] Number=11049 Confirmed=N Filename=tgfix.exe Description=Software from SupportSoft (aka Support.com) provided to manufacturers (such as Sony (Vaio Support Agent) and Toshiba (Virtual Tech)) and ISPs (such as Comcast, Cox and Charter (Pipeline Support Agent)) that allows them to offer on-line support - to update drivers, fix faults, etc. Can cause a deterioration in a PC's peformance (see here). This part does the protection and "self-healing". Uninstallation is recommended by most people - especially for System Restore users (WinME/XP). If not available via Add/Remove try here Source=Paul Collins Startup list [tgbcde] Number=11050 Confirmed=X Filename=module32.exe Description=Added by the REIGN.R TROJAN! Source=Paul Collins Startup list [Tgcmd] Number=11051 Confirmed=U Filename=tgcmd.exe Description=See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [tgcmdprovidersbc] Number=11052 Confirmed=U Filename=tgcmd.exe Description=See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [TGCMG] Number=11053 Confirmed=N Filename=?? Description=Related to Rogers@Home, causes errors in WinSock32.dll. Not required for connection to work Source=Paul Collins Startup list [TGDC IE Plugin] Number=11054 Confirmed=X Filename=tgdc.exe Description=ShopForGood spyware - see here Source=Paul Collins Startup list [tgkill] Number=11055 Confirmed=X Filename=tgkill.exe Description=Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs Source=Paul Collins Startup list [Tgsetsite] Number=11056 Confirmed=U Filename=tgfix.exe Description=See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [Thdetrf] Number=11057 Confirmed=N Filename=thdetr32.exe Description=Appears to be related to Lycos advertising Source=Paul Collins Startup list [ThE] Number=11058 Confirmed=X Filename=wind0s.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [The Easy Bee's Hive] Number=11059 Confirmed=U Filename=ATCEgSvr.exe Description=The Easy Bee is a software that allows you to record Internet navigation sequences, which can include form filling and button clicking and to attach a replay schedule to each sequence Source=Paul Collins Startup list [The Ethernet] Number=11060 Confirmed=X Filename=ethernet.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [The Intranet] Number=11061 Confirmed=X Filename=intranet.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [TheMainStart] Number=11062 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [TheMonitor] Number=11063 Confirmed=X Filename=[path to trojan] Description=Added by the DLOADR-LO TROJAN! Source=Paul Collins Startup list [TheMonitor] Number=11064 Confirmed=X Filename=Duce6.exe Description=YourEnhancement downloader Source=Paul Collins Startup list [THGuard] Number=11065 Confirmed=U Filename=TH_Guard.exe Description=Resident memory scanning for TrojanHunter Source=Paul Collins Startup list [THGuard] Number=11066 Confirmed=U Filename=THGuard.exe Description=Resident memory scanning for TrojanHunter Source=Paul Collins Startup list [Think-Adz] Number=11067 Confirmed=X Filename=[random filename].exe Description=ZenoSearch adware Source=Paul Collins Startup list [This is a virus, please delete it] Number=11068 Confirmed=X Filename=bigbadvirus.exe Description=Added by the RANDEX.F WORM! Source=Paul Collins Startup list [THOTKEY] Number=11069 Confirmed=U Filename=THotkey.exe Description=Associated with the Fn+ keys on Toshiba laptops. When disabled some keys still worked, like the one that regulates the volume of the system beep, but others didn't, like the one that immediately blackens your screen Source=Paul Collins Startup list [ThpSrv] Number=11070 Confirmed=Y Filename=thpsrv.exe Description=Toshiba Hard Drive Protection Utility - moves the Hard Drive head to a safe position in case of shock or vibration to reduce the risk of damage that could be caused by head-to-disk contact Source=Paul Collins Startup list [Threaded] Number=11071 Confirmed=X Filename=intcp32.exe Description=Added by the RANDEX.UG WORM! Source=Paul Collins Startup list [ThrustTSR] Number=11072 Confirmed=U Filename=TMTMTSR.exe Description=Thrustmaster Thrustmapper - "t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly" Source=Paul Collins Startup list [Thumbs Plus *.*] Number=11073 Confirmed=X Filename=thmbplus**.exe Description=Added by the AGOBOT-AAF WORM! ** is a combination of a random digits and characters Source=Paul Collins Startup list [TI WLAN] Number=11074 Confirmed=U Filename=TIWLANCu.exe Description=Texas Instruments TI wireless LAN products Source=Paul Collins Startup list [tibs3] Number=11075 Confirmed=X Filename=tibs3.exe Description=Premium rate adult content dialler - see here Source=Paul Collins Startup list [tibs5] Number=11076 Confirmed=X Filename=tibs5.exe Description=Premium rate adult content dialer - see here Source=Paul Collins Startup list [Tiger] Number=11077 Confirmed=X Filename=Shine.exe Description=Added by the HAPPYLOW (or NISHE-A) VIRUS! Source=Paul Collins Startup list [TiKL] Number=11078 Confirmed=U Filename=tikl.exe Description=TinyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Tilerun] Number=11079 Confirmed=X Filename=Tilecom32.com Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Time Manager] Number=11080 Confirmed=X Filename=TimeManager.exe Description=Added by the MYTOB-BV WORM! Source=Paul Collins Startup list [Time Zone Synchronization] Number=11081 Confirmed=X Filename=wscript zshell.js Description=Added by the NETDEX-A TROJAN! Source=Paul Collins Startup list [TimeCalendar] Number=11082 Confirmed=U Filename=tc.exe Description=TimeCalendar digital planner Source=Paul Collins Startup list [Timed Backups Manager Startup] Number=11083 Confirmed=N Filename=BACKTIME.EXE Description=Backup Plus - backup software Source=Paul Collins Startup list [TimeLeft] Number=11084 Confirmed=U Filename=TimeLeft.exe Description=TimeLeft is a countdown, reminder, clock, alarm clock, stopwatch, timer, sticker and time synchronization utility which uses Winamp skins to show digits and text Source=Paul Collins Startup list [Timemanager.exe] Number=11085 Confirmed=U Filename=Timemanager.exe Description=Time Manager will let you track billable and non-billable time by customer, by category and by associate and then integrate directly to our custom billing package Source=Paul Collins Startup list [TimeOnline] Number=11086 Confirmed=N Filename=TIMEONLINE.EXE Description=Lightman Groups's TimeOnline monitor. For dial-up users to monitor time spent on the net. Available via Start -> Programs Source=Paul Collins Startup list [TIMER] Number=11087 Confirmed=X Filename=TIMER.EXE Description=Added by the TIMESE.AG WORM! Source=Paul Collins Startup list [Timer] Number=11088 Confirmed=X Filename=comm.exe Description=Added by the IP TROJAN! Source=Paul Collins Startup list [Timer] Number=11089 Confirmed=X Filename=timed.exe Description=Added by the LV TROJAN! Source=Paul Collins Startup list [Timer] Number=11090 Confirmed=X Filename=msncomm.exe Description=Added by the WEBDOR.AK TROJAN! Source=Paul Collins Startup list [TimeService] Number=11091 Confirmed=X Filename=trun.exe Description=TlfLic-A premium rate adult content dialler Source=Paul Collins Startup list [TimeSink Add Client] Number=11092 Confirmed=X Filename=TSADBOT.EXE Description=Advertising spyware Source=Paul Collins Startup list [timessquare] Number=11093 Confirmed=X Filename=timessquare.exe Description=Reported as Trojan.Win32.StartPage.aw by Kaspersky Anti-Virus Source=Paul Collins Startup list [timestamp] Number=11094 Confirmed=X Filename=timeapr32.exe Description=Added by the AGENT-DRU TROJAN! Source=Paul Collins Startup list [TimeSyncApp] Number=11095 Confirmed=X Filename=TimeSynchronize.exe Description=DealHelper adware Source=Paul Collins Startup list [TimeUp] Number=11096 Confirmed=N Filename=Timeup.exe Description=TimeUp - internet online timer Source=Paul Collins Startup list [Timezone] Number=11097 Confirmed=U Filename=TimeZone.exe Description=Microsoft Daylight Saving Time Update Utility - see here Source=Paul Collins Startup list [TimounterMonitor] Number=11098 Confirmed=U Filename=TimounterMonitor.exe Description=Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive Source=Paul Collins Startup list [TINTSETP] Number=11099 Confirmed=N Filename=TINTSETP.EXE Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [Tiny AV] Number=11100 Confirmed=X Filename=fooding.exe Description=Added by the NETSKY.I WORM! Source=Paul Collins Startup list [Tiny Personal Firewall] Number=11101 Confirmed=Y Filename=persfw.exe Description=Tiny Personal Firewall Source=Paul Collins Startup list [tinySpell] Number=11102 Confirmed=U Filename=tinyspell.exe Description=Tinyspell - "allows you to easily and quickly check the spelling of words in any Windows application. Monitors your typing on the fly, alerts you whenever it detects a misspelled word, and checks the spelling of every word you copy to the clipboard" Source=Paul Collins Startup list [TiomanExe] Number=11103 Confirmed=U Filename=Tioman.Exe Description=Agate Tioman - warm and hot swap removable bay device manager for IBM laptops Source=Paul Collins Startup list [Tips] Number=11104 Confirmed=N Filename=mousetips.exe Description=Suggests tips on using your mouse Source=Paul Collins Startup list [TiTleBarClock] Number=11105 Confirmed=U Filename=TiTleBarClock.exe Description=TitleBarClock displays the day/month/time and free physical RAM on the right hand side of an open window, replacing the system tray clock at startup Source=Paul Collins Startup list [TitleTime] Number=11106 Confirmed=U Filename=TiTime.exe Description="TitleTime adds the current date and/or time to the Caption of the currently active application window. Additional options are a second clock (with a different time), week number, GMT/UTC time, Swatch Internet Time and Sounds at each full, half or quarter hour" Source=Paul Collins Startup list [Tivoli] Number=11107 Confirmed=N Filename=LCFEP.EXE Description=Tivoli 'TME' System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally" Source=Paul Collins Startup list [TivoNotify] Number=11108 Confirmed=X Filename=TiVoNotify.exe Description=Part of Tivo Desktop. What does it do and is it required? Source=Paul Collins Startup list [TivoServer] Number=11109 Confirmed=U Filename=TiVoServer.exe Description=Tivo Server - installed with the TiVo Home Media Option. It streams audio files to your television/home theater from your PC Source=Paul Collins Startup list [TivoTransfer] Number=11110 Confirmed=U Filename=TivoTransfer.exe Description=Tivo Transfer Service. TiVo Desktop is an easy-to-use application that lets you publish and share digital music, photos and TiVo recordings between your networked TiVo Series2 DVR and your computer Source=Paul Collins Startup list [TIxDSL] Number=11111 Confirmed=U Filename=tidslmon.exe Description=Actiontec DSL modem. Associated with High Speed AOL DSL. Used to get line sync with the Actiontec DSL USB Modem. Available via Start -> Programs Source=Paul Collins Startup list [TizzleTalk] Number=11112 Confirmed=N Filename=TizzleTalk.exe Description=TizzeTalk is a dialect translator for Yahoo, MSN, AOL Instant Messengers. Bundles adware, hence not recommended. From their EULA : "As a result of installing the Company's Software, you will see occasional banner ads, pop-up or pop-under ads, or other types of ads selected based on your online activities .../... Occasionally, we may automatically or through other remote means, update, upgrade, patch or uninstall the Company's Software, including the Company's advertising-supported software, without further notice to you. These upgrades also may include installation of additional applications from the Company as well as third party applications" Source=Paul Collins Startup list [tjstartup] Number=11113 Confirmed=X Filename=[path to file] Description=Added by the TJSERV.C TROJAN! Source=Paul Collins Startup list [TkBell.Exe] Number=11114 Confirmed=N Filename=evntsvc.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkBell.Exe] Number=11115 Confirmed=N Filename=realsched.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkBell.Exe] Number=11116 Confirmed=N Filename=tkbell.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkBellExe] Number=11117 Confirmed=N Filename=evntsvc.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkBellExe] Number=11118 Confirmed=N Filename=realsched.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkBellExe] Number=11119 Confirmed=N Filename=tkbell.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [TkNetDriver Monitor] Number=11120 Confirmed=X Filename=lexbce.exe Description=Added by the SDBOT-ADF WORM! Source=Paul Collins Startup list [tkonnect] Number=11121 Confirmed=N Filename=TKONNECT.EXE Description=Dialer for the Tiscali internet service provider. Available as a desktop shortcut Source=Paul Collins Startup list [tlc] Number=11122 Confirmed=X Filename=update911.js Description=Hijacker installer Source=Paul Collins Startup list [TlcR] Number=11123 Confirmed=? Filename=avp.exe Description=?? Source=Paul Collins Startup list [tlntsvr] Number=11124 Confirmed=U Filename=tlntsvr.exe Description=Microsoft program associated with Telnet Source=Paul Collins Startup list [TLogonPath] Number=11125 Confirmed=U Filename=tb2logon.exe Description=Timbuktu Pro - remote desktop access software Source=Paul Collins Startup list [TM Outbreak Agent] Number=11126 Confirmed=U Filename=TMOAgent.exe Description=Trend Micro Internet Security anti-virus software virus outbreak warnings. Notifies users of virus outbreaks and offers to update the scanner Source=Paul Collins Startup list [TMA distribution] Number=11127 Confirmed=U Filename=cfinst.exe Description=Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Source=Paul Collins Startup list [tmax] Number=11128 Confirmed=X Filename=pupdate.exe Description=Adware pop-up generator Source=Paul Collins Startup list [tmchook] Number=11129 Confirmed=X Filename=tmchook.exe Description=Detected by Kaspersky as the TrojanDownloader.Win32.VB.aa VIRUS! Source=Paul Collins Startup list [TMEEJME] Number=11130 Confirmed=? Filename=TMEEJME.EXE Description=Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMERzCtl] Number=11131 Confirmed=? Filename=TMERzCtl.EXE Description=Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMESBS] Number=11132 Confirmed=U Filename=TMESBS21.exe Description=Toshiba Mobile Extension Selectable Bay Service for WinXP - support for docking stations. Not required if you don't use a docking station Source=Paul Collins Startup list [TMESBS32] Number=11133 Confirmed=? Filename=TMESBS32.EXE Description=Found in a ToshibaTME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMESRV31] Number=11134 Confirmed=U Filename=TMESRV31.EXE Description=Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station Source=Paul Collins Startup list [TMExLogon] Number=11135 Confirmed=U Filename=TMESRV.EXE Description=Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station Source=Paul Collins Startup list [Tmmkb] Number=11136 Confirmed=? Filename=Tmmkysvr.exe Description=Toshiba multi-media keyboard software - possibly including creating keyboard shortcuts? Source=Paul Collins Startup list [TmNetDriver Monitor] Number=11137 Confirmed=X Filename=exbce.exe Description=Added by the SDBOT-ABR WORM! Source=Paul Collins Startup list [Tmntsrv32] Number=11138 Confirmed=X Filename=Tmntsrv32.exe Description=Hijacker, detected by Norton antivirus as Trojan.StartPage.O Source=Paul Collins Startup list [TMOUSE] Number=11139 Confirmed=U Filename=tmouse.exe Description=Component of the Toshiba Mouse Control that allows users with an AccuPoint mouse to scroll MS-scroll-compatible documents by holding CTRL + ALT and moving the AccuPoint up or down. It also allows zooming by holding CTRL + SHIFT and moving the AccuPoint up or down. Disabling this item has no adverse effects, except disabling the scroll/zoom features of the AccuPoint Source=Paul Collins Startup list [tmproxy] Number=11140 Confirmed=Y Filename=tmproxy.exe Description=Trend Micro PC-cillin 2003 antivirus software Source=Paul Collins Startup list [TMTMTSR] Number=11141 Confirmed=U Filename=TMTMTSR.exe Description=Thrustmaster Thrustmapper - "t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly" Source=Paul Collins Startup list [TNTClk] Number=11142 Confirmed=U Filename=TNTCLK.exe Description=Overclocking program for TNT, TNT2, and other graphics cards. This program can overclock the graphics card manually after startup when needed, especially before starting a gaming session. However, for simplicity, it can be left checked to let it run once at startup to automatically overclock the graphics card. In this case, it doesn't even run in the background after doing its job Source=Paul Collins Startup list [ToADiMon.exe] Number=11143 Confirmed=U Filename=ToADiMon.exe Description=T-Online ISP software connection assistant Source=Paul Collins Startup list [Toggler] Number=11144 Confirmed=U Filename=toggler.exe Description="Toggler allows you to gain control over your Caps Lock, Num Lock, and Insert keys. It prevents you from writing in ALL CAPS when your finger has slipped to accidentally hit the Caps Lock key" Source=Paul Collins Startup list [Tok-Cirrhatus] Number=11145 Confirmed=X Filename=IDTemplate.exe Description=Added by the RONTOKBRO.A WORM! Source=Paul Collins Startup list [Tok-Cirrhatus] Number=11146 Confirmed=X Filename=smss.exe Description=Added by the BRONTOK-A WORM and variants! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "Documents and Settings\[User]\Local Settings\Application Data\" folder Source=Paul Collins Startup list [Tok-Cirrhatus] Number=11147 Confirmed=X Filename=[path to file] Description=Added by the BRONTOK-F WORM! Source=Paul Collins Startup list [Tok-Cirrhatus-1959] Number=11148 Confirmed=X Filename=br4941on.exe Description=Added by the BRONTOK-J WORM! Source=Paul Collins Startup list [Tok-Cirrhatus-1959sarc] Number=11149 Confirmed=X Filename=sv711224030r.exe Description=Added by the BRONTOK-R WORM! Source=Paul Collins Startup list [Tok-Cirrhatus-2784] Number=11150 Confirmed=X Filename=br6591on.exe Description=Added by the BRONTOK-L WORM! Source=Paul Collins Startup list [Tok-Cirrhatus-2784] Number=11151 Confirmed=X Filename=smss.exe Description=Added by the BRONTOK-S WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the "Documents and Settings\[User]\Local Settings\Application Data\" folder Source=Paul Collins Startup list [Tok-Cirrhatus-[4 random digits]] Number=11152 Confirmed=X Filename=br[4 random digits]on.exe Description=Added by the BRONTOK-M WORM! Source=Paul Collins Startup list [TomcatStartup] Number=11153 Confirmed=? Filename=hpbpsttp.exe Description=Apache Tomcat web server, part of HP LaserJet "Printer Tools" software. What does it do and is it required? Source=Paul Collins Startup list [TomcatStartup 2.5] Number=11154 Confirmed=? Filename=hpbpsttp.exe Description=Apache Tomcat web server, part of HP LaserJet "Printer Tools" software. What does it do and is it required? Source=Paul Collins Startup list [Tommorrow] Number=11155 Confirmed=? Filename=tomorrow.exe Description=?? Source=Paul Collins Startup list [ToolBoxFX] Number=11156 Confirmed=? Filename=HPTLBXFX.exe Description=HP ToolBoxFX - "provides desktop configuration, status and support for every feature". Supplied with some HP multifunction printers Source=Paul Collins Startup list [ToP] Number=11157 Confirmed=X Filename=LSASS.exe Description=Added by the WOWCRAFT.C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Top Tilecom] Number=11158 Confirmed=X Filename=Tilecomtop.com Description=Added by the WORM_RBOT.BXD WORM! Source=Paul Collins Startup list [ToPassSrv] Number=11159 Confirmed=? Filename=Pktopass.exe Description=Related to Caere Pagekeeper scanning software (now taken over by Scansoft), Disabling is known to cause problems Source=Paul Collins Startup list [TopDesk] Number=11160 Confirmed=U Filename=TopDesk.exe Description=TopDesk - puts an icon in your system tray that when clicked upon, opens a pop-up menu that gives instant access to all of your desktop programs without having to minimize, resize, move or close other programs or files Source=Paul Collins Startup list [Topic lnternet] Number=11161 Confirmed=X Filename=lnternet32.exe Description=Added by the RBOT-GLZ WORM! Source=Paul Collins Startup list [ToPicks Starter] Number=11162 Confirmed=X Filename=Idhost.exe Description=TOPicks adware Source=Paul Collins Startup list [topmoxie] Number=11163 Confirmed=X Filename=JavaRun.exe Description=TopMoxie adware Source=Paul Collins Startup list [TopSearch] Number=11164 Confirmed=X Filename=TopSearch.exe Description=TopSearch adware variant Source=Paul Collins Startup list [Tor] Number=11165 Confirmed=N Filename=tor.exe Description=Tor anonymous internet communication system. Shortcut available via Start -> Programs Source=Paul Collins Startup list [tor anonymous proxy] Number=11166 Confirmed=X Filename=tor32.exe Description=Added by the SDBOT-ADR WORM! Source=Paul Collins Startup list [Torjan Program] Number=11167 Confirmed=X Filename=[path to trojan] Description=Added by the LEGMIR-BO TROJAN! Source=Paul Collins Startup list [Torjan Program] Number=11168 Confirmed=X Filename=smss.exe Description=Added by the WOWCRAFT.B TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Torjan Program] Number=11169 Confirmed=X Filename=WINLOGON.EXE Description=Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! This trojan file is found in the Windows or Winnt folder Source=Paul Collins Startup list [TOSCDSPD] Number=11170 Confirmed=N Filename=toscdspd.exe Description=Related to Toshiba laptop CD/DVD drivers. This is a non-essential process. Disabling or enabling this is down to user preference Source=Paul Collins Startup list [TOSHIBA Accessibility] Number=11171 Confirmed=U Filename=FnKeyHook.exe Description="Allows you to use the Fn key to create a hot key combination with one of the function keys without pressing the two keys simultaneously as is usually required. Using Accessibility lets you make the Fn key a sticky key, meaning you can press it once, release it, and then press a function key to activate the hot key function" Source=Paul Collins Startup list [Toshiba Fan] Number=11172 Confirmed=Y Filename=fan.exe Description=Toshiba untilty to keep the fan on a laptop running if they fail to detect there is too much heat Source=Paul Collins Startup list [Toshiba Key State] Number=11173 Confirmed=U Filename=KEYSTATE.EXE Description=Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g., Toshiba) laptops which do not have a Caps Lock indicator light. Available via Start -> Programs Source=Paul Collins Startup list [ToshibaPinger] Number=11174 Confirmed=N Filename=pinger.exe Description=Pinger is the resident program for Toshiba Upgrades. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification. Disabling instructions here Source=Paul Collins Startup list [TOSHIBSU] Number=11175 Confirmed=U Filename=Toshibsu.exe Description=Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor clock rate, etc. Required if you run off battery regularly Source=Paul Collins Startup list [TosHKCW] Number=11176 Confirmed=U Filename=TosHKCW.exe Description=Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed) Source=Paul Collins Startup list [TosMem] Number=11177 Confirmed=Y Filename=tosmem.exe Description=Toshiba laptop related. Win98/Me ACPI system can not hibernate or go on standby if all of the physical memory lower than 640KB is locked. This utility allocates and locks three pages on boot and then releases them on standby/hibernation for ACPI.SYS in order to solve the above problem Source=Paul Collins Startup list [TosRotation] Number=11178 Confirmed=U Filename=TRot.exe Description=TOSHIBA Rotation Utility - allows users to rotate a notebook's screen image 180 degrees in order to share information on the screen with others seated across a table or desk Source=Paul Collins Startup list [TotRecSched] Number=11179 Confirmed=U Filename=TotRecSched.exe Description=Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm Source=Paul Collins Startup list [ToUcamVProperty] Number=11180 Confirmed=Y Filename=VProperty.exe Description=Philips Web Camera model name pcvc740k, ToUcam driver configuration tray icon Source=Paul Collins Startup list [Touch Manager] Number=11181 Confirmed=U Filename=WinLED.exe Description=Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality Source=Paul Collins Startup list [TouchED] Number=11182 Confirmed=U Filename=TouchED.exe Description=TouchPad On/Off Utility on a Toshiba laptop Source=Paul Collins Startup list [tour] Number=11183 Confirmed=N Filename=regedit ..tour.reg Description=Edits registry values to keep the WinMe tour in Task Scheduler Source=Paul Collins Startup list [Tour] Number=11184 Confirmed=N Filename=wincool.exe Description=Component of WinME that's annoying as hell. Pop's up a prompt to play the C:\WINDOWS\Application Data\Microsoft\INTROCONTENT.HTA that plays a full screen version of the WinME product preview Windows Media video file that cannot be stopped to my knowledge until it finishes. That prompt will keep popping up after an install/reinstall of WinME until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 minutes, and don't bother deleting that entry, Windows puts it right back. Not only should you disable it from running, you should delete the thing altogether, as it, somehow can re-enable itself. Apparently you can try setting the file to read only Source=Paul Collins Startup list [tourpath] Number=11185 Confirmed=N Filename=regedit /s [path] tour.reg Description=Edits registry values to keep the Win 2000 "tour" in Task Scheduler Source=Paul Collins Startup list [TP4EX] Number=11186 Confirmed=U Filename=tp4ex.exe Description=Adds accessibility options for an IBM TrackPoint Source=Paul Collins Startup list [tp4mon] Number=11187 Confirmed=U Filename=tp4mon.exe Description=Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [tp4serv] Number=11188 Confirmed=U Filename=tp4serv.exe Description=Supports the "pointer stick" on Thinkpads in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [TP98TRAY] Number=11189 Confirmed=? Filename=TP98TRAY.EXE Description=IBM Thinkpad related utility. What does it do and is it required? Source=Paul Collins Startup list [TP98UTIL] Number=11190 Confirmed=N Filename=TP98.EXE Description=IBM Thinkpad feature setup & configuration utility Source=Paul Collins Startup list [tpcupdater] Number=11191 Confirmed=X Filename=updatetc.exe Description=180Solutions adware related Source=Paul Collins Startup list [TpHotKey] Number=11192 Confirmed=U Filename=TPHKMGR.EXE Description=Activates "ThinkPad Help" when the "Thinkpad key" is pressed on an IBM ThinkPad laptop. Also activates the audio buttons (volume up/down, mute) on models such as the Thinkpad T30 Source=Paul Collins Startup list [TPKBDLED] Number=11193 Confirmed=U Filename=TpScrLk.exe Description=IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED Source=Paul Collins Startup list [TPKMAPHELPER] Number=11194 Confirmed=U Filename=TpKmapAp.exe Description=IBM Thinkpad - Keyboard Customizer Utility. Allows the user to set keyboard shortcuts, emulate such features as Windows key on laptop, can be disabled from within program, is available from Programs > Access IBM. Not required Source=Paul Collins Startup list [TpKmapMn] Number=11195 Confirmed=U Filename=TpKmapMn.exe Description=Create Keyboard combinations for special Thinkpad buttons when using an external keyboard, e.g. "Ctrl-arrow up" for "volume up". Only required when using an external keyboard. Available via Start -> Programs Source=Paul Collins Startup list [tpopservice] Number=11196 Confirmed=U Filename=tpopservice.exe Description=DirecWay two-way satellite internet service enhanced POP proxy server for email Source=Paul Collins Startup list [TPP Auto Loader] Number=11197 Confirmed=U Filename=Tppaldr.exe Description=Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD, CD-ROM and CD-RW drives. System tray icon allowing the user to disconnect the external drive without an error message being displayed Source=Paul Collins Startup list [Tprtray] Number=11198 Confirmed=U Filename=Tprtray.exe Description=Displays the Power icon in the System Tray on a Toshiba laptop Source=Paul Collins Startup list [TpScrLk] Number=11199 Confirmed=U Filename=TpScrLk.exe Description=IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED Source=Paul Collins Startup list [TpShocks] Number=11200 Confirmed=Y Filename=TpShocks.exe Description=Responsible for controlling the IBM Hard Drive Active Protection system found on newer models of IBM Thinkpads, including T41, T42, X40, R50, and R51. The Hard Drive Active Protection system is based on a technology similar to that used in automobiles to deploy airbags on contact: An accelorometer on the motherboard detects physical acceleration--such as when the notebook falls--and in response the system temporarily parks the hard drive's read/write head until stability returns Source=Paul Collins Startup list [TPSmain] Number=11201 Confirmed=U Filename=TPSMain.exe Description=Toshiba Power Saver - associated with Toshiba laptops/desktops. Manages the power save function to make sure that the system goes to a power saver mode when not used Source=Paul Collins Startup list [TPSODDCtl] Number=11202 Confirmed=Y Filename=TPSODDCtl.exe Description=Power saving software on Toshiba laptops Source=Paul Collins Startup list [TPTray] Number=11203 Confirmed=N Filename=TPTray.exe Description=Touchpad configuration tray icon for Toshiba laptops. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TPTRAY] Number=11204 Confirmed=? Filename=TP98TRAY.EXE Description=IBM Thinkpad related utility. What does it do and is it required? Source=Paul Collins Startup list [TPwrMain] Number=11205 Confirmed=Y Filename=TPwrMain.EXE Description=Power management software for Toshiba laptops Source=Paul Collins Startup list [TPwrMgr] Number=11206 Confirmed=? Filename=TPwrMgr.exe Description=Found on a Toshiba laptop. Related to power management? Source=Paul Collins Startup list [TPWRTRAY] Number=11207 Confirmed=Y Filename=Tpwrtray.exe Description=Toshiba laptop's own Advanced Power Management system which disables Windows APM (greyed-out in Control Panel). You can't choose which of the 2 systems to use Source=Paul Collins Startup list [tqrecv] Number=11208 Confirmed=U Filename=tqrecv.exe Description=Tellique satellite broadcast reception software Source=Paul Collins Startup list [Traceless] Number=11209 Confirmed=N Filename=launch.exe Description=Traceless 2003 - clear your cookies, temp directories and browser history with a click of a button. It also clears the recent documents and the IE drop down auto complete box Source=Paul Collins Startup list [Track4WinMonitor] Number=11210 Confirmed=U Filename=STMonitor.exe Description=Track4Win is a surveillance software program that takes screenshots and logs user activity such as URLs and currently running processes. It uploads the logs and screenshots to a preconfigured server. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [Tracker] Number=11211 Confirmed=? Filename=Tracker.exe Description=Possibly associated with My Deluxe Invoices program Source=Paul Collins Startup list [TrackpointSrv] Number=11212 Confirmed=U Filename=daemon.exe Description=Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [TrackpointSrv] Number=11213 Confirmed=U Filename=tp4serv.exe Description=Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [TrackPointSrv] Number=11214 Confirmed=U Filename=tp4mon.exe Description=Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [Tracks Eraser] Number=11215 Confirmed=U Filename=te.exe Description=Tracks Eraser from Acesoft - "Erases all tracks of your internet activity" Source=Paul Collins Startup list [Tracks Eraser Pro] Number=11216 Confirmed=U Filename=te.exe Description=Tracks Eraser Pro from Acesoft - "Erases all tracks of your internet activity" Source=Paul Collins Startup list [tranicon] Number=11217 Confirmed=U Filename=tranicon.exe Description=A Tweak-XP component (only in the registered version), makes Desktop icons transparent. Can be enabled/disabled via Tweak-XP -> System + File Tweaks -> Windows Tweaks -> Desktop Tweaks -> Make Desktop Icons Transparent Source=Paul Collins Startup list [Transcode360] Number=11218 Confirmed=N Filename=Transcode360Tray.exe Description=Designed for WinXP Media Center Edition 2005 and the Xbox 360, Transcode360 aims to broaden the support for a wide range of video media including DivX and XviD Source=Paul Collins Startup list [Transparent] Number=11219 Confirmed=U Filename=TransparentW.exe Description=Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Source=Paul Collins Startup list [Transparent] Number=11220 Confirmed=U Filename=TransparentD.exe Description=Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Source=Paul Collins Startup list [Transparent] Number=11221 Confirmed=U Filename=TransparentB.exe Description=Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Source=Paul Collins Startup list [TransparentIcons] Number=11222 Confirmed=U Filename=tranicon.exe Description=A Tweak-XP component (only in the registered version), makes Desktop icons transparent. Can be enabled/disabled via Tweak-XP -> System + File Tweaks -> Windows Tweaks -> Desktop Tweaks -> Make Desktop Icons Transparent Source=Paul Collins Startup list [transtask] Number=11223 Confirmed=U Filename=transtask.exe Description=A Tweak-XP component, makes the taskbar icons transparent Source=Paul Collins Startup list [Trashgrd] Number=11224 Confirmed=U Filename=TRASHGRD.EXE Description=Part of McAfee Nuts & Bolts. Protects all the files you delete, even files deleted in DOS or in 16-bit Windows applications, by sending them to the Recycle Bin Source=Paul Collins Startup list [Tray] Number=11225 Confirmed=X Filename=rundll32.exe Description=Added by the LINEAG-ADR TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98\ME) or the System32 folder(NT\2000\XP). This file is located in an "command" sub-folder Source=Paul Collins Startup list [Tray Pilot Lite] Number=11226 Confirmed=U Filename=TrayPlt.exe Description=Tray Pilot allows you to hide the System Tray window. No longer supported by the authors Source=Paul Collins Startup list [Tray Temperature] Number=11227 Confirmed=N Filename=Weatherbug.exe Description=Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Source=Paul Collins Startup list [Traybar] Number=11228 Confirmed=X Filename=lsass.exe Description=Added by the MYDOOM.L WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [traydate.exe] Number=11229 Confirmed=U Filename=TRAYDATE.EXE Description=Displays the date as well as the time in the System Tray. Available from TUCOWS Source=Paul Collins Startup list [TrayManager] Number=11230 Confirmed=U Filename=Trayman.exe Description=TrayManager hides system tray icons (FreeCell won't work when TrayMan is loaded) Source=Paul Collins Startup list [Traymin900] Number=11231 Confirmed=U Filename=Tray900.exe Description=Related to the Philips SPC webcam - System Tray manager for Personal 900 series camera Source=Paul Collins Startup list [Traymon] Number=11232 Confirmed=U Filename=traymon.exe Description=Netropa Internet Receiver traymonitor. Will only launch the bar if you are connected to the internet and there's new news Source=Paul Collins Startup list [TraySantaCruz] Number=11233 Confirmed=N Filename=tbctray.exe Description=Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TrayServer] Number=11234 Confirmed=N Filename=TrayServer.exe Description=For monitoring tray icons Source=Paul Collins Startup list [TrayX] Number=11235 Confirmed=X Filename=winppr32.exe Description=Added by the SOBIG.F WORM! Source=Paul Collins Startup list [tray_helper] Number=11236 Confirmed=N Filename=tray_helper.exe Description=Tray Helper is an Email checker with additional tools, including a popup window killer, pinger module to monitor hosts and an event reminder Source=Paul Collins Startup list [Trend Micro Anti-Spyware] Number=11237 Confirmed=U Filename=Tmas.exe Description=Trend Micro Anti-Spyware - required when using real time monitoring Source=Paul Collins Startup list [Trend Micro AntiVirus 2007] Number=11238 Confirmed=Y Filename=tavui.exe Description=Trend Micro AntiVirus Source=Paul Collins Startup list [TrendMicro Antivirus] Number=11239 Confirmed=Y Filename=Aveagent.exe Description=Virus scanner Source=Paul Collins Startup list [TrendMicro OfficeScan NT] Number=11240 Confirmed=Y Filename=TMLISTEN.EXE Description=Virus scanner Source=Paul Collins Startup list [Trickler] Number=11241 Confirmed=X Filename=[path to file] Description=GAIN adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [TridentTVIcon] Number=11242 Confirmed=Y Filename=tvicon.exe Description=Trident Microsystems, Inc Display driver Source=Paul Collins Startup list [TridTray] Number=11243 Confirmed=? Filename=TridTray.exe Description=System Tray access to Trident 4DWave soundcards? Source=Paul Collins Startup list [TridTray] Number=11244 Confirmed=? Filename=TridTray.exe Description=System Tray access to Trident 4DWave soundcards? Source=Paul Collins Startup list [Trillian] Number=11245 Confirmed=U Filename=trillian.exe Description=Part of Trillian IRC client Source=Paul Collins Startup list [trirot] Number=11246 Confirmed=Y Filename=trirot.exe Description=Trident Microsystems 3D video driver Source=Paul Collins Startup list [TRIXX] Number=11247 Confirmed=U Filename=TRIXX.exe Description=Sapphire TRIXX overclocking tool for the X800 GTO graphics card (and possiby others) - "push default clock speeds to 560MHz or better" Source=Paul Collins Startup list [Trojan Guarder Gold Version] Number=11248 Confirmed=N Filename=Trojan Guarder.exe Description=TrojanGuarder is a security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats Source=Paul Collins Startup list [Trojancheck 6 Guard] Number=11249 Confirmed=U Filename=tcguard.exe Description=TrojanCheck anti-trojan software Source=Paul Collins Startup list [TrojanScanner] Number=11250 Confirmed=U Filename=Trjscan.exe Description=Trojan Remover from Simply Super Software. Scans for an removes trojan viruses where anti-virus software may have not detected or removed Source=Paul Collins Startup list [TrojanShield] Number=11251 Confirmed=U Filename=Init.exe Description=TrojanShield Source=Paul Collins Startup list [TrojanShield Protector] Number=11252 Confirmed=U Filename=Port.exe Description=TrojanShield anti-hacker/anti-trojan software Source=Paul Collins Startup list [True Internet Color Icon] Number=11253 Confirmed=U Filename=internetcolor.exe Description=Now superseeded by ColorWizzard. Was part of 3Deep. "With True Internet Color PCs can display the best color possible over the web. Enabled web sites will know how connected monitors display color and will send them color corrected images" Source=Paul Collins Startup list [TrueCrypt] Number=11254 Confirmed=U Filename=TrueCrypt.exe Description=TrueCrypt is a free open-source disk encryption software for Windows XP/2K/2003 and Linux. This the Truecrypt background task that enables some background function of truetyp: Hot-keys, autodismount, etc Source=Paul Collins Startup list [TrueFonts] Number=11255 Confirmed=X Filename=fonts.hta Description=Browser hijacker - redirecting to Hugesearch.net Source=Paul Collins Startup list [TrueImageMonitor.exe] Number=11256 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [TrueSync Launcher] Number=11257 Confirmed=N Filename=tstool.exe Description=Starfish TrueSync - for synchronization between Windows platforms and popular devices, applications and services. Stafish became Intellisync which was acquired by Nokia and is now no longer supported Source=Paul Collins Startup list [truetype] Number=11258 Confirmed=X Filename=truetype.exe Description=Added by the COSIAM-I TROJAN! Source=Paul Collins Startup list [TrueVector] Number=11259 Confirmed=Y Filename=VSMON.EXE Description=Even if you don't have ZoneAlarm or ZoneAlarm Pro run at start-up you do need this Source=Paul Collins Startup list [Trust Cleaner] Number=11260 Confirmed=X Filename=TrustCleaner.exe Description=Smitfraud variant Source=Paul Collins Startup list [TrustIn Popups] Number=11261 Confirmed=X Filename=TrustInPopups.exe Description=TrustInPopups adware Source=Paul Collins Startup list [trustras.exe] Number=11262 Confirmed=? Filename=trustras.exe Description=Trust ADSL modem related. Is it required? Source=Paul Collins Startup list [TrustyHound-TS] Number=11263 Confirmed=X Filename=TrustyHound-TS.exe Description=TrustyHound spyware Source=Paul Collins Startup list [tsa] Number=11264 Confirmed=X Filename=tsm.exe Description=TargetSaver adware Source=Paul Collins Startup list [Tsa2] Number=11265 Confirmed=X Filename=tsm2.exe Description=TargetSaver adware Source=Paul Collins Startup list [TsAdbot] Number=11266 Confirmed=X Filename=TSADBOT.EXE Description=TimeSink Add Client - advertising spyware Source=Paul Collins Startup list [TSBxLogon] Number=11267 Confirmed=? Filename=TMESBS2.EXE Description=Found on a Toshiba laptop. May be related to TMESBS? Source=Paul Collins Startup list [TSE_PLUtil] Number=11268 Confirmed=U Filename=PLBkMon.exe Description=Prolific USB Flash Disk Log On Application Source=Paul Collins Startup list [Tsk Mng Hlp] Number=11269 Confirmed=X Filename=wins32.exe Description=Added by the AGOBOT-JB WORM! Source=Paul Collins Startup list [tskdbg] Number=11270 Confirmed=X Filename=tskdbg.exe Description=Added by the FLOOD.E TROJAN! Source=Paul Collins Startup list [Tsklist] Number=11271 Confirmed=X Filename=tsklist32.exe Description=Added by the BANCOS.SP TROJAN as reported by Kaspersky Source=Paul Collins Startup list [TSkrMain] Number=11272 Confirmed=U Filename=TSkrMain.exe Description=TOSHIBA Accelerometer Utilities - hardware utilities that work with the motion sensors built into their Tablet PCs. Detect the way you are holding it at any given moment, you can set the machine to perform a specific function when the unit is quickly tilted to the left or right, or to the front or back and you can also take control of the cursor in some applications and make it move by leaning the PC in a certain direction Source=Paul Collins Startup list [Tsl] Number=11273 Confirmed=X Filename=tsl.exe Description=Uploader-R adware Source=Paul Collins Startup list [Tsl2] Number=11274 Confirmed=X Filename=tsl2.exe Description=TargetSaver adware Source=Paul Collins Startup list [TSMsger] Number=11275 Confirmed=N Filename=TSMsger.exe Description=Epson scannner software - required for "one-touch" operation. Can be launched manually Source=Paul Collins Startup list [tsnp2std] Number=11276 Confirmed=N Filename=tsnp2std.exe Description=Digital camera related Source=Paul Collins Startup list [TSPower] Number=11277 Confirmed=? Filename=spower.drv Description=Found on a Toshiba laptop. Related to power management? Source=Paul Collins Startup list [tsrv] Number=11278 Confirmed=X Filename=t2serv.exe Description=Added by the WAREZOV.AT WORM! Source=Paul Collins Startup list [tsrv] Number=11279 Confirmed=X Filename=tsrv.exe Description=Added by the WAREZOV.W WORM! Source=Paul Collins Startup list [TSService] Number=11280 Confirmed=? Filename=NSSERVICE.EXE Description=?? Source=Paul Collins Startup list [tsvcin] Number=11281 Confirmed=X Filename=n20050308.exe Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [tsyssmon] Number=11282 Confirmed=? Filename=tsyssmon.exe Description=Found in a Toshibasysstability directory Source=Paul Collins Startup list [TSystem] Number=11283 Confirmed=X Filename=[trojan filename] Description=Added by the NSYS-A TROJAN! Source=Paul Collins Startup list [ttaa] Number=11284 Confirmed=X Filename=tata.exe Description=Added by the LINEAGE-T TROJAN! Source=Paul Collins Startup list [ttasq] Number=11285 Confirmed=? Filename=ttasq.exe Description=?? Source=Paul Collins Startup list [ttool] Number=11286 Confirmed=X Filename=scvc.exe Description=Added by the OWM TROJAN! Source=Paul Collins Startup list [TTrayp] Number=11287 Confirmed=N Filename=VTtrayp.exe Description=Part of S3 Graphics Controllers - S3 Screentoys Helper Source=Paul Collins Startup list [TTS Sync] Number=11288 Confirmed=X Filename=testtts.exe Description=Added by the SDBOT.BVA WORM! Source=Paul Collins Startup list [Ttt] Number=11289 Confirmed=X Filename=Ttt.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [ttupt] Number=11290 Confirmed=X Filename=ttupt.exe Description=eZula TopText adware Source=Paul Collins Startup list [Tukati] Number=11291 Confirmed=? Filename=TukatiRedistributor.exe Description=Tukati Digital Content Distribution. Is it required? Source=Paul Collins Startup list [tunebite] Number=11292 Confirmed=N Filename=tunebite.exe Description="Tunebite lets you make unprotected copies of copy-protected music files by recording them while they are being played". Can be launched from it's Start Menu shortcut Source=Paul Collins Startup list [TuneUp MemOptimizer] Number=11293 Confirmed=U Filename=memoptimizer.exe Description=Part of "TuneUp Utilities", specifically 2003 version. "Monitors and optimizes free memory in the background." Basically, it cleans RAM and also allows you to clear the clipboard Source=Paul Collins Startup list [TurBo] Number=11294 Confirmed=X Filename=System.Trubo.vbs Description=Added by the AUTOM-C WORM! Source=Paul Collins Startup list [TurboExplorer] Number=11295 Confirmed=U Filename=TE.exe Description=Web accelerator - "TurboExplorer 2.x is a real-time web surfing accelerator specifically designed for Internet Explorer 4/5 to achieve a faster and more effective approach to the internet". Only needed if you find it improves web browsing Source=Paul Collins Startup list [TurboLaunch] Number=11296 Confirmed=U Filename=Tlaunch.exe Description=TurboLaunch is a tool-bar style application that can be set up to run many programs and perform certain pre-programmed actions Source=Paul Collins Startup list [TurboMemoryCharger] Number=11297 Confirmed=U Filename=turbomemorycharger.exe Description=Turbo Memory Charger - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [TurboNote] Number=11298 Confirmed=N Filename=tbnote.exe Description=Post-It's on your desktop. Available via Start -> Programs Source=Paul Collins Startup list [TurboTop] Number=11299 Confirmed=U Filename=TurboTop.exe Description=TurboTop - make any window "Always on top" Source=Paul Collins Startup list [TURXP Protocol] Number=11300 Confirmed=X Filename=sps32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [tutcdchk2] Number=11301 Confirmed=X Filename=tutcdchk2.exe Description=Added by the VXGAME TROJAN! Source=Paul Collins Startup list [TV Media] Number=11302 Confirmed=X Filename=Tvm.exe Description=CleverIEHooker hijacker variant Source=Paul Collins Startup list [TV Scheduler] Number=11303 Confirmed=U Filename=TVSCHL.EXE Description=ProLink PlayTVpro TV tuner software scheduler Source=Paul Collins Startup list [TV878 Remote Control] Number=11304 Confirmed=U Filename=C7XRCtl.exe Description=Related to Kworld TV878 Tuner Source=Paul Collins Startup list [TVMD] Number=11305 Confirmed=X Filename=tvmd.exe Description=Total Velocity - "Secure commerce company that enables the 'checkout' process for our customers in order to safely and securely purchase our award winning software". Autointsalling spyware Source=Paul Collins Startup list [TvNow] Number=11306 Confirmed=U Filename=TvNow.exe Description=Application supplied with HP notebooks. It activates the S-Video port and is said to improve the quality of the output signal (resolution/timeouts) Source=Paul Collins Startup list [TvrRemote] Number=11307 Confirmed=U Filename=Remote.exe Description=Remote Control driver for LifeView internal and external TV products Source=Paul Collins Startup list [TvrSchedule] Number=11308 Confirmed=U Filename=Schedule.exe Description=Scheduler for Mercury Ez View TV Tuner Card Source=Paul Collins Startup list [Tvs] Number=11309 Confirmed=N Filename=TvsTray.exe Description=Toshiba Virtual Sound on a notebook. Allows you to change sound settings on the fly - default setting is "build-in speaker". You can also select external speaker, open type headphone, or closed type headphone. Each setting has presets for Bass, Stereo, and Clarity - which can also be changed by user if desired. Can also be launched from Start -> Programs -> Toshiba -> Utilities Source=Paul Collins Startup list [tvs_b] Number=11310 Confirmed=X Filename=tvs_b.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [tvs_b] Number=11311 Confirmed=X Filename=tvs_ln.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [tvs_re] Number=11312 Confirmed=X Filename=tvs_re_inst.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [TVTMD] Number=11313 Confirmed=X Filename=TVTMD.EXE Description=Total Velocity variant - autoinstalling spyware Source=Paul Collins Startup list [TVTunerLib] Number=11314 Confirmed=U Filename=TVTLInstTool.exe Description=Related to Sony installer tool for Sony TV tuner library Source=Paul Collins Startup list [TVWakeup] Number=11315 Confirmed=N Filename=tvwakeup.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Tvwatch] Number=11316 Confirmed=? Filename=tvwatch.exe Description=Associated with the TV-oOut option on Asus AGP or Intel graphics cards. Is it required? Source=Paul Collins Startup list [Twain image] Number=11317 Confirmed=X Filename=mmp32.exe Description=DailyWinner adware Source=Paul Collins Startup list [TWarmBay] Number=11318 Confirmed=? Filename=N/A Description=Found on a Toshiba laptop. Related to hotswap bay management? Source=Paul Collins Startup list [TWarnMsg] Number=11319 Confirmed=U Filename=twarnmsg.exe Description=Toshiba System Warning Function for Windows 98, Me, 2000 - provides notification dialog when the cooling fan stops Source=Paul Collins Startup list [TWBbtn] Number=11320 Confirmed=? Filename=N/A Description=Found on a Toshiba laptop Source=Paul Collins Startup list [TWBrowse] Number=11321 Confirmed=? Filename=TWBrowse.drv Description=Found on a Toshiba laptop. Possibly related to TWAIN drivers (ie, scanners, etc) - see this? Source=Paul Collins Startup list [Tweak Manager] Number=11322 Confirmed=? Filename=WinManager.Exe Description=WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed? Source=Paul Collins Startup list [Tweak UI] Number=11323 Confirmed=U Filename=rundll32.exe tweakui.cpl, tweakmeup Description=Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed Source=Paul Collins Startup list [Tweak UI] Number=11324 Confirmed=U Filename=rundll32.exe tweakui.cpl, tweaklogon Description=Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed Source=Paul Collins Startup list [Tweak UI] Number=11325 Confirmed=X Filename=RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup Description=Added by the SUBWOOFER TROJAN! Note - the real Tweak UI entry for this is "rundll32.exe tweakui.cpl, tweakmeup" Source=Paul Collins Startup list [Tweak UI 1.33 deutsch] Number=11326 Confirmed=U Filename=RUNDLL32.EXE TWEAKUI.CPL, TweakMeUp Description=Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed - German version Source=Paul Collins Startup list [Tweak-Me] Number=11327 Confirmed=U Filename=TWEAK-ME.exe Description=3rd party version of Miscrosoft'sTweak UI "powertoy" with many more options and controls (plus full support), designed specifically to take advantage of features in WinMe/2K and above, available from here Source=Paul Collins Startup list [Tweak-xp] Number=11328 Confirmed=U Filename=Tweak-xp.exe Description=Main program for Tweak-XP - a WinXP tweaking utility Source=Paul Collins Startup list [TweakDUN] Number=11329 Confirmed=U Filename=tweakdun.exe Description=Utility to optimize your Internet Browser Software. TweakDUN promotes faster Internet data transfer rates and faster downloads by eliminating fragmentation of data packets Source=Paul Collins Startup list [Tweaki4PU] Number=11330 Confirmed=U Filename=twksup.exe Description="Tweaki puts several Windows utilities into one easy to use program while adding hundreds of additional tweaks not found in other system tweakers" Source=Paul Collins Startup list [tweakico] Number=11331 Confirmed=? Filename=tweakico.exe Description=May be a HP program to control their icons? Source=Paul Collins Startup list [TweakMASTER] Number=11332 Confirmed=U Filename=TMTray.exe Description=TweakMASTER Internet Optimizer Source=Paul Collins Startup list [TweakYC] Number=11333 Confirmed=? Filename=TweakYC.exe Description=VideoMate TV tuner and capture card related - what does it do and is it required? Source=Paul Collins Startup list [twister] Number=11334 Confirmed=U Filename=twister.exe Description=Twister "AntiTrojanVirus" Source=Paul Collins Startup list [TwkSCardSrv] Number=11335 Confirmed=N Filename=SCardS32.Exe Description=Used with Towitoko SmartCard Readers for card recognition Source=Paul Collins Startup list [twunk service] Number=11336 Confirmed=X Filename=twunk16.exe Description=Added by the RBOT.BAT WORM! Source=Paul Collins Startup list [twunk_32] Number=11337 Confirmed=X Filename=twunk_32.exe Description=Added by the BLACKMAL.C WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Twunk_64] Number=11338 Confirmed=X Filename=twunk_64.exe Description=System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory Source=Paul Collins Startup list [tyack drive] Number=11339 Confirmed=X Filename=tyack.pif Description=Added by the RBOT-AMT WORM! Source=Paul Collins Startup list [type32] Number=11340 Confirmed=N Filename=type32.exe Description=For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings. Not required unless you have changed them Source=Paul Collins Startup list [TypingSatellite] Number=11341 Confirmed=N Filename=KBOOST.exe Description=Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs Source=Paul Collins Startup list [U.S.Robotics WLAN Adapter Configuration Utility] Number=11342 Confirmed=U Filename=USRWLAN.exe Description=U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility Source=Paul Collins Startup list [Uate] Number=11343 Confirmed=X Filename=oocs.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [UBSShell] Number=11344 Confirmed=U Filename=UBSShell.exe Description=UBS (United Bank of Switzerland) banking software Source=Paul Collins Startup list [UCmd] Number=11345 Confirmed=X Filename=fallfour.exe Description=Added by the SDBOT-AZA WORM! Source=Paul Collins Startup list [UCmore XP - The Search Accelerator] Number=11346 Confirmed=U Filename=rundll32.exe UCMTSAIE.dll, DllShowTB Description=UCmore toolbar - search accelerator Source=Paul Collins Startup list [UC_SMB] Number=11347 Confirmed=N Filename=ucstart.exe Description=Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed Source=Paul Collins Startup list [uc_start] Number=11348 Confirmed=N Filename=ucstartup.exe Description=Auto updater feature for IBM machines that tries to connect to IBM to see if there are any new drivers, patches and etc Source=Paul Collins Startup list [UD Agent] Number=11349 Confirmed=U Filename=UD.EXE Description=The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs Source=Paul Collins Startup list [UDC6cw] Number=11350 Confirmed=N Filename=UDC6cw.exe Description=DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks Source=Paul Collins Startup list [udzok] Number=11351 Confirmed=X Filename=udzou.exe Description=Added by the SDBOT-CUS WORM! Source=Paul Collins Startup list [Ueproc32] Number=11352 Confirmed=U Filename=UEPROC32.exe Description=Part of Norton Utilities - most likely associated with the Unerase Wizard in older versions Source=Paul Collins Startup list [UFD Monitor9382] Number=11353 Confirmed=X Filename=ufdlmon.exe Description=Part of USB Flashdisk software - what does it do and is it required? Source=Paul Collins Startup list [UFD Utility9382] Number=11354 Confirmed=? Filename=UFDTool.exe Description=Part of USB Flashdisk software - what does it do and is it required? Source=Paul Collins Startup list [ugon] Number=11355 Confirmed=? Filename=aockstrs.exe Description=?? Source=Paul Collins Startup list [uhvjsul.dll] Number=11356 Confirmed=X Filename=[path] rundll32.exe [path] uhvjsul.dll, mrpmvyf Description=Added by the BUSKY-G TROJAN! Source=Paul Collins Startup list [Uidler] Number=11357 Confirmed=N Filename=Uidler.exe Description=Uniloc Titlewave Browser used with some shareware Source=Paul Collins Startup list [UIWatcher] Number=11358 Confirmed=N Filename=UIWatcher.exe Description=Ashampoo's Uninstaller Suite - installation watcher. Available via Start -> Programs Source=Paul Collins Startup list [ujm] Number=11359 Confirmed=U Filename=nm32.exe Description=Stranget keystroke logger/monitoring program - remove unless you installed it yourself! Found in an "fyt" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [UKVideo2] Number=11360 Confirmed=X Filename=ukvideo2.exe Description=Adult content dialler Source=Paul Collins Startup list [Ulead AutoDetector v2] Number=11361 Confirmed=? Filename=monitor.exe Description=Related to Ulead Systems Inc.. What does it do and is it required? Source=Paul Collins Startup list [Ulead Photo Express x.0 Calendar] Number=11362 Confirmed=N Filename=calcheck.exe Description=Ulead Calendar Checker - part of Ulead Photo Express, where "x" represents the version number. Automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually Source=Paul Collins Startup list [Ultimate Cleaner] Number=11363 Confirmed=N Filename=App.exe Description=Ultimate Cleaner spyware remover - not recommended, see here Source=Paul Collins Startup list [UltimateBuddy] Number=11364 Confirmed=X Filename=UltimateBuddy.exe Description=UltimateBuddy - installs malware, or is bundled with malware Source=Paul Collins Startup list [UltimateZip Quick Start] Number=11365 Confirmed=N Filename=uzqkst.exe Description=UltimateZip - file compression utility Source=Paul Collins Startup list [Ultra Hal Assistant 4.5 Startup] Number=11366 Confirmed=N Filename=HalAsst.exe Description=Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion Source=Paul Collins Startup list [UltraDVDMon] Number=11367 Confirmed=? Filename=DVDMon.exe Description=UltraDVD DVD player software - is it required? Source=Paul Collins Startup list [Ulubione] Number=11368 Confirmed=X Filename=sys****.exe Description=Ulubione adware Source=Paul Collins Startup list [UMAX VistaAccess] Number=11369 Confirmed=N Filename=vsaccess.exe Description=VistaAccess gives you quick and easy access to scanning functions right from your desktop Source=Paul Collins Startup list [UMonit] Number=11370 Confirmed=U Filename=umonit.exe Description=Alerts when USB device is plugged in Source=Paul Collins Startup list [umxagent] Number=11371 Confirmed=Y Filename=umxagent.exe Description=Tiny Personal Firewall V4 - main engine Source=Paul Collins Startup list [umxldra] Number=11372 Confirmed=Y Filename=umxldra.exe Description=User mode executive module DLL loader - part of Tiny Personal Firewall V4 Source=Paul Collins Startup list [UMXLDRW] Number=11373 Confirmed=Y Filename=UMXLDRW.exe Description=Tiny Personal Firewall (pre V4) Source=Paul Collins Startup list [un32info] Number=11374 Confirmed=X Filename=un32info.Exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [UNERI] Number=11375 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BOO WORM! Source=Paul Collins Startup list [UnHackMe Monitor] Number=11376 Confirmed=U Filename=hackmon.exe Description=UnHackMe allows you to detect and remove a new generation of 'invisible' Trojan programs called "rootkits" Source=Paul Collins Startup list [Uniblue Quick Access] Number=11377 Confirmed=U Filename=qaccess.exe Description=Quick Access application from UniBlue Systems Ltd - "helps you account for all processes on your computer by providing an additional plug-in for the Windows task manager" Source=Paul Collins Startup list [Uniblue Registry Booster] Number=11378 Confirmed=U Filename=RegistryBooster.exe Description=Uniblue "Registry Booster is the safest and most trusted solution to clean and optimise your system, free it from registry errors and fragmented entries" Source=Paul Collins Startup list [Uniblue SpyEraser] Number=11379 Confirmed=U Filename=spyeraser.exe Description=SpyEraser from Uniblue. Spyware detection program Source=Paul Collins Startup list [uninstal] Number=11380 Confirmed=X Filename=regsvr32 image.dll Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Uninstall****] Number=11381 Confirmed=X Filename=upd.exe Description=Adult content based screen saver where **** can be any number Source=Paul Collins Startup list [UninstallAbility] Number=11382 Confirmed=N Filename=uability.exe Description=UninstallAbility free uninstaller Source=Paul Collins Startup list [UninstallHL] Number=11383 Confirmed=X Filename=PreUninstallHL.exe Description=LinkReplacer/FFinder adware Source=Paul Collins Startup list [UninstallQL] Number=11384 Confirmed=X Filename=PreUninstallQL.exe Description=LinkReplacer/FFinder adware Source=Paul Collins Startup list [Uninstall_TBPS] Number=11385 Confirmed=X Filename=TBuninst.exe Description=WebSearch Toolbar - HuntBar hijacker, toolbar installer variant Source=Paul Collins Startup list [UniPrint] Number=11386 Confirmed=U Filename=SetDfltSettings.exe Description=Drivers for Uniprint, a printing help for Terminal Services and Citrix which recieves downloaded files from a Uniprint enabled server and prints them locally allowing for truly universal printing through Terminal Services or Citrix Source=Paul Collins Startup list [UniSc] Number=11387 Confirmed=U Filename=Unisc.exe Description=McAfee UnInstaller Source=Paul Collins Startup list [uniucu] Number=11388 Confirmed=? Filename=uniucu.exe Description=?? Source=Paul Collins Startup list [Universal USB Service] Number=11389 Confirmed=X Filename=svchost32.exe Description=Added by the KELVIR.R WORM! Source=Paul Collins Startup list [Unix File Support] Number=11390 Confirmed=X Filename=init3.exe Description=Added by the RBOT-ZN WORM! Source=Paul Collins Startup list [unldr16] Number=11391 Confirmed=X Filename=unldr16.