Start-Up Applications - All

Last update :- 31st July, 2005
10247 items listed

Introduction

This page presents a searchable, comprehensive list of the programs you may find that run when you switch on your PC as typically identified by MSCONFIG or the registry "Run" keys - and whether you need them.

Close Program/Task Manager

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Operating System Differences

A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Noeton eMail Protect" in the registry.

To avoid the list becoming too large, all VIRUSES are shown using the registry version which is common to all Windows versions.

Random startup entry/filename viruses

There are viruses and other pests that can add any number of different entries to the startups. They make additional entries under the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\ Run and RunOnce keys, allowing them to run at startup. In all cases below, %system% is a variable - by default this is C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP):

1. PE_BISTRO - adds "XXXX"="C:\WINDOWS\XXXX.EXE" - where XXXX is the randomly chosen filename of the dropped file
2. MAGISTR.A - adds "[Virus file name]"="[Virus Path and file name].EXE"
3. BUGBEAR.A or BUGBEAR.C or BUGBEAR.E - adds ""=%System%\"[random filename].EXE"
4. OPTIXPRO.11 - adds "%Registry entry%"="%Path%\%Filename%"
5. Lop.com homepage hijacker - adds multiple and random startup entries
6. FreeScratchAndWin - adds multiple and random startup entries as it includes LOP above
7. nCase (or n-Case) parasite - adds multiple and random startup entries
8. LORAC - adds "[four random characters]"="%Sysdir%\abcdef.exe"
9. MOSUCK - random name and filename in C:\Windows or C:\Winnt
10. DEBORMS.D - adds one of a number of valid Name/Startup Item entries but points to the path of the worm file dropped
11. GIBE.C - adds random name and filename in C:\Windows or C:\Winnt
12. SWEN.A - adds random name and filename
13. ZOMBAM.B - adds random name and filename
14. WANADO or REUR - adds "XXXXXXXX"="%Sysdir%\XXXXXXXX.exe" where X can be any random hexadecimal (0-9, A-F) number
15. SINCOM - adds random name and filename in C:\Windows or C:\Winnt with "Run:Auto" appended to the command/data column entry
16. SOBER family - adds "[random string]"="%system%\[random filename.exe]"
17. BRANCOS.C - adds "win_[4 random characters][4 random numbers 0-9]"="%System%\SYS_386X\[4 random characters][4 random numbers 0-9].exe"
18. IRC.BOT.B - adds random name and filename
19. COREFLOO-C - adds "[random filename]"="rundll32 %SYSTEM% [random filename].dll,Init 1"
20. [random digits].exe = [random digits].exe - 8 random digits, example: 77231997.exe = 77231997.exe. Winpup.exe adult content downloader
21. DRAGONQQ - "[Trojan's filename]"="[Path to the Trojan]", "[Random name]"="C:\WINNT\[Random name].exe", "[Random name]"="C:\Program Files\[Random name].exe" or "[Random name]"="C:\WINDOWS\[Random name].exe"
22. FORMADOR - adds "[executed file name]"="%System%\[executed file name].exe"
23. NETTRASH - adds "[file name]"="[path to filename].exe"
24. OPTIXPRO.13B - adds "[registry value name]"="[path to trojan].exe"
25. MYDOOM.F or MYDOOM.G or MYDOOM.H - adds "[4 to 8 random, lowercase letters]"="[worm filename]"
26. ANNIL - adds random name and filename
27. ANTINNY.G and ANTINNY.K - adds "[random name]"="[path to worm]"
28. KILLAV.D - adds "[Trojan filename]"="%Windir%\[Trojan file name]" where %Windir% is C:\Windows or C:\Winnt
29. MYPOO - adds "[value name]"="[Trojan file name]" where [value name] is configurable
30. BLACKMAL or BLACKMAL.B - adds "[random_file_name1].exe"="%System%\[random_file_name1].exe"
31. ERKEX.A - adds "[random_file_name]"="%System%\[random_file_name].exe"
32. OPASA - adds "[random_file_name]"="%System%\[random_file_name].exe"
33. GAOBOT.ADN - adds random name and filename
34. ADWAHECK - adds "[trojan name]"="%System%\[trojan filename]"
35. GOBOT.A - adds random name and filename in C:\Windows or C:\Winnt
36. Sandboxer adware - adds random name and filename
37. AGENT.B - adds "[1-5 random characters]"="RUNDLL32 %System%\[DLL filename].dll,StreamingDeviceSetup"
38. EXRUNTEL - adds "[original filename]"="%System%\[original filename]"
39. Margoc adware - adds random name and filename
40. Winpup adware - adds random name and filename in %System%
41. KETCH - adds "[word]"="%System%\[word][number].exe"
42. DARBY.B - adds "[random worm filename]"="%System%\[random worm filename]"
43. VUNDO - adds "*[trojan name]"="[trojan path]"
44. BEAKER.A - adds "[5 random lower-case char]"="[5 random lower-case char].exe" in the System, system32, Temp and Fonts sub-directories of %Windir%
45. LIFEFORENOW - adds "[random filename]"="%System%\[random filename].exe"
46. DIMI - adds "[random value name]"="%System%\[random filename].exe"
47. ABEBOT - adds "[random service name]"="[random filename].exe -services"
48. OMEGA - adds "[random value]" = "%Windir%\[random file name].exe"
49. NAMSHARE - adds "[Random service name]" = "[Random file name]"
50. REANET.B - adds "[file name]" = "[path to file name]"
51. BANCOS.Q - adds "[filename prefix]" = "[path to filename]"
52. SPYBOTER.GEN - adds "[key name]" = "[file name of Trojan]"
53. BOTUK - adds "[random characters]Srv32" = "[random characters]srv.exe"

Spyware/Adware/Malware/Foistware & Hijackers

Check CastleCops for information about these types of program. They have very active forums. You may also want to try SpywareInfo for their forums and a list of startup program managers

o-----------------------------o

Search Query Courtesy of Dynamic Drive
Press Alt+S if an entry is found to continue searching

This search works with IE4+, NS4 and Mozilla/NS7+ but not NS6. Alternatively use your browsers search facility - Ctrl+F for IE users.

