[] Number=1 Confirmed=X Filename=system32.exe Description=Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=2 Confirmed=X Filename=pathex.exe Description=Added by the MKMOOSE-A WORM! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=3 Confirmed=X Filename=svchost.exe Description=Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=4 Confirmed=X Filename=MSPF.EXE Description=Added by a variant of the SDBOT WORM! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=5 Confirmed=X Filename=dllvirtual.exe Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=6 Confirmed=X Filename=dllvirtual.dll Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=7 Confirmed=X Filename=dllvirtual.js Description=Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=8 Confirmed=X Filename=ajsha5.exe Description=Added by the SPYBOT-NX WORM! Note - has a blank entry under the Startup Item/Name field Source=Paul Collins Startup list [] Number=9 Confirmed=X Filename=ne.exe Description=Added by the IRCBOT-ZL TROJAN! Source=Paul Collins Startup list [ SystemBoot] Number=10 Confirmed=X Filename=services.exe Description=Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Help\Help subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ WinCheck] Number=11 Confirmed=X Filename=services.exe Description=Added by the SOBER-S WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "ConnectionStatus\Microsoft" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ Windows] Number=12 Confirmed=X Filename=services.exe Description=Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "WinSecurity" subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ WinStart] Number=13 Confirmed=X Filename=services.exe Description=Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Connection Wizard\Status subfolder of the Windows or Winnt folder Source=Paul Collins Startup list [ winsystem.sys] Number=14 Confirmed=X Filename=smss.exe Description=Added by the SOBER.K TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a msagent\win32 subfolder of the Winnt or Windows folder Source=Paul Collins Startup list [!1_pgaccount] Number=15 Confirmed=Y Filename=pgaccount.exe Description=DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks. You will see one instant of pgaccount.exe for every active account on your system, and this is essential for PG to work properly Source=Paul Collins Startup list [!1_ProcessGuard_Startup] Number=16 Confirmed=Y Filename=procguard.exe Description=DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks Source=Paul Collins Startup list [!AVG Anti-Spyware] Number=17 Confirmed=U Filename=avgas.exe Description=Part of AVG Anti-Spyware from Grisoft Source=Paul Collins Startup list [!ewido] Number=18 Confirmed=U Filename=ewido.exe Description=Part of Ewido anti-spyware Source=Paul Collins Startup list [!NoLoad] Number=19 Confirmed=N Filename=winrecon.exe Description=WinRecon keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [$EnterNet] Number=20 Confirmed=? Filename=Enternet.exe Description=Connection manager for the EnterNet ISP. You can also use RASPPOE Source=Paul Collins Startup list [$sys$cmp] Number=21 Confirmed=X Filename=$sys$xp.exe Description=Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer Source=Paul Collins Startup list [$sys$crash] Number=22 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$crash] Number=23 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$crash] Number=24 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$drv] Number=25 Confirmed=X Filename=$sys$drv.exe Description=Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer Source=Paul Collins Startup list [$sys$momomomochin] Number=26 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$momomomochin] Number=27 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$momomomochin] Number=28 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=29 Confirmed=X Filename=$sys$sonyTimer.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=30 Confirmed=X Filename=$sys$sos$sys$.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$sys$umaiyo] Number=31 Confirmed=X Filename=$sys$WeLoveMcCOL.exe Description=Added by the WELOMOCH TROJAN! Source=Paul Collins Startup list [$Volumouse$] Number=32 Confirmed=U Filename=volumouse.exe Description=Volumouse from Nirsoft. "Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse" Source=Paul Collins Startup list [$WindowsRegKey%update] Number=33 Confirmed=X Filename=IEXPLORE.EXE Description=Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder Source=Paul Collins Startup list [%cmpmixtitle%] Number=34 Confirmed=N Filename=%cmpmixstr% Description=Possibly related to C-Media Mixer Control panel? Source=Paul Collins Startup list [%FP%012-L2TP fts.exe] Number=35 Confirmed=N Filename=fts.exe Description=012.Net.il Israeli ISP software front-end Source=Paul Collins Startup list [%FP%012-L2TP FWPortal.exe] Number=36 Confirmed=U Filename=FWPortal.exe Description=012.Net.il Israeli ISP dial-up software Source=Paul Collins Startup list [%FP%1776 Internet fts.exe] Number=37 Confirmed=N Filename=fts.exe Description=1776 Internet US ISP software ISP software front-end Source=Paul Collins Startup list [%FP%1776 Internet FWPortal.exe] Number=38 Confirmed=U Filename=FWPortal.exe Description=1776 Internet US ISP dial-up software Source=Paul Collins Startup list [%FP%AIRTEL fts.exe] Number=39 Confirmed=N Filename=fts.exe Description=Bharti Airtel Broadband - Indian ISP software front-end Source=Paul Collins Startup list [%FP%Barak013 fts.exe] Number=40 Confirmed=N Filename=fts.exe Description=Barak013 Israeli ISP software front-end Source=Paul Collins Startup list [%FP%Barak013 FWPortal.exe] Number=41 Confirmed=U Filename=FWPortal.exe Description=Barak013 Israeli ISP dial-up software Source=Paul Collins Startup list [%FP%Friendly fts.exe] Number=42 Confirmed=N Filename=fts.exe Description=Friendly ISP software front-end Source=Paul Collins Startup list [µTorrent] Number=43 Confirmed=U Filename=utorrent.exe Description=µTorrent - BitTorrent client for Windows sporting a very small footprint. It was designed to use as little cpu, memory and space as possible while offering all the functionality expected from advanced clients Source=Paul Collins Startup list [(*)API Machine] Number=44 Confirmed=X Filename=winSOCKS.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(*)Run] Number=45 Confirmed=X Filename=win32API.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(default)] Number=46 Confirmed=X Filename=[random filename].exe Description=Added by the BLACKMAL WORM! Note - this malware actually changes the default value data of the registry "Run" key in order to force Windows to launch it at boot. Name field may be empty Source=Paul Collins Startup list [(default)] Number=47 Confirmed=X Filename=rundll32.exe [path to DLL file], Do98Work Description=Added by the HESIVE.B TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted Source=Paul Collins Startup list [(Default)] Number=48 Confirmed=X Filename=5640.exe Description=Added by the DOWNLD-ABF TROJAN! Source=Paul Collins Startup list [(L4r1$$4) (4nt1) (V1ruz)] Number=49 Confirmed=X Filename=SP00Lsv32.pif Description=Added by the ASSIRAL.B WORM! Source=Paul Collins Startup list [*Bandook] Number=50 Confirmed=X Filename=msdll.exe Description=Added by an unidentified TROJAN - see here Source=Paul Collins Startup list [*JanisRuckenbrodII] Number=51 Confirmed=X Filename=janis.com Description=Added by the POPS WORM! Source=Paul Collins Startup list [*Microsoft Update] Number=52 Confirmed=X Filename=ctxma.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=53 Confirmed=X Filename=cxma.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=54 Confirmed=X Filename=wstcl.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=55 Confirmed=X Filename=wucxt.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*Microsoft Update] Number=56 Confirmed=X Filename=wuytc.exe Description=Added by the STMU TROJAN! Source=Paul Collins Startup list [*MS Setup] Number=57 Confirmed=X Filename=[random filename] Description=Virtumondo adware, also known as the VUNDO TROJAN! Source=Paul Collins Startup list [*MSConfig32] Number=58 Confirmed=X Filename=aecache.exe Description=Detected by F-secure as the OBFUSCATED.GP TROJAN! Source=Paul Collins Startup list [*Security Center] Number=59 Confirmed=X Filename=secctr.exe Description=Added by the SDBOT.BRO WORM! Source=Paul Collins Startup list [*StateMgr] Number=60 Confirmed=Y Filename=statemgr.exe Description=Windows ME default for System Restore. Do NOT disable! Source=Paul Collins Startup list [*windows update] Number=61 Confirmed=X Filename=wrauclt.exe Description=Added by the RBOT-QU WORM! Source=Paul Collins Startup list [*windows update] Number=62 Confirmed=X Filename=wuanclt.exe Description=Added by the RBOT-PG WORM! Source=Paul Collins Startup list [*windows update] Number=63 Confirmed=X Filename=wuaucrlt.exe Description=Added by the SPYBOT.HUR WORM! Source=Paul Collins Startup list [*windows update] Number=64 Confirmed=X Filename=wuraclt.exe Description=Added by the RBOT-PO WORM! Source=Paul Collins Startup list [*windows update] Number=65 Confirmed=X Filename=wurauclt.exe Description=Added by the RBOT-SY WORM! Source=Paul Collins Startup list [*windows update] Number=66 Confirmed=X Filename=wsctl.exe Description=Added by the SPYBOT.PR WORM! Source=Paul Collins Startup list [*windows update] Number=67 Confirmed=X Filename=wkmst.exe Description=Added by the SDBOT.AVD WORM! Source=Paul Collins Startup list [*windows update] Number=68 Confirmed=X Filename=wscxt.exe Description=Added by the RBOT.AOS WORM! Source=Paul Collins Startup list [*windows update] Number=69 Confirmed=X Filename=waurclt.