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [unldr32] Number=11392 Confirmed=X Filename=unldr32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [UnlockerAssistant] Number=11393 Confirmed=U Filename=UnlockerAssistant.exe Description=Related to Unlocker utility to unlock files when the OS reports the file is being used by an other person or program Source=Paul Collins Startup list [UnSpyPC] Number=11394 Confirmed=N Filename=UnSpyPC.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [untray] Number=11395 Confirmed=Y Filename=untray.exe Description=Command Antivirus related Source=Paul Collins Startup list [uoltray] Number=11396 Confirmed=N Filename=exec.exe Description=Netzero free ISP software - not required Source=Paul Collins Startup list [Up Service] Number=11397 Confirmed=X Filename=up32.pif Description=Added by the RBOT-ARI WORM! Source=Paul Collins Startup list [UpConfgVer] Number=11398 Confirmed=N Filename=UpgConf.exe Description=Panda Antivirus Platinum. Purpose unclear, but according to Panda Software not required for the AV to function Source=Paul Collins Startup list [Updade Windows] Number=11399 Confirmed=X Filename=winlogom.exe Description=Added by the TONAX-A TROJAN! Source=Paul Collins Startup list [UpData] Number=11400 Confirmed=X Filename=wupdata.exe Description=Added by the IRCBOT-AA TROJAN! Source=Paul Collins Startup list [Update] Number=11401 Confirmed=X Filename=[original file path] Description=Added by the LYNDEGG WORM! Source=Paul Collins Startup list [Update] Number=11402 Confirmed=X Filename=CDUpdater.exe Description="Carpe Diem" adult premium rate dialler related Source=Paul Collins Startup list [Update] Number=11403 Confirmed=X Filename=Sysupd.exe Description=Added by the SLACKBOT VIRUS! Source=Paul Collins Startup list [Update] Number=11404 Confirmed=X Filename=Zupdate.exe Description=Associated with B3d Projector foistware - see here Source=Paul Collins Startup list [Update] Number=11405 Confirmed=X Filename=mshtm.exe Description=Browser hijacker - redirecting to buldog-search.com Source=Paul Collins Startup list [Update] Number=11406 Confirmed=X Filename=UPDATE-28062004.exe[25 blank spaces].vbs Description=Added by the MIDFIN WORM! Source=Paul Collins Startup list [update] Number=11407 Confirmed=X Filename=winis.exe Description=Added by the RBOT-VD WORM! Source=Paul Collins Startup list [update] Number=11408 Confirmed=X Filename=r00t.exe Description=Added by the RBOT-ACO WORM! Source=Paul Collins Startup list [UPDATE] Number=11409 Confirmed=X Filename=WinUpdater5.0.vbs Description=Added by the GORMLEZ-A WORM! Source=Paul Collins Startup list [UpDate] Number=11410 Confirmed=X Filename=RAuth.exe Description=Added by the DLOADER-UL TROJAN! Source=Paul Collins Startup list [Update] Number=11411 Confirmed=X Filename=csrss.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Update] Number=11412 Confirmed=X Filename=csrss.exe Description=Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in a "winupdate" subfolder Source=Paul Collins Startup list [Update] Number=11413 Confirmed=X Filename=lsass.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Update] Number=11414 Confirmed=X Filename=svchost.exe Description=Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Update] Number=11415 Confirmed=X Filename=Update.exe Description=QuickButton adware Source=Paul Collins Startup list [Update] Number=11416 Confirmed=X Filename=hanz.exe Description=Added by a variant of the RBOT-GLJ WORM! Source=Paul Collins Startup list [Update Checker] Number=11417 Confirmed=X Filename=winlog.exe Description=Added by the IRCBOT-TJ TROJAN! Source=Paul Collins Startup list [Update Checker] Number=11418 Confirmed=X Filename=scvhost.exe Description=Added by the AGENT-DSF TROJAN! Source=Paul Collins Startup list [Update for Windows] Number=11419 Confirmed=X Filename=[various filenames] Description=Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif Source=Paul Collins Startup list [Update for Works] Number=11420 Confirmed=? Filename=MSWkstz.exe Description=Maybe related to later versions of MS Works? Source=Paul Collins Startup list [Update Grokster] Number=11421 Confirmed=N Filename=WiseUpdt.exe Description=Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program, for instance, Grokster contains CyDoor Source=Paul Collins Startup list [Update Install] Number=11422 Confirmed=X Filename=Schost.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Update local] Number=11423 Confirmed=? Filename=SetCPQLC.exe Description=Running on a Compaq desktop. Any ideas? Source=Paul Collins Startup list [Update Manager] Number=11424 Confirmed=N Filename=UpdateManager.exe Description=Searches for updates for the Rogers Yahoo! Browser - can be run manually Source=Paul Collins Startup list [update run dos] Number=11425 Confirmed=X Filename=logon.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Update Run MSword] Number=11426 Confirmed=X Filename=LOGON.EXE Description=Added by the RBOT.TY WORM! Source=Paul Collins Startup list [Update Service] Number=11427 Confirmed=Y Filename=Update.exe Description=Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall Source=Paul Collins Startup list [update service] Number=11428 Confirmed=X Filename=svxhost.exe Description=Added by the RBOT-MG WORM! Source=Paul Collins Startup list [Update Service] Number=11429 Confirmed=X Filename=winu32.exe Description=Added by the RBOT-MG WORM! Source=Paul Collins Startup list [update service] Number=11430 Confirmed=X Filename=winx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Update TUT] Number=11431 Confirmed=? Filename=WiseUpdt.exe Description=?? Source=Paul Collins Startup list [Update ver 1.0] Number=11432 Confirmed=X Filename=Swap.exe Description=Added by the SWAP-C WORM! Source=Paul Collins Startup list [Update Windows] Number=11433 Confirmed=X Filename=EXPLORE.EXE Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Update Windows] Number=11434 Confirmed=X Filename=EXPLORE.EXE Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Update.exe] Number=11435 Confirmed=X Filename=ravseuper.exe Description=Added by the QQPASS-P TROJAN! Source=Paul Collins Startup list [Update32] Number=11436 Confirmed=X Filename=configs.exe Description=Hijacker, also detected as the QURL-2 TROJAN! Source=Paul Collins Startup list [UpdateCheck] Number=11437 Confirmed=X Filename=winstall.exe Description=Added by the SPYBOT-CY WORM! Source=Paul Collins Startup list [UpdateComponent] Number=11438 Confirmed=X Filename=CNF UPD.EXE Description=Added by the SPYBOT.GEN VIRUS! Source=Paul Collins Startup list [UpdateFW] Number=11439 Confirmed=? Filename=fwdload.exe Description=Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module? Source=Paul Collins Startup list [UPDATEHOOK] Number=11440 Confirmed=? Filename=Rundll32.exe Description=?? Source=Paul Collins Startup list [updatelavasoft] Number=11441 Confirmed=X Filename=updatelavasoft.exe Description=CoolWebSearch parasite variant - redirecting to lalasearch.com Source=Paul Collins Startup list [UpdateManager] Number=11442 Confirmed=U Filename=sgtray.exe Description=StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups Source=Paul Collins Startup list [UpdateMedia] Number=11443 Confirmed=X Filename=UpdateMedia.exe Description=MediaUpdate foistware Source=Paul Collins Startup list [UpdateMgr] Number=11444 Confirmed=X Filename=updmgr.exe Description=Added by the SouthBeachTel premium rate adult content dialer Source=Paul Collins Startup list [updateMgr] Number=11445 Confirmed=N Filename=AdobeUpdateManager.exe Description=Automatic updates for the Adobe Reader file viewer Source=Paul Collins Startup list [updatemgr.exe] Number=11446 Confirmed=N Filename=updatemgr.exe Description=Once a month, your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software, Update Manager will inform you and, with your permission, download and install the update. Can go to http://www.earthlink.net and download the updates manually Source=Paul Collins Startup list [UPDATEMSN] Number=11447 Confirmed=X Filename=svhost.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [updater] Number=11448 Confirmed=X Filename=wupdater.exe Description=eUniverse/KeenValue adware Source=Paul Collins Startup list [updater] Number=11449 Confirmed=? Filename=updater.exe Description=?? Source=Paul Collins Startup list [Updater] Number=11450 Confirmed=X Filename=adservernow.exe Description=AdServerNow adware Source=Paul Collins Startup list [updater] Number=11451 Confirmed=X Filename=wisvc.exe Description=Added by the ORSE-A TROJAN! Source=Paul Collins Startup list [Updater Service Process] Number=11452 Confirmed=X Filename=svhost32.exe Description=Added by the AGOBOT.TY WORM! Source=Paul Collins Startup list [updater32] Number=11453 Confirmed=X Filename=winload32.exe Description=Added by the CULT.M WORM! Source=Paul Collins Startup list [updatereal] Number=11454 Confirmed=X Filename=realupdate.exe Description=Chinese originated adware Source=Paul Collins Startup list [Updates] Number=11455 Confirmed=X Filename=msupdate.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Updates from HP] Number=11456 Confirmed=N Filename=backweb*****.exe Description=See here - "messaging service that automatically sends you support information, tips, ideas, and special offers from HP and our partners, especially designed for HP and Compaq desktop computer owners". * can be any digit Source=Paul Collins Startup list [Updates from HP] Number=11457 Confirmed=N Filename=Updates from HP.exe Description=Automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [UpdateService] Number=11458 Confirmed=X Filename=wservice.exe Description=Added by the DREF-K WORM! Source=Paul Collins Startup list [Updatestats] Number=11459 Confirmed=X Filename=Updatestats.exe Description=Statblaster adware Source=Paul Collins Startup list [UpdateStats] Number=11460 Confirmed=X Filename=UpdateStats.exe Description=SeekSeek search hijacker related - see here Source=Paul Collins Startup list [updatev01] Number=11461 Confirmed=N Filename=updatev01.exe Description=Ultra-networks.com software updater/downloader Source=Paul Collins Startup list [updatewin] Number=11462 Confirmed=X Filename=update.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Updatewiz] Number=11463 Confirmed=? Filename=updatewiz.exe Description=?? Source=Paul Collins Startup list [UPDATE~1] Number=11464 Confirmed=N Filename=updatemgr.exe Description=Once a month, your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software, Update Manager will inform you and, with your permission, download and install the update. Can go to http://www.earthlink.net and download the updates manually Source=Paul Collins Startup list [upddateit] Number=11465 Confirmed=X Filename=winit.exe Description=Added by the RBOT-MS WORM! Source=Paul Collins Startup list [Updmgr] Number=11466 Confirmed=X Filename=updmgr.exe Description=eUniverse/KeenValue adware Source=Paul Collins Startup list [updmgr] Number=11467 Confirmed=X Filename=rvupdmgr.exe Description=eUniverse/KeenValue adware Source=Paul Collins Startup list [upDpacketo] Number=11468 Confirmed=X Filename=services.exe Description=Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "TEMPER" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [UpdReg] Number=11469 Confirmed=N Filename=Updreg.exe Description=Reminder to register Creative Labs SoundBlaster Live! cards Source=Paul Collins Startup list [UpdSys] Number=11470 Confirmed=X Filename=[random filename] Description=Added by the BJ TROJAN! Source=Paul Collins Startup list [Updt Service] Number=11471 Confirmed=X Filename=updt.pif Description=Added by the RBOT-AYU WORM! Source=Paul Collins Startup list [updwebmin] Number=11472 Confirmed=X Filename=updwebmin.exe Description=Added by the BACKDOOR.GEN TROJAN! Source=Paul Collins Startup list [UPERVGAS] Number=11473 Confirmed=? Filename=UPERVGAS.exe Description=?? Source=Paul Collins Startup list [Upgrade Sarvice] Number=11474 Confirmed=X Filename=sxchost.exe Description=Added by a variant of the TOFGER-I TROJAN! Source=Paul Collins Startup list [Upgrade Service] Number=11475 Confirmed=X Filename=sxchost.exe Description=Added by the TOFGER-I TROJAN! Source=Paul Collins Startup list [Upgrade Service] Number=11476 Confirmed=X Filename=winupd.exe Description=Added by the TOFGER-U TROJAN! Source=Paul Collins Startup list [upme] Number=11477 Confirmed=X Filename=[filename] Description=Added by the MUGLY.F WORM! Source=Paul Collins Startup list [Upme] Number=11478 Confirmed=X Filename=DLLMAN.EXE Description=Added by the MUGLY.I WORM! Source=Paul Collins Startup list [upnp] Number=11479 Confirmed=X Filename=upnp.exe Description=Added by the DLOADR-YT WORM! Source=Paul Collins Startup list [UPnP Manager] Number=11480 Confirmed=X Filename=upnpman.exe Description=Added by a variant of the AGOBOT WORM! Source=Paul Collins Startup list [UPNPService] Number=11481 Confirmed=X Filename=WinSVCservice.exe Description=Added by the AGOBOT.UN WORM! Source=Paul Collins Startup list [Upromise0] Number=11482 Confirmed=U Filename=Upromise0.exe Description=Upromise college savings program Source=Paul Collins Startup list [UpromiseRemindU] Number=11483 Confirmed=U Filename=wjview ...Code Description=Part of the Upromise saving scheme but associated with Ebates MoneyMaker adware so the choice is yours Source=Paul Collins Startup list [UPS] Number=11484 Confirmed=Y Filename=ups.exe Description=PowerChute v5.02 - UPS Monitoring Module (which loads iconclnt - the tray icon) Source=Paul Collins Startup list [UPS] Number=11485 Confirmed=X Filename=UPS32.exe Description=Added by the FEMOT.O WORM! Source=Paul Collins Startup list [UPSentry 2000] Number=11486 Confirmed=Y Filename=upsd.exe Description=Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss Source=Paul Collins Startup list [UPSlim] Number=11487 Confirmed=Y Filename=upsd.exe Description=Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss Source=Paul Collins Startup list [UPSMON] Number=11488 Confirmed=U Filename=UPSMON.exe Description=UPSMON Power Management software Source=Paul Collins Startup list [UPSUtl] Number=11489 Confirmed=X Filename=web.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Uptimer4] Number=11490 Confirmed=U Filename=Uptimer4.exe Description=Uptimer4 is an appbar which displays time, date, uptime, free ram, free pagefile, cpu usage, disk free space, battery power, IP addresses, TCP throughput, list of running processes, netstat and several more things Source=Paul Collins Startup list [UpTimes service] Number=11491 Confirmed=X Filename=WinUp.exe Description=Added by the RBOT-AKB WORM! Source=Paul Collins Startup list [UpToDate] Number=11492 Confirmed=X Filename=uptodate.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [upxdn] Number=11493 Confirmed=X Filename=upxdn.exe Description=Added by the AGENT.NCC TROJAN! Source=Paul Collins Startup list [upxdnd] Number=11494 Confirmed=X Filename=upxdnd.exe Description=Added by the JD-A TROJAN! Source=Paul Collins Startup list [upyxo] Number=11495 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BIX WORM! Source=Paul Collins Startup list [UrlLstCk] Number=11496 Confirmed=Y Filename=UrlLstCk.exe Description=Part of Norton Internet Security. From Symantec - "UrlLstCk.exe is a necessary file that will be present in C:\Program Files\Norton Internet Security. It is a URL Checklist. It should not be disabled" Source=Paul Collins Startup list [URLMAP] Number=11497 Confirmed=N Filename=Urlmap.exe Description=Installed by MS Money, and runs whenever you start IE. All it does is bring up an annoying sidebar (kind of like the search window) with 'financial links' when the web page supports it Source=Paul Collins Startup list [UrtSvcExe] Number=11498 Confirmed=Y Filename=Urt95Svc.exe Description="Cisco Secure URT is a virtual LAN (VLAN) assignment service that enhances LAN security by actively identifying and authenticating users and then associating them only to their specific network services and resources" Source=Paul Collins Startup list [Usb] Number=11499 Confirmed=? Filename=Usb.exe Description=HP related - not sure whether it's required Source=Paul Collins Startup list [usb] Number=11500 Confirmed=X Filename=SASS.EXE Description=Added by the FUNSTA-A TROJAN! Source=Paul Collins Startup list [USB 2.0 Driver] Number=11501 Confirmed=X Filename=updateXPSPC.exe Description=Added by the AGOBOT-RJ WORM! Source=Paul Collins Startup list [USB 2.0 Driver] Number=11502 Confirmed=X Filename=Winsys32.exe Description=Added by the AGOBOT-QM WORM! Source=Paul Collins Startup list [USB 2.0 Driver] Number=11503 Confirmed=X Filename=updateXP.exe Description=Added by the AGOBOT-QP WORM! Source=Paul Collins Startup list [USB 2.0 Driver] Number=11504 Confirmed=X Filename=winsystem.exe Description=Added by the AGOBOT-QS WORM! Source=Paul Collins Startup list [USB 2.1 Driver] Number=11505 Confirmed=X Filename=winupdate1.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [USB controller] Number=11506 Confirmed=X Filename=Svcmm32.exe Description=SvcMM backdoor parasite downloader Source=Paul Collins Startup list [USB Device] Number=11507 Confirmed=X Filename=servicelog.exe Description=Added by the WOOTBOT.CB WORM! Source=Paul Collins Startup list [USB Device] Number=11508 Confirmed=X Filename=win32usb.exe Description=Added by the FORBOT-BQ WORM! Source=Paul Collins Startup list [USB Driver4] Number=11509 Confirmed=X Filename=UpdateXP*.exe [* = random digit] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [USB Drivers1] Number=11510 Confirmed=X Filename=msupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [USB Driverz2] Number=11511 Confirmed=X Filename=msnplus1.exe Description=Added by the SDBOT-XQ WORM! Source=Paul Collins Startup list [USB Fix 1.1] Number=11512 Confirmed=X Filename=wuservices.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [USB Fixes] Number=11513 Confirmed=X Filename=wuafix.exe Description=Added by the RBOT-ABV TROJAN! Source=Paul Collins Startup list [USB Hardware Monitoring] Number=11514 Confirmed=X Filename=USBhardware.exe Description=Added by the RBOT-NN WORM! Source=Paul Collins Startup list [USB Hardware326 Monitoring] Number=11515 Confirmed=Y Filename=USBhardware326.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [USB Hardware32c Monitoring] Number=11516 Confirmed=X Filename=USBHARDWARE32C.EXE Description=Added by the RBOT-UU WORM! Source=Paul Collins Startup list [USB Host Service] Number=11517 Confirmed=X Filename=usbsvc.exe Description=Added by the RBOT-GG WORM! Source=Paul Collins Startup list [USB Hub Keyboard Patch] Number=11518 Confirmed=? Filename=SKBPATCH.EXE Description=USB HUB Update Source=Paul Collins Startup list [USB SECURITY DEVICE CoInstaller] Number=11519 Confirmed=Y Filename=JupitCo.exe Description=ButterflyMedia USB Flash drive related - required for the password security feature to work Source=Paul Collins Startup list [USB Updates] Number=11520 Confirmed=X Filename=mservices.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [USB Updates] Number=11521 Confirmed=X Filename=msfirewalls.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [USB Updates 2] Number=11522 Confirmed=X Filename=wugfixx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [USB2Check] Number=11523 Confirmed=N Filename=PCLECoInst.dll Description=Related to Pinnacle Systems Inc. CoInstaller - you can execute the USB2.0 interface check program (Usb2Check.exe file) to check if your system is a USB2.0 enabled system Source=Paul Collins Startup list [USBConfigration2] Number=11524 Confirmed=X Filename=wmmndir.exe Description=Added by the AGOBOT-SV WORM! Source=Paul Collins Startup list [UsbD] Number=11525 Confirmed=X Filename=smss32.exe Description=Adware downloader - recognized by Kaspersky antivirus as Trojan-Proxy.Win32.Agent.cj Source=Paul Collins Startup list [UsbD] Number=11526 Confirmed=X Filename=svhost32.exe Description=Added by the AGENT.IB TROJAN! Source=Paul Collins Startup list [Usbd] Number=11527 Confirmed=X Filename=usb_d.exe Description=Added by the CIDRA-A TROJAN! Source=Paul Collins Startup list [UsbD] Number=11528 Confirmed=X Filename=[path to trojan] Description=Added by the CIDRA-F TROJAN! Source=Paul Collins Startup list [USBDetector] Number=11529 Confirmed=U Filename=USBDetector.exe Description=USBDetector sets up an icon in the System Tray for a USB card which is intended to be used to eject or unplug hardware Source=Paul Collins Startup list [USBDetector] Number=11530 Confirmed=U Filename=UDetect.exe Description=USB tray icon/detection for external Belkin (and maybe other makes) under Win98 Source=Paul Collins Startup list [USBDrives] Number=11531 Confirmed=X Filename=msfirewalI.exe Description=Added by the RBOT-ABP WORM! Source=Paul Collins Startup list [usbdrv] Number=11532 Confirmed=X Filename=servicetask.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [USBHWDRV] Number=11533 Confirmed=X Filename=gam.exe Description=Added by a variant of the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBHWDRV] Number=11534 Confirmed=X Filename=msdc.exe Description=Added by a variant of the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBHWDRV] Number=11535 Confirmed=X Filename=sst4.exe Description=Added by a variant of the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBHWINFO] Number=11536 Confirmed=X Filename=mac.exe Description=Added by the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBHWINFO] Number=11537 Confirmed=X Filename=[path to trojan] Description=Added by the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBHWINFO] Number=11538 Confirmed=X Filename=sst6.exe Description=Added by the LOWZONE-I TROJAN! Source=Paul Collins Startup list [USBMMKBD] Number=11539 Confirmed=U Filename=usbmmkbd.exe Description=USB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version no longer pings a server when on-line wheras the older version did but did not transmit any user information Source=Paul Collins Startup list [USBMonit.exe] Number=11540 Confirmed=U Filename=USBMonit.exe Description=Monitors USB ports for insertion of Sandisk USB flashdrives Source=Paul Collins Startup list [usbn] Number=11541 Confirmed=X Filename=usbn.exe Description=Adult content dialer - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Small.afa Source=Paul Collins Startup list [usbn] Number=11542 Confirmed=X Filename=[path to trojan] Description=Added by the HOGIL-C TROJAN! Source=Paul Collins Startup list [USBPNP] Number=11543 Confirmed=Y Filename=USBPNP.exe Description=SiPix digital camera Twain USB driver Source=Paul Collins Startup list [USBTA] Number=11544 Confirmed=N Filename=usbtapnp.exe Description=System Tray access for the BeWAN Gazel 128 USB ISDN adapter Source=Paul Collins Startup list [USBToolTip] Number=11545 Confirmed=? Filename=USBTip.exe Description=Related to Pinnacle Systems Inc. What does it do and is it required? Source=Paul Collins Startup list [useful-soft] Number=11546 Confirmed=X Filename=svchst.exe Description=Added by the STARTPA-HH TROJAN! Source=Paul Collins Startup list [user] Number=11547 Confirmed=X Filename=user32.exe Description=Added by the BINGHE TROJAN! Source=Paul Collins Startup list [User Logger] Number=11548 Confirmed=U Filename=UsrLog.exe Description=UserLogger is a commercial surveillance software program. It logs keystrokes, programs used and computer ID information. It also captures screenshots, can hide its presence on the computer and can be disguised in the Windows Task list Source=Paul Collins Startup list [User Manager] Number=11549 Confirmed=X Filename=fcllls.exe Description=Added by the ZAGABAN-B TROJAN! Source=Paul Collins Startup list [User Services] Number=11550 Confirmed=X Filename=usersvc.exe Description=Added by the REVCUSS.A TROJAN! Source=Paul Collins Startup list [User23.exe] Number=11551 Confirmed=X Filename=DIAL.exe Description=This is a trojan trying to disguise itself as User32.dll Source=Paul Collins Startup list [User32] Number=11552 Confirmed=X Filename=[filename] Description=Added by the NETTRASH TROJAN! Source=Paul Collins Startup list [UserFaultCheck] Number=11553 Confirmed=N Filename=dumprep 0 -u Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [Userinit] Number=11554 Confirmed=X Filename=lsass.exe Description=Added by a variant of the DLOADER-TP TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files\Common Files folder Source=Paul Collins Startup list [userinit] Number=11555 Confirmed=X Filename=winlogon.exe Description=Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [Userinit] Number=11556 Confirmed=X Filename=lsass.exe Description=Added by a variant of the VIRAN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files\Common Files\System folder Source=Paul Collins Startup list [userinit] Number=11557 Confirmed=X Filename=smss.exe Description=Added by the DLOADR-B TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This trojan file is found in the Windows or Winnt folder Source=Paul Collins Startup list [userinit] Number=11558 Confirmed=X Filename=choo_003956f4 Description=Added by the PEED.16896 TROJAN! Source=Paul Collins Startup list [userinit] Number=11559 Confirmed=X Filename=ntos.exe Description=Added by the AGENT-ECU TROJAN! Source=Paul Collins Startup list [UserInit StartUp] Number=11560 Confirmed=X Filename=rpcxuisu.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [userint32] Number=11561 Confirmed=X Filename=userint32.exe Description=Added by an unidentified TROJAN via an Instant Message that says, "This was cool, check it out here." Also contains Aurora popups Source=Paul Collins Startup list [USERINTERFACE REPORT3R] Number=11562 Confirmed=X Filename=M0USE.exe Description=Added by the MYTOB.HS WORM! Source=Paul Collins Startup list [Userinterface Reporter] Number=11563 Confirmed=X Filename=fuuuucktttttt.exe Description=Added by the MYTOB-DK WORM! Source=Paul Collins Startup list [Userinterface Reporter] Number=11564 Confirmed=X Filename=srv32.exe Description=ISTBar adware Source=Paul Collins Startup list [UserSystem] Number=11565 Confirmed=X Filename=[filename] Description=CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN! Source=Paul Collins Startup list [ushli] Number=11566 Confirmed=X Filename=sscbltqu.exe Description=Obtained from an MP3 search list site. Also generates random processes on reboot Source=Paul Collins Startup list [usrgtway.exe] Number=11567 Confirmed=X Filename=syswrun4x.exe Description=Added by the MITGLIEDER.E TROJAN! Source=Paul Collins Startup list [USRobotics 802.11g Wireless Network Utility] Number=11568 Confirmed=N Filename=USRWLANG.exe Description=USRobotics Wireless Network Utility - used to configure security settings for connecting to WEP encrypted Access Point through the USR Wireless adapter. You must uncheck "Use Windows to configure my wireless settings" for the program to work properly. Has Site Survey capabilities, and reports link quality and signal strength. Not required for proper operation of the device as the features given are accessible in the network connection properties Source=Paul Collins Startup list [Usrobotics Online Registration] Number=11569 Confirmed=N Filename=?? Description=Pop-up reminding customers to register their products online at US Robotics Source=Paul Collins Startup list [USRpdA] Number=11570 Confirmed=Y Filename=USRmlnkA.exe Description=Modem driver files from US Robotics Source=Paul Collins Startup list [Usrr] Number=11571 Confirmed=X Filename=rncr.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Usrr] Number=11572 Confirmed=X Filename=rpen.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [USRSTA] Number=11573 Confirmed=? Filename=USRSTA.exe Description=Wireless Card controller. What does it do and is it required? Source=Paul Collins Startup list [USRSTA.EXE] Number=11574 Confirmed=? Filename=USRSTA.EXE Description=Wireless Card controller. What does it do and is it required? Source=Paul Collins Startup list [USSShReg] Number=11575 Confirmed=N Filename=USSSHREG.EXE Description=Registration reminder for Ulead SmartSaver Pro - compacts large graphics for web designers Source=Paul Collins Startup list [UStorag] Number=11576 Confirmed=U Filename=ustorage.exe Description=U-Storage is application software running under Microsoft Windows, it provides functions and utility to manage STF flash drive (USB drive) for security, partition, boot-ability and recovery. See note Source=Paul Collins Startup list [Ustorage] Number=11577 Confirmed=N Filename=Ustorage.exe Description=Maintenance tool (enable security functions) for a USB drive from Pretec Source=Paul Collins Startup list [Utility Ping] Number=11578 Confirmed=? Filename=UTILIT~1.EXE Description=?? Source=Paul Collins Startup list [UtilityPro] Number=11579 Confirmed=N Filename=UtilityPro.exe Description=IE search toolbars as supplied by people such as Yellow Internet and SearchBoss and written by Rawhide Search Solutions Source=Paul Collins Startup list [UTILsInst] Number=11580 Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Utopia Angel] Number=11581 Confirmed=N Filename=Angel.exe Description=Calculator for the online Utopia game Source=Paul Collins Startup list [uvnx] Number=11582 Confirmed=X Filename=uvcx.exe Description=Added by the DLOADR-AWF TROJAN! Source=Paul Collins Startup list [uvnx] Number=11583 Confirmed=X Filename=uvnx.exe Description=Added by the SMALL.CUL TROJAN! Source=Paul Collins Startup list [UVS10 Preload] Number=11584 Confirmed=U Filename=uvPL.exe Description=Related to Ulead VideoStudio video editing and DVD authoring software Source=Paul Collins Startup list [uwa7pcw] Number=11585 Confirmed=N Filename=uwa7pcw.exe Description=WinAntiVirus Pro 2007 virus software - not recommended, see here Source=Paul Collins Startup list [uwyrl] Number=11586 Confirmed=X Filename=uwyrl.exe Description=Added by the PHEL.A TROJAN! Source=Paul Collins Startup list [uwyw.exe] Number=11587 Confirmed=X Filename=yujixit.exe Description=Added by the SDBOT.BGB WORM! Source=Paul Collins Startup list [v] Number=11588 Confirmed=? Filename=WMPVer.EXE Description=Dritek System Inc. 3D Mouse related. Is it required? Source=Paul Collins Startup list [V.92 Modem On Hold] Number=11589 Confirmed=U Filename=Ltmoh.exe Description=Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet Source=Paul Collins Startup list [V0250Mon.exe] Number=11590 Confirmed=Y Filename=V0250Mon.exe Description=Part of Creative Webcam Launcher Source=Paul Collins Startup list [V128IID] Number=11591 Confirmed=Y Filename=Rundll32.exe v128iitw.dll, STB_InitTweak Description=Loads drivers for some STB graphics cards such as the STB nVIDIA TNT 16MB. Required if you don't want to experience lock-ups or error messages Source=Paul Collins Startup list [V128IITV] Number=11592 Confirmed=? Filename=?? Description=Loads drivers for some STB graphics cards. May be related to such a card with a TV out option? Source=Paul Collins Startup list [V66SHELL] Number=11593 Confirmed=? Filename=V66SHELL.EXE Description=It looks to be part of the display driver set for ASUS V3800, V6600 and V6800 display adapters. Probably a system tray quick access control? Source=Paul Collins Startup list [va10key] Number=11594 Confirmed=U Filename=va10key.exe Description=Only required if you use the 10 kay bay unit with a Sony Vaio laptop Source=Paul Collins Startup list [VaCtrls] Number=11595 Confirmed=X Filename=v7 Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Vaganza-XPloit-[User Name]"] Number=11596 Confirmed=X Filename=[user name].exe Description=Added by the GAVGENT.A WORM! Source=Paul Collins Startup list [VAGCtrl] Number=11597 Confirmed=Y Filename=VAGCTRL.EXE Description=Vexira Antivirus - virus scanner from Central Command Source=Paul Collins Startup list [VAGuard] Number=11598 Confirmed=Y Filename=VAGNT.exe Description=Vexira Antivirus - virus scanner from Central Command Source=Paul Collins Startup list [VAIO Action Setup (Server)] Number=11599 Confirmed=U Filename=VAServ.exe Description=Sony Vaio utility that auto-launches selected applications when you plug in a digital video camera, digital still camera, etc. via iLink (FireWire) or USB Source=Paul Collins Startup list [VAIO Recovery] Number=11600 Confirmed=U Filename=PartSeal.exe Description=System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere Source=Paul Collins Startup list [VAIO Update 2] Number=11601 Confirmed=U Filename=VAIOUpdt.exe Description=Related to Sony Vaio Update service. This program is non-essential process to the running of the program, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [ValidData] Number=11602 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.H TROJAN! Source=Paul Collins Startup list [valuename] Number=11603 Confirmed=X Filename=svchosts.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [vb6] Number=11604 Confirmed=X Filename=vb6.exe Description=Added by the MUGLY.D WORM! Source=Paul Collins Startup list [VBouncer] Number=11605 Confirmed=X Filename=VirtualBouncer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [VbouncerDL] Number=11606 Confirmed=X Filename=VbouncerInner****.exe [* = random char] Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [VbouncerDL] Number=11607 Confirmed=X Filename=VBouncerInner.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [VBS.Ipnuker@mm] Number=11608 Confirmed=X Filename=[worm filename].vbs Description=Added by the NUKIP WORM! Source=Paul Collins Startup list [VBS_AUTO_UPDATE] Number=11609 Confirmed=X Filename=0548656X.vbs Description=Added by the GORMLEZ-A WORM! Source=Paul Collins Startup list [VBundleOuterDL] Number=11610 Confirmed=X Filename=BundleOuter.EXE Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [VB_run] Number=11611 Confirmed=X Filename=comctl_32.exe Description=Dubious downloader from densmail.com Source=Paul Collins Startup list [VC5MediaPlayer] Number=11612 Confirmed=X Filename=csmss.exe Description=Added by the DEDLER-B WORM! Source=Paul Collins Startup list [VC5Play] Number=11613 Confirmed=N Filename=VC5Play.exe Description=Virtual CD drive emulator - version 5. Available via Start -> Programs Source=Paul Collins Startup list [VC6play] Number=11614 Confirmed=N Filename=VC6Play.exe Description=Virtual CD drive emulator - version 6. Available via Start -> Programs Source=Paul Collins Startup list [VC7Play] Number=11615 Confirmed=N Filename=VC7Play.exe Description=Virtual CD drive emulator - version 7. Available via Start -> Programs Source=Paul Collins Startup list [VC7Player] Number=11616 Confirmed=N Filename=VC7Play.exe Description=Virtual CD drive emulator - version 7. Available via Start -> Programs Source=Paul Collins Startup list [VCatch] Number=11617 Confirmed=X Filename=Vcatch.exe Description=CommonSearch Vcatch - "antivirus" software which actually bundles spy/adware itself! Source=Paul Collins Startup list [VCatch Premium] Number=11618 Confirmed=X Filename=VCatchpre.exe Description=VCatch antivirus. Considered spyware itself - see here Source=Paul Collins Startup list [VCDPlayer] Number=11619 Confirmed=N Filename=VCDPlayer.exe Description=Virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [vcdplayx] Number=11620 Confirmed=N Filename=vcdplayx.exe Description=CD emulation part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically Source=Paul Collins Startup list [VCDTower] Number=11621 Confirmed=U Filename=VCDTower.exe Description=Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200X for true multitasking Source=Paul Collins Startup list [VCDWATCH] Number=11622 Confirmed=? Filename=VCDWATCH.EXE Description=Confirmed as Voyetra CD Watcher as it was found in a Compaq/Voyetra/AS2 directory but what does it do? Source=Paul Collins Startup list [VCMnet11] Number=11623 Confirmed=X Filename=VCMnet11.exe Description=Windows AFA Internet Enhancement - a browser hijacker, redirecting to adsourcecorp.com. See here Source=Paul Collins Startup list [VCS Host] Number=11624 Confirmed=X Filename=vcshost.exe Description=Added by the RBOT-FKT WORM! Source=Paul Collins Startup list [VCSPlayer] Number=11625 Confirmed=N Filename=vcsplay.exe Description=Virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [VCXD Settings] Number=11626 Confirmed=X Filename=phqg.EXE Description=Added by the RBOT.BRF WORM! Source=Paul Collins Startup list [VC_Log] Number=11627 Confirmed=U Filename=keylog.exe Description=PaqKeylog is a surveillance software program that logs keystrokes and can run in stealth mode. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [Vdat Update] Number=11628 Confirmed=X Filename=lalaa.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [VDI Manager (HP)] Number=11629 Confirmed=? Filename=HPO0VDX05.exe Description=HP (Hewlett-Packard) related. Now - what does it do? Source=Paul Collins Startup list [vdtask] Number=11630 Confirmed=N Filename=vdtask.exe Description=Program part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically Source=Paul Collins Startup list [Vegas Palms - Launcher] Number=11631 Confirmed=N Filename=Launcher.exe Description=Vegas Palms on-line cassino Source=Paul Collins Startup list [veja_fotos.exe] Number=11632 Confirmed=X Filename=veja_fotos.exe Description=Added by the MDROP-F TROJAN! Source=Paul Collins Startup list [VERBATIM STORE 'N' G] Number=11633 Confirmed=U Filename=verbatim store 'n' go.exe Description=Loads the driver for the Verbatim Store'n'Go PRO USB Flash Drive - reportedly required only on systems running Windows 98 and Millennium Source=Paul Collins Startup list [Verif] Number=11634 Confirmed=X Filename=vxst.exe Description=Added by the NOPIR.B WORM! Source=Paul Collins Startup list [Verizon Control Pad] Number=11635 Confirmed=N Filename=cpad.exe Description=Control Pad - installed with Verizon DSL accounts. Tool designed to streamline the online experience Source=Paul Collins Startup list [Verizon Online Support Center] Number=11636 Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Verizon Online Support Center is required to run with the Help and Support program. If you uncheck Verizon Online Support Center and and then run help and Support it will add another Verizon Online Support Center in the startup menu. If you remove the Verizon Online Support Center in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [VerizonServicepoint.exe] Number=11637 Confirmed=U Filename=VerizonServicepoint.exe Description=Part of Verizon Online Support Manager Source=Paul Collins Startup list [vern16.dll] Number=11638 Confirmed=X Filename=regsvr32.exe [path] vernn16.dll Description=DailyWinner adware Source=Paul Collins Startup list [versato] Number=11639 Confirmed=U Filename=versato.exe Description="Hot" button (such as volume and browser control) management and a CD player as supplied with QTronix (as possibly Micro Innovations) keyboards Source=Paul Collins Startup list [Version] Number=11640 Confirmed=X Filename=Version.exe Description=JRAUN adware variant Source=Paul Collins Startup list [Version] Number=11641 Confirmed=X Filename=manage.exe Description=JRAUN adware variant Source=Paul Collins Startup list [version] Number=11642 Confirmed=X Filename=adl_dh.exe Description=DealHelper adware related Source=Paul Collins Startup list [Vet Alert] Number=11643 Confirmed=Y Filename=vetmsg9x.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software Source=Paul Collins Startup list [Vet Alert] Number=11644 Confirmed=Y Filename=VETMSG.EXE Description=Computer Associates Vet Anti-Virus software Source=Paul Collins Startup list [Vet Start Up] Number=11645 Confirmed=Y Filename=vet98.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system, if set too aggressively. There is no need to scan every file when opened, closed, etc. Check in InoculateIT PE options Source=Paul Collins Startup list [Vet Start Up] Number=11646 Confirmed=Y Filename=vet32.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system, if set too aggressively. There is no need to scan every file when opened, closed, etc. Check in InoculateIT PE options Source=Paul Collins Startup list [VetTray] Number=11647 Confirmed=U Filename=vettray.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. System Tray quicklaunch access, not really necessary but only occupies 36k resources Source=Paul Collins Startup list [VFW Encoder/Decoder Settings] Number=11648 Confirmed=X Filename=RUNDLL32.exe MSSIGN30.DLL ondll_reg Description=Added by the LOVGATE-W WORM! Source=Paul Collins Startup list [VGA Startup] Number=11649 Confirmed=X Filename=vgacard.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [VgaDriver] Number=11650 Confirmed=X Filename=RsrVga32.exe Description=Added by the KEYLOG-AH TROJAN! Source=Paul Collins Startup list [VGATune] Number=11651 Confirmed=X Filename=VGATune.exe Description=Added by the RBOT-AWM WORM! Source=Paul Collins Startup list [VGAUtil] Number=11652 Confirmed=U Filename=G-VGA.exe Description=Gigabyte VGA Utility - access card options (application needs to be run at startup, but is not system critical) Source=Paul Collins Startup list [vid32cntl] Number=11653 Confirmed=X Filename=vid32cntl.Exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [vidcntl] Number=11654 Confirmed=X Filename=vidcntl.Exe Description=Added by the CRYPTER.A TROJAN! Source=Paul Collins Startup list [Vidcompat] Number=11655 Confirmed=X Filename=Vidcompat.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [vidctrl] Number=11656 Confirmed=X Filename=vidctrl.exe Description=Delfin Promulgate adware variant Source=Paul Collins Startup list [Video] Number=11657 Confirmed=X Filename=explored.exe Description=Added by the GAOBOT.RF WORM! Source=Paul Collins Startup list [Video] Number=11658 Confirmed=X Filename=winamp32.exe Description=Added by the AGOBOT-NG WORM! Source=Paul Collins Startup list [Video Card Driver (do not remove)] Number=11659 Confirmed=X Filename=tsasi.exe Description=Added by the SPYBOT-EF WORM! Source=Paul Collins Startup list [Video Lan Player] Number=11660 Confirmed=X Filename=VideoLanPlayer.exe Description=Added by the RBOT-MY WORM! Source=Paul Collins Startup list [Video Manager] Number=11661 Confirmed=X Filename=videomgr.exe Description=Added by the PANDEM.C WORM! Source=Paul Collins Startup list [Video Multimedia Driver] Number=11662 Confirmed=X Filename=ndrives32.exe Description=Added by the RBOT-DK WORM! Source=Paul Collins Startup list [Video Proces] Number=11663 Confirmed=X Filename=winaps.exe Description=Added by the AGOBOT.HD WORM! Source=Paul Collins Startup list [Video Process] Number=11664 Confirmed=X Filename=sysconf.exe Description=Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS! Source=Paul Collins Startup list [Video Process] Number=11665 Confirmed=X Filename=MS32x16.exe Description=Added by the RBOT.RH WORM! Source=Paul Collins Startup list [Video Process] Number=11666 Confirmed=X Filename=netsvcs.exe Description=Added by the AGOBOT.LH WORM! Source=Paul Collins Startup list [Video Process] Number=11667 Confirmed=X Filename=MSlti64.exe Description=Added by the AGOBOT.UE WORM! Source=Paul Collins Startup list [Video Process] Number=11668 Confirmed=X Filename=[random filename] Description=Added by the RBOT-LM WORM! Source=Paul Collins Startup list [Video Process] Number=11669 Confirmed=X Filename=winasp.exe Description=Added by the AGOBOT-IS WORM! Source=Paul Collins Startup list [Video Process] Number=11670 Confirmed=X Filename=msn5.exe Description=Added by the AGOBOT-TW WORM! Source=Paul Collins Startup list [Video Process] Number=11671 Confirmed=X Filename=MStli32s.exe Description=Added by the RBOT-GAD WORM! Source=Paul Collins Startup list [Video Services] Number=11672 Confirmed=X Filename=explore.exe Description=Added by the GAOBOT.GL WORM! Source=Paul Collins Startup list [Video Services] Number=11673 Confirmed=X Filename=videol_32.exe Description=Added by the AGOBOT-DM WORM! Source=Paul Collins Startup list [Video Services] Number=11674 Confirmed=X Filename=sys32.exe Description=Added by the AGOBOT.PS WORM! Source=Paul Collins Startup list [Videocntl] Number=11675 Confirmed=X Filename=Videocntl.exe Description=Added by a variant of the GEMA.D TROJAN! Source=Paul Collins Startup list [VideoDriver] Number=11676 Confirmed=X Filename=[filename] Description=Added by the GSPOT20.A TROJAN! Source=Paul Collins Startup list [VideoDriver] Number=11677 Confirmed=X Filename=videodrv.exe Description=Added by the MIMAIL.A WORM! Source=Paul Collins Startup list [VideoDriver] Number=11678 Confirmed=X Filename=gspotbot.exe Description=Added by the SPIGOT.C TROJAN! Source=Paul Collins Startup list [Videool32] Number=11679 Confirmed=X Filename=VIDEOL32.EXE Description=Added by the AGOBOT.EC WORM! Source=Paul Collins Startup list [videoporno.exe] Number=11680 Confirmed=X Filename=videoporno.exe Description=Premium rate adult content dialer Source=Paul Collins Startup list [Videora] Number=11681 Confirmed=Y Filename=Videora.exe Description=Video Holding personal video downloading program Source=Paul Collins Startup list [vidmon] Number=11682 Confirmed=X Filename=VIDMON.EXE Description=Delfin Media Viewer adware related Source=Paul Collins Startup list [VidSvr] Number=11683 Confirmed=N Filename=vidsvr.exe Description=MS WebTV for Windows Channel Guide. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [vietato.exe] Number=11684 Confirmed=X Filename=vietato.exe Description=Adult content dialler Source=Paul Collins Startup list [VIEW POINT DRIVERS] Number=11685 Confirmed=X Filename=phqghum.exe Description=Added by the RBOT.BRX WORM! Source=Paul Collins Startup list [VIEW POINT DRIVERS FOR WIN32] Number=11686 Confirmed=X Filename=phqghu.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [ViewMgr] Number=11687 Confirmed=N Filename=ViewMgr.exe Description=Viewpoint Manager - automatic updates for ViewPoint products such as ViewPoint Media Player (as bundled with AOL, AOL Instant Messenger, Compuserve, etc). Can be run manually via Start -> Settings -> Control Panel by enabling auto-updates temporarily, re-booting and then disabling again. Not recommended as Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This may change in 2006 - read this article Source=Paul Collins Startup list [ViewpointPhotosDeviceConnect] Number=11688 Confirmed=U Filename=FotomatDeviceConnect.exe Description=Related to Viewpoint which is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 according to this article. You can remove it via Start -> Settings -> Control Panel -> Add/Remove Programs list... Source=Paul Collins Startup list [Vinny] Number=11689 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Virt.exe] Number=11690 Confirmed=X Filename=Virt.exe Description=Added by the REMADM-C TROJAN! Source=Paul Collins Startup list [VirtuaGirl] Number=11691 Confirmed=U Filename=Vg.exe Description=VirtuaGirl is a shareware program featuring scantily dressed girls on your desktop. They say hi in the morning, remind you of your appointments and dance for you on request... Source=Paul Collins Startup list [VirtuaGirl2] Number=11692 Confirmed=U Filename=VirtuaGirl2 Description=VirtuaGirl is a shareware program featuring scantily dressed girls on your desktop. They say hi in the morning, remind you of your appointments and dance for you on request... Source=Paul Collins Startup list [virtual] Number=11693 Confirmed=X Filename=winit.exe Description=Added by the MUGLY.A or MUGLY.B WORMS! Source=Paul Collins Startup list [virtual] Number=11694 Confirmed=X Filename=winprotect.exe Description=Added by the MUGLY.C WORM! Source=Paul Collins Startup list [virtual] Number=11695 Confirmed=X Filename=wini.exe Description=Added by the RBOT-YX WORM! Source=Paul Collins Startup list [Virtual Access Scheduler] Number=11696 Confirmed=U Filename=VASCHD32.EXE Description=The scheduler for mail and usenet tool Source=Paul Collins Startup list [Virtual Bouncer] Number=11697 Confirmed=X Filename=VirtualBouncer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [Virtual CD v6] Number=11698 Confirmed=X Filename=grplscd.exe Description=Added by the RBOT-AXV WORM! Source=Paul Collins Startup list [Virtual CD v6] Number=11699 Confirmed=X Filename=[random].exe Description=Added by the RBOT-AZV WORM! Source=Paul Collins Startup list [Virtual CDROM] Number=11700 Confirmed=X Filename=deamon.exe Description=Added by the RBOT.VP WORM! Source=Paul Collins Startup list [Virtual Protocol] Number=11701 Confirmed=X Filename=vr32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [virtual-ie] Number=11702 Confirmed=X Filename=winlogi.exe Description=Malware - recognized by Kaspersky antivirus as Trojan-Dropper.Win32.WinAD.h Source=Paul Collins Startup list [virtual-machine] Number=11703 Confirmed=X Filename=svchosts.exe Description=Added by the RBOT-US WORM! Source=Paul Collins Startup list [virtual-machine] Number=11704 Confirmed=X Filename=winlogin.exe Description=Added by the RBOT-VU WORM! Source=Paul Collins Startup list [virtual-machine] Number=11705 Confirmed=X Filename=wini.exe Description=Added by the RBOT-WR WORM! Source=Paul Collins Startup list [VirtualCloneDrive] Number=11706 Confirmed=N Filename=VCDDaemon.exe Description=Virtual Clone Drive, part of CloneCD CD/DVD copying sofware. Discontinued Source=Paul Collins Startup list [VirtualDrive] Number=11707 Confirmed=N Filename=VDTask.exe Description=VirtualDrive from Farstone - virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [VirtuaReminder] Number=11708 Confirmed=U Filename=VirtuaReminder.exe Description=VirtuaReminder is a tool allowing the user to create reminders for such things as important appointments, birthdays, etc Source=Paul Collins Startup list [Virtuele Katja] Number=11709 Confirmed=U Filename=VKatja.exe Description=Virtuele Katja - have an attractive moviestar parade on your Desktop and help you search the Dutch "Gouden Gids" business directory too... Source=Paul Collins Startup list [Virus] Number=11710 Confirmed=X Filename=Anti.exe Description=Added by the SEENBOT.O WORM! Source=Paul Collins Startup list [Virus Protect] Number=11711 Confirmed=X Filename=vrsprtc.exe Description=Added by the RBOT-APR WORM! Source=Paul Collins Startup list [Virus Removal Tool] Number=11712 Confirmed=X Filename=[path to trojan] Description=Added by the TOMETA-B TROJAN! Source=Paul Collins Startup list [Virus Scan] Number=11713 Confirmed=X Filename=virscana.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Virus-Burst] Number=11714 Confirmed=N Filename=Virus-Burst.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [VirusBurst] Number=11715 Confirmed=N Filename=VirusBurst.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [VirusCheckII] Number=11716 Confirmed=X Filename=AVIRCHK.EXE Description=Added by the DASMIN TROJAN! Source=Paul Collins Startup list [VirusKeeper] Number=11717 Confirmed=U Filename=VirusKeeper.exe Description=VirusKeeper uses a powerful real-time threat detection engine Source=Paul Collins Startup list [VirusRescue] Number=11718 Confirmed=N Filename=VirusRescue.exe Description=Virus program - not recommended, see here Source=Paul Collins Startup list [VirusScan Online] Number=11719 Confirmed=Y Filename=mcvsshld.exe Description=McAfee VirusScan On-line. See also the McAgentExe entry Source=Paul Collins Startup list [VirusScanMSC] Number=11720 Confirmed=? Filename=VsStat.exe Description=Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe), McAfee SecurityCenter integration or something else? Is it required? Source=Paul Collins Startup list [VirusScanner] Number=11721 Confirmed=X Filename=mnsys.exe Description=Added by the SDBOT-AFQ WORM! Source=Paul Collins Startup list [Virus_Scanner] Number=11722 Confirmed=X Filename=Virus_Cleaner.exe Description=Added by the PANOL WORM! Source=Paul Collins Startup list [visionGS] Number=11723 Confirmed=N Filename=VISIONGS.EXE Description=visionGS webcam software Source=Paul Collins Startup list [Vistascan] Number=11724 Confirmed=N Filename=vistascan.exe Description=Included in VistaScan are VistaAccess and VistaShuttle. VistaAccess gives you quick and easy access to scanning functions right from your desktop. For Windows users, you'll see a scanner icon in the Windows Tray of the Taskbar. Click this icon and a menu opens Source=Paul Collins Startup list [Visual Element FX5] Number=11725 Confirmed=X Filename=[various filenames] Description=ClearStream Accelerator adware Source=Paul Collins Startup list [VisualStudio] Number=11726 Confirmed=X Filename=msorunner.exe Description=Added by a variant of the TACTSLAY TROJAN! Source=Paul Collins Startup list [VisualTaskTips] Number=11727 Confirmed=U Filename=VisualTaskTips.exe Description="Visual Task Tips is a lightweight shell enhancement utility. It provides thumbnail preview image for each task in the Windows Taskbar" Source=Paul Collins Startup list [VisualTooltip] Number=11728 Confirmed=U Filename=VisualToolTip.exe Description=Related to VisualTooltip. Shows a thumbnail of a window by placing the mouse cursor over a button on the taskbar Source=Paul Collins Startup list [VITAL BOOT PROCESS] Number=11729 Confirmed=X Filename=taskmngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [VITAL BOOT PROCESS] Number=11730 Confirmed=X Filename=taskmnsgr.exe Description=Added by the Rbot-VY WORM! Source=Paul Collins Startup list [Vital Load Process] Number=11731 Confirmed=X Filename=Spoolsvr.exe Description=Added by the RBOT.AIF WORM! Source=Paul Collins Startup list [VividGalut] Number=11732 Confirmed=X Filename=VividGalut.exe Description=Adult content related web downloader Source=Paul Collins Startup list [vmcleaner] Number=11733 Confirmed=X Filename=gxlib.exe Description=Added by the SMALL-HS TROJAN! Source=Paul Collins Startup list [VMConsole.exe] Number=11734 Confirmed=? Filename=VMConsole.exe Description=Sony VAIO Media Console - installed on the VAIO Media Integrated Server PCs. What does it do and is it required? Source=Paul Collins Startup list [VMDFW] Number=11735 Confirmed=Y Filename=vmdfw.exe Description=VirusMD Personal Firewall. Vendor's Note: "VirusMD Personal Firewall is a micro-firewall and should not be use as your primary virus scanner or as your primary firewall. It does not pan-block incoming or outgoing data. Rather, is a diagnostic and therapeutic utility designed to help professionals save time and effort in eradicating Trojan horses" Source=Paul Collins Startup list [vmlib] Number=11736 Confirmed=X Filename=vmlib.exe Description=Added by the LOWZONE-AQ TROJAN! Source=Paul Collins Startup list [Vmmon32] Number=11737 Confirmed=X Filename=vmmon32.exe Description=Browser hijacker Source=Paul Collins Startup list [vmnetdhcp] Number=11738 Confirmed=X Filename=vmnetdhcp.exe Description=Added by the DWNLDR-GTC TROJAN! Source=Paul Collins Startup list [vmsnGraber] Number=11739 Confirmed=X Filename=VMSNGRABER.EXE Description=Added by the ENVID.B WORM! Source=Paul Collins Startup list [vmss] Number=11740 Confirmed=X Filename=vmss.exe Description=Delfin Media Viewer or "Promulgate" adware variant Source=Paul Collins Startup list [vmtuner] Number=11741 Confirmed=X Filename=gclib.exe Description=Hijacker - recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Small.fh Source=Paul Collins Startup list [vmtuner] Number=11742 Confirmed=X Filename=gglib.exe Description=Added by the QLOWZON-D TROJAN! Source=Paul Collins Startup list [VnCplUpdate] Number=11743 Confirmed=X Filename=msdm.exe Description=Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in this advisory Source=Paul Collins Startup list [vnmispoisn downloader] Number=11744 Confirmed=X Filename=vnmispoisn downloader.exe Description=SearchBarCash adware variant Source=Paul Collins Startup list [VOBID] Number=11745 Confirmed=U Filename=InstantDrive.exe Description=Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software Source=Paul Collins Startup list [VOBRegCheck] Number=11746 Confirmed=Y Filename=VOBRegCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [VoiceCenter] Number=11747 Confirmed=U Filename=AndreaVC.exe Description=Related to Andrea's Superbeam microphone utility Source=Paul Collins Startup list [voip phone] Number=11748 Confirmed=U Filename=voip phone.exe Description=Related to Acer Bluetooth VoIP phone - as optionally supplied with some of their notebooks such as the TravelMate 8200 Source=Paul Collins Startup list [VoipBuster] Number=11749 Confirmed=N Filename=VoipBuster.exe Description=VoipBuster - voice over the internet service. If you are calling a land line in one of their free destinations listed, the call will be placed at no costs at all. For all other calls, you will be asked to buy credits first Source=Paul Collins Startup list [VolPanel] Number=11750 Confirmed=U Filename=VolPanel.exe Description=Related to Creative Sound Blaster X-Fi Source=Paul Collins Startup list [Voltage Manager] Number=11751 Confirmed=X Filename=[random filename] Description=Added by the DREFFORT WORM! Source=Paul Collins Startup list [Volume Controller] Number=11752 Confirmed=X Filename=VolumeControl.exe Description=Added by the SDBOT.AYI WORM! Source=Paul Collins Startup list [Vonage] Number=11753 Confirmed=U Filename=click2call.exe Description=Vonage Voice over IP Internet phone service Source=Paul Collins Startup list [VoodooBanshee] Number=11754 Confirmed=U Filename=rundll32.exe 3DBBps.dll, BansheeLoadSettings Description=Loads the configuration settings for a 3dfx Voodoo Banshee chipset based graphics card. If you change some of the settings from default you probably need this - otherwise maybe not Source=Paul Collins Startup list [voowsmcr] Number=11755 Confirmed=? Filename=huhdir.exe Description=?? Source=Paul Collins Startup list [Vortex Tray] Number=11756 Confirmed=N Filename=asp4setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VortexTray] Number=11757 Confirmed=N Filename=au30setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VortexTray] Number=11758 Confirmed=N Filename=asp4tray.