Key:

• "Y" - Normally leave to run at start-up

• "N" - Not required - typically infrequently used tasks that can be started manually if necessary

• "U" - User's choice - depends whether a user deems it necessary

• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"

• "?" - Unknown




	Name/Startup Item	Command	Comments
X		system32.exe	Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field
X		pathex.exe	Added by the MKMOOSE-A WORM!
X	SystemBoot	services.exe	Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X	WinStart	services.exe	Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X	winsystem.sys	smss.exe	Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!
Y	!1_pgaccount	pgaccount.exe	DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks. You will see one instant of pgaccount.exe for every active account on your system, and this is essential for PG to work properly
Y	!1_ProcessGuard_Startup	procguard.exe	DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background, as well as a variety of other attacks
N	!NoLoad	winrecon.exe	WinRecon - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it
?	$EnterNet	Enternet.exe	Connection manager for the EnterNet ISP. You can also use RASPPOE
X	$WindowsRegKey%update	IEXPLORE.EXE	Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which should not appear in Msconfig/Startup unless you add it manually!
N	%cmpmixtitle%	%cmpmixstr%	Possibly related to C-Media Mixer Control panel?
?	%FP%012-L2TP fts.exe	fts.exe	012.Net ISP software - what does it do and is it required?
?	%FP%012-L2TP FWPortal.exe	FWPortal.exe	012.Net ISP software - what does it do and is it required?
?	%FP%1776 Internet fts.exe	fts.exe	1776 Internet ISP software - what does it do and is it required?
?	%FP%1776 Internet FWPortal.exe	FWPortal.exe	1776 Internet ISP software - what does it do and is it required?
?	%FP%Barak013 fts.exe	fts.exe	Barak013 ISP software - what does it do and is it required?
?	%FP%Barak013 FWPortal.exe	FWPortal.exe	Barak013 ISP software - what does it do and is it required?
?	%FP%Friendly fts.exe	fts.exe	Friendly ISP software - what does it do and is it required?
X	(*)API Machine	winSOCKS.exe	Homepage hijacker, see here (* = any digit)
X	(*)Run	win32API.exe	Homepage hijacker, see here (* = any digit)
X	(default)	[random filename].exe	Added by the BLACKMAL WORM!
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	Added by the ASSIRAL.B WORM!
X	*JanisRuckenbrodII	janis.com	Added by the POPS WORM!
X	*Microsoft Update	ctxma.exe	Added by the STMU TROJAN!
X	*Microsoft Update	cxma.exe	Added by the STMU TROJAN!
X	*Microsoft Update	wstcl.exe	Added by the STMU TROJAN!
X	*Microsoft Update	wucxt.exe	Added by the STMU TROJAN!
X	*Microsoft Update	wuytc.exe	Added by the STMU TROJAN!
X	*MS Setup	[random filename]	Virtumondo adware, also known as the VUNDO TROJAN!
X	*Security Center	secctr.exe	Added by the SDBOT.BRO WORM!
Y	*StateMgr	statemgr.exe	Windows ME default for System Restore. Do NOT disable!
X	*windows update	wrauclt.exe	Added by the RBOT-QU WORM!
X	*windows update	wuanclt.exe	Added by the RBOT-PG WORM!
X	*windows update	wuaucrlt.exe	Added by the SPYBOT.HUR WORM!
X	*windows update	wuraclt.exe	Added by the RBOT-PO WORM!
X	*windows update	wurauclt.exe	Added by the RBOT-SY WORM!
X	*windows update	wsctl.exe	Added by the SPYBOT.PR WORM!
X	*windows update	wkmst.exe	Added by the SDBOT.AVD WORM!
X	*windows update	wscxt.exe	Added by the RBOT.AOS WORM!
X	*windows update	waurclt.exe	Added by a variant of the RBOT WORM!
X	*WinLogon	[trojan path] ren time:[random number]	Added by the VUNDO TROJAN!
X	*wuauclt.exe	wxmct.exe	Added by an unidentified WORM or TROJAN!
X	*wuauclt.exe	w****.exe [* = random char]	Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe, wtmsv.exe, wxmst.exe, wmsvc.exe and so on...
X	,main drive Loader	wininfo.exe	Suspected malware as it appears in 3 different registry locations - see here
X	.mscdr	lassa.exe	Added by the WEBUS.C TROJAN!
X	.mscdr	lsvchost.exe	Added by the WEBUS.D TROJAN!
X	.mscdsr	lsvchost.exe	Added by the CR TROJAN!
X	.mscsbl	svhost.exe	Added by the CMQ TROJAN!
X	.msfupdate	msveup.exe	Added by the ALLOCUP.A WORM!
X	.mssecure	mssecure.exe	Added by the DDOS_BOXED.X TROJAN!
?	.NET config	sysmon32.exe	??
X	.norton	rchost.exe	Added by a variant of the BOXED-A TROJAN!
X	.Prog	services.exe	Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X	.Prog	winlogon.exe	Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup!
X	.svchost	CSRSS.EXE	Added by the WEBUS.F TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
X	.TEXTCONV	csrss.exe	Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
X	.TEXTCONV	lsass.exe	Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup!
X	.WMAudio	csrss.exe	Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
X	.WMAudio	lsass.exe	Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup!
N	/l:eng	N/A	Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it's easily available using the search function
U	000	pit.exe	Added by the PrivateEye surveillance software! Note - If you did not intentionally install this remove it
X	000hpdllhos	hpdllhost.exe	LZIO.com adware downloader
U	000StTHK	000StTHK.exe	Toshiba Hot key functionality for the function keys (Fn-Esc, Fn-F1 (lock), Fn-F2, Fn-F3, Fn-F4, Fn-F5 (switching between laptop and CRT display output), etc...)