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [*Windows [filename] Checker] Number=70 Confirmed=X Filename=[filename] Description=Added by the KEDEBE-B WORM! Source=Paul Collins Startup list [*WindowsAudio] Number=71 Confirmed=X Filename=systemupd.exe Description=Added by the AGENT-TH WORM! Source=Paul Collins Startup list [*WinLogon] Number=72 Confirmed=X Filename=[trojan path] ren time:[random number] Description=Added by the VUNDO TROJAN! Source=Paul Collins Startup list [*winstats] Number=73 Confirmed=X Filename=winstats.exe Description=Added by the GARGAFX TROJAN! Source=Paul Collins Startup list [*wuauclt.exe] Number=74 Confirmed=X Filename=w****.exe [* = random char] Description=Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe, wtmsv.exe, wxmst.exe, wmsvc.exe and so on... Source=Paul Collins Startup list [,main drive Loader] Number=75 Confirmed=X Filename=wininfo.exe Description=Suspected malware as it appears in 3 different registry locations - see here Source=Paul Collins Startup list [-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+] Number=76 Confirmed=X Filename=ISASS.exe Description=Added by the ASSIRAL.B WORM! Source=Paul Collins Startup list [-FreedomNeedsReboot] Number=77 Confirmed=Y Filename=ZkRunOnceR.exe Description=Internet Security Suite used by ISPs to protect customers against many attacks Source=Paul Collins Startup list [..] Number=78 Confirmed=X Filename=ABC2007.exe Description=Added by the DLOADR-ASH TROJAN! Source=Paul Collins Startup list [.mscdr] Number=79 Confirmed=X Filename=lassa.exe Description=Added by the WEBUS.C TROJAN! Source=Paul Collins Startup list [.mscdr] Number=80 Confirmed=X Filename=lsvchost.exe Description=Added by the WEBUS.D TROJAN! Source=Paul Collins Startup list [.mscdsr] Number=81 Confirmed=X Filename=lsvchost.exe Description=Added by the CR TROJAN! Source=Paul Collins Startup list [.mscsbl] Number=82 Confirmed=X Filename=svhost.exe Description=Added by the CMQ TROJAN! Source=Paul Collins Startup list [.msfupdate] Number=83 Confirmed=X Filename=msveup.exe Description=Added by the ALLOCUP.A WORM! Source=Paul Collins Startup list [.mssecure] Number=84 Confirmed=X Filename=mssecure.exe Description=Added by the DDOS_BOXED.X TROJAN! Source=Paul Collins Startup list [.NET config] Number=85 Confirmed=? Filename=sysmon32.exe Description=?? Source=Paul Collins Startup list [.NET.] Number=86 Confirmed=X Filename=msnmgnr.exe Description=Added by the DELF.AYF WORM! Source=Paul Collins Startup list [.norton] Number=87 Confirmed=X Filename=rchost.exe Description=Added by the BOXED-H TROJAN! Source=Paul Collins Startup list [.nvsvc] Number=88 Confirmed=X Filename=smss.exe Description=Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [.nvsvcb] Number=89 Confirmed=X Filename=smssb.exe Description=Added by the BOXED.CG TROJAN! Source=Paul Collins Startup list [.Prog] Number=90 Confirmed=X Filename=services.exe Description=Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.Prog] Number=91 Confirmed=X Filename=winlogon.exe Description=Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.protected] Number=92 Confirmed=X Filename=N/A Description=Smitfraud variant Source=Paul Collins Startup list [.svchost] Number=93 Confirmed=X Filename=CSRSS.EXE Description=Added by the WEBUS.F TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [.TEXTCONV] Number=94 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.TEXTCONV] Number=95 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [.WMAudio] Number=96 Confirmed=X Filename=csrss.exe Description=Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [.WMAudio] Number=97 Confirmed=X Filename=lsass.exe Description=Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder Source=Paul Collins Startup list [/l:eng] Number=98 Confirmed=N Filename=N/A Description=Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it's easily available using the search function Source=Paul Collins Startup list [000] Number=99 Confirmed=U Filename=pit.exe Description=PrivateEye surveillance software. Uninstall this software unless you put it there yourself Source=Paul Collins Startup list [000hpdllhos] Number=100 Confirmed=X Filename=hpdllhost.exe Description=LZIO.com adware downloader Source=Paul Collins Startup list [000StTHK] Number=101 Confirmed=U Filename=000StTHK.exe Description=Toshiba Hot key functionality for the function keys (Fn-Esc, Fn-F1 (lock), Fn-F2, Fn-F3, Fn-F4, Fn-F5 (switching between laptop and CRT display output), etc...) Source=Paul Collins Startup list [0050726-007-i32-1] Number=102 Confirmed=X Filename=0050726-007-i32-1.exe Description=Added by the BANCBAN-EC TROJAN! Source=Paul Collins Startup list [00DSKSVR00] Number=103 Confirmed=? Filename=desksaver.exe Description=Related to Advanced Desktop Shield Source=Paul Collins Startup list [00DSKSVR01] Number=104 Confirmed=? Filename=desksaver.exe Description=Related to Advanced Desktop Shield Source=Paul Collins Startup list [00PCTFW] Number=105 Confirmed=Y Filename=FirewallGUI.exe Description=PC Tools Firewall Plus - "powerful free personal firewall for Windows that protects your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network" Source=Paul Collins Startup list [00TCrdMain] Number=106 Confirmed=Y Filename=TCrdMain.exe Description=Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards Source=Paul Collins Startup list [00THotkey] Number=107 Confirmed=U Filename=00THotKey.exe Description=For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev. Source=Paul Collins Startup list [00THotkey] Number=108 Confirmed=U Filename=system32THotkey.exe Description=For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev Source=Paul Collins Startup list [0190 Warner] Number=109 Confirmed=U Filename=WARN0190.EXE Description=Anti-dialer program (Germany) Source=Paul Collins Startup list [0900 Warner] Number=110 Confirmed=U Filename=WARN0900.EXE Description=Anti-dialer program (Germany) Source=Paul Collins Startup list [0mcamcap] Number=111 Confirmed=X Filename=0mcamcap.exe Description=Added by the COSIAM-H TROJAN! Source=Paul Collins Startup list [0utlook Express] Number=112 Confirmed=X Filename=*****.exe [* = random char] Description=Added by the RBOT-CC WORM! Note the first letter is actually the digit "0" and not a capital "o" Source=Paul Collins Startup list [1] Number=113 Confirmed=X Filename=1.exe Description=Added by the ESTEEMS TROJAN! Source=Paul Collins Startup list [1] Number=114 Confirmed=X Filename=lsass.scr Description=Added by the BANCOS.V TROJAN! Source=Paul Collins Startup list [1] Number=115 Confirmed=X Filename=svchost.scr Description=Added by the BANCOS.X TROJAN! Source=Paul Collins Startup list [1&1 EasyLogin] Number=116 Confirmed=N Filename=EasyLogin.exe Description=1&1 EasyLogin - quick access to webhost 1&1's Control Panel, Web-Mail and other applications via the System Tray Source=Paul Collins Startup list [1029BB4B-16A9-4E77-AA3D-96930BD68EEC] Number=117 Confirmed=X Filename=sysockeu.exe Description=Detected by McAfee as the FAKEALERT-AH TROJAN! See here Source=Paul Collins Startup list [1111swapmgr.exe] Number=118 Confirmed=X Filename=1111swapmgr.exe Description=Added by the IC TROJAN! Source=Paul Collins Startup list [123456] Number=119 Confirmed=X Filename=rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl Description=Added by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number Source=Paul Collins Startup list [12Ghosts Backup] Number=120 Confirmed=U Filename=12backup.exe Description=12Ghosts Backup - "Automatic Backups, HyperBackup for Multiple Versions, Registry Backup" Source=Paul Collins Startup list [12Ghosts Clip] Number=121 Confirmed=U Filename=12clip.exe Description=12Ghosts Clip - "Screen shots made easy" Source=Paul Collins Startup list [12Ghosts JustAWindow] Number=122 Confirmed=U Filename=12window.exe Description=12Ghosts JustAWindow - "Cover annoying ads, animated gifs, things you don't want to see" Source=Paul Collins Startup list [12Ghosts Popup-Killer] Number=123 Confirmed=U Filename=12popup.exe Description=12Ghosts Popup-Killer Source=Paul Collins Startup list [12Ghosts SaveLayout] Number=124 Confirmed=U Filename=12autosl.exe Description=12Ghosts SaveLayout - "Always (always!) keep the layout of your desktop icons" Source=Paul Collins Startup list [12Ghosts SetColor] Number=125 Confirmed=U Filename=12color.exe Description=12Ghosts SetColor - "Change your desktop icon text colors, also to transparent" Source=Paul Collins Startup list [12Ghosts ShowTime] Number=126 Confirmed=U Filename=12showtime.exe Description=12Ghosts Showtime - "Enhance the clock in your tray with font formatting, colors, date, time zones" Source=Paul Collins Startup list [12Ghosts Synchronize] Number=127 Confirmed=U Filename=12sync.exe