Home Computer Repair Online - Startup Applications List

Home Computer Repair Online Startup Applications List

Home » Welcome to the Startup Applications List
Status Code Key:
  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

  • To lookup a startup program by file name, click the letter it starts with or use the search feature.

    ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z - Other

    Status CodeNameCommand Description
    XWindows HTML file readerSysconf32.exeAdded by the NOOMY.A WORM!
    ?Windows Help SystemHelp.pif??
    XWindows Host Devicehostsvc.exeAdded by the ZOOTY-A WORM!
    XWindows Help Servicewinhelpsv.exeAdded by the RBOT-LP WORM!
    XWindows Help Managersvchost32.exeAdded by the RBOT-OZ WORM!
    XWindows Help Filewinhelper32.exeAdded by the SDBOT-QK TROJAN!
    UWindows Guardianthehel1iawgrd32.exePart of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
    UWindows GuardianFawgrd32.exePart of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
    NWindows Eyes??For blind people, gives a voice description of items on the screen. Windows application which gives you total control over what you hear, when you hear it, and how you hear it. Available via Start -> Programs
    XWindows Explorer-3212WINRE16.EXEAdded by the HARDOC WORM!
    XWindows Explorer Update Build 1142EXPLORER32.EXEAdded by the KaZaA based KWBOT or KWBOT.Y WORMS!
    XWindows Explorer ShellWinexec32.exeAdded by the REDIST.B WORM!
    XWindows Explorerolecom32.exeAdded by an unidentified WORM or TROJAN!
    XWindows ExplorerLsas.exeAdded by the GAOBOT.AO WORM! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    XWindows Explorer[filename].exeAdded by the SDBOT TROJAN! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    XWindows Driver Servicesmsdrvs32.exeAdded by the WOOTBOT.L WORM!
    XWindows Drive CompatibilitySystem32Driver32.exeAdded by the SUPOVA.Z WORM!
    XWindows DNS Daemonwindnsd.exeAdded by the WOOTBOT.AS WORM!
    XWindows DLL Loaderdefragfat32pi.exeAdded by the RBOT-QQ WORM!
    XWindows DLL Loaderrundll32.exeAdded by the WHIPSER-B WORM! Note - rundll32.exe file is placed in the WindowsSystem folder, wheras the legitimate rundll32.exe is located in the C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP)
    XWindows DLL Loaderdefragfat32z.exeAdded by the LINKBOT.A WORM!
    XWindows DLL LoaderRUNDLL16.EXEAdded by the DOMWIS TROJAN!
    XWindows Debuggerwindbg.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows debug loggingwinloggs.exeAdded by the RBOT-QN WORM!
    XWindows debug loggingwinlogg.exeAdded by the RBOT-OY WORM!
    XWindows Dcom2 Fixmscom32.exeAdded by the RBOT-QT WORM!
    XWindows ControlControl.exeBrowser hijacker. NOTE - On Win9x systems it will overwrite the Windows file of the same name in the Windows directory, so therefore it will be necessary to extract a fresh copy of the file from the Windows setup cabs!
    XWindows Data Serverautodisc.exeAdded by the SPYBOT-CB WORM!
    XWindows Configurationwsys32.exeAdded by the GAOBOT.FB WORM!
    XWindows ConfigSSYS.EXEAdded by the SPYBOT-DA WORM!
    XWindows Config LoaderWincfg32.exeAdded by the SILVERFTP TROJAN!
    XWindows Compliant[random filename]Added by the RBOT-IR WORM!
    XWindows Ba?lang?? Dosyas?sistem.exeAdded by the MUZK WORM!
    XWindows Communicatorwincomm.exeAdded by the AGOBOT-BH WORM!
    XWindows Backup ConfigurationIEXPLORER.exeAdded by the GAOBOT.AZ WORM!
    XWindows Automationmsdspr.exeAdded by the SOLAME.A WORM!
    XWindows backupsystemss.exeAdded by a variant of the SPYBOT WORM!
    Xwindows automationmslaugh.exeAdded by the BLASTER.E WORM!
    XWindows Automatic Updatesdvldr.exeAdded by the RBOT.MF WORM!
    Xwindows auto update msblast.exeAdded by the BLASTER.B WORM!
    XWindows Automatic Updatewuamgrder.exeAdded by a variant of the RBOT WORM!
    Xwindows auto updatepenis32.exeAdded by the BLASTER (or MSBLAST.A) WORM!
    XWindows AdToolsWinAdTools.exeWindupdates adware variant
    XWindows AdServiceWinAdServ.exeWindupdates adware variant
    XWindows AdControlWinAdCtl.exeWindupdates adware variant
    UWindows Acceleratorssetup.exeKeySpy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
    XWindows (random character)diskcheck.exeAdded by the SINGU.B TROJAN!
    Xwindowssystem copy.exeAdded by the SALGA.A WORM!
    Xwindowshkey.exeAdded by the GAOBOT.AFW WORM!
    Xwindows[path to trojan]Added by the AIMWIN TROJAN!
    XWindowsexplorer.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    XWindowsWindows.exeAdded by the KAZMOR, BOBBINS & ALADINZ.D TROJANS!
    XWindowsmsdos98.exeAdded by the PWSTEAL TROJAN!
    XWindowsKernel32.exeAdded by the TENDOOLF WORM!
    UWindowFXwfxload.exeStardock WindowFX - "Allows you to add an unprecedented number of special effects to windows"
    XWindowEnhancerWinex.exeSCbar foistware variant
    UWindowBlindswbload.exeWindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins
    Xwindow2ssvchost.exeAdded by the IRCBOT.H TROJAN!
    Xwindow.exewindow.exeAdded by the MITGLIEDER.H or MITGLIEDER.J TROJANS!
    UWindow WasherwwDisp.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    XWindow Monitorwinmon32.exeAdded by the SDBOT.RT WORM!