U	00THotkey	00THotKey.exe	For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev.
U	0190 Warner	WARN0190.EXE	Anti-dialer program (Germany)
U	0900 Warner	WARN0900.EXE	Anti-dialer program (Germany)
X	0utlook Express	*****.exe [* = random char]	Added by the RBOT-CC WORM! Note the first letter is actually the digit "0" and not a capital "o"
X	1	1.exe	Added by the ESTEEMS TROJAN!
X	1111swapmgr.exe	1111swapmgr.exe	Added by the IC TROJAN!
X	123456	rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl	Added by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number
U	12Ghosts Popup-Killer	12popup.exe	12Ghosts Popup-Killer
?	17779Proj2002	N/A	??
X	180adsolution	180adsolution.exe	180Solutions/N-Case adware variant
X	180ax	180ax.exe	180Solutions/N-Case adware variant
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	180Solutions adware related
X	180ClientStubInstall	[path to trojan]	180Solutions adware related
N	1:	hpdrv.exe	HP utility for monitoring when and how many recoveries have been done
N	1A:MacVisionTrayMonitor	TrayMonitor.exe	Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock)
Y	1A:Stardock MCP	mcpserver.exe	Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
?	1CmailS	NETMAIL.EXE	??
X	1on1	1on1.exe	Adult content dialler
U	1Srv32	SpyAgent4.exe	SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC."
U	1Win32Cfg	SpyBuddy.exe	SpyBuddy monitoring software
U	1Win32Cfg	Keyloggerpro.exe	KeyloggerPro - monitoring software
X	1WinCfg32	WebMailSpy.exe	WebMailSpy spyware
X	2020Downloader	mssvr.exe	2020Search Toolbar related. Reported to be auto-installed
X	27	slsorve.exe	Added by the SLSORVE-A TROJAN!
X	2thousandbuck	[path to file]	Added by the RANKY.L TROJAN!
U	2wSysTray	2portalmon.exe	2Wire Homeportal user interface
X	32-bit Thunking service	thunk32.exe	Added by the DERDERO.A WORM!
?	39ELTFH25Z8SKF	Ezg1q5.exe	Seems to be associated with software by Resplendence SP ?
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	3Com WinModem driver. See here for more WinModem information
Y	3capplnk	3capplnk.exe	US Robotics Modem driver
N	3cdminic	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3CM Link	3cmcnkw.exe	Required for a US Robotics WinModem as it provides the link to Windows - won't work without it
Y	3Cmlink	3CmlinkW.exe	For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information
N	3ComDMIAgent	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	3D Text	3D Text.scr	Added by the JERMY.A WORM!
U	3Deep Control Panel	3DeepCTL.EXE	From LightSurf Technologies (nee E-Color) - 3Deep corrects lighting, shading and color for all your 2D and 3D games
X	3Dfx Acc	GFXACC.EXE	Added by the GIBE WORM!
N	3dfx Task Manager	3dfxMan.exe	System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
Y	3dfx Tools	3dfxCmn.dll	Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
Y	3dfxv2ps.dll	3dfxv2ps.dll	Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
?	3Dlabs Taskbar Display Manager	3DLman.exe	3DLabs graphics driver related. System Tray access to display settings?
U	3DLabsHelperDemon	3dldemon.exe	Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore), so it should take zero CPU time and virtually zero memory, since it will all be paged out to the hard drive." In most cases it can be safely disabled
Y	3DMouse.EXE	3DMouse.EXE	Dritek System Inc. 3D Mouse driver
U	3qdctl.exe	3qdctl.exe	Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup, restoring volume and other audio settings to a pre-determined default. Similar to Creative Lab's AudioHQ
Y	3ware 3DM	3dm.exe	Monitors status of the disk array on 3ware IDE RAID controllers
X	4wd!!!	Natal!.pif	Added by the OPASERV.AI WORM!
X	5-1-61-96	members-area.exe	Adult content dialler
X	5-2-46-112	5-2-46-112.exe	Adult content pop-up dialler. Removal instructions here
X	55278	grepclient1.exe	Added by the LINEAGE-S TROJAN!
X	666	Ska.exe	Added by the PIPES TROJAN!
X	678	lsas32.exe	Added by the SLSORVE-B TROJAN!
Y	9xadiras	9xadiras.exe	Allied Telesyn AT series router/modem related - apparently required
X	9xHtProtect	AVprotect9x.exe	Added by the NETSKY.M WORM!
X	;Rundll	[filename]	Added by the PWSLEGMIR.E TROJAN!
X	@	regedit -s ..win.dll	Added by the SEEKER.K TROJAN!
N	@Hoc Toolbar	AtHoc.exe	One-click activated browsing toolbar used by various web-sites. See here for more info
N	@loha	reminder.exe	Registration reminder for @loha@home E-mail utility
X	@tour_ww	@tour_ww[1].exe	Adult content dialler
X	a	a.exe	Commercials file that registers itself in the system registry and redirects IE to a certain commercial website
X	A New Windows Updater	w32NTupdt.exe	Added by MYTOB.BM WORM!
U	a-squared	a2guard.exe	a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a² 'Background Guard' real time protection feature
Y	a-winpoet-service	winpppoverethernet.exe	WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking
U	A1000 Settings Utility	cpqa1000.exe	Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan, print, copy and fax. Only required if you use these features
U	A4Proxy	A4Proxy.exe	Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites
?	AAACLEAN	AAACLEAN.INF	??
?	AAAKeyboard	??	??
N	AAATraySaver	TraySaver.exe	System Tray management utility from Mike Lin which allows you to hide, show, restore icons that are lost in an Explorer crash, remove dead tray icons, minimize any window to the System Tray