Description=12Ghosts Synchronize - "Sync PC clock with an atomic clock over the Internet" Source=Paul Collins Startup list [12Ghosts Tower] Number=128 Confirmed=U Filename=12tower.exe Description=12Ghosts Tower - "Quickly access and manage all Ghosts (included in all packages)" Source=Paul Collins Startup list [12Ghosts TrayProtect] Number=129 Confirmed=U Filename=12srvc.exe Description=12Ghosts TrayProtect - "Hide tray icons, restore after a crash" Source=Paul Collins Startup list [12Ghosts Wash] Number=130 Confirmed=U Filename=12wash.exe Description=12Ghosts Wash - "Protect your privacy, clear browser history, delete and overwrite cache files" Source=Paul Collins Startup list [17779Proj2002] Number=131 Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [180adsolution] Number=132 Confirmed=X Filename=180adsolution.exe Description=NCase adware Source=Paul Collins Startup list [180ax] Number=133 Confirmed=X Filename=180ax.exe Description=NCase adware Source=Paul Collins Startup list [180ClientStubInstall] Number=134 Confirmed=X Filename=stubinstaller****.exe [* = digit] Description=180Solutions adware related Source=Paul Collins Startup list [180ClientStubInstall] Number=135 Confirmed=X Filename=[path to trojan] Description=180Solutions adware related Source=Paul Collins Startup list [180ClientStubInstall] Number=136 Confirmed=X Filename=******.tmp [* = random digit/char] Description=180Solutions adware related Source=Paul Collins Startup list [1916435341.exe] Number=137 Confirmed=X Filename=1916435341.exe Description=Added by the DLOADR-AXU TROJAN! Source=Paul Collins Startup list [196_150_ni] Number=138 Confirmed=X Filename=196_150_ni.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [197_150_ni_3] Number=139 Confirmed=X Filename=197_150_ni_3.exe Description=WinFixer web installer. Winfixer is "Foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here Source=Paul Collins Startup list [1:] Number=140 Confirmed=N Filename=hpdrv.exe Description=HP utility for monitoring when and how many recoveries have been done Source=Paul Collins Startup list [1A:MacVisionTrayMonitor] Number=141 Confirmed=N Filename=TrayMonitor.exe Description=Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock) Source=Paul Collins Startup list [1A:Stardock MCP] Number=142 Confirmed=Y Filename=mcpserver.exe Description=Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications Source=Paul Collins Startup list [1A:Stardock TrayMonitor] Number=143 Confirmed=Y Filename=TrayServer.exe Description=For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX Source=Paul Collins Startup list [1CmailS] Number=144 Confirmed=? Filename=NETMAIL.EXE Description=?? Source=Paul Collins Startup list [1on1] Number=145 Confirmed=X Filename=1on1.exe Description=Adult content dialler Source=Paul Collins Startup list [1Srv32] Number=146 Confirmed=U Filename=SpyAgent4.exe Description=SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC." Source=Paul Collins Startup list [1u7] Number=147 Confirmed=X Filename=1u7.exe Description=Added by the MURBAC-A TROJAN! Source=Paul Collins Startup list [1Win32Cfg] Number=148 Confirmed=U Filename=SpyBuddy.exe Description=SpyBuddy keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [1Win32Cfg] Number=149 Confirmed=U Filename=Keyloggerpro.exe Description=Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [1WinCfg32] Number=150 Confirmed=X Filename=WebMailSpy.exe Description=WebMailSpy spyware Source=Paul Collins Startup list [2020Downloader] Number=151 Confirmed=X Filename=mssvr.exe Description=2020Search Toolbar Source=Paul Collins Startup list [2177F056-0AA6-4D6C-A944-13F71F341C29] Number=152 Confirmed=X Filename=sysokuaw.exe Description=Detected by McAfee as the FAKEALERT-AH TROJAN! See here Source=Paul Collins Startup list [24Online Client] Number=153 Confirmed=U Filename=CyberoamClient.exe Description=Related to Cyberroam from Elitecore Technologies Ltd Source=Paul Collins Startup list [252] Number=154 Confirmed=X Filename=winmgr.exe Description=Added by the LEGMIR-AT TROJAN! Source=Paul Collins Startup list [27] Number=155 Confirmed=X Filename=slsorve.exe Description=Added by the SLSORVE-A TROJAN! Source=Paul Collins Startup list [27] Number=156 Confirmed=X Filename=csrss32.exe Description=Added by the SLSORVE-D TROJAN! Source=Paul Collins Startup list [27] Number=157 Confirmed=X Filename=msm32.exe Description=Added by the SLSORVE-E TROJAN! Source=Paul Collins Startup list [2Search] Number=158 Confirmed=X Filename=main.exe Description=2Search adware Source=Paul Collins Startup list [2thousandbuck] Number=159 Confirmed=X Filename=[path to file] Description=Added by the RANKY.L TROJAN! Source=Paul Collins Startup list [2wSysTray] Number=160 Confirmed=U Filename=2portalmon.exe Description=2Wire Homeportal user interface Source=Paul Collins Startup list [32-bit Thunking service] Number=161 Confirmed=X Filename=thunk32.exe Description=Added by the DERDERO.A WORM! Source=Paul Collins Startup list [333] Number=162 Confirmed=X Filename=svchost.exe Description=Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This one is located in a "Syswm1i" directory Source=Paul Collins Startup list [388529725448] Number=163 Confirmed=X Filename=AutomaticUpdates.exe Description=Added by the SDBOT-DEN WORM! Source=Paul Collins Startup list [39ELTFH25Z8SKF] Number=164 Confirmed=? Filename=Ezg1q5.exe Description=Seems to be associated with software by Resplendence SP ? Source=Paul Collins Startup list [3c1807pd] Number=165 Confirmed=Y Filename=3cmlink.exe 3cpipe-3c1807pd Description=3Com WinModem driver. See here for more WinModem information Source=Paul Collins Startup list [3capplnk] Number=166 Confirmed=Y Filename=3capplnk.exe Description=US Robotics Modem driver Source=Paul Collins Startup list [3cdminic] Number=167 Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3CM Link] Number=168 Confirmed=Y Filename=3cmcnkw.exe Description=Required for a US Robotics WinModem as it provides the link to Windows - won't work without it Source=Paul Collins Startup list [3Cmlink] Number=169 Confirmed=Y Filename=3CmlinkW.exe Description=For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information Source=Paul Collins Startup list [3ComDMIAgent] Number=170 Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3cpipe-USRpdA] Number=171 Confirmed=Y Filename=USRmlnkA.exe Description=Modem driver files from US Robotics Source=Paul Collins Startup list [3D Text] Number=172 Confirmed=X Filename=3D Text.scr Description=Added by the JERMY.A WORM! Source=Paul Collins Startup list [3Deep Control Panel] Number=173 Confirmed=U Filename=3DeepCTL.EXE Description=Now superseeded by ColorWizzard - 3Deep corrected lighting, shading and color for all your 2D and 3D games Source=Paul Collins Startup list [3Dfx Acc] Number=174 Confirmed=X Filename=GFXACC.EXE Description=Added by the GIBE WORM! Source=Paul Collins Startup list [3dfx Task Manager] Number=175 Confirmed=N Filename=3dfxMan.exe Description=System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs Source=Paul Collins Startup list [3dfx Tools] Number=176 Confirmed=Y Filename=3dfxCmn.dll Description=Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards Source=Paul Collins Startup list [3dfxv2ps.dll] Number=177 Confirmed=Y Filename=3dfxv2ps.dll Description=Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards Source=Paul Collins Startup list [3Dlabs Taskbar Display Manager] Number=178 Confirmed=? Filename=3DLman.exe Description=3DLabs graphics driver related. System Tray access to display settings? Source=Paul Collins Startup list [3DLabsHelperDemon] Number=179 Confirmed=U Filename=3dldemon.exe Description=Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore), so it should take zero CPU time and virtually zero memory, since it will all be paged out to the hard drive." In most cases it can be safely disabled Source=Paul Collins Startup list [3DMouse.EXE] Number=180 Confirmed=Y Filename=3DMouse.EXE Description=Dritek System Inc. 3D Mouse driver Source=Paul Collins Startup list [3d_sound] Number=181 Confirmed=X Filename=3d_sound.exe Description=Added by the RIADOS-A TROJAN! Source=Paul Collins Startup list [3qdctl.exe] Number=182 Confirmed=U Filename=3qdctl.exe Description=Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup, restoring volume and other audio settings to a pre-determined default. Similar to Creative Lab's AudioHQ Source=Paul Collins Startup list [3ware 3DM] Number=183 Confirmed=Y Filename=3dm.exe Description=Monitors status of the disk array on 3ware IDE RAID controllers Source=Paul Collins Startup list [456655] Number=184 Confirmed=X Filename=explorer.exe Description=Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System folder Source=Paul Collins Startup list [4684735485910] Number=185 Confirmed=X Filename=netdll32.exe Description=Added by the SDBOT-DEV WORM! Source=Paul Collins Startup list [4da92ad5.exe] Number=186 Confirmed=X Filename=4da92ad5.exe Description=Added by the DLOADR-WZ TROJAN! Source=Paul Collins Startup list [4oD] Number=187 Confirmed=U Filename=KHost.exe Description=Verisign Kontiki Delivery Management System - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [4wd!!!] Number=188 Confirmed=X Filename=Natal!.pif Description=Added