    XWindow LoaderDos32.exeAdded by the GAOBOT.AO WORM!
    XWindowexplore.exeAdded by the GAOBOT.ADW WORM!
    XWindoes Kernelkernel32.exeAdded by the KICKIN.A (or CYDOG.C) WORM!
    XWinDNSwindns32.exeAdded by the GAOBOT.WX WORM!
    XWindll32Windll32.exeAdded by the MSNPWS TROJAN!
    Xwindllsys32.exewindllsys32.exeAdded by a variant of the MITGLIEDER.BY TROJAN!
    XWindll.exeWindll.exeAdded by the STEALER TROJAN!
    UWINDLLWSYS.EXESTARR key logger. "It logs almost everything that goes through the box. It logs all key strokes, all passwords transacted even if they weren't keyed in, all web sites visited, every program launched including the path to that program, and more"
    Xwindllwindll32.exeAdded by the ASTEF or RESPAN WORMS!
    XWindllWindll.exeAdded by the TRYNOMA TROJAN!
    Xwindirwinrun.exeAdded by the WINBUR.B WORM!
    XwindefWin32sp.vbsAdded by the ANPES WORM!
    XWindewinde.exeAdded by the DLUCA TROJAN!
    Xwindbswinxtc.exeAdded by the AGOBOT-WD WORM!
    NWinDateswindates.exeWinDates is a calendar, date organizer and event reminder program from Rockin' Software
    XWIND0WSWIND0WS.exeAdded by the SPYBOT.DQ WORM!
    XWinCSRSSMSGRT32.EXEAdded by the REWINDO-A TROJAN!
    Xwind.exewind.exeAdded by the MITGLIEDER.BD TROJAN!
    NWinCinemaMgrWinCinemaMgr.exeWinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs
    NWINCINEMAMGRWINCIN~1.EXEWinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs
    XWinCheckWinCheck.exeAdded by the PWS-CY TROJAN!
    XWinbedwinbed.exeHijacker
    UWinBarWinBar.exe"WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls"
    UWinBackup SchedulerWbsched.exeLIUtilities WinBackup scheduler - backup software
    XWinAuthwinlogon.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the valid winlogon.exe process
    XWinappwinpup32.exeProduces popup ads to adult content sites
    XWinApp32msapp.exeAdded by the RSBOT TROJAN!
    XWinApiwinapix.exeAdded by a variant of the TIBSER.A downloader TROJAN!
    UWinampAgentWINAMPa.exeLoads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs
    XWinampa AgentWINAMPA.EXEAdded by the SPYBOT-BR WORM! Note - this is NOT the Winamp Media Player
    XWinampawinampa.exeAdded by the AGOBOT-GS WORM!
    UWinampaWINAMPa.exeLoads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs
    XWinamp media playerwinapa.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinampwinamp.htaHijacker - re-directing to adult content sites. Note - this isn't the real Winamp
    Xwinallapuwinallapu.exeAdded by the DELF.E TROJAN!
    Xwinallapwinallap.exeAdded by the DELF.E TROJAN!
    XWinahlp.exeWinahlp.exeAdded by a variant of the VAGRNOCKER TROJAN!
    Xwinadmwinadm.exeBrowser hijacker - redirecting to Search-World.net. Related to the SMALL.LR TROJAN!
    XWinad ClientWinad.exeWinAd adware by eXact Advertising
    XwinactiveWINACTIVE.EXEActive variant of LOP.com hijacker - see here
    XWinActiveJWinActiveJ.exeAdded by the ROTARRAN VIRUS!
    XWIN3S2SNDSwinabsmod.exeAdded by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well"
    XWIN3S2SNDSwiniprtx.exeAdded by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well"
    XWin64 Compatibility Checkload win64.drvCoolWebSearch parasite variant
    XWin386Win386.exeAdded by the GOSUSUB VIRUS!
    XWin386sp32.dllHomepage hijacker. Not a dll but a regfile in disguise
    Xwin32_i ml097ewin32_i.exeVariant of the RapidBlaster parasite (in a "win32_i" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    Xwin32_i lptt01win32_i.exeVariant of the RapidBlaster parasite (in a "win32_i" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    Xwin32uswin32us.exeAll-In-One-Telcom (adult content dialler) variant
    Xwin32usbdssrs.exeAdded by the RBOT-RA WORM!
    XWin32SystemMonitor***.exe [* = random char]Browser hijacker
    XWin32Systemwin32s.exeAdded by the MYDOOM.V WORM!
    XWin32system[random filename]Added by the DDV.B WORM!
    XWIN32SNDSbanc.exeAdded by an unidentified WORM or TROJAN!
    YWIN32SLWin32sl.exePart of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. The specific function of this is to load MIF's in order for Dell OpenManage Client to work
    Xwin32inisystroy.exeAdded by the IRC.ALADINZ.C TROJAN!
    XWin32RServer.comAdded by the ESTRELLA TROJAN!
    Xwin32infowin32info.exeAdult content dialler
    Xwin32gbwin32gb.exeAll-In-One-Telcom (adult content dialler) variant
    XWin32GKernel32.comAdded by the ESTRELLA TROJAN!
    XWin32GScandisk.comAdded by the ESTRELLA TROJAN
    XWin32dllWin32dll.exeAdded by the BANPAES TROJAN!
    XWin32DLLWin32DLL.vbsAdded by the LOVELETTER (I LOVE YOU) VIRUS!
    Xwin32clfwin32clf.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWin32BaseServiceMODWintask.exeAdded by the NAVIDAD WORM!
    Xwin32.exewin32.exeAdded by the STARTPAGE TROJAN!
    XWin32 Wmls Driverwinitr32.exeAdded by the WOOTBOT.B WORM!
    XWin32 USB2.0 Driverservice.exeAdded by the SDBOT-QF WORM!
    XWin32 USB2.0 Driverw32usb2.exeAdded by the SPYBOT.DN WORM!