U	AAK	aak.exe	Advanced Anti-Keylogger - "Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere"
X	Aaou	amee.exe	PurityScan/Clickspring adware
X	Aapp	adprot.exe	AdBlaster adware
?	aauclient	ACNUpdater.exe	Appears to be related to software from Accenture.comF1527
?	ab EazyScheduler	ezsched.exe	??
N	ABBYY Community Agent	CAGENT.EXE	Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software
X	ABC	keylogger.exe	Monitors keystrokes so you can check if someone has typed anything while your away from your PC. Reported as spyware by SpyCop in their FAQ
U	ABIT uGuru	uGuru.exe	Provides quick access to several Abit motherboard utilities - such as monitoring cpu temperature, fan speeds, overclocking, flashing of BIOS
N	ABITEQ	abiteq.exe	Monitoring utility for ABIT Motherboards. Displays system voltages, temperatures and fan speeds
U	Absolute Shield	dseraser.exe	Absolute Shield/Evidence Eliminator - iternet history eraser
U	Absolute StartUp monitor	ASMon.exe	Absolute Startup - startup monitor from F-Group Software
X	ABsr	absr.exe	Added by the AUTOUPDER TROJAN!
X	absr	mwsvm.exe	SeekSeek search hijacker related - as seen here
X	abtu	mp3serch.exe	Loads the executable for Lop.com. mp3serch.exe is the final version
X	abtu	lopsearch.exe	Loads the executable for Lop.com. lopsearch.exe is the beta version
U	AbyssWebServer	abyssws.exe	Abyss web server
Y	AcBtnMgr_Xxx	AcBtnMgr_Xxx.exe	Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation
U	acc	acc.exe	Advanced Call Center - "full-featured yet easy-to-use answering machine software for your voice modem"
X	ACCDEFRAGINFO	[path to worm]	Added by the DARBY-O WORM!
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
N	Access Ramp Monitor	armon32.exe	Monitors your progress on the internet; hang-ups, connection speeds, internet congestion and traffic flow. It prevents some games from running also. To disable the Access Ramp Monitor (1) Open Windows Explorer (2) Open the Program Files folder (3) Open the MindSpring folder (4) Open the AccessRamp folder (5) Double-click on the ARMCfg32.exe file (6) Uncheck Enable Dialup Monitor and click OK (7) Restart the computer and try again
X	Access WebControl	[path to file]	Added by the PPDOOR-M TROJAN!
U	AccessManager	AccessMgr.exe	Part of SmartPipes SecureSite software. "SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management, access control management, and key management"
X	AccessMedia P2P Loader	amp2pl.exe	My AccessMedia toolbar related, stealth installed!
N	AccessRamp Monitor01	ARMon32a.exe	From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup, or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS, but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service."
N	AccessRampLAN01	ARUpld32.exe	Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file, you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003
U	AcctMgr	AcctMgr.exe	Norton™ Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information, and retrieves the data needed for email logins, shopping orders, banking, and other online activities—all from the safety of your own PC
N	AccuWeather.com® Desktop	??	Desktop weather from AccuWeather.com
?	Ace bows	Ace bows.exe	??
N	AceGain LiveUpdate	LiveUpdate.exe	AceGain_LiveUpdate. "AceGain LiveUpdate provides a fully managed and customizable LiveUpdate platform that seamlessly integrates with a game. As soon as an update is made available, AceGain manages the alert, download and installation as well as version control and user network preferences."
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
U	AcerPowerkey	Powerkey.exe	PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3
N	Acme.PCHButton	pchbutton.exe	Used by HP Instant Support
Y	ACMonitor_Xxx	ACMonitor_Xxx.exe	Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation
X	acocash	fastdown.exe	Adult content dialler
X	acocash	fastdown.exe	Adult content dialler
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
X	Aconti	aconti.exe	Adult content dialler
U	acoustic	acoustic.exe	Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained
N	acpart	agpart11.exe	Program for finding trucks on-line
U	Acrobat Assistant *.*	ACROTRAY.EXE	Used to create PDF files with Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the "U" recommendation. *.* represents the version
U	Acronis Scheduler2 Service	schedhlp.exe	Part of Acronis True Image - backup software. Co-operates with the "schedul2.exe" servuce to perform backup/restore tasks correctly. Required if you want to use TrueImage to do some real backup/restore tasks - not if you only want to explore/mount images
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage
N	Acronis True Image Monitor	TrueImageMonitor.exe	Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage
N	Action Manager 32	am32.exe	Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
?	ActionAgent	actionagent.exe	"A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client". Is it required?
N	Activation	Activation.exe	Part of Microsoft Money
U	Activboard	MMKeybd.exe	Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock, Caps Lock, Scroll Lock keys
X	Active Bit Station	abs.exe	Added by the MYTOB.BZ WORM!