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VortexTray] Number=11759 Confirmed=N Filename=asp4setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VoyetraTray] Number=11760 Confirmed=N Filename=vtray.exe Description=This provides an abbreviated Control Group for the Turtle Beach Montego II sound functions/associated with AudioStation 3 and 32 Source=Paul Collins Startup list [VPCUserServices] Number=11761 Confirmed=U Filename=VMUSrvc.exe Description=Part of "DOS Virtual Machine Additions" for Microsoft Virtual PC, software virtualization software that allows you to run multiple PC-based operating systems simultaneously on one workstation. This process provides additional functionalities such as Shared Folders Source=Paul Collins Startup list [Vpop3 Mail Server] Number=11762 Confirmed=U Filename=vpop3.exe Description=Mail server from Paul Smith Computer Services. Runs in system tray to collect mail. Can be run from a shortcut and if it isn't running then it won't get your email! Source=Paul Collins Startup list [vptray] Number=11763 Confirmed=U Filename=vptray.exe Description=System Tray icon for Norton Anti-Virus Corporate Edition. Gives access to the options available and may not be required. Some users may have problems - refer here Source=Paul Collins Startup list [Vrmon] Number=11764 Confirmed=Y Filename=vrmonnt.exe Description=HAURI Anti-Virus Source=Paul Collins Startup list [VrSchedule] Number=11765 Confirmed=Y Filename=Vrres.exe Description=HAURI Anti-Virus Source=Paul Collins Startup list [VS.VSN] Number=11766 Confirmed=Y Filename= Description=Part of eSafe antivirus "SmartScan" - alerts the user if files have been changed/added Source=Paul Collins Startup list [vsadmin] Number=11767 Confirmed=X Filename=smrs.exe Description=Added by the AGOBOT-RC WORM! Source=Paul Collins Startup list [Vsample] Number=11768 Confirmed=X Filename=winxpsock.exe Description=Added by the SDBOT.BLK WORM! Source=Paul Collins Startup list [vscanner] Number=11769 Confirmed=X Filename=spooll32.exe Description=Added by the OPTIXPRO.10 TROJAN! Source=Paul Collins Startup list [vschost] Number=11770 Confirmed=X Filename=vschosts.exe Description=Added by the VIPSY-A TROJAN! Source=Paul Collins Startup list [VsEcomrEXE] Number=11771 Confirmed=N Filename=VSECOMR.EXE Description=From McAfee VirusScan up to version 4.x. This executable is responsible for the periodic "update" prompts Source=Paul Collins Startup list [Vshwin32EXE] Number=11772 Confirmed=Y Filename=VSHWIN32.EXE Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [VSN] Number=11773 Confirmed=N Filename=VSN.exe Description=Software to share photographs across the internet Source=Paul Collins Startup list [vsnpstd3] Number=11774 Confirmed=Y Filename=vsnpstd3.exe Description=Sonix Inc. Camera Monitor MFC Application Source=Paul Collins Startup list [VSOCheckTask] Number=11775 Confirmed=Y Filename=MCMNHDLR.EXE Description=Part of McAfee's SecurityCenter and Virusscan Online. Must be enabled for scanning to work Source=Paul Collins Startup list [VSP32 Controls] Number=11776 Confirmed=X Filename=vsp32.exe Description=Added by the RBOT-VA WORM! Source=Paul Collins Startup list [vspdfprsrv.exe] Number=11777 Confirmed=N Filename=vspdfprsrv.exe Description=Visage PDF Printer Source=Paul Collins Startup list [VsStatEXE] Number=11778 Confirmed=Y Filename=VSSTAT.EXE Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [vst] Number=11779 Confirmed=X Filename=vstkmgr.exe Description=Added by the AGOBOT.SK WORM! Source=Paul Collins Startup list [vTPass] Number=11780 Confirmed=N Filename=vtpassld.exe Description=Part of vTrails - a live media delivery solution. vTPass is the driver enabling the system to work. If unavailable via Start -> Programs, create your own shortcut for the "vtpass.exe" file Source=Paul Collins Startup list [VTPreset] Number=11781 Confirmed=U Filename=VTPreset.exe Description=Savage Pro S3 graphics software Source=Paul Collins Startup list [VTTimer] Number=11782 Confirmed=U Filename=VTTimer.exe Description=Driver file for the on-board VIA/S3G KM400/KN400 graphics which enables TV in/out communication Source=Paul Collins Startup list [vTunerStartUp] Number=11783 Confirmed=N Filename=vTuner.exe Description=vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet" Source=Paul Collins Startup list [vuaaa] Number=11784 Confirmed=X Filename=reg.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [VVSN] Number=11785 Confirmed=X Filename=VVSN.exe Description=WhenU.Save adware Source=Paul Collins Startup list [VX Audio] Number=11786 Confirmed=X Filename=vxaudio.exe Description=Added by the VANEBOT-AI WORM! Source=Paul Collins Startup list [VX1000] Number=11787 Confirmed=? Filename=vVX1000.exe Description=Associated with Microsoft's VX-1000 LifeCam webcams. What does it do and is it required? Source=Paul Collins Startup list [VX3000] Number=11788 Confirmed=? Filename=vVX3000.exe Description=Associated with Microsoft's VX-1000 LifeCam webcams. What does it do and is it required? Source=Paul Collins Startup list [VX6000] Number=11789 Confirmed=? Filename=vVX6000.exe Description=Associated with Microsoft's VX-1000 LifeCam webcams. What does it do and is it required? Source=Paul Collins Startup list [VZAccess Manager] Number=11790 Confirmed=U Filename=VZAccess Manager.exe Description=Verizon Access manager for enterprises Source=Paul Collins Startup list [VZRemoteCommander] Number=11791 Confirmed=U Filename=AvRmtCtr.exe Description=Related to Sony's VAIO Zone Remote Commander. A non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems Source=Paul Collins Startup list [W1N32.DLL] Number=11792 Confirmed=X Filename=WINLOGON .exe Description=Added by the DROPPERFL.A TROJAN! Source=Paul Collins Startup list [w32] Number=11793 Confirmed=X Filename=w32.exe Description=Added by the SOKEVEN TROJAN! Source=Paul Collins Startup list [W32.Scran] Number=11794 Confirmed=X Filename=Scran.exe Description=Added by the NARCS WORM! Source=Paul Collins Startup list [w32alanis] Number=11795 Confirmed=X Filename=mope.scr Description=Added by the SINALA WORM! Source=Paul Collins Startup list [W32data] Number=11796 Confirmed=X Filename=eworo.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [W32Load] Number=11797 Confirmed=X Filename=[random filename].scr Description=Added by the CASPID WORM! Source=Paul Collins Startup list [W32PluginsDownloaderXMLHTTPSelfClearing7520] Number=11798 Confirmed=X Filename=wiper.exe Description=Added by the PROXYSER-M TROJAN! Source=Paul Collins Startup list [w32sup] Number=11799 Confirmed=X Filename=w32sup.exe Description=Adult content dialler Source=Paul Collins Startup list [W32SYS] Number=11800 Confirmed=X Filename=w32sys.exe Description=Added by the JAMBU-A WORM! Source=Paul Collins Startup list [W32Tc] Number=11801 Confirmed=X Filename=WTC32.scr Description=Added by the VOTE.D or VOTE.K WORMS! Source=Paul Collins Startup list [W3KNetwork] Number=11802 Confirmed=X Filename=rundll32.exe w3knet.dll, dllinitrun Description=Advertising spyware. Check here for more info on this particular one Source=Paul Collins Startup list [W75P2PSERVER] Number=11803 Confirmed=Y Filename=W75P2PS.EXE Description=Printer utility which is required in order to make the printer work correctly Source=Paul Collins Startup list [W815DM] Number=11804 Confirmed=U Filename=W815DM.exe Description=Enuff Parental Control Software by Akrontech Source=Paul Collins Startup list [w98Eject] Number=11805 Confirmed=U Filename=w98Eject.exe Description=Related to USB support for Sigmatel MP3 audio palyer (and others such as SanDisk). It's intent is to "put away" the "disk" before you unplug it from the USB port, ostensibly to avoid "losing" data Source=Paul Collins Startup list [wait4IP] Number=11806 Confirmed=U Filename=wait4IP.exe Description=Packard Bell net2Plug allows you to network PCs anywhere in your house Source=Paul Collins Startup list [wallchgr.exe wstart] Number=11807 Confirmed=U Filename=Wallchgr.exe Description=WallChanger - wallpaper changer from Blue Tree Software Source=Paul Collins Startup list [WallPaper] Number=11808 Confirmed=X Filename=taskimgr.exe Description=Added by the BANKER-GX TROJAN! Source=Paul Collins Startup list [WallPaper] Number=11809 Confirmed=U Filename=WALLPA~1.EXE Description=Wallpaper Changer - wallpaper manager that can change your background images on every startup Source=Paul Collins Startup list [WallpaperChanger] Number=11810 Confirmed=U Filename=Wallpaper.exe Description=A wallpaper changer and manager utility. There is the Freeware version and the Pro version. The freeware version is completely free. The Pro version is 30-day trialware, and after the 30 days some of the more advanced features will be disabled unless you register it Source=Paul Collins Startup list [Wanadoo Messenger.exe] Number=11811 Confirmed=N Filename=Wanadoo Messenger.exe Description=Wanadoo ISP instant messenger client Source=Paul Collins Startup list [WanMPSvc] Number=11812 Confirmed=Y Filename=WanMPSvc.exe Description=An AOL component, the Wan miniport (ATW) service. If you delete this and logon, AOL reports a problem with your internet connection, and reinstalling AOL doesn't help Source=Paul Collins Startup list [WAPI] Number=11813 Confirmed=X Filename=wts**.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [War FTPD Tray Icon] Number=11814 Confirmed=N Filename=wartray.exe Description=War-ftpd - FTP server Source=Paul Collins Startup list [war-ftpd.exe] Number=11815 Confirmed=N Filename=WAR-FTPD.EXE Description=War FTP Daemon from JGAA's Internet - FTP client Source=Paul Collins Startup list [Wardo] Number=11816 Confirmed=X Filename=syslaunch.exe Description=Added by the ADCLICKER.G TROJAN! Source=Paul Collins Startup list [WareOut] Number=11817 Confirmed=X Filename=WareOut.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [warez] Number=11818 Confirmed=N Filename=warez.exe Description=Warez P2P client Source=Paul Collins Startup list [Warner] Number=11819 Confirmed=U Filename=warner.exe Description=Also known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files Source=Paul Collins Startup list [Warnet] Number=11820 Confirmed=U Filename=warnet.exe Description=Warnet - system cleanup software Source=Paul Collins Startup list [Warning: do not remove it!] Number=11821 Confirmed=U Filename=fpplock.exe Description=Part of Folder Password Expert by ZQS Software Team - "a software program to restrict access to the folders that contain your sensitive data" Source=Paul Collins Startup list [Warning: do not remove it! (system)] Number=11822 Confirmed=Y Filename=cfpsys.exe Description=Folder Password Protect - a program that lets you set a password on folders of your choice Source=Paul Collins Startup list [WarReg_PopUp] Number=11823 Confirmed=N Filename=WarReg_PopUp.exe Description=Acer warranty registration popup Source=Paul Collins Startup list [WARSVR] Number=11824 Confirmed=N Filename=war-ftpd.exe Description="War FTP Daemon - the original free FTP server for windows" Source=Paul Collins Startup list [WashAndGo - Cleanup of old Backupfiles] Number=11825 Confirmed=U Filename=checker.exe Description=WashAndGo - temp file cleaner Source=Paul Collins Startup list [Washer] Number=11826 Confirmed=U Filename=washer.exe Description=Window Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [Washerie.exe] Number=11827 Confirmed=N Filename=washerie.exe Description=Cookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer, specific for cleaning the IE cache and cookies. Available via Start -> Programs Source=Paul Collins Startup list [washindex] Number=11828 Confirmed=U Filename=washidx.exe Description=Window Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [Wast] Number=11829 Confirmed=X Filename=wast.exe Description=Grokster ads updater Source=Paul Collins Startup list [Watch] Number=11830 Confirmed=N Filename=watch.exe Description=Found to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted Source=Paul Collins Startup list [Watch] Number=11831 Confirmed=U Filename=1200UBWATCH.EXE Description=Button press monitor for the Mustek 1200 UB Scanner Source=Paul Collins Startup list [Watch Dog Program] Number=11832 Confirmed=N Filename=watchdog.exe Description=For Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do Source=Paul Collins Startup list [Watchdog] Number=11833 Confirmed=N Filename=Watchdog.exe Description=Definitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others), launches from the Startup folder in the Start Menu, but not required as they give instructions on removing it on their webpage Source=Paul Collins Startup list [WatchDog] Number=11834 Confirmed=? Filename=watchdog.exe Description=Part of Motorola "Mobile Phone Tools" v3 - in a "Mobiile Phone Tools" sub-directory of Program Files Source=Paul Collins Startup list [WatchDog] Number=11835 Confirmed=? Filename=DVDCheck.exe Description=Related to an Intervideo program. What does it do and is it required in startup? Source=Paul Collins Startup list [WaveTop Launcher] Number=11836 Confirmed=N Filename=WaveTop.exe Description=WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Source=Paul Collins Startup list [WaveTop Receiver 1] Number=11837 Confirmed=N Filename=N/A Description=WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Source=Paul Collins Startup list [WaveTop Receiver 2] Number=11838 Confirmed=N Filename=N/A Description=WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Source=Paul Collins Startup list [WaveTop Upload Manager] Number=11839 Confirmed=N Filename=N/A Description=WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Source=Paul Collins Startup list [Wbiff] Number=11840 Confirmed=N Filename=Wbiff.exe Description=Wbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received Source=Paul Collins Startup list [Wbutton] Number=11841 Confirmed=U Filename=Wbutton.exe Description=Turns on and off the integrated WiFi on Acer (and other laptops) Source=Paul Collins Startup list [WCESCOMM] Number=11842 Confirmed=N Filename=WCESCOMM.EXE Description=Active sync for use with Windows CE based palm PC Source=Paul Collins Startup list [WCESMngr] Number=11843 Confirmed=X Filename=spoolsb.exe Description=Added by the AGOBOT-QZ WORM! Source=Paul Collins Startup list [WCESMngr] Number=11844 Confirmed=X Filename=WCEMNGR.EXE Description=Added by the AGOBOT-QX WORM! Source=Paul Collins Startup list [wcmdmgr] Number=11845 Confirmed=U Filename=wcmdmgrl.exe Description=Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [wcmdmgr.exe] Number=11846 Confirmed=N Filename=wcmdmgr.exe Description=Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [wcmdmgrl] Number=11847 Confirmed=U Filename=wcmdmgrl.exe Description=Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [WCOLOREAL] Number=11848 Confirmed=U Filename=coloreal.exe Description=Makes colours sharper and brighter, but will only work with coloreal capable monitors Source=Paul Collins Startup list [WCPC] Number=11849 Confirmed=? Filename=wintsvcc.exe Description=?? Source=Paul Collins Startup list [WCPI] Number=11850 Confirmed=X Filename=wintsvit.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WCPS] Number=11851 Confirmed=X Filename=Wint**.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WCPT] Number=11852 Confirmed=X Filename=wintsvtr.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [wcsys] Number=11853 Confirmed=X Filename=wcsys.exe Description=Added by the KEYLOG-AP TROJAN! Source=Paul Collins Startup list [WD Button Manager] Number=11854 Confirmed=U Filename=WDBtnMgr.exe Description=Button manager installed with a western digital external disk drive. Allows you to back up your system with one click Source=Paul Collins Startup list [wdfmgr32.exe] Number=11855 Confirmed=X Filename=wdfmgr32.exe Description=Added by the DWNLDR-FVL TROJAN! Source=Paul Collins Startup list [WDInfo] Number=11856 Confirmed=X Filename=wdinfo.exe Description=Added by the DLUCA.B TROJAN! Source=Paul Collins Startup list [WDNS SYSTEM] Number=11857 Confirmed=X Filename=nibie.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [WDNS SYSTEM] Number=11858 Confirmed=X Filename=skybotx.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [WDNS SYSTEM] Number=11859 Confirmed=X Filename=wdns33.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [wdskctl] Number=11860 Confirmed=X Filename=wdskctl.exe Description=IEPlugin spyware Source=Paul Collins Startup list [wdwctrl] Number=11861 Confirmed=X Filename=wdwctrl.exe Description=Added by the DLUCA.E TROJAN! Source=Paul Collins Startup list [WEATHER] Number=11862 Confirmed=N Filename=WEATHER.EXE Description=Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Source=Paul Collins Startup list [WeatherCast] Number=11863 Confirmed=N Filename=Weather.exe Description=Weather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight Source=Paul Collins Startup list [WeatherOnTray] Number=11864 Confirmed=X Filename=WeatherOnTray.exe Description=Hotbar's Weather Forecast tool for your desktop - adware Source=Paul Collins Startup list [WeatherOnTray] Number=11865 Confirmed=X Filename=SbWeatherOnTray.exe Description=Related to Hotbar's Weather Forecast tool for your desktop Source=Paul Collins Startup list [Weatherscope] Number=11866 Confirmed=N Filename=Weatherscope.exe Description=WeatherScope - "displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!" Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [WeatherWatcher] Number=11867 Confirmed=N Filename=ww.exe Description=WeatherWatcher - weather reporting in the System Tray Source=Paul Collins Startup list [web] Number=11868 Confirmed=X Filename=******.exe [* = random char] Description=Added by a variant of the EASTO.A TROJAN! Source=Paul Collins Startup list [WEB DRIVERS FOR WIN32] Number=11869 Confirmed=X Filename=phqgh.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Web Offer] Number=11870 Confirmed=X Filename=ezPopStub.exe Description=eZula TopText adware Source=Paul Collins Startup list [Web Offer] Number=11871 Confirmed=X Filename=ezStub.exe Description=eZula TopText adware Source=Paul Collins Startup list [Web Offer] Number=11872 Confirmed=X Filename=EZSTUB22.EXE Description=eZula TopText adware Source=Paul Collins Startup list [Web Offer] Number=11873 Confirmed=X Filename=vl_ezstub.exe Description=eZula TopText adware Source=Paul Collins Startup list [Web Search] Number=11874 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Web Service] Number=11875 Confirmed=X Filename=[random filename].exe Description=Added by the ADMINCASH TROJAN! Source=Paul Collins Startup list [Web Service] Number=11876 Confirmed=X Filename=sm.exe Description=Added by the BUBE-F VIRUS! Source=Paul Collins Startup list [Web Service] Number=11877 Confirmed=X Filename=MSXMIDI.EXE Description=CoolWebSearch parasite variant, identified by Kaspersky as TrojanDropper.Win32.Small.cw Source=Paul Collins Startup list [Web2Pop] Number=11878 Confirmed=U Filename=Web2Pop.exe Description=Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client Source=Paul Collins Startup list [web3trap] Number=11879 Confirmed=Y Filename=web3trap.exe Description=PC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [webalize] Number=11880 Confirmed=X Filename=webalize.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [WebArmyKnife] Number=11881 Confirmed=N Filename=WAK.exe Description=Web Army Knife - a suite of web site developer's tools Source=Paul Collins Startup list [webassist] Number=11882 Confirmed=X Filename=webassist.exe Description=Adware popup generator Source=Paul Collins Startup list [webcam] Number=11883 Confirmed=X Filename=webcam.exe Description=Added by the MONAD-A TROJAN! Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Webcam Go Sti Service Application] Number=11884 Confirmed=? Filename=wbcgosvc.exe Description=Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required? Source=Paul Collins Startup list [WebcamRT.exe] Number=11885 Confirmed=N Filename=WEBCAMRT.exe Description=For Logitech Web Cams. Not required - camera works fine without it Source=Paul Collins Startup list [Webcelerator] Number=11886 Confirmed=X Filename=webcel.exe Description=Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here Source=Paul Collins Startup list [WebCheck] Number=11887 Confirmed=X Filename=WebCheck.pif Description=Added by the CONE.C or CONE.F WORMS! Source=Paul Collins Startup list [WebCpr0] Number=11888 Confirmed=X Filename=WebCpr0.exe Description=WebRebates adware Source=Paul Collins Startup list [Webdav.exe] Number=11889 Confirmed=X Filename=webdav.exe Description=IRC DDoS bot which gives the hacker full control over your system Source=Paul Collins Startup list [WebExRemoteAccessAgent] Number=11890 Confirmed=U Filename=raagtapp.exe Description=Related to Web Meetings from WebEx Communications, Inc. Share and present online with anyone, anywhere Source=Paul Collins Startup list [WebHancer Agent] Number=11891 Confirmed=X Filename=whagent.exe Description=System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here Source=Paul Collins Startup list [webHancer Survey Companion] Number=11892 Confirmed=X Filename=whSurvey.exe Description=WebHancertrackware - traffic measurement service that uses a client agent that is stealth installed on user machines, gathering detailed data about sites visited, their performance and, most important, what the user actually does while there Source=Paul Collins Startup list [WebInstall] Number=11893 Confirmed=X Filename=WebInstall.exe Description=ClipGenie adware downloader Source=Paul Collins Startup list [WebInstall2] Number=11894 Confirmed=X Filename=WebInstall.exe Description=ClipGenie adware downloader Source=Paul Collins Startup list [WebKey] Number=11895 Confirmed=N Filename=WebKey.exe Description=WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet Source=Paul Collins Startup list [WebLink] Number=11896 Confirmed=N Filename=WebLink.exe Description=Softex is a "cost-effective way to provide software updates, technical support or new product information to specific end-users - it can silently provide end-users with software updates, technical support and new product information customized to their specific needs through a persistent link" Source=Paul Collins Startup list [WebOutfitterTray] Number=11897 Confirmed=N Filename=sttray.exe Description=Intel WebOutfitter service System Tray icon Source=Paul Collins Startup list [Webposition Gold 2] Number=11898 Confirmed=N Filename=wpsche~1.exe Description=Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines Source=Paul Collins Startup list [WebRebates0] Number=11899 Confirmed=X Filename=WebRebates0.exe Description=WebRebates adware Source=Paul Collins Startup list [WebRun] Number=11900 Confirmed=X Filename=[random filename] Description=Added by the ADWARELOADER TROJAN! Source=Paul Collins Startup list [websaverlive] Number=11901 Confirmed=U Filename=websaverlive.exe Description=WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle Source=Paul Collins Startup list [WebSavingsfromEbates] Number=11902 Confirmed=X Filename=WebSavingsfromEbatesrun.exe Description=Web Savings From Ebates Software, a shopping tool that opens pop-up windows Source=Paul Collins Startup list [WebSavingsFromEbates0] Number=11903 Confirmed=X Filename=WebSavingsFromEbates0.exe Description=Web Savings From Ebates Software, a shopping tool that opens pop-up windows Source=Paul Collins Startup list [WebScan] Number=11904 Confirmed=U Filename=DEFSCANGUI.EXE Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [webscan] Number=11905 Confirmed=U Filename=stopsignav.exe Description=eAcceleration Stop-Sign security software related. Previously not recommended, see here Source=Paul Collins Startup list [WebScanX] Number=11906 Confirmed=Y Filename=WebScanX.exe Description=From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [websearch] Number=11907 Confirmed=X Filename=wjview ...websearch.exe Description="Web Savings" From Ebates Software, a shopping tool that opens pop-up windows Source=Paul Collins Startup list [WebSecureAlert] Number=11908 Confirmed=N Filename=WebSecureAlert.exe Description=WebSecureAlert - "helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings, and can help to protect your privacy by deleting your web surfing history on a regular basis". Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here Source=Paul Collins Startup list [WebServer] Number=11909 Confirmed=? Filename=VBI_SE~1.EXE Description=Related to a Pinnacle sound card. What does it do and is it needed? Source=Paul Collins Startup list [Webshots] Number=11910 Confirmed=U Filename=Webshots Tray.exe Description=Webshots - software that displays photos as your screensaver and wallpaper, and provides tools for sharing your personal photos on the web Source=Paul Collins Startup list [Webshots] Number=11911 Confirmed=U Filename=websho~1.exe Description=Webshots - software that displays photos as your screensaver and wallpaper, and provides tools for sharing your personal photos on the web Source=Paul Collins Startup list [Webshots] Number=11912 Confirmed=U Filename=Launcher.exe Description=Webshots - software that displays photos as your screensaver and wallpaper, and provides tools for sharing your personal photos on the web Source=Paul Collins Startup list [Webshots] Number=11913 Confirmed=U Filename=WebshotsTray.exe Description=Webshots - software that displays photos as your screensaver and wallpaper, and provides tools for sharing your personal photos on the web Source=Paul Collins Startup list [Website Administrator Info] Number=11914 Confirmed=X Filename=webadmin.exe Description=Added by the FORBOT-FY WORM! Source=Paul Collins Startup list [WebSpecials] Number=11915 Confirmed=X Filename=rundll32 [path] webspec.dll Description=WebSpecials spyware Source=Paul Collins Startup list [Websx] Number=11916 Confirmed=X Filename=Int*****.exe Description=Adult content dialler - where ***** are random Source=Paul Collins Startup list [Webtrap] Number=11917 Confirmed=Y Filename=webtrap.exe Description=Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating Source=Paul Collins Startup list [WebTrapNT.exe] Number=11918 Confirmed=Y Filename=WebTrapNT.exe Description=Part of PC-Cillin Anti-Virus software. Checks visited web-sites for malicious Java and ActiveX elements Source=Paul Collins Startup list [WebWasher] Number=11919 Confirmed=U Filename=wwasher.exe Description=Free Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs Source=Paul Collins Startup list [WeirdOnTheWeb] Number=11920 Confirmed=X Filename=WeirdOnTheWeb.exe Description=Added by the WeirdOnTheWeb adware Source=Paul Collins Startup list [Welcome] Number=11921 Confirmed=N Filename=Welcome.exe Description=Launches the Welcome to Windows tutorial on boot up Source=Paul Collins Startup list [WEPstat] Number=11922 Confirmed=? Filename=Wepstat.exe Description=Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be "U". Can anybody confirm this? Source=Paul Collins Startup list [wersds] Number=11923 Confirmed=X Filename=doriot.exe Description=Added by the JECT.C TROJAN! Source=Paul Collins Startup list [wersds.exe] Number=11924 Confirmed=X Filename=doriot.exe Description=Added by the BAGLEDI-A TROJAN! Source=Paul Collins Startup list [wesumu] Number=11925 Confirmed=X Filename=wiustv.exe Description=Added by the QQPASS-L TROJAN! Source=Paul Collins Startup list [WetSock] Number=11926 Confirmed=N Filename=wetsock.exe Description=RoboMagic Wetsock - weather reporting in the System Tray Source=Paul Collins Startup list [wextract_cleanup0] Number=11927 Confirmed=N Filename=advpack.dll, DelNodeRunDLL32 [path] [filename].TMP Description=Wextract Cleanup0 is valid and legal software included or sold to help clean up temporary or cab files created by the installer software for a wide variety of software. It should disapear after a restart of the system. If not fix it Source=Paul Collins Startup list [WFGStartup] Number=11928 Confirmed=N Filename=WFGStartup.exe Description=World Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones" Source=Paul Collins Startup list [wfips] Number=11929 Confirmed=U Filename=iphider.exe Description=ICQ (messaging/chat program) anti-bomb software. "WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed." For more information about ICQ bombs see here Source=Paul Collins Startup list [WFXCTL32.EXE] Number=11930 Confirmed=N Filename=WFXCTL32.EXE Description=From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [wfxsnt40] Number=11931 Confirmed=Y Filename=wfxsnt40.exe Description=WinFax 10.0 and maybe earlier versions. The program that opens the port for WinFax and not normally in the start menu. Needed if you want to run WinFax Source=Paul Collins Startup list [WFXSwtch] Number=11932 Confirmed=? Filename=WFXSWTCH.exe Description=Related to WinFax. What does it do and is it required? Source=Paul Collins Startup list [WG111v2 Smart Wizard Wireless Setting] Number=11933 Confirmed=U Filename=RtlWake.exe Description=Configuration utility for the Netgear WG111 54 Mbps Wireless USB 2.0 Adapter that "provides wireless access to your desktop or notebook PC through the computer's USB port" Source=Paul Collins Startup list [WG511WLU] Number=11934 Confirmed=Y Filename=WG511WLU.exe Description=Netgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card Source=Paul Collins Startup list [wgeax] Number=11935 Confirmed=X Filename=wgeax.exe Description=Added by the IRCBOT-TM WORM! Source=Paul Collins Startup list [wgs3] Number=11936 Confirmed=X Filename=wgs3.exe Description=Added by the LEGMIR-AQH TROJAN! Source=Paul Collins Startup list [WGV] Number=11937 Confirmed=X Filename=WGV.exe Description=Added by the ZIPPIE TROJAN! Source=Paul Collins Startup list [WGWLocalManager] Number=11938 Confirmed=U Filename=WGWLocalManager.exe Description=Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creating a shortcut, running it only when connecting to the internet. If internet is used often, it's recommended to leave it in startup so it starts with the system Source=Paul Collins Startup list [WgwMngr] Number=11939 Confirmed=Y Filename=WgwMngr.exe Description=Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so Source=Paul Collins Startup list [whagent] Number=11940 Confirmed=X Filename=whagent.exe Description=System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here Source=Paul Collins Startup list [WhatPulse] Number=11941 Confirmed=U Filename=WHATPU~1.EXE Description=WhatPulse keeps track of your keystrokes, allowing you to find out just how much you type a day Source=Paul Collins Startup list [WheelMouse] Number=11942 Confirmed=U Filename=4DMAIN.EXE Description=Mouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide Source=Paul Collins Startup list [WheelMouse] Number=11943 Confirmed=U Filename=AMOUMAIN.EXE Description=A4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features Source=Paul Collins Startup list [WheelsMouse] Number=11944 Confirmed=X Filename=[path to trojan] Description=Added by the SOCKSPR-D TROJAN! Source=Paul Collins Startup list [WhenUSave] Number=11945 Confirmed=X Filename=Save.exe Description=WhenU.Save adware Source=Paul Collins Startup list [WhenUSearch] Number=11946 Confirmed=X Filename=Search.exe Description=WhenU.Save adware Source=Paul Collins Startup list [WhenUSearchWHSE] Number=11947 Confirmed=X Filename=whse.exe Description=WhenU.Save adware Source=Paul Collins Startup list [Whistler] Number=11948 Confirmed=X Filename=whismng.exe Description=Added by the WHISTLER-F TROJAN! Source=Paul Collins Startup list [Whitechix] Number=11949 Confirmed=X Filename=brightx.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Whvlxd] Number=11950 Confirmed=X Filename=Whvlxd.exe Description=Added by the ZAPCHAS-CS TROJAN! Source=Paul Collins Startup list [whxpin service] Number=11951 Confirmed=X Filename=ssvsol.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WIAWizardMenu] Number=11952 Confirmed=N Filename=RUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenu Description=Still Image Class Installer - installed with a webcam Source=Paul Collins Startup list [Widnows Xp Web scan] Number=11953 Confirmed=X Filename=xpscan.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [wifeman] Number=11954 Confirmed=X Filename=wifeman.exe Description=Unidentified malware Source=Paul Collins Startup list [WiFix service] Number=11955 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WildFlics] Number=11956 Confirmed=X Filename=WildFlics.exe Description=Added by the Direct-B premium rate adult content dialler Source=Paul Collins Startup list [WildTangent CDA] Number=11957 Confirmed=? Filename=RUNDLL32.exe cdaEngine0400.dll, cdaEngineMain Description=Part of the WildTangent on-line games system. What does it do and is it required? Source=Paul Collins Startup list [WildTangent Web Driver updater] Number=11958 Confirmed=U Filename=wcmdmgrl.exe Description=Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [Wildwire Monitor] Number=11959 Confirmed=N Filename=WWMon.exe Description=This places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem Source=Paul Collins Startup list [Willow Road] Number=11960 Confirmed=N Filename=WillowRoad.exe Description=Willow Road Screen Saver Source=Paul Collins Startup list [win] Number=11961 Confirmed=X Filename=regedit -s ..win.dll Description=Added by the SEEKER.K TROJAN! Source=Paul Collins Startup list [win] Number=11962 Confirmed=X Filename=xwinxrpc32.exe Description=Added by the AGOBOT-MV WORM! Source=Paul Collins Startup list [win] Number=11963 Confirmed=X Filename=xwinxrpc.exe Description=Added by the AGOBOT-MV WORM! Source=Paul Collins Startup list [WIN] Number=11964 Confirmed=X Filename=ehshell.exe Description=Added by the MYTOB-CQ WORM! Source=Paul Collins Startup list [WIN] Number=11965 Confirmed=X Filename=windows.exe Description=Added by the REATLE.C WORM! Source=Paul Collins Startup list [Win Chimes] Number=11966 Confirmed=U Filename=winchi~1.exe Description=WinChimes - enhancement software for the system clock that runs in the system tray Source=Paul Collins Startup list [Win Comm] Number=11967 Confirmed=X Filename=WinComm.exe Description=Added by the WINCOM TROJAN! Source=Paul Collins Startup list [Win Command] Number=11968 Confirmed=X Filename=command32.exe Description=Added by the AGOBOT.XQ WORM! Source=Paul Collins Startup list [Win CPU] Number=11969 Confirmed=X Filename=sysin.pif Description=Added by the RBOT-AXL WORM! Source=Paul Collins Startup list [win ctl app] Number=11970 Confirmed=X Filename=wuctl.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win Drivers SSL] Number=11971 Confirmed=X Filename=hpws.exe Description=Added by the IRCBOT.67098 WORM! Source=Paul Collins Startup list [Win Drivers SSL] Number=11972 Confirmed=X Filename=TASKMAN4.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win Drivers SSL] Number=11973 Confirmed=X Filename=hpws.exe Description=Added by the IRCBOT.67098 WORM! Source=Paul Collins Startup list [Win Drivers SSL32] Number=11974 Confirmed=X Filename=hpwsnnsbc.exe Description=Added by the SPYBOT.MAR WORM! Source=Paul Collins Startup list [WIN HOST PROCESS] Number=11975 Confirmed=X Filename=WIN HOST PROCESS.EXE Description=Added by the KEYLOGGER.CLONE TROJAN! Source=Paul Collins Startup list [Win INI 32] Number=11976 Confirmed=X Filename=msrp32.exe Description=Added by the RBOT-FZC WORM! Source=Paul Collins Startup list [Win l5oahder] Number=11977 Confirmed=X Filename=winampa.exe Description=Added by a variant of the RBOT WORM! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a "Winamp" subdirectory of the Program Files directory Source=Paul Collins Startup list [Win Login] Number=11978 Confirmed=X Filename=winlogin.exe Description=Added by the RBOT-AWE WORM! Note - this trojan file is found in the System (95/98/ME) or System32 (NT/2000/XP) folder Source=Paul Collins Startup list [Win Microsoft 98] Number=11979 Confirmed=X Filename=win14.exe Description=Added by the RBOT-AKX WORM! Source=Paul Collins Startup list [win name] Number=11980 Confirmed=? Filename=stat.exe Description=?? Source=Paul Collins Startup list [Win Patch] Number=11981 Confirmed=X Filename=ntldr.exe Description=Added by the SDBOT-GS WORM! Source=Paul Collins Startup list [Win Process Updates] Number=11982 Confirmed=X Filename=winupdates.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win Prosess0r] Number=11983 Confirmed=X Filename=[random filename] Description=Added by the RBOT-BIT WORM! Source=Paul Collins Startup list [WIN prosessor16] Number=11984 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win Proxy32 Protocol] Number=11985 Confirmed=X Filename=bsvtem.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win Secure Update] Number=11986 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AGI WORM! Source=Paul Collins Startup list [Win Security] Number=11987 Confirmed=X Filename=msw32.pif Description=Added by the RBOT-AQT WORM! Source=Paul Collins Startup list [Win Server] Number=11988 Confirmed=X Filename=winserv.exe Description=Added by the IMISERV.A TROJAN! Source=Paul Collins Startup list [Win Server Updt] Number=11989 Confirmed=X Filename=wupdt.exe Description=Added by the IMISERV.A TROJAN! Source=Paul Collins Startup list [Win Server Updt] Number=11990 Confirmed=X Filename=winserver.exe Description=Added by a variant of the IMISERV TROJAN! Source=Paul Collins Startup list [Win Server Updt] Number=11991 Confirmed=X Filename=pxckdla.exe Description=IEPlugin adware Source=Paul Collins Startup list [Win TaskLoader] Number=11992 Confirmed=X Filename=msgmr.exe Description=Added by the MYTOB.L WORM! Source=Paul Collins Startup list [win update] Number=11993 Confirmed=X Filename=wupda32.exe Description=Added by the SDBOT.J WORM! Source=Paul Collins Startup list [win update] Number=11994 Confirmed=X Filename=wapdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win Update] Number=11995 Confirmed=X Filename=SysUpdate.exe Description=Added by the AGOBOT-TN WORM! Source=Paul Collins Startup list [Win Update] Number=11996 Confirmed=X Filename=oleupdate.exe Description=Added by the AGENT-UY TROJAN! Source=Paul Collins Startup list [Win Update] Number=11997 Confirmed=X Filename=msnmger.exe Description=Added by the RBOT-GDP WORM! Source=Paul Collins Startup list [Win Updater] Number=11998 Confirmed=X Filename=WINUPDATER.EXE Description=Added by the RBOT.IP WORM! Source=Paul Collins Startup list [Win Updator Services] Number=11999 Confirmed=X Filename=ctfnom.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [WIN USB 2.0] Number=12000 Confirmed=X Filename=usbsystem.exe Description=Added by an unidentified WORM of TROJAN! Source=Paul Collins Startup list [WIN USB 2.0] Number=12001 Confirmed=X Filename=winusb.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win USB 2.0 USB Driver] Number=12002 Confirmed=X Filename=HPPrint.exe Description=Added by the SPYBOT.DNB WORM! Source=Paul Collins Startup list [WIN USB SUPPORT] Number=12003 Confirmed=X Filename=grxsrv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win Validation Application] Number=12004 Confirmed=X Filename=DBExecCom.exe Description=Added by the VBSILLY-A WORM! Source=Paul Collins Startup list [Win WinAmp] Number=12005 Confirmed=X Filename=winamp.exe Description=Added by the RBOT.AGF WORM! Note - this is NOT the popular Winamp media player which resides in a "Winamp" subdirectory of the Program Files directory. This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [win************* [* = random digit]] Number=12006 Confirmed=X Filename=win*************.exe [* = random digit] Description=WINBO adware Source=Paul Collins Startup list [WIN-BUGSFIX] Number=12007 Confirmed=X Filename=WIN-BUGSFIX.EXE Description=Added by the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [win-xp] Number=12008 Confirmed=X Filename=nvsc32.exe Description=Added by the BROPIA.N WORM! Source=Paul Collins Startup list [win-xp] Number=12009 Confirmed=X Filename=winis.exe Description=Added by the BROPIA.N WORM! Source=Paul Collins Startup list [win-xp] Number=12010 Confirmed=X Filename=winis.exe Description=Added by the BROPIA.N WORM! Source=Paul Collins Startup list [win.exe] Number=12011 Confirmed=X Filename=win.exe Description=Added by the PODROP-C TROJAN! Source=Paul Collins Startup list [win16.dll] Number=12012 Confirmed=U Filename=win16dll.exe Description=Screenspy captures screenshots silently. If you didn't install this yourself, remove it Source=Paul Collins Startup list [Win2Drv] Number=12013 Confirmed=X Filename=[worm filename] Description=Added by the WINTOO WORM! Source=Paul Collins Startup list [WIN32] Number=12014 Confirmed=X Filename=WIN32.EXE Description=Added by the RATEGA TROJAN! Source=Paul Collins Startup list [win32] Number=12015 Confirmed=X Filename=Shakira_1997_Part_1_.Mpeg_.scr Description=Added by the MYLIFE.N WORM! Source=Paul Collins Startup list [win32] Number=12016 Confirmed=X Filename=Setup_32.exe Description=Added by the EVILBOT.B TROJAN! Source=Paul Collins Startup list [Win32] Number=12017 Confirmed=X Filename=Win32.exe Description=Added by the ISRAZ.A WORM! Source=Paul Collins Startup list [win32] Number=12018 Confirmed=X Filename=winsrv32.exe Description=Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites Source=Paul Collins Startup list [win32] Number=12019 Confirmed=X Filename=WinSetup.exe Description=Added by the EVILBOT.B TROJAN! Source=Paul Collins Startup list [Win32] Number=12020 Confirmed=X Filename=system32.vbs Description=Added by the SWERUN VIRUS! Source=Paul Collins Startup list [Win32] Number=12021 Confirmed=X Filename=Game.exe.vbs Description=Added by the SCAFENE WORM! Source=Paul Collins Startup list [Win32] Number=12022 Confirmed=X Filename=arsetup.exe Description=Added by the SPAZBOX.A TROJAN! Source=Paul Collins Startup list [win32] Number=12023 Confirmed=X Filename=winhost.exe Description=Added by the BROPIA.J WORM! Source=Paul Collins Startup list [Win32] Number=12024 Confirmed=X Filename=winnnit.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32] Number=12025 Confirmed=X Filename=msnsrv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32] Number=12026 Confirmed=X Filename=sysmon.exe Description=Added by the MYTOB-HQ TROJAN! Source=Paul Collins Startup list [Win32] Number=12027 Confirmed=X Filename=zaq.exe Description=Added by the RBOT-GCE WORM! Source=Paul Collins Startup list [Win32 Bios] Number=12028 Confirmed=X Filename=Winbios.exe Description=Added by the SEMAPI-A WORM! Source=Paul Collins Startup list [Win32 Configuration] Number=12029 Confirmed=X Filename=videosd32.exe Description=Added by the SDBOT.TT WORM! Source=Paul Collins Startup list [Win32 Configuration] Number=12030 Confirmed=X Filename=dllhelp.exe Description=Added by the SDBOT.UL WORM! Source=Paul Collins Startup list [Win32 Configuration] Number=12031 Confirmed=X Filename=mplayer.exe Description=Added by the FORBOT-BZ WORM! Source=Paul Collins Startup list [WIN32 DDOSSER] Number=12032 Confirmed=X Filename=dos.exe Description=Added by the KELVIR.F WORM! Source=Paul Collins Startup list [Win32 Debug Manager] Number=12033 Confirmed=X Filename=Win32Debug.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Win32 Debug Manager] Number=12034 Confirmed=X Filename=microsoftupd.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Win32 Device Loader] Number=12035 Confirmed=X Filename=Win32ldr.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Win32 Driver] Number=12036 Confirmed=X Filename=svchosts.exe Description=Added by the FORBOT-FD WORM! Source=Paul Collins Startup list [Win32 Drivers] Number=12037 Confirmed=X Filename=winlogons.exe Description=Added by the FORBOT-FG WORM! Source=Paul Collins Startup list [Win32 DRK Driver] Number=12038 Confirmed=X Filename=wdrk32.exe Description=Added by the WOOTBOT.CY WORM! Source=Paul Collins Startup list [Win32 exe file] Number=12039 Confirmed=X Filename=winstr32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Win32 Explorer] Number=12040 Confirmed=X Filename=Explorer32.exe Description=StartPa-MN homepage hijacker Source=Paul Collins Startup list [Win32 Firewall Driver] Number=12041 Confirmed=X Filename=winfw.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 FireWire Driver] Number=12042 Confirmed=X Filename=CTHELPER32.EXE Description=Added by the WOOTBOT TROJAN! Source=Paul Collins Startup list [Win32 FRT Driver] Number=12043 Confirmed=X Filename=msfr32.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Win32 Help32 Service] Number=12044 Confirmed=X Filename=win32help.exe Description=Added by the DELBOT-U WORM! Source=Paul Collins Startup list [Win32 Information Service] Number=12045 Confirmed=X Filename=crsrs.exe Description=Added by the RINBOT.Y WORM! Source=Paul Collins Startup list [Win32 Information Service] Number=12046 Confirmed=X Filename=crsss.exe Description=Added by the DELBOT-O WORM! Source=Paul Collins Startup list [win32 internet server] Number=12047 Confirmed=X Filename=winserver.exe Description=Added by the DERMON-D TROJAN! Source=Paul Collins Startup list [Win32 Kernel core component] Number=12048 Confirmed=X Filename=Kernel32.pif Description=Added by the MOKS VIRUS! Source=Paul Collins Startup list [Win32 LSA Driver] Number=12049 Confirmed=X Filename=lsa.exe Description=Added by the FORBOT-FJ WORM! Source=Paul Collins Startup list [Win32 Ms Auto Updater] Number=12050 Confirmed=X Filename=AutomsUPD.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 NDIS Driver] Number=12051 Confirmed=X Filename=xpndis.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 Network Driver] Number=12052 Confirmed=X Filename=crss.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Win32 NT Adv Services] Number=12053 Confirmed=X Filename=taskmngr.exe Description=Added by the RBOT-ADE WORM! Source=Paul Collins Startup list [Win32 nvc] Number=12054 Confirmed=X Filename=nvcva.exe Description=Added by the RBOT-ABF WORM! Source=Paul Collins Startup list [Win32 NVIDIA Driver] Number=12055 Confirmed=X Filename=MSPMSPSU.EXE Description=Added by a variant of the WOOTBOT.Y WORM! Source=Paul Collins Startup list [win32 regedit] Number=12056 Confirmed=X Filename=msn32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Win32 Rundll Loader] Number=12057 Confirmed=X Filename=Rundll32.exe Description=Added by the SDBOT.A TROJAN! Note - this is not to be confused with the legitimate rundll32.exe file! Source=Paul Collins Startup list [Win32 Secure] Number=12058 Confirmed=X Filename=msconfigsvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32 Security Protocol] Number=12059 Confirmed=X Filename=secure32.exe Description=Added by the RBOT-ETI WORM! Source=Paul Collins Startup list [Win32 Security Service] Number=12060 Confirmed=X Filename=crsrs.exe Description=Added by the DELBOT-S WORM! Source=Paul Collins Startup list [Win32 Service] Number=12061 Confirmed=X Filename=bazzi.exe Description=Added by the AHKER.E WORM! Source=Paul Collins Startup list [Win32 Services] Number=12062 Confirmed=X Filename=odbc32.exe Description=Added by the SPYBOT-EK WORM! Source=Paul Collins Startup list [Win32 Services Config] Number=12063 Confirmed=X Filename=winwkys.exe Description=Added by the RBOT.BKY WORM! Source=Paul Collins Startup list [Win32 Services1] Number=12064 Confirmed=X Filename=wuamngr1.exe Description=Added by the SDBOT-PV WORM! Source=Paul Collins Startup list [Win32 Src Service] Number=12065 Confirmed=X Filename=win32src.exe Description=Added by the RBOT-SX WORM! Source=Paul Collins Startup list [Win32 SSL Driver] Number=12066 Confirmed=X Filename=winssv.exe Description=Added by the FORBOT-BH WORM! Source=Paul Collins Startup list [Win32 Svchosts Driver] Number=12067 Confirmed=X Filename=svchosts.exe Description=Added by the FORBOT-FO WORM! Source=Paul Collins Startup list [win32 system server] Number=12068 Confirmed=X Filename=winserver.exe Description=Added by the DERMON-A TROJAN! Source=Paul Collins Startup list [Win32 System Spool] Number=12069 Confirmed=X Filename=spoolsvc.exe Description=Added by the SDBOT.UK WORM! Source=Paul Collins Startup list [Win32 Test] Number=12070 Confirmed=X Filename=bleatest.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 Update] Number=12071 Confirmed=X Filename=svchosts.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32 Update] Number=12072 Confirmed=X Filename=dl32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [win32 update service] Number=12073 Confirmed=X Filename=svchostt.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32 USB Driver] Number=12074 Confirmed=X Filename=winxpinit.exe Description=Added by the SDBOT.AA TROJAN! Source=Paul Collins Startup list [Win32 USB Driver] Number=12075 Confirmed=X Filename=mvsecn.exe Description=Added by the FORBOT-BK WORM! Source=Paul Collins Startup list [Win32 Usb Driver] Number=12076 Confirmed=X Filename=svhosint32.exe Description=Added by the FORBOT-BE or FORBOT-J WORMS! Source=Paul Collins Startup list [Win32 Usb Driver] Number=12077 Confirmed=X Filename=usb32.exe Description=Added by the SDBOT-OV WORM! Source=Paul Collins Startup list [Win32 Usb Driver] Number=12078 Confirmed=X Filename=AvpG.exe Description=Added by the FORBOT-BX WORM! Source=Paul Collins Startup list [Win32 USB2] Number=12079 Confirmed=X Filename=wins32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12080 Confirmed=X Filename=win32usb.exe Description=Added by the SPYBOT.DHV WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12081 Confirmed=X Filename=smsc.exe Description=Added by the SDBOT.FO WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12082 Confirmed=X Filename=svchosting.exe Description=Added by the FORBOT.J or SDBOT.HU WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12083 Confirmed=X Filename=sys32.exe Description=Added by the WOOTBOT.X WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12084 Confirmed=X Filename=sys32snd.exe Description=Added by the FORBOT-AN WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12085 Confirmed=X Filename=wind32.exe Description=Added by the FORBOT-AH WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12086 Confirmed=X Filename=winupdate.exe Description=Added by the AGOBOT.YE WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12087 Confirmed=X Filename=updatemgr.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12088 Confirmed=X Filename=winsnd32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12089 Confirmed=X Filename=msn.exe Description=Added by the FORBOT-EX WORM! Source=Paul Collins Startup list [Win32 USB2 Driver] Number=12090 Confirmed=X Filename=syscfg32.exe Description=Added by the FORBOT-R WORM! Source=Paul Collins Startup list [Win32 USB2.0 Driver] Number=12091 Confirmed=X Filename=386.exe Description=Added by the IRCBOT.D WORM! Source=Paul Collins Startup list [Win32 USB2.0 Driver] Number=12092 Confirmed=X Filename=rundll16.exe Description=Added by the WOOTBOT.H WORM! Source=Paul Collins Startup list [Win32 USB2.0 Driver] Number=12093 Confirmed=X Filename=w32usb2.exe Description=Added by the SPYBOT.DN WORM! Source=Paul Collins Startup list [Win32 USB2.0 Driver] Number=12094 Confirmed=X Filename=service.exe Description=Added by the SDBOT-QF WORM! Source=Paul Collins Startup list [Win32 USB3 Driver] Number=12095 Confirmed=X Filename=win32tool.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Win32 Wmls Driver] Number=12096 Confirmed=X Filename=winitr32.exe Description=Added by the WOOTBOT.B WORM! Source=Paul Collins Startup list [Win32 Word Services] Number=12097 Confirmed=X Filename=msword32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [win32.exe] Number=12098 Confirmed=X Filename=win32.exe Description=Added by the STARTPAGE TROJAN! Source=Paul Collins Startup list [Win32.exe] Number=12099 Confirmed=X Filename=Win32.exe Description=Added by the AWQ.A TROJAN! Source=Paul Collins Startup list [Win32.Exploit.mzH] Number=12100 Confirmed=X Filename=mzrun.exe Description=Added by the PAINTER TROJAN! Source=Paul Collins Startup list [Win32.Trojan.Downloader] Number=12101 Confirmed=X Filename=netstat2.exe Description=Added by the PAINTER TROJAN! Source=Paul Collins Startup list [Win32BaseServiceMOD] Number=12102 Confirmed=X Filename=Wintask.exe Description=Added by the NAVIDAD WORM! Source=Paul Collins Startup list [win32beta] Number=12103 Confirmed=X Filename=win32sys4.exe Description=Added by the BANKER-DA TROJAN! Source=Paul Collins Startup list [win32clf] Number=12104 Confirmed=X Filename=win32clf.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [win32debug] Number=12105 Confirmed=X Filename=win32debug.exe Description=Added by the GUDEB WORM! Source=Paul Collins Startup list [Win32DLL] Number=12106 Confirmed=X Filename=Win32DLL.vbs Description=Added by the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [Win32dll] Number=12107 Confirmed=X Filename=Win32dll.exe Description=Added by the BANPAES TROJAN! Source=Paul Collins Startup list [WIN32DS] Number=12108 Confirmed=X Filename=clienttimer.exe Description=Added by Eziin adware Source=Paul Collins Startup list [Win32G] Number=12109 Confirmed=X Filename=Kernel32.com Description=Added by the ESTRELLA TROJAN! Source=Paul Collins Startup list [Win32G] Number=12110 Confirmed=X Filename=Scandisk.com Description=Added by the ESTRELLA TROJAN! Source=Paul Collins Startup list [win32gb] Number=12111 Confirmed=X Filename=win32gb.exe Description=All-In-One-Telcom (adult content dialler) variant Source=Paul Collins Startup list [Win32Host Process] Number=12112 Confirmed=X Filename=webemir.exe Description=Added by the TURGEN -A TROJAN! Source=Paul Collins Startup list [win32info] Number=12113 Confirmed=X Filename=win32info.exe Description=Adult content dialler Source=Paul Collins Startup list [win32ini] Number=12114 Confirmed=X Filename=systroy.exe Description=Added by the IRC.ALADINZ.C TROJAN! Source=Paul Collins Startup list [WIN32io] Number=12115 Confirmed=X Filename=clienttimer.exe Description=Added by Eziin adware Source=Paul Collins Startup list [Win32R] Number=12116 Confirmed=X Filename=Server.com Description=Added by the ESTRELLA TROJAN! Source=Paul Collins Startup list [WIn32S Java DLL] Number=12117 Confirmed=X Filename=kavsvx.exe Description=Added by the AGOBOT-RZ WORM! Source=Paul Collins Startup list [win32servv] Number=12118 Confirmed=X Filename=load.exe Description=iSearch adware Source=Paul Collins Startup list [win32servv] Number=12119 Confirmed=X Filename=ms1.exe Description=iSearch adware Source=Paul Collins Startup list [WIN32SL] Number=12120 Confirmed=Y Filename=Win32sl.exe Description=Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. The specific function of this is to load MIF's in order for Dell OpenManage Client to work Source=Paul Collins Startup list [WIN32SNDS] Number=12121 Confirmed=X Filename=banc.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Win32system] Number=12122 Confirmed=X Filename=[random filename] Description=Added by the DDV.B WORM! Source=Paul Collins Startup list [Win32System] Number=12123 Confirmed=X Filename=win32s.exe Description=Added by the MYDOOM.V WORM! Source=Paul Collins Startup list [Win32SystemMonitor] Number=12124 Confirmed=X Filename=***.exe [* = random char] Description=Browser hijacker Source=Paul Collins Startup list [Win32SysV] Number=12125 Confirmed=X Filename=xin.exe Description=Added by the FORBOT-EO WORM! Source=Paul Collins Startup list [win32us] Number=12126 Confirmed=X Filename=win32us.exe Description=All-In-One-Telcom (adult content dialler) variant Source=Paul Collins Startup list [win32usbd] Number=12127 Confirmed=X Filename=ssrs.exe Description=Added by the RBOT-RA WORM! Source=Paul Collins Startup list [WIN32WN] Number=12128 Confirmed=X Filename=system_wc.exe Description=Added by Eziin adware Source=Paul Collins Startup list [win32_i lptt01] Number=12129 Confirmed=X Filename=win32_i.exe Description=RapidBlaster variant (in a "win32_i" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [win32_i ml097e] Number=12130 Confirmed=X Filename=win32_i.exe Description=RapidBlaster variant (in a "win32_i" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [Win386] Number=12131 Confirmed=X Filename=Win386.exe Description=Added by the GOSUSUB VIRUS! Source=Paul Collins Startup list [Win386] Number=12132 Confirmed=X Filename=sp32.dll Description=Homepage hijacker. Not a dll but a regfile in disguise Source=Paul Collins Startup list [WIN3S2SNDS] Number=12133 Confirmed=X Filename=winabsmod.exe Description=Added by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well" Source=Paul Collins Startup list [WIN3S2SNDS] Number=12134 Confirmed=X Filename=winiprtx.exe Description=Added by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well" Source=Paul Collins Startup list [Win64 Compatibility Check] Number=12135 Confirmed=X Filename=load win64.drv Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [WIN95DEFVIEW] Number=12136 Confirmed=X Filename=[path to file] Description=Added by the DEDLER-D TROJAN! Source=Paul Collins Startup list [WIN95DEFVIEW] Number=12137 Confirmed=X Filename=csmss.exe Description=Added by the DEDLER-D TROJAN! Source=Paul Collins Startup list [win98 DNS] Number=12138 Confirmed=X Filename=wingrd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winabc] Number=12139 Confirmed=X Filename=rundll32.exe [Temp]\[ORIGFILENAME].DLL, InstallLaunchEv Description=Added by the LINEAGE-PN TROJAN! Source=Paul Collins Startup list [WinAC v4] Number=12140 Confirmed=X Filename=klsuicbn.exe Description=Added by the FORBOT-CS WORM! Source=Paul Collins Startup list [Winacsr] Number=12141 Confirmed=U Filename=Winacsr.exe Description=AceScreenSpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [winactive] Number=12142 Confirmed=X Filename=WINACTIVE.EXE Description=WinActive of the LOP.com hijacker Source=Paul Collins Startup list [WinActiveJ] Number=12143 Confirmed=X Filename=WinActiveJ.exe Description=Added by the ROTARRAN VIRUS! Source=Paul Collins Startup list [Winad Client] Number=12144 Confirmed=X Filename=Winad.exe Description=WinAd adware by eXact Advertising Source=Paul Collins Startup list [WinAdCnt.exe] Number=12145 Confirmed=X Filename=WinAdCnt.exe Description=Added by the BANKER-BU TROJAN! Source=Paul Collins Startup list [winadm] Number=12146 Confirmed=X Filename=winadm.exe Description=Browser hijacker - redirecting to Search-World.net. Related to the SMALL.AEX TROJAN! Source=Paul Collins Startup list [WinAgent] Number=12147 Confirmed=? Filename=WinAgent.exe Description=Standard Life Insurance program. Is it required at startup? Source=Paul Collins Startup list [Winahlp.exe] Number=12148 Confirmed=X Filename=Winahlp.exe Description=Added by a variant of the VAGRNOCKER TROJAN! Source=Paul Collins Startup list [winallap] Number=12149 Confirmed=X Filename=winallap.exe Description=Added by the DELF.E TROJAN! Source=Paul Collins Startup list [winallapu] Number=12150 Confirmed=X Filename=winallapu.exe Description=Added by the DELF.E TROJAN! Source=Paul Collins Startup list [Winamp] Number=12151 Confirmed=X Filename=winamp.hta Description=Hijacker - re-directing to adult content sites. Note - this isn't the real Winamp Source=Paul Collins Startup list [Winamp] Number=12152 Confirmed=X Filename=winamp.exe Description=Added by the AGOBOT.XI WORM! Note - this is NOT the popular Winamp media player Source=Paul Collins Startup list [WinAMP] Number=12153 Confirmed=X Filename=winamp62.exe Description=Added by the SDBOT-WN WORM! Source=Paul Collins Startup list [Winamp] Number=12154 Confirmed=N Filename=winamp.exe Description=Winamp media player. Resides in a "Winamp" subdirectory of the Program Files directory Source=Paul Collins Startup list [Winamp Agent] Number=12155 Confirmed=X Filename=winamp.exe Description=Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player. The valid filename for the Winamp Agent is "winampa.exe" - see here Source=Paul Collins Startup list [Winamp Media] Number=12156 Confirmed=X Filename=qmedia.exe Description=Added by the DIAZMON-A TROJAN! Source=Paul Collins Startup list [Winamp media player] Number=12157 Confirmed=X Filename=winapa.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [WinAmp Player] Number=12158 Confirmed=X Filename=winampp.exe Description=Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename Source=Paul Collins Startup list [Winamp to Google Talk] Number=12159 Confirmed=U Filename=winamptogoogletalk.exe Description=Winamp to Google Talk, available here shows your current Winamp track in your Google Talk status Source=Paul Collins Startup list [Winamp Update] Number=12160 Confirmed=X Filename=yhn.exe Description=Added by the SDBOT-ACR WORM! Source=Paul Collins Startup list [Winampa] Number=12161 Confirmed=U Filename=WINAMPa.exe Description=Loads the System Tray icon for the popular Winamp media player - see here. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs. Resides in a "Winamp" subdirectory of the Program Files directory Source=Paul Collins Startup list [Winampa] Number=12162 Confirmed=X Filename=winampa.exe Description=Added by the AGOBOT-GS TROJAN! ! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a "Winamp" subdirectory of the Program Files directory whereas this file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Winampa Agent] Number=12163 Confirmed=X Filename=WINAMPA.EXE Description=Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player. The valid filename for the Winamp Agent is "winampa.exe" - see here Source=Paul Collins Startup list [WinampAgent] Number=12164 Confirmed=U Filename=WINAMPa.exe Description=Loads the System Tray icon for the popular Winamp media player - see here. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs. Resides in a "Winamp" subdirectory of the Program Files directory Source=Paul Collins Startup list [WinAmpAgent] Number=12165 Confirmed=X Filename=Msexploren.exe Description=Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Source=Paul Collins Startup list [WinAmpAgent] Number=12166 Confirmed=X Filename=Shch.exe Description=Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Source=Paul Collins Startup list [WinAmpAgent] Number=12167 Confirmed=X Filename=svchst.exe Description=Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Source=Paul Collins Startup list [WinAmpAgent] Number=12168 Confirmed=X Filename=Winagent.exe Description=Added by the EB TROJAN! Note - this is NOT the popular Winamp media player which has a different filename Source=Paul Collins Startup list [WinAmpAgent] Number=12169 Confirmed=X Filename=msnexploren.