    XWin32 USB2.0 Driverrundll16.exeAdded by the WOOTBOT.H WORM!
    XWin32 USB2.0 Driver386.exeAdded by the IRCBOT.D WORM!
    XWin32 USB2 Driverwinupdate.exeAdded by the AGOBOT.YE WORM!
    XWin32 USB2 Driverwind32.exeAdded by the FORBOT-AH WORM!
    XWin32 USB2 Driversys32snd.exeAdded by the FORBOT-AN WORM!
    XWin32 USB2 Driversys32.exeAdded by the WOOTBOT.X WORM!
    XWin32 USB2 Driversvchosting.exeAdded by the FORBOT.J or SDBOT.HU WORM!
    XWin32 USB2 Driverwin32usb.exeAdded by the SPYBOT.DHV WORM!
    XWin32 USB2 Driversmsc.exeAdded by the SDBOT.FO WORM!
    XWin32 Usb Driversvhosint32.exeAdded by the FORBOT-BE or FORBOT-J WORMS!
    XWin32 USB Drivermvsecn.exeAdded by the FORBOT-BK WORM!
    XWin32 USB Driverwinxpinit.exeAdded by the SDBOT.AA TROJAN!
    XWin32 SSL Driverwinssv.exeAdded by the FORBOT-BH WORM!
    XWin32 System Spoolspoolsvc.exeAdded by the SDBOT.UK WORM!
    XWin32 Services1wuamngr1.exeAdded by the SDBOT-PV WORM!
    XWin32 Rundll LoaderRundll32.exeAdded by the SDBOT.A TROJAN! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:Windows directory. The version created by this virus is saved in the C:WindowsSystem directory
    XWin32 Ms Auto UpdaterAutomsUPD.exeAdded by a variant of the RBOT WORM!
    Xwin32 regeditmsn32.exeAdded by an unidentified WORM or TROJAN!
    XWin32 FRT Drivermsfr32.exeAdded by a variant of the FORBOT WORM!
    XWin32 Kernel core componentKernel32.pifAdded by the MOKS VIRUS!
    XWin32 ExplorerExplorer32.exeStartPa-MN homepage hijacker
    XWin32 exe filewinstr32.exeAdded by a variant of the SPYBOT WORM!
    XWin32 DRK Driverwdrk32.exeAdded by the WOOTBOT.CY WORM!
    XWin32 Device LoaderWin32ldr.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWin32 Configurationdllhelp.exeAdded by the SDBOT.UL WORM!
    XWin32 Configurationvideosd32.exeAdded by the SDBOT.TT WORM!
    Xwin32WinSetup.exeAdded by the EVILBOT.B TROJAN!
    Xwin32winsrv32.exeAdded by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites
    XWin32Win32.exeAdded by the ISRAZ.A WORM!
    Xwin32Setup_32.exeAdded by the EVILBOT.B TROJAN!
    Xwin32Shakira_1997_Part_1_.Mpeg_.scrAdded by the MYLIFE.N WORM!
    XWIN32WIN32.EXEAdded by the RATEGA TROJAN!
    XWin2Drv[worm filename]Added by the WINTOO WORM!
    XWin USB 2.0 USB DriverHPPrint.exeAdded by the SPYBOT.DNB WORM!
    XWIN-BUGSFIXWIN-BUGSFIX.EXEAdded by the LOVELETTER (I LOVE YOU) VIRUS!
    Xwin updatewupda32.exeAdded by the SDBOT.J WORM!
    XWin Server Updtwupdt.exeAdded by the IMISERV.A TROJAN!
    XWin Serverwinserv.exeAdded by the IMISERV.A TROJAN!
    ?win namestat.exe??
    XWin l5oahderwinampa.exeAdded by the SPYBOTER.GEN VIRUS! Not the valid Winamp Agent which uses the same filename. This resides in the System32 sub-folder wheras real one is located in the winamp folder
    XWIN HOST PROCESSWIN HOST PROCESS.EXEAdded by the KEYLOGGER.CLONE TROJAN!
    XWin Commandcommand32.exeAdded by the AGOBOT.XQ WORM!
    XWin Commandcommand32.exeAdded by the AGOBOT.XQ WORM!
    XWin CommWinComm.exeWebRebates related adware
    UWin Chimeswinchi~1.exeWinChimes - enhancement software for the system clock that runs in the system tray
    Xwinxwinxrpc32.exeAdded by the AGOBOT-MV WORM!
    NWillow RoadWillowRoad.exeWillow Road Screen Saver
    Xwinregedit -s ..win.dllAdded by the SEEKER.K TROJAN!
    NWildwire MonitorWWMon.exeThis places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem
    UWildTangent Web Driver updaterwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWIAWizardMenuRUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenuStill Image Class Installer - installed with a webcam
    ?WildTangent CDARUNDLL32.exe cdaEngine0400.dll,cdaEngineMainPart of the WildTangent on-line games system. What does it do and is it required?
    XWhenUSearchSearch.exeWhenUSearch adware
    XWhvlxdWhvlxd.exeAdded by the W32.LXD.MIRC TROJAN!
    XWhenUSaveSave.exeRebranded version of SaveNow advertising spyware
    UWheelMouseAMOUMAIN.EXEA4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features
    UWheelMouse4DMAIN.EXEMouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide
    Xwhagentwhagent.exeSystem Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here
    UWGWLocalManagerWGWLocalManager.exePart of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creating a shortcut, running it only when connecting to the internet. If internet is used often, it's recommended to leave it in startup so it starts with the system
    YWG511WLUWG511WLU.exeNetgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card
    ?WFXSwtchWFXSWTCH.exeRelated to WinFax. What does it do and is it required?