by the OPASERV.AI WORM! Source=Paul Collins Startup list [5-1-61-96] Number=189 Confirmed=X Filename=members-area.exe Description=Adult content dialler Source=Paul Collins Startup list [5-2-46-112] Number=190 Confirmed=X Filename=5-2-46-112.exe Description=Adult content pop-up dialler. Removal instructions here Source=Paul Collins Startup list [55278] Number=191 Confirmed=X Filename=grepclient1.exe Description=Added by the LINEAGE-S TROJAN! Source=Paul Collins Startup list [5p4m] Number=192 Confirmed=X Filename=[path to trojan] Description=Added by the LITEBOT-C TROJAN! Source=Paul Collins Startup list [5whgue21] Number=193 Confirmed=X Filename=5whgue21.exe Description=ClearSearch adware Source=Paul Collins Startup list [666] Number=194 Confirmed=X Filename=Ska.exe Description=Added by the PIPES TROJAN! Source=Paul Collins Startup list [678] Number=195 Confirmed=X Filename=lsas32.exe Description=Added by the SLSORVE-B TROJAN! Source=Paul Collins Startup list [756349DC-6D9E-4F2A-9B24-269661F073C3] Number=196 Confirmed=X Filename=sysoghcx.exe Description=Detected by McAfee as the FAKEALERT-AH TROJAN! See here Source=Paul Collins Startup list [7f8e] Number=197 Confirmed=X Filename=z****.exe 9idf Description=Detected by NOD32 as the SMALL.ALI TROJAN! Note - it creates a number of extra z****.dll files in the system32 folder Source=Paul Collins Startup list [802.11b+g USB Wireless LAN Utility] Number=198 Confirmed=U Filename=ZDWlan.exe Description=802.11b+g USB Wireless LAN Utility Source=Paul Collins Startup list [802.11g Wireless Adatper] Number=199 Confirmed=U Filename=Monitor.exe Description=Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to "Wireless Connection Status" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled Source=Paul Collins Startup list [852EBF20-A95D-4F1F-B9C2-B2CD24350F3E] Number=200 Confirmed=X Filename=sysodkcs.exe Description=Detected by McAfee as the FAKEALERT-AH TROJAN! See here Source=Paul Collins Startup list [98D0CE0C16B1] Number=201 Confirmed=X Filename=rundll32.exe D0CE0C16B1, D0CE0C16B1 Description=BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted Source=Paul Collins Startup list [9m] Number=202 Confirmed=X Filename=winlog0n.exe Description=Added by the LEGMIR-AQK TROJAN! Source=Paul Collins Startup list [9xadiras] Number=203 Confirmed=Y Filename=9xadiras.exe Description=Allied Telesyn AT series router/modem related - apparently required Source=Paul Collins Startup list [9xHtProtect] Number=204 Confirmed=X Filename=AVprotect9x.exe Description=Added by the NETSKY.M WORM! Source=Paul Collins Startup list [;Rundll] Number=205 Confirmed=X Filename=[filename] Description=Added by the PWSLEGMIR.E TROJAN! Source=Paul Collins Startup list [?ekio Startups] Number=206 Confirmed=X Filename=?nksvc32.exe Description=Added by the AGOBOT-OV WORM where ? is a random character Source=Paul Collins Startup list [@] Number=207 Confirmed=X Filename=regedit -s ..win.dll Description=Added by the SEEKER.K TROJAN! Source=Paul Collins Startup list [@Hoc Toolbar] Number=208 Confirmed=N Filename=AtHoc.exe Description=One-click activated browsing toolbar used by various web-sites. See here for more info Source=Paul Collins Startup list [@loha] Number=209 Confirmed=N Filename=reminder.exe Description=Registration reminder for @loha@home E-mail utility Source=Paul Collins Startup list [@tour_ww] Number=210 Confirmed=X Filename=@tour_ww[1].exe Description=Adult content dialler Source=Paul Collins Startup list [a] Number=211 Confirmed=X Filename=a.exe Description=Commercials file that registers itself in the system registry and redirects IE to a certain commercial website Source=Paul Collins Startup list [a] Number=212 Confirmed=X Filename=jesse.exe Description=Added by the MELO-A WORM! Source=Paul Collins Startup list [A New Windows Updater] Number=213 Confirmed=X Filename=w32NTupdt.exe Description=Added by the MYTOB.BM WORM! Source=Paul Collins Startup list [A Note] Number=214 Confirmed=N Filename=A Note.exe Description="A Note is a program that lets you create post-it like notes on your Microsoft Windows desktop" Source=Paul Collins Startup list [A Verizon App] Number=215 Confirmed=U Filename=VERIZO~1.EXE Description=Part of Verizon Online Support Manager Source=Paul Collins Startup list [a-squared] Number=216 Confirmed=U Filename=a2guard.exe Description=a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a? 'Background Guard' real time protection feature Source=Paul Collins Startup list [a-squared Anti-Dialer] Number=217 Confirmed=Y Filename=a2adguard.exe Description=a-sqaured Anti-Dialer Source=Paul Collins Startup list [a-winpoet-service] Number=218 Confirmed=Y Filename=winpppoverethernet.exe Description=WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking Source=Paul Collins Startup list [A1000 Settings Utility] Number=219 Confirmed=U Filename=cpqa1000.exe Description=Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan, print, copy and fax. Only required if you use these features Source=Paul Collins Startup list [A4Proxy] Number=220 Confirmed=U Filename=A4Proxy.exe Description=Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites Source=Paul Collins Startup list [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] Number=221 Confirmed=X Filename=rundll32.exe E6F1873B.DLL, D9EBC318C Description=BrowserAid/BrowserPal foistware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted Source=Paul Collins Startup list [a?] Number=222 Confirmed=U Filename=a2guard.exe Description=a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a? 'Background Guard' real time protection feature Source=Paul Collins Startup list [AAACLEAN] Number=223 Confirmed=? Filename=AAACLEAN.INF Description=?? Source=Paul Collins Startup list [AAAKeyboard] Number=224 Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [AAATraySaver] Number=225 Confirmed=N Filename=TraySaver.exe Description=System Tray management utility from Mike Lin which allows you to hide, show, restore icons that are lost in an Explorer crash, remove dead tray icons, minimize any window to the System Tray Source=Paul Collins Startup list [AAK] Number=226 Confirmed=U Filename=aak.exe Description=Advanced Anti-Keylogger - "Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere" Source=Paul Collins Startup list [aaLDISCN32] Number=227 Confirmed=U Filename=LDISCN32.EXE Description=LANDesk? Management Suite software component Source=Paul Collins Startup list [aaLDTaskCompletion] Number=228 Confirmed=U Filename=amclient.EXE Description=LANDesk? Management Suite software component Source=Paul Collins Startup list [AAMSFree702] Number=229 Confirmed=X Filename=Avengine.com Description=Added by the DELF.LJ TROJAN! Source=Paul Collins Startup list [AAMSFree702] Number=230 Confirmed=X Filename=sys.exe Description=Added by the BACKDOOR-CPC TROJAN! Source=Paul Collins Startup list [Aaou] Number=231 Confirmed=X Filename=amee.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Aapp] Number=232 Confirmed=X Filename=adprot.exe Description=AdBlaster adware Source=Paul Collins Startup list [aauclient] Number=233 Confirmed=? Filename=ACNUpdater.exe Description=Appears to be related to software from Accenture.com Source=Paul Collins Startup list [AAW] Number=234 Confirmed=U Filename=Ad-Aware.exe Description=Ad-Aware anti-spyware tool from Lavasoft Source=Paul Collins Startup list [AAWTray] Number=235 Confirmed=U Filename=AAWTray.exe Description=System Tray access to Ad-aware from Lavasoft - popular spyware/adware removal tool Source=Paul Collins Startup list [ab EazyScheduler] Number=236 Confirmed=? Filename=ezsched.exe Description=?? Source=Paul Collins Startup list [ABBYY Community Agent] Number=237 Confirmed=N Filename=CAGENT.EXE Description=Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software Source=Paul Collins Startup list [ABC] Number=238 Confirmed=U Filename=keylogger.exe Description=Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [abcdefgh] Number=239 Confirmed=X Filename=abcdefgh.exe Description=EPJ TROJAN! Source=Paul Collins Startup list [ABIT uGuru] Number=240 Confirmed=U Filename=uGuru.exe Description=ABIT ?Guru - on motherboards incorporating the ?Guru processor this provides quick access to "hardware monitoring, overclocking, BIOS flashing and audio tweakin Source=Paul Collins Startup list [ABITEQ] Number=241 Confirmed=N Filename=abiteq.exe Description=Monitoring utility for ABIT Motherboards. Displays system voltages, temperatures and fan speeds Source=Paul Collins Startup list [Abrada WIN32] Number=242 Confirmed=X Filename=abrada.exe Description=Added by the DERMON-G TROJAN! Source=Paul Collins Startup list [Absolute Shield] Number=243 Confirmed=U Filename=dseraser.exe Description=Absolute Shield Evidence Eliminator - internet history eraser Source=Paul Collins Startup list [Absolute StartUp monitor] Number=244 Confirmed=U Filename=ASMon.exe Description=Absolute Startup - startup monitor from F-Group Software Source=Paul Collins Startup list [AbsoluteShield Internet Eraser] Number=245 Confirmed=U Filename=cseraser.exe Description=AbsoluteShield Internet Eraser - "protects your privacy by cleaning up all the tracks of your Internet and computer activities" Source=Paul Collins Startup list [ABsr] Number=246 Confirmed=X Filename=absr.exe Description=Added by the AUTOUPDER TROJAN! Source=Paul Collins Startup list [absr] Number=247 Confirmed=X Filename=mwsvm.exe Description=SeekSeek search hijacker related - see here Source=Paul Collins Startup list [abtu] Number=248 Confirmed=X Filename=mp3serch.exe Description=Loads the executable for Lop.com. mp3serch.exe is the final version Source=Paul Collins Startup list [abtu] Number=249 Confirmed=X Filename=lopsearch.exe Description=Loads the executable for Lop.com. lopsearch.exe is the beta version Source=Paul Collins Startup list [AbyssWebServer] Number=250 Confirmed=U Filename=abyssws.exe Description=Abyss web server Source=Paul Collins Startup list [Ac97Sound] Number=251 Confirmed=X Filename=snddrv.exe Description=Detected by Sophos as the SILLYFDC-A TROJAN! Source=Paul Collins Startup list [AcBtnMgr_X63] Number=252 Confirmed=U Filename=AcBtnMgr_X63.exe Description="Lexmark Scan & Copy Control Program" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan, scan to E-mail, copy, etc Source=Paul Collins Startup list [AcBtnMgr_X73] Number=253 Confirmed=U Filename=AcBtnMgr_X73.exe Description="Lexmark Scan & Copy Control Program" for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan, scan to E-mail, copy, etc Source=Paul Collins Startup list [AcBtnMgr_X83] Number=254 Confirmed=U Filename=AcBtnMgr_X83.exe Description="Lexmark Scan & Copy Control Program" for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan, scan to E-mail, copy, etc Source=Paul Collins Startup list [AcBtnMgr_X84-X85] Number=255 Confirmed=U Filename=AcBtnMgr_X84-X85.exe Description="Lexmark Scan & Copy Control Program" for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan, scan to E-mail, copy, etc Source=Paul Collins Startup list [acc] Number=256 Confirmed=U Filename=acc.exe Description=Advanced Call Center - "full-featured yet easy-to-use answering machine software for your voice modem" Source=Paul Collins Startup list [ACCDEFRAGINFO] Number=257 Confirmed=X Filename=[path to worm] Description=Added by the DARBY-O WORM! Source=Paul Collins Startup list [Accelerate] Number=258 Confirmed=U Filename=accelerate.exe Description=Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection Source=Paul Collins Startup list [Access Control App] Number=259 Confirmed=X Filename=winsto.exe Description=Detected by Kaspersky as the AGENT.DGO TROJAN! See here Source=Paul Collins Startup list [Access Ramp Monitor] Number=260 Confirmed=N Filename=armon32.exe Description=Monitors your progress on the internet; hang-ups, connection speeds, internet congestion and traffic flow. It prevents some games from running also. To disable the Access Ramp Monitor (1) Open Windows Explorer (2) Open the Program Files folder (3) Open the MindSpring folder (4) Open the AccessRamp folder (5) Double-click on the ARMCfg32.exe file (6) Uncheck Enable Dialup Monitor and click OK (7) Restart the computer and try again Source=Paul Collins Startup list [Access WebControl] Number=261 Confirmed=X Filename=[path to file] Description=Added by the PPDOOR-M TROJAN! Source=Paul Collins Startup list [AccessManager] Number=262 Confirmed=U Filename=AccessMgr.exe Description=Part of SmartPipes SecureSite software. "SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management, access control management, and key management" Source=Paul Collins Startup list [AccessMedia P2P Loader] Number=263 Confirmed=X Filename=amp2pl.exe Description=My AccessMedia toolbar related, stealth installed! Source=Paul Collins Startup list [AccessoriesPlus] Number=264 Confirmed=U Filename=clockplus.exe Description=Clock Plus, part of Accessories Plus allows you to select from dozens of alternatives for the Windows clock Source=Paul Collins Startup list [AccessRamp Monitor01] Number=265 Confirmed=N Filename=ARMon32a.exe Description=From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup, or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS, but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service." Source=Paul Collins Startup list [AccessRampLAN01] Number=266 Confirmed=N Filename=ARUpld32.exe Description=Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file, you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003 Source=Paul Collins Startup list [AcctMgr] Number=267 Confirmed=U Filename=AcctMgr.exe Description=Norton? Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information, and retrieves the data needed for email logins, shopping orders, banking, and other online activities - all from the safety of your own PC Source=Paul Collins Startup list [AccuWeather.com? Desktop] Number=268 Confirmed=N Filename=AccuWeatherDesktop.exe Description=Desktop weather from AccuWeather Source=Paul Collins Startup list [accwizz.exe] Number=269 Confirmed=X Filename=accwizz.exe Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [accwizzz.exe] Number=270 Confirmed=X Filename=accwizzz.exe Description=Added by the RULAND.A WORM! Source=Paul Collins Startup list [acdllib3] Number=271 Confirmed=X Filename=bcdlmem.exe Description=Added by the MAILBOT-BA TROJAN! Source=Paul Collins Startup list [ACDSee] Number=272 Confirmed=N Filename=ACDSee8Pro.exe Description=ACDSee 8 photo software. Organize, manage, enhance, and share all your valued photo memories Source=Paul Collins Startup list [Ace bows] Number=273 Confirmed=? Filename=Ace bows.exe Description=?? Source=Paul Collins Startup list [AceGain LiveUpdate] Number=274 Confirmed=N Filename=LiveUpdate.exe Description="AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates, driver updates or full product updates and automatically download and install them according to user configuration" Source=Paul Collins Startup list [Acer ePower Management] Number=275 Confirmed=U Filename=Acer ePower Management.exe Description=Part of Acer Empowering Technology. "Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles, or to create their own customized profiles" Source=Paul Collins Startup list [Acer ePresentation HPD] Number=276 Confirmed=N Filename=ePresentation.exe Description=Allows you to connect your Acer laptop to a projector Source=Paul Collins Startup list [Acer Product Registration] Number=277 Confirmed=N Filename=ACE1.exe Description=Acer Product Registration - remove when registration is completed Source=Paul Collins Startup list [Acer Tour Reminder] Number=278 Confirmed=N Filename=Reminder.exe Description=Popup reminder to take the tour of your new Acer laptop Source=Paul Collins Startup list [AcerGoto] Number=279 Confirmed=U Filename=AcerGoto.exe Description=Acer Computer "Goto Drive" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files, or easy importation of data from user's previous computer Source=Paul Collins Startup list [AcerNotebookManager] Number=280 Confirmed=U Filename=almxptray.exe Description=System Tray access on some Acer Notebooks to give faster access to system settings Source=Paul Collins Startup list [AcerPowerkey] Number=281 Confirmed=U Filename=Powerkey.exe Description=PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3 Source=Paul Collins Startup list [Acess2007a] Number=282 Confirmed=X Filename=access2007a.exe Description=Added by the GAOBOT.PQA WORM! Source=Paul Collins Startup list [Aceu] Number=283 Confirmed=X Filename=[random filename] Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [acEventServ] Number=284 Confirmed=Y Filename=acevtsrv.exe Description=ActivCard Gold from ActivIdentity, Inc. Smart card-based strong authentication software - for photo IDs, proximity badges for facility access and as digital identification and authentication Source=Paul Collins Startup list [AClntUsr] Number=285 Confirmed=U Filename=AClntUsr.exe Description=Altiris AClient Service Windows Tray Icon Source=Paul Collins Startup list [Acme.PCHButton] Number=286 Confirmed=N Filename=pchbutton.exe Description=Used by HP Instant Support Source=Paul Collins Startup list [ACMonitor_X63] Number=287 Confirmed=U Filename=ACMonitor_X63.exe Description=Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjuction with the "Lexmark Scan & Copy Control Program" button manager whose filename is "AcBtnMgr_X63.exe" Source=Paul Collins Startup list [ACMonitor_X73] Number=288 Confirmed=U Filename=ACMonitor_X73.exe Description=Button monitor for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Works in conjuction with the "Lexmark Scan & Copy Control Program" button manager whose filename is "AcBtnMgr_X73.exe" Source=Paul Collins Startup list [ACMonitor_X83] Number=289 Confirmed=U Filename=ACMonitor_X83.exe Description=Button monitor for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Works in conjuction with the "Lexmark Scan & Copy Control Program" button manager whose filename is "AcBtnMgr_X83.exe" Source=Paul Collins Startup list [ACMonitor_X84-X85] Number=290 Confirmed=U Filename=ACMonitor_X84-X85.exe Description=Button monitor for the Lexmark X85-X85 all-in-one multifunction printer/copier/scanner. Works in conjuction with the "Lexmark Scan & Copy Control Program" button manager whose filename is "AcBtnMgr_X85-X85.exe" Source=Paul Collins Startup list [acocash] Number=291 Confirmed=X Filename=fastdown.exe Description=Adult content dialler Source=Paul Collins Startup list [acocash] Number=292 Confirmed=X Filename=fastdown.exe Description=Adult content dialler Source=Paul Collins Startup list [Acombo3dmouse] Number=293 Confirmed=U Filename=Acombo3d.exe Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Aconti] Number=294 Confirmed=X Filename=aconti.exe Description=Adult content dialler Source=Paul Collins Startup list [acoustic] Number=295 Confirmed=U Filename=acoustic.exe Description=Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained Source=Paul Collins Startup list [acpart] Number=296 Confirmed=N Filename=agpart11.exe Description=Program for finding trucks on-line Source=Paul Collins Startup list [Acrobat] Number=297 Confirmed=X Filename=acrmon32.exe Description=Added by the SMALL-ECT TROJAN! Source=Paul Collins Startup list [Acrobat Assistant *.