U	Active shield	Activeshield.exe	Active Shield is "an heuristic screen that actively protects your computer from trojans, spyware, adware, trackware, dialers, keyloggers, and even some special kinds of viruses"
X	ActiveDesktop	systray32.exe	Added by the DABOOM WORM!
X	ACTIVEDS	ACTIVEDS.EXE	Added by the OPASERV.T WORM!
N	ActiveEyes	ActiveEyes.exe	ActiveEyes from TFI Technology
U	ActiveMenu	ActiveMenu.exe	WildTangent games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)
Y	ActiveShield	MCVSSHLD.EXE	McAfee VirusScan On-line. See also the McAgentExe entry
U	ActiveSpeed	AS.exe	Ascentive ActiveSpeed Internet Optimizer
X	ActiveXUpdate	svcss.exe	Added by a variant of the DEDLER.C TROJAN!
U	Activity	actik.exe	ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself!
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	ActMaker	ActMak25.exe	"ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding, nor are you required to know a lot about the computer"
U	ACU	ACU.exe	Atheros wireless Client Utility For HP Compaq
U	Ad Blocker	blocker.exe	Ad Blocker - blocks popups, and also removes banners, image ads and flash ads
U	Ad Blocker Pro	Ad Blocker Pro.exe	Ad Away popup and banner remover
U	Ad Muncher	AdMunch.exe	Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications
?	Ad Online Guide	adonlineguide.exe	??
N	Ad-aware	Ad-aware.exe	Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs
X	Ad-Aware	Ad-Aware.exe	Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-aware spware/adware removal tool and is located in the WinntSystem32 or WindowsSystem32 directory
U	Ad-Muncher	ADMUNCH.EXE	Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications
U	Ad-watch	Ad-watch.exe	Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system
U	AD2KClient	AD2KClient.exe	Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk
N	Adaptec DirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
N	AdaptecDirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	AdAware	wini.exe	Added by the RBOT-XN WORM!
N	Adaware Bootup	ad-aware.exe	Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs
X	Adaware lptt01	adaware.exe	Variant of the RapidBlaster parasite (in a "Adaware" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Lavasoft Adaware
X	Adaware ml097e	adaware.exe	Variant of the RapidBlaster parasite (in a "Aimaol" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X	AddClass	AddClass.exe	CoolWebSearch parasite variant
X	AddClass	[Installation_Path]	Added by the Startpage.F hijacker
U	AdDelete	AdDelete.exe	Banner advertisment blocker
X	AdDestroyer	AdDestroyer.exe	Like VirtualBouncer, malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the malware it claims to remove/prevent, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code
?	ADG	ADG.exe	SoundBlaster Audigy related?
N	ADGJdet	ADGJDet.exe	Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection
Y	Adiras	Adiras.exe	ADSL USB modem related
X	ADM Library Loader	admlib32.exe	Added by a variant of the SDBOT TROJAN!
X	Admanager Controller	AdManCtl.exe	Adware, probably a Windupdates variant
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	AdminSoft	sysfile.vbs	Added by the STARGRUB-A WORM!
X	Adobe	Adobe.exe	Added by an unidentified VIRUS, WORM or TROJAN!
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	adobe	gam.exe	Added by an unidentified WORM or TROJAN!
X	Adobe	sysbat32.exe	Added by the LOWZONES.T TROJAN!
X	Adobe	zteam.exe	Added by an unidentified TROJAN!
X	Adobe Acrobat Distiller Application	acrotray.exe	Added by the RANDEX.DFJ WORM!
X	Adobe Filter Platform	afilterplatform.exe	Added by the RBOT-OP WORM!
U	Adobe Gamma Loader	Adobe Gamma Loader.exe	Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine
N	Adobe Reader Speed Lauch	reader_sl.exe	Speeds up the launch of Adobe (Acrobat) Reader 7
N	Adobe Reader Speed Lauch	READER~1.EXE	Speeds up the launch of Adobe (Acrobat) Reader 7
N	Adobe Reader Speed Launch	reader_sl.exe	Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly
X	AdobeA	adobes.exe	Added by the FLOOD.BA TROJAN!
X	AdobeFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
N	AdobeVersionCue	VersionCueTray.exe	"An exclusive feature of the Adobe® Creative Suite, Version Cue™ helps you find files fast, track multiple versions of your files, and share your files for creative collaboration"
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	adp	adp.exe	Spyware installed by Net2Phone, Limewire, Cydoor, Grokster, KaZaa, etc
X	adprot	adprot.exe	AdBlaster adware variant
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	AdRoarUpdate	ARUpdate.exe	AdRoar adware updater
X	AdRotator.Application	[path to csrss.exe]	Added by the SMALL-AQ TROJAN!
U	ADService	ADService.exe	Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk
U	AdsGone	Adsgone.exe	AdsGone - pop-up stopper
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	Apparently Annex A ADSL modem related. What does it do and is it required?
Y	AdslTaskBar	rundll32.exe stmctrl.dll, TaskBar	ISP software, initializes DSL modem
?	ADSL_A2	A2Installed	Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required?
Y	ADSS	ADSS.exe	ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied
X	adstartup	automove.exe	Adlogix adware variant
X	adstartup	Adstartup.exe	Adlogix adware variant
X	AdStatus Service	AdStatServ.exe	WindUpdates AdStatus Service adware