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [WinAmpAgent] Number=12170 Confirmed=X Filename=sdhch.exe Description=Added by the TACTSLAY.B TROJAN! Source=Paul Collins Startup list [WinAntiSpyware 2005] Number=12171 Confirmed=N Filename=was5.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [WinAntiVirus Pro 2007] Number=12172 Confirmed=N Filename=WinAV.exe Description=WinAntiVirus Pro 2007 virus software - not recommended, see here Source=Paul Collins Startup list [WinApi] Number=12173 Confirmed=X Filename=winapix.exe Description=Added by a variant of the TIBSER.A downloader TROJAN! Source=Paul Collins Startup list [WINAPLOGUPD] Number=12174 Confirmed=X Filename=WINAPLOGUPD.EXE Description=Added by the CAPSIDE-C WORM! Source=Paul Collins Startup list [Winapp] Number=12175 Confirmed=X Filename=winpup32.exe Description=Produces popup ads to adult content sites Source=Paul Collins Startup list [WinApp32] Number=12176 Confirmed=X Filename=msapp.exe Description=Added by the RSBOT TROJAN! Source=Paul Collins Startup list [WinAppLog] Number=12177 Confirmed=U Filename=svchost.exe Description=StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! Source=Paul Collins Startup list [WinAuth] Number=12178 Confirmed=X Filename=winlogon.exe Description=Hijacker, also indentified as the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [WinAwk] Number=12179 Confirmed=X Filename=WinAwk.exe Description=Added by the SDBOT-AYF WORM! Source=Paul Collins Startup list [WinBackup Scheduler] Number=12180 Confirmed=U Filename=Wbsched.exe Description=LIUtilities WinBackup scheduler - backup software Source=Paul Collins Startup list [WinBar] Number=12181 Confirmed=U Filename=WinBar.exe Description="WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls" Source=Paul Collins Startup list [winbar.pif] Number=12182 Confirmed=X Filename=packe.pif Description=Added by the RBOT-AVI WORM! Source=Paul Collins Startup list [winbas12] Number=12183 Confirmed=X Filename=winbas12.exe Description=Adware, CoolWebSearch parasite related - recognized by Kaspersky antivirus as TrojanDownloader.Win32.VB.du - Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Winbed] Number=12184 Confirmed=X Filename=winbed.exe Description=Hijacker Source=Paul Collins Startup list [Winbin] Number=12185 Confirmed=X Filename=swchost.exe Description=Added by the RBOT.CLS WORM! Source=Paul Collins Startup list [winbin32] Number=12186 Confirmed=X Filename=win32exe.exe Description=Added by the RBOT-ZL WORM! Source=Paul Collins Startup list [winbot] Number=12187 Confirmed=X Filename=winbot.exe Description=Added by the MIDRUG-A TROJAN! Source=Paul Collins Startup list [WinCheck] Number=12188 Confirmed=X Filename=WinCheck.exe Description=Added by the PWS-CY TROJAN! Source=Paul Collins Startup list [WinCheck] Number=12189 Confirmed=X Filename=services.exe Description=Added by the SOBER.S WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatus\Microsoft" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [WinCheck] Number=12190 Confirmed=X Filename=check.exe Description=Added by the DELBOT-Y WORM! Source=Paul Collins Startup list [winchost] Number=12191 Confirmed=X Filename=winchost.exe Description=Added by the DLOADER-PO TROJAN! Source=Paul Collins Startup list [WINCINEMAMGR] Number=12192 Confirmed=N Filename=WINCIN~1.EXE Description=WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [WinCinemaMgr] Number=12193 Confirmed=N Filename=WinCinemaMgr.exe Description=WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [winclean] Number=12194 Confirmed=X Filename=winclean.exe Description=Added by the AGENT.GXR TROJAN! Source=Paul Collins Startup list [wincmap] Number=12195 Confirmed=X Filename=wincmapp.exe Description=CasClient adware variant - also detected as the CMAPP TROJAN! Source=Paul Collins Startup list [wincms] Number=12196 Confirmed=X Filename=wincms.exe Description=Added by the RBOT.CBR WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [WinCRT32] Number=12197 Confirmed=X Filename=wincrt32.exe Description=Added by the DOGBOT-D WORM! Source=Paul Collins Startup list [WinCSRSS] Number=12198 Confirmed=X Filename=MSGRT32.EXE Description=Added by the REWINDO-A TROJAN! Source=Paul Collins Startup list [WINCX] Number=12199 Confirmed=X Filename=wincore332.exe Description=Added by the AGOBOT-MG WORM! Source=Paul Collins Startup list [Wind Logd File] Number=12200 Confirmed=X Filename=servicelogd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Wind Security] Number=12201 Confirmed=X Filename=mswi32.pif Description=Added by the RBOT-ARH WORM! Source=Paul Collins Startup list [wind.exe] Number=12202 Confirmed=X Filename=wind.exe Description=Added by the MITGLIEDER.BD TROJAN! Source=Paul Collins Startup list [WIND0WS] Number=12203 Confirmed=X Filename=WIND0WS.exe Description=Added by the SPYBOT.DQ WORM! Source=Paul Collins Startup list [WIND0WS] Number=12204 Confirmed=X Filename=mella.bat Description=Added by the ALLEM WORM! Source=Paul Collins Startup list [Wind0ws] Number=12205 Confirmed=X Filename=wordpad.exe Description=Added by the AGOBOT-TL WORM! Note - this is not the legitimate Windows application wordpad.exe (which is found in the Program Files\Accessories folder) which should not normally be seen in Msconfig or as a Startup item. This file is loacted in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Wind0ws Sharing] Number=12206 Confirmed=X Filename=ssprotecter.exe Description=Added by the RBOT-AHW WORM! Source=Paul Collins Startup list [WinData] Number=12207 Confirmed=X Filename=services.exe Description=Added by the SOBER.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "PoolData" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [WinDates] Number=12208 Confirmed=N Filename=windates.exe Description=WinDates is a calendar, date organizer and event reminder program from Rockin' Software Source=Paul Collins Startup list [windbs] Number=12209 Confirmed=X Filename=winxtc.exe Description=Added by the AGOBOT-WD WORM! Source=Paul Collins Startup list [Winde] Number=12210 Confirmed=X Filename=winde.exe Description=Added by the DLUCA TROJAN! Source=Paul Collins Startup list [windef] Number=12211 Confirmed=X Filename=Win32sp.vbs Description=Added by the ANPES WORM! Source=Paul Collins Startup list [windef] Number=12212 Confirmed=X Filename=windef.exe Description=Added by the WURMARK-O WORM! Source=Paul Collins Startup list [Windeows NetStart Service2] Number=12213 Confirmed=X Filename=tesakrmger.exe Description=Added by the RBOT-AMY WORM! Source=Paul Collins Startup list [windhost.exe] Number=12214 Confirmed=X Filename=osrwin32.exe Description=Added by the BANKER-CB TROJAN! Source=Paul Collins Startup list [windhost.exe] Number=12215 Confirmed=X Filename=windhost.exe Description=Added by the BANKER-BV TROJAN! Source=Paul Collins Startup list [windhost.exe] Number=12216 Confirmed=X Filename=winos.exe Description=Added by the PWSAGENT-A WORM! Source=Paul Collins Startup list [windir] Number=12217 Confirmed=X Filename=winrun.exe Description=Added by the WINBUR.B WORM! Source=Paul Collins Startup list [Windll] Number=12218 Confirmed=X Filename=Windll.exe Description=Added by the TRYNOMA TROJAN! Source=Paul Collins Startup list [WINDLL] Number=12219 Confirmed=U Filename=WSYS.EXE Description=STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes, all passwords transacted even if they weren't keyed in, all web sites visited, every program launched including the path to that program, and more" Source=Paul Collins Startup list [windll] Number=12220 Confirmed=X Filename=windll32.exe Description=Added by the ASTEF or RESPAN WORMS! Source=Paul Collins Startup list [WinDLL (csmss.exe)] Number=12221 Confirmed=X Filename=rundll32.exe [path] CSMSS.EXE Description=Added by the AKBOT.U WORM! Source=Paul Collins Startup list [WinDLL (wchshield.exe)] Number=12222 Confirmed=X Filename=wchshield.exe Description=Added by the IRCBOT GEN WORM! Source=Paul Collins Startup list [Windll.exe] Number=12223 Confirmed=X Filename=Windll.exe Description=Added by the STEALER TROJAN! Source=Paul Collins Startup list [Windll32] Number=12224 Confirmed=X Filename=Windll32.exe Description=Added by the MSNPWS TROJAN! Source=Paul Collins Startup list [WinDll32] Number=12225 Confirmed=X Filename=_WIN32.EXE Description=Added by the LEGMIR.AQ TROJAN! Source=Paul Collins Startup list [windllsys32.exe] Number=12226 Confirmed=X Filename=windllsys32.exe Description=Added by a variant of the MITGLIE-A TROJAN! Source=Paul Collins Startup list [WinDNS] Number=12227 Confirmed=X Filename=windns32.exe Description=Added by the GAOBOT.WX WORM! Source=Paul Collins Startup list [Windoes Kernel] Number=12228 Confirmed=X Filename=kernel32.exe Description=Added by the KICKIN.A (or CYDOG.C) WORM! Source=Paul Collins Startup list [Window] Number=12229 Confirmed=X Filename=explore.exe Description=Added by the GAOBOT.ADW WORM! Source=Paul Collins Startup list [Window Loader] Number=12230 Confirmed=X Filename=Dos32.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Window Monitor] Number=12231 Confirmed=X Filename=winmon32.exe Description=Added by the SDBOT.RT WORM! Source=Paul Collins Startup list [Window service] Number=12232 Confirmed=X Filename=[random filename] Description=Added by the RBOT-ACH WORM! Source=Paul Collins Startup list [Window Washer] Number=12233 Confirmed=U Filename=wwDisp.exe Description=Window Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [window.exe] Number=12234 Confirmed=X Filename=window.exe Description=Added by the MITGLIEDER.H or MITGLIEDER.J TROJANS! Source=Paul Collins Startup list [window2] Number=12235 Confirmed=X Filename=ssvchost.exe Description=Added by the IRCBOT.H TROJAN! Source=Paul Collins Startup list [WindowBlinds] Number=12236 Confirmed=U Filename=wbload.exe Description=WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins Source=Paul Collins Startup list [WindowEnhancer] Number=12237 Confirmed=X Filename=Winex.exe Description=SCBar foistware variant Source=Paul Collins Startup list [Windowfdgfds DasdLL Verifiew] Number=12238 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-GGX WORM! Source=Paul Collins Startup list [Windowfdgfds DLL fgfdg Verifier] Number=12239 Confirmed=X Filename=winsecure.exe Description=Added by the RBOT.CSP WORM! Source=Paul Collins Startup list [Windowfdgfds DLL fgfdg Verifier] Number=12240 Confirmed=X Filename=winsecure.exe Description=Added by the RBOT.CSP WORM! Source=Paul Collins Startup list [WindowFX] Number=12241 Confirmed=U Filename=wfxload.exe Description=Stardock WindowFX - "Allows you to add an unprecedented number of special effects to windows" Source=Paul Collins Startup list [windown] Number=12242 Confirmed=X Filename=wiusyt.exe Description=Added by the QQPASS-M TROJAN! Source=Paul Collins Startup list [WindowRegKey update] Number=12243 Confirmed=X Filename=wins.exe Description=Added by the SPYBOT.I WORM! Source=Paul Collins Startup list [Windows] Number=12244 Confirmed=X Filename=Kernel32.exe Description=Added by the TENDOOLF.A WORM! Source=Paul Collins Startup list [Windows] Number=12245 Confirmed=X Filename=msdos98.exe Description=Added by the PWSTEAL TROJAN! Source=Paul Collins Startup list [Windows] Number=12246 Confirmed=X Filename=Windows.exe Description=Added by the KAZMOR.A, BOBBINS & ALADINZ.D TROJANS! Source=Paul Collins Startup list [Windows] Number=12247 Confirmed=X Filename=explorer.exe Description=Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [windows] Number=12248 Confirmed=X Filename=[path to trojan] Description=Added by the AIMWIN TROJAN! Source=Paul Collins Startup list [windows] Number=12249 Confirmed=X Filename=hkey.exe Description=Added by the GAOBOT.AFW WORM! Source=Paul Collins Startup list [windows] Number=12250 Confirmed=X Filename=system copy.exe Description=Added by the SALGA.A WORM! Source=Paul Collins Startup list [Windows] Number=12251 Confirmed=X Filename=gearsec.exe Description=Added by the STUBBOT-B TROJAN! Source=Paul Collins Startup list [Windows] Number=12252 Confirmed=X Filename=run.exe Description=Added by the SPYBOT.OFN WORM! Source=Paul Collins Startup list [Windows] Number=12253 Confirmed=X Filename=system.exe Description=Added by the SPYBOT.OBB WORM! Source=Paul Collins Startup list [WINDOWS] Number=12254 Confirmed=X Filename=\windows.exe Description=Added by the MONBOT-A TROJAN! Source=Paul Collins Startup list [Windows] Number=12255 Confirmed=X Filename=services.exe Description=Added by the SOBER-Z WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! ! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [WINDOWS] Number=12256 Confirmed=X Filename=jif.exe Description=Added by the MYTOB.MK WORM! Source=Paul Collins Startup list [windows] Number=12257 Confirmed=X Filename=iexplore.exe Description=Added by the RBOT-UM WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Windows] Number=12258 Confirmed=X Filename=services.exe Description=Added by the DLOADR-GW TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Windows" subfolder Source=Paul Collins Startup list [Windows] Number=12259 Confirmed=X Filename=smss.exe Description=Added by the BANCBAN-QF TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [windows] Number=12260 Confirmed=X Filename=svchost.exe Description=Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [WINDOWS] Number=12261 Confirmed=X Filename=ymssgr.exe Description=Added by the PS TROJAN! Note - deactivates the MicrosoftInternet Connection Firewall (ICF) Source=Paul Collins Startup list [Windows] Number=12262 Confirmed=X Filename=taskmngr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows (ICS) Spooler] Number=12263 Confirmed=X Filename=crtss.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows (random character)] Number=12264 Confirmed=X Filename=diskcheck.exe Description=Added by the SINGU.B TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12265 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12266 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12267 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12268 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12269 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12270 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12271 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows .Net Manager] Number=12272 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows 128 Module] Number=12273 Confirmed=X Filename=win128.exe Description=Added by the FORBOT-ES WORM! Source=Paul Collins Startup list [Windows 2004] Number=12274 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programas\Windows 2004\Tools" folder Source=Paul Collins Startup list [Windows 32 Editor] Number=12275 Confirmed=X Filename=Win32edit.exe Description=Added by the WOOTBOT.GQ WORM! Source=Paul Collins Startup list [Windows 32 Rescue] Number=12276 Confirmed=X Filename=win32resc.exe Description=Added by the FORBOT-EU WORM! Source=Paul Collins Startup list [Windows 32 Update] Number=12277 Confirmed=X Filename=Windows-Update.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Accelerators] Number=12278 Confirmed=U Filename=setup.exe Description=KeySpy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Windows AdControl] Number=12279 Confirmed=X Filename=WinAdCtl.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows AdService] Number=12280 Confirmed=X Filename=WinAdServ.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows AdStatus] Number=12281 Confirmed=X Filename=WinStat.exe Description=Added by the BLESHARE!DR VIRUS! Source=Paul Collins Startup list [Windows AdTools] Number=12282 Confirmed=X Filename=WinAdTools.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows Anti Verifier] Number=12283 Confirmed=X Filename=Windows-Anti.exe Description=Added by the RBOT.ETT WORM! Source=Paul Collins Startup list [Windows Anti-Virus Built 32] Number=12284 Confirmed=X Filename=AntiVirus32.exe Description=Added by the SDBOT-BG WORM! Source=Paul Collins Startup list [Windows APCI Verifier] Number=12285 Confirmed=X Filename=dhcpserv.exe Description=Added by the RBOT-FON WORM! Note - Disables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF) Source=Paul Collins Startup list [Windows API Control Task] Number=12286 Confirmed=X Filename=apitsk32.exe Description=Added by the MYTOB.HI WORM! Source=Paul Collins Startup list [Windows Application Layer] Number=12287 Confirmed=X Filename=walg32.exe Description=Added by the AGOBOT.ATN WORM! Source=Paul Collins Startup list [Windows Application Layer Gateway] Number=12288 Confirmed=X Filename=walg32.exe Description=Added by the AGOBOT-AAZ WORM! Source=Paul Collins Startup list [Windows ASN Service] Number=12289 Confirmed=X Filename=rge.exe Description=Added by the RBOT-AOK WORM! Source=Paul Collins Startup list [Windows ASN Service] Number=12290 Confirmed=X Filename=[random filename] Description=Added by the AGOBOT-TC WORM! Source=Paul Collins Startup list [Windows Authority Service] Number=12291 Confirmed=X Filename=lsass.exe Description=Added by the KALEL-E WORM! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [windows auto update] Number=12292 Confirmed=X Filename=penis32.exe Description=Added by the BLASTER (or MSBLAST.A) WORM! Source=Paul Collins Startup list [Windows Auto Update] Number=12293 Confirmed=X Filename=winupdater.exe Description=Added by the SDBOT.TF WORM! Source=Paul Collins Startup list [Windows auto update] Number=12294 Confirmed=X Filename=bazzi.exe Description=Added by the AHKER.E WORM! Source=Paul Collins Startup list [Windows auto update] Number=12295 Confirmed=X Filename=LSASS.exe Description=Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [windows auto update ] Number=12296 Confirmed=X Filename=msblast.exe Description=Added by the BLASTER.B WORM! Source=Paul Collins Startup list [Windows Automatic Update] Number=12297 Confirmed=X Filename=wuamgrder.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Automatic Updater] Number=12298 Confirmed=X Filename=windrg.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Automatic Updates] Number=12299 Confirmed=X Filename=dvldr.exe Description=Added by the RBOT.MF WORM! Source=Paul Collins Startup list [Windows Automatical Updater] Number=12300 Confirmed=X Filename=dcz.exe Description=Added by the RBOT.CXS WORM! Source=Paul Collins Startup list [Windows AutomaticUpdater] Number=12301 Confirmed=X Filename=runddls.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [windows automation] Number=12302 Confirmed=X Filename=mslaugh.exe Description=Added by the BLASTER.E WORM! Source=Paul Collins Startup list [Windows Automation] Number=12303 Confirmed=X Filename=msdspr.exe Description=Added by the SOLAME.A WORM! Source=Paul Collins Startup list [Windows Autostart Loader] Number=12304 Confirmed=X Filename=notepad32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows backup] Number=12305 Confirmed=X Filename=systemss.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Backup Configuration] Number=12306 Confirmed=X Filename=IEXPLORER.exe Description=Added by the GAOBOT.AZ WORM! Source=Paul Collins Startup list [Windows Ba�lang�� Dosyas�] Number=12307 Confirmed=X Filename=sistem.exe Description=Added by the MUZK WORM! Source=Paul Collins Startup list [Windows Bootup] Number=12308 Confirmed=X Filename=ms-wks32.exe Description=Added by the RBOT-AFM WORM! Source=Paul Collins Startup list [Windows Bootup] Number=12309 Confirmed=X Filename=Systemwks32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Bootup] Number=12310 Confirmed=X Filename=task-mngr.exe Description=Added by the RBOT-AWP WORM! Source=Paul Collins Startup list [Windows Clean-Up Pro] Number=12311 Confirmed=N Filename=WINDOWS CLEAN-UP PRO.Exe Description=Spyware remover - not recommended, see note Source=Paul Collins Startup list [Windows Client Service 32] Number=12312 Confirmed=X Filename=csrss.exe Description=Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located a drivers\winsdriver subfolder Source=Paul Collins Startup list [Windows Client/Server Runtime Server] Number=12313 Confirmed=X Filename=csrs.exe Description=Added by the RBOT.KD WORM! Source=Paul Collins Startup list [Windows Command] Number=12314 Confirmed=X Filename=wincmd.exe Description=Added by the RBOT.ANV WORM! Source=Paul Collins Startup list [Windows Communicator] Number=12315 Confirmed=X Filename=wincomm.exe Description=Added by the AGOBOT-BH WORM! Source=Paul Collins Startup list [Windows Communicator for NT/XP] Number=12316 Confirmed=X Filename=osndyrn.exe Description=Added by the SDBOT-CPK WORM! Note - can terminate AV related processes Source=Paul Collins Startup list [Windows Compliant] Number=12317 Confirmed=X Filename=[random filename] Description=Added by the RBOT-IR WORM! Source=Paul Collins Startup list [Windows Config] Number=12318 Confirmed=X Filename=SSYS.EXE Description=Added by the SPYBOT-DA WORM! Source=Paul Collins Startup list [Windows Config] Number=12319 Confirmed=X Filename=wins.exe Description=Added by the SPYBOT.JR WORM! Source=Paul Collins Startup list [Windows Config] Number=12320 Confirmed=X Filename=RUNDLL.EXE Description=Added by the SPYBOT-DX WORM! Note - this is not the Windows system file of the same name as described here Source=Paul Collins Startup list [Windows Config Connection] Number=12321 Confirmed=X Filename=msicll.exe Description=Added by the RBOT-EXQ WORM! Source=Paul Collins Startup list [Windows Config Loader] Number=12322 Confirmed=X Filename=Wincfg32.exe Description=Added by the SILVERFTP TROJAN! Source=Paul Collins Startup list [Windows Config Manager] Number=12323 Confirmed=X Filename=winconf.exe Description=Added by the RBOT-AIT WORM! Source=Paul Collins Startup list [Windows Config System] Number=12324 Confirmed=X Filename=config.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Configuration] Number=12325 Confirmed=X Filename=wsys32.exe Description=Added by the GAOBOT.FB WORM! Source=Paul Collins Startup list [Windows Configuration] Number=12326 Confirmed=X Filename=wincfg32.exe Description=Added by the MYTOB.ED WORM! Source=Paul Collins Startup list [Windows Configuration Loader] Number=12327 Confirmed=X Filename=asclt.exe Description=Added by the SDBOT-OA WORM! Source=Paul Collins Startup list [Windows connection manager] Number=12328 Confirmed=X Filename=Internet.exe Description=Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one, it copies it's self under three other file names and folder locations Source=Paul Collins Startup list [Windows Console Monitor] Number=12329 Confirmed=X Filename=[path to worm] Description=Added by KEDEBE WORM! Source=Paul Collins Startup list [Windows Console Monitor] Number=12330 Confirmed=X Filename=gcasAV32.exe Description=Added by the KEDEBE-A WORM! Source=Paul Collins Startup list [Windows Control] Number=12331 Confirmed=X Filename=Control.exe Description=Browser hijacker. NOTE - On Win9x systems it will overwrite the Windows file of the same name in the Windows directory, so therefore it will be necessary to extract a fresh copy of the file from the Windows setup cabs! Source=Paul Collins Startup list [Windows ControlAd] Number=12332 Confirmed=X Filename=WinCtlAd.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows Core Kernel Update] Number=12333 Confirmed=X Filename=win32bootcfg.exe Description=Added by the RANCK-EL TROJAN! Source=Paul Collins Startup list [Windows CPU host] Number=12334 Confirmed=X Filename=winbog32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Critical Alert] Number=12335 Confirmed=X Filename=wincrt.exe Description=Added by the ALEDO-A TROJAN! Source=Paul Collins Startup list [Windows Custom Services] Number=12336 Confirmed=X Filename=CSRCS.EXE Description=Added by the SPYBOT-EI WORM! Source=Paul Collins Startup list [Windows Data Server] Number=12337 Confirmed=X Filename=autodisc.exe Description=Added by the SPYBOT-CB WORM! Source=Paul Collins Startup list [Windows Data Server] Number=12338 Confirmed=X Filename=[random name].exe Description=Added by the SPYBOT-DS WORM! Source=Paul Collins Startup list [Windows Database] Number=12339 Confirmed=X Filename=WinDat.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Database] Number=12340 Confirmed=X Filename=wiinsvc.exe Description=Added by the AGOBOT-RU WORM! Source=Paul Collins Startup list [Windows Dcom2 Fix] Number=12341 Confirmed=X Filename=mscom32.exe Description=Added by the RBOT-QT WORM! Source=Paul Collins Startup list [Windows DDE Loader] Number=12342 Confirmed=X Filename=windde32.exe Description=Added by the SDBOT-UZ WORM! Source=Paul Collins Startup list [Windows debug logging] Number=12343 Confirmed=X Filename=winlogg.exe Description=Added by the RBOT-OY WORM! Source=Paul Collins Startup list [Windows debug logging] Number=12344 Confirmed=X Filename=winloggs.exe Description=Added by the RBOT-QN WORM! Source=Paul Collins Startup list [Windows Debugger] Number=12345 Confirmed=X Filename=windbg.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Windows Debugger] Number=12346 Confirmed=X Filename=msdbg32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Debugger] Number=12347 Confirmed=X Filename=windbg32.exe Description=Added by the ZOTOB.L WORM! Source=Paul Collins Startup list [Windows Debugging Tools] Number=12348 Confirmed=X Filename=updatecfg.exe Description=Added by the RBOT-AXU WORM! Source=Paul Collins Startup list [Windows Default Configuration] Number=12349 Confirmed=X Filename=svchost.exe Description=Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [Windows Defender] Number=12350 Confirmed=Y Filename=MSASCui.exe Description=Related to Windows Defender Microsoft (anti-spyware) tool Source=Paul Collins Startup list [WINDOWS DENEME] Number=12351 Confirmed=X Filename=deneme.exe Description=Added by the MYTOB-CR WORM! Source=Paul Collins Startup list [Windows Desktop Controler] Number=12352 Confirmed=X Filename=windesktop.exe Description=Added by the SDBOT-XH WORM! Source=Paul Collins Startup list [Windows Desktop Daemon] Number=12353 Confirmed=X Filename=winpadg.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Desktop Search] Number=12354 Confirmed=U Filename=WindowsSearch.exe Description=Windows Desktop Search from Microsoft Source=Paul Collins Startup list [Windows Dialup Service] Number=12355 Confirmed=X Filename=dialup.exe Description=Added by the AGOBOT.AAH WORM! Source=Paul Collins Startup list [Windows DLL host] Number=12356 Confirmed=X Filename=winupd32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows DLL Host] Number=12357 Confirmed=X Filename=dllhost32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows DLL Loader] Number=12358 Confirmed=X Filename=RUNDLL16.EXE Description=Added by the DOMWIS TROJAN! Source=Paul Collins Startup list [Windows DLL Loader] Number=12359 Confirmed=X Filename=defragfat32z.exe Description=Added by the LINKBOT.A WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12360 Confirmed=X Filename=rundll32.exe Description=Added by the WHIPSER-B WORM! Note - rundll32.exe file is placed in the Windows\System folder, wheras the legitimate rundll32.exe is located in the C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K) or C:\Windows\System32 (WinXP) Source=Paul Collins Startup list [Windows DLL Loader] Number=12361 Confirmed=X Filename=defragfat32pi.exe Description=Added by the RBOT-QQ WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12362 Confirmed=X Filename=defragfat39.exe Description=Added by the POEBOT-C WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12363 Confirmed=X Filename=defragfatz.exe Description=Added by the LINKBOT.H WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12364 Confirmed=X Filename=defragfat32.exe Description=Added by the SDBOT-SS WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12365 Confirmed=X Filename=defragfat32abc.exe Description=Added by the RBOT-RG WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12366 Confirmed=X Filename=wdevice.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12367 Confirmed=X Filename=SYSCFG16.EXE Description=Added by the DOMWIS-N WORM! Source=Paul Collins Startup list [Windows DLL Loader] Number=12368 Confirmed=X Filename=WINCFG32.EXE Description=Added by the AGOBOT-TE WORM! Source=Paul Collins Startup list [Windows DLL Services] Number=12369 Confirmed=X Filename=winsvc32.exe Description=Added by the RBOT-ZF WORM! Source=Paul Collins Startup list [Windows DLL Services] Number=12370 Confirmed=X Filename=svchost.exe Description=Added by the AGENT.H spyware! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows DLL Services] Number=12371 Confirmed=X Filename=system.exe Description=Added by the AGENT.H spyware Source=Paul Collins Startup list [Windows DLL Tracker] Number=12372 Confirmed=X Filename=spoolsrv.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Windows DLL Verifier] Number=12373 Confirmed=X Filename=xptl.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows DLL Verifier] Number=12374 Confirmed=X Filename=windlls.exe Description=Added by the RBOT-AZQ WORM! Source=Paul Collins Startup list [Windows DNS] Number=12375 Confirmed=X Filename=windns.exe Description=Added by the SDBOT-XU WORM! Source=Paul Collins Startup list [Windows DNS Daemon] Number=12376 Confirmed=X Filename=windnsd.exe Description=Added by the WOOTBOT.AS WORM! Source=Paul Collins Startup list [Windows Domain Name Drivers] Number=12377 Confirmed=X Filename=windns.exe Description=Added by the FORBOT-EP WORM! Source=Paul Collins Startup list [Windows DOS] Number=12378 Confirmed=X Filename=dosw.exe Description=Added by the SALAY-A WORM! Source=Paul Collins Startup list [Windows Download Manager] Number=12379 Confirmed=X Filename=windlmngr.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Windows Drive Compatibility] Number=12380 Confirmed=X Filename=System32Driver32.exe Description=Added by the SUPOVA.Z WORM! Source=Paul Collins Startup list [Windows Driver] Number=12381 Confirmed=X Filename=winxpdriver.exe Description=Added by the WOOTBOT.EE WORM! Source=Paul Collins Startup list [Windows Driver Adapter] Number=12382 Confirmed=X Filename=svchost.exe Description=Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in a "drivers" subfolder Source=Paul Collins Startup list [Windows Driver Foundation] Number=12383 Confirmed=X Filename=MTVSCMXT.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Driver Services] Number=12384 Confirmed=X Filename=msdrvs32.exe Description=Added by the WOOTBOT.L WORM! Source=Paul Collins Startup list [Windows drivers update] Number=12385 Confirmed=X Filename=windowsupdate.exe Description=Added by the RBOT-ACE WORM! Source=Paul Collins Startup list [Windows Dynamic Loading Header] Number=12386 Confirmed=X Filename=winDLL32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Executable] Number=12387 Confirmed=X Filename=winmys.exe Description=Added by the RBOT-ABO WORM! Source=Paul Collins Startup list [Windows ExpIorer] Number=12388 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AKO WORM! Source=Paul Collins Startup list [Windows Explorer] Number=12389 Confirmed=X Filename=[filename].exe Description=Added by the SDBOT TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [Windows Explorer] Number=12390 Confirmed=X Filename=Lsas.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Windows Explorer] Number=12391 Confirmed=X Filename=olecom32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Explorer] Number=12392 Confirmed=X Filename=EEXPLORER.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Explorer] Number=12393 Confirmed=X Filename=explorer.exe Description=Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Windows Explorer] Number=12394 Confirmed=X Filename=explorer.pif Description=Added by the RBOT-AID WORM! Source=Paul Collins Startup list [Windows Explorer] Number=12395 Confirmed=X Filename=system32.exe Description=Added by the RBOT-AJH WORM! Source=Paul Collins Startup list [Windows Explorer] Number=12396 Confirmed=X Filename=explorer32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Explorer Shell] Number=12397 Confirmed=X Filename=Winexec32.exe Description=Added by the REDIST.B WORM! Source=Paul Collins Startup list [Windows Explorer SP2] Number=12398 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located a JavaBeans subfolder Source=Paul Collins Startup list [Windows Explorer Update Build 1142] Number=12399 Confirmed=X Filename=EXPLORER32.EXE Description=Added by the KaZaA based KWBOT or KWBOT.Y WORMS! Source=Paul Collins Startup list [Windows Explorer-3212] Number=12400 Confirmed=X Filename=WINRE16.EXE Description=Added by the HARDOC WORM! Source=Paul Collins Startup list [Windows Extensions for Win32] Number=12401 Confirmed=X Filename=winprgs32.exe Description=Added by the SDBOT.AFA WORM! Source=Paul Collins Startup list [Windows Eyes] Number=12402 Confirmed=N Filename=?? Description=For blind people, gives a voice description of items on the screen. Windows application which gives you total control over what you hear, when you hear it, and how you hear it. Available via Start -> Programs Source=Paul Collins Startup list [Windows FAT 32] Number=12403 Confirmed=X Filename=WINFAT32B.exe Description=Added by the SPYBOT-AGT WORM! Source=Paul Collins Startup list [Windows File Protection] Number=12404 Confirmed=X Filename=winprotect.exe Description=Added by the AGOBOT.JB WORM! Source=Paul Collins Startup list [Windows File System Frame] Number=12405 Confirmed=X Filename=ntframe.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Firewal] Number=12406 Confirmed=X Filename=Lsess.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Firewall] Number=12407 Confirmed=X Filename=WindowsFirewall.exe Description=Added by the MYTOB.AO WORM! Source=Paul Collins Startup list [Windows Firewall Log] Number=12408 Confirmed=X Filename=winlog.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Firewall Manager] Number=12409 Confirmed=X Filename=msfw.exe Description=Added by the RBOT.WR WORM! Source=Paul Collins Startup list [Windows firewall manager] Number=12410 Confirmed=X Filename=chh.exe Description=Added by a variant of the RANDEX.GEL WORM! Source=Paul Collins Startup list [Windows firewall manager] Number=12411 Confirmed=X Filename=msguard.exe Description=Added by a variant of the RANDEX.GEL WORM! Source=Paul Collins Startup list [Windows Firewall Updater] Number=12412 Confirmed=X Filename=updatees.exe Description=Added by the RBOT-GX WORM! Source=Paul Collins Startup list [Windows Firewall Updater] Number=12413 Confirmed=X Filename=cronos.exe Description=Added by the RBOT-GBY WORM! Source=Paul Collins Startup list [Windows Firewall Updater] Number=12414 Confirmed=X Filename=ctfcom.exe Description=Added by the RBOT-GCB WORM! Source=Paul Collins Startup list [Windows Firewalll] Number=12415 Confirmed=X Filename=scvhost.exe Description=Added by the RBOT-EK WORM! Source=Paul Collins Startup list [Windows Firewalll] Number=12416 Confirmed=X Filename=sphost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Firewalll] Number=12417 Confirmed=X Filename=svvhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Firewalll] Number=12418 Confirmed=X Filename=winmu.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Fix] Number=12419 Confirmed=X Filename=integator.exe Description=Added by the SDBOT.ZAB WORM! Source=Paul Collins Startup list [Windows Fixes Systems] Number=12420 Confirmed=X Filename=elite.exe Description=Added by the MYTOB.EG WORM! Source=Paul Collins Startup list [Windows FormatAd] Number=12421 Confirmed=X Filename=WinForm.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows Frame Works] Number=12422 Confirmed=X Filename=frmwrks32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WINDOWS FUCK BY CLASIC] Number=12423 Confirmed=X Filename=fuck.exe Description=Added by the ZOTOB.H or ZOTOB.J WORMS! Source=Paul Collins Startup list [Windows Generic Proc] Number=12424 Confirmed=X Filename=procmsg.exe Description=Added by the ALLIM.B WORM! Source=Paul Collins Startup list [Windows GMT32] Number=12425 Confirmed=X Filename=wingmt32.exe Description=Added by the MYTOB.KM WORM! Source=Paul Collins Startup list [Windows Graphics Loaders] Number=12426 Confirmed=X Filename=wingraphics.exe Description=Added by the SPYBOT.JG WORM! Source=Paul Collins Startup list [Windows Guard] Number=12427 Confirmed=X Filename=WAUMGRD.EXE Description=Added by the RBOT-GY WORM! Source=Paul Collins Startup list [Windows Guardian] Number=12428 Confirmed=U Filename=thehel1iawgrd32.exe Description=Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes Source=Paul Collins Startup list [Windows Guardian] Number=12429 Confirmed=U Filename=Fawgrd32.exe Description=Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes Source=Paul Collins Startup list [Windows Help] Number=12430 Confirmed=X Filename=mailinfo.exe Description=Added by the MYTOB.JX WORM! Source=Paul Collins Startup list [Windows Help File] Number=12431 Confirmed=X Filename=winhelper32.exe Description=Added by the SDBOT-QK TROJAN! Source=Paul Collins Startup list [Windows Help Manager] Number=12432 Confirmed=X Filename=svchost32.exe Description=Added by the RBOT-OZ WORM! Source=Paul Collins Startup list [Windows Help Service] Number=12433 Confirmed=X Filename=winhelpsv.exe Description=Added by the RBOT-LP WORM! Source=Paul Collins Startup list [Windows Help Service] Number=12434 Confirmed=X Filename=winhlp.pif Description=Added by the RBOT-AKW WORM! Source=Paul Collins Startup list [Windows Help System] Number=12435 Confirmed=? Filename=Help.pif Description=?? Source=Paul Collins Startup list [Windows Host] Number=12436 Confirmed=X Filename=hosts.exe Description=Added by the KELVIR.U WORM! Source=Paul Collins Startup list [Windows Host] Number=12437 Confirmed=X Filename=winhost.exe Description=Added by the PRYSAT TROJAN! Source=Paul Collins Startup list [Windows Host Device] Number=12438 Confirmed=X Filename=hostsvc.exe Description=Added by the ZOOTY-A WORM! Source=Paul Collins Startup list [Windows Host Name] Number=12439 Confirmed=X Filename=lmass.exe Description=Added by the GAOBOT.O WORM! Source=Paul Collins Startup list [Windows Host Service] Number=12440 Confirmed=X Filename=scvhosts.exe Description=Added by the SPYBOT.NLI WORM! Source=Paul Collins Startup list [Windows Host Service] Number=12441 Confirmed=X Filename=host.exe Description=Added by KELVIR.AN WORM! Source=Paul Collins Startup list [Windows Host Service] Number=12442 Confirmed=X Filename=svchoste.exe Description=Added by the KELVIR.BF WORM! Source=Paul Collins Startup list [Windows Host Service] Number=12443 Confirmed=X Filename=svchosts32.exe Description=Added by the KELVIR.AW WORM! Source=Paul Collins Startup list [Windows Host32 Starter] Number=12444 Confirmed=X Filename=hostserv.exe Description=Added by the SDBOT-WU WORM! Source=Paul Collins Startup list [Windows Hosts] Number=12445 Confirmed=X Filename=hosts.exe Description=Added by the KELVIR-O TROJAN! Source=Paul Collins Startup list [Windows HP Drivers] Number=12446 Confirmed=X Filename=hpdmws.exe Description=Added by the SDBOT.AQU WORM! Source=Paul Collins Startup list [Windows HTML file reader] Number=12447 Confirmed=X Filename=Sysconf32.exe Description=Added by the NOOMY.A WORM! Source=Paul Collins Startup list [Windows HTTP services] Number=12448 Confirmed=X Filename=winhttps.exe Description=Added by a variant of the SDBOT WORM! See here Source=Paul Collins Startup list [Windows Icons Manager] Number=12449 Confirmed=X Filename=wicomgr.exe Description=Added by the RBOT-AIF WORM! Source=Paul Collins Startup list [WINDOWS ID SYSTEM] Number=12450 Confirmed=X Filename=wID32.exe Description=Added by the MYTOB.LN WORM! Source=Paul Collins Startup list [Windows iMessenger Messenger] Number=12451 Confirmed=X Filename=winimsg.exe Description=Added by the ALLIM.A WORM! Source=Paul Collins Startup list [Windows Incontext] Number=12452 Confirmed=X Filename=InSearch.exe Description=PacerD_Media/Pacimedia.com/Z-Quest adware installer Source=Paul Collins Startup list [Windows Insecure] Number=12453 Confirmed=X Filename=[path to worm] Description=Added by the RBOT-FSM WORM! Source=Paul Collins Startup list [Windows installer] Number=12454 Confirmed=X Filename=winstall.exe Description=SpySheriff malware. For more information on registry key changes see SPYWAD-E Source=Paul Collins Startup list [Windows Installer] Number=12455 Confirmed=X Filename=ntdll.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Internet Protocol] Number=12456 Confirmed=X Filename=winproc32.exe Description=CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN! Source=Paul Collins Startup list [Windows Internet Protocol] Number=12457 Confirmed=X Filename=deinst_qfe001.exe Description=Added by a variant of the Win32.Small TROJAN! Source=Paul Collins Startup list [Windows Internet Service] Number=12458 Confirmed=X Filename=wininet.exe Description=Added by the RBOT-AUX WORM! Source=Paul Collins Startup list [Windows IP Security] Number=12459 Confirmed=U Filename=ipsec.exe Description=Related to the VPN IPSec utility - used to create Security Policy (SP) entries and Security Association (SA) entries in the kernel Source=Paul Collins Startup list [Windows IP Security Service] Number=12460 Confirmed=X Filename=ipsecs.exe Description=Added by the RBOT.BPW WORM! Source=Paul Collins Startup list [Windows IPv6 Drivers] Number=12461 Confirmed=X Filename=wipv6.exe Description=Added by the SDBOT-VJ WORM! Source=Paul Collins Startup list [Windows Java Update] Number=12462 Confirmed=X Filename=weatherBug32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows JavaScript Daemon] Number=12463 Confirmed=X Filename=Winjsd.exe Description=Added by the WOOTBOT.AF WORM! Source=Paul Collins Startup list [Windows Kernel 64] Number=12464 Confirmed=X Filename=kernal64.exe Description=Added by the YIMP-B WORM! Source=Paul Collins Startup list [Windows Kernel System Service] Number=12465 Confirmed=X Filename=wkssvr.exe Description=Added by a variant of the RANDEX.GEL WORM! Source=Paul Collins Startup list [Windows kev Messenger] Number=12466 Confirmed=X Filename=mskev.exe Description=Added by the SDBOT-XV WORM! Source=Paul Collins Startup list [Windows live Support] Number=12467 Confirmed=X Filename=wlmsngr.exe Description=Added by the RBOT-BKL WORM! Source=Paul Collins Startup list [Windows Load] Number=12468 Confirmed=? Filename=windows.com Description=?? Source=Paul Collins Startup list [Windows Loader] Number=12469 Confirmed=X Filename=wstart32.exe Description=Added by the GAOBOT.CA WORM! Source=Paul Collins Startup list [Windows Loader] Number=12470 Confirmed=X Filename=winServices.pif Description=Reported by Kaspersky Anti-Virus as the CARDSPY.D TROJAN! Source=Paul Collins Startup list [Windows Loader] Number=12471 Confirmed=X Filename=SysUpdate.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Loader Service] Number=12472 Confirmed=X Filename=civsc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [windows Loadxm] Number=12473 Confirmed=X Filename=Win_.exe Description=Added by the FODDER-A TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12474 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12475 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12476 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12477 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12478 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12479 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12480 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Local Services] Number=12481 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Locator] Number=12482 Confirmed=X Filename=wsass.exe Description=Added by the IRCBOT.N TROJAN! Source=Paul Collins Startup list [Windows Logger] Number=12483 Confirmed=X Filename=winlog.exe Description=Added by the NSHADOW-B TROJAN! Source=Paul Collins Startup list [Windows logging] Number=12484 Confirmed=X Filename=winlogd.exe Description=Added by the RBOT-ON WORM! Source=Paul Collins Startup list [Windows Login] Number=12485 Confirmed=X Filename=explored.exe Description=Added by the GAOBOT.SY WORM! Source=Paul Collins Startup list [Windows Login] Number=12486 Confirmed=X Filename=winlog.exe Description=Added by the AGOBOT.MG WORM! Source=Paul Collins Startup list [Windows Login] Number=12487 Confirmed=X Filename=lmss.exe Description=Added by the AGOBOT-JA WORM! Source=Paul Collins Startup list [Windows Login] Number=12488 Confirmed=X Filename=lmss.exe Description=Added by the AGOBOT-JA WORM! Source=Paul Collins Startup list [Windows Login Folder] Number=12489 Confirmed=X Filename=winzep.exe Description=Added by the AGOBOT-TZ WORM! Source=Paul Collins Startup list [Windows Login Manager] Number=12490 Confirmed=X Filename=winlogin.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Login Security] Number=12491 Confirmed=X Filename=winlogin.pif Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Login Service] Number=12492 Confirmed=X Filename=winlog.exe Description=Added by the RBOT-AFN WORM! Source=Paul Collins Startup list [Windows Login Service] Number=12493 Confirmed=X Filename=winlogin.pif Description=Added by the SDBOT-ACU WORM! Source=Paul Collins Startup list [Windows Logon] Number=12494 Confirmed=X Filename=winlogin.exe Description=Added by the SPYBOT-C TROJAN! Source=Paul Collins Startup list [Windows Logon Application] Number=12495 Confirmed=X Filename=WinIogon.exe Description=Added by the LINKBOT.M WORM! Source=Paul Collins Startup list [Windows Logon Application] Number=12496 Confirmed=X Filename=logon.exe Description=Added by the POEBOT-J WORM! Source=Paul Collins Startup list [Windows Logon Application] Number=12497 Confirmed=X Filename=services.exe Description=Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Windows Logon Application] Number=12498 Confirmed=X Filename=win32help.exe Description=Added by the DELBOT-X WORM! Source=Paul Collins Startup list [Windows Logon Application] Number=12499 Confirmed=X Filename=winlogon.exe Description=Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Logon Manager] Number=12500 Confirmed=X Filename=logon.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Logon Procedure] Number=12501 Confirmed=X Filename=Svchoste.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Logon Procedure] Number=12502 Confirmed=X Filename=Svchosta.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [windows logon procedure] Number=12503 Confirmed=X Filename=winlogonpc.exe Description=Added by the WINLOGON TROJAN! Source=Paul Collins Startup list [Windows Logon Service] Number=12504 Confirmed=X Filename=winlogon.pif Description=Added by the RBOT-AOU WORM! Source=Paul Collins Startup list [Windows Logon Service] Number=12505 Confirmed=X Filename=napi32.exe Description=Added by the SPYBOT.ANDM WORM! Source=Paul Collins Startup list [Windows LoL Layer] Number=12506 Confirmed=X Filename=gqwdcr.exe Description=Added by the AGOBOT-AHS WORM! Source=Paul Collins Startup list [Windows LoL Layer] Number=12507 Confirmed=X Filename=win.exe Description=Added by the RBOT-FTO WORM! Source=Paul Collins Startup list [Windows LoL Layer] Number=12508 Confirmed=X Filename=[random filename].exe Description=Added by the RBOT-GMD WORM! Source=Paul Collins Startup list [Windows LoL Layer] Number=12509 Confirmed=X Filename=pyvnpt.exe Description=Added by the RBOT-GKV WORM! Source=Paul Collins Startup list [Windows LoL Layer] Number=12510 Confirmed=X Filename=winlolx.exe Description=Added by the RBOT-FOR WORM! Source=Paul Collins Startup list [Windows Management Instrumentation] Number=12511 Confirmed=X Filename=mwd.exe Description=Added by the GRAPS WORM! Source=Paul Collins Startup list [Windows Management Instrumentation] Number=12512 Confirmed=X Filename=[path to file] Description=Added by the QEDS-A VIRUS! Source=Paul Collins Startup list [WINDOWS MANAGEMENT SYSTEM] Number=12513 Confirmed=X Filename=wm1exe.exe Description=Added by the RBOT-VT WORM! Source=Paul Collins Startup list [Windows Manager] Number=12514 Confirmed=X Filename=winmants.exe Description=Added by the MANTAS WORM! Source=Paul Collins Startup list [Windows Manager] Number=12515 Confirmed=X Filename=winsrv.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Windows Manager Update Inc] Number=12516 Confirmed=X Filename=tgb.exe Description=Added by the SDBOT-ACM WORM! Source=Paul Collins Startup list [Windows mangement] Number=12517 Confirmed=X Filename=winlogonn.exe Description=Added by the RANDEX.FC WORM! Source=Paul Collins Startup list [Windows Media AP] Number=12518 Confirmed=X Filename=winmapp.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Media APP] Number=12519 Confirmed=X Filename=wmapp.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Media Center] Number=12520 Confirmed=N Filename=RunDLL32.exe [path] ehuihlp.dll, BootMediaCenter Description=Starts Windows Media Center every time Windows Vista (Home Premium or Ultimate) boots. Disable by unchecking the "Start Windows Media Center when Windows Starts" option via Windows Media Center -> Tasks -> Settings -> General -> Startup and Window Behaviour Source=Paul Collins Startup list [Windows Media Connect 2] Number=12521 Confirmed=N Filename=WMCCFG.exe Description=Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network Source=Paul Collins Startup list [Windows Media Driver] Number=12522 Confirmed=X Filename=msnger.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Media Loader] Number=12523 Confirmed=X Filename=wmloader.exe Description=Added by a variant of the GAOBOT WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12524 Confirmed=X Filename=wmediaplayer.exe Description=Added by the AGOBOT-NQ WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12525 Confirmed=X Filename=MediaPIayer.exe Description=Added by the SDBOT-QO TROJAN! - note, the executable is called 'MediapIayer', with an 'i' !) Source=Paul Collins Startup list [Windows Media Player] Number=12526 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12527 Confirmed=X Filename=msa.exe Description=Added by the RBOT-SI WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12528 Confirmed=X Filename=mcafe32.exe Description=Added by the RBOT-YO WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12529 Confirmed=X Filename=wmplayer.exe Description=Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the executeable resides is C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K) or C:\Windows\System32 (WinXP) rather than C:\Program Files\Windows Media Player Source=Paul Collins Startup list [Windows Media Player] Number=12530 Confirmed=X Filename=50cent.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12531 Confirmed=X Filename=mpwe.exe Description=Added by the RBOT-TT WORM! Source=Paul Collins Startup list [Windows Media Player] Number=12532 Confirmed=X Filename=msams.exe Description=Added by the RBOT.AHR WORM! Source=Paul Collins Startup list [Windows Media Player 3.6] Number=12533 Confirmed=X Filename=wmpa36.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Media Player 3.6b] Number=12534 Confirmed=X Filename=WMPA36B.EXE Description=Added by the RBOT-VV WORM! Source=Paul Collins Startup list [Windows Media Player 3.6d] Number=12535 Confirmed=X Filename=wmpa36d.exe Description=Added by the RBOT-YA WORM! Source=Paul Collins Startup list [Windows Media Player 3.9] Number=12536 Confirmed=X Filename=wmpa36.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Media Player Service] Number=12537 Confirmed=X Filename=wmedia.exe Description=Added by the RBOT.213504 WORM! Source=Paul Collins Startup list [Windows Media Player Update] Number=12538 Confirmed=X Filename=[random filename] Description=Added by the RBOT-ET WORM! Source=Paul Collins Startup list [Windows Media Powerpoint Helper] Number=12539 Confirmed=N Filename=NSPPTHLP.EXE Description=German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs Source=Paul Collins Startup list [Windows media service] Number=12540 Confirmed=X Filename=crvss.exe Description=Added by the SDBOT.VP WORM! Source=Paul Collins Startup list [Windows media service] Number=12541 Confirmed=X Filename=crsss.exe Description=Added by the RBOT.ACY WORM! Source=Paul Collins Startup list [Windows media service] Number=12542 Confirmed=X Filename=Sygate32.exe Description=Added by the RBOT.ADE WORM! Source=Paul Collins Startup list [Windows media services] Number=12543 Confirmed=X Filename=cvrsss.exe Description=Added by the RBOT-MW WORM! Source=Paul Collins Startup list [Windows Media SP.2.37] Number=12544 Confirmed=X Filename=[random filename] Description=Added by the LEMIR.C TROJAN! Source=Paul Collins Startup list [Windows Media Updater] Number=12545 Confirmed=X Filename=crease.exe Description=Added by the RBOT-ATI WORM! Source=Paul Collins Startup list [Windows Media Upgrade] Number=12546 Confirmed=X Filename=NeUpgrade.exe Description=Added by the RBOT.BMF TROJAN! Source=Paul Collins Startup list [Windows Media Utility] Number=12547 Confirmed=X Filename=wmediautil.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows messenger] Number=12548 Confirmed=X Filename=messengers.exe Description=Added by the MYTOB.EI WORM! Source=Paul Collins Startup list [Windows Messenger] Number=12549 Confirmed=X Filename=msnsmgs.exe Description=Added by the RBOT-ANJ WORM! Source=Paul Collins Startup list [Windows Messenger Messenger] Number=12550 Confirmed=X Filename=winmsg.exe Description=Added by VELKBOT.A WORM! Source=Paul Collins Startup list [Windows Messenger Service] Number=12551 Confirmed=X Filename=winsmsgr.exe Description=Added by the RBOT-VW WORM! Source=Paul Collins Startup list [Windows Messenger Service] Number=12552 Confirmed=X Filename=kaspersky.exe Description=Added by the MYTOB.HY WORM! Source=Paul Collins Startup list [Windows MeTaLRoCk service] Number=12553 Confirmed=X Filename=metalrock.exe Description=Added by the TASTYRED TROJAN! Source=Paul Collins Startup list [Windows Micro Drivers] Number=12554 Confirmed=X Filename=wupdates32.exe Description=Added by the RBOT-AEH WORM! Source=Paul Collins Startup list [Windows Microsoft Update] Number=12555 Confirmed=X Filename=wintask32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows mod Verifier] Number=12556 Confirmed=X Filename=Windows-mod.exe Description=Added by the RBOT.DSU WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12557 Confirmed=X Filename=w1nz0zz0.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12558 Confirmed=X Filename=Window2.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12559 Confirmed=X Filename=WindowsLogon.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12560 Confirmed=X Filename=Wwuamguard.exe Description=Added by the RBOT.EZJ WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12561 Confirmed=X Filename=winlogom.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12562 Confirmed=X Filename=Windows-.exe Description=Added by the RBOT-DIO WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12563 Confirmed=X Filename=taskmngr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows modez Verifier] Number=12564 Confirmed=X Filename=winl0g0z.exe Description=Added by the RBOT-FNB WORM! Source=Paul Collins Startup list [Windows Monitor] Number=12565 Confirmed=X Filename=winmon.exe Description=Added by the SDBOT.VB WORM! Source=Paul Collins Startup list [Windows Monitor] Number=12566 Confirmed=X Filename=arsetup.exe Description=Added by the SPAZBOX.A TROJAN! Source=Paul Collins Startup list [Windows Monitor Services] Number=12567 Confirmed=X Filename=winmonitor.exe Description=Added by the RBOT-XX WORM! Source=Paul Collins Startup list [Windows Monitoring Service] Number=12568 Confirmed=X Filename=winmon.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows More Choice] Number=12569 Confirmed=X Filename=TopContext.exe Description=ZQuest adware Source=Paul Collins Startup list [Windows Mouse Utilities] Number=12570 Confirmed=X Filename=mouseutils.exe Description=Added by the RBOT-ABU WORM! Source=Paul Collins Startup list [Windows ms Drivers] Number=12571 Confirmed=X Filename=msnup32.exe Description=Added by the SDBOT-AAL WORM! Source=Paul Collins Startup list [Windows MS Update 32] Number=12572 Confirmed=X Filename=fhm.exe Description=Added by the IRCBOT.GEN WORM! Source=Paul Collins Startup list [Windows MS Update 32] Number=12573 Confirmed=X Filename=sucker.exe Description=Added by the FORBOT-GJ WORM! Source=Paul Collins Startup list [Windows MSConfig Startup Logger] Number=12574 Confirmed=X Filename=winlog.exe Description=Added by the RBOT.BCU WORM! Source=Paul Collins Startup list [Windows Msn Live Messanger] Number=12575 Confirmed=X Filename=msnmsgsman.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows MSX drivers] Number=12576 Confirmed=X Filename=winmsx.exe Description=Added by the RBOT-AYG TROJAN! Source=Paul Collins Startup list [Windows Net Cfg ] Number=12577 Confirmed=X Filename=service.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows NetDDe] Number=12578 Confirmed=X Filename=wrmana32.exe Description=Added by the MYTOB.IM WORM! Source=Paul Collins Startup list [Windows Nets] Number=12579 Confirmed=X Filename=WinNET.exe Description=Added by the RBOT-MO WORM! Source=Paul Collins Startup list [Windows NetStart Service] Number=12580 Confirmed=X Filename=winsN2S.exe Description=Added by the RBOT-ZX WORM! Source=Paul Collins Startup list [Windows NetStart Service2] Number=12581 Confirmed=X Filename=winsN2S.exe Description=Added by the RBOT-ABN WORM! Source=Paul Collins Startup list [Windows NetStart Service2] Number=12582 Confirmed=X Filename=winsN2SD.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Network Controller] Number=12583 Confirmed=X Filename=Mqguard.exe Description=Added by the FORBOT-CL WORM! Source=Paul Collins Startup list [Windows Network Controller] Number=12584 Confirmed=X Filename=WinxPupd.exe Description=Added by the FORBOT-DK WORM! Source=Paul Collins Startup list [Windows Network Controller] Number=12585 Confirmed=X Filename=winmms32.exe Description=Added by the FORBOT-ED WORM! Source=Paul Collins Startup list [Windows Network Controller] Number=12586 Confirmed=X Filename=wingmt.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Network Controller] Number=12587 Confirmed=X Filename=Win9x.exe Description=Added by the WOOTBOT.I WORM! Source=Paul Collins Startup list [Windows Network Firewall] Number=12588 Confirmed=X Filename=firewall.exe Description=Added by the POEBOT-J WORM! Source=Paul Collins Startup list [Windows Network Service] Number=12589 Confirmed=X Filename=winvc32.exe Description=Added by the RBOT.RY WORM! Source=Paul Collins Startup list [Windows Networking] Number=12590 Confirmed=X Filename=winsys32.exe Description=Added by the GAOBOT.FL WORM! Source=Paul Collins Startup list [Windows Networks] Number=12591 Confirmed=X Filename=netcog.exe Description=Added by the MYTOB.FH WORM! Source=Paul Collins Startup list [Windows Nivedia Driver] Number=12592 Confirmed=X Filename=sysMGT.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows NNT] Number=12593 Confirmed=X Filename=[path to trojan] Description=Added by the RANKY.E TROJAN! Source=Paul Collins Startup list [Windows NT 32] Number=12594 Confirmed=X Filename=ntlogin32.exe Description=Added by the RANDEX.BRD WORM! Source=Paul Collins Startup list [Windows NT Login] Number=12595 Confirmed=X Filename=ntlogin32.exe Description=Added by the SDBOT.WG WORM! Source=Paul Collins Startup list [Windows NT Login Session Manager] Number=12596 Confirmed=X Filename=WNSM.EXE Description=Added by the RBOT.BIV WORM! Source=Paul Collins Startup list [Windows NT Logon Application] Number=12597 Confirmed=X Filename=winlogon.scr Description=Added by the RBOT-ALP WORM! Source=Paul Collins Startup list [Windows NT Service Name] Number=12598 Confirmed=X Filename=winshock.exe Description=Added by the RBOT-PK WORM! Source=Paul Collins Startup list [Windows NT Update Manager] Number=12599 Confirmed=X Filename=WINL0G0N.exe Description=Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital "o" Source=Paul Collins Startup list [Windows OEM Tools] Number=12600 Confirmed=X Filename=winres32.exe Description=Added by the SPYBOT.FD WORM! Source=Paul Collins Startup list [Windows OLE Automation Server] Number=12601 Confirmed=X Filename=ole32aut.vbe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Windows Online Updater] Number=12602 Confirmed=X Filename=dllman.exe Description=Added by the RBOT-TE WORM! Source=Paul Collins Startup list [Windows Pc] Number=12603 Confirmed=X Filename=winmgr.exe Description=Added by the BIBOT-A WORM! Source=Paul Collins Startup list [Windows PDG] Number=12604 Confirmed=X Filename=winpdg.exe Description=Added by the RBOT-ADW WORM! Source=Paul Collins Startup list [Windows Performance Monitor] Number=12605 Confirmed=X Filename=wmscupd.exe Description=Added by the IRCBOT_GEN WORM! Source=Paul Collins Startup list [Windows PNP] Number=12606 Confirmed=X Filename=winpnp.exe Description=Added by the RBOT-AKN WORM! Source=Paul Collins Startup list [Windows PNP Server] Number=12607 Confirmed=X Filename=pnpsrv.exe Description=Added by this variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Portable Device Drivers] Number=12608 Confirmed=X Filename=MSKSVRVS.EXE Description=Added by a TROJAN - see here Source=Paul Collins Startup list [Windows Portable Devices] Number=12609 Confirmed=X Filename=MSKSVRTSS.EXE Description=Added by the SPYBOT.APEO WORM! Source=Paul Collins Startup list [Windows Print Monitor Daemon] Number=12610 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Print Spooler] Number=12611 Confirmed=? Filename=SCVHOSTS.EXE Description=Suspicious due to the similarity to the valid "svchost.exe" file Source=Paul Collins Startup list [Windows Print Spooler] Number=12612 Confirmed=X Filename=NavAgent32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Windows Print Spooler] Number=12613 Confirmed=X Filename=SVEHOST.EXE Description=Added by the SPYBOT.H WORM! Source=Paul Collins Startup list [Windows Process] Number=12614 Confirmed=X Filename=win_update.exe Description=Added by the LASTWORD WORM! Source=Paul Collins Startup list [Windows Process Manager] Number=12615 Confirmed=X Filename=winproc.