*] Number=298 Confirmed=U Filename=ACROTRAY.EXE Description=Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the "U" recommendation. *.* represents the version Source=Paul Collins Startup list [Acrobat Read] Number=299 Confirmed=X Filename=acroup32.exe Description=Added by the VANBOT-BQ TROJAN! Source=Paul Collins Startup list [Acrobat Speed Launch] Number=300 Confirmed=N Filename=acrobat_sl.exe Description=Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards Source=Paul Collins Startup list [ACROMOUSE] Number=301 Confirmed=U Filename=ACROMAPP.exe Description=Related to ACROMOUSE Laser mouse control Source=Paul Collins Startup list [Acronis Popup Blocker] Number=302 Confirmed=U Filename=RunDll32.exe [path] Blocker.dll, Run Description=Part of Acronis Privacy Expert - anti-spyware and security suite Source=Paul Collins Startup list [Acronis Scheduler Helper] Number=303 Confirmed=U Filename=schedhlp.exe Description=Part of Acronis True Image backup software. Co-operates with the "schedul2.exe" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images Source=Paul Collins Startup list [Acronis Scheduler2 Service] Number=304 Confirmed=U Filename=schedhlp.exe Description=Part of Acronis True Image - backup software. Co-operates with the "schedul2.exe" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images Source=Paul Collins Startup list [Acronis True Image] Number=305 Confirmed=U Filename=TimounterMonitor.exe Description=Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive Source=Paul Collins Startup list [Acronis True Image Monitor] Number=306 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [Acronis TrueImage Monitor] Number=307 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [AcronisTimounterMonitor] Number=308 Confirmed=U Filename=TimounterMonitor.exe Description=Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive Source=Paul Collins Startup list [AcronisTrueImage Monitor] Number=309 Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [Act! Preloader] Number=310 Confirmed=U Filename=Act8.exe Description=Sage Software's ACT! "enables individuals and small business customers to instantly access key contact and customer information, manage and prioritize activities, and track all contact-related communications so you can grow productive business relationships" Source=Paul Collins Startup list [Action Manager 32] Number=311 Confirmed=N Filename=am32.exe Description=Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs Source=Paul Collins Startup list [ActionAgent] Number=312 Confirmed=? Filename=actionagent.exe Description="A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client". Is it required? Source=Paul Collins Startup list [Activation] Number=313 Confirmed=N Filename=Activation.exe Description=Part of Microsoft Money Source=Paul Collins Startup list [Activboard] Number=314 Confirmed=U Filename=MMKeybd.exe Description=Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock, Caps Lock, Scroll Lock keys Source=Paul Collins Startup list [Active Bit Station] Number=315 Confirmed=X Filename=abs.exe Description=Added by the MYTOB.BZ WORM! Source=Paul Collins Startup list [Active CPU] Number=316 Confirmed=N Filename=acpu.exe Description=Active CPU - "easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity" Source=Paul Collins Startup list [Active Desktop Calendar] Number=317 Confirmed=U Filename=ADC.EXE Description=XemiComputers Active Desktop Calendar Source=Paul Collins Startup list [Active Email Monitor] Number=318 Confirmed=U Filename=aem25.exe Description=Active Email Monitor checks multiple accounts for email, serves as a SPAM filter and can also protect you from harmful items that can be sent via email Source=Paul Collins Startup list [Active shield] Number=319 Confirmed=U Filename=Activeshield.exe Description=Active Shield is "an heuristic screen that actively protects your computer from trojans, spyware, adware, trackware, dialers, keyloggers, and even some special kinds of viruses" Source=Paul Collins Startup list [ActiveDesktop] Number=320 Confirmed=X Filename=systray32.exe Description=Added by the DABOOM WORM! Source=Paul Collins Startup list [ACTIVEDS] Number=321 Confirmed=X Filename=ACTIVEDS.EXE Description=Added by the OPASERV.T WORM! Source=Paul Collins Startup list [ActiveEyes] Number=322 Confirmed=N Filename=ActiveEyes.exe Description=ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small, it's free and comes with a range of options and animations. Not needed - if unavailable via Start -> Programs, create your own shortcut Source=Paul Collins Startup list [ActiveKeys.AAB635BD7D054a37A576] Number=323 Confirmed=U Filename=akeys.exe Description="Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action" Source=Paul Collins Startup list [ActiveMenu] Number=324 Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case Source=Paul Collins Startup list [ActivePlus] Number=325 Confirmed=U Filename=activeplus.exe Description=Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on) Source=Paul Collins Startup list [ActiveScan Antivirus] Number=326 Confirmed=X Filename=ActiveScan.exe Description=Added by the RBOT-FKQ WORM! Source=Paul Collins Startup list [ActiveScript32] Number=327 Confirmed=X Filename=nod.exe Description=Added by the SOHANA-AJ WORM! Source=Paul Collins Startup list [ActiveShield] Number=328 Confirmed=Y Filename=MCVSSHLD.EXE Description=McAfee VirusScan On-line. See also the McAgentExe entry Source=Paul Collins Startup list [ActiveSpeed] Number=329 Confirmed=U Filename=AS.exe Description=Ascentive ActiveSpeed Internet Optimizer Source=Paul Collins Startup list [ActiveSync] Number=330 Confirmed=X Filename=wcescom32.exe Description=Added by the MANCSYN-E TROJAN! Source=Paul Collins Startup list [ActiveWords] Number=331 Confirmed=N Filename=AWMonitor.exe Description=ActiveWords from ActiveWord Systems, Inc. Like macro programs, ActiveWords sits in the background and watches as you type. When it recognizes that you?ve typed an ActiveWord, it takes the associated action, such as replacing your keystrokes with the text you?ve defined Source=Paul Collins Startup list [ActiveX File Registration Service] Number=332 Confirmed=X Filename=filereg.exe Description=Added by the RBOT-DVD WORM! Source=Paul Collins Startup list [ActiveX Streamer] Number=333 Confirmed=X Filename=msgfix.exe Description=Added by the SDBOT.NQ WORM! Source=Paul Collins Startup list [ActiveXUpdate] Number=334 Confirmed=X Filename=svcss.exe Description=Added by a variant of the DEDLER.C TROJAN! Source=Paul Collins Startup list [Activity] Number=335 Confirmed=U Filename=actik.exe Description=ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself! Source=Paul Collins Startup list [ActivSurf] Number=336 Confirmed=N Filename=backweb*****.exe Description=Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [ActMaker] Number=337 Confirmed=U Filename=ActMak25.exe Description="ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding, nor are you required to know a lot about the computer" Source=Paul Collins Startup list [ActMaker] Number=338 Confirmed=U Filename=ActMaker25.exe Description=ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload Source=Paul Collins Startup list [ACTray] Number=339 Confirmed=U Filename=ACTray.exe Description=System Tray icon for ThinkVantage Access Connections - "allowing users to seamlessly switch between wired and wireless environments, managing security settings, printers, home page and other location-specific settings automatically" Source=Paul Collins Startup list [Actual Window Minimizer] Number=340 Confirmed=U Filename=ActualWindowMinimizerCenter.exe Description=Actual Window Minimizer - "allows minimizing any window to task tray notification area or to the edge of the screen" Source=Paul Collins Startup list [ACTX1] Number=341 Confirmed=X Filename=v1201.exe Description=Added by the VB.IS TROJAN! Source=Paul Collins Startup list [ACU] Number=342 Confirmed=U Filename=ACU.exe Description=Atheros wireless Client Utility Source=Paul Collins Startup list [ACU_QSB] Number=343 Confirmed=U Filename=ACU.exe Description=Atheros wireless Client Utility Source=Paul Collins Startup list [ACWLIcon] Number=344 Confirmed=U Filename=ACWLIcon.exe Description=Related to IBM ThinkVantage Connectivity Solution Source=Paul Collins Startup list [Ad Blocker] Number=345 Confirmed=U Filename=blocker.exe Description=Ad Blocker - blocks popups, and also