    Ywfxsnt40wfxsnt40.exeWinFax 10.0 and maybe earlier versions. The program that opens the port for WinFax and not normally in the start menu. Needed if you want to run WinFax
    NWFXCTL32.EXEWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
    Uwfipsiphider.exeICQ (messaging/chat program) anti-bomb software. "WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed." For more information about ICQ bombs see here
    NWFGStartupWFGStartup.exeWorld Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones"
    NWetSockwetsock.exeRoboMagic Wetsock - weather reporting in the System Tray
    Xwersdsdoriot.exeAdded by the JECT.C TROJAN!
    ?WEPstatWepstat.exeCisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be "U". Can anybody confirm this?
    NWelcomeWelcome.exeLaunches the Welcome to Windows tutorial on boot up
    UWebWasherwwasher.exeFree Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs
    YWebTrapNT.exeWebTrapNT.exePart of PC-Cillin Anti-Virus software. Checks visited web-sites for malicious Java and ActiveX elements
    YWebtrapwebtrap.exePart of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating
    XWebSpecialsrundll32 [path] webspec.dllWebSpecials spyware
    XWebsxInt*****.exeAdult content dialler - where ***** are random
    NWebshotswebsho~1.exeScreensaver program that automatically downloads from the webshots web site
    NWebshotsWebshots Tray.exeScreensaver program that automatically downloads from the webshots web site
    XWebSecureAlertWebSecureAlert.exeWebSecureAlert. "Can help protect your browser security and privacy". However, it's by GAIN Publishing, and will display pop up ads on your computer screen based on your online Web surfing behavior
    ?WebServerVBI_SE~1.EXERelated to a Pinnacle sound card. What does it do and is it needed?
    Xwebsearchwjview ...websearch.exe"Web Savings" From Ebates Software, a shopping tool that opens pop-up windows
    YWebScanXWebScanX.exeFrom McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc
    Nwebscanstopsignav.exeeAcceleration Stop-Sign related - not recommended, see note
    XWebScanDEFSCANGUI.EXEStop-Sign from eAccelerration. Detects spyware, malware, viruses and keyloggers and stops popups. Spyware in itself - see their privacy statement here
    XWebSavingsFromEbates0WebSavingsFromEbates0.exeWeb Savings From Ebates Software, a shopping tool that opens pop-up windows
    XWebSavingsfromEbatesWebSavingsfromEbatesrun.exeWeb Savings From Ebates Software, a shopping tool that opens pop-up windows
    Uwebsaverlivewebsaverlive.exeWebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle
    XWebRebates0WebRebates0.exeWebRebates adware
    NWebposition Gold 2wpsche~1.exeScheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines
    NWebOutfitterTraysttray.exeIntel WebOutfitter service System Tray icon
    NWebKeyWebKey.exeWebKey from JB Utilities. Utility to keep track of login data required when browsing the internet
    XWebInstallWebInstall.exeClipGenie adware downloader
    XWebInstall2WebInstall.exeClipGenie adware downloader
    XWebHancer Agentwhagent.exeSystem Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here
    XwebHancer Survey CompanionwhSurvey.exeWebHancer foistware - traffic measurement service that uses a client agent that is stealth installed on user machines, gathering detailed data about sites visited, their performance and, most important, what the user actually does while there
    XWebdav.exewebdav.exeIRC DDoS bot which gives the hacker full control over your system
    XWebCpr0WebCpr0.exeWeb_CPR/TopMoxie adware
    XWebCheckWebCheck.pifAdded by the CONE.C or CONE.F WORMS!
    NWebcamRT.exeWEBCAMRT.exeFor Logitech Web Cams. Not required - camera works fine without it
    XWebceleratorwebcel.exeWebcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Spyware and troublesome - see here
    Xwebassistwebassist.exeAdware popup generator
    ?Webcam Go Sti Service Applicationwbcgosvc.exeControl software for the portable Creative Video Blaster Webcam Go digital camera/PC web cam. What does it do and is it required?
    NWebArmyKnifeWAK.exeWeb Army Knife - a suite of web site developer's tools
    Yweb3trapweb3trap.exePC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs, etc 
    Xwebalizewebalize.exeSearchcentrix hijacker
    ?Web Search????
    Xweb******.exe [* = random char]Added by a variant of the EASTO.A TROJAN!
    NWeatherWatcherww.exeWeatherWatcher - weather reporting in the System Tray
    XWeatherOnTrayWeatherOnTray.exeHotbar's Weather Forecast tool for your desktop - adware
    NWEATHERWEATHER.EXEWeatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs
    NWeatherCastWeather.exeWeather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight
    Xwdwctrlwdwctrl.exeAdded by the DLUCA.E TROJAN!
    Xwdskctlwdskctl.exeIEPlugin spyware
    XWDInfowdinfo.exeAdult content dialler
    UWD Button ManagerWDBtnMgr.exeButton manager installed with a western digital external disk drive. Allows you to back up your system with one click
    XWCPTwintsvtr.exePurityScan/Clickspring adware
    XWCPSWint**.exe [* = random char]PurityScan/Clickspring adware
    XWCPIwintsvit.exePurityScan/Clickspring adware
    ?WCPCwintsvcc.exe??
    UWCOLOREALcoloreal.exeMakes colours sharper and brighter, but will only work with coloreal capable monitors
    Uwcmdmgrlwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    Nwcmdmgr.exewcmdmgr.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    Uwcmdmgrwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWCESCOMMWCESCOMM.EXEActive sync for use with Windows CE based palm PC
    ?WbuttonWbutton.exeRelated to the Wacom Penabled driver on Acer Tablet PCs. Appears to do nothing so is it required?
    NWbiffWbiff.exeWbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received
    NWaveTop Upload ManagerN/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop Receiver 2N/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop Receiver 1N/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop LauncherWaveTop.exeWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWatchdogWatchdog.exeDefinitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others), launches from the Startup folder in the Start Menu, but not required as they give instructions on removing it on their webpage
    NWatch Dog Programwatchdog.exeFor Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do
    ?Watch1200UBWATCH.EXE??