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Processe Manager] Number=12616 Confirmed=X Filename=mspn32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Proffesional Security] Number=12617 Confirmed=X Filename=WinSecure32.exe Description=Added by the AGOBOT.VA WORM Source=Paul Collins Startup list [Windows Protectot] Number=12618 Confirmed=X Filename=boxide.exe Description=Added by a variant of the WOOTBOT WORM! Source=Paul Collins Startup list [Windows Recylinder Check] Number=12619 Confirmed=X Filename=zwdomsgemw.exe Description=Added by the RBOT-EGJ WORM! Source=Paul Collins Startup list [Windows Reg Services] Number=12620 Confirmed=X Filename=ffservice.exe Description=Added by the DLOADER-PL or DLOADER-XM TROJANS! Source=Paul Collins Startup list [Windows Reg Services] Number=12621 Confirmed=X Filename=dservice.exe Description=Added by the PRORAT-D TROJAN! Source=Paul Collins Startup list [Windows Reg Services] Number=12622 Confirmed=X Filename=fservice.exe Description=Added by the PRORAT-D TROJAN! Source=Paul Collins Startup list [Windows Reg Services] Number=12623 Confirmed=X Filename=ssservice.exe Description=Added by the PRORAT-D TROJAN! Source=Paul Collins Startup list [Windows Reg Services] Number=12624 Confirmed=X Filename=lncom.exe Description=Added by the PRORAT-O TROJAN! Source=Paul Collins Startup list [Windows Reg Services] Number=12625 Confirmed=X Filename=lservice.exe Description=Added by the PRORAT-O TROJAN! Source=Paul Collins Startup list [Windows Reg Services] Number=12626 Confirmed=X Filename=wservice.exe Description=Added by the PRORAT-O TROJAN! Source=Paul Collins Startup list [WINDOWS REGISTER EDIT] Number=12627 Confirmed=X Filename=registr32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Register Settings] Number=12628 Confirmed=X Filename=svmhost.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Windows Registers] Number=12629 Confirmed=X Filename=winservicess.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Registry] Number=12630 Confirmed=X Filename=msnmsg.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Registry] Number=12631 Confirmed=X Filename=winhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Registry Cleaner] Number=12632 Confirmed=X Filename=winclean.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Registry Express Loader] Number=12633 Confirmed=X Filename=regexpress.exe Description=Added by the FORBOT-CJ WORM! Source=Paul Collins Startup list [Windows Registry Manager] Number=12634 Confirmed=X Filename=tasksmanagers.exe Description=Added by the MYTOB.ER WORM! Source=Paul Collins Startup list [Windows Registry Name] Number=12635 Confirmed=X Filename=[random filename] Description=Added by the RBOT-AEB WORM! Source=Paul Collins Startup list [Windows Registry Name] Number=12636 Confirmed=X Filename=winses.exe Description=Added by the RBOT-ADB WORM! Source=Paul Collins Startup list [Windows Registry Repair Pro] Number=12637 Confirmed=U Filename=RegistryRepairPro.exe Description=Registry Repair Pro. "Scans the Windows Registry for invalid or obsolete information in the registry" Source=Paul Collins Startup list [Windows Registry Scan] Number=12638 Confirmed=X Filename=regscan32.exe Description=Added by the RBOT.KE WORM! Source=Paul Collins Startup list [Windows Registry Scan] Number=12639 Confirmed=X Filename=timeupdate.exe Description=Added by the SPYBOT.JE WORM! Source=Paul Collins Startup list [Windows Registry Scan] Number=12640 Confirmed=X Filename=svcdll.exe Description=Added by the RBOT-TP WORM! Source=Paul Collins Startup list [Windows Registry Scan] Number=12641 Confirmed=X Filename=regscan23.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Registry Security] Number=12642 Confirmed=X Filename=crss.exe Description=Added by a variant of the IRC.BOT TROJAN! Source=Paul Collins Startup list [Windows Registry Startup] Number=12643 Confirmed=X Filename=wind32.exe Description=Added by the AGOBOT-BZ WORM! Source=Paul Collins Startup list [Windows Repair] Number=12644 Confirmed=X Filename=toxikx.exe Description=Added by the SDBOT-ADL WORM! Source=Paul Collins Startup list [Windows report] Number=12645 Confirmed=X Filename=swchost.exe Description=Added by the SMALL-BD TROJAN! Source=Paul Collins Startup list [windows run] Number=12646 Confirmed=X Filename=system.exe Description=Added by the ICPASS-A WORM! Source=Paul Collins Startup list [Windows Run-Time 64bit] Number=12647 Confirmed=X Filename=win64rt.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Runtime Help] Number=12648 Confirmed=X Filename=win32hlp.exe Description=Added by a variant of the AIMVISION TROJAN! Source=Paul Collins Startup list [Windows Runtime Help] Number=12649 Confirmed=X Filename=WinRunHelp.wrh Description=Added by a variant of the AIMVISION TROJAN! Source=Paul Collins Startup list [Windows Runtime Proccess] Number=12650 Confirmed=X Filename=32RUNdll.exe Description=Added by the SDBOT.QW WORM! Source=Paul Collins Startup list [Windows SA] Number=12651 Confirmed=X Filename=omniscient.exe Description=BLAZEFIND adware Source=Paul Collins Startup list [Windows Screensaver] Number=12652 Confirmed=X Filename=Service.exe Description=Added by the KELVIR.P WORM! Source=Paul Collins Startup list [WINDOWS SCREENSAVER] Number=12653 Confirmed=X Filename=ssaver.scr Description=Added by the SDBOT-YZ WORM! Source=Paul Collins Startup list [Windows secure] Number=12654 Confirmed=X Filename=setver32.exe Description=Added by the SPYBOT.EP WORM! Source=Paul Collins Startup list [Windows Secure Connection] Number=12655 Confirmed=X Filename=winsc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Secure Layer] Number=12656 Confirmed=X Filename=[random filename] Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Secure Messaging System] Number=12657 Confirmed=X Filename=msnmsgrsrvc.exe Description=Added by the RBOT-RE WORM! Source=Paul Collins Startup list [Windows Secure Services] Number=12658 Confirmed=X Filename=ssms.exe Description=Added by the RBOT-GAR WORM! Source=Paul Collins Startup list [Windows Secure Update] Number=12659 Confirmed=X Filename=winupser.exe Description=Added by the RBOT-GCG WORM! Source=Paul Collins Startup list [Windows Secure Update] Number=12660 Confirmed=X Filename=WinSecUp.exe Description=Added by the RBOT-GCD WORM! Source=Paul Collins Startup list [WINDOWS SECURITY] Number=12661 Confirmed=X Filename=wingrd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Security] Number=12662 Confirmed=X Filename=win.pif Description=Added by the RBOT-APT WORM! Source=Paul Collins Startup list [Windows Security] Number=12663 Confirmed=X Filename=ms32.pif Description=Added by the RBOT-ARN WORM! Source=Paul Collins Startup list [Windows Security] Number=12664 Confirmed=X Filename=winscure.exe Description=Added by the RBOT-BAF WORM! Source=Paul Collins Startup list [Windows Security Assistant] Number=12665 Confirmed=X Filename=rundll32.vbe Description=CoolWebSearch Alfasearch parasite variant - also detected as the STARTPA-U TROJAN! Source=Paul Collins Startup list [Windows Security Assistant] Number=12666 Confirmed=X Filename=winsec.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Windows Security Authority Service] Number=12667 Confirmed=X Filename=lsass.exe Description=Added by the KALEL-A WORM! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Security Center Notification Appls] Number=12668 Confirmed=X Filename=sxe.exe Description=Added by the RBOT-GKX WORM! Source=Paul Collins Startup list [Windows Security Center Notification Applse] Number=12669 Confirmed=X Filename=sxes.exe Description=Added by the RBOT-GLR WORM! Source=Paul Collins Startup list [Windows Security Manager] Number=12670 Confirmed=X Filename=winsecurity.exe Description=Added by the AGOBOT-KI WORM! Source=Paul Collins Startup list [Windows Security Manager] Number=12671 Confirmed=X Filename=winsecure.exe Description=Affilred adware Source=Paul Collins Startup list [Windows Security Manager] Number=12672 Confirmed=X Filename=svchost.exe Description=Added by the ANTINNY.AX WORM!! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder Source=Paul Collins Startup list [Windows Security Module] Number=12673 Confirmed=X Filename=module.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Security Service] Number=12674 Confirmed=X Filename=[random file name] Description=Added by the RBOT-ALV WORM! Source=Paul Collins Startup list [Windows Security Service] Number=12675 Confirmed=X Filename=arrdt.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Security Service] Number=12676 Confirmed=X Filename=windows.pif Description=Added by the RBOT-AMG WORM! Source=Paul Collins Startup list [Windows Security Update] Number=12677 Confirmed=X Filename=security32.exe Description=Affilred adware Source=Paul Collins Startup list [Windows Serv Patch] Number=12678 Confirmed=X Filename=Mcaffe2005.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows ServeAd] Number=12679 Confirmed=X Filename=WinServAd.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows Server Information] Number=12680 Confirmed=X Filename=servinfo.exe Description=Added by the FORBOT-EN WORM! Source=Paul Collins Startup list [Windows Servic2] Number=12681 Confirmed=X Filename=winsy.exe Description=Added by the RBOT-AIA WORM! Source=Paul Collins Startup list [Windows service] Number=12682 Confirmed=X Filename=wuamgrd.exe Description=Added by the RBOT-QW WORM! Source=Paul Collins Startup list [Windows Service] Number=12683 Confirmed=X Filename=dddd.exe Description=Identified by Kaspersky Labs as Dialer.Salc, also known to come with the Bube family trojans Source=Paul Collins Startup list [Windows Service] Number=12684 Confirmed=X Filename=prvdi.exe Description=Malware - recognized by Kaspersky antivirus as Trojan-Dropper.Win32.Small.rd Source=Paul Collins Startup list [Windows Service] Number=12685 Confirmed=X Filename=video.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12686 Confirmed=X Filename=svvhost.exe Description=Added by the AGOBOT-HL WORM! Source=Paul Collins Startup list [Windows Service] Number=12687 Confirmed=X Filename=private-zone.exe Description=Added by an unidentified TROJAN.CLICKER! Source=Paul Collins Startup list [Windows Service] Number=12688 Confirmed=X Filename=pd7.exe Description=Added by the SMALL.VZ TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12689 Confirmed=X Filename=dstart4.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12690 Confirmed=X Filename=pd14.exe Description=Adware, detected by DiamondCS TDS-3 anti-trojan as "TrojanDownloader.Win32.Delf.dg" Source=Paul Collins Startup list [Windows Service] Number=12691 Confirmed=X Filename=video2.exe Description=Added by the DOWNLOADER.SMALL.MY TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12692 Confirmed=X Filename=services.exe Description=Added by the KALEL-A WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Service] Number=12693 Confirmed=X Filename=WINSVC.EXE Description=Added by the SPYBOT-DH TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12694 Confirmed=X Filename=r.exe Description=Added by a variant of the SMALL.VZ TROJAN! Source=Paul Collins Startup list [Windows Service] Number=12695 Confirmed=X Filename=windowz.exe Description=Added by the SDBOT-AYI WORM! Note - dissables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF) Source=Paul Collins Startup list [Windows Service Agent] Number=12696 Confirmed=X Filename=czf.exe Description=Added by the RBOT-GAJ WORM! Source=Paul Collins Startup list [Windows Service Controller] Number=12697 Confirmed=X Filename=services.exe Description=Added by the KALEL-B WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Service DC] Number=12698 Confirmed=X Filename=uhpnjcjl.exe Description=Added by the RBOT-GLY WORM! Source=Paul Collins Startup list [Windows Service Host] Number=12699 Confirmed=X Filename=scvhost.exe Description=Added by the SDBOT.N TROJAN! Source=Paul Collins Startup list [Windows Service Host] Number=12700 Confirmed=X Filename=svchost.exe Description=Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Windows Service Host] Number=12701 Confirmed=X Filename=svchost.exe Description=Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Service Host] Number=12702 Confirmed=X Filename=schost.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Windows Service Host Process] Number=12703 Confirmed=X Filename=[path to file] Description=Added by the EZIO-A WORM! Source=Paul Collins Startup list [Windows Service Hosting] Number=12704 Confirmed=X Filename=USERINIT.exe Description=Added by the GOMMER-A WORM! Source=Paul Collins Startup list [Windows Service Loader] Number=12705 Confirmed=X Filename=Window.exe Description=Added by the RBOT-XO WORM! Source=Paul Collins Startup list [Windows Service Manager] Number=12706 Confirmed=X Filename=userint32.exe Description=Added by the OSCABOT-C WORM! Source=Paul Collins Startup list [Windows Service Manager] Number=12707 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12708 Confirmed=X Filename=msgs.exe Description=Added by the OSCABOT-E WORM! Source=Paul Collins Startup list [Windows Service Manager] Number=12709 Confirmed=X Filename=msnmrg.exe Description=Added by the OSCABOT-G WORM! Source=Paul Collins Startup list [Windows Service Manager] Number=12710 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12711 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12712 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12713 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12714 Confirmed=X Filename=svcmgr32.exe Description=Added by the OSCABOT-D WORM! Source=Paul Collins Startup list [Windows Service Manager] Number=12715 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12716 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12717 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Service Manager] Number=12718 Confirmed=X Filename=taskmgr.exe Description=Detected as Trojan-Spy.Win32.IamBigBrother.91 by Kaspersky, possibly a commercial keylogger Source=Paul Collins Startup list [Windows Service Pack Auto Update] Number=12719 Confirmed=X Filename=winworks.exe Description=Adware downloader, identified by eScan antivirus as Trojan-Clicker.Agent.bt Source=Paul Collins Startup list [Windows Service Pack Auto Update] Number=12720 Confirmed=X Filename=figgaz.exe Description=Added by a TROJAN.CLICKER - identified by Kaspersky antivirus as Trojan-Clicker.Agent.bt Source=Paul Collins Startup list [Windows Service Pack Auto Update] Number=12721 Confirmed=X Filename=ballin.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Service Pack Auto Update] Number=12722 Confirmed=X Filename=del-me.exe Description=Adware, also detected as the LOWZONES.BH TROJAN! Source=Paul Collins Startup list [Windows Service Pack2] Number=12723 Confirmed=X Filename=svchhost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Service Pack2] Number=12724 Confirmed=X Filename=WIN43.EXE Description=Added by the GAOBOT.G WORM! Source=Paul Collins Startup list [Windows Service Support Call] Number=12725 Confirmed=X Filename=SVSS32.EXE Description=Added by the RBOT-XQ WORM! Source=Paul Collins Startup list [Windows Service Utitity] Number=12726 Confirmed=X Filename=winsrvc.exe Description=Added by the RBOT-ASI WORM! Source=Paul Collins Startup list [Windows Service XP] Number=12727 Confirmed=X Filename=XpFirewall.exe Description=Added by the MYTOB.AM WORM! Source=Paul Collins Startup list [Windows Services] Number=12728 Confirmed=X Filename=service.exe Description=Added by the RANDEX.R WORM! Source=Paul Collins Startup list [Windows Services] Number=12729 Confirmed=X Filename=svchosts.exe Description=Added by the AGOBOT-KL TROJAN! Source=Paul Collins Startup list [Windows Services] Number=12730 Confirmed=X Filename=Explorer.exe Description=Added by the SDBOT-WT WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder Source=Paul Collins Startup list [Windows Services] Number=12731 Confirmed=X Filename=NetworkDriver32.exe Description=Added by the RBOT-ACR WORM! Source=Paul Collins Startup list [Windows Services] Number=12732 Confirmed=X Filename=scmsg.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Services] Number=12733 Confirmed=X Filename=scvhoste.exe Description=Added by SPYBOT.OBZ WORM! Source=Paul Collins Startup list [Windows Services] Number=12734 Confirmed=X Filename=winsvc32.exe Description=Added by the MYTOB-CB WORM! Source=Paul Collins Startup list [Windows Services] Number=12735 Confirmed=X Filename=NetworkDrivers.exe Description=Added by the SDBOT-YO WORM! Source=Paul Collins Startup list [Windows Services] Number=12736 Confirmed=X Filename=smsc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Services] Number=12737 Confirmed=X Filename=spoolsvc.exe Description=Added by the SDBOT.CPZ WORM! Source=Paul Collins Startup list [Windows Services] Number=12738 Confirmed=X Filename=iexplore.exe Description=Added by the RBOT-WE WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [Windows Services Host] Number=12739 Confirmed=X Filename=svchost.exe Description=Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Services Hosts] Number=12740 Confirmed=X Filename=svhosts.exe Description=Added by the SDBOT-YH TROJAN! Source=Paul Collins Startup list [Windows Services Ink Platform Tablet Input Subsystem] Number=12741 Confirmed=X Filename=wsiptis.exe Description=Added by the RBOT.APC WORM! Source=Paul Collins Startup list [Windows Services Layer] Number=12742 Confirmed=X Filename=winlogz2.exe Description=Added by the RBOT-FZE WORM! Source=Paul Collins Startup list [Windows Services Layer] Number=12743 Confirmed=X Filename=winl0g0.exe Description=Added by the RBOT-FZQ WORM! Source=Paul Collins Startup list [Windows Services Layer] Number=12744 Confirmed=X Filename=sslms.exe Description=Added by the RBOT-GAH WORM! Source=Paul Collins Startup list [Windows Services Update] Number=12745 Confirmed=X Filename=svch0st.exe Description=Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [Windows Session Manager] Number=12746 Confirmed=X Filename=smss32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Session Manager Subsystem] Number=12747 Confirmed=X Filename=smss.exe Description=Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows shell] Number=12748 Confirmed=? Filename=win70.exe Description=?? Source=Paul Collins Startup list [Windows Shell] Number=12749 Confirmed=X Filename=shell.exe Description=Added by the MYTOB-CA WORM! Source=Paul Collins Startup list [Windows Shell] Number=12750 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB.BV WORM! Source=Paul Collins Startup list [Windows Shell Library Loader] Number=12751 Confirmed=X Filename=load shell.dll Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [windows shellext.32] Number=12752 Confirmed=X Filename=mschost.exe Description=Added by the BLASTER.K WORM! Source=Paul Collins Startup list [WINDOWS SKY] Number=12753 Confirmed=X Filename=sky.exe Description=Added by the MYTOB.CH WORM! Source=Paul Collins Startup list [Windows Smart Manager] Number=12754 Confirmed=X Filename=smart.exe Description=Added by the RBOT-SL WORM! Source=Paul Collins Startup list [Windows Socket Procedure] Number=12755 Confirmed=X Filename=WinSock32.exe Description=Added by the RBOT-FMX WORM! Source=Paul Collins Startup list [Windows Software] Number=12756 Confirmed=X Filename=hbsppe.exe Description=Added by the RBOT-GLL WORM! Source=Paul Collins Startup list [Windows Sound Driver] Number=12757 Confirmed=X Filename=SndMon32.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Sound Manager] Number=12758 Confirmed=X Filename=SndMon32.exe Description=Added by the FORBOT-BU WORM! Source=Paul Collins Startup list [Windows Sound Manager] Number=12759 Confirmed=X Filename=SndMon16.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Windows Sound Verifier] Number=12760 Confirmed=X Filename=WinIp32.exe Description=Added by the RBOT-FMO WORM! Source=Paul Collins Startup list [Windows SP2 Firewall] Number=12761 Confirmed=X Filename=wfirewall7.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows SP2 Update] Number=12762 Confirmed=X Filename=Sp2update.exe Description=Added by the WOOTBOT.BS WORM! Source=Paul Collins Startup list [Windows SP2 Version Load] Number=12763 Confirmed=X Filename=wuauclt32.exe Description=Added by the GAOBOT.CX WORM! Source=Paul Collins Startup list [Windows SP4] Number=12764 Confirmed=X Filename=directCC.exe Description=Added by the RBOT-ACX WORM! Source=Paul Collins Startup list [Windows Spool Server] Number=12765 Confirmed=X Filename=spoolsrv.exe Description=Added by the SDBOT-ACT WORM! Source=Paul Collins Startup list [Windows SpoolaPrint Service] Number=12766 Confirmed=X Filename=spoolasrv.exe Description=Added by the SDBOT-AYD WORM! Source=Paul Collins Startup list [Windows Spooler] Number=12767 Confirmed=X Filename=SPOOLSRV.EXE Description=Added by the SPYBOT.P WORM! Source=Paul Collins Startup list [Windows Spooler] Number=12768 Confirmed=X Filename=spoolsv32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Spooler Services] Number=12769 Confirmed=X Filename=spool.exe Description=Added by the AGOBOT-AMO WORM! Source=Paul Collins Startup list [Windows SpoolPrint Service] Number=12770 Confirmed=X Filename=spoolersrv.exe Description=Added by the SDBOT-ZT WORM! Source=Paul Collins Startup list [Windows Spools SV] Number=12771 Confirmed=X Filename=winsv.exe Description=Added by the RBOT-AUQ WORM! Source=Paul Collins Startup list [Windows spoolservr Service] Number=12772 Confirmed=X Filename=spoolservr.exe Description=Added by the SDBOT-AAN WORM! Source=Paul Collins Startup list [Windows Spoolsre Service] Number=12773 Confirmed=X Filename=spoolsre.exe Description=Added by the SDBOT-AAE WORM! Source=Paul Collins Startup list [Windows Spoolsrv Service] Number=12774 Confirmed=X Filename=spoolmsv.exe Description=Added by the SDBOT-ZS WORM! Source=Paul Collins Startup list [windows spoolsrv service] Number=12775 Confirmed=X Filename=spoolssv.exe Description=Added by the SDBOT-AWV WORM! Source=Paul Collins Startup list [Windows Spoolsurf Service] Number=12776 Confirmed=X Filename=spoolsurf.exe Description=Added by the SDBOT-ZZ WORM! Source=Paul Collins Startup list [Windows SpooltPrint Service] Number=12777 Confirmed=X Filename=spooltsrv.exe Description=Added by the SDBOT-AYE WORM! Source=Paul Collins Startup list [Windows Spoolvvv Service] Number=12778 Confirmed=X Filename=spoolvvv.exe Description=Added by the SDBOT-AAW WORM! Source=Paul Collins Startup list [Windows spyware remover] Number=12779 Confirmed=X Filename=Windows-spyware.exe Description=Added by the SystemPoser TROJAN! Source=Paul Collins Startup list [Windows sq Drivers] Number=12780 Confirmed=X Filename=winmsn32.exe Description=Added by the RBOT-ADI WORM! Source=Paul Collins Startup list [Windows Sql Service For Windows 32 Bit] Number=12781 Confirmed=X Filename=winsql32.exe Description=Added by the FORBOT-FC WORM! Source=Paul Collins Startup list [Windows SSH Client] Number=12782 Confirmed=X Filename=winssh.exe Description=Added by the RBOT-AXC WORM! Source=Paul Collins Startup list [Windows SSL File] Number=12783 Confirmed=X Filename=winssv.exe Description=Added by the WOOTBOT.CA WORM! Source=Paul Collins Startup list [Windows SSL Secondary Drivers] Number=12784 Confirmed=X Filename=SSL32Dr.exe Description=Added by the SDBOT.ASQ WORM! Source=Paul Collins Startup list [Windows Stand Sound Drivers] Number=12785 Confirmed=X Filename=Sounddrv.exe Description=Added by the SDBOT-XF WORM! Source=Paul Collins Startup list [Windows Standard Securty] Number=12786 Confirmed=X Filename=[random 3-letter filename] Description=Added by the RBOT-ALF WORM! Source=Paul Collins Startup list [Windows Start Server 2000] Number=12787 Confirmed=X Filename=traficy.exe Description=Added by the RBOT-AHM WORM! Source=Paul Collins Startup list [Windows Startup] Number=12788 Confirmed=X Filename=winsta~1.exe Description=GoHip foistware Source=Paul Collins Startup list [Windows Startup] Number=12789 Confirmed=X Filename=winstartup.exe Description=GoHip foistware Source=Paul Collins Startup list [Windows Startup] Number=12790 Confirmed=X Filename=Wdrun32.exe Description=Added by the GAOBOT.AO WORM! Source=Paul Collins Startup list [Windows Startup] Number=12791 Confirmed=X Filename=services21.exe Description=Added by the AGOBOT-MX WORM! Source=Paul Collins Startup list [Windows Startup 32 Bits] Number=12792 Confirmed=X Filename=sysrun32.exe Description=Added by a variant of the DARKSUN TROJAN! Source=Paul Collins Startup list [Windows Stortup] Number=12793 Confirmed=X Filename=svchost.exe Description=Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Windows Streams Server] Number=12794 Confirmed=X Filename=localsrv.exe Description=Added by the SDBOT.LN WORM! Source=Paul Collins Startup list [Windows Subsys] Number=12795 Confirmed=X Filename=winload.exe Description=Added by the NETSPREE.C WORM! Source=Paul Collins Startup list [WINDOWS SVC] Number=12796 Confirmed=X Filename=winsvc.exe Description=Added by the MYTOB-EY WORM! Source=Paul Collins Startup list [Windows Svshost Service Update 32] Number=12797 Confirmed=X Filename=svcsshost32.exe Description=Added by the FORBOT-GD WORM! Source=Paul Collins Startup list [Windows SyncroAd] Number=12798 Confirmed=X Filename=SyncroAd.exe Description=Windupdates adware variant Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12799 Confirmed=X Filename=beta.exe Description=Added by the MYTOB.DF WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12800 Confirmed=X Filename=dcomuser.exe Description=Added by the MYTOB.EO WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12801 Confirmed=X Filename=lf66prc.exe Description=Added by the MYTOB.GC WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12802 Confirmed=X Filename=msdev32.exe Description=Added by the MYTOB.EH WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12803 Confirmed=X Filename=nec.exe Description=Added by the MYTOB-L WORM or variants! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12804 Confirmed=X Filename=nibie.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12805 Confirmed=X Filename=ninfoie.exe Description=Added by the MYTOB-EP WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12806 Confirmed=X Filename=skybot.exe Description=Added by the MYTOB-CX WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12807 Confirmed=X Filename=skybotx.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12808 Confirmed=X Filename=smoc.exe Description=Added by the MYTOB.FU WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12809 Confirmed=X Filename=smsc.exe Description=Added by the MYTOB-BR WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12810 Confirmed=X Filename=test.exe Description=Added by the MYTOB.DJ WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12811 Confirmed=U Filename=test2.exe Description=Added by the MYTOB.DJ WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12812 Confirmed=X Filename=test3.exe Description=Added by the MYTOB.DV WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12813 Confirmed=X Filename=wdns33.exe Description=Added by the MYTOB-BY WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12814 Confirmed=X Filename=win.exe.exe Description=Added by the MYTOB.FA WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12815 Confirmed=X Filename=winaup.exe Description=Added by the MYTOB-DN WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12816 Confirmed=X Filename=winligon.exe Description=Added by the MYTOB.EP WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12817 Confirmed=X Filename=winmon.exe Description=Added by the MYTOB.GB WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12818 Confirmed=X Filename=winNTsys32.exe Description=Added by the MYTOB-DM WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12819 Confirmed=X Filename=winsvc32.exe Description=Added by the MYTOB.HH WORM! Source=Paul Collins Startup list [Windows System] Number=12820 Confirmed=X Filename=WINSYS.exe Description=Added by the RBOT-AEF WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12821 Confirmed=X Filename=winsys33.exe Description=Added by the MYTOB.EK WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12822 Confirmed=X Filename=winvnc.exe Description=Added by the MYTOB.EU WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12823 Confirmed=X Filename=winxpserv.exe Description=Added by the MYTOB-BQ WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12824 Confirmed=X Filename=xxx.exe Description=Added by the MYTOB.CZ WORM! Source=Paul Collins Startup list [Windows System] Number=12825 Confirmed=X Filename=winsys32.exe Description=Added by the MYTOB-IS WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12826 Confirmed=X Filename=\skybot.exe Description=Added by the MYTOB.JU WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12827 Confirmed=X Filename=botzor.exe Description=Added by the ZOTOB WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12828 Confirmed=X Filename=gothica.exe Description=Added by the MYTOB.HU WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12829 Confirmed=X Filename=msnl.exe Description=Added by the MYTOB.IK WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12830 Confirmed=X Filename=per.exe Description=Added by the ZOTOB.C WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12831 Confirmed=X Filename=twunk_65.exe Description=Added by the MYTOB-EG WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12832 Confirmed=X Filename=servce.exe Description=Added by the MYTOB-EI WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12833 Confirmed=X Filename=servises.exe Description=Added by the ZOTOB-I WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12834 Confirmed=X Filename=xpupdate.exe Description=Added by the ZOTOB-G WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12835 Confirmed=X Filename=expI0rer.exe Description=Added by the MYTOB-FI WORM! Note the upper case "i" and number "0" in the filename Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12836 Confirmed=X Filename=msn32.exe Description=Added by the MYTOB-FX WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12837 Confirmed=X Filename=sky.exe Description=Added by the MYTOB.LB WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12838 Confirmed=X Filename=Win32IMAPSVR.exe Description=Added by the MYTOB-FQ or MYTOB-FU WORMS! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12839 Confirmed=X Filename=winsvc.exe Description=Added by the MYTOB.LM WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12840 Confirmed=X Filename=mswins.exe Description=Added by the MYTOB.DP WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12841 Confirmed=X Filename=mtrnqs.exe Description=Added by the MYTOB.IG WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM] Number=12842 Confirmed=X Filename=logic.exe Description=Added by the MYTOB.IC WORM! Source=Paul Collins Startup list [Windows System 32] Number=12843 Confirmed=X Filename=winsys_32.exe Description=Added by the RBOT-FTR WORM! Source=Paul Collins Startup list [Windows System 32-Bat Service] Number=12844 Confirmed=X Filename=win32bat.exe Description=Added by the MYTOB.FI WORM! Source=Paul Collins Startup list [Windows System Backup] Number=12845 Confirmed=X Filename=SysBackup.exe Description=Unidentified malware Source=Paul Collins Startup list [WINDOWS SYSTEM By FEnR] Number=12846 Confirmed=X Filename=windasz-updote.exe Description=Added by the MYTOB.LR WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM Cleaner] Number=12847 Confirmed=X Filename=h3.exe Description=Added by the MYTOB.EQ WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM CLEANER] Number=12848 Confirmed=X Filename=iexplore.exe Description=Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) Source=Paul Collins Startup list [Windows System Configuration] Number=12849 Confirmed=X Filename=SYSCFG16.EXE Description=Added by the WISDOOR.Z TROJAN! Source=Paul Collins Startup list [Windows System Configuration] Number=12850 Confirmed=X Filename=Passcfg16.exe Description=Added by the DOMWIS-E TROJAN! Source=Paul Collins Startup list [Windows System Configuration] Number=12851 Confirmed=X Filename=Winfrw.exe Description=Added by the SOLUFINA TROJAN or the DOMWIS-J WORM! Source=Paul Collins Startup list [Windows System Configuration] Number=12852 Confirmed=X Filename=wincfg.exe Description=Added by the AGOBOT.OP WORM! Source=Paul Collins Startup list [Windows System Configuration] Number=12853 Confirmed=X Filename=WINCFG32.EXE Description=Added by the AGOBOT-TE WORM! Source=Paul Collins Startup list [Windows System Configuration] Number=12854 Confirmed=X Filename=WinNeth.exe Description=Added by the RETHE-A WORM! Source=Paul Collins Startup list [Windows System Configuration] Number=12855 Confirmed=X Filename=nether.exe Description=Added by the Opanki-AB WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM Dns] Number=12856 Confirmed=X Filename=windsns.exe Description=Added by the MYTOB.EY WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM DNSPOOL] Number=12857 Confirmed=X Filename=hbmail.exe Description=Added by the MYTOB.FW WORM! Source=Paul Collins Startup list [Windows System File] Number=12858 Confirmed=X Filename=cmxp.exe Description=Added by the SPYBOT.KHO WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM FILE] Number=12859 Confirmed=X Filename=winload.exe Description=Added by the MYTOB.DK WORM! Source=Paul Collins Startup list [Windows System Gateway] Number=12860 Confirmed=X Filename=SPOOLER.EXE Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows System Init] Number=12861 Confirmed=X Filename=winit32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows System Manager] Number=12862 Confirmed=X Filename=winsystem.exe Description=Added by the RBOT-AN WORM! Source=Paul Collins Startup list [Windows System Manager] Number=12863 Confirmed=X Filename=CRSL.EXE Description=Added by the SDBOT.MG WORM! Source=Paul Collins Startup list [Windows System Manager] Number=12864 Confirmed=X Filename=sysconf.exe Description=Added by the MYTOB.AL WORM! Source=Paul Collins Startup list [Windows System Manager] Number=12865 Confirmed=X Filename=smsc.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows System Manager] Number=12866 Confirmed=X Filename=crssm.exe Description=Added by the RBOT-AFH WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM MANAGER] Number=12867 Confirmed=X Filename=spoolsvc.exe Description=Added by the MYTOB-LY WORM! Source=Paul Collins Startup list [Windows System Manager Loader] Number=12868 Confirmed=X Filename=smsls.exe Description=Added by the AGOBOT.TF WORM! Source=Paul Collins Startup list [Windows System Manager Proc] Number=12869 Confirmed=X Filename=winsmc.exe Description=Added by the RBOT.JH WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM MEMORY LOADER] Number=12870 Confirmed=X Filename=memloader.exe Description=Added by the MYTOB-IN WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM mscdvvs] Number=12871 Confirmed=X Filename=mscdvvs.exe Description=Added by the MYTOB.MD WORM! Source=Paul Collins Startup list [windows system notepad] Number=12872 Confirmed=X Filename=wnpsm.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows System Restore Configuration] Number=12873 Confirmed=X Filename=Sblhost.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows System Restorer] Number=12874 Confirmed=X Filename=SystemRestorer.exe Description=Added by the DULOAD.C WORM! Source=Paul Collins Startup list [WINDOWS SYSTEM SCALPE] Number=12875 Confirmed=X Filename=scalpe91.exe Description=Added by the MYTOB_HI WORM! Source=Paul Collins Startup list [Windows System Security] Number=12876 Confirmed=X Filename=winmp.exe Description=Added by the RBOT.IV WORM! Source=Paul Collins Startup list [Windows System Security] Number=12877 Confirmed=X Filename=sys32.pif Description=Added by the RBOT-AOL WORM! Source=Paul Collins Startup list [Windows System Security Monitor] Number=12878 Confirmed=X Filename=[4 random letters].exe Description=Added by the PINKTON.A WORM! Source=Paul Collins Startup list [Windows System Serivce] Number=12879 Confirmed=X Filename=winserv.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [windows system service] Number=12880 Confirmed=X Filename=winsock.exe Description=Added by the RBOT-MR WORM! Source=Paul Collins Startup list [Windows System Service] Number=12881 Confirmed=X Filename=wnuserv.exe Description=Added by the SPYBOT.ANDM WORM! Source=Paul Collins Startup list [Windows System Tray] Number=12882 Confirmed=U Filename=msni.exe Description=Iambigbrother monitoring software Source=Paul Collins Startup list [Windows System Tray] Number=12883 Confirmed=X Filename=swhost.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [WINDOWS SYSTEM UPDATE] Number=12884 Confirmed=X Filename=xDcc.exe Description=Added by the MYOTB-EH WORM! Source=Paul Collins Startup list [Windows System32] Number=12885 Confirmed=X Filename=windowsp.exe Description=Added by the MYTOB.GD WORM! Source=Paul Collins Startup list [Windows System32] Number=12886 Confirmed=X Filename=winsys32.exe Description=Added by the SDBOT-AHS WORM! Source=Paul Collins Startup list [Windows System32] Number=12887 Confirmed=X Filename=clsas32.exe Description=Added by the RBOT-AZO WORM! Source=Paul Collins Startup list [Windows System32] Number=12888 Confirmed=X Filename=explorer.exe Description=Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [Windows System32] Number=12889 Confirmed=X Filename=System32.exe Description=Added by the SDBOT-ALI WORM! Source=Paul Collins Startup list [Windows SYSTEM32] Number=12890 Confirmed=X Filename=Realplayer.exe Description=Added by the SPYBOT.ZH WORM! Source=Paul Collins Startup list [Windows System32] Number=12891 Confirmed=X Filename=wingrd32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows System32 Kernel] Number=12892 Confirmed=X Filename=system32.exe Description=Added by the SDBOT-AAT WORM! Source=Paul Collins Startup list [WINDOWS SYSTEMn] Number=12893 Confirmed=X Filename=servicces.exe Description=Added by the MYTOB-EL WORM! Source=Paul Collins Startup list [Windows Systemnmg] Number=12894 Confirmed=X Filename=stagmr.exe Description=Added by the MYTOB.S WORM! Source=Paul Collins Startup list [Windows Systems16] Number=12895 Confirmed=X Filename=winjews16.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Sz Host] Number=12896 Confirmed=X Filename=winshvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Task Manager] Number=12897 Confirmed=X Filename=ACCOUNT_DETAILS.DOC.exe Description=Added by the QUATERS.A WORM! Source=Paul Collins Startup list [Windows Task Manager] Number=12898 Confirmed=X Filename=taskmgn.exe Description=Unidentified malware, either a variant of the WIN32.RBOT WORM, or part of a Casino Palazzo foistware install Source=Paul Collins Startup list [Windows Task Manager] Number=12899 Confirmed=X Filename=taskmrg.exe Description=Added by the MYTOB.AV WORM! Source=Paul Collins Startup list [Windows Task Manager] Number=12900 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB.BJ WORM! Source=Paul Collins Startup list [Windows Task Manager] Number=12901 Confirmed=X Filename=taskmg.exe Description=Browser hijacker - identified by DrWeb antivirus as "Trojan.StartPage.601" Source=Paul Collins Startup list [Windows Task Manager] Number=12902 Confirmed=X Filename=taskmngr.exe Description=Added by the RBOT-ANM WORM! Source=Paul Collins Startup list [Windows Task Manager Emulator] Number=12903 Confirmed=X Filename=kennewr.exe Description=Added by the SPYBOT-FA WORM! Source=Paul Collins Startup list [Windows Task Scheduler] Number=12904 Confirmed=X Filename=asijdie.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Task Service (32-bits)] Number=12905 Confirmed=X Filename=tasksys.exe Description=Added by the DREFIR.D WORM! Source=Paul Collins Startup list [Windows TaskAd] Number=12906 Confirmed=X Filename=Wintaskad.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Windows Taskbar Manager] Number=12907 Confirmed=X Filename=internat.exe Description=Added by the PROTORIDE-H WORM! Source=Paul Collins Startup list [Windows Taskbar Manager] Number=12908 Confirmed=X Filename=[path to file] Description=Added by the PROTORIDE.B WORM! Source=Paul Collins Startup list [Windows Taskbar System] Number=12909 Confirmed=X Filename=tasksys.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Taskmanager] Number=12910 Confirmed=X Filename=lsassx.exe Description=Added by the KELVIR.E WORM! Source=Paul Collins Startup list [Windows TCP/IP] Number=12911 Confirmed=X Filename=wintcp.exe Description=Added by the AGOBOT-ZH WORM! Source=Paul Collins Startup list [Windows Telnet Server] Number=12912 Confirmed=X Filename=wintel.exe Description=Added by the AGOBOT-MW WORM! Source=Paul Collins Startup list [Windows Time] Number=12913 Confirmed=X Filename=tmservice.exe Description=Added by a variant of the RBOT-YK WORM! Source=Paul Collins Startup list [Windows Time] Number=12914 Confirmed=X Filename=winmgr.exe Description=Added by the RBOT-XC WORM! Source=Paul Collins Startup list [Windows Time Server] Number=12915 Confirmed=X Filename=TimeSRV.exe Description=Added by the SPYBOT.DNC WORM! Source=Paul Collins Startup list [Windows TM] Number=12916 Confirmed=X Filename=SVPHOST.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows TM] Number=12917 Confirmed=X Filename=rundlI32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows TM] Number=12918 Confirmed=X Filename=windowssys32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows TM] Number=12919 Confirmed=X Filename=WinxSys.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Upate] Number=12920 Confirmed=X Filename=rundll.exe Description=Added by the HAKO TROJAN! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [Windows Update] Number=12921 Confirmed=X Filename=[filename] Description=Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites Source=Paul Collins Startup list [Windows Update] Number=12922 Confirmed=X Filename=iexplorere.exe Description=Added by the GAOBOT.AP WORM! Source=Paul Collins Startup list [windows update] Number=12923 Confirmed=X Filename=uddater.exe Description=Added by the LEOX TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12924 Confirmed=X Filename=wudate.exe Description=Added by the AGOBOT.ML WORM! Source=Paul Collins Startup list [Windows Update] Number=12925 Confirmed=X Filename=wupdate.exe Description=Wengs adware Source=Paul Collins Startup list [windows update] Number=12926 Confirmed=X Filename=sychost.exe Description=Added by the LEOX.B WORM! Source=Paul Collins Startup list [Windows Update] Number=12927 Confirmed=X Filename=Wuamgrd.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Update] Number=12928 Confirmed=X Filename=inetinf.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Windows Update] Number=12929 Confirmed=X Filename=WindowsUpdate.exe Description=Added by the BAYROB-A TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12930 Confirmed=X Filename=host32.exe Description=Added by the RBOT-GU WORM! Source=Paul Collins Startup list [windows update] Number=12931 Confirmed=X Filename=wuraclt.exe Description=Added by the RBOT-PO WORM! Source=Paul Collins Startup list [windows update] Number=12932 Confirmed=X Filename=Wuanclt.exe Description=Added by the RBOT.XZ WORM! Source=Paul Collins Startup list [Windows Update] Number=12933 Confirmed=X Filename=svchosts.exe Description=Added by the FRUCTA TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12934 Confirmed=X Filename=ebay.exe Description=Added by the GAOBOT.BUU WORM! Source=Paul Collins Startup list [Windows Update] Number=12935 Confirmed=X Filename=windows.exe Description=Added by the RBOT-RB WORM! Source=Paul Collins Startup list [windows update] Number=12936 Confirmed=X Filename=wuaurlt.exe Description=Added by the RBOT.ADG WORM! Source=Paul Collins Startup list [Windows Update] Number=12937 Confirmed=X Filename=Update.exe Description=Added by the DELF-FN TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12938 Confirmed=X Filename=winmguard.exe Description=Added by the RBOT-EM WORM! Source=Paul Collins Startup list [Windows Update] Number=12939 Confirmed=X Filename=wuampd.exe Description=Added by the RBOT.UM WORM! Source=Paul Collins Startup list [windows update] Number=12940 Confirmed=X Filename=wuarclt.exe Description=Added by the RBOT-OF WORM! Source=Paul Collins Startup list [Windows Update] Number=12941 Confirmed=X Filename=winupdate.exe Description=Added by the SDBOT-WS WORM! Source=Paul Collins Startup list [Windows Update] Number=12942 Confirmed=X Filename=msnwinsb.exe Description=Added by the RBOT-AAH WORM! Source=Paul Collins Startup list [Windows Update] Number=12943 Confirmed=X Filename=scvhost.exe Description=Added by the SDBOT-XT WORM! Source=Paul Collins Startup list [windows update] Number=12944 Confirmed=X Filename=Microsoft.exe Description=Added by the LMIR.A TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12945 Confirmed=X Filename=mplupdate.exe Description=Added by the MOEGA WORM! Source=Paul Collins Startup list [windows update] Number=12946 Confirmed=X Filename=msnsever.exe Description=Added by the RBOT-AHN WORM! Source=Paul Collins Startup list [Windows Update] Number=12947 Confirmed=X Filename=taskmr.exe Description=Added by the MYTOB-GZ WORM! Source=Paul Collins Startup list [Windows Update] Number=12948 Confirmed=X Filename=update32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Update] Number=12949 Confirmed=X Filename=wininfo.exe Description=Added by the MYTOB.GA WORM! Source=Paul Collins Startup list [Windows Update] Number=12950 Confirmed=X Filename=winlogin.exe Description=Added by the BANKER-DV TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12951 Confirmed=X Filename=msnupdates.exe Description=Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN Source=Paul Collins Startup list [Windows Update] Number=12952 Confirmed=X Filename=qtask.exe Description=Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here Source=Paul Collins Startup list [windows update] Number=12953 Confirmed=X Filename=real.exe Description=Added by the LEGMIR-AU WORM! Source=Paul Collins Startup list [Windows Update] Number=12954 Confirmed=X Filename=windowsx.exe Description=Added by the BANCD-A TROJAN! Source=Paul Collins Startup list [Windows update] Number=12955 Confirmed=X Filename=wudupdate.exe Description=Adware downloader - Istbar related Source=Paul Collins Startup list [Windows Update] Number=12956 Confirmed=X Filename=wupdmgr.exe Description=Added by the BANCBAN-FC TROJAN and variants! Source=Paul Collins Startup list [Windows Update] Number=12957 Confirmed=X Filename=csrss.exe Description=Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [Windows Update] Number=12958 Confirmed=X Filename=msnsupdate.exe Description=Added by the RBOT-AXS WORM! Source=Paul Collins Startup list [Windows Update] Number=12959 Confirmed=X Filename=XPLoogNT.exe Description=Added by the BANCD-B TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12960 Confirmed=X Filename=install.exe Description=Added by the BANKER-IB TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12961 Confirmed=X Filename=msi.exe Description=Added by the BANKER-XB TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12962 Confirmed=X Filename=Sqltob.exe Description=Added by the DASHER.A WORM! Source=Paul Collins Startup list [windows update] Number=12963 Confirmed=X Filename=logonuit.exe Description=Added by the LEGMIR-AO TROJAN! Source=Paul Collins Startup list [Windows Update] Number=12964 Confirmed=X Filename=avkir.exe Description=Added by the RBOT-GJP WORM! Source=Paul Collins Startup list [Windows Update 32] Number=12965 Confirmed=X Filename=winlogons.exe Description=Added by the FORBOT-FI WORM! Source=Paul Collins Startup list [Windows Update 32] Number=12966 Confirmed=X Filename=rempss.exe Description=Added by the FORBOT-FW WORM! Source=Paul Collins Startup list [Windows Update 32] Number=12967 Confirmed=X Filename=slsys.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Windows Update 63] Number=12968 Confirmed=X Filename=shupd64.exe Description=Added by the FORBOT-GA WORM! Source=Paul Collins Startup list [Windows Update 64] Number=12969 Confirmed=X Filename=nbupd64.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Windows Update 64] Number=12970 Confirmed=X Filename=WinV.exe Description=Added by the FORBOT-FP WORM! Source=Paul Collins Startup list [Windows Update Auto Update] Number=12971 Confirmed=X Filename=wuaumgr.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Update AutoUpdate Client] Number=12972 Confirmed=X Filename=waucult.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Update AutoUpdate Client] Number=12973 Confirmed=X Filename=wuauclt.exe Description=Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows Update AutoUpdate Client Product] Number=12974 Confirmed=X Filename=wuauct.exe Description=Added by the AGOBOT.ACL WORM! Source=Paul Collins Startup list [Windows Update Center] Number=12975 Confirmed=X Filename=svthx.exe Description=Added by the STUBBOT.A WORM! Source=Paul Collins Startup list [Windows Update Center] Number=12976 Confirmed=X Filename=W32RSA.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows Update Checker] Number=12977 Confirmed=X Filename=[random filename] Description=Adware downloader trojan Source=Paul Collins Startup list [Windows Update Checker] Number=12978 Confirmed=X Filename=msupdte32.exe Description=Added by the SDBOT-AEF WORM! Source=Paul Collins Startup list [Windows Update Checker] Number=12979 Confirmed=X Filename=deinst_qfe001.exe Description=Added by a variant of the Win32.Small TROJAN! Source=Paul Collins Startup list [Windows Update Checker] Number=12980 Confirmed=X Filename=deinst_qfe002.exe Description=Added by a variant of the Win32.Small TROJAN! Source=Paul Collins Startup list [Windows Update Client] Number=12981 Confirmed=X Filename=wuclient.exe Description=Added by the SMALL-RN TROJAN! Source=Paul Collins Startup list [Windows Update Client Service] Number=12982 Confirmed=X Filename=windrvl32.exe Description=Added by the AGOBOT-MM TROJAN! Source=Paul Collins Startup list [Windows update config] Number=12983 Confirmed=X Filename=svhost.exe Description=Added by the SDBOT-PF WORM! Source=Paul Collins Startup list [windows update configurator] Number=12984 Confirmed=X Filename=svghost.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows Update Controller] Number=12985 Confirmed=X Filename=mwoffice.exe Description=Added by the BATTRY-A TROJAN! Source=Paul Collins Startup list [Windows Update Drive] Number=12986 Confirmed=X Filename=updrvs.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Update Files] Number=12987 Confirmed=X Filename=dnetc.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - wupdmgr.exe is the real Windows Update Source=Paul Collins Startup list [Windows Update Firewall System] Number=12988 Confirmed=X Filename=ctfmoom.exe Description=Added by the RBOT-GAN WORM! Source=Paul Collins Startup list [Windows Update GUI Executable x32x] Number=12989 Confirmed=X Filename=wupdategux32.exe Description=Added by the RBOT.CXY WORM! Source=Paul Collins Startup list [Windows Update GUI Executable x32x] Number=12990 Confirmed=X Filename=wupdategux32.exe Description=Added by the RBOT.CXY WORM! Source=Paul Collins Startup list [Windows Update Host] Number=12991 Confirmed=X Filename=winupsvc.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Update IPv6 Layer] Number=12992 Confirmed=X Filename=WIN32IPV6.EXE Description=Added by the RBOT.DUD WORM! Source=Paul Collins Startup list [Windows update loader] Number=12993 Confirmed=X Filename=xpupdate.exe Description=Added by the BRAVE-A TROJAN! Source=Paul Collins Startup list [Windows Update Manager] Number=12994 Confirmed=X Filename=wupdmngr.exe Description=Added by the RANDEX.BTB WORM! Source=Paul Collins Startup list [Windows Update Manager] Number=12995 Confirmed=X Filename=Winlog0n.exe Description=Added by the AGENT-BO TROJAN! Source=Paul Collins Startup list [Windows Update Manager] Number=12996 Confirmed=X Filename=wupdate.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Update Manager] Number=12997 Confirmed=X Filename=bootwiz.exe Description=Added by the MYBOT WORM! Source=Paul Collins Startup list [Windows Update Manager for NT] Number=12998 Confirmed=X Filename=wupdmgr32.exe Description=Added by the SDBOT.AH WORM! Source=Paul Collins Startup list [Windows Update Monitoring Service] Number=12999 Confirmed=X Filename=winupdt.exe Description=Added by the RBOT-PL WORM! Source=Paul Collins Startup list [Windows Update Process] Number=13000 Confirmed=X Filename=wmiprvsc.exe Description=Added by the SDBOT-CB WORM! Source=Paul Collins Startup list [Windows Update Service] Number=13001 Confirmed=X Filename=csrs.exe Description=Added by the AGOBOT-NI WORM! Source=Paul Collins Startup list [Windows Update Service] Number=13002 Confirmed=X Filename=smcg.exe Description=Added by the SDBOT.QY WORM! Source=Paul Collins Startup list [Windows Update Service] Number=13003 Confirmed=X Filename=SP00ISS.exe Description=Added by the SDBOT-ZH WORM! Source=Paul Collins Startup list [Windows Update Service] Number=13004 Confirmed=X Filename=update32.pif Description=Added by the RBOT-ALC WORM! Source=Paul Collins Startup list [Windows Update Service 2004/2005] Number=13005 Confirmed=X Filename=systemupdate.exe Description=Added by the RBOT-JE WORM! Source=Paul Collins Startup list [Windows Update services] Number=13006 Confirmed=X Filename=wins32svcs.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Update Software] Number=13007 Confirmed=X Filename=system.exe Description=Added by the TOFGER.BX TROJAN! Source=Paul Collins Startup list [Windows Update System] Number=13008 Confirmed=X Filename=mswins.exe Description=Added by the IRCBOT.DN WORM! Source=Paul Collins Startup list [Windows Update System Shell] Number=13009 Confirmed=X Filename=svhostcs32.exe Description=Added by the RBOT-AAZ WORM! Source=Paul Collins Startup list [Windows Update V6] Number=13010 Confirmed=X Filename=[random filename] Description=Added by the RBOT-KT WORM! Source=Paul Collins Startup list [Windows Update.exe] Number=13011 Confirmed=X Filename=N/A Description=Homepage hijacker Source=Paul Collins Startup list [Windows Updated] Number=13012 Confirmed=X Filename=spoolsae.exe Description=Added by the RBOT-APM WORM! Source=Paul Collins Startup list [Windows Updated] Number=13013 Confirmed=X Filename=updatr.exe Description=Added by the RBOT-AYB WORM! Source=Paul Collins Startup list [Windows Updater] Number=13014 Confirmed=X Filename=wupdmgr32.exe Description=Added by a variant of the DOS.AUTOCAT TROJAN! Source=Paul Collins Startup list [Windows Updater] Number=13015 Confirmed=X Filename=iexplorerrs.exe Description=Added by the RBOT-TN WORM! Source=Paul Collins Startup list [Windows Updater] Number=13016 Confirmed=X Filename=svigost.exe Description=Added by the RBOT-VS WORM! Source=Paul Collins Startup list [Windows Updater] Number=13017 Confirmed=X Filename=wupdate.exe Description=Added by the WOOTBOT.AJ WORM! Source=Paul Collins Startup list [Windows Updater] Number=13018 Confirmed=X Filename=sdsys.exe Description=Added by the FORBOT-JG WORM! Source=Paul Collins Startup list [Windows Updater Online] Number=13019 Confirmed=X Filename=winupdatexx.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Updates] Number=13020 Confirmed=X Filename=lsassx.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Updates] Number=13021 Confirmed=X Filename=winupd32.exe Description=Added by the MYTOB.CE WORM! Source=Paul Collins Startup list [Windows Updates] Number=13022 Confirmed=X Filename=w32dns.exe Description=Added by the SDBOT-BFW WORM! Source=Paul Collins Startup list [Windows Updating Service] Number=13023 Confirmed=X Filename=updating.pif Description=Added by the RBOT-ALW WORM! Source=Paul Collins Startup list [Windows Updtee Mgnr] Number=13024 Confirmed=X Filename=W1NT45K.exe Description=Added by the MYTOB.DC WORM! Source=Paul Collins Startup list [Windows USB 2.0 Driver] Number=13025 Confirmed=X Filename=usbtskmgr.exe Description=Added by the RBOT-BKG WORM! Source=Paul Collins Startup list [Windows USB 2.0 Driver] Number=13026 Confirmed=X Filename=usb2ctrl.exe Description=Added by the RBOT-BIW WORM! Source=Paul Collins Startup list [Windows USB controler] Number=13027 Confirmed=X Filename=winusb.exe Description=Added by the RBOT-HR WORM! Source=Paul Collins Startup list [Windows USB Driver Support] Number=13028 Confirmed=X Filename=Windowsusb.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows USB Service] Number=13029 Confirmed=X Filename=666.exe Description=Added by the MYTOB.AR WORM! Source=Paul Collins Startup list [Windows USBD] Number=13030 Confirmed=X Filename=msifirewall.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Windows User Mode Driver Manager] Number=13031 Confirmed=X Filename=wdfmrg.exe Description=Added by SDBOT-ZN WORM! Source=Paul Collins Startup list [Windows User Starter] Number=13032 Confirmed=X Filename=winuser32.exe Description=Added by the RBOT.SN WORM! Source=Paul Collins Startup list [Windows Version Check] Number=13033 Confirmed=N Filename=ver_chk.exe Description=Version checker for CyberAudioLibrary - "a new way to exchange information through the Internet" Source=Paul Collins Startup list [Windows video] Number=13034 Confirmed=X Filename=vide_32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [Windows Video Acquisition (WVA)] Number=13035 Confirmed=X Filename=wvsvc.exe Description=Added by the AGOBOT.YM WORM! Source=Paul Collins Startup list [Windows Video Drivers] Number=13036 Confirmed=X Filename=videons32.exe Description=Added by the GAOBOT.AZT WORM! Source=Paul Collins Startup list [Windows Virus Control] Number=13037 Confirmed=X Filename=plou.exe Description=Added by the SDBOT-ACZ WORM! Source=Paul Collins Startup list [Windows Web Services] Number=13038 Confirmed=X Filename=localsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13039 Confirmed=X Filename=netsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13040 Confirmed=X Filename=spoolsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13041 Confirmed=X Filename=svcadmin.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13042 Confirmed=X Filename=svcman.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13043 Confirmed=X Filename=svcrun.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13044 Confirmed=X Filename=tcpsvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Web Services] Number=13045 Confirmed=X Filename=websvc.exe Description=Added by the DLOADER-NY TROJAN! Source=Paul Collins Startup list [Windows Winhlp32 Stub Service] Number=13046 Confirmed=X Filename=winhlp32.pif Description=Added by the AIMBOT.AH TROJAN! Source=Paul Collins Startup list [Windows WKS] Number=13047 Confirmed=X Filename=wsass.exe Description=Added by the SDBOT-DK WORM! Source=Paul Collins Startup list [Windows WMF Fix] Number=13048 Confirmed=X Filename=winfix.exe Description=Added by the RBOT-FTQ WORM! Source=Paul Collins Startup list [Windows Workstation] Number=13049 Confirmed=X Filename=mpci.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Workstation] Number=13050 Confirmed=X Filename=msup32a.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Workstation Service] Number=13051 Confirmed=X Filename=explore.exe Description=Added by unknown malware Source=Paul Collins Startup list [Windows Workstation Service (32-bits)] Number=13052 Confirmed=X Filename=wkssvc32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Windows Workstation Start Service] Number=13053 Confirmed=X Filename=mslanmgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows Xp] Number=13054 Confirmed=X Filename=nortonguard.exe Description=Added by the MYTOB-DZ WORM! Source=Paul Collins Startup list [Windows XP Automatic Update] Number=13055 Confirmed=X Filename=wXPupdate.exe Description=Added by the RBOT-AFC WORM! Source=Paul Collins Startup list [Windows Xp Service Pack 2] Number=13056 Confirmed=X Filename=svchost.exe Description=Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [Windows XP SP2 KeyGen] Number=13057 Confirmed=X Filename=Windows XP SP2 KeyGen.exe Description=Added by the TIBICK-C WORM! Source=Paul Collins Startup list [Windows-System] Number=13058 Confirmed=X Filename=System32.exe Description=Added by the LOGPOLE.C WORM! Source=Paul Collins Startup list [Windows-TCP-IP] Number=13059 Confirmed=X Filename=rfkampig.exe Description=Added by the GIPMA TROJAN! Source=Paul Collins Startup list [Windows-XP-Service-Pack] Number=13060 Confirmed=X Filename=xpspz.exe Description=Added by the SDBOT-AAC WORM! Source=Paul Collins Startup list [windows16] Number=13061 Confirmed=X Filename=windows16.exe Description=Added by the XU TROJAN! Source=Paul Collins Startup list [Windows32] Number=13062 Confirmed=X Filename=rundll.exe Description=Added by the AGOBOT-LK or AGOBOT-ND WORMS! Note - this is NOT the Windows system file of the same name as described here Source=Paul Collins Startup list [windows32] Number=13063 Confirmed=X Filename=windows32.exe Description=Added by the XU TROJAN! Source=Paul Collins Startup list [Windows32] Number=13064 Confirmed=X Filename=wuuaclt.exe Description=Added by the BRATLE.B WORM! Source=Paul Collins Startup list [Windows32 Configuration Loader] Number=13065 Confirmed=X Filename=msrf32.exe Description=Added by the SDBOT-ABX WORM! Source=Paul Collins Startup list [Windows32 Messenger Service] Number=13066 Confirmed=X Filename=msmsgv.exe Description=Added by the RBOT.ANS WORM! Source=Paul Collins Startup list [Windows32 Net Database] Number=13067 Confirmed=X Filename=msnd32.exe Description=Added by the RBOT-AAL WORM! Source=Paul Collins Startup list [Windows32 Serivces] Number=13068 Confirmed=X Filename=winser32.exe Description=Added by the SPYBOT.AAF WORM! Source=Paul Collins Startup list [WindowsAgent] Number=13069 Confirmed=X Filename=WindowsAgent.exe Description=Added by the GOP.G WORM! Source=Paul Collins Startup list [WindowsAgent] Number=13070 Confirmed=X Filename=sysexhook.exe Description=Added by the GOP keyboard logger/TROJAN! Source=Paul Collins Startup list [WindowsAPI.DLL] Number=13071 Confirmed=X Filename=Server5.exe Description=Added by the "Fear and Hope" TROJAN! Source=Paul Collins Startup list [WindowsAudio] Number=13072 Confirmed=X Filename=systemupd.exe Description=Added by the AGENT-TH WORM! Source=Paul Collins Startup list [WindowsBackup] Number=13073 Confirmed=X Filename=WINDOWSBACKUP.EXE Description=Added by the STANG WORM! Source=Paul Collins Startup list [WindowsBool] Number=13074 Confirmed=X Filename=aimplg.exe Description=Added by the SDBOT-CNG WORM! Source=Paul Collins Startup list [WindowsCRC] Number=13075 Confirmed=X Filename=wscrc.exe Description=Added by the SDBOT-VU WORM! Source=Paul Collins Startup list [WindowsCriticalUpdate] Number=13076 Confirmed=X Filename=windows_critical_update.exe Description=Added by the ASTEF or RESPAN WORMS! Source=Paul Collins Startup list [WindowsDiskEvt] Number=13077 Confirmed=X Filename=svcsvh32.exe Description=Added by the NANINF.D TROJAN! Source=Paul Collins Startup list [WindowsDiskLog] Number=13078 Confirmed=X Filename=cstsm.exe Description=Added by the STINX-C or STINX-D TROJANS! Source=Paul Collins Startup list [WindowsFileSystem] Number=13079 Confirmed=X Filename=winsfs32.exe Description=Added by the RBOT-FMQ WORM! Source=Paul Collins Startup list [WindowsFirewallSvc] Number=13080 Confirmed=X Filename=winsvcup.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WINDOWSflashbrg] Number=13081 Confirmed=X Filename=sqldata1.exe Description=Added by a variant of the AGENT-IC TROJAN! Source=Paul Collins Startup list [WindowsFY] Number=13082 Confirmed=X Filename=wp.exe Description=Part of a "Security IGuard" parasite infestation - also detected as DESKTOPHIJACK Source=Paul Collins Startup list [WindowsFY] Number=13083 Confirmed=X Filename=bsw.exe Description=Added by a variant of the DESKTOPHIJACK TROJAN! For removal see here Source=Paul Collins Startup list [WindowsFY] Number=13084 Confirmed=X Filename=[path to trojan] Description=Added by the FAKEALE-E TROJAN! Source=Paul Collins Startup list [WindowsFZ] Number=13085 Confirmed=X Filename=[path to file] Description=Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN! Source=Paul Collins Startup list [WindowsFZ] Number=13086 Confirmed=X Filename=A5281300.so Description=Variant of the SmitFraud alias FAKEALE-C TROJAN! Source=Paul Collins Startup list [WindowsFZ] Number=13087 Confirmed=X Filename=zloader3.exe Description=Variant of the SmitFraud alias FAKEALE-C TROJAN! Source=Paul Collins Startup list [WindowsKeyUpdate] Number=13088 Confirmed=X Filename=master.exe Description=Added by the JOSAM WORM! Source=Paul Collins Startup list [WindowsMGM] Number=13089 Confirmed=X Filename=Winmgm32.exe Description=Added by the SOBIG.A WORM and LALA.C TROJAN! Source=Paul Collins Startup list [WindowsProtocolLog] Number=13090 Confirmed=X Filename=lsadst.exe Description=Added by the NANINF.C TROJAN! Source=Paul Collins Startup list [WindowsReg% update] Number=13091 Confirmed=X Filename=[random filename].exe Description=Added by the RBOT-HH WORM! Source=Paul Collins Startup list [WindowsRegistration] Number=13092 Confirmed=X Filename=[random filename] Description=Added by the RBOT-NO WORM! Source=Paul Collins Startup list [WindowsRegKey Autoupdate] Number=13093 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WindowsRegKey upd4te2d4te] Number=13094 Confirmed=X Filename=*********.exe [* = random char] Description=Added by the RBOT.XQ WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13095 Confirmed=X Filename=winupdate.exe Description=Added by the RBOT-QJ WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13096 Confirmed=X Filename=windns.exe Description=Added by the RBOT.IE WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13097 Confirmed=X Filename=WinUpdate32.exe Description=Added by the RBOT-AGW WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13098 Confirmed=X Filename=winupdatexx.exe Description=Added by the RBOT.LW WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13099 Confirmed=X Filename=[random filename] Description=Added by the RBOT.QT WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13100 Confirmed=X Filename=svchoosts.exe Description=Added by the RBOT.ADB WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13101 Confirmed=X Filename=svchostc.exe Description=Added by the RBOT.IF WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13102 Confirmed=X Filename=wdnupdate.exe Description=Added by the SDBOT.QX WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13103 Confirmed=X Filename=Windowsup.exe Description=Added by the SDBOT.PU WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13104 Confirmed=X Filename=WINUPDATES.EXE Description=Added by the RBOT-MM WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13105 Confirmed=X Filename=rkbuouoxfl.exe Description=Added by the RBOT-OO WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13106 Confirmed=X Filename=winsys.exe Description=Added by the RBOT-JY WORM! Source=Paul Collins Startup list [WindowsRegKey update] Number=13107 Confirmed=X Filename=winupdat32.exe Description=Added by the RBOT-AGW WORM! Source=Paul Collins Startup list [WindowsRegKey update XP] Number=13108 Confirmed=X Filename=windexv1.exe Description=Added by the RBOT-ABM WORM! Source=Paul Collins Startup list [WindowsRegKey%$ update] Number=13109 Confirmed=X Filename=msi332.exe Description=Added by the RBOT-IX WORM! Source=Paul Collins Startup list [WindowsRegKey%update] Number=13110 Confirmed=X Filename=ethernet32m.exe Description=Added by the RBOT-EN WORM! Source=Paul Collins Startup list [WindowsRegKeys update] Number=13111 Confirmed=X Filename=winsysi.exe Description=Added by the SDBOT.WE WORM! Source=Paul Collins Startup list [WindowsSetup] Number=13112 Confirmed=X Filename=[path to trojan] Description=Added by the EZBOT TROJAN! Source=Paul Collins Startup list [WindowsSystem32] Number=13113 Confirmed=X Filename=asper.exe Description=Added by the AGENT-EFP TROJAN! Source=Paul Collins Startup list [WindowsSystem32] Number=13114 Confirmed=X Filename=svchosts.exe Description=Added by the AGENT-EDA TROJAN! Source=Paul Collins Startup list [windowstime.exe] Number=13115 Confirmed=X Filename=windowstime.exe Description=Added by the AQV TROJAN! Source=Paul Collins Startup list [WindowsUpd] Number=13116 Confirmed=X Filename=WindowsUpd4.exe Description=VirtuMonde adware Source=Paul Collins Startup list [WindowsUpd1] Number=13117 Confirmed=X Filename=WindowsUpd1.exe Description=VirtuMonde adware Source=Paul Collins Startup list [WindowsUpd2] Number=13118 Confirmed=X Filename=WindowsUpd2.exe Description=VirtuMonde adware Source=Paul Collins Startup list [WindowsUpdate] Number=13119 Confirmed=X Filename=windows_update.exe Description=Added by the LOFNI WORM! Source=Paul Collins Startup list [WindowsUpdate] Number=13120 Confirmed=X Filename=svchost.exe Description=Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [windowsupdate] Number=13121 Confirmed=X Filename=RPCX1sQ3.exe Description=Added by the IRCBOT.B TROJAN! Source=Paul Collins Startup list [WindowsUpdate] Number=13122 Confirmed=X Filename=USRINIT.EXE Description=Added by the MADDIS.B WORM! Source=Paul Collins Startup list [windowsupdate] Number=13123 Confirmed=X Filename=winupdate.exe Description=Added by the WARPI WORM! Source=Paul Collins Startup list [WindowsUpdate] Number=13124 Confirmed=X Filename=svchost.exe Description=Added by the IK TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [WindowsUpdate] Number=13125 Confirmed=X Filename=winnnint.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [WindowsUpdate] Number=13126 Confirmed=X Filename=[path to file] Description=Added by the DUPA-B TROJAN! Source=Paul Collins Startup list [WindowsUpdate] Number=13127 Confirmed=X Filename=dupadupam2.exe Description=Added by the DUPA-B TROJAN! Source=Paul Collins Startup list [WindowsUpdate] Number=13128 Confirmed=X Filename=svchostw.exe Description=Added by the COBFINN_B TROJAN! Source=Paul Collins Startup list [WindowsUpdate renew] Number=13129 Confirmed=X Filename=iexplore.exe Description=Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [WindowsUpdate Service] Number=13130 Confirmed=X Filename=wuautlc.exe Description=Added by the RBOT-NR WORM! Source=Paul Collins Startup list [Windowsupdate Service] Number=13131 Confirmed=X Filename=csrss.exe Description=Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the root folder (ie, C:\) Source=Paul Collins Startup list [WindowsUpdateDirect] Number=13132 Confirmed=X Filename=dupadirect.exe Description=Added by the DUPA-C TROJAN! Source=Paul Collins Startup list [WindowsUpdatem1] Number=13133 Confirmed=X Filename=[path to file] Description=Added by the AGENT-AAJ TROJAN! Source=Paul Collins Startup list [WindowsUpdatem2] Number=13134 Confirmed=X Filename=svchost.exe Description=Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [WindowsUpdateNT] Number=13135 Confirmed=X Filename=svwhost.exe Description=Added by the SHELLOT-B TROJAN! Source=Paul Collins Startup list [WindowsUpdateR] Number=13136 Confirmed=X Filename=regserv.exe Description=Added by the COBFINN_B TROJAN! Source=Paul Collins Startup list [WindowsXP Module] Number=13137 Confirmed=X Filename=DirectX3D.exe Description=Malware, reportedly a keylogger - see here Source=Paul Collins Startup list [WindowsXP Update] Number=13138 Confirmed=X Filename=windowsxpupdate.exe Description=Added by the RBOT-PB WORM! Source=Paul Collins Startup list [WindowsXPserv] Number=13139 Confirmed=X Filename=svcnxp32.exe Description=Addee by the NANINF-A TROJAN! Source=Paul Collins Startup list [Windows_LowLevel_Security_Core] Number=13140 Confirmed=X Filename=lsass.exe Description=Added by the PADMIN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Repair" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [Windows_Protect] Number=13141 Confirmed=X Filename=winsystem.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows_Protect] Number=13142 Confirmed=X Filename=winregal.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Windows_Protect] Number=13143 Confirmed=X Filename=lsas.exe Description=Added by the RBOT.ARO WORM! Source=Paul Collins Startup list [Windows_Protect] Number=13144 Confirmed=X Filename=wincontrol32.exe Description=Added by the RBOT-ADK WORM! Source=Paul Collins Startup list [Windows_Serivce] Number=13145 Confirmed=X Filename=SERVICE.exe Description=Added by the WOOTBOT.AH WORM! Source=Paul Collins Startup list [Windows_Updates] Number=13146 Confirmed=X Filename=svthost.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Windows_VXD] Number=13147 Confirmed=X Filename=user32.exe Description=Added by the PPORT TROJAN! Source=Paul Collins Startup list [Windowz] Number=13148 Confirmed=X Filename=[original worm filename].vbs Description=Added by the NUKIP WORM! Source=Paul Collins Startup list [Windowz Update V2.0] Number=13149 Confirmed=X Filename=Explorer.exe Description=Added by the YODO WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder Source=Paul Collins Startup list [Windoxs Update Center] Number=13150 Confirmed=X Filename=W32RfSA.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WinDrg32] Number=13151 Confirmed=X Filename=windrg32.exe Description=Added by the DRUDGEBOT.A WORM! Source=Paul Collins Startup list [WinDriv32] Number=13152 Confirmed=X Filename=WinDriv32.exe Description=Added by the SMALL-BA TROJAN! Source=Paul Collins Startup list [WinDriver Configuration] Number=13153 Confirmed=X Filename=windrvconf.exe Description=Added by the AGOBOT-LX TROJAN! Source=Paul Collins Startup list [WinDrives] Number=13154 Confirmed=X Filename=WinDrives.EXE Description=Added by the SMALL.DIG WORM! Source=Paul Collins Startup list [WINDRUN] Number=13155 Confirmed=X Filename=taskgmrs.exe Description=Added by the MYTOB-BT WORM! Source=Paul Collins Startup list [windrv] Number=13156 Confirmed=X Filename=windrv32.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! - possibly a strain of OBLIVION or BIONET Source=Paul Collins Startup list [WinDrv] Number=13157 Confirmed=X Filename=windrvx.exe Description=Added by a variant of the TIBSER.A downloader TROJAN! Source=Paul Collins Startup list [WinDSL MTU-Adjust] Number=13158 Confirmed=U Filename=WinDSL_MTU.exe Description=Adjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung Source=Paul Collins Startup list [WinDSL_MTU] Number=13159 Confirmed=? Filename=WinDSL_MTU.exe Description=May be realted to Tiscali broadband, if so is it required? Source=Paul Collins Startup list [WinDSNX] Number=13160 Confirmed=X Filename=Win????.exe Description=Added by the DSNX TROJAN! Source=Paul Collins Startup list [WindUpdates] Number=13161 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT.BF TROJAN! Source=Paul Collins Startup list [WindUpdates] Number=13162 Confirmed=X Filename=WinUpdt.exe Description=Windupdates adware variant Source=Paul Collins Startup list [WINDVDpatch] Number=13163 Confirmed=U Filename=CTHELPER.EXE Description=CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative's sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it Source=Paul Collins Startup list [WinDVR SchSvr] Number=13164 Confirmed=N Filename=SchSvr.exe Description=WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [WinDVRCtrl] Number=13165 Confirmed=N Filename=WinDVRCtrl.exe Description=Control center software for an AOpen VA1000 TV tuner card Source=Paul Collins Startup list [Windws Configuration Loader] Number=13166 Confirmed=X Filename=LEXPLORE.exe Description=Added by the SODABOT WORM! Note - the executable is spelt with a lower case "L" rather than an lower or upper case "i" which is the case with Internet Explorer Source=Paul Collins Startup list [WinEssential] Number=13167 Confirmed=X Filename=Keyhost.exe Description=Hijacker - hailing from jraun.com Source=Paul Collins Startup list [WinEssential] Number=13168 Confirmed=X Filename=keyword.exe Description=Jraun adware Source=Paul Collins Startup list [WinEx] Number=13169 Confirmed=X Filename=lexplore_.exe Description=Added by the MSNOPT-A TROJAN! Source=Paul Collins Startup list [WinExec] Number=13170 Confirmed=X Filename=Winexec.exe.vbs Description=Added by the AINESEY.A WORM! Source=Paul Collins Startup list [WinExec] Number=13171 Confirmed=X Filename=WinExec.exe Description=Added by the FALUS-A WORM! Source=Paul Collins Startup list [WinExec] Number=13172 Confirmed=X Filename=Lsass.exe Description=Added by the CRUTLE-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [WinExec32] Number=13173 Confirmed=X Filename=WinExec32.exe Description=Added by the KAZWIN WORM! Source=Paul Collins Startup list [WinFast Schedule] Number=13174 Confirmed=U Filename=Wfwiz.exe Description=Leadtek WinFast TV tuner scheduler and remote control driver - required if you use the latter Source=Paul Collins Startup list [Winfast2KLoadDefault] Number=13175 Confirmed=U Filename=Rundll32.exe Wf2kcpl.dll, DllLoadDefaultSettings Description=Loads default settings for Leadtek Winfast graphics cards Source=Paul Collins Startup list [WinFastDTV] Number=13176 Confirmed=U Filename=DTVSchdl.exe Description=Scheduler for WinFast DTV digital TV cards from Leadtek Research Inc Source=Paul Collins Startup list [Winfast_2K] Number=13177 Confirmed=U Filename=WF2k.exe Description=System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card Source=Paul Collins Startup list [WinFast_Gamma] Number=13178 Confirmed=U Filename=Rundll32.exe wfcpl.dll, DllLoadGammaRampSettings Description=Loads if you change the gamma settings on Leadtek WinFast graphics cards Source=Paul Collins Startup list [WinFast_Taskbar] Number=13179 Confirmed=U Filename=rundll32.exe wftask.dll, WFDllLoadDefaultSettings Description=Loads default settings for Leadtek WinFast graphics cards Source=Paul Collins Startup list [WinFavorites] Number=13180 Confirmed=X Filename=WinFavorites.exe1 Description=Loudmarketing.com adware downloader Source=Paul Collins Startup list [WinFax PRO] Number=13181 Confirmed=N Filename=FAXMNG32.EXE Description=WinFax PRO from Symantec - fax management software Source=Paul Collins Startup list [WinFax PRO Controller] Number=13182 Confirmed=N Filename=WFXCTL32.EXE Description=From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [WinFaxAppPortStarter] Number=13183 Confirmed=Y Filename=wfxsnt40.exe Description=WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application. Source=Paul Collins Startup list [WinFire] Number=13184 Confirmed=X Filename=WF.exe Description=Added by the DELF-SY TROJAN! Source=Paul Collins Startup list [WinFix service] Number=13185 Confirmed=X Filename=rsswjzgp.exe Description=Added by the RBOT-FAE WORM! Source=Paul Collins Startup list [WinFixer 2005] Number=13186 Confirmed=X Filename=wfx5.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [WinFixer helper] Number=13187 Confirmed=X Filename=wfxcwr.exe Description=WinAntiSpyware 2005 by Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [WinFixer service] Number=13188 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WinFixer2006] Number=13189 Confirmed=X Filename=uwfx6.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [WinFlyer32.dll] Number=13190 Confirmed=X Filename=WinFlyer32.dll Description=Added by the WINFLYER TROJAN! Source=Paul Collins Startup list [winfont] Number=13191 Confirmed=X Filename=winfont.exe Description=Added by the DEATH TROJAN! Source=Paul Collins Startup list [winform] Number=13192 Confirmed=X Filename=winform.exe Description=Added by the PWS-ALB TROJAN! Source=Paul Collins Startup list [WinFoxV2] Number=13193 Confirmed=U Filename=WF2k.exe Description=System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card Source=Paul Collins Startup list [WinFX] Number=13194 Confirmed=X Filename=cssrs.exe Description=Added by the AGOBOT.FX WORM! Source=Paul Collins Startup list [WinGate] Number=13195 Confirmed=X Filename=WinGate.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [WinGate Engine Monitor] Number=13196 Confirmed=U Filename=wgengmon.exe Description=WinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine, and appears in the system tray of each workstation on the network reassuring clients that their workstations have connectivity with the WinGate Server Source=Paul Collins Startup list [WinGate initialize] Number=13197 Confirmed=X Filename=WinGate.exe Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [wingerver2.0.exe] Number=13198 Confirmed=X Filename=wingerver2.0.exe Description=Added by the GRAYBRD-AE TROJAN! Source=Paul Collins Startup list [wingo] Number=13199 Confirmed=X Filename=wingo.exe Description=Added by the BEAGLE.AW or BEAGLE.AV WORMS! Source=Paul Collins Startup list [wingo] Number=13200 Confirmed=X Filename=[various filenames] Description=Added by the BAGLE-AU WORM! Source=Paul Collins Startup list [WinGuage Pro] Number=13201 Confirmed=N Filename=WGPRO32.EXE Description=Part of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [Winguard] Number=13202 Confirmed=Y Filename=WGFE95.EXE Description=Dr Solomon's Virex antivirus Source=Paul Collins Startup list [winguard] Number=13203 Confirmed=Y Filename=wingrd32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WinGuard Pro] Number=13204 Confirmed=U Filename=wgp.exe Description=Winguard Pro Source=Paul Collins Startup list [WinHacker] Number=13205 Confirmed=N Filename=rundll32.exe wh95.dll, HackMe Description=WinHacker tweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free Source=Paul Collins Startup list [Winhelp] Number=13206 Confirmed=X Filename=winhe1p.exe Description=Added by the QQPASS.E TROJAN! Source=Paul Collins Startup list [WinHelp] Number=13207 Confirmed=X Filename=WinHelp.exe Description=Added by a variant of the LOVGATE WORM! Note - "winhelp.exe" resides in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP) whereas the valid "winhelp.exe" resides in C:\Windows or C:\Winnt Source=Paul Collins Startup list [WinHelp] Number=13208 Confirmed=X Filename=realsched.exe Description=Added by a variant of the LOVGATE WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name Source=Paul Collins Startup list [Winhelp] Number=13209 Confirmed=X Filename=TkBellExe.exe... Description=Added by a variant of the LOVGATE WORM! Source=Paul Collins Startup list [winhelp] Number=13210 Confirmed=X Filename=winhelp.exe Description=Added by the BLACKMAL.C WORM! Note - this malware actually changes the default value data of the Registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [winhelp] Number=13211 Confirmed=X Filename=dns32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winhelp] Number=13212 Confirmed=X Filename=Updadv.exe Description=Added by the QQPASS-N TROJAN! Source=Paul Collins Startup list [winhlp.exe] Number=13213 Confirmed=X Filename=winhlp.exe Description=Added by the FORMGLIEDER TROJAN! Source=Paul Collins Startup list [winhlp3.exe] Number=13214 Confirmed=X Filename=winhlp3.exe Description=Added by a variant of the EASTO.A TROJAN! Source=Paul Collins Startup list [Winhlp32] Number=13215 Confirmed=X Filename=Wscript.exe ..Msexec32.vbs Description=Added by the GANT.B WORM! Source=Paul Collins Startup list [winhlp32.exe] Number=13216 Confirmed=X Filename=winhlp32.exe Description=Added by the EASTO.A TROJAN! Source=Paul Collins Startup list [winhlpp32.exe] Number=13217 Confirmed=X Filename=winhlpp32.exe Description=Added by the GAOBOT.SY WORM! Source=Paul Collins Startup list [Winhost] Number=13218 Confirmed=X Filename=wintt.exe Description=Added by the LOLAWEB.B TROJAN! Source=Paul Collins Startup list [Winhost] Number=13219 Confirmed=X Filename=win.exe Description=Added by the DLOADER-AP TROJAN! Source=Paul Collins Startup list [Winhost] Number=13220 Confirmed=X Filename=yahoo.exe Description=Added by the DELF-KM TROJAN! Source=Paul Collins Startup list [Winhost] Number=13221 Confirmed=X Filename=winhost.exe Description=Added by the REATLE.F WORM! Source=Paul Collins Startup list [winhost.exe] Number=13222 Confirmed=X Filename=winhost.exe Description=Added by the LOHAV-R TROJAN! Source=Paul Collins Startup list [winhost32.exe] Number=13223 Confirmed=X Filename=winhost32.exe Description=Added by the TABDIM TROJAN! Source=Paul Collins Startup list [WinHound] Number=13224 Confirmed=N Filename=WinHound.exe Description=Spyware remover - not recommended, see here Source=Paul Collins Startup list [WinIeRun] Number=13225 Confirmed=X Filename=winierun.exe Description=Added by the RNWATCH-A WORM! Source=Paul Collins Startup list [winimage] Number=13226 Confirmed=X Filename=wvsvc.exe Description=Added by the RBOT.TX WORM! Source=Paul Collins Startup list [WinINet] Number=13227 Confirmed=X Filename=services.exe Description=Added by the SOBER-P WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatus" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [wininet] Number=13228 Confirmed=X Filename=wininet.exe Description=Added by the STUBBOT-C WORM! Source=Paul Collins Startup list [wininet32] Number=13229 Confirmed=X Filename=wininet32.exe Description=Added by the RAZNEW-A TROJAN! Source=Paul Collins Startup list [wininetd] Number=13230 Confirmed=X Filename=wininetd.exe Description=Added by the WINET TROJAN! Source=Paul Collins Startup list [wininit] Number=13231 Confirmed=X Filename=wininit.exe Description=Added by the WOLLF.16 TROJAN! Source=Paul Collins Startup list [WinInit] Number=13232 Confirmed=X Filename=Win86.exe Description=Added by the SMALL-PB TROJAN! Source=Paul Collins Startup list [winint] Number=13233 Confirmed=X Filename=winint.exe Description=Added by the SDBOT-ADA WORM! Source=Paul Collins Startup list [winipsec] Number=13234 Confirmed=X Filename=winipsec.exe Description=Unidentified malware Source=Paul Collins Startup list [WinIRXHelper] Number=13235 Confirmed=U Filename=WinIRXHelper.exe Description=MSI Media Center Deluxe software - see here Source=Paul Collins Startup list [winis] Number=13236 Confirmed=X Filename=winis.exe Description=Added by the RBOT-WI WORM! Source=Paul Collins Startup list [Wink*.exe] Number=13237 Confirmed=X Filename=Wink*.exe [* = random char] Description=Added by a variant of the KLEZ WORM! Source=Paul Collins Startup list [Winkb6] Number=13238 Confirmed=U Filename=winkb6.exe Description=Part of We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content, while filtering out sites that contain adult content. Works in conjunction with Winkb6 and both files are needed to run We-Blocker Source=Paul Collins Startup list [WinKernel] Number=13239 Confirmed=X Filename=WinKer.exe Description=Added by the MIRAB or SERVIDOR TROJANS! Source=Paul Collins Startup list [WinKernel] Number=13240 Confirmed=X Filename=[path to worm] Description=Added by the PLEA VIRUS! Source=Paul Collins Startup list [winkernel32] Number=13241 Confirmed=X Filename=wWin32.com Description=Added by the BANSAP TROJAN! Source=Paul Collins Startup list [WinKey] Number=13242 Confirmed=U Filename=winkey.exe Description=Loads Copernic's WinKey. Used to map out Windows key hotkey combinations. Not required for the system, but is necessary for this to be running if you use these hotkey combos Source=Paul Collins Startup list [winla] Number=13243 Confirmed=X Filename=winla.exe Description=Added by the DLOADR-AQL TROJAN! Source=Paul Collins Startup list [winldr] Number=13244 Confirmed=X Filename=[path to file] Description=Added by the VIDLO-P TROJAN! Source=Paul Collins Startup list [winldr] Number=13245 Confirmed=X Filename=Rechnung.pdf.exe Description=Added by the ACS TROJAN! Source=Paul Collins Startup list [winlgz2] Number=13246 Confirmed=X Filename=winlgz2.exe Description=Added by the KILLFIL-Q TROJAN! Source=Paul Collins Startup list [winlibs.exe] Number=13247 Confirmed=X Filename=winlibs.exe Description=Added by the EVAMAN.C WORM! Source=Paul Collins Startup list [WinLibUpdate] Number=13248 Confirmed=X Filename=libupdate.exe Description=Added by the BIONET series of TROJANS such as BIONET.31 or BIONET.310 Source=Paul Collins Startup list [WinLibUpdate32] Number=13249 Confirmed=X Filename=libupdate32.exe Description=Added by the BIONET.405 TROJAN! Source=Paul Collins Startup list [WinLibUpdte] Number=13250 Confirmed=X Filename=libupdte.exe Description=Added by the BIONET.318 TROJAN! Source=Paul Collins Startup list [winligom] Number=13251 Confirmed=X Filename=winligom.exe Description=Added by the RBOT-GAI WORM! Note - this malware actually changes the default value data of the registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [Winlink] Number=13252 Confirmed=X Filename=winlink32.exe Description=Added by the GAOBOT.AAY WORM! Source=Paul Collins Startup list [Winlme] Number=13253 Confirmed=X Filename=windll.exe Description=Added by the GOP.F WORM! Source=Paul Collins Startup list [WinLoad] Number=13254 Confirmed=U Filename=Winload.exe Description=PCTattletale is a surveillance software program that monitors user activity, logs keystrokes, and takes screenshots. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [WinLoader] Number=13255 Confirmed=X Filename=[random filename] Description=Added by variants of the SUBSEVEN TROJAN! Source=Paul Collins Startup list [winlocatorupdate] Number=13256 Confirmed=X Filename=updatewinlocator.exe Description=Locator adult content toolbar related Source=Paul Collins Startup list [winlog] Number=13257 Confirmed=X Filename=winlog.exe Description=Unidentified adware. Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [winlog] Number=13258 Confirmed=X Filename=winlog.exe Description=Added by the GAOBOT_DF WORM! Source=Paul Collins Startup list [winlog manager] Number=13259 Confirmed=X Filename=winlog.exe Description=Added by the DONBOMB.A TROJAN! Source=Paul Collins Startup list [WINLOG0N] Number=13260 Confirmed=X Filename=WINLOG0N.EXE Description=Added by the MYDOOM.BI WORM! Source=Paul Collins Startup list [WinLogin] Number=13261 Confirmed=X Filename=winlogin.exe Description=Added by the AGOBOT-IX WORM! Source=Paul Collins Startup list [winlogin] Number=13262 Confirmed=X Filename=win32x.exe Description=Browser hijacker, also detetected as the STARTPA-DF TROJAN! Source=Paul Collins Startup list [Winlogin.exe] Number=13263 Confirmed=X Filename=log.exe Description=Added by a variant of the AGENT.AH downloader TROJAN! Source=Paul Collins Startup list [winlogin.exe] Number=13264 Confirmed=X Filename=logfile.exe Description=Added by the AGENT.AH TROJAN! Source=Paul Collins Startup list [winlogin.exe] Number=13265 Confirmed=X Filename=mspaint.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [Winlogin.exe] Number=13266 Confirmed=X Filename=steam.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [winlogoff] Number=13267 Confirmed=X Filename=winlogoff.exe Description=Added by the AGOBOT-TR WORM! Source=Paul Collins Startup list [winlogon] Number=13268 Confirmed=X Filename=winlogon.exe Description=Hijacker or adult content dialler! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [winlogon] Number=13269 Confirmed=X Filename=winlogin.exe Description=Added by the RANDEX.E WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder Source=Paul Collins Startup list [winlogon] Number=13270 Confirmed=X Filename=winlogon.exe Description=Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder Source=Paul Collins Startup list [winlogon] Number=13271 Confirmed=X Filename=msreg32.exe Description=Added by the SDBOT.EO WORM! Source=Paul Collins Startup list [winlogon] Number=13272 Confirmed=X Filename=winlogon32.exe Description=Added by the MASLAN.C WORM! Source=Paul Collins Startup list [winlogon] Number=13273 Confirmed=X Filename=wpwlogon.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [WINLOGON] Number=13274 Confirmed=X Filename=wscript.exe [System or System32]\WINLOGON.vbs Description=Added by the YPSAN.F WORM! Source=Paul Collins Startup list [Winlogon] Number=13275 Confirmed=X Filename=lsass.exe Description=Added by the VB-EJ TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [Winlogon] Number=13276 Confirmed=X Filename=lsass.exe Description=Added by the FLOPPY-B VIRUS! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [winlogon] Number=13277 Confirmed=X Filename=nvchost.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [winlogon service] Number=13278 Confirmed=X Filename=urx.exe Description=Added by the SPYBOT.EN WORM! Source=Paul Collins Startup list [Winlogon Shell] Number=13279 Confirmed=X Filename=Explorer.exe [path] svchost.exe Description=Added by the KIPIS.M WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in System\1032 or System32\1032 subfolders Source=Paul Collins Startup list [Winlogon.exe] Number=13280 Confirmed=X Filename=N/A Description=CoolWebSearch parasite variant - resets home page to an adult content site Source=Paul Collins Startup list [winlogon.exe] Number=13281 Confirmed=X Filename=helper.exe Description=Added by the FAKESPY-A TROJAN! Source=Paul Collins Startup list [winlogon.exe] Number=13282 Confirmed=X Filename=msole32.exe Description=Adware, also detected as the FAKESPY-B TROJAN! Source=Paul Collins Startup list [winlogon32_] Number=13283 Confirmed=X Filename=[path to file] Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [Winlogun] Number=13284 Confirmed=X Filename=winlogin.exe Description=Added by the P2LOAD-C WORM! Source=Paul Collins Startup list [WinLsass] Number=13285 Confirmed=X Filename=servicec.exe Description=Added by the SCANE WORM! Source=Paul Collins Startup list [WinLsass] Number=13286 Confirmed=X Filename=[path to trojan] Description=Added by the SCANE WORM! Source=Paul Collins Startup list [winltmpv] Number=13287 Confirmed=X Filename=winln.exe Description=Added by the TCXMEDI-C TROJAN! Source=Paul Collins Startup list [winltmpv] Number=13288 Confirmed=X Filename=wutop.exe Description=Added by the TCXMEDI-C TROJAN! Source=Paul Collins Startup list [Winmain] Number=13289 Confirmed=X Filename=winmain.exe Description=One of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. NSClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled! Source=Paul Collins Startup list [WinManager] Number=13290 Confirmed=? Filename=schost.exe Description=?? Source=Paul Collins Startup list [winmatrix.exe] Number=13291 Confirmed=U Filename=WinMatrixXP.exe Description=WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop Source=Paul Collins Startup list [WinMedia] Number=13292 Confirmed=X Filename=[path to trojan] Description=Added by the ZEROBE-A TROJAN! Source=Paul Collins Startup list [WinMedia] Number=13293 Confirmed=X Filename=msupd******.exe [*= random digit] Description=Added by the INJECT.163 TROJAN! Source=Paul Collins Startup list [WinMem] Number=13294 Confirmed=U Filename=WinMem.exe Description=WinMem Cleaner - part of Ultra WinCleaner Utility Suite. Makes more memory available for your programs and the Operating System. It also defragments your system Source=Paul Collins Startup list [WinMenssage] Number=13295 Confirmed=X Filename=winmax.exe Description=Added by the BANCOS.B TROJAN! Source=Paul Collins Startup list [WinMessenger] Number=13296 Confirmed=X Filename=syshost.exe Description=Added by the OPANKI-E WORM! Source=Paul Collins Startup list [WinMgmt] Number=13297 Confirmed=N Filename=WinMgmt.exe Description=Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here Source=Paul Collins Startup list [WINMGR] Number=13298 Confirmed=X Filename=taskgmgr.exe Description=Added by the MYTOB.AN WORM! Source=Paul Collins Startup list [Winmgr.exe] Number=13299 Confirmed=X Filename=scvhost.exe Description=Added by the AGOBOT.AFG WORM! Source=Paul Collins Startup list [WinMgr32] Number=13300 Confirmed=X Filename=winmgr32.exe Description=Added by the MIMAIL.P WORM! Source=Paul Collins Startup list [WinMine] Number=13301 Confirmed=X Filename=D4NG3.vbs Description=Added by the BISCUIT.A WORM! Source=Paul Collins Startup list [winmodem] Number=13302 Confirmed=Y Filename=wmexe.exe Description=Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [WinMoviePlugIn] Number=13303 Confirmed=X Filename=WinMoviePlugIn.exe Description=Sfonditalia adult content premium rate dialer Source=Paul Collins Startup list [Winmsg] Number=13304 Confirmed=X Filename=winwork.exe Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [WinMsg] Number=13305 Confirmed=X Filename=winmsgr.exe Description=Added by the DLOADR-AS TROJAN! Source=Paul Collins Startup list [WinMsrv32] Number=13306 Confirmed=X Filename=WinMsrv32.exe Description=Added by the GAOBOT.AFJ WORM! Source=Paul Collins Startup list [WinMX] Number=13307 Confirmed=N Filename=WinMX.exe Description=WinMX file sharing application Source=Paul Collins Startup list [winmysqladmin] Number=13308 Confirmed=N Filename=winmysqladmin.exe Description=Starts the MySQL database admin tool Source=Paul Collins Startup list [WinMySQLadmin Tool] Number=13309 Confirmed=N Filename=winmysqladmin.exe Description=Starts the MySQL database admin tool Source=Paul Collins Startup list [winnet] Number=13310 Confirmed=X Filename=winnet.exe Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [WinNetDDE] Number=13311 Confirmed=X Filename=[random characters].exe Description=Added by the NETDEPIX.B TROJAN! Source=Paul Collins Startup list [WinNite] Number=13312 Confirmed=X Filename=niteaim.exe Description=Added by the OPANKI.B WORM! Source=Paul Collins Startup list [Winnov Menu] Number=13313 Confirmed=? Filename=WnvMenu.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [Winnov Remote] Number=13314 Confirmed=? Filename=WnvRsvr.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [Winnov Status] Number=13315 Confirmed=? Filename=WvStatus.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [winnt] Number=13316 Confirmed=X Filename=winnt.exe Description=Added by the MONA-E WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13317 Confirmed=X Filename=wuamgrd32.exe Description=Added by the RBOT-BAU WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13318 Confirmed=X Filename=iexplorer.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13319 Confirmed=X Filename=pidchk32.exe Description=Added by the RBOT-ACY WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13320 Confirmed=X Filename=windowxp.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13321 Confirmed=X Filename=Winupd32.exe Description=Added by the RBOT.AVU WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13322 Confirmed=X Filename=winupdate32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winnt DNS ident] Number=13323 Confirmed=X Filename=wuamgrd33.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Winnt DNS ident] Number=13324 Confirmed=X Filename=windowsp.exe Description=Added by the RBOT.BAL WORM! Source=Paul Collins Startup list [winNT updatc] Number=13325 Confirmed=X Filename=wupgrd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WinNtBB] Number=13326 Confirmed=X Filename=WinntBB.exe Description=Added by the DULOAD.C WORM! Source=Paul Collins Startup list [Winnup] Number=13327 Confirmed=X Filename=win32nls.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [winocx32] Number=13328 Confirmed=X Filename=winocx32.exe Description=Added by the PROTORIDE.I WORM! Source=Paul Collins Startup list [WINOWS SYSTEM] Number=13329 Confirmed=X Filename=winnt.exe Description=Added by the MYTOB.ID WORM! Source=Paul Collins Startup list [WINP] Number=13330 Confirmed=X Filename=winmic.exe Description=Added by the SPYBOT-EB WORM! Source=Paul Collins Startup list [Winpack] Number=13331 Confirmed=X Filename=winpack.exe Description=Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Agent.gg Source=Paul Collins Startup list [WinPatrol] Number=13332 Confirmed=U Filename=WinPatrol.exe Description=WinPatrol - "Manage Startup programs, tasks, cookies; will sniff out Worms, Trojan horses, Cookies, Adware, Spyware, Klez, Assumption and other malicious programs" Source=Paul Collins Startup list [WinPatrol Explorer] Number=13333 Confirmed=Y Filename=WinPatrolEx.exe Description=Part of WinPatrol Source=Paul Collins Startup list [winphonics7536] Number=13334 Confirmed=X Filename=vbsystem35.exe setups.exe vb.vb Description=Added by a variant of the MUTIN-C TROJAN! Source=Paul Collins Startup list [winpipe] Number=13335 Confirmed=X Filename=winpipe.exe Description=Browser hijacker redirecting to wow-access.com Source=Paul Collins Startup list [WinPLOSION] Number=13336 Confirmed=U Filename=WinPlosion.exe Description="WinPLOSION allows you to immediately view and select from all the windows running on your computer, just those of the active application, or to minimise all windows and display a clear desktop" Source=Paul Collins Startup list [WinPoet] Number=13337 Confirmed=Y Filename=WinPPPoverEthernet.exe Description=WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking Source=Paul Collins Startup list [winpol] Number=13338 Confirmed=X Filename=winpol.exe Description=Added by the AGENT.IWD TROJAN! Source=Paul Collins Startup list [WinPopup] Number=13339 Confirmed=N Filename=WINPOPUP.EXE Description=Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95, and maybe in WFWG 3.11. Normally it won't set itself up to run unless the user specifically adds it to startup Source=Paul Collins Startup list [winpopup] Number=13340 Confirmed=X Filename=winupie.exe Description=Adware by Tradeexit.com Source=Paul Collins Startup list [Winpower] Number=13341 Confirmed=N Filename=Winpower.exe Description=Part of InstallAnywhere from Zero G Software, now owned by Macrovision Source=Paul Collins Startup list [Winprocer32 Update] Number=13342 Confirmed=X Filename=winprocer32.exe Description=Added by the RBOT.GW WORM! Source=Paul Collins Startup list [winprocessor Update] Number=13343 Confirmed=X Filename=winprocessor.exe Description=Added by the RBOT.IO WORM! Source=Paul Collins Startup list [WinProfile] Number=13344 Confirmed=X Filename=Command.exe Description=Added by the BUDDY TROJAN! Source=Paul Collins Startup list [WinProfile] Number=13345 Confirmed=X Filename=sndcfg16.exe Description=Added by the SNDC.A WORM! Source=Paul Collins Startup list [winprofile] Number=13346 Confirmed=X Filename=iexpiore.exe Description=Added by a variant of the MONCHER WORM! Source=Paul Collins Startup list [WinProfile] Number=13347 Confirmed=X Filename=iexpIore.exe Description=Added by CHUM-C TROJAN! Source=Paul Collins Startup list [WinProt] Number=13348 Confirmed=X Filename=Winprot.exe Description=Added by the CHUPACABRA TROJAN! Source=Paul Collins Startup list [WinProt] Number=13349 Confirmed=X Filename=server.exe Description=Added by the CHUPACABRA TROJAN! Source=Paul Collins Startup list [winprotect] Number=13350 Confirmed=X Filename=win32.exe Description=Added by the MUGLY.E WORM! Source=Paul Collins Startup list [winprotect] Number=13351 Confirmed=X Filename=winprotect.exe Description=Added by the SDBOT-SB WORM! Source=Paul Collins Startup list [WinProxy] Number=13352 Confirmed=U Filename=WinProxy.EXE Description="WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP" Source=Paul Collins Startup list [Winproxy Personal] Number=13353 Confirmed=X Filename=WINPROXY.EXE Description=Added by the SDBOT.BMF WORM! Source=Paul Collins Startup list [winpsd] Number=13354 Confirmed=X Filename=winpsd.exe Description=Added by the MYDOOM.Q WORM! Source=Paul Collins Startup list [WinPWD Manager] Number=13355 Confirmed=X Filename=wpwdmgr.exe Description=Added by the RBOT-AUT WORM! Source=Paul Collins Startup list [winrapid] Number=13356 Confirmed=X Filename=winrapid.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winrar] Number=13357 Confirmed=X Filename=winrar.exe Description=CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR! Source=Paul Collins Startup list [winrarshell] Number=13358 Confirmed=X Filename=winrarshell32.exe Description=Added by the SALIRA TROJAN! Source=Paul Collins Startup list [WinReader] Number=13359 Confirmed=X Filename=read.exe Description=Added by the DELBOT-V WORM! Source=Paul Collins Startup list [winReg] Number=13360 Confirmed=X Filename=winReg.exe Description=Added by the YAHA.H or YAHA.J WORMS! Source=Paul Collins Startup list [WinReg32 service] Number=13361 Confirmed=X Filename=holqdnoxpmeu.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [winregsrv] Number=13362 Confirmed=X Filename=winregsrv.exe Description=Added by the SYNRG TROJAN! Source=Paul Collins Startup list [winreg_32] Number=13363 Confirmed=X Filename=svchosst.exe Description=Added by the BANCOS-CE TROJAN! Source=Paul Collins Startup list [winreg_32] Number=13364 Confirmed=X Filename=[path to trojan] Description=Added by the BANKER-DB TROJAN! Source=Paul Collins Startup list [winreg_32] Number=13365 Confirmed=X Filename=sysdll.exe Description=Added by the DLOADER-IJ TROJAN! Source=Paul Collins Startup list [winreg_32] Number=13366 Confirmed=X Filename=Vc030405.exe Description=Added by the BANCOS-CT TROJAN! Source=Paul Collins Startup list [WINREMOTE] Number=13367 Confirmed=U Filename=WinRemote.exe Description=InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control Source=Paul Collins Startup list [Winres32vis] Number=13368 Confirmed=X Filename=[path to worm] Description=Added by the THRAX.A WORM! Source=Paul Collins Startup list [winrestore1] Number=13369 Confirmed=X Filename=winrestore.exe Description=Added by the KILLFIL-Q TROJAN! Source=Paul Collins Startup list [winreups] Number=13370 Confirmed=X Filename=winreups.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winroute] Number=13371 Confirmed=N Filename=winroute.exe Description=Win-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process, also to log in to the console to view logs and change settings. Can be unchecked and the engine still runs and functions normally. Can then use provided shortcuts for administration of the program. Loaded in SERVICES on Windows 2k Source=Paul Collins Startup list [WinRPC] Number=13372 Confirmed=X Filename=winrpcmx.exe Description=Added by the BANKER-EEI TROJAN! Source=Paul Collins Startup list [winrun] Number=13373 Confirmed=X Filename=msconfig.exe Description=Added by the WINUR WORM! Note - this is not the real msconfig.exe as it's located in C:\winrun\ Source=Paul Collins Startup list [winrun] Number=13374 Confirmed=X Filename=winrun.exe Description=Added by the WINBUR.B WORM! Source=Paul Collins Startup list [WINRUN] Number=13375 Confirmed=X Filename=taskgmr32.exe Description=Added by the MYTOB.AP WORM! Source=Paul Collins Startup list [WINRUN] Number=13376 Confirmed=X Filename=svchost32.exe Description=Added by the MYTOB-AI WORM! Source=Paul Collins Startup list [WINRUN] Number=13377 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB-BX WORM! Source=Paul Collins Startup list [WINRUN z] Number=13378 Confirmed=X Filename=W1NT45K.exe Description=Added by the MYTOB.BL WORM! Source=Paul Collins Startup list [WinRunners] Number=13379 Confirmed=X Filename=WinDrivers.exe Description=Added by the DULOAD.C WORM! Source=Paul Collins Startup list [Wins Service Driver] Number=13380 Confirmed=X Filename=winet.exe Description=Added by the RBOT-APV WORM! Source=Paul Collins Startup list [Wins Update 32] Number=13381 Confirmed=X Filename=services32.exe Description=Added by the FORBOT-FN WORM! Source=Paul Collins Startup list [Wins32 Online] Number=13382 Confirmed=X Filename=cfgpwnz.exe Description=Added by the BROPIA.R WORM! Source=Paul Collins Startup list [WinScMngr] Number=13383 Confirmed=X Filename=winsmc.exe Description=Added by the SDBOT-BPZ WORM! Source=Paul Collins Startup list [WinSec] Number=13384 Confirmed=X Filename=winsec16.exe Description=Added by the AGOBOT.ZF WORM! Source=Paul Collins Startup list [winsecure] Number=13385 Confirmed=X Filename=winsecure.exe Description=Browser hijacker, redirecting to specificsearches.com Source=Paul Collins Startup list [WinSecure] Number=13386 Confirmed=X Filename=[random].exe Description=Added by the AGENT-LR TROJAN! Source=Paul Collins Startup list [Winsecure Antivirus] Number=13387 Confirmed=X Filename=Secureantivirus.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [WinSecured32] Number=13388 Confirmed=X Filename=ssmr.exe Description=Added by a variant of the FORBOT WORM! Source=Paul Collins Startup list [Winserv] Number=13389 Confirmed=X Filename=Winserv.ila Description=Added by the NODMIN WORM! Source=Paul Collins Startup list [winserver] Number=13390 Confirmed=X Filename=Server.txt.vbs Description=Added by the DELTAD.A WORM! Source=Paul Collins Startup list [Winservice] Number=13391 Confirmed=X Filename=winmain.exe Description=Adult content related malware Source=Paul Collins Startup list [winservice] Number=13392 Confirmed=X Filename=svchost.exe Description=Added by the CVK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [WinService] Number=13393 Confirmed=X Filename=hosth.exe Description=Added by the DWNLDR-FUX TROJAN! Source=Paul Collins Startup list [WinService] Number=13394 Confirmed=X Filename=Ttt.exe Description=Added by the MSNVB-D WORM! Source=Paul Collins Startup list [WinService32] Number=13395 Confirmed=U Filename=ssmgr.exe Description=007 Spy Software - "stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP" Source=Paul Collins Startup list [WinService32] Number=13396 Confirmed=U Filename=svchost.exe Description=007 Spy Software keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup! Source=Paul Collins Startup list [WinServices] Number=13397 Confirmed=X Filename=WinServices.exe Description=Added by the YAHA.K or YAHA.M WORMS! Source=Paul Collins Startup list [winservices] Number=13398 Confirmed=X Filename=bootvfy.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [winservit] Number=13399 Confirmed=X Filename=cassl.exe Description=Added by the RBOT.ASG WORM! Source=Paul Collins Startup list [winservn] Number=13400 Confirmed=X Filename=winservn.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [winservs] Number=13401 Confirmed=X Filename=winservs.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WinSetBrowse] Number=13402 Confirmed=X Filename=BasicUpdate.dll.vbs Description=Added by the BISCUIT.A WORM! Source=Paul Collins Startup list [winsfc] Number=13403 Confirmed=X Filename=winsfc.exe Description=Added by the WISFC VIRUS! Source=Paul Collins Startup list [Winshell] Number=13404 Confirmed=X Filename=remote.exe Description=Added by the MYTOB.LJ WORM! Source=Paul Collins Startup list [Winshoe] Number=13405 Confirmed=? Filename=wuadfdqr.exe Description=Probably an unidentified VIRUS! Adds itself to 3 registry "Run" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed Source=Paul Collins Startup list [winshost.exe] Number=13406 Confirmed=X Filename=winshost.exe Description=Added by the TOOSO WORM and variants! Source=Paul Collins Startup list [WinShowUpdate] Number=13407 Confirmed=X Filename=copy C:\WINDOWS\winshow.new C:\WINDOW\Swinshow.dll Description=Winshow parasiate related - from the "RunOnce" keys it replaces "winshow.dll" with a new version Source=Paul Collins Startup list [WinSig] Number=13408 Confirmed=X Filename=NetXP.exe Description=Added by the BANKER-FN TROJAN! Source=Paul Collins Startup list [winskype] Number=13409 Confirmed=X Filename=winskype.exe Description=Added by the BROGGER-C TROJAN! Source=Paul Collins Startup list [winsock] Number=13410 Confirmed=X Filename=svch0st.exe Description=Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase "o" Source=Paul Collins Startup list [Winsock driver] Number=13411 Confirmed=X Filename=winnt update.exe Description=Added by the SPYBOT-DM TROJAN! Source=Paul Collins Startup list [Winsock driver] Number=13412 Confirmed=X Filename=winnt64.exe Description=Added by the SPYBOT-DR WORM! Source=Paul Collins Startup list [Winsock Startup] Number=13413 Confirmed=X Filename=Main2.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [winsock2] Number=13414 Confirmed=X Filename=netsvr.exe Description=Added by the AGOBOT.LY WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13415 Confirmed=X Filename=SDJOIJE.EXE Description=Added by the SPYBOT.DR TROJAN! Source=Paul Collins Startup list [Winsock2 driver] Number=13416 Confirmed=X Filename=MIRC32.exe Description=Added by the SPYBUZZ TROJAN! Source=Paul Collins Startup list [Winsock2 driver] Number=13417 Confirmed=X Filename=kgzgjkpcw.exe Description=Added by the SDBOT.T TROJAN! Source=Paul Collins Startup list [Winsock2 driver] Number=13418 Confirmed=X Filename=ZONEALARM.EXE Description=Added by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program Source=Paul Collins Startup list [Winsock2 driver] Number=13419 Confirmed=X Filename=WINCFG.SCR Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13420 Confirmed=X Filename=winupdate.exe Description=Added by the SPYBOT-BX WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13421 Confirmed=X Filename=SPOLSV.EXE Description=Added by the SPYBOT-CM WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13422 Confirmed=X Filename=Zonealarmupdate.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13423 Confirmed=X Filename=sysreq.exe Description=Added by the SPYBOT-CC WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13424 Confirmed=X Filename=AMSNMGR.EXE Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13425 Confirmed=X Filename=WUAUMQR.EXE Description=Added by the SPYBOT-DP WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13426 Confirmed=X Filename=wincfg.exe Description=Added by the SPYBOT.CO WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13427 Confirmed=X Filename=ntsys32.exe Description=Added by the SPYBOT-DD WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13428 Confirmed=X Filename=svchorsst.exe Description=Added by the SPYBOT-EE WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13429 Confirmed=X Filename=SYSTEM32.EXE Description=Added by the SPYBOT-EG WORM! Source=Paul Collins Startup list [Winsock2 driver] Number=13430 Confirmed=X Filename=dllcfg32.exe Description=Added by the SPYBOT.AG WORM! Source=Paul Collins Startup list [Winsock2.dll] Number=13431 Confirmed=X Filename=WINLODR.SCR Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Winsock32 driver] Number=13432 Confirmed=X Filename=Testing.exe Description=Added by the SPYBOT.B WORM! Source=Paul Collins Startup list [Winsock32 driver] Number=13433 Confirmed=X Filename=lcd.exe Description=Added by the SPYBOT.B WORM! Source=Paul Collins Startup list [Winsock32 driver] Number=13434 Confirmed=X Filename=Sdjoije.exe Description=Added by the SPYBOT.B WORM! Source=Paul Collins Startup list [Winsock32driver] Number=13435 Confirmed=X Filename=win32server.scr Description=Added by the HACARMY TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13436 Confirmed=X Filename=sp2XPupdate.exe Description=Added by the HACKARMY.S TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13437 Confirmed=X Filename=win32server.exe Description=Added by the BACKDOOR-AZV TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13438 Confirmed=X Filename=ZoneAlarmPr0.exe Description=Added by the HACKARMY-B TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13439 Confirmed=X Filename=ZoneLockup.exe Description=Added by the HACARMY.D TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13440 Confirmed=X Filename=win32server.exe Description=Added by the HACARMY.F TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13441 Confirmed=X Filename=winXPupdate.exe Description=Added by the HACKARMY.9728 TROJAN! Source=Paul Collins Startup list [Winsock32driver] Number=13442 Confirmed=X Filename=svchhost.exe Description=Added by the HACKARMY.I TROJAN! Source=Paul Collins Startup list [winsockdriver] Number=13443 Confirmed=X Filename=tskmg.exe Description=Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM! Source=Paul Collins Startup list [winsockdriver] Number=13444 Confirmed=X Filename=winsock2.2.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [winsockdriver] Number=13445 Confirmed=X Filename=iexplor.exe Description=Added by the BLATIC.A WORM! Source=Paul Collins Startup list [winsockdriver] Number=13446 Confirmed=X Filename=winsock3.exe Description=Added by the SPYBOT-DO WORM! Source=Paul Collins Startup list [winsockdriver] Number=13447 Confirmed=X Filename=bot.exe Description=Added by the WARPIGS-D TROJAN! Source=Paul Collins Startup list [WinSocketComponent] Number=13448 Confirmed=X Filename=nthost.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Winsocks2 driver] Number=13449 Confirmed=X Filename=mznmgr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WINSOS VERIFY] Number=13450 Confirmed=U Filename=WINSOS.EXE Description=WinSOS - "deletes spyware, optimizes your computer - backs up selected data" Source=Paul Collins Startup list [WinSP] Number=13451 Confirmed=X Filename=[path] REGEDIT.EXE -s [path] sysreg.reg Description=Added by the STARTPA-ME TROJAN! Source=Paul Collins Startup list [winspd32dll] Number=13452 Confirmed=X Filename=winspd32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [WinSPF] Number=13453 Confirmed=X Filename=windrv32.exe Description=Added by the MYDOOM.T WORM! Source=Paul Collins Startup list [WinSPF] Number=13454 Confirmed=X Filename=winspf32.exe Description=Added by the MYDOOM.S WORM! Source=Paul Collins Startup list [Winspl] Number=13455 Confirmed=X Filename=winsplx.exe Description=Added by a variant of the TROLL-A TROJAN! Source=Paul Collins Startup list [Winspool] Number=13456 Confirmed=X Filename=spoolsvr.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WinSrv] Number=13457 Confirmed=X Filename=kn0x.exe Description=Added by the HOBBIT.F WORM! Source=Paul Collins Startup list [WinSrv] Number=13458 Confirmed=X Filename=SHIZZLE.EXE Description=Added by the HOBBIT.C WORM! Source=Paul Collins Startup list [Winsrv] Number=13459 Confirmed=X Filename=winsrv.exe Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [winsrv] Number=13460 Confirmed=X Filename=winsrv.exe Description=Added by the NETSNAK-B TROJAN! Source=Paul Collins Startup list [winsrv3] Number=13461 Confirmed=X Filename=services.exe Description=Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder Source=Paul Collins Startup list [WinsSystem] Number=13462 Confirmed=X Filename=syssmss.exe Description=Added by the DELF.IG TROJAN! Source=Paul Collins Startup list [WinStabilizer] Number=13463 Confirmed=X Filename=WinStabilizer.exe Description=Added by the AGOBOT-SW WORM! Source=Paul Collins Startup list [WinStart] Number=13464 Confirmed=X Filename=WinStart.exe Description=From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge Source=Paul Collins Startup list [WinStart] Number=13465 Confirmed=X Filename=Wscript.exe WinStart.vbs Description=Added by the CIAN.C WORM! Source=Paul Collins Startup list [WinStart] Number=13466 Confirmed=X Filename=winstart32.exe Description=Added by the PUROL WORM! Source=Paul Collins Startup list [WinStart] Number=13467 Confirmed=X Filename=WinStart.pif Description=Added by the CONE.E WORM! Source=Paul Collins Startup list [winstart] Number=13468 Confirmed=X Filename=winstart.exe Description=Added by the SCKEYLO-AB TROJAN! Source=Paul Collins Startup list [WinStart001] Number=13469 Confirmed=X Filename=WinStart001.exe Description=From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge Source=Paul Collins Startup list [WinStart001.EXE] Number=13470 Confirmed=X Filename=WinStart001.exe Description=From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge Source=Paul Collins Startup list [winstats] Number=13471 Confirmed=X Filename=winstats.exe Description=Added by the GARGAFX TROJAN! Source=Paul Collins Startup list [Winsta~1] Number=13472 Confirmed=X Filename=winsta~1.exe Description=GoHip foistware Source=Paul Collins Startup list [WinSth16] Number=13473 Confirmed=X Filename=WinSth16.exe Description=Added by the CAKE WORM! Source=Paul Collins Startup list [winstro] Number=13474 Confirmed=X Filename=RUN32DLL.exe Description=Added by the FTP_ANA TROJAN! Source=Paul Collins Startup list [winsupdatesysmngr64] Number=13475 Confirmed=X Filename=winsys64mnger.exe Description=Added by the RBOT-BAG WORM! Source=Paul Collins Startup list [WinSvc16.exe] Number=13476 Confirmed=X Filename=WinSvc16.exe Description=Added by the SDBOT.FQ TROJAN! Source=Paul Collins Startup list [Winsvc32] Number=13477 Confirmed=X Filename=Winsvc32.exe Description=Homepage hijacker Source=Paul Collins Startup list [winsvc32.exe] Number=13478 Confirmed=X Filename=winsvc32.exe Description=Added by the GREPAGE TROJAN! Source=Paul Collins Startup list [Winsvr] Number=13479 Confirmed=X Filename=msupd******.exe [*= random digit] Description=Added by the INJECT.163 TROJAN! Source=Paul Collins Startup list [Winsvr manager] Number=13480 Confirmed=X Filename=DDEsvr.exe Description=Added by the TIRBOT-C WORM! Source=Paul Collins Startup list [winsy32.exe] Number=13481 Confirmed=X Filename=winsy32.