U	AdSubtract	adsub.exe	AdSubtract blocks ads, cookies, pop-up windows, animations, music, and more. Can be disabled from within AdSubtract. Available via Start -> Programs
X	Adtools Service	AdTools.exe	Windupdates Adware
X	AdultX	AdultX.exe	Adult content dialler and hijacker
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
U	ADUserMon	ADUserMon.exe	Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk
X	Advanced Internet Protocol	cerf.exe	Added by a variant of the SPYBOT WORM!
X	Advanced Protection System	advpsys.exe	Added by a variant of the RBOT WORM!
X	Advanced Tool Checks	advchks.exe	Added by a variant of the RBOT WORM!
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	Innovative Solutions Advanced Uninstaller PRO - "easy-to-use suite for uninstalling applications and keeping your computer fast, clean, and in its best shape"
X	Advapi	Advapi.exe	Added by the NETDEVIL.12 WORM!
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advertising Killer	Akiller.exe	AKiller - pop-up stopper
X	advmon32	advmon32.exe	Added by a variant of the CRYPTER.C TROJAN!
U	Adware Agent	adware agent.exe	Adware Agent popup blocker
N	Adware Spy	AdwareSpy.exe	Adware remover - not recommended, see here
X	AdwareAlert	AdwareAlert.Exe	Adware remover - not recommended, see here
X	AdwareDelete	adwaredelete.exe	Adware remover - not recommended, see here
?	Aeiwlsta.exe	Aeiwlsta.exe	IBM High Rate Wireless LAN Adapter driver. Is it required?
N	AELaunch	AELaunch.exe	Audio Applications Launcher for the Philips Acoustic Edge soundcard
X	AERVICESN	AERVICESN.exe	Added by the RANDON-AO WORM!
?	AeXSWDUsr	AeXSWDUsr.exe	Altiris Express NS Client Manager software. Is it required?
U	AEZBProc	aptezbp.exe	IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation, volume control, and few quickstart buttons. Keyboard will work without it but you lose the special functions
U	AFAFilter	windefault.exe	AFAFilter - internet filter software
N	Agent	Agent.exe	Cyberlink Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
?	Agente	Remupd.exe	Part of Panda Antivirus Titanium. Is this an update reminder (guess because of the name), virus definition update reminder or something similar?
U	AgfaCLnk	AgfaCLnk.exe	For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive
X	agp	agp32.exe	Added by the GAOBOT.SY WORM!
Y	AGRSMMSG	AGRSMMSG.exe	IBM AMR modem driver
N	AGSatellite	AGSatellite.exe	Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
U	ahfp	ahfp.exe	Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either"
U	ahfprog	ahfp.exe	Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either"
U	AHNSD	AhnSD.exe	AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis
?	AHNUE	AHNUE.exe	??
N	AHQInit	ahqinit.exe	Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required
X	Ahst	iebs.exe	PurityScan/Clickspring adware
X	AHU	[path to worm]	Added by the ANACON-B WORM!
X	Aica	tuaa.exe	PurityScan/Clickspring adware
X	Aida	ttuh.exe	PurityScan/Clickspring adware
U	aiepk	aiepk2.exe	Another IE Popup Killer - pop-up stopper
N	AIM	aim.exe	AOL Instant Messenger. If connected to the internet, automatically runs up AIM. Convenience more than anything. Available via Start -> Programs
X	AIM Instant Message Cookies	[random filename]	Added by the RBOT-AFV WORM!
X	AIM reminder	AIM reminder.exe	Added by the BUDDY TROJAN!
X	AIM95 Startup	aim95.exe	Added by the AGOBOT.AEE WORM!
X	aimaol lptt01	aimaol.exe	Variant of the RapidBlaster parasite (in a "Aimaol" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X	aimaol ml097e	aimaol.exe	Variant of the RapidBlaster parasite (in a "Aimaol" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
U	aimb.exe	aimb.exe	IMSufSentinel is a spy program which can record IM conversations, log keystrokes, record URLs visited, and take screenshots. If you didn't install this yourself remove it
N	AimingClick	AimingClick.exe	AimingClick from AimingTech. Web searching tool. Available via Start -> Programs
N	AIMster	??	Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs
N	AIMWDInstall	AIMWDInstall.exe	Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
X	aircity	aircity.exe	Related to "Prutect" malware from e2Give
X	AKEYNAME	WinServ.exe	Added by the EVILBOT.C TROJAN!
U	AKiller	akiller.exe	BuyPin Advertising Killer - popup killer
X	ala.exe	ala.exe	Access Lock is a system-tray security utility you can use to secure your desktop when you are away from your computer
U	Alarm Manager	Alarm.app.exe	Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop
?	AlarmWatcher	AlarmWatcher.exe	Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required?
N	Album Fast Start	ABMTSR.EXE	Scanner software, not required for scanner to work
X	Alchem	Alchem.exe	Transponder parasite updater/installer
X	alcmtr	ALCMTR.EXE	Realtek AC97 Audio - Event Monitor. "Sypware" file used surreptitiously monitor one's actions. It is not a sinister one, like remote control programs, but it is being used by Realtek to gather data about customers
U	Alcohol	Alcohol.exe	Alcohol 120% - CD/DVD emulation/writing/copying software
U	Alcohol Autorun	Alcohol.exe	Alcohol 120% - CD/DVD emulation/writing/copying software
?	Alcom PCL Capture	FMW_PCAP.EXE	??
N	AlcWzrd	ALCWZRD.EXE	RealTek High Definition audio driver related - detects new devices when plugged in, then pops up a dialog box. If everything works as expected you should be able to disable this one
X	AlcxMonitor	Alcxmntr.exe	Realtek AC97 Audio - Event Monitor. Sypware file used surreptitiously monitor one's actions. It is not a sinister one, like remote control programs, but is being used by Realtek to gather data about customers
X	Alevir	Alevir.exe	Added by the OPASERV.A or OPASERV.F or OPASERV.G WORMS!
X	AlevirOld	[worm filename]	Added by the OPASERV.G WORM!
N	Alexa	Alexa.exe?	Alexa Toolbar "is a downloadable toolbar that helps you navigate the Internet as you surf, by instantly providing you with related information about the site you're viewing". Available via Start -> Programs
?	ALFY Accellerator	AlfyAC~1.exe	??
X	ALG32	ALG32.EXE	Added by the Startpage.K hijacker
X	ALGU	ALGU.EXE	Added by the CWS-I TROJAN!
N	Alias SketchBook Snapshot	ALIASS~2.EXE	Screen-capture utility for Alias Sketchbook
N	AlienAutopsy	Test_BS.exe	Alienware computer technical support software
Y	ALiSndMgr	ALiSndMg.exe	ALi AC97 Sound driver
?	AliUSBfix	GREENMK.exe	May be realted to a USB 2.0 PCI card - the IOgear GIC220OU?
X	alkasr	ÎäÒíÑ.exe	Added by the BALKART TROJAN!
U	All Aboard Status	stswin.exe	All Aboard! Internet Connection Sharing status icon
X	All Sea screen saver	TaskTray.exe	"Free screensaver", installs lots of foistware. See here. Get rid of it
X	All Sea web link	FWLink.exe	"Free screensaver", installs lots of foistware. See here. Get rid of it
N	AllerCalc	AllerCalc.exe	AllerCalc is an expression calculator which allows you to directly enter an expression to be evaluated. Can be started manually
U	allSnap	allSnap.exe	"allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop"
X	Alogrithm Link Queue	alq.exe	Added by a variant of the SDBOT WORM!
U	Alogserv	Alogserv.exe	From McAfee VirusScan for logging scanning activities. In some cases, if left running it can cause CPU % usage to go between 5-95% or go to and stay at 100%. Disabling it impacts on the reported last scan date. It is reported to cause jerky graphics response in many games. As of version 6, this is a critical component of McAfee and disabling it can cause a PC to lock up
U	ALPass	ALPass.exe	ALPass password manager
Y	Alps Electric USB Server	Monserv.exe	Alps Electric USB Server - required according to this article
U	AlpsPoint	Apoint.exe	Touchpad software for laptop PC's. For instance it is found on the Panasonic machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work
?	ALServ	ALServ.exe	Altec Lansing AMS speaker related. What does it do and is it required?
N	Altnet	points manager.exe	Altnet Points Manager - manages the new Kazaa Plus scheme for awarding you points if you share music files on your machine with others rather than simply getting files and not sharing their own. Start manually when required
N	AltnetPointsManager	points manager.exe	Altnet Points Manager - manages the new Kazaa Plus scheme for awarding you points if you share music files on your machine with others rather than simply getting files and not sharing their own. Start manually when required
U	AltoMB_service	AltoMBsrv.exe	Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind
U	ALUAlert	ALUNotify.exe	Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis
N	Aluria Security Center	SecurityCenter.exe	Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here
U	Aluria's Pop-Up Stopper	eps.exe	Aluria Pop-Stopper
N	Aluria's Spyware Eliminator	ASE.exe	Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here
U	AlwaysOnTopMaker	AlwaysOnTopMaker.exe	Always On Top Maker - utilty to enable an application to always be displayed "on top" of others on the desktop
X	AmazingTens	AmazingTens.exe	Premium rate adult content dialler
N	America Online *.* Tray Icon	aoltray.exe	Puts AOL icon in System Tray (*.* denotes version if present). Connect to AOL via the desktop shortcut or Start -> Programs
N	AME_CSA	rundll32 amecsa.cpl, RUN_DLL	Loads ADSL modem Control Panel applet
U	AModemLockDown	ModemLockDown.exe	ModemLockDown - allows you to supervise internet access by disabling the modem, protects againt dialers accessing dial-up connections, etc
Y	Amon	AMON.EXE	Monitoring part of Eset's NOD32 virus-scanner
Y	Amonitor	amon.exe	Tiny Personal Firewall
U	AMSN	amsn.exe	aMSN P2P client - can be started manually
X	anbv32	nabv32.exe	Added by the TITOG.C WORM!
Y	ANIWZCS2Service	WZCSLDR2.exe	ALPHA Networks wireless driver
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
?	AnnotateCheck	AnnCheck.exe	Genius Wizard Pen Tablet driver related. Is it required?
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
N	Anntext	Anntext.exe	Caere Pagekeeper text annotation server
U	ANONYMIZER_SPYWAREKILLER	SpyWareKiller.exe	Anonymizer Spyware Killer
U	Another Internet Explorer Popup Killer	aiepk.exe	Another IE Popup Killer - pop-up stopper
X	ansjava	[path to worm]	Added by the RANDON-AN WORM!
X	Anskya	PYSKY.NET.exe	Added by the DLOADER-MW TROJAN!
X	Answer Problem	dSAFsqs.exe	Added by the SDBOT-SC WORM!
X	Anti Spam Service	spamsvc.exe	Added by the MYTOB-BK WORM!
U	Anti-keylogger check	antikey.exe	Anti-keylogger - protects against keylogger programs monitoring your keystrokes
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	Added by the KEDEBE.D WORM!
X	Anti-Virus Update Scheduler	[various filenames]	Added by a variant of the HEPLANE or STAPREW.B TROJANS!