removes banners, image ads and flash ads Source=Paul Collins Startup list [Ad Blocker Pro] Number=346 Confirmed=U Filename=Ad Blocker Pro.exe Description=Ad Away popup and banner remover Source=Paul Collins Startup list [Ad Muncher] Number=347 Confirmed=U Filename=AdMunch.exe Description=Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications Source=Paul Collins Startup list [Ad Online Guide] Number=348 Confirmed=? Filename=adonlineguide.exe Description=?? Source=Paul Collins Startup list [Ad-aware] Number=349 Confirmed=U Filename=Ad-aware.exe Description=Ad-aware from Lavasoft - popular spyware/adware removal tool Source=Paul Collins Startup list [Ad-Aware] Number=350 Confirmed=X Filename=Ad-Aware.exe Description=Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-aware spware/adware removal tool and is located in the Winnt\System32 or Windows\System32 directory Source=Paul Collins Startup list [Ad-Eliminator] Number=351 Confirmed=X Filename=ad-eliminator.exe Description=Ad-Eliminator spyware remover - not recommended, see here Source=Paul Collins Startup list [Ad-Muncher] Number=352 Confirmed=U Filename=ADMUNCH.EXE Description=Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications Source=Paul Collins Startup list [Ad-Protect] Number=353 Confirmed=U Filename=ad-protect.exe Description=Ad-Protect spyware and spam monitoring tool Source=Paul Collins Startup list [Ad-watch] Number=354 Confirmed=U Filename=Ad-watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [AD2KClient] Number=355 Confirmed=U Filename=AD2KClient.exe Description=Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip? disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [Adaptec DirectCD] Number=356 Confirmed=N Filename=Directcd.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [AdaptecDirectCD] Number=357 Confirmed=N Filename=Directcd.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [AdAware] Number=358 Confirmed=X Filename=wini.exe Description=Added by the RBOT-XN WORM! Source=Paul Collins Startup list [Adaware Bootup] Number=359 Confirmed=U Filename=ad-aware.exe Description=Ad-aware from Lavasoft - popular spyware/adware removal tool Source=Paul Collins Startup list [Adaware lptt01] Number=360 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [Adaware ml097e] Number=361 Confirmed=X Filename=adaware.exe Description=RapidBlaster variant (in a "Adaware" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [AdBin] Number=362 Confirmed=U Filename=AdBin.exe Description=AdBin - "Free and easy solution to managing your Window's hosts file. A fun way to block ads" Source=Paul Collins Startup list [Add**.exe [* = random char]] Number=363 Confirmed=X Filename=Add**.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [Add**32.exe [* = random char]] Number=364 Confirmed=X Filename=Add**32.exe [* = random char] Description=CoolWebSearch/HomeSearch adware - for examples, see this log Source=Paul Collins Startup list [AddClass] Number=365 Confirmed=X Filename=AddClass.exe Description=CoolWebSearch Addclass parasite variant Source=Paul Collins Startup list [AddClass] Number=366 Confirmed=X Filename=[Installation_Path] Description=Added by the STARTPAGE.F hijacker Source=Paul Collins Startup list [AddClass] Number=367 Confirmed=X Filename=[path to trojan] Description=Added by the SECDL-A TROJAN! Source=Paul Collins Startup list [AdDelete] Number=368 Confirmed=U Filename=AdDelete.exe Description=Banner advertisment blocker Source=Paul Collins Startup list [AdDestroyer] Number=369 Confirmed=X Filename=AdDestroyer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here Source=Paul Collins Startup list [ADDITIONAL Services] Number=370 Confirmed=X Filename=pkgadd.exe Description=Added by a variant of the IRCBOT TROJAN! Source=Paul Collins Startup list [addproxy] Number=371 Confirmed=? Filename=addproxy.exe Description=Related to Adobe Photoshop Source=Paul Collins Startup list [ADG] Number=372 Confirmed=? Filename=ADG.exe Description= SoundBlaster Audigy related? Source=Paul Collins Startup list [ADGJdet] Number=373 Confirmed=N Filename=ADGJDet.exe Description=Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Source=Paul Collins Startup list [aDir] Number=374 Confirmed=X Filename=adirss.exe Description=Added by the SPAMSRV-E TROJAN! Source=Paul Collins Startup list [Adiras] Number=375 Confirmed=Y Filename=Adiras.exe Description=ADSL USB modem related Source=Paul Collins Startup list [adirka] Number=376 Confirmed=X Filename=adirka.exe Description=Added by the TIBS-QT TROJAN! Source=Paul Collins Startup list [AdKiller] Number=377 Confirmed=U Filename=AD Defender.exe Description=Part of Advanced Spyware Remover anti-spyware tool Source=Paul Collins Startup list [adlhidp] Number=378 Confirmed=X Filename=psncc32.exe Description=Detected by Kaspersky as the SLAPER.AI TROJAN! See here Source=Paul Collins Startup list [ADM Library Loader] Number=379 Confirmed=X Filename=admlib32.exe Description=Added by a variant of the SDBOT TROJAN! Source=Paul Collins Startup list [Admanager Controller] Number=380 Confirmed=X Filename=AdManCtl.exe Description=Adware, probably a Windupdates variant Source=Paul Collins Startup list [Admilli Service] Number=381 Confirmed=X Filename=AdmilliServ.exe Description=Windupdates adware variant Source=Paul Collins Startup list [Administrator] Number=382 Confirmed=X Filename=svchost.scr Description=Added by the NOVACAL TROJAN! Source=Paul Collins Startup list [Administrator] Number=383 Confirmed=X Filename=winlogon.exe Description=Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! Source=Paul Collins Startup list [Administrator di Dago] Number=384 Confirmed=X Filename=Dago.exe Description=Added by the PUNYA-B WORM! Source=Paul Collins Startup list [AdminSoft] Number=385 Confirmed=X Filename=sysfile.vbs Description=Added by the STARGRUB-A WORM! Source=Paul Collins Startup list [admtray.exe] Number=386 Confirmed=U Filename=admtray.exe Description=Related to Acer Inc. destop tray Source=Paul Collins Startup list [Adobe] Number=387 Confirmed=X Filename=Adobe.exe Description=Added by an unidentified VIRUS, WORM or TROJAN! Source=Paul Collins Startup list [Adobe] Number=388 Confirmed=X Filename=sysconfig.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [adobe] Number=389 Confirmed=X Filename=gam.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [Adobe] Number=390 Confirmed=X Filename=sysbat32.exe Description=Added by the LOWZONES.T TROJAN! Source=Paul Collins Startup list [Adobe] Number=391 Confirmed=X Filename=zteam.exe Description=Added by an unidentified TROJAN! Source=Paul Collins Startup list [Adobe Acrobat] Number=392 Confirmed=N Filename=READER~1.EXE Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Acrobat Distiller Application] Number=393 Confirmed=X Filename=acrotray.exe Description=Added by the RANDEX.DFJ WORM! Source=Paul Collins Startup list [Adobe Acrobat Reader CFG] Number=394 Confirmed=X Filename=[random filename] Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Adobe Acrobat Speed Launcher] Number=395 Confirmed=N Filename=acrobat_sl.exe Description=Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards Source=Paul Collins Startup list [Adobe Filter Platform] Number=396 Confirmed=X Filename=afilterplatform.exe Description=Added by the RBOT-OP WORM! Source=Paul Collins Startup list [Adobe Gamma Loader] Number=397 Confirmed=U Filename=Adobe Gamma Loader.exe Description=Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine Source=Paul Collins Startup list [Adobe Photo Downloader] Number=398 Confirmed=N Filename=apdproxy.exe Description=Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here) Source=Paul Collins Startup list [Adobe Reader Speed Launch] Number=399 Confirmed=N Filename=Reader_sl.exe Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Reader Speed Launch] Number=400 Confirmed=N Filename=READER~1.EXE Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Reader Speed Launcher] Number=401 Confirmed=N Filename=Reader_sl.exe Description=Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly Source=Paul Collins Startup list [Adobe Reader Synchronizer] Number=402 Confirmed=U Filename=AdobeCollabSync.exe Description=Adobe Synchronizer - installed along with Adobe Reader 8.x. "Synchronizer is a small application that runs in the background, providing synchronization of document reviews and Tracker subscriptions so that your data is available when you need it." See the link for more information Source=Paul Collins Startup list [Adobe Version Cue CS2] Number=403 Confirmed=U Filename=VersionCueCS2Tray.exe Description=File manager that's part of Adobe Creative Suite 2 - "find files fast, track versions across applications, link files together, and share them in creative collaboration without fear of overwriting someone else's work" Source=Paul Collins Startup list [AdobeA] Number=404 Confirmed=X Filename=adobes.exe Description=Added by the FLOOD.BA TROJAN! Source=Paul Collins Startup list [AdobeFonts] Number=405 Confirmed=X Filename=fonts.hta Description=Browser hijacker - redirecting to Hugesearch.net Source=Paul Collins Startup list [adobemgr] Number=406 Confirmed=X Filename=adobemgr.exe Description=Added by the ADCLICKER TROJAN! Source=Paul Collins Startup list [AdobeReader] Number=407 Confirmed=X Filename=msni.exe Description=Added by the RBOT.DAO TROJAN! Source=Paul Collins Startup list [AdobeReaderPro] Number=408 Confirmed=X Filename=msnxpsp.exe Description=Added by the RBOT-ASK or RBOT-AUS WORMS! Source=Paul Collins Startup list [AdobeReaderPro] Number=409 Confirmed=X Filename=ntkernell32.exe Description=Added by the RBOT-ATY WORM! Source=Paul Collins Startup list [AdobeReaderPro] Number=410 Confirmed=X Filename=msnserve.exe Description=Added by the SDBOT-AKH WORM! Source=Paul Collins Startup list [AdobeReaderPro] Number=411 Confirmed=X Filename=updt.exe Description=Added by the IRCBOT-VQ WORM! Source=Paul Collins Startup list [AdobeReaderProfessional] Number=412 Confirmed=X Filename=msx64.exe Description=Added by the RBOT-GAT WORM! Source=Paul Collins Startup list [AdobeReaderPros] Number=413 Confirmed=X Filename=sysmsn.exe Description=Added by the RBOT-BGH WORM! Source=Paul Collins Startup list [AdobeUpdater] Number=414 Confirmed=N Filename=AdobeUpdater.exe Description=Automatic updater for Adobe software - run manually Source=Paul Collins Startup list [AdobeVersionCue] Number=415 Confirmed=N Filename=VersionCueTray.exe Description="An exclusive feature of the Adobe? Creative Suite, Version Cue? helps you find files fast, track multiple versions of your files, and share your files for creative collaboration" Source=Paul Collins Startup list [adodemaster] Number=416 Confirmed=X Filename=adodemaster.exe Description=Downloader of Korean origin, detected as ADOD.28672 Source=Paul Collins Startup list [Adope File Manager] Number=417 Confirmed=X Filename=lsasv.exe Description=Added by an unidentified WORM or TROJAN! Source=Paul Collins Startup list [adp] Number=418 Confirmed=X Filename=adp.exe Description=Spyware installed by Net2Phone, Limewire, Cydoor, Grokster, KaZaa, etc Source=Paul Collins Startup list [AdPopup] Number=419 Confirmed=X Filename=dcf5678.exe Description=Added by the AGENT-FZ TROJAN! Source=Paul Collins Startup list [adprot] Number=420 Confirmed=X Filename=adprot.exe Description=AdBlaster adware Source=Paul Collins Startup list [ADQuickAccess] Number=421 Confirmed=N Filename=Adtray.exe Description=After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95 Source=Paul Collins Startup list [ADriver] Number=422 Confirmed=X Filename=windrv.exe Description=Added by the DELF.WG TROJAN! Source=Paul Collins Startup list [AdRoarUpdate] Number=423 Confirmed=X Filename=ARUpdate.exe Description=AdRoar adware updater Source=Paul Collins Startup list [AdRotator.Application] Number=424 Confirmed=X Filename=[path to csrss.exe] Description=Added by the SMALL-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! Source=Paul Collins Startup list [AdRotator.Application] Number=425 Confirmed=X Filename=services.exe Description=FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an "Inetsrv" subfolder Source=Paul Collins Startup list [ADS Adware Remover] Number=426 Confirmed=X Filename=ADS Adware Remover.exe Description=ADS Adware Remover - not recommended, see here Source=Paul Collins Startup list [AdsBlocker] Number=427 Confirmed=X Filename=stopAds.exe Description=Reported as DILAER.DW by NOD32 Source=Paul Collins Startup list [AdsCleaner] Number=428 Confirmed=U Filename=AdsCleaner.exe Description="AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad, kill popup), guard your online privacy" Source=Paul Collins Startup list [ADService] Number=429 Confirmed=U Filename=ADService.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip? disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [AdsGone] Number=430 Confirmed=U Filename=Adsgone.exe Description=AdsGone - pop-up stopper Source=Paul Collins Startup list [ADSL Diagnostic Tools] Number=431 Confirmed=N Filename=mapiicon.exe Description=System tray access to ADSL modem diagnostic tools. Available via Start -> Programs Source=Paul Collins Startup list [ADSLSYSTEMTRAY] Number=432 Confirmed=? Filename=SystemtrayV100B.exe Description=Apparently Annex A ADSL modem related. What does it do and is it required? Source=Paul Collins Startup list [AdslTaskBar] Number=433 Confirmed=Y Filename=rundll32.exe stmctrl.dll, TaskBar Description=ISP software, initializes DSL modem Source=Paul Collins Startup list [AdslTaskBars] Number=434 Confirmed=X Filename=taskmng.exe Description=Added by the RBOT-AXZ WORM! Source=Paul Collins Startup list [ADSL_A2] Number=435 Confirmed=? Filename=A2Installed Description=Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required? Source=Paul Collins Startup list [ADSS] Number=436 Confirmed=Y Filename=ADSS.exe Description=ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied Source=Paul Collins Startup list [adstartup] Number=437 Confirmed=X Filename=automove.exe Description=Adlogix adware variant Source=Paul Collins Startup list [adstartup] Number=438 Confirmed=X Filename=Adstartup.exe Description=Adlogix adware variant Source=Paul Collins Startup list [AdStatus Service] Number=439 Confirmed=X Filename=AdStatServ.exe Description=WindUpdates AdStatus Service adware Source=Paul Collins Startup list [AdSubtract] Number=440 Confirmed=U Filename=adsub.exe Description=AdSubtract blocks ads, cookies, pop-up windows, animations, music, and more. Can be disabled from within AdSubtract. Available via Start -> Programs. Now superseeded by Trend Micro AntiSpyware Source=Paul Collins Startup list [adtech2005] Number=441 Confirmed=X Filename=adtech2005.exe Description=Detected by Kaspersky as the STARTPAGE.AW TROJAN! Source=Paul Collins Startup list [adtech2006] Number=442 Confirmed=X Filename=adtech2006.exe Description=Detected by Kaspersky as the VB.KC WORM! Source=Paul Collins Startup list [Adtools Service] Number=443 Confirmed=X Filename=AdTools.exe Description=Windupdates Adware Source=Paul Collins Startup list [ADU] Number=444 Confirmed=? Filename=adu.exe Description=Related to Cisco Aironet wireless products. What does it do and is it required? Source=Paul Collins Startup list [AdultX] Number=445 Confirmed=X Filename=AdultX.exe Description=Adult content dialler and hijacker Source=Paul Collins Startup list [Adult_Chat] Number=446 Confirmed=X Filename=Adult_Chat.exe Description=Adult content dialler Source=Paul Collins Startup list [Adult_Chat1] Number=447 Confirmed=X Filename=Adult_Chat1.exe Description=Adult content dialler Source=Paul Collins Startup list [AdUpdater] Number=448 Confirmed=X Filename=sysupudt.exe Description=Unidentified adware downloader/updater Source=Paul Collins Startup list [ADUserMon] Number=449 Confirmed=U Filename=ADUserMon.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip? disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [Advanced DHTML Enable] Number=450 Confirmed=X Filename=exo32.exe Description=Added by the RANCK-FI TROJAN! Source=Paul Collins Startup list [Advanced DHTML Enable] Number=451 Confirmed=X Filename=[path to trojan] Description=Added by the AGENT.GLQ TROJAN! Source=Paul Collins Startup list [Advanced Internet Protocol] Number=452 Confirmed=X Filename=cerf.exe Description=Added by a variant of the SPYBOT WORM! Source=Paul Collins Startup list [Advanced Protection System] Number=453 Confirmed=X Filename=advpsys.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Advanced Spyware Remover] Number=454 Confirmed=U Filename=Asr.exe Description=Advanced Spyware Remover anti spyware tool Source=Paul Collins Startup list [Advanced Tool Checks] Number=455 Confirmed=X Filename=advchks.exe Description=Added by a variant of the RBOT WORM! Source=Paul Collins Startup list [Advanced Tools Check] Number=456 Confirmed=N Filename=ADVCHK.EXE Description=Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Source=Paul Collins Startup list [Advanced Uninstaller PRO Installation Monitor] Number=457 Confirmed=U Filename=monitor.exe Description=Innovative Solutions Advanced Uninstaller PRO - "easy-to-use suite for uninstalling applications and keeping your computer fast, clean, and in its best shape" Source=Paul Collins Startup list [AdvancedCleaner Free] Number=458 Confirmed=X Filename=UADC.exe Description=AdvancedCleaner misleading security software - not recommended, see here Source=Paul Collins Startup list [AdVantage] Number=459 Confirmed=X Filename=AdVantage.exe Description=MediaAdVantage adware Source=Paul Collins Startup list [advap32] Number=460 Confirmed=X Filename=[path to trojan] Description=Detected by Trend Micro as the MUTANT.AT TROJAN! See here Source=Paul Collins Startup list [Advapi] Number=461 Confirmed=X Filename=Advapi.exe Description=Added by the NETDEVIL.12 WORM! Source=Paul Collins Startup list [ADVCHK] Number=462 Confirmed=N Filename=ADVCHK.EXE Description=Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Source=Paul Collins Startup list [Advertising Killer] Number=463 Confirmed=U Filename=Akiller.exe Description=Advertising Killer - popup stopper Source=Paul Collins Startup list [advmon32] Number=464 Confirmed=X Filename=advmon32.exe Description=Added by a variant of the CRYPTER.C TROJAN! Source=Paul Collins Startup list [Adware Agent] Number=465 Confirmed=U Filename=adware agent.exe Description=Adware Agent popup blocker Source=Paul Collins Startup list [Adware Spy] Number=466 Confirmed=X Filename=AdwareSpy.exe