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [winsync] Number=13482 Confirmed=X Filename=******.exe reg_run [* = random char] Description=Added by a variant of the QOOLOGIC TROJAN! Source=Paul Collins Startup list [Winsys] Number=13483 Confirmed=U Filename=Winsys.exe Description=Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself Source=Paul Collins Startup list [WINSYS] Number=13484 Confirmed=X Filename=[path to trojan] Description=Added by the GOLDPLAY TROJAN! Source=Paul Collins Startup list [winsys] Number=13485 Confirmed=X Filename=syschost.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [WinSys32] Number=13486 Confirmed=X Filename=Winsys32.exe Description=Added by the CIGIVIP TROJAN or RECKUS WORM! Source=Paul Collins Startup list [winsys32 Driver] Number=13487 Confirmed=X Filename=winsys32.exe Description=Added by the LOONY-O TROJAN! Source=Paul Collins Startup list [WinSysAppMon] Number=13488 Confirmed=U Filename=WinSysRM.exe Description=Home & Family Content Filter related. See here Source=Paul Collins Startup list [winsysban] Number=13489 Confirmed=X Filename=[path to trojan] Description=Added by the CLICKER-CD TROJAN! Source=Paul Collins Startup list [winsyslog lptt01] Number=13490 Confirmed=X Filename=winsyslog.exe Description=RapidBlaster variant (in a "Winsyslog" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [WinSysModule] Number=13491 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT-DIQ TROJAN! Source=Paul Collins Startup list [WinSysStartUpWKbLw] Number=13492 Confirmed=X Filename=TaskSystemDll.Exe Description=Added by the BACKZAT.G WORM! Source=Paul Collins Startup list [WinSyst32] Number=13493 Confirmed=X Filename=winsyst32.exe Description=Added by the MORB WORM! Source=Paul Collins Startup list [WinSystem] Number=13494 Confirmed=X Filename=winsystem.exe Description=Added by the WHITEBAIT WORM! Source=Paul Collins Startup list [WinSystem] Number=13495 Confirmed=U Filename=WinSystems.exe Description=CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [WinSystems] Number=13496 Confirmed=X Filename=winsystems16.exe Description=Added by the SDBOT-CZT WORM! Source=Paul Collins Startup list [winsystems25] Number=13497 Confirmed=X Filename=winsystems.exe Description=Added by the RBOT-CNZ WORM! Source=Paul Collins Startup list [winsysupd] Number=13498 Confirmed=X Filename=[path to trojan] Description=Added by the STARTPA-NI TROJAN! Source=Paul Collins Startup list [WINT] Number=13499 Confirmed=X Filename=wcp****.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WINT] Number=13500 Confirmed=X Filename=wcpcc.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WINT] Number=13501 Confirmed=X Filename=wcpsvit.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WinTask] Number=13502 Confirmed=X Filename=Wintask.exe Description=Added by the HIPO or LEMIR.F TROJANS! Source=Paul Collins Startup list [WINTASK] Number=13503 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB.I WORM and variants! Source=Paul Collins Startup list [WINTASK] Number=13504 Confirmed=X Filename=taskgamr.exe Description=Added by the MYTOB.AU WORM! Source=Paul Collins Startup list [WINTASK] Number=13505 Confirmed=X Filename=sys32.exe Description=Added by the MYTOB.K WORM! Source=Paul Collins Startup list [WINTASK] Number=13506 Confirmed=X Filename=msmgrxp.exe Description=Added by the MYTOB.AQ WORM! Source=Paul Collins Startup list [WINTASK] Number=13507 Confirmed=X Filename=iexplorer.exe Description=Added by the MYTOB-CH WORM! Source=Paul Collins Startup list [WINTASK] Number=13508 Confirmed=X Filename=taskgmr32.exe Description=Added by the MYTOB.BU WORM! Source=Paul Collins Startup list [WINTASK] Number=13509 Confirmed=X Filename=msvhost.exe Description=Added by the MYTOB-AR WORM! Source=Paul Collins Startup list [WINTASK] Number=13510 Confirmed=X Filename=t4skmgr.exe Description=Added by the MYTOB-AK WORM! Source=Paul Collins Startup list [WINTASK] Number=13511 Confirmed=X Filename=taskfile.exe Description=Added by the MYTOB.EF WORM! Source=Paul Collins Startup list [WINTASK] Number=13512 Confirmed=X Filename=taskgm.exe Description=Added by the MYTOB-AO WORM! Source=Paul Collins Startup list [WINTASK] Number=13513 Confirmed=X Filename=taskgmrs.exe Description=Added by the MYTOB.DH WORM! Source=Paul Collins Startup list [WINTASK] Number=13514 Confirmed=X Filename=yahooicons.exe Description=Added by the MYTOB-HM WORM! Source=Paul Collins Startup list [WINTASK DLL] Number=13515 Confirmed=X Filename=jusched32.exe Description=Added by the MYTOB.AI WORM! Source=Paul Collins Startup list [WINTASK DLL32] Number=13516 Confirmed=X Filename=smsrss.exe Description=Added by the MYTOB.BS WORM! Source=Paul Collins Startup list [WinTask driver] Number=13517 Confirmed=X Filename=wintask.exe Description=Added by the DLOADER-NA TROJAN! Source=Paul Collins Startup list [WINTASK32] Number=13518 Confirmed=X Filename=taskgmr32.exe Description=Added by the MYTOB.BN WORM! Source=Paul Collins Startup list [WINTASK32] Number=13519 Confirmed=X Filename=taskgmrr.exe Description=Added by the MYTOB.FX WORM! Source=Paul Collins Startup list [wintask32] Number=13520 Confirmed=X Filename=Jwintask.com Description=Added by the NAFBOT-A WORM! Source=Paul Collins Startup list [WINTASKMANAGER] Number=13521 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB-AF WORM! Source=Paul Collins Startup list [WINTASKMGR] Number=13522 Confirmed=X Filename=ccsrs.exe Description=Added by the MYTOB.Q WORM! Source=Paul Collins Startup list [WINTASKS] Number=13523 Confirmed=X Filename=taskgmr.exe Description=Added by the MYTOB.BO WORM! Source=Paul Collins Startup list [WINTASKS] Number=13524 Confirmed=X Filename=winxpro.exe Description=Added by the MYTOB.EZ WORM! Source=Paul Collins Startup list [WinTasks DLL Library (32-bits)] Number=13525 Confirmed=X Filename=winkll.exe Description=Added by the RBOT-AJZ WORM! Source=Paul Collins Startup list [WinTasks Traybar] Number=13526 Confirmed=U Filename=wintasks.exe Description=WinTasks - "Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task, but will actually make your system run faster and more smoothly than ever before" Source=Paul Collins Startup list [wintasks.exe] Number=13527 Confirmed=X Filename=wintasks.exe Description=Added by the EVAMAN WORM! Source=Paul Collins Startup list [Wintbp.exe] Number=13528 Confirmed=X Filename=wintbp.exe Description=Added by the ZOTOB.E WORM! Source=Paul Collins Startup list [Wintbpx.exe] Number=13529 Confirmed=X Filename=wintbpx.exe Description=Added by the ZOTOB.F WORM! Source=Paul Collins Startup list [wintective] Number=13530 Confirmed=U Filename=wintective.exe Description=Wintective logs keystrokes, captures screenshots, and monitors Internet activity. The gathered information can be sent to a predetermined email address. If you didn't install this yourself remove it Source=Paul Collins Startup list [winter] Number=13531 Confirmed=X Filename=happy.exe Description=Added by the SDBOT-YF WORM! Source=Paul Collins Startup list [Wintercooler Pro] Number=13532 Confirmed=N Filename=WINCOOL.EXE Description=Wintercooler Pro - utility that monitors CPU usage, RAM consumption and Internet connection speed Source=Paul Collins Startup list [WinTidy] Number=13533 Confirmed=N Filename=WinTidy.exe Description=Desktop icon manager from PC Magazine (Ziff-Davis). Available via Start -> Programs Source=Paul Collins Startup list [Wintime] Number=13534 Confirmed=X Filename=Wintime.exe Description=Added by the HARNIG TROJAN! Source=Paul Collins Startup list [WinTime] Number=13535 Confirmed=U Filename=wintime.exe Description=Added by WinTime - change desktop icons' color and font Source=Paul Collins Startup list [Wintime Wtxpload] Number=13536 Confirmed=N Filename=Wxpload.exe Wintime Description=Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet, if it's not already running. It then starts an application which manages the tablet messages. Since I leave the tablet unplugged unless I need to use it, I don't need this running at startup. I suspect that this program monitors a number of windows messages, so that when it's loaded, my regular mouse slows down - it acts like it 'sticks' entering and leaving windows. Certainly my performance returned to what I expected when I removed this item using MSCONFIG" Source=Paul Collins Startup list [WinTimer] Number=13537 Confirmed=X Filename=msupdate.cmd Description=Hijacker - recognized by Kaspersky antivirus as Trojan.Win32.StartPage.tj Source=Paul Collins Startup list [wintnask32.exe] Number=13538 Confirmed=X Filename=wintnask32.exe Description=Added by the RBOT-AFP WORM! Source=Paul Collins Startup list [wintnl.exe] Number=13539 Confirmed=X Filename=wintnl.exe Description=Added by a variant of the ZOTOB.K WORM! Source=Paul Collins Startup list [wintnpx.exe] Number=13540 Confirmed=X Filename=wintnpx.exe Description=Added by the ZOTOB.H WORM! Source=Paul Collins Startup list [WinTools] Number=13541 Confirmed=X Filename=WToolsA.exe Description=Wintools adware Source=Paul Collins Startup list [WinTOTAL Scheduler] Number=13542 Confirmed=N Filename=guru.exe Description=WinTOTAL Real estate appraisal software related Source=Paul Collins Startup list [WinTray] Number=13543 Confirmed=X Filename=wintray.exe Description=Added by the LEGUARDIEN.B TROJAN! Source=Paul Collins Startup list [wintsk32dll] Number=13544 Confirmed=X Filename=wintsk32dll.exe Description=Added by the RBOT-AAJ WORM! Source=Paul Collins Startup list [winudll.exe] Number=13545 Confirmed=X Filename=winudll.exe Description=Added by the MITGLIE-CE TROJAN! Source=Paul Collins Startup list [winui] Number=13546 Confirmed=X Filename=z.exe Description=Added by the KONDELI TROJAN! Source=Paul Collins Startup list [winupated.exe] Number=13547 Confirmed=X Filename=winupated.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [winupd] Number=13548 Confirmed=X Filename=RUNDLL32.EXE [random value].dll, _mainRD Description=Added by the MOTA.A WORM! Source=Paul Collins Startup list [winupd] Number=13549 Confirmed=X Filename=winupd.exe Description=SearchNew adware Source=Paul Collins Startup list [winupd.exe] Number=13550 Confirmed=X Filename=winupd.exe Description=Added by the BEAGLE.M or BEAGLE.N WORMS! Source=Paul Collins Startup list [WinUPD32] Number=13551 Confirmed=X Filename=explorer.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually! Source=Paul Collins Startup list [winupdat] Number=13552 Confirmed=X Filename=winupdat.exe Description=Added by the CANBOT.A WORM! Source=Paul Collins Startup list [WinUpdate] Number=13553 Confirmed=X Filename=RBSKQQBO.EXE Description=Added by the VBSWG2B.A WORM! Source=Paul Collins Startup list [WinUpdate] Number=13554 Confirmed=X Filename=wmbem.exe Description=Added by the REVCUSS.B TROJAN! Source=Paul Collins Startup list [WinUpdate] Number=13555 Confirmed=X Filename=updsys.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winupdate] Number=13556 Confirmed=X Filename=winupdate.exe Description=Added by the ALCAN.B WORM! Source=Paul Collins Startup list [WinUpdate] Number=13557 Confirmed=X Filename=svhost.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WinUpdate Loader] Number=13558 Confirmed=X Filename=msnnm.exe Description=Added by the REVCUSS.C TROJAN! Source=Paul Collins Startup list [winupdate.exe] Number=13559 Confirmed=X Filename=winupdate.exe Description=Added by the RADO TROJAN! Source=Paul Collins Startup list [winupdate.reg] Number=13560 Confirmed=X Filename=winupdate.exe Description=Added by the SPYBOT.EAS WORM! Source=Paul Collins Startup list [winupdate2846] Number=13561 Confirmed=X Filename=vbsystem35.exe msvbrun.exe Description=Added by a variant of the MUTIN-C TROJAN! Source=Paul Collins Startup list [WinUpdateB] Number=13562 Confirmed=X Filename=breatle.exe Description=Added by the BRATLE.AWORM! Source=Paul Collins Startup list [winupdateconn] Number=13563 Confirmed=X Filename=[path to file] Description=Added by the COMBRA-A WORM! Source=Paul Collins Startup list [winupdateconn_] Number=13564 Confirmed=X Filename=Explorer.EXE Description=Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [winupdatefiv_] Number=13565 Confirmed=X Filename=[path to file] Description=Added by the COMBRA.C WORM! Source=Paul Collins Startup list [WinUpdateProtection] Number=13566 Confirmed=U Filename=csrss.exe Description=EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer Source=Paul Collins Startup list [winupdates] Number=13567 Confirmed=X Filename=winupdates.exe Description=Added by the ALCRA-B WORM! Source=Paul Collins Startup list [winupdate_] Number=13568 Confirmed=X Filename=[path to file] Description=Added by the COMDOR.A WORM! Source=Paul Collins Startup list [WinUPDbc] Number=13569 Confirmed=X Filename=winupdbc.exe Description=Added by the BANKER-DSN TROJAN! Source=Paul Collins Startup list [WinUpdsv] Number=13570 Confirmed=X Filename=winupdsv.exe Description=Added by the DROPO MACRO! Source=Paul Collins Startup list [winupdt] Number=13571 Confirmed=X Filename=RUNDLL32.EXE [random.dll] Description=Added by the MABUT.A WORM! Source=Paul Collins Startup list [winupdtl] Number=13572 Confirmed=X Filename=winupdtl.exe Description=SecondThought adware variant Source=Paul Collins Startup list [WinUpgrader] Number=13573 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT-DZ TROJAN! Source=Paul Collins Startup list [winur] Number=13574 Confirmed=X Filename=winrun.exe Description=Added by the WINUR.B WORM! Source=Paul Collins Startup list [winusb.dll] Number=13575 Confirmed=X Filename=winguard.exe Description=Added by the FORBOT-CN WORM! Source=Paul Collins Startup list [WinUser32K] Number=13576 Confirmed=X Filename=usr32wink.exe Description=Added by the HK TROJAN! Source=Paul Collins Startup list [WinUsr] Number=13577 Confirmed=X Filename=WinUsr.exe K1S2 Description=Added by the CLUNK.A WORM! Source=Paul Collins Startup list [Winux Piriax Service] Number=13578 Confirmed=X Filename=PH32.EXE Description=Added by the RANDEX.G WORM! Source=Paul Collins Startup list [winversion] Number=13579 Confirmed=X Filename=winversion.exe Description=Browser hijacker, redirecting to specificsearches.com Source=Paul Collins Startup list [WinVNC] Number=13580 Confirmed=U Filename=WinVNC.exe Description=WinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet. Now superseeded by RealVNC Source=Paul Collins Startup list [WinVNC] Number=13581 Confirmed=X Filename=iexplorer.exe Description=Added by the EVIVINC VIRUS! Source=Paul Collins Startup list [winvxd32] Number=13582 Confirmed=X Filename=winvxd32.exe Description=Added by the GABLOLIZ.A WORM! Source=Paul Collins Startup list [winwan lptt01] Number=13583 Confirmed=X Filename=winwan.exe Description=RapidBlaster variant (in a "Winwan" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [winwan ml097e] Number=13584 Confirmed=X Filename=winwan.exe Description=RapidBlaster variant (in a "Winwan" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [winword] Number=13585 Confirmed=X Filename=winword.exe Description=Added by the TORPID-C TROJAN! Source=Paul Collins Startup list [WINWORD.exe] Number=13586 Confirmed=X Filename=WINWORD.exe Description=Added by the DRIVUS TROJAN! Note - this is not the legitimate MS Word process of the same name, which is always located in the Program Files folder. This one is found in System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [WinWorks] Number=13587 Confirmed=X Filename=vstmgr.exe Description=Added by the AGOBOT.ACJ WORM! Source=Paul Collins Startup list [winwsl.exe] Number=13588 Confirmed=X Filename=winwsl.exe Description=Added by the ZOTOB-J WORM! Source=Paul Collins Startup list [winXP] Number=13589 Confirmed=X Filename=33.exe Description=Added by the ANPES WORM! Source=Paul Collins Startup list [WinXP] Number=13590 Confirmed=X Filename=plugin1.exe Description=Added by the Downloader-JW TROJAN! Source=Paul Collins Startup list [WinXP] Number=13591 Confirmed=X Filename=csrss.exe Description=Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "Arquivos de programas\WinXP\Tools" folder Source=Paul Collins Startup list [WinXP fix] Number=13592 Confirmed=X Filename=[path to file] Description=Added by the RANKY.P TROJAN! Source=Paul Collins Startup list [WinXP Processor Generator v1.2] Number=13593 Confirmed=X Filename=intspnsr32.exe Description=Added by the SDBOT.LP WORM! Source=Paul Collins Startup list [WinXp Updater] Number=13594 Confirmed=X Filename=winxp32.exe Description=Added by the RBOT-HG WORM! Source=Paul Collins Startup list [WinXP-98] Number=13595 Confirmed=X Filename=CSRSS.exe Description=Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located a C:\Arquivos de programas\WinXP-98\Tools folder Source=Paul Collins Startup list [winxpdll32.exe] Number=13596 Confirmed=X Filename=winxpdll32.exe Description=Added by a variant of the SMALL downloader TROJAN! Source=Paul Collins Startup list [WinXPHome] Number=13597 Confirmed=X Filename=plugin2.exe Description=Added by the malicious INOR.T script! Source=Paul Collins Startup list [WinXPLoad] Number=13598 Confirmed=U Filename=Rundll32 LoadDll, LoadExe WinXPLoad.exe Description=Compaq hotkey related - required if you use the hotkeys Source=Paul Collins Startup list [winxpusbd] Number=13599 Confirmed=X Filename=winxp64.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [winystems25] Number=13600 Confirmed=X Filename=winystems.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Winz Firewall] Number=13601 Confirmed=X Filename=[random filename].exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [WinZap Check] Number=13602 Confirmed=X Filename=winzbp.exe Description=Added by the RBOT-AWZ WORM! Source=Paul Collins Startup list [winzip] Number=13603 Confirmed=X Filename=[path to trojan] Description=Added by the BANCOS.G or BANCOS.K TROJANS! Note - this is not part of the popular WinZip file compression utility Source=Paul Collins Startup list [Winzip] Number=13604 Confirmed=X Filename=[various filenames] Description=Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe, common.pif, common.scr, Sexo.exe, Sexo.jpg.pif, ini_file__.pif, load_me__.tmp, msfile.pif, system_load_.pif or zipped.rar.pif Source=Paul Collins Startup list [Winzip Application] Number=13605 Confirmed=X Filename=winzip81.exe Description=Added by the RBOT-BKZ WORM! Source=Paul Collins Startup list [WinZip Quick Pick] Number=13606 Confirmed=N Filename=WZQKPICK.EXE Description=Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up Source=Paul Collins Startup list [WinZip Update] Number=13607 Confirmed=X Filename=WinZip.exe Description=Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility Source=Paul Collins Startup list [Win_api_driver] Number=13608 Confirmed=X Filename=system.exe Description=Added by the REVIRD TROJAN! Source=Paul Collins Startup list [Win_BooT] Number=13609 Confirmed=X Filename=[path to file] Description=Added by the BANKER-GI TROJAN! Source=Paul Collins Startup list [WIN_DRIVR32] Number=13610 Confirmed=X Filename=shchostv.exe Description=Added by a TROJAN - see here Source=Paul Collins Startup list [Win_Library] Number=13611 Confirmed=X Filename=INISvc.exe Description=Added by the ANARCH WORM! Source=Paul Collins Startup list [win_spool2] Number=13612 Confirmed=X Filename=win_spool2.exe Description=Added by the SCKEYLOG.B TROJAN! Source=Paul Collins Startup list [win_supp00.exe] Number=13613 Confirmed=X Filename=Win Const.exe Description=Added by the ASSASIN-H TROJAN! Source=Paul Collins Startup list [win_upd.exe] Number=13614 Confirmed=X Filename=WINdirect.exe Description=Added by the MITGLIEDER.M TROJAN! Source=Paul Collins Startup list [win_upd2.exe] Number=13615 Confirmed=X Filename=WINdirect.exe Description=Added by the BEAGLE.AO WORM! Source=Paul Collins Startup list [Win_vader] Number=13616 Confirmed=X Filename=Win_vader.vbs Description=Added by the INVASION.A VIRUS! Source=Paul Collins Startup list [WIP Config GUI] Number=13617 Confirmed=X Filename=Winipcfgs.exe Description=Added by the RBOT-CN WORM! Source=Paul Collins Startup list [Wireless Console] Number=13618 Confirmed=N Filename=wcourier.exe Description=ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices Source=Paul Collins Startup list [Wireless PCI Card Configuration Utility] Number=13619 Confirmed=U Filename=WMP11Cfg.exe Description=Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Source=Paul Collins Startup list [Wireless Provider Server] Number=13620 Confirmed=X Filename=wpsvr.exe Description=Added by the FORBOT-AD WORM! Source=Paul Collins Startup list [Wireless Switching Setting Utility] Number=13621 Confirmed=U Filename=Switcher.exe Description=On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN, Bluetooth, both) when turning the wireless switch on if disabled) Source=Paul Collins Startup list [Wireless-G Notebook Adapter] Number=13622 Confirmed=Y Filename=Gcc.exe Description=LinkSys Wireless-G Notebook Adapter driver Source=Paul Collins Startup list [Wireless-G Notebook Adapter Utility] Number=13623 Confirmed=U Filename=WPC54CFG.EXE Description=Utility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G) Source=Paul Collins Startup list [WireLessKeyboard] Number=13624 Confirmed=U Filename=PS2USBKbdDrv.exe Description=Related to WireLess Keyboard Multimedia Combo Set by SANSUN Industries Source=Paul Collins Startup list [WireLessMouse] Number=13625 Confirmed=U Filename=MouseDrv.exe Description=Related to WireLess Mouse Multimedia Combo Set by SANSUN Industries. Located in C:\Program Files\Multimedia Combo Set Source=Paul Collins Startup list [wise] Number=13626 Confirmed=X Filename=clockwise.exe Description=Added by the LAZAR-A TROJAN! Source=Paul Collins Startup list [WIZZ] Number=13627 Confirmed=X Filename=dazzler.exe Description=Reported by Kaspersky Anti-Virus as DIALER.IS TROJAN! Source=Paul Collins Startup list [wjview] Number=13628 Confirmed=N Filename=wjview.exe Description=MS tool used to view window-based Java applications from the command line Source=Paul Collins Startup list [wkcalrem] Number=13629 Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [WkDetect] Number=13630 Confirmed=N Filename=WkDetect.exe Description=Checks for updates to MS Works Source=Paul Collins Startup list [wkfud] Number=13631 Confirmed=N Filename=wkfud.exe Description=A marketing program for MS Works Source=Paul Collins Startup list [WksSb] Number=13632 Confirmed=N Filename=WksSb.exe Description=The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file Source=Paul Collins Startup list [WksSVC] Number=13633 Confirmed=X Filename=EXPLORER.exe Description=Added by the MYTOB-BW WORM! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [WkUFind] Number=13634 Confirmed=N Filename=WkUFind.exe Description=MS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site. You can also turn of the automatic update feature within Picture It! - see here Source=Paul Collins Startup list [Wkyo86] Number=13635 Confirmed=X Filename=[path to worm] Description=Added by the PITIN-A WORM! Source=Paul Collins Startup list [Wlan Drier] Number=13636 Confirmed=X Filename=Winusb2.exe Description=Added by the WOOTBOT.DC WORM! Source=Paul Collins Startup list [Wlan Driver] Number=13637 Confirmed=X Filename=avscan.exe Description=Added by the WOOTBOT.DH WORM! Source=Paul Collins Startup list [WLAN Status Tray Applet] Number=13638 Confirmed=N Filename=WLANSTA.EXE Description=System Tray icon for checking the status of a Wireless LAN Source=Paul Collins Startup list [wlancfg] Number=13639 Confirmed=U Filename=wlancfg.exe Description=Inventel wireless router related - required in order to automatically connect to the Net at bootup Source=Paul Collins Startup list [wlancfg5] Number=13640 Confirmed=Y Filename=wlancfg5.exe Description=NetGear WG311v3 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient Source=Paul Collins Startup list [WLANSTA.EXE] Number=13641 Confirmed=N Filename=WLANSTA.EXE Description=System Tray icon for checking the status of a Wireless LAN Source=Paul Collins Startup list [WLAN_Cfg.exe] Number=13642 Confirmed=Y Filename=WLAN_Cfg.exe Description=Linksys Instant Wireless USB Network Adapter driver Source=Paul Collins Startup list [wlsass] Number=13643 Confirmed=X Filename=wlsass.exe Description=Added by the RANKY.CY TROJAN! Source=Paul Collins Startup list [WLTRAY] Number=13644 Confirmed=N Filename=wltray.exe Description=Installed alongside Dell Wireless WLAN Card and provides additional configuration options for these devices Source=Paul Collins Startup list [wltray] Number=13645 Confirmed=N Filename=wltray.exe Description=System tray access to wireless LAN card configuration options Source=Paul Collins Startup list [WM VCR] Number=13646 Confirmed=N Filename=WMVCR.exe Description=WM Recorder allows you to record Windows Media(tm) streaming Video or Audio content. Can be accessed via Start Menu -> Programs Source=Paul Collins Startup list [Wm24Pan] Number=13647 Confirmed=Y Filename=Wm24Pan.Exe Description=ESI external sound card driver Source=Paul Collins Startup list [wm41a398] Number=13648 Confirmed=X Filename=rundll32.exe [path] wm41a398.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [WMAudio] Number=13649 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [WMAudio] Number=13650 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [WMBoot] Number=13651 Confirmed=N Filename=N/A Description=Associated with Logitech Wingman game controllers. Not required but what does it do? Source=Paul Collins Startup list [wmcbaaca] Number=13652 Confirmed=X Filename=rundll32.exe [path] wmcbaaca.dll, EnableRunDLL32 Description=LZIO.com adware downloader Source=Paul Collins Startup list [WMC_RebootCheck] Number=13653 Confirmed=N Filename=unregmp2.exe Description=Corrects problems with installations of Windows Media Player from version 9 onwards - see here and search for "unregmp2.exe" Source=Paul Collins Startup list [WMI Application Interface] Number=13654 Confirmed=X Filename=wmiapi.exe Description=Added by the SPYBOT.RBY WORM! Source=Paul Collins Startup list [WMIEXE.exe] Number=13655 Confirmed=U Filename=wmiexe.exe Description=NT component, used by Windows Millennium to detect Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed Source=Paul Collins Startup list [Wminf] Number=13656 Confirmed=X Filename=Wminf.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [Wminfo] Number=13657 Confirmed=X Filename=Wminfo.exe Description=Added by the GEMA TROJAN! Source=Paul Collins Startup list [wmiprv] Number=13658 Confirmed=X Filename=wmiprv.exe Description=Added by the RBOT-WM WORM! Source=Paul Collins Startup list [wmon] Number=13659 Confirmed=X Filename=jusched.exe Description=Added by the AGOBOT-OW WORM! Source=Paul Collins Startup list [WMP54Gv4] Number=13660 Confirmed=Y Filename=WMP54Gv4.exe Description=Linksys WMP54Gv4 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient Source=Paul Collins Startup list [wmplayer.exe] Number=13661 Confirmed=X Filename=wmplayer.exe Description=Added by the BANCBAN-CZ TROJAN! Source=Paul Collins Startup list [wmpnscfg] Number=13662 Confirmed=U Filename=wmpnscfg.exe Description="Microsoft Windows uses wmpnscfg.exe to alert users when media rendering devices are found on the network. Wmpnscfg starts the Windows Media Player Network Sharing Service (NSS) and then waits for notifications from the service. When wmpnscfg is notified that a new media device is available on the network, it displays a popup in the system tray that informs the user about the availability of the new device. If the user clicks the popup, wmpnscfg launches Windows Media Player, which displays a dialog box that asks the user to either allow or deny sharing with the new device." - see here Source=Paul Collins Startup list [wms3] Number=13663 Confirmed=X Filename=wms3.exe Description=Added by the LEGMIR-AQG TROJAN! Source=Paul Collins Startup list [wmsys32] Number=13664 Confirmed=X Filename=wmsys32.exe Description=Added by the BANPAES.B TROJAN! Source=Paul Collins Startup list [wmv] Number=13665 Confirmed=X Filename=winmonv.exe Description=Added by the AGENT-DG TROJAN! Source=Paul Collins Startup list [WM_LOGIN] Number=13666 Confirmed=? Filename=MSGLOGIN.EXE Description=Part of McAfee Firewall. What is it for and is it needed? Source=Paul Collins Startup list [WN Services] Number=13667 Confirmed=X Filename=wnsvc.exe Description=Added by the KBBOT-A TROJAN! Source=Paul Collins Startup list [WNAD] Number=13668 Confirmed=X Filename=WNAD.EXE Description=Spyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like Source=Paul Collins Startup list [wnddrv] Number=13669 Confirmed=X Filename=svchost.exe Description=Added by an unidentified TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [WNILOGON] Number=13670 Confirmed=X Filename=WNILOGON.exe Description=Added by the LEWOR-M TROJAN! Source=Paul Collins Startup list [WNSC] Number=13671 Confirmed=X Filename=wns*****.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Wnsck2 driver] Number=13672 Confirmed=X Filename=wlogf.exe Description=Added by the SPYBOT-AF WORM! Source=Paul Collins Startup list [WNSI] Number=13673 Confirmed=X Filename=wnscp**.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WNSO] Number=13674 Confirmed=X Filename=WNSO.exe Description=Baidu.SoBar adware Source=Paul Collins Startup list [WNST] Number=13675 Confirmed=X Filename=wns*****.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [wntlgns] Number=13676 Confirmed=X Filename=wntlgns.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [wnxpupdate] Number=13677 Confirmed=X Filename=spvspool.exe Description=Added by the DABORA.B WORM! Source=Paul Collins Startup list [wnxupdate] Number=13678 Confirmed=X Filename=updatexp.exe Description=Added by the COMBRA-G WORM! Source=Paul Collins Startup list [won update] Number=13679 Confirmed=X Filename=WAPDATE.EXE Description=Added by the RBOT.N WORM! Source=Paul Collins Startup list [WonderFrog] Number=13680 Confirmed=U Filename=WonderFrog.exe Description=Wonder Frog typing monitor Source=Paul Collins Startup list [WooCnxMon] Number=13681 Confirmed=N Filename=CnxMon.exe Description=Wanadoo ISP software related - not required - here's how to bypass it Source=Paul Collins Startup list [Woods Inc] Number=13682 Confirmed=X Filename=wcmd.exe Description=Added by the KILLFIL-O TROJAN! Source=Paul Collins Startup list [woopie] Number=13683 Confirmed=X Filename=winamp.exe Description=Added by the AGOBOT.XV WORM! Note - this is NOT the popular Winamp media player Source=Paul Collins Startup list [WOOTASKBARICON] Number=13684 Confirmed=N Filename=TaskbarIcon.exe Description=Wanadoo ISP taskbar icon - not required Source=Paul Collins Startup list [Woowatch] Number=13685 Confirmed=N Filename=Watch.exe Description=Wanadoo ISP software, not required Source=Paul Collins Startup list [word pair] Number=13686 Confirmed=X Filename=bopotsvr.exe Description=Added by the SHED-A TROJAN! Source=Paul Collins Startup list [WordQ carat flag] Number=13687 Confirmed=Y Filename=WordQcrs.exe Description=Related to WordQ Writing Aid Software Source=Paul Collins Startup list [WordWeb] Number=13688 Confirmed=N Filename=wweb32.exe Description=WordWeb - free theasaurus and dictionary. Start manually Source=Paul Collins Startup list [Workflo] Number=13689 Confirmed=? Filename=workflow.exe Description=Related to BroadJump Client Foundation - broadband troubleshooting software installed by various companies. Is it required? Source=Paul Collins Startup list [Working System Analyzer] Number=13690 Confirmed=X Filename=syswork.exe Description=Added by the FORBOT-FZ WORM! Source=Paul Collins Startup list [worknote1] Number=13691 Confirmed=X Filename=[filename] Description=Added by the MEETOT WORM! Source=Paul Collins Startup list [WorkPace 3.0] Number=13692 Confirmed=U Filename=workpace.exe Description=WorkPace - stress injury prevention software Source=Paul Collins Startup list [Works Calendar Reminder] Number=13693 Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [WorksFUD] Number=13694 Confirmed=N Filename=wkfud.exe Description=A marketing program for MS Works Source=Paul Collins Startup list [Workstation Scheduler] Number=13695 Confirmed=U Filename=wm95.exe Description=Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled, it is required, otherwise, it is useless and a memory hog Source=Paul Collins Startup list [Workstation Services] Number=13696 Confirmed=X Filename=wrkstn.exe Description=Added by the RBOT-OJ WORM! Source=Paul Collins Startup list [Workstation Ver 5.0] Number=13697 Confirmed=X Filename=vmware.exe Description=Added by the RBOT-AHB WORM! Source=Paul Collins Startup list [WorldAntiSpy] Number=13698 Confirmed=X Filename=worldantispy.exe Description=WorldAntiSpy, "rogue" spyware remover, installed as part of this scam Source=Paul Collins Startup list [Worm Detector] Number=13699 Confirmed=U Filename=wd.exe Description=Worm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam Source=Paul Collins Startup list [wormexe] Number=13700 Confirmed=X Filename=winstart.exe Description=Added by the EARLYBIRD WORM! Source=Paul Collins Startup list [wovax] Number=13701 Confirmed=X Filename=wovax.exe Description=Added by the DAQA.A TROJAN! Source=Paul Collins Startup list [wow] Number=13702 Confirmed=X Filename=bar.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [wow] Number=13703 Confirmed=X Filename=wwf.exe Description=Added by the LINEAGE-Y TROJAN! Source=Paul Collins Startup list [wow] Number=13704 Confirmed=X Filename=Launcher.exe Description=Added by the DELF-DOR TROJAN! Source=Paul Collins Startup list [Wpctrl] Number=13705 Confirmed=N Filename=wpctrlnt.exe Description=WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [Wpctrl] Number=13706 Confirmed=N Filename=wpctrl95.exe Description=WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [wpctrl95] Number=13707 Confirmed=N Filename=wpctrlnt.exe Description=WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [wpctrl95] Number=13708 Confirmed=N Filename=wpctrl95.exe Description=WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [WPCUMI] Number=13709 Confirmed=Y Filename=WpcUmi.exe Description=Windows Vista Parental Control Notifications from Microsoft Corporation Source=Paul Collins Startup list [WPCycle.exe] Number=13710 Confirmed=Y Filename=WpCycleWin.exe Description=Added when selecting Mplayer2 to open media files. Forces other codes to Wait for Previous instructions to end, preventing instability of your CPU (freezing) Source=Paul Collins Startup list [wpds.exe] Number=13711 Confirmed=X Filename=doriot.exe Description=Added by the SMALL-KY TROJAN! Source=Paul Collins Startup list [wpds.exe] Number=13712 Confirmed=X Filename=wwnrot.exe Description=Added by the BAGLEDI-D TROJAN! Source=Paul Collins Startup list [wpwmgrs] Number=13713 Confirmed=X Filename=wpwmgrs.exe Description=Added by the MYTOB-DH WORM! Source=Paul Collins Startup list [WQK] Number=13714 Confirmed=X Filename=WQK.exe Description=Added by the KLEZ.H WORM! Source=Paul Collins Startup list [wr] Number=13715 Confirmed=? Filename=WR.EXE Description=?? Source=Paul Collins Startup list [WR Command] Number=13716 Confirmed=? Filename=wr.exe Description=?? Source=Paul Collins Startup list [WrCtrl] Number=13717 Confirmed=N Filename=WrCtrl.exe Description=Win-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not work, but you can manually start/stop the service with a shortcut the program installs at any time Source=Paul Collins Startup list [WRDialer] Number=13718 Confirmed=X Filename=WrDialer.exe Description=WinPoet DSL dialler Source=Paul Collins Startup list [WRECK GUARD] Number=13719 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [WregBios] Number=13720 Confirmed=? Filename=wregbios.exe Description=Desktop Management BIOS (DMI BIOS) related. Apparently invokes the DosBios.exe file. Is it required? Source=Paul Collins Startup list [wrexec] Number=13721 Confirmed=U Filename=wrexec.exe Description=Watch Right - monitoring program, part of the PowerTools add-on for AOL. Records instant messages, E-mail, chat. Watch Right appears to be, and functions as an online clock updater which connects with the U.S. National Institute of Standards and Technology. It was designed for parents who wish to keep an eye on what their children are doing online Source=Paul Collins Startup list [wriste] Number=13722 Confirmed=? Filename=wriste.exe Description=?? Source=Paul Collins Startup list [Write DVD-R!] Number=13723 Confirmed=U Filename=saimon.exe Description=Saimon's WriteDVD! "gives total support for DVD-RAM drives. It provides many functions such as setting partitions on DVD-RAM disks and FixDVD! can diagnose and repair UDF formatted disks" Source=Paul Collins Startup list [ws2 32] Number=13724 Confirmed=X Filename=svchst.exe Description=Added by the VOKEN-A TROJAN! Source=Paul Collins Startup list [ws2help] Number=13725 Confirmed=X Filename=ws2help.exe Description=Added by a variant of the SMALL.AN TROJAN! Source=Paul Collins Startup list [WSAConfiguration] Number=13726 Confirmed=X Filename=wmon32.exe Description=Added by the GAOBOT.BAJ WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13727 Confirmed=X Filename=svchostt.exe Description=Added by the AGOBOT.ZT WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13728 Confirmed=X Filename=rpcxmn32.exe Description=Added by the AGOBOT.ABG WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13729 Confirmed=X Filename=win32upd.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13730 Confirmed=X Filename=drrss.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13731 Confirmed=X Filename=winlogon32.exe Description=Added by the AGOBOT-WC WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13732 Confirmed=X Filename=ntguard32.exe Description=Added by a variant of the AGOBOT/GAOBOT WORM! Source=Paul Collins Startup list [WSAConfiguration] Number=13733 Confirmed=X Filename=csrsvcs.exe Description=Added by the AGOBOT.VI WORM! Source=Paul Collins Startup list [WSAConfiguration1] Number=13734 Confirmed=X Filename=csass.exe Description=Added by the AGOBOT.WH WORM! Source=Paul Collins Startup list [wsass32] Number=13735 Confirmed=X Filename=wsass32.exe Description=Added by the BANKEM-V TROJAN! Source=Paul Collins Startup list [wsbklite] Number=13736 Confirmed=? Filename=wsbklite.exe Description=Related to the Acer Soft Button on Acer Tablet PCs. Appears to do nothing so is it required? Source=Paul Collins Startup list [WScheduler] Number=13737 Confirmed=U Filename=WScheduler.exe Description=Windows Scheduler - "schedule unattended running of applications, batch files, scripts and much more. Also, you can schedule popup reminders so you'll never forget reminders, tasks and other events." Source=Paul Collins Startup list [wscntfys] Number=13738 Confirmed=X Filename=wsscntfy.exe Description=Added by the SDBOT-TN WORM! Source=Paul Collins Startup list [wscript.exe] Number=13739 Confirmed=X Filename=vabian.vbs Description=Added by the VABI VIRUS! Source=Paul Collins Startup list [wscsvc.exe] Number=13740 Confirmed=X Filename=wscsvc.exe Description=Added by a password stealing BANKER TROJAN! Source=Paul Collins Startup list [Wsdata service] Number=13741 Confirmed=X Filename=WSconf.exe Description=Added by the SDBOT.ZU WORM! Source=Paul Collins Startup list [wserv] Number=13742 Confirmed=X Filename=wserv.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [wserver] Number=13743 Confirmed=X Filename=wserver.exe Description=Added by the NETSKY.AC or SASSER.G WORMS! Source=Paul Collins Startup list [WService] Number=13744 Confirmed=U Filename=WService.exe Description=Tablet client Driver for UC-Logic Pen/Graphics Tablet Source=Paul Collins Startup list [wsg32] Number=13745 Confirmed=U Filename=wsg32.exe Description=GoldenKeylog keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [wskrnl] Number=13746 Confirmed=U Filename=wskrnl.exe Description=ActMon surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [wsock32] Number=13747 Confirmed=X Filename=svchost.exe Description=Added by the HORST-A WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [wsrv32] Number=13748 Confirmed=X Filename=wsrv32.exe Description=Added by a CLICKER TROJAN! Identified by Kaspersky antivirus as Win32.Agent.ep Source=Paul Collins Startup list [WSSAConfiguration] Number=13749 Confirmed=X Filename=wmmon32.exe Description=Added by the AGOBOT-KC WORM! Source=Paul Collins Startup list [wssys] Number=13750 Confirmed=U Filename=wssys.exe Description=WebPI logs keystrokes and captures screenshots. If you didn't install this yourself remove it Source=Paul Collins Startup list [Wstat32 driver] Number=13751 Confirmed=X Filename=Wstat32.exe Description=Added by the LOONBOT TROJAN! Source=Paul Collins Startup list [wstimeb] Number=13752 Confirmed=Y Filename=wstimeb.exe Description=Used with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it Source=Paul Collins Startup list [wsttrs] Number=13753 Confirmed=X Filename=wsttrs.exe Description=Added by the LDPINCH-QS TROJAN! Source=Paul Collins Startup list [wsvbs] Number=13754 Confirmed=X Filename=wsvbs.exe Description=Added by the PWS-AEB TROJAN! Source=Paul Collins Startup list [WSVCS] Number=13755 Confirmed=U Filename=SERVICES.EXE Description=WSLogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [wswpd] Number=13756 Confirmed=Y Filename=wswpd.exe Description=Used with some models of Panasonic, Epson and NEC printers. Some older drivers known to have a "memory leak". Needed for printing to work Source=Paul Collins Startup list [wsys.exe] Number=13757 Confirmed=U Filename=wsys.exe Description=SpyloPCMonitor is a surviellance software program that monitors user activity, logs keystrokes, and takes screenshots. It ends the processes of anti-spyware programs. If you didn't install this yourself remove it Source=Paul Collins Startup list [ws_d] Number=13758 Confirmed=X Filename=ws32.exe Description=Added by the LEGMIR-RL TROJAN! Source=Paul Collins Startup list [WT Game Channel] Number=13759 Confirmed=N Filename=GameChannel.exe Description=WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [WT Game Channel] Number=13760 Confirmed=N Filename=wtgamechannel.exe Description=WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [WT GameChannel] Number=13761 Confirmed=N Filename=GameChannel.exe Description=WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [WT GameChannel] Number=13762 Confirmed=N Filename=wtgamechannel.exe Description=WildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [WTF Test] Number=13763 Confirmed=X Filename=wtftest.exe Description=Added by the RBOT-ACM WORM! Source=Paul Collins Startup list [WTIndicator] Number=13764 Confirmed=U Filename=SchedInd.exe Description=WinTask - software that automates a variety of routine tasks quickly and simply Source=Paul Collins Startup list [WTSI] Number=13765 Confirmed=X Filename=wapisvit.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WTSS] Number=13766 Confirmed=X Filename=wap***.exe [* = random char] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WTST] Number=13767 Confirmed=X Filename=wapisvtr.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WU713STA.EXE] Number=13768 Confirmed=Y Filename=WU713STA.EXE Description=Blitzz Technology wireless NIC adapter driver Source=Paul Collins Startup list [wuanguard] Number=13769 Confirmed=X Filename=wuanguard32.exe Description=Added by the RBOT-AAF WORM! Source=Paul Collins Startup list [WUOLService] Number=13770 Confirmed=Y Filename=WUOLService9x.exe Description=Remote wakeup status agent. Part of Novell's ZenWorks. Processes Wake-up on LAN requests (turn on a computer remotely on LAN) Source=Paul Collins Startup list [wuosdial] Number=13771 Confirmed=X Filename=wuosdial.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [WUPD] Number=13772 Confirmed=X Filename=iglmtray.exe Description=Added by the TZET WORM! Source=Paul Collins Startup list [wupd] Number=13773 Confirmed=X Filename=symcsvc.exe Description=Added by the ABWIZ.C TROJAN! Source=Paul Collins Startup list [wupd] Number=13774 Confirmed=X Filename=win32.exe Description=Added by the ORSE-C TROJAN! Source=Paul Collins Startup list [wupdate] Number=13775 Confirmed=X Filename=wisvccz.exe Description=Added by the ORSE-B TROJAN! Source=Paul Collins Startup list [wupdate] Number=13776 Confirmed=X Filename=wi32.exe Description=Downloader trojan, detected by Panda antivirus as Adware/Trustbid Source=Paul Collins Startup list [WUpdate] Number=13777 Confirmed=X Filename=1037v.exe Description=Added by the CLAGGER-AR TROJAN! Source=Paul Collins Startup list [Wupdate driver] Number=13778 Confirmed=X Filename=[various filenames] Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [WUpdates] Number=13779 Confirmed=X Filename=WUpdates.exe Description=Added by the SWEPDAT TROJAN! Source=Paul Collins Startup list [Wupdm32] Number=13780 Confirmed=X Filename=Wupdm32.exe Description=Added by the MIDLAK WORM! Source=Paul Collins Startup list [wupdmgr32.exe] Number=13781 Confirmed=X Filename=wupdmgr32.exe Description=Added by the CERTIF-I TROJAN! Source=Paul Collins Startup list [wupdt] Number=13782 Confirmed=X Filename=wupdt.exe Description=Added by the IMISERV.A TROJAN! Source=Paul Collins Startup list [WUSB11B.exe] Number=13783 Confirmed=Y Filename=WUSB11B.exe Description=Linksys WUSB11 WLAN USB adapter Source=Paul Collins Startup list [WUSB54Gv2] Number=13784 Confirmed=Y Filename=InvokeSvc3.exe Description=Wireless-G USB Wireless Network Adapter related - would appear to be required Source=Paul Collins Startup list [WUSB54Gv4] Number=13785 Confirmed=Y Filename=WUSB54Gv4.exe Description=Wireless-G USB Wireless Network Adapter related - would appear to be required Source=Paul Collins Startup list [wuviewer] Number=13786 Confirmed=X Filename=wuviewer.exe Description=Added by a Proxy Trojan variant Source=Paul Collins Startup list [WUx_RegSvr] Number=13787 Confirmed=? Filename=RegSvr32.exe Description=x is any number?? Source=Paul Collins Startup list [WWKS] Number=13788 Confirmed=X Filename=wsass.exe Description=Added by the SDBOT-BT WORM! Source=Paul Collins Startup list [www.hidro.4t.com] Number=13789 Confirmed=X Filename=enbiei.exe Description=Added by the BLASTER.F WORM! Source=Paul Collins Startup list [www.symantec.com] Number=13790 Confirmed=X Filename=oz11111.exe Description=Added by the MYDOOM.W WORM Source=Paul Collins Startup list [WXcmeinst] Number=13791 Confirmed=X Filename=[path to file] Description=Added by the RANCK-CD TROJAN! Source=Paul Collins Startup list [Wxp4] Number=13792 Confirmed=X Filename=Norton Update.exe Description=Added by the ERKEZ.D WORM! Source=Paul Collins Startup list [WXProcMgr Module] Number=13793 Confirmed=N Filename=WXprocMgr.exe Description=TVTonic from Wavexpress - "enjoy 3 full-screen, DVD-quality video channels for FREE". Allows data content to be downloaded and synchronized on your system Source=Paul Collins Startup list [WZCBDLService] Number=13794 Confirmed=U Filename=WZCBDL9X.exe Description=WZCBDLService Launcher from D-Link - configuration/drivers Source=Paul Collins Startup list [wzdmg] Number=13795 Confirmed=X Filename=wzdmg.exe Description=Added by a generic downloader TROJAN - see here Source=Paul Collins Startup list [wzhelper] Number=13796 Confirmed=X Filename=wzhelper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [wzservice] Number=13797 Confirmed=X Filename=hess.exe Description=Added by the HACKARMY.W TROJAN! Source=Paul Collins Startup list [X Server] Number=13798 Confirmed=U Filename=X.exe Description="XoftWare for Windows" enables you to run network-based UNIX programs ("X programs" or "clients") side-by-side with Windows applications on your personal computer. You can also share programs and computing resources with host computers connected to your PC over a network Source=Paul Collins Startup list [X-Cleaner Deluxe] Number=13799 Confirmed=U Filename=xcleaner.exe Description=X-Cleaner Deluxe - privacy and anti-spy application Source=Paul Collins Startup list [X-Cleaner Freeware] Number=13800 Confirmed=U Filename=XCLEAN~1.EXE Description=X-Cleaner Freeware - "cookie cleaning, Internet cache cleaning, scans for many popular spy software packages and performs permanent file shredding" Source=Paul Collins Startup list [X-Grabber] Number=13801 Confirmed=N Filename=sswizard.exe Description=ScreenShot Wizard Source=Paul Collins Startup list [X1] Number=13802 Confirmed=U Filename=X1.exe Description=Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine Source=Paul Collins Startup list [X1 System Tray] Number=13803 Confirmed=U Filename=X1Systray.exe Description=Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine Source=Paul Collins Startup list [X10 Device Network Service] Number=13804 Confirmed=U Filename=x10nets.exe Description=Belongs to X10 video streaming device(s) Source=Paul Collins Startup list [X10Weax] Number=13805 Confirmed=X Filename=WTHRTRAY.EXE Description=WeatherCheck - "bring the latest local weather to your desktop". Not recommended as it reportedly pops ads, and contains no uninstaller Source=Paul Collins Startup list [X1FileMonitor.exe] Number=13806 Confirmed=U Filename=X1FileMonitor.exe Description=Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine Source=Paul Collins Startup list [x3watch] Number=13807 Confirmed=U Filename=x3watch.exe Description="program helping with online integrity. Whenever you browse the internet and accesses a site which may contain questionable material, the program will save the site name on your computer. Approximately every 30 days, a person of your choice (an accountabiltiy partner) will receive an e-mail containing all possible questionable sites you may have visited within the month. This information is meant to encourage an open and honest conversation between friends and help us all be more accountable" Source=Paul Collins Startup list [x3yy] Number=13808 Confirmed=X Filename=[path to trojan] Description=Added by the TANNICK TROJAN! Source=Paul Collins Startup list [Xanadu] Number=13809 Confirmed=N Filename=Xanadu.exe Description=Xanadu - free language and translation wizard from Foreignword Source=Paul Collins Startup list [xBrotherMeCom] Number=13810 Confirmed=? Filename=BrMeCom.exe Description=Related to Brother MFC-9200c printer. What does it do and is it required? Source=Paul Collins Startup list [xbtl] Number=13811 Confirmed=U Filename=bootldr.exe Description=Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [Xcpy1] Number=13812 Confirmed=X Filename=Xcpy1.exe Description=BroadcastPC adware variant Source=Paul Collins Startup list [xdxqa] Number=13813 Confirmed=X Filename=dewa.exe Description=Added by the SDBOT-YB WORM! Source=Paul Collins Startup list [XE 8x LM Status] Number=13814 Confirmed=U Filename=lmsxxe.exe Description=Xerox XE8 series laser printer status monitor Source=Paul Collins Startup list [Xecuter.bat] Number=13815 Confirmed=X Filename=psexec.bat Description=Added by the BOOHOO WORM! Source=Paul Collins Startup list [XemiCo] Number=13816 Confirmed=U Filename=ADC.EXE Description=XemiComputers Active Desktop Calendar Source=Paul Collins Startup list [XeroxScannerDaemon] Number=13817 Confirmed=U Filename=XrxFTPLt.exe Description=Xerox Scanner Daemon - driver for Xerox Scanner model fu621d Source=Paul Collins Startup list [XFILTER] Number=13818 Confirmed=Y Filename=xfilter.exe Description=Filseclab Personal Firewall Professional Edition Source=Paul Collins Startup list [Xfire] Number=13819 Confirmed=N Filename=Xfire.exe Description=Terratec DMXFire 1024 soundcard control panel Source=Paul Collins Startup list [xflash] Number=13820 Confirmed=X Filename=xflash.exe Description=Added by the BANCJ-A TROJAN! Source=Paul Collins Startup list [xftpGraber] Number=13821 Confirmed=X Filename=Xftpgraber.exe Description=Added by the ENVID.C WORM! Source=Paul Collins Startup list [XGIWatchDog] Number=13822 Confirmed=? Filename=XWatDog.exe Description=Related to XGI Technology's Volari graphics cards - what does it do and is it required? Source=Paul Collins Startup list [xhi] Number=13823 Confirmed=X Filename=xhi.exe Description=Added by the SCLOG-A TROJAN! Source=Paul Collins Startup list [xhrmy] Number=13824 Confirmed=X Filename=Xhrmy.exe Description=HyperLinker adware Source=Paul Collins Startup list [xicon] Number=13825 Confirmed=? Filename=xicon.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [XiD] Number=13826 Confirmed=X Filename=mmx.exe Description=Added by the ANALOGX TROJAN! Source=Paul Collins Startup list [XircWinModem4] Number=13827 Confirmed=Y Filename=ltcm000c.exe Description=WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [xitami] Number=13828 Confirmed=U Filename=Xiwin32.exe Description=Xitami Multiplatform Open Source web server Source=Paul Collins Startup list [xkstartup] Number=13829 Confirmed=? Filename=RunDll32 InstZ82.dll, SetUsbPrinterPort Description=On a system with a Lexmark printer Source=Paul Collins Startup list [xload32] Number=13830 Confirmed=X Filename=netdd.exe Description=Added by the NETSPY TROJAN! Source=Paul Collins Startup list [xloadnet] Number=13831 Confirmed=X Filename=xloadnet.exe Description=Added by the VB.NCK TROJAN! Source=Paul Collins Startup list [XML Service] Number=13832 Confirmed=X Filename=msxml.exe Description=Added by the RBOT-HD WORM! Source=Paul Collins Startup list [XNSearchAssistant] Number=13833 Confirmed=X Filename=SrchAsst.exe Description=iWon Search Assistant - spyware Source=Paul Collins Startup list [XoftSpy] Number=13834 Confirmed=U Filename=XoftSpy.exe Description=XoftSpy antispyware software Source=Paul Collins Startup list [xor] Number=13835 Confirmed=X Filename=svchost.exe Description=Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in a "xor" subfolder Source=Paul Collins Startup list [xor] Number=13836 Confirmed=X Filename=svshost.exe Description=Added by the AGENT.DC TROJAN! Source=Paul Collins Startup list [Xordate] Number=13837 Confirmed=X Filename=wuauclt10.exe Description=Added by the RBOT-GKN WORM! Source=Paul Collins Startup list [Xordate] Number=13838 Confirmed=X Filename=wuauclt11.exe Description=Added by the RBOT-GLI WORM! Source=Paul Collins Startup list [Xordate] Number=13839 Confirmed=X Filename=wuauclt12.exe Description=Added by the RBOT-GLQ WORM! Source=Paul Collins Startup list [Xordate] Number=13840 Confirmed=X Filename=wuauclt13.exe Description=Added by the RBOT-GLM WORM! Source=Paul Collins Startup list [xp] Number=13841 Confirmed=X Filename=winis.exe Description=Added by the RBOT-WO WORM! Source=Paul Collins Startup list [Xp] Number=13842 Confirmed=X Filename=p2pnetworking.exe Description=Added by the SDBOT.XA WORM! Source=Paul Collins Startup list [xp service pack 2] Number=13843 Confirmed=X Filename=xpsp2.exe Description=Added by the RBOT-KW WORM! Source=Paul Collins Startup list [XP Tools] Number=13844 Confirmed=U Filename=xptools.exe Description=XPTools - "integrated suite of powerful PC Utilities to fix, speed up, maintain and protect your computer" Source=Paul Collins Startup list [xp32win] Number=13845 Confirmed=X Filename=xpupdater02.exe Description=Added by the MOSUCK-A TROJAN! Source=Paul Collins Startup list [Xpagent] Number=13846 Confirmed=? Filename=xpagent.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [XPAgent] Number=13847 Confirmed=X Filename=XPAgent.exe Description=Reported as the CLICKER.LE TROJAN by Panda Anti-Virus. Do not confuse this with the IBM/XPoint Rapid Restore file which is generally located in the PROGRAM FILES\XPOINT\AGENT folder Source=Paul Collins Startup list [xpcfg] Number=13848 Confirmed=? Filename=xpcfg.exe Description=?? Source=Paul Collins Startup list [Xpclient] Number=13849 Confirmed=? Filename=xpclient.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [XPCPHOST Settings] Number=13850 Confirmed=X Filename=xpcphost.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [xpiupdate] Number=13851 Confirmed=X Filename=xpiupdate.exe Description=Added by the RBOT-AAB WORM! Source=Paul Collins Startup list [xPlanetControl] Number=13852 Confirmed=U Filename=xPlanetControl.exe Description=Tool that displays a globe with current day/night zones and clouds on users desktop. Source=Paul Collins Startup list [XPSoft] Number=13853 Confirmed=X Filename=CVDAsDW.exe Description=Added by the SDBOT-SY WORM! Source=Paul Collins Startup list [XPSP2 Firewall] Number=13854 Confirmed=X Filename=xpsp2fw.exe Description=Added by the SMALL-RN TROJAN! Source=Paul Collins Startup list [xpstart] Number=13855 Confirmed=X Filename=wini.exe Description=Added by the PICRATE.A WORM! Source=Paul Collins Startup list [xpstat] Number=13856 Confirmed=X Filename=winlogins.exe Description=Added by the RBOT-AAR WORM! Source=Paul Collins Startup list [XPsys] Number=13857 Confirmed=X Filename=XPsys.exe Description=Added by the DELF-KQ TROJAN! Source=Paul Collins Startup list [xpsystem] Number=13858 Confirmed=X Filename=y.