    XWastwast.exeGrokster ads updater
    NWatchwatch.exeFound to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted
    Uwashindexwashidx.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    NWasherie.exewasherie.exeCookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer, specific for cleaning the IE cache and cookies. Available via Start -> Programs
    UWasherwasher.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    UWashAndGo - Cleanup of old Backupfileschecker.exeWashAndGo - temp file cleaner
    NWARSVRwar-ftpd.exe"War FTP Daemon - the original free FTP server for windows"
    UWarning: do not remove it!fpplock.exePart of Folder Password Expert by ZQS Software Team - "a software program to restrict access to the folders that contain your sensitive data"
    UWarnetwarnet.exeWarnet - system cleanup software
    UWarnerwarner.exeAlso known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files
    Nwarezwarez.exeWarez P2P client
    XWardosyslaunch.exeAdded by the ADLCICKER.G TROJAN!
    Nwar-ftpd.exeWAR-FTPD.EXEWar FTP Daemon from JGAA's Internet - FTP client
    XWAPIwts**.exe [* = random char]PurityScan/Clickspring adware
    YWanMPSvcWanMPSvc.exeAn AOL component, the Wan miniport (ATW) service. If you delete this and logon, AOL reports a problem with your internet connection, and reinstalling AOL doesn?t help
    NWanadoo Messenger.exeWanadoo Messenger.exeWanadoo ISP instant messenger client
    ?W815DMW815DM.exe??
    YW75P2PSERVERW75P2PS.EXEPrinter utility which is required in order to make the printer work correctly
    XW3KNetworkrundll32.exe w3knet.dll, dllinitrunAdvertising spyware. Check here for more info on this particular one
    Xw32supw32sup.exeAdult content dialler
    XW32TcWTC32.scrAdded by the VOTE.D or VOTE.K WORMS!
    Xw32alanismope.scrAdded by the SINALA WORM!
    XW32Load[random filename].scrAdded by the CASPID WORM!
    Xw32w32.exeAdded by the SOKEVEN TROJAN!
    XW32.ScranScran.exeAdded by the NARCS WORM!
    XWindows Internet Protocolwinproc32.exeCoolWebSearch parasite variant
    XWindows JavaScript DaemonWinjsd.exeAdded by the WOOTBOT.AF WORM!
    ?Windows Loadwindows.com??
    XWindows Loaderwstart32.exeAdded by the GAOBOT.CA WORM!
    XWindows loggingwinlogd.exeAdded by the RBOT-ON WORM!
    XWindows Loginexplored.exeAdded by the GAOBOT.SY WORM!
    XWindows Logonwinlogin.exeAdded by the SPYBOT-C TROJAN!
    XWindows Logon ProcedureSvchoste.exeAdded by a variant of the SPYBOT WORM!
    XWindows Management Instrumentationmwd.exeAdded by the GRAPS WORM!
    XWindows Managerwinmants.exeAdded by the MANTAS WORM!
    XWindows mangementwinlogonn.exeAdded by the RANDEX.FC WORM!
    XWindows Media Playerwmediaplayer.exeAdded by the AGOBOT-NQ WORM!
    XWindows Media PlayerWMP23.exeAdded by a variant of the RBOT WORM!
    XWindows Media PlayerMediaPIayer.exeAdded by the SDBOT-QO TROJAN! - note, the executable is called 'MediapIayer', with an 'i' !)
    XWindows Media Playermsass43.exeAdded by a variant of the RBOT WORM!
    NWindows Media Powerpoint HelperNSPPTHLP.EXEGerman software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
    XWindows media servicecrvss.exeAdded by the SDBOT.VP WORM!
    XWindows media servicescvrsss.exeAdded by the RBOT-MW WORM!
    XWindows Media SP.2.37[random filename]Added by the LEMIR.C TROJAN!
    XWindows MeTaLRoCk servicemetalrock.exeAdded by the TASTYRED TROJAN!
    XWindows Monitorwinmon.exeAdded by the SDBOT.VB WORM!
    XWindows Monitoring Servicewinmon.exeAdded by a variant of the SDBOT WORM!
    XWindows NetsWinNET.exeAdded by the RBOT-MO WORM!
    XWindows Network Servicewinvc32.exeAdded by the RBOT.RY WORM!
    XWindows Networkingwinsys32.exeAdded by the GAOBOT.FL WORM!
    XWindows Nivedia DriversysMGT.exeAdded by a variant of the RBOT WORM!
    XWindows NNT[path to trojan]Added by the RANKY.E TROJAN!
    XWindows NT 32ntlogin32.exeAdded by the RANDEX.BRD WORM!
    XWindows NT Loginntlogin32.exeAdded by the SDBOT.WG WORM!
    XWindows NT Service Namewinshock.exeAdded by the RBOT-PK WORM!
    XWindows OEM Toolswinres32.exeAdded by the SPYBOT.FD WORM!
    XWindows OLE Automation Serverole32aut.vbeCoolWebSearch parasite related browser hijacker
    ?Windows Print SpoolerSCVHOSTS.EXESuspicious due to the similarity to the valid "svchost.exe" file
    XWindows Print SpoolerNavAgent32.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows Print SpoolerSVEHOST.EXEAdded by the SPYBOT.H WORM!
    XWindows Registrymsnmsg.exeAdded by a variant of the RBOT WORM!
    XWindows Registry Cleanerwinclean.exeAdded by a variant of the SPYBOT WORM!
    XWindows Registry Express Loaderregexpress.exeAdded by the FORBOT-CJ WORM!
    XWindows Registry Scanregscan32.exeAdded by the RBOT.KE WORM!
    XWindows Registry Securitycrss.exeAdded by a variant of the IRC.BOT TROJAN!
    XWindows Registry Startupwind32.exeAdded by the AGOBOT-BZ WORM!
    XWindows reportswchost.exeAdded by the SMALL.GV VIRUS!