X	Anti-Virus Update Scheduler V1.39.12R	[various filenames]	Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe, kaspersky.exe, nrton.exe, wins.exe, gah32.exe, 1.tmp, syste.exe, alg.exe, socks.exe, winxpsp2.exe, tek9.exe, sks.exe, hihi.exe, s.exe, xps2.exe, dns2.exe, ikav32.exe and more...
U	AntiPopUp	AntiPopUp.exe	AntiPopUp for IE - pop-up stopper
Y	AntiVir XP	AVwin.exe	AntiVir antivirus
X	Antivirus	av.exe	Added by the SINKIN TROJAN! Resets IE start page to realphx.com
X	Antivirus	maja.exe	Added by the NETSKY.H WORM!
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	Added by a variant of the RBOT WORM!
X	Antivirus Installer	[path to trojan]	Added by the BADGENT-A TROJAN!
X	antivirus32	antivirus.exe	Added by the SPYBOT.KAI WORM!
X	AntivirusGold	AntivirusGold.exe	Malware masquerading as an antivirus - also installs the Winnook TROJAN!
?	AntiVirusProtection	qumk.exe	??
X	antiware	elite***32.exe [*** = random char]	Added by the DLOADER-HW TROJAN!
U	AntiWindowsMessenger	AntiMsMsg.exe	Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory
Y	AnVir	AnVir.exe	AnVir Task Manager - protects computer against viruses and manages running processes and startup files
Y	AnVir Task Manager	AnVir.exe	AnVir Task Manager - protects computer against viruses and manages running processes and startup files
U	anvshell	anvshell.exe	System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar
?	anycom bluetooth	ftflauncher.exe	Associated with an Anycom bluetooth wireless card. What does it do and is it required?
N	AnyDVD	AnyDVD.exe	"AnyDVD is a driver, which descrambles DVD-Movies automatically in the background. This DVD appears unprotected and region code free for all applications and the Windows operating system as well"
N	AO Tray	AOTray.Exe	System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel
X	AOL 9.0 Optimized	AOLClient.exe	Added by the SPYBOTER.A TROJAN!
U	AOL Broadband Check-Up	matcli.exe	"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". The AOL Self Support Tool is required to run with the Help and Support program. If you uncheck AOL and and then run Help and Support it will add another AOL entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide
N	AOL Companion	companion.exe	Part of the AOL Connection Suite and installs an icon on the system tray offering easy access to AOL's additional utilities and functions. This program is a non-essential process, and is installed for ease of use
X	Aol Configuration Loader	aimsng.exe	Added by the SDBOT-XE WORM!
?	AOL Fast Start	AOL.exe	AOL ISP software related. What does it do and is it required?
X	AOL Instant Messanger	aim.exe	Added by the SDBOT-YT WORM!
X	AOL Instant Messengar	aol.exe	Added by the AGOBOT-FN WORM!
?	AOL Instant Messenger	AlM.EXE	That is an L between the A and M, the start up location is wrong for AIM. What does this relate to?
X	Aol Instant Messenger	aolmsg.exe	Added by KELVIR.AL WORM!
X	AOL Instant Messenger 7.213	aim9283.exe	Added by the SDBOT-ZF WORM!
X	AOL Messenger	[random filename]	Added by an unidentified VIRUS, WORM or TROJAN!
X	AOL Messenger	aolmsngr.exe	Added by the SDBOT-JF WORM!
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
Y	AolAcsDaemon1	Acsd.exe	AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually
Y	AolAcsDaemon1	AOLACSD.EXE	AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually
?	AOLCC	ACCAgnt.exe	AOL ISP software related, file located in a "AOL Computer Check-Up" folder. What does it do and is it required?
X	AolCon	config.com	Added by the TAPLAK WORM!
N	AOLDialer	AOLDial.exe	AOL ISP software dialer - can be activated through a desktop shortcut
N	AolFix	AolFix.exe	Run on Gateway Astra computers, and maybe a few others. Designed to repair a bad registry key in Gateway computers that would not allow AOL  to run correctly. Not seen much any more and should only run once
X	Aornum	aornum.exe	Installed along with iWon Prize Machine. Based upon their privacy statement this can be regarded as spyware
N	AOTray	AOTray.Exe	System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel
Y	APC UPS Status	Display.exe	APC PowerChute Personal Edition status icon
U	APC_SERVICE	mainserv.exe	PowerChute® Personal Edition - "safe system shutdown software with sophisticated power management functions"
Y	apc_tray	apc_tray.exe	Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure
X	API32	api32.exe	Added by the IRCBOT-B TROJAN!
X	APIMon	apimonx.exe	Added by the TIBSER.A downloader TROJAN!
X	APIMon	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
?	Apmsrv9x	APMSRV9X.EXE	Intel AnyPoint Wireless II Home Network related. What does it do and is it required?
U	Apoint	Apoint.exe	Touchpad software for laptop PC's. For instance it is found on the Panasonic machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work
X	App.EXEName	[path to worm].exe	Added by the BODIRU WORM!
U	Appcon	vAppCon.exe	Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established
X	appconn	appconn.exe	Added by the CARGAO WORM!
U	AppExtender	AppExtCB.exe	Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received
X	appis.exe	appis.exe	Added by the AGENT-BC TROJAN!
Y	Application	mdmsetsp.exe	Aztech Labs modem driver
U	Application Explorer	Naldesk.exe	Novell Zenworks Application Explorer Executable. "For almost all users