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Xpsystem] Number=13859 Confirmed=X Filename=SERVICES.EXE Description=Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "SERVICES" subfolder Source=Paul Collins Startup list [xpsystem] Number=13860 Confirmed=X Filename=services.exe Description=CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [xpsystem] Number=13861 Confirmed=X Filename=MSXMIDI.EXE Description=CoolWebSearch parasite variant, identified by Kaspersky antivirus as TrojanDropper.Win32.Small.cw Source=Paul Collins Startup list [xpupdate] Number=13862 Confirmed=X Filename=updates.exe Description=Added by the BROPIA.L WORM! Source=Paul Collins Startup list [xp_system] Number=13863 Confirmed=X Filename=[filename] Description=Added by the BOOKMARKER.J TROJAN! This file is located in a Windows\inet20004 or Winnt\inet20004 folder Source=Paul Collins Startup list [xp_system] Number=13864 Confirmed=X Filename=winlogon.exe Description=Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe, which should not figure in Msconfig/Startup! Source=Paul Collins Startup list [xp_system] Number=13865 Confirmed=X Filename=services.exe Description=Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! The file is located in a "inet*****" subfolder of the Windows or Winnt folder - where ***** varies dependent upon the variant, examples are 20088, 20001, 10066 Source=Paul Collins Startup list [XSC SIP Client] Number=13866 Confirmed=U Filename=X-Lite.exe Description="CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download". For VOIP and broadband users Source=Paul Collins Startup list [xserv] Number=13867 Confirmed=X Filename=[path to trojan] Description=Added by the STUMPY-A TROJAN! Source=Paul Collins Startup list [XStop95] Number=13868 Confirmed=U Filename=XStop95.exe Description=XStop - internet filter Source=Paul Collins Startup list [xswin] Number=13869 Confirmed=N Filename=xswin.exe Description=Installed with a Xerox Work Centre Pro 555. Unchecking it removes an "out of system memory" error Source=Paul Collins Startup list [XTCsgloader] Number=13870 Confirmed=? Filename=XTCsgloader.exe Description=Another Xupiter toolbar variant?? Source=Paul Collins Startup list [XTN Service Drivers] Number=13871 Confirmed=X Filename=winxtn.exe Description=Added by the SDBOT-YK WORM! Source=Paul Collins Startup list [XTNDConnect PC - 3CmPlm] Number=13872 Confirmed=U Filename=Autodet.exe Description=Component of EasySync Pro. Synchronisation between Palm PDAs and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - ErPhn2] Number=13873 Confirmed=U Filename=ErPhn2.exe Description=Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - ErTray] Number=13874 Confirmed=U Filename=ErTray.exe Description=Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - LtNts4] Number=13875 Confirmed=U Filename=NtsAgnt.exe Description=Component of EasySync Pro Source=Paul Collins Startup list [Xtray] Number=13876 Confirmed=X Filename=xtray_link.exe Description=Added by the VB.JL TROJAN! Source=Paul Collins Startup list [XtreamLok License Manager] Number=13877 Confirmed=U Filename=xl.exe Description=License manager for xLok (XtreamLok) - prevents software being reverse engineered Source=Paul Collins Startup list [Xtrem parental control] Number=13878 Confirmed=U Filename=pcx.exe Description=ParentXtreme is a surviellance software program that monitors user activity, logs keystrokes, and takes screenshots. It ends the processes of anti-spyware programs. If you didn't install this yourself remove it Source=Paul Collins Startup list [XTServiceUpdate] Number=13879 Confirmed=X Filename=XTServiceUpdate.exe Description=hahame.net adware downloader Source=Paul Collins Startup list [XtTb.exe] Number=13880 Confirmed=X Filename=XtTb.exe Description=Top-banners.com adware Source=Paul Collins Startup list [xuio.exe] Number=13881 Confirmed=? Filename=xuio.exe Description=?? Source=Paul Collins Startup list [Xupiter Startup] Number=13882 Confirmed=X Filename=XupiterStartup.exe Description=Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [XupiterCfgLoader] Number=13883 Confirmed=X Filename=XTCfgLoader.exe Description=Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [XupiterCfgLoader] Number=13884 Confirmed=X Filename=BWCfgLoader.exe Description=Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [xupiterstartup2003] Number=13885 Confirmed=X Filename=xupiterstartup2003.exe Description=Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [XupiterToolbarLoader] Number=13886 Confirmed=X Filename=XupiterToolbarLoader.exe Description=Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here Source=Paul Collins Startup list [xv_ctrl] Number=13887 Confirmed=U Filename=v_ctrl.exe Description=3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter" Source=Paul Collins Startup list [xware] Number=13888 Confirmed=X Filename=xware.exe Description=Malware downloader from xxsware.com, causes adult content popups Source=Paul Collins Startup list [xware] Number=13889 Confirmed=X Filename=cskware.exe Description=Malware downloader from xxsware.com, produces adult content popups Source=Paul Collins Startup list [XWMSUSBAPI] Number=13890 Confirmed=? Filename=XWMSAPI.EXE Description=Part of the installation of a Xerox WorkCentre printer/scanner. Is it required? Source=Paul Collins Startup list [xxcm] Number=13891 Confirmed=X Filename=sys.exe Description=Added by the KRISWORM-A WORM! Source=Paul Collins Startup list [xxsrSrv32] Number=13892 Confirmed=X Filename=xxsrsrv.exe Description=Added by the BANCSDE-E TROJAN! Source=Paul Collins Startup list [XXXmpeg] Number=13893 Confirmed=X Filename=XXXmpeg.exe Description=Adult content dialler Source=Paul Collins Startup list [xxxvideo] Number=13894 Confirmed=X Filename=xxxvideo.exe Description=AccessPlugin premium rate adult content dialler Source=Paul Collins Startup list [xy] Number=13895 Confirmed=X Filename=svhost32.exe Description=Added by the DELF.FAI TROJAN! Source=Paul Collins Startup list [x[Number from 1 to 7]] Number=13896 Confirmed=X Filename=x[Number from 1 to 7].exe Description=Added by the DADOBRA-A TROJAN! Source=Paul Collins Startup list [Y!TunnelBasic] Number=13897 Confirmed=U Filename=YTBasic.exe Description=Y!TunnelBasic software provides additional features to Yahoo! Messenger Source=Paul Collins Startup list [Y!TunnelPro] Number=13898 Confirmed=U Filename=YTunnelPro.exe Description=Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia Source=Paul Collins Startup list [Y!TunnelPro] Number=13899 Confirmed=U Filename=YTPro.exe Description=Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia Source=Paul Collins Startup list [Y'z Shadow] Number=13900 Confirmed=U Filename=YzShadow.exe Description=Y'z Shadow 'adds a shadow effect to the windows in pursuit of the "beauty of a shadow". It also allows the user the option of making menus transparent' Source=Paul Collins Startup list [Y'z Toolbar] Number=13901 Confirmed=U Filename=YzToolBar.exe Description=Y'z Toolbar "allows the user to change the toolbar icons in Explorer and Internet Explorer. The user can also create and add their own themes" Source=Paul Collins Startup list [Ya Salam] Number=13902 Confirmed=X Filename=NancyAjram.exe Description=Added by the JALABED WORM! Source=Paul Collins Startup list [yaemu.exe] Number=13903 Confirmed=X Filename=yaemu.exe Description=Added by the WIN32.DNSCHANGER.S TROJAN! Source=Paul Collins Startup list [yahoo groups] Number=13904 Confirmed=X Filename=upgrdmgr.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Yahoo HP Reminder 1.1] Number=13905 Confirmed=? Filename=yr.exe Description=?? Source=Paul Collins Startup list [Yahoo Instant Messengar] Number=13906 Confirmed=X Filename=YahooMsgr.exe Description=Added by the SDBOT.GEN TROJAN! Source=Paul Collins Startup list [Yahoo Messenger] Number=13907 Confirmed=X Filename=Yahoomsg.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Yahoo Messenger] Number=13908 Confirmed=X Filename=YPager.exe Description=Added by the RBOT-QO WORM! Source=Paul Collins Startup list [Yahoo Messenger] Number=13909 Confirmed=X Filename=svchost32.exe Description=Added by the SOHANA-P WORM! Source=Paul Collins Startup list [Yahoo Messengger] Number=13910 Confirmed=X Filename=SVICHHOST.exe Description=Added by the TIOTUA-C TROJAN! Source=Paul Collins Startup list [Yahoo Messengger] Number=13911 Confirmed=X Filename=RVHOST.exe Description=Added by the SILLYFDC-G WORM! Source=Paul Collins Startup list [Yahoo Messengger] Number=13912 Confirmed=X Filename=SSVICHOSST.exe Description=Added by the SOHANA-R WORM! Source=Paul Collins Startup list [Yahoo Update] Number=13913 Confirmed=X Filename=Yahoo!.exe Description=Added by the YAHOO! TROJAN! Source=Paul Collins Startup list [Yahoo Updater] Number=13914 Confirmed=X Filename=Messenger.exe Description=Added by the FORBOT-FE WORM! Source=Paul Collins Startup list [Yahoo! Pager] Number=13915 Confirmed=N Filename=ypager.exe Description=Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs Source=Paul Collins Startup list [Yahoo! Pager] Number=13916 Confirmed=N Filename=YAHOOM~1.EXE Description=Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs Source=Paul Collins Startup list [Yahoo2000] Number=13917 Confirmed=X Filename=Anti.exe Description=Added by the RBOT.ATK WORM! Source=Paul Collins Startup list [Yahoo2000] Number=13918 Confirmed=X Filename=Anti.exe Description=Added by an unknown Malware, possibly a variant of the RBOT-RAM WORM! Source=Paul Collins Startup list [YahooStock] Number=13919 Confirmed=X Filename=Prmvr.exe Description=Adtomi adware Source=Paul Collins Startup list [YahooStock] Number=13920 Confirmed=X Filename=ystckAO32.exe Description=Adtomi adware Source=Paul Collins Startup list [yahoo_toolbar lptt01] Number=13921 Confirmed=X Filename=yahoo_toolbar.exe Description=RapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [yahoo_toolbar ml097e] Number=13922 Confirmed=X Filename=yahoo_toolbar.exe Description=RapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here Source=Paul Collins Startup list [YAMAHA AC-XG Power Utility] Number=13923 Confirmed=? Filename=yacpower.exe Description=YAMAHA AC-XG Power Utility. What does it do and is it required? Source=Paul Collins Startup list [YAMAHA DS-XG Launcher] Number=13924 Confirmed=N Filename=dslaunch.exe Description=System Tray access for the features of the Yamaha DS-XG soundcard unless you regularly change set-ups Source=Paul Collins Startup list [Yankee Clipper III] Number=13925 Confirmed=N Filename=YankClip.exe Description=Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures, Richtext, URLS, etc - any size. Features printing, drag and drop, optional permanent storage of clippings. Familiar "Outlook" interface'. Freeware Source=Paul Collins Startup list [YBrowser] Number=13926 Confirmed=N Filename=ybrwicon.exe Description=SBC Yahoo! Browser system tray icon Source=Paul Collins Startup list [YCentral] Number=13927 Confirmed=U Filename=YahooCentral.exe Description=Yahoo! Central - "alerts you if your default home page, search, or email is changed or if updates are available for your Yahoo! software. You can manage your default Internet settings and get updates to your software from Yahoo!" Source=Paul Collins Startup list [yeahdude.exe] Number=13928 Confirmed=X Filename=hallowelt.exe Description=Added by the GAOBOT.RS or GAOBOT.SA WORMS! Source=Paul Collins Startup list [yemarvd] Number=13929 Confirmed=X Filename=sysmon.exe Description=Added by the AGENT-CH TROJAN! Source=Paul Collins Startup list [YeppStudioAgent] Number=13930 Confirmed=N Filename=SamsungMediaStudioAgent.exe Description=Samsung Media Studio MP3 player file management software - see here for an example Source=Paul Collins Startup list [YhooUapdates] Number=13931 Confirmed=X Filename=ymssmsgs.exe Description=Added by a variant of the SMALL_K TROJAN! Source=Paul Collins Startup list [YhooUpdates] Number=13932 Confirmed=X Filename=ymsmsgs.exe Description=Added by the SMALL_K TROJAN! Source=Paul Collins Startup list [ying] Number=13933 Confirmed=X Filename=ying.exe Description=Constructor VC2000 malware Source=Paul Collins Startup list [ymetray] Number=13934 Confirmed=N Filename=ymetray.exe Description=Yahoo! Music system tray icon Source=Paul Collins Startup list [YOP] Number=13935 Confirmed=N Filename=yop.exe Description=Dashboard Module for SBC Yahoo! Online Protection Source=Paul Collins Startup list [You've Got Pictures Screensaver] Number=13936 Confirmed=U Filename=ygpsstra.exe Description=AOL You've Got Pictures Screensaver Source=Paul Collins Startup list [YOW tuner] Number=13937 Confirmed=? Filename=WatchPNM.exe Description=?? Source=Paul Collins Startup list [ypager] Number=13938 Confirmed=N Filename=ypager.exe Description=Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs Source=Paul Collins Startup list [YPC] Number=13939 Confirmed=U Filename=ypc.exe Description=Yahoo Parental controls - "Let you decide what type of sites and Yahoo! services your kids can access" Source=Paul Collins Startup list [YPOPs] Number=13940 Confirmed=U Filename=YPOPs.exe Description=YPOPs! - an application that provides POP3 access to Yahoo! Mail. Yahoo! Mail disabled free access to its POP3 service in 2002. This application emulates a POP3 server and enables popular email clients like Outlook, Netscape, Eudora, Mozilla, etc., to download email from Yahoo! account Source=Paul Collins Startup list [YTrayMagic Lite 1] Number=13941 Confirmed=Y Filename=YTRAYMAGIC.EXE Description=YTrayMagic from YoconSoft automatically restores your tray icons after an Explorer(the windows shell) crash. Leave to run at startup since only those icons that are in the taskbar after YTrayMagic has initialized will be restored Source=Paul Collins Startup list [Yumgo's Homepage Protector V1] Number=13942 Confirmed=U Filename=YumgoHomepageProtector.exe Description=Yumgo's Homepage Protector Source=Paul Collins Startup list [ywwvc.exe] Number=13943 Confirmed=X Filename=ywwvc.exe Description=Added by the STARTPA-HR TROJAN! Source=Paul Collins Startup list [ywzizdon] Number=13944 Confirmed=X Filename=ywzizdon.exe Description=Free_Scratch_Cards foistware Source=Paul Collins Startup list [yx] Number=13945 Confirmed=X Filename=uu.exe Description=Added by the AGOBOT-YX WORM! Source=Paul Collins Startup list [yyyyyyyy] Number=13946 Confirmed=X Filename=[path to trojan] Description=Added by the MUMUBOY.B TROJAN! Source=Paul Collins Startup list [yz.exe] Number=13947 Confirmed=X Filename=yz.exe Description=Added by the VARDO TROJAN! Source=Paul Collins Startup list [YZH] Number=13948 Confirmed=X Filename=YZH.exe Description=Added by the LEGMIR-BM VIRUS! Source=Paul Collins Startup list [YZH.SYS] Number=13949 Confirmed=X Filename=YZH.exe Description=Added by the PHILIS.C VIRUS! Source=Paul Collins Startup list [Z] Number=13950 Confirmed=X Filename=zmon.exe Description=Added by the DELBOT-AO WORM! Source=Paul Collins Startup list [z-WrDialer] Number=13951 Confirmed=U Filename=WrDialer.exe Description=WinPoet DSL dialer Source=Paul Collins Startup list [ZaCker] Number=13952 Confirmed=X Filename=[filename].PIF Description=Added by the HOLAR.A WORM! Source=Paul Collins Startup list [Zacker] Number=13953 Confirmed=X Filename=Zacker.exe Description=Added by the GEMEL WORM! Source=Paul Collins Startup list [zango] Number=13954 Confirmed=X Filename=zango.exe Description=NCase adware Source=Paul Collins Startup list [Zango SiteFinder] Number=13955 Confirmed=X Filename=ZangoSiteFinder.exe Description=180Solutions ZangoSearch adware variant Source=Paul Collins Startup list [Zango TvTimes] Number=13956 Confirmed=X Filename=ZANGOT~1.EXE Description=ZangoSearch adware Source=Paul Collins Startup list [zanu] Number=13957 Confirmed=X Filename=zanu.exe Description=NCase adware Source=Paul Collins Startup list [Zapro] Number=13958 Confirmed=Y Filename=Zapro.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [zBrowser Launcher] Number=13959 Confirmed=U Filename=iTouch.exe Description=For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Also used to display your keyboard LEDs on-screen to indicate Caps Lock, etc if it doesn't have them Source=Paul Collins Startup list [zBrowser Launcher] Number=13960 Confirmed=U Filename=Commandr.exe Description=For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Also used to display your keyboard LEDs on-screen to indicate Caps Lock, etc if it doesn't have them Source=Paul Collins Startup list [zcb] Number=13961 Confirmed=? Filename=zcb.exe Description=?? Source=Paul Collins Startup list [Zcfgsvc] Number=13962 Confirmed=U Filename=ZCfgSvc.exe Description=Zero Config MFC Application, part of Intel's ProSET utilities and installed by the drivers for many of Intel wireless network cards - essential to the proper functioning of many of the Intel ProSET utilities (but not all) and these System Tray ProSET utilities are a must if you are using your wireless connection, if only so you know when the signal is fading or dropping. The problem is that, in some PCs, ZCFGSVC can be incredibly badly behaved : taking up to 100% of CPU time and therefore resulting in an extremely slow PC, preventing the installation of software or Windows updates, or causing "Not Responding" or "End this Program" shutdown problems. If you experience this, try first the very latest drivers from Intel or your laptop manufacturer. If that still does not solve the problem and you have WinXP/2003, try setting the "Wireless Zero Configuration" service to disabled Source=Paul Collins Startup list [zcproo] Number=13963 Confirmed=X Filename=qssstiej.exe Description=Possible homepage hijacker installing a toolbar: http://tdko.com/ ,Lop.com in disguise Source=Paul Collins Startup list [ZDConfig] Number=13964 Confirmed=? Filename=ZDConfig.exe Description=Related to various brands of Wireless USB LAN Adapter - what does it do and is it required? Source=Paul Collins Startup list [zdnet] Number=13965 Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [Zebus] Number=13966 Confirmed=N Filename=msdc32.exe Description=Runs a HTML tutorial on the Zebus web-site Source=Paul Collins Startup list [Zekio Startups] Number=13967 Confirmed=X Filename=znksvc32.exe Description=Added by the AGOBOT-AGI WORM! Source=Paul Collins Startup list [Zen.A] Number=13968 Confirmed=X Filename=[path to trojan] Description=Added by the ZOOMEN-A TROJAN! Source=Paul Collins Startup list [Zenet] Number=13969 Confirmed=X Filename=rundll32 CNBabe.dll, DllStartup Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [Zeno] Number=13970 Confirmed=X Filename=*sys****.exe [* = random char/digit] Description=ZenoSearch adware. Note - the most frequent filenames appear to be rsyssx2d.exe, rsyssx2d.exe, rsystu2d.exe and ysysyz2d.exe but there are others Source=Paul Collins Startup list [Zeno] Number=13971 Confirmed=X Filename=*winspez.exe [* = rand letter] Description=ZenoSearch adware Source=Paul Collins Startup list [Zeno] Number=13972 Confirmed=X Filename=nwinrqez.exe Description=Added by the QEXREZ family of TROJANS! Source=Paul Collins Startup list [ZENRC] Number=13973 Confirmed=Y Filename=zenrc32.exe Description=The main component of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Leave well alone Source=Paul Collins Startup list [ZENRC Tray Icon] Number=13974 Confirmed=Y Filename=zentray.exe Description=Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Best left alone Source=Paul Collins Startup list [ZENworks Imaging Service] Number=13975 Confirmed=Y Filename=ZISWin.exe Description=Imaging Agent. Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management" Source=Paul Collins Startup list [Zero PoPup Killer XP] Number=13976 Confirmed=U Filename=zpk_xp.exe Description=Intelligent anti-pop-up software product by Ax-Soft Source=Paul Collins Startup list [ZeroAds] Number=13977 Confirmed=U Filename=0 Description=ZeroAds - culls ads, cookies and pop-ups. Tells ZeroAds not to run at startup - needed to start it manually Source=Paul Collins Startup list [ZeroAds] Number=13978 Confirmed=U Filename=LAS0Ads.exe Description=ZeroAds - culls ads, cookies and pop-ups. Required for the cookie interception to work Source=Paul Collins Startup list [ZeroAds] Number=13979 Confirmed=U Filename=Zeroads.exe Description=ZeroAds - a popular Internet accelerator and anti-adware application Source=Paul Collins Startup list [ZeroSpyware] Number=13980 Confirmed=U Filename=ZeroSpyware.exe Description=FBM Software ZeroSpyware 2004 spyware detector and remover Source=Paul Collins Startup list [zervpack2] Number=13981 Confirmed=X Filename=update2.exe Description=Added by the SDBOT.WD WORM! Source=Paul Collins Startup list [ZGNUBI] Number=13982 Confirmed=? Filename=ZGNUBI.exe Description=?? Source=Paul Collins Startup list [Zi5] Number=13983 Confirmed=X Filename=AntiVirus Update.exe Description=Added by the ERKEZ.G WORM! Source=Paul Collins Startup list [ZIBMACC] Number=13984 Confirmed=U Filename=rundll.exe ZIBMACC.INF Description=ZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Technical Support (USA - 800-887-7435) Source=Paul Collins Startup list [ZincgrubInc] Number=13985 Confirmed=X Filename=Lsass.exe Description=Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "mirc32" folder Source=Paul Collins Startup list [ZingSpooler] Number=13986 Confirmed=U Filename=ZingSpooler.exe Description=Was used for a drag and drop program to upload pictures to www.zing.com but Zing has gone out of business. Now used for Sony ImageStation's upload photos to online albums Source=Paul Collins Startup list [Zinio DLM] Number=13987 Confirmed=N Filename=ZDLM.EXE Description=Zinio - used to read magazines in digital rather than paper format Source=Paul Collins Startup list [Zinio DLM] Number=13988 Confirmed=N Filename=ZinioDeliveryManager.exe Description=Related to Zinio used to read magazines in digital rather than paper format Source=Paul Collins Startup list [Zip Driver Loader] Number=13989 Confirmed=X Filename=ZipLoader32.exe Description=Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Source=Paul Collins Startup list [Zip Driver Loader] Number=13990 Confirmed=X Filename=msload32.exe Description=Added by the OBLIVION TROJAN! This executable is one of the most common but there are more Source=Paul Collins Startup list [ZipDisk Icons] Number=13991 Confirmed=U Filename=IMGICON.EXE Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [ZipGenius Clean] Number=13992 Confirmed=N Filename=zg.exe Description=ZipGenius file compression utility Source=Paul Collins Startup list [ziphelp] Number=13993 Confirmed=X Filename=ziphelp.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [ZipMagic] Number=13994 Confirmed=N Filename=zm32.exe Description=Zip utility by Ontrack. Preloading ZipMagic allows you to access files within a zip archive without unzipping them first Source=Paul Collins Startup list [zlclient] Number=13995 Confirmed=Y Filename=zlclient.exe Description=Firewall program from Zonelabs. Pro version inlcudes other online security options Source=Paul Collins Startup list [ZLH] Number=13996 Confirmed=U Filename=ZLH.EXE Description=System Tray icon for Norman Antivirus Source=Paul Collins Startup list [ZNN] Number=13997 Confirmed=X Filename=znnsvc.exe Description=Added by the SDBOT-DAA WORM! Source=Paul Collins Startup list [Zolero Translator] Number=13998 Confirmed=X Filename=ZoleroTranslator.exe Description=Zolero Translator - added by Clickspring, the makers of Purityscan, products and are bundled with the Outer Info Network Client, or OIN client Source=Paul Collins Startup list [Zonavirus] Number=13999 Confirmed=X Filename=0 Description=Added by the KITRO.D (or ARGEN.A) WORM! Source=Paul Collins Startup list [Zone Alarm] Number=14000 Confirmed=X Filename=vsmon.exe Description=Added by the RBOT.BO WORM! If this was the ZoneAlarm firewall the name column would be TrueVector Source=Paul Collins Startup list [zone alarm security] Number=14001 Confirmed=X Filename=zlclint.exe Description=Added by the NIRBOT WORM! Source=Paul Collins Startup list [Zone Labs Client] Number=14002 Confirmed=Y Filename=zlclient.exe Description=Firewall program from Zonelabs. Pro version inlcudes other online security options Source=Paul Collins Startup list [Zone Labs Client Ex] Number=14003 Confirmed=X Filename=svchost.exe Description=Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder Source=Paul Collins Startup list [Zone system] Number=14004 Confirmed=X Filename=szchost.exe Description=Added by the MULTIDR-AC TROJAN! Source=Paul Collins Startup list [ZoneAlarm] Number=14005 Confirmed=Y Filename=zonealarm.exe Description=Firewall program from Zonelabs - free version Source=Paul Collins Startup list [zonealarm] Number=14006 Confirmed=X Filename=[random filename] Description=Added by an unidentified VIRUS, WORM or TROJAN! The only exception is if you have an older version of the ZoneAlarm firewall running Source=Paul Collins Startup list [Zonealarm] Number=14007 Confirmed=X Filename=Removeme.exe Description=Added by the FORBOT-BG WORM! Source=Paul Collins Startup list [Zonealarm] Number=14008 Confirmed=X Filename=iexplore.exe Description=Added by the FORBOT-CP WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup unless you add it manually! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [ZoneAlarm Plus] Number=14009 Confirmed=Y Filename=zaplus.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [ZoneAlarm Pro] Number=14010 Confirmed=Y Filename=Zapro.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [Zonesoft Cleaner] Number=14011 Confirmed=X Filename=rnsys.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [Zoom] Number=14012 Confirmed=U Filename=zoom.exe Description=Zoom - speeds up Windows startup and manages startup applications Source=Paul Collins Startup list [Zooming] Number=14013 Confirmed=U Filename=ZoomingHook.exe Description=Toshiba Zooming Utility - found on Toshiba laptops and Tablet PCs. It allows users to zoom in (or magnify) text Source=Paul Collins Startup list [ZoomingHook] Number=14014 Confirmed=U Filename=ZoomingHook.exe Description=Toshiba Zooming Utility - found on Toshiba laptops. It allows users to zoom in (or magnify) text Source=Paul Collins Startup list [ZPoint] Number=14015 Confirmed=X Filename=winmuse.exe Description=Added by the VJ TROJAN! Source=Paul Collins Startup list [ZPOINT32] Number=14016 Confirmed=Y Filename=ZPOINT32.exe Description=USB graphics/writing tablet driver Source=Paul Collins Startup list [zSearch] Number=14017 Confirmed=X Filename=Zstb.exe Description=TotalVelocity zSearch parasite Source=Paul Collins Startup list [zSecurity Service] Number=14018 Confirmed=X Filename=szsvc.exe Description=Added by the SDBOT-DAB WORM! Source=Paul Collins Startup list [zsms] Number=14019 Confirmed=X Filename=smss.exe Description=Added by the BANCOS-CK TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [zsmsgs] Number=14020 Confirmed=X Filename=iservice.exe Description=Added by the BANCOS-BU TROJAN! Source=Paul Collins Startup list [zsmss] Number=14021 Confirmed=X Filename=smss.exe Description=Added by the BANCOS-DD TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Source=Paul Collins Startup list [zSPGuard] Number=14022 Confirmed=U Filename=Spguard.exe Description="StartPage Guard (SPG) protects your PC from cyberscam, by detecting and preventing any unauthorized changes to your internet browser's Start and Search pages. It is also capable of removing automatically most of known 'invaders'." Source=Paul Collins Startup list [ZSScheduler] Number=14023 Confirmed=U Filename=zsscheduler.dll Description=ZeroSpyware from FBM Software Source=Paul Collins Startup list [ZStart] Number=14024 Confirmed=X Filename=[various filenames] Description=VX2.Transponder parasite updater/installer related Source=Paul Collins Startup list [Zstart] Number=14025 Confirmed=X Filename=cxdxregt.exe Description=ZenoSearch adware Source=Paul Collins Startup list [ZtgServerSwitch] Number=14026 Confirmed=X Filename=server.vbs Description=ZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spyware Source=Paul Collins Startup list [Zune Launcher] Number=14027 Confirmed=U Filename=ZuneLauncher.exe Description=Only needed if running Microsoft's new Zune software for use with their new Zune music player. Similar to iTunes for the iPod Source=Paul Collins Startup list [Zupdate] Number=14028 Confirmed=X Filename=Zupdate.exe Description=Associated with B3d Projector foistware - see here Source=Paul Collins Startup list [zzb] Number=14029 Confirmed=X Filename=zzb.exe Description=IAGold adware downloader Source=Paul Collins Startup list [zzb] Number=14030 Confirmed=X Filename=zzb.exe Description=IAGold adware downloader Source=Paul Collins Startup list [zzgshp] Number=14031 Confirmed=X Filename=gshp.vbs Description=Homepage hi-jacker that re-defines your IE or Netscape start page Source=Paul Collins Startup list [zztp] Number=14032 Confirmed=X Filename=svchost.exe Description=Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! Source=Paul Collins Startup list [zzz-hpi-boot] Number=14033 Confirmed=? Filename=hpi-boot.exe Description=Associated with HP Photosmart printers Source=Paul Collins Startup list [zzzCamlnSuitelll] Number=14034 Confirmed=? Filename=setup.exe 46*** Description=?? Source=Paul Collins Startup list [zzzhpsetup] Number=14035 Confirmed=? Filename=setup.exe Description=?? Source=Paul Collins Startup list [Z_Start] Number=14036 Confirmed=X Filename=********.exe [* = 8 random chars] Description=ZenoSearch adware. Note - the most frequent filenames appear to be dwdsregt.exe, rkdsregm.exe, psdsregm.exe and ZIFI002.exe but there are others Source=Paul Collins Startup list [[3-4 random letters]] Number=14037 Confirmed=X Filename=nslookup.exe Description=PurityScan/Clickspring adware. Not to be confused with the legitimate nslookup.exe which is found in the System32 folder Source=Paul Collins Startup list [[3-4 random letters]Srv32] Number=14038 Confirmed=X Filename=[path to file] Description=Added by the BANCSADE-A TROJAN! Source=Paul Collins Startup list [[decimal number]] Number=14039 Confirmed=X Filename=[path to worm] Description=Added by the OPOSSUM-A WORM! The decimal number can be anything, eg, 0.12345678 Source=Paul Collins Startup list [[default]] Number=14040 Confirmed=X Filename=DrWatson32.exe Description=Added by the DREMN TROJAN! Source=Paul Collins Startup list [[Entry name]] Number=14041 Confirmed=X Filename=System.exe Description=Added by the NETHIEF-N TROJAN! Source=Paul Collins Startup list [[Ephemeral 2.5] by TreeHugger,] Number=14042 Confirmed=X Filename=[path to worm] Description=Added by the LEMOOR-C WORM! Source=Paul Collins Startup list [[Ephemeral 2.x] by TreeHugger,] Number=14043 Confirmed=X Filename=[path to worm] Description=Added by the LEMOOR.A WORM! where "x" represents 3 or 4 Source=Paul Collins Startup list [[executed file name]] Number=14044 Confirmed=X Filename=App.exe Description=Added by the WAXPOW WORM! Source=Paul Collins Startup list [[executed file name]] Number=14045 Confirmed=X Filename=Regsrv32.com Description=Added by the SOUTHGHOST WORM! Source=Paul Collins Startup list [[filename]] Number=14046 Confirmed=X Filename=svchost.scr Description=Added by the BANKER-CC TROJAN! Source=Paul Collins Startup list [[original filename]] Number=14047 Confirmed=X Filename=svchost.scr Description=Added by the BANCBAN-CX TROJAN! Source=Paul Collins Startup list [[original filename]] Number=14048 Confirmed=X Filename=xphost.scr Description=Added by the BANCBAN-HM TROJAN! Source=Paul Collins Startup list [[random 12 digit number]] Number=14049 Confirmed=X Filename=avifile5.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14050 Confirmed=X Filename=bootvid4.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14051 Confirmed=X Filename=browser8.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14052 Confirmed=X Filename=atitvo32.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14053 Confirmed=X Filename=autodisc.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14054 Confirmed=X Filename=cabview1.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14055 Confirmed=X Filename=advpack1.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14056 Confirmed=X Filename=batmeter.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14057 Confirmed=X Filename=bidispl2.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14058 Confirmed=X Filename=asferror.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14059 Confirmed=X Filename=catsrvps.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14060 Confirmed=X Filename=admparse.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14061 Confirmed=X Filename=audiosrv.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14062 Confirmed=X Filename=bootvid2.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random 12 digit number]] Number=14063 Confirmed=X Filename=cmpbk321.exe Description=Adsrv.com/IeDriver adware variant Source=Paul Collins Startup list [[random characters]] Number=14064 Confirmed=X Filename=securewinload32x.exe Description=Added by the OPTIXP-N TROJAN! Note - this trojan file is found in the System (9x/Me) or System32 (NT/2K/XP) folder. The file system32dir2a.exe will also be found in the same folder and should be deleted Source=Paul Collins Startup list [[random characters]] Number=14065 Confirmed=X Filename=rsbmsc.exe Description=Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN! Source=Paul Collins Startup list [[random filename]] Number=14066 Confirmed=X Filename=slk8x2peu.exe Description=QuickLinks adware Source=Paul Collins Startup list [[random names]] Number=14067 Confirmed=X Filename=eee2.exe Description=MediaMotor adware Source=Paul Collins Startup list [[random name]] Number=14068 Confirmed=X Filename=Svchosts.exe Description=Added by the SDBOT.N TROJAN! Source=Paul Collins Startup list [[random name]] Number=14069 Confirmed=X Filename=wincpu.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [[random name]] Number=14070 Confirmed=X Filename=m?dtc.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14071 Confirmed=X Filename=ping.exe Description=PurityScan/Clickspring adware. Note - do not confuse with the Microsoft utility of the same name as described here Source=Paul Collins Startup list [[random name]] Number=14072 Confirmed=X Filename=CXTPLS_LOADER.EXE Description=AproposMedia adware Source=Paul Collins Startup list [[random name]] Number=14073 Confirmed=X Filename=??plorer.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14074 Confirmed=X Filename=?hkdsk.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14075 Confirmed=X Filename=?hkntfs.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14076 Confirmed=X Filename=l?gonui.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14077 Confirmed=X Filename=m?iexec.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14078 Confirmed=X Filename=r?gsvr32.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14079 Confirmed=X Filename=t?skmgr.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14080 Confirmed=X Filename=w?auboot.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14081 Confirmed=X Filename=w?auclt.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14082 Confirmed=X Filename=w?crtupd.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14083 Confirmed=X Filename=w?wexec.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14084 Confirmed=X Filename=??erinit.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14085 Confirmed=X Filename=d?dplay.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14086 Confirmed=X Filename=n?tepad.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14087 Confirmed=X Filename=??chost.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14088 Confirmed=X Filename=??oolsv.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14089 Confirmed=X Filename=??xplore.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14090 Confirmed=X Filename=r?ndll32.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14091 Confirmed=X Filename=se?vices.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14092 Confirmed=X Filename=w?nlogon.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14093 Confirmed=X Filename=w?nword.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14094 Confirmed=X Filename=??anregw.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14095 Confirmed=X Filename=?ttrib.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14096 Confirmed=X Filename=j?vaw.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14097 Confirmed=X Filename=l?ass.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14098 Confirmed=X Filename=m?config.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14099 Confirmed=X Filename=n?lookup.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14100 Confirmed=X Filename=n?pdb.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14101 Confirmed=X Filename=??ool32.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14102 Confirmed=X Filename=??rss.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14103 Confirmed=X Filename=??rvices.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14104 Confirmed=X Filename=?ti2evxx.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14105 Confirmed=X Filename=chkdsk.exe Description=PurityScan/Clickspring adware. Unlike this file, the legitimate Windows chkdisk.exe will in Windows XP/2K/NT always be located in the Winnt\System32 or Windows\System32 folder, and ought moreover NOT to figure among the startups! Source=Paul Collins Startup list [[random name]] Number=14106 Confirmed=X Filename=d?xplore.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14107 Confirmed=X Filename=dvdplay.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14108 Confirmed=X Filename=spoolsv.exe Description=PurityScan/Clickspring adware. Do not confuse with the legitimate Microsoft Printer Spooler Service (spoolsv.exe) Source=Paul Collins Startup list [[random name]] Number=14109 Confirmed=X Filename=w?aclt.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14110 Confirmed=X Filename=wucrtupd.exe Description=PurityScan/Clickspring adware. Do not confuse with the legitimate Windows Critical Update Notification (wucrtupd.exe) Source=Paul Collins Startup list [[random name]] Number=14111 Confirmed=X Filename=charmapnt.exe Description=Added by the BANCOS-DR TROJAN! Source=Paul Collins Startup list [[random name]] Number=14112 Confirmed=X Filename=n?tdde.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14113 Confirmed=X Filename=r?gedit.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14114 Confirmed=X Filename=r?ndll.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14115 Confirmed=X Filename=scanregw.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14116 Confirmed=X Filename=wuauboot.exe Description=PurityScan/Clickspring adware. Note - do not confuse with the legitimate wuauboot.exe file, which should not figure in Msconfig/Startup! Source=Paul Collins Startup list [[random name]] Number=14117 Confirmed=X Filename=w?nspool.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [[random name]] Number=14118 Confirmed=X Filename=svchost.exe Description=Added by the BANCBAN-JC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "config" subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [[random name]] Number=14119 Confirmed=X Filename=[random name].dll Description=SearchNet adware Source=Paul Collins Startup list [[random name]] Number=14120 Confirmed=X Filename=iexpl0ra.exe Description=Added by the ULPM.BD TROJAN! Source=Paul Collins Startup list [[random name]] Number=14121 Confirmed=X Filename=rundl13a.exe Description=Added by the GAMPASS-L TROJAN! Source=Paul Collins Startup list [[random name]] Number=14122 Confirmed=X Filename=Servere.exe Description=Added by the LEGMIR-AQM TROJAN! Source=Paul Collins Startup list [[random number]] Number=14123 Confirmed=X Filename=explorer.exe Description=Added by the KEYLOG-AN TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one copies it's self under 9 additional file names in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14124 Confirmed=X Filename=_autorun.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14125 Confirmed=X Filename=_cfg.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14126 Confirmed=X Filename=_config.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14127 Confirmed=X Filename=_env.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14128 Confirmed=X Filename=_loader.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14129 Confirmed=X Filename=_login.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14130 Confirmed=X Filename=_setup.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[Randomly chosen existing folder name]] Number=14131 Confirmed=X Filename=_start.exe Description=Added by the ANTINNY-L WORM! Source=Paul Collins Startup list [[random]] Number=14132 Confirmed=X Filename=lsass.scr Description=Added by the BANCBAN-CW TROJAN! Source=Paul Collins Startup list [[random]] Number=14133 Confirmed=X Filename=svchost.scr Description=Added by the BANCBAN-CY TROJAN! Source=Paul Collins Startup list [[trojan filename]] Number=14134 Confirmed=X Filename=Install.exe Description=Added by the BANCBAN-FS TROJAN! Source=Paul Collins Startup list [[trojan name]] Number=14135 Confirmed=X Filename=svchost.exe Description=Added by the BANCBAN-CL TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [[username] config] Number=14136 Confirmed=X Filename=[path to trojan] Description=Added by the MOSUCK-H TROJAN! Source=Paul Collins Startup list [[various filenames]] Number=14137 Confirmed=X Filename=qtsks.exe Description=Added by the WEBDOR.Y TROJAN Source=Paul Collins Startup list [[various names]] Number=14138 Confirmed=X Filename=elf.exe Description=Elf is a hacker program, tied to a trojan server Source=Paul Collins Startup list [[various names]] Number=14139 Confirmed=X Filename=crsrs.exe Description=Added by the FORBOT-AK WORM! Source=Paul Collins Startup list [[various names]] Number=14140 Confirmed=X Filename=Windows32.exe Description=Added by any of a number of WORM or TROJAN variants Source=Paul Collins Startup list [[various names]] Number=14141 Confirmed=X Filename=bling.exe Description=Added by the RBOT-NI WORM! Source=Paul Collins Startup list [[various names]] Number=14142 Confirmed=X Filename=mediaplayer32.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [[various names]] Number=14143 Confirmed=X Filename=winlogon32.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [[various names]] Number=14144 Confirmed=X Filename=svchostss.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [[various names]] Number=14145 Confirmed=X Filename=win32snd.exe Description=Added by the RBOT-DQ WORM! Source=Paul Collins Startup list [[various names]] Number=14146 Confirmed=X Filename=shch.exe Description=Premium rate adult content dialler Source=Paul Collins Startup list [[various names]] Number=14147 Confirmed=X Filename=PasswdMon.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14148 Confirmed=X Filename=runload32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14149 Confirmed=X Filename=dstart2.exe Description=Adware - recognized by Kaspersky antivirus as Trojan-Downloader.Small.alw Source=Paul Collins Startup list [[various names]] Number=14150 Confirmed=X Filename=msdos32.exe Description=Added by a variant of the AGENT.AH TROJAN! Source=Paul Collins Startup list [[various names]] Number=14151 Confirmed=X Filename=sitebar.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [[various names]] Number=14152 Confirmed=X Filename=backorif.exe Description=Added by a NTROOTKIT TROJAN variant! Source=Paul Collins Startup list [[various names]] Number=14153 Confirmed=X Filename=bhoserv.exe Description=Added by a NTROOTKIT TROJAN variant! Source=Paul Collins Startup list [[various names]] Number=14154 Confirmed=X Filename=driver32.exe Description=Added by a variant of the SDBOT WORM! Source=Paul Collins Startup list [[various names]] Number=14155 Confirmed=X Filename=hyandex.exe Description=Added by a NTROOTKIT TROJAN variant! Source=Paul Collins Startup list [[various names]] Number=14156 Confirmed=X Filename=Uint32.exe Description=Added by a NTROOTKIT TROJAN variant! Source=Paul Collins Startup list [[various names]] Number=14157 Confirmed=X Filename=Uint32.exe Description=Added by a NTROOTKIT TROJAN variant! Source=Paul Collins Startup list [[various names]] Number=14158 Confirmed=X Filename=_ctcp.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14159 Confirmed=X Filename=10010.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14160 Confirmed=X Filename=321102.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14161 Confirmed=X Filename=34763.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14162 Confirmed=X Filename=abrek.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14163 Confirmed=X Filename=ActionScr.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14164 Confirmed=X Filename=AliceSD.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14165 Confirmed=X Filename=AppMasterCenter.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14166 Confirmed=X Filename=atl_helper.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14167 Confirmed=X Filename=ATLIEHELPER.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14168 Confirmed=X Filename=avpmondll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14169 Confirmed=X Filename=awinrar.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14170 Confirmed=X Filename=backd.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14171 Confirmed=X Filename=backorif.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14172 Confirmed=X Filename=barint.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14173 Confirmed=X Filename=bhoserv.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14174 Confirmed=X Filename=bingo9.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14175 Confirmed=X Filename=bnui.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14176 Confirmed=X Filename=Bogobot.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14177 Confirmed=X Filename=borlandg.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14178 Confirmed=X Filename=BoundRec.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14179 Confirmed=X Filename=br0ken.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14180 Confirmed=X Filename=Brong32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14181 Confirmed=X Filename=clamav.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14182 Confirmed=X Filename=cmon14.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14183 Confirmed=X Filename=cnftips.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14184 Confirmed=X Filename=control64.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14185 Confirmed=X Filename=corrida.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14186 Confirmed=X Filename=CToolBar.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14187 Confirmed=X Filename=DCC_send.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14188 Confirmed=X Filename=defect08.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14189 Confirmed=X Filename=Dest068.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14190 Confirmed=X Filename=dialer423.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14191 Confirmed=X Filename=diskserv.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14192 Confirmed=X Filename=driver64.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14193 Confirmed=X Filename=DTOURS.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14194 Confirmed=X Filename=ERTYDF.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14195 Confirmed=X Filename=ExchangeMaster.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14196 Confirmed=X Filename=EXE32EXE.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14197 Confirmed=X Filename=expoler.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14198 Confirmed=X Filename=FLKPT.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14199 Confirmed=X Filename=forces_elite.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14200 Confirmed=X Filename=ftbar.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14201 Confirmed=X Filename=gabber.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14202 Confirmed=X Filename=hyandex.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14203 Confirmed=X Filename=iehelper.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14204 Confirmed=X Filename=iesetupdll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14205 Confirmed=X Filename=init32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14206 Confirmed=X Filename=InpriseMon.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14207 Confirmed=X Filename=install2.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14208 Confirmed=X Filename=jopplerg.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14209 Confirmed=X Filename=Kargo.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14210 Confirmed=X Filename=keybdll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14211 Confirmed=X Filename=KeywordFinder.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14212 Confirmed=X Filename=killall.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14213 Confirmed=X Filename=LOPTCON.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14214 Confirmed=X Filename=media64.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14215 Confirmed=X Filename=MNTP.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14216 Confirmed=X Filename=MON76234.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14217 Confirmed=X Filename=moniter.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14218 Confirmed=X Filename=mozilla-text.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14219 Confirmed=X Filename=msag.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14220 Confirmed=X Filename=ms-its.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14221 Confirmed=X Filename=MsNetHelper.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14222 Confirmed=X Filename=new32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14223 Confirmed=X Filename=newbreed.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14224 Confirmed=X Filename=nmdllw.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14225 Confirmed=X Filename=NopeZ.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14226 Confirmed=X Filename=NsCplTray.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14227 Confirmed=X Filename=NSYSCPLSTR.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14228 Confirmed=X Filename=NukeSpan.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14229 Confirmed=X Filename=openstre.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14230 Confirmed=X Filename=panel_its.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14231 Confirmed=X Filename=ParisM.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14232 Confirmed=X Filename=pizda.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14233 Confirmed=X Filename=powerdll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14234 Confirmed=X Filename=PrcIdle.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14235 Confirmed=X Filename=prcmon.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14236 Confirmed=X Filename=Preliminary.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14237 Confirmed=X Filename=prgsys0984.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14238 Confirmed=X Filename=progmen.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14239 Confirmed=X Filename=qwe.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14240 Confirmed=X Filename=RtlFindVal.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14241 Confirmed=X Filename=SAPSTR.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14242 Confirmed=X Filename=sbin.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14243 Confirmed=X Filename=scanSYS.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14244 Confirmed=X Filename=Serviceprocess.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14245 Confirmed=X Filename=SetupExeDll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14246 Confirmed=X Filename=Shaitan1678.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14247 Confirmed=X Filename=slamm.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14248 Confirmed=X Filename=sound64.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14249 Confirmed=X Filename=SpyElim.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14250 Confirmed=X Filename=srbho.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14251 Confirmed=X Filename=ssweeper.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14252 Confirmed=X Filename=StartCpl.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14253 Confirmed=X Filename=startman.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14254 Confirmed=X Filename=StatusCheck.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14255 Confirmed=X Filename=stuffmon.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14256 Confirmed=X Filename=sysconf16.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14257 Confirmed=X Filename=SysEntry.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14258 Confirmed=X Filename=sysmon12.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14259 Confirmed=X Filename=syspanel.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14260 Confirmed=X Filename=SysSupport.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14261 Confirmed=X Filename=SYSTRAV.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14262 Confirmed=X Filename=TemplateDongle.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14263 Confirmed=X Filename=teqq32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14264 Confirmed=X Filename=Testimonials.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14265 Confirmed=X Filename=TForm1.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14266 Confirmed=X Filename=TorontoMail.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14267 Confirmed=X Filename=Trayz.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14268 Confirmed=X Filename=TRPT.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14269 Confirmed=X Filename=trycrt.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14270 Confirmed=X Filename=typeconf.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14271 Confirmed=X Filename=Uint32.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14272 Confirmed=X Filename=uio.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14273 Confirmed=X Filename=UserSp1.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14274 Confirmed=X Filename=utsgmon.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14275 Confirmed=X Filename=vxdman.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14276 Confirmed=X Filename=WhatsNewBot.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14277 Confirmed=X Filename=WinInitDll.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14278 Confirmed=X Filename=wormexe.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14279 Confirmed=X Filename=WTFCTF.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14280 Confirmed=X Filename=XTermInit.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14281 Confirmed=X Filename=xwiz.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14282 Confirmed=X Filename=xxtoolbar.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14283 Confirmed=X Filename=zantu.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14284 Confirmed=X Filename=zxc.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14285 Confirmed=X Filename=ABCXYZ.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14286 Confirmed=X Filename=dePloy.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14287 Confirmed=X Filename=JAguAr.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14288 Confirmed=X Filename=80d0.exe Description=MediaMotor adware Source=Paul Collins Startup list [[various names]] Number=14289 Confirmed=X Filename=exe81.exe Description=MediaMotor adware Source=Paul Collins Startup list [[various names]] Number=14290 Confirmed=X Filename=exe82.exe Description=MediaMotor adware Source=Paul Collins Startup list [[various names]] Number=14291 Confirmed=X Filename=MSTCPDLL.exe Description=Wareout - malware masquerading as a spyware and dialer remover Source=Paul Collins Startup list [[various names]] Number=14292 Confirmed=X Filename=seli.exe Description=MediaMotor adware Source=Paul Collins Startup list [\IEService.exe] Number=14293 Confirmed=X Filename=IEService.exe Description=FastFind parasite variant Source=Paul Collins Startup list [\Pribi.exe] Number=14294 Confirmed=X Filename=Pribi.exe Description=FastFind adware variant Source=Paul Collins Startup list [\SysInit] Number=14295 Confirmed=X Filename=svchost.exe Description=Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files/Common Files folder Source=Paul Collins Startup list [\\TOOLS.exe] Number=14296 Confirmed=X Filename=tools.exe Description=Lycos SideSearch/Fastfind.org adware Source=Paul Collins Startup list [^`d}qZxu] Number=14297 Confirmed=X Filename=~`d}qzxu3zYF Description=Added by the GAOBOT.GEN!POLY WORM! Source=Paul Collins Startup list [_AntiSpyware] Number=14298 Confirmed=U Filename=MssCli.exe Description=Part of McAfee AntiSpyware Source=Paul Collins Startup list [_AntiSpyware] Number=14299 Confirmed=U Filename=masalert.exe Description=Part of McAfee AntiSpyware Source=Paul Collins Startup list [_Cat1] Number=14300 Confirmed=X Filename=nmmst.exe Description=Added by the SMALL.SD TROJAN! Source=Paul Collins Startup list [_Cat2] Number=14301 Confirmed=X Filename=nmstt.exe Description=Added by the SMALL-DT TROJAN! Source=Paul Collins Startup list [_Cat3] Number=14302 Confirmed=X Filename=msmsgrxp.exe Description=Added by a variant of the SMALL-DT downloader TROJAN Source=Paul Collins Startup list [_Cat4] Number=14303 Confirmed=X Filename=msmsgr2.exe Description=Added by the SMALL-EB TROJAN! Source=Paul Collins Startup list [_Hazafibb] Number=14304 Confirmed=X Filename=[path to file] Description=Added by the ZAFI.B WORM! Source=Paul Collins Startup list [_mzu_stonedrv2] Number=14305 Confirmed=X Filename=_mzu_stonedrv2.exe Description=Added by a variant of the DWNLDR-FTB TROJAN! Source=Paul Collins Startup list [_mzu_stonedrv3] Number=14306 Confirmed=X Filename=_mzu_stonedrv3.exe Description=Added by the DWNLDR-FTB TROJAN! Source=Paul Collins Startup list [_mzu_stonedrv7] Number=14307 Confirmed=Y Filename=_mzu_stonedrv7.exe Description=Added by a variant of the FTB TROJAN! Source=Paul Collins Startup list [_ntrdlhost] Number=14308 Confirmed=X Filename=_Ntrdlhost.exe Description=Added by the DLOADER-JV TROJAN! Source=Paul Collins Startup list [_ntrRescueService] Number=14309 Confirmed=X Filename=_ntrrs.exe Description=Added by the DLOADER-JV TROJAN! Source=Paul Collins Startup list [_pnd_Panda Antivirus] Number=14310 Confirmed=X Filename=_pnd_*****.exe [* = random char/digit] Description=Added by the AGENT.NAK TROJAN! Source=Paul Collins Startup list [_Setv] Number=14311 Confirmed=X Filename=Setv.com Description=Added by the BESAM WORM! Source=Paul Collins Startup list [_svchost.con] Number=14312 Confirmed=X Filename=svchost.com Description=Added by the ERKEZ.C WORM! Source=Paul Collins Startup list [_SystemBoot] Number=14313 Confirmed=X Filename=services.exe Description=Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Help\Help subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [_SystemDriver] Number=14314 Confirmed=X Filename=csrss.exe Description=Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a \addins\explorer subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [_System_Run] Number=14315 Confirmed=X Filename=_svchost_.exe Description=Added by the LINEAGE-Z TROJAN! Source=Paul Collins Startup list [_tdiserv_] Number=14316 Confirmed=X Filename=_tdicli_.exe Description=Added by the TDISERV.A WORM! Source=Paul Collins Startup list [_winadm] Number=14317 Confirmed=U Filename=winadm.exe Description=Parents Friend - "Log any activity and protect programs with a password. Further more you can lock the pc any hour in the week you want with the main password. You can also give users allowed programs in their program-lists and you can limit the maximal daily hours and maximal weekly hours user spend on the PC" Source=Paul Collins Startup list [_WinCheck] Number=14318 Confirmed=X Filename=services.exe Description=Added by the SOBER.V WORM! Source=Paul Collins Startup list [_WinData] Number=14319 Confirmed=X Filename=services.exe Description=Added by the SOBER.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "PoolData" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [_Windows] Number=14320 Confirmed=X Filename=services.exe Description=Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [_WinMain] Number=14321 Confirmed=X Filename=winexec.exe Description=Added by the DLOADER-XX TROJAN! Source=Paul Collins Startup list [_WinStart] Number=14322 Confirmed=X Filename=services.exe Description=Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Connection Wizard\Status subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [_winsystem.sys] Number=14323 Confirmed=X Filename=smss.exe Description=Added by the SOBER.K TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a msagent\win32 subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [_x-Finder] Number=14324 Confirmed=X Filename=_x-Finder.exe Description=Disconnects and redials an ISP modem to an adult content site Source=Paul Collins Startup list [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] Number=14325 Confirmed=U Filename=gnotify.exe Description=Google Gmail Notifier. Alerts you when you have new Gmail messages Source=Paul Collins Startup list [{1290A33C-85F5-4164-A1BE-7DD299D4986A}] Number=14326 Confirmed=U Filename=PBKScheduler.exe Description=Scheduler for CyberLink PowerBackup - archiving/backup utility Source=Paul Collins Startup list [{12EE7A5E-0674-42f9-A76B-000000004D00}] Number=14327 Confirmed=X Filename=rundll32.exe [path] stlb2.dll, DllRunMain Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [{1C-CC-C5-54-ZN}] Number=14328 Confirmed=X Filename=dwdsregt.exe Description=ZenoSearch adware Source=Paul Collins Startup list [{2CF0B992-5EEB-4143-99C0-5297EF71F444}] Number=14329 Confirmed=X Filename=rundll32.exe stlbdist.dll, DllRunMain Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [{2CF0B992-5EEB-4143-99C2-5297EF71F44B}] Number=14330 Confirmed=X Filename=rundll32.exe stlbupdt.DLL, DllRunMain Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [{2F-FF-F4-4C-ZN}] Number=14331 Confirmed=X Filename=omdsregk.exe Description=ZenoSearch adware Source=Paul Collins Startup list [{357AA41A-B7A8-4632-A27D-5B980B25CF43}] Number=14332 Confirmed=X Filename=[path to svchost.exe] Description=Added by the SMALL-AQ TROJAN! Source=Paul Collins Startup list [{357AA41A-B7A8-4632-A27D-5B980B25CF43}] Number=14333 Confirmed=X Filename=services.exe Description=Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder Source=Paul Collins Startup list [{357AA41A-B7A8-4632-A27D-5B980B25CF43}] Number=14334 Confirmed=X Filename=[path to trojan] Description=Added by the SMALL-EP TROJAN! Source=Paul Collins Startup list [{8C-C4-4A-A4-ZN}] Number=14335 Confirmed=X Filename=dwdsregt.exe Description=ZenoSearch adware Source=Paul Collins Startup list [{A70F6A1D-0195-42a2-934C-D8AC0F7C08EB}] Number=14336 Confirmed=X Filename=rundll32.exe E6F1873B.DLL, D9EBC318C Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [�Torrent] Number=14337 Confirmed=U Filename=utorrent.exe Description=�Torrent - BitTorrent client for Windows sporting a very small footprint. It was designed to use as little cpu, memory and space as possible while offering all the functionality expected from advanced clients Source=Paul Collins Startup list