    XWindows Runtime Helpwin32hlp.exeAdded by a variant of the AIMVISION TROJAN!
    XWindows Runtime HelpWinRunHelp.wrhAdded by a variant of the AIMVISION TROJAN!
    XWindows SAomniscient.exeBLAZEFIND adware
    XWindows securesetver32.exeAdded by the SPYBOT.EP WORM!
    XWindows Security Assistantrundll32.vbeCoolWebSearch parasite variant
    XWindows Security Assistantwinsec.exeCoolWebSearch parasite variant
    XWindows Security Modulemodule.exeAdded by a variant of the RBOT WORM!
    XWindows Service Hostscvhost.exeAdded by the SDBOT.N TROJAN!
    XWindows Service Hostsvchost.exeAdded by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XWindows Servicesservice.exeAdded by the RANDEX.R WORM!
    XWindows Services Hostsvchost.exeAdded by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XWindows Services Updatesvch0st.exeAdded by a variant of the RBOT WORM!
    ?Windows shellwin70.exe??
    XWindows Shell Library Loaderload shell.dll /c /setCoolWebSearch parasite variant
    Xwindows shellext.32mschost.exeAdded by the BLASTER.K WORM!
    XWindows Sound DriverSndMon32.exeAdded by a variant of the SPYBOT WORM!
    XWindows Sound ManagerSndMon32.exeAdded by the FORBOT-BU WORM!
    XWindows SP2 UpdateSp2update.exeAdded by the WOOTBOT.BS WORM!
    XWindows SpoolerSPOOLSRV.EXEAdded by the SPYBOT.P WORM!
    XWindows SSL Filewinssv.exeAdded by the WOOTBOT.CA WORM!
    XWindows Startupwinsta~1.exeGoHip foistware
    XWindows Startupwinstartup.exeGoHip foistware
    XWindows StartupWdrun32.exeAdded by the GAOBOT.AO WORM!
    XWindows Startupservices21.exeAdded by the AGOBOT-MX WORM!
    XWindows Startup 32 Bitssysrun32.exeAdded by a variant of the DARKSUN TROJAN!
    XWindows SyncroAdSyncroAd.exeBlazeFind "Windupdates" targeted advertizing
    XWindows System ConfigurationSYSCFG16.EXEAdded by the WISDOOR.Z TROJAN!
    XWindows System Managerwinsystem.exeAdded by the RBOT-AN WORM!
    XWindows System Manager Procwinsmc.exeAdded by the RBOT.JH WORM!
    XWindows System Restore ConfigurationSblhost.exeAdded by a variant of the SPYBOT WORM!
    XWindows System RestorerSystemRestorer.exeAdded by the DULOAD.C WORM!
    XWindows System Serivcewinserv.exeAdded by a variant of the RBOT WORM!
    Xwindows system servicewinsock.exeAdded by the RBOT-MR WORM!
    UWindows System Traymsni.exeIambigbrother monitoring software
    XWindows System Trayswhost.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows Task ManagerACCOUNT_DETAILS.DOC.exeAdded by the QUATERS.A WORM!
    XWindows Task Managertaskmgn.exeUnidentified malware, either a variant of the WIN32.RBOT WORM, or part of a Casino Palazzo foistware install
    XWindows TaskAdWintaskad.exeWindupdates adware variant
    XWindows TCP/IPwintcp.exeAdded by the AGOBOT-ZH WORM!
    XWindows Telnet Serverwintel.exeAdded by the AGOBOT-MW WORM!
    XWindows Time ServerTimeSRV.exeAdded by the SPYBOT.DNC WORM!
    XWindows Update[filename]Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites
    XWindows Updateiexplorere.exeAdded by the GAOBOT.AP WORM!
    Xwindows updateuddater.exeAdded by the LEOX TROJAN!
    XWindows Updatewudate.exeAdded by the AGOBOT.ML WORM!
    XWindows Updatewupdate.exeWengs adware
    Xwindows updatesychost.exeAdded by the LEOX.B WORM!
    XWindows UpdateWuamgrd.exeAdded by a variant of the SPYBOT WORM!
    XWindows Updateinetinf.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWindows Updatehost32.exeAdded by the RBOT-GU WORM!
    Xwindows updatewuraclt.exeAdded by the RBOT-PO WORM!
    Xwindows updateWuanclt.exeAdded by the RBOT.XZ WORM!
    XWindows Updateebay.exeAdded by the GAOBOT.BUU WORM!
    XWindows Updatewindows.exeAdded by the RBOT-RB WORM!
    XWindows Update AutoUpdate Client Productwuauct.exeAdded by the AGOBOT.ACL WORM!
    XWindows Update Checker[random filename]Adware downloader trojan
    XWindows update configsvhost.exeAdded by the SDBOT-PF WORM!
    Xwindows update configuratorsvghost.exeAdded by a variant of the SPYBOT WORM!
    XWindows Update Filesdnetc.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - wupdmgr.exe is the real Windows Update
    XWindows Update Managerwupdmngr.exeAdded by the RANDEX.BTB WORM!
    XWindows Update Manager for NTwupdmgr32.exeAdded by the SDBOT.AH WORM!
    XWindows Update Monitoring Servicewinupdt.exeAdded by the RBOT-PL WORM!
    XWindows Update Processwmiprvsc.exeAdded by the SDBOT-CB WORM!
    XWindows Update Servicecsrs.exeAdded by the AGOBOT-NI WORM!
    XWindows Update Servicesmcg.exeAdded by the SDBOT.QY WORM!
    XWindows Update Service 2004/2005systemupdate.exeAdded by the RBOT-JE WORM!
    XWindows Update V6[random filename]Added by the RBOT-KT WORM!
    XWindows Update.exeN/AHomepage hijacker, see here
    XWindows Updaterwupdmgr32.exeAdded by a variant of the DOS.AUTOCAT TROJAN!
    NWindows Version Checkver_chk.exeVersion checker for CyberAudioLibrary ("A new way to exchange information through the Internet")
    XWindows videovide_32.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWindows Video Acquisition (WVA)wvsvc.exeAdded by the AGOBOT.YM WORM!
    XWindows Video Driversvideons32.exeAdded by the GAOBOT.AZT WORM!
    XWindows-SystemSystem32.exeAdded by the LOGPOLE.C WORM!
    XWindows-TCP-IPrfkampig.exeAdded by the GIPMA TROJAN!
    XWindows32rundll.exeAdded by the AGOBOT-LK or AGOBOT-ND WORMS!
    XWindowsAgentWindowsAgent.exeAdded by the GOP.G WORM!
    XWindowsAPI.DLLServer5.exeAdded by the "Fear and Hope" TROJAN!
    XWindowsCriticalUpdatewindows_critical_update.exeAdded by the ASTEF or RESPAN WORMS!
    XWindowsKeyUpdatemaster.exeAdded by the JOSAM WORM!
    XWindowsMGMWinmgm32.exeAdded by the SOBIG WORM and LALA.C TROJAN!
    XWindowsRegistration[random filename]Added by the RBOT-NO WORM!
    XWindowsRegKey Autoupdate[random filename]Added by a variant of the RBOT WORM!
    XWindowsRegKey upd4te2d4te*********.exe [* = random char]Added by the RBOT.XQ WORM!
    XWindowsRegKey update[random filename]Added by a variant of the RBOT WORM!
    XWindowsRegKey%$ updatemsi332.exeAdded by the RBOT-IX WORM!
    XWindowsRegKey%updateethernet32m.exeAdded by the RBOT-EN WORM!
    XWindowsRegKeys updatewinsysi.exeAdded by the SDBOT.WE WORM!
    XWindowsSetup[path to trojan]Added by the EZBOT TROJAN!
    XWindowsUpdWindowsUpd4.exeVirtuMonde adware
    XWindowsUpd1WindowsUpd1.exeVirtuMonde adware
    XWindowsUpd2WindowsUpd2.exeVirtuMonde adware
    XWindowsUpdatewindows_update.exeAdded by the LOFNI WORM!
    XWindowsUpdatesvchost.exeAdded by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XwindowsupdateRPCX1sQ3.exeAdded by the IRCBOT.B TROJAN!
    XWindowsUpdateUSRINIT.EXEAdded by the MADDIS.B WORM!
    XWindowsUpdate Servicewuautlc.exeAdded by the RBOT-NR WORM!
    XWindowsXP Updatewindowsxpupdate.exeAdded by the RBOT-PB WORM!
    XWindows_SerivceSERVICE.exeAdded by the WOOTBOT.AH WORM!
    XWindows_Updatessvthost.exeAdded by a variant of the SPYBOT WORM!
    XWindows_VXDuser32.exeAdded by the PWSTEAL.PPORT TROJAN!
    XWindowz Update V2.0Explorer.exeAdded by the YODO WORM! Note - the valid "explorer.exe" is located in C:Windows or C:Winnt whereas this one is located in the System32 sub-directory
    XWinDriv32WinDriv32.exeAdded by the SMALL-BA TROJAN!
    Xwindrvwindrv32.exeAdded by an unidentified VIRUS, WORM or TROJAN! - possibly a strain of OBLIVION or BIONET
    XWinDrvwindrvx.exeAdded by a variant of the TIBSER.A downloader TROJAN!
    UWinDSL MTU-AdjustWinDSL_MTU.exeAdjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung
    ?WinDSL_MTUWinDSL_MTU.exeMay be realted to Tiscali broadband, if so is it required?
    XWinDSNXWin????.exeAdded by the DNSX TROJAN!
    XWindUpdates[path to trojan]Added by the AGENT.BF TROJAN!
    XWindUpdatesWinUpdt.exeBlazeFind "Windupdates" targeted advertizing
    UWINDVDpatchCTHELPER.EXECTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative?s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it
    NWinDVR SchSvrSchSvr.exeWinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs
    NWinDVRCtrlWinDVRCtrl.exeControl center software for an AOpen VA1000 TV tuner card
    XWindws Configuration LoaderLEXPLORE.exeAdded by the SODABOT WORM!
    XWinEssentialKeyhost.exeHijacker - hailing from jraun.com
    XWinEssentialkeyword.exeJraun.com hijacker
    XWinExecWinexec.exe.vbsAdded by the AINESEY.A WORM!
    XWinExec32WinExec32.exeAdded by the KAZWIN WORM!
    UWinFast ScheduleWfwiz.exeLeadtek WinFast TV tuner scheduler
    UWinfast2KLoadDefaultRundll32.exe Wf2kcpl.dll, DllLoadDefaultSettingsLoads default settings for Leadtek Winfast graphics cards
    UWinfast_2KWF2k.exeSystem Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card
    UWinFast_GammaRundll32.exe wfcpl.dll, DllLoadGammaRampSettingsLoads if you change the gamma settings on Leadtek WinFast graphics cards
    UWinFast_Taskbarrundll32.exe wftask.dll, WFDllLoadDefaultSettingsLoads default settings for Leadtek WinFast graphics cards
    XWinFavoritesWinFavorites.exe1Loudmarketing.com adware downloader
    NWinFax PRO ControllerWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
    YWinFaxAppPortStarterwfxsnt40.exeWinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
    Xwinfontwinfont.exeAdded by the DEATH TROJAN!
    UWinFoxV2WF2k.exeSystem Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card
    XWinFXcssrs.exeAdded by the AGOBOT.FX WORM!
    XWinGateWinGate.exeAdded by a variant of the LOVGATE WORM!
    UWinGate Engine Monitorwgengmon.exeWinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine, and appears in the system tray of each workstation on the network reassuring clients that their workstations have connectivity with the WinGate Server
    XWinGate initializeWinGate.exeAdded by a variant of the LOVGATE WORM!
    Xwingowingo.exeAdded by the BEAGLE.AW or BEAGLE.AV WORMS!
    NWinGuage ProWGPRO32.EXEPart of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs
    YWinguardWGFE95.EXEDr Solomon's Virex antivirus
    UWinGuard Prowgp.exeWinguard Pro
    NWinHackerrundll32.exe wh95.dll, HackMeTweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free
    XWinhelpwinhe1p.exeAdded by the QQPASS.E TROJAN!
    XWinHelpWinHelp.exeAdded by a variant of the LOVGATE WORM! Note - "winhelp.exe" resides in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP) whereas the valid "winhelp.exe" resides in C:Windows or C:Winnt
    XWinHelprealsched.exeAdded by a variant of the LOVGATE WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name
    XWinhelpTkBellExe.exe...Added by a variant of the LOVGATE WORM!
    Xwinhlp3.exewinhlp3.exeAdded by a variant of the EASTO.A TROJAN!
    XWinhlp32Wscript.exe ..Msexec32.vbsAdded by the GANT.B WORM!
    Xwinhlp32.exewinhlp32.exeAdded by a variant of the EASTO.A TROJAN!
    Xwinhlpp32.exewinhlpp32.exeAdded by the GAOBOT.SY WORM!
    XWinhostwintt.exeAdded by the LOLAWEB.B TROJAN!
    XWinhostwin.exeAdded by the DLOADER-AP TROJAN!
    Xwininet32wininet32.exeAdded by the RAZNEW-A TROJAN!
    Xwininetdwininetd.exeAdded by the WINET TROJAN!
    Xwininitwininit.exeAdded by the WOLLF.16 TROJAN!
    XWink*.exeWink*.exe [* = random char]Added by a variant of the KLEZ WORM!
    UWinkb6winkb6.exePart of We-Blocker, works in tandem with syswb6. Both files are needed to run WeBlocker. Required if We-Blocker is installed
    XWinKernelWinKer.exeAdded by the MIRAB or SERVIDOR TROJANS!
    XWinKernel[path to worm]Added by the PLEA VIRUS!
    Xwinkernel32wWin32.comAdded by the BANSAP TROJAN!
    UWinKeywinkey.exeLoads Copernic's WinKey. Used to map out Windows key hotkey combinations. Not required for the system, but is necessary for this to be running if you use these hotkey combos
    Xwinlibs.exewinlibs.exeAdded by the EVAMAN.C WORM!
    XWinLibUpdatelibupdate.exeAdded by the BIONET series of TROJANS such as BIONET.31 or BIONET.310
    XWinLibUpdate32libupdate32.exeAdded by the BIONET.405 TROJAN!
    XWinLibUpdtelibupdte.exeAdded by the BIONET.318 TROJAN!
    XWinlinkwinlink32.exeAdded by the GAOBOT.AAY WORM!
    XWinlmewindll.exeAdded by the GOP.F WORM!
    XWinLoader[random filename]Added by variants of the SUBSEVEN TROJAN!
    Xwinlocatorupdateupdatewinlocator.exeLocator adult content toolbar related
    XWinLoginwinlogin.exeAdded by the AGOBOT-IX WORM!
    XWinlogin.exelog.exeAdded by a variant of the AGENT.AH downloader TROJAN!
    Xwinlogin.exelogfile.exeAdded by the AGENT.AH TROJAN!
    Ywinlogonwinlogon.exeWindows Logon Process - handles user logons described here
    Xwinlogonwinlogon.exeHijacker or adult content dialler - file is located in C:Windows or C:Winnt, and not in it's System or System32 subdirectory, as is the case with the legitimate Windows Logon (winlogon.exe) process
    Xwinlogonwinlogin.exeAdded by the RANDEX.E WORM!
    Xwinlogonwinlogon.exeAdded by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! File is located in C:Windows or C:Winnt, and not in it's System or System32 subdirectory
    XWinlogon.exeN/ACoolWebSearch parasite related - resets home page to an adult material site
    XWinLsassservicec.exeAdded by the SCANE WORM!
    XWinLsass[path to trojan]Added by the SCANE WORM!
    Xwinltmpvwinln.exeAdded by the TCXMEDI-C TROJAN!
    Xwinltmpvwutop.exeAdded by the TCXMEDI-C TROJAN!
    XWinmainwinmain.exeOne of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. BOClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled!
    ?WinManagerschost.exe??
    Uwinmatrix.exeWinMatrixXP.exeWinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop
    UWinMemWinMem.exeWinMem Cleaner - part of Ultra WinCleaner Utility Suite. Makes more memory available for your programs and the Operating System. It also defragments your system
    XWinMenssagewinmax.exeAdded by the BANCOS.B TROJAN!
    NWinMgmtWinMgmt.exeUsed for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here
    XWinMgr32winmgr32.exeAdded by the MIMAIL.P WORM!
    XWinMineD4NG3.vbsAdded by the BISCUIT.A WORM!
    Ywinmodemwmexe.exeSoftware for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information
    XWinMsrv32WinMsrv32.exeAdded by the GAOBOT.AFJ WORM!
    Nwinmysqladminwinmysqladmin.exeStarts the MySQL database admin tool
    NWinMySQLadmin Toolwinmysqladmin.exeStarts the MySQL database admin tool
    Xwinnetwinnet.exeCommonName Toolbar spyware. To uninstall see here
    ?Winnov MenuWnvMenu.ExeWinnov Video Capture Card related. What does it do and is it required?
    ?Winnov RemoteWnvRsvr.ExeWinnov Video Capture Card related. What does it do and is it required?
    ?Winnov StatusWvStatus.ExeWinnov Video Capture Card related. What does it do and is it required?
    XWinNtBBWinntBB.exeAdded by the DULOAD.C WORM!
    Xwinocx32winocx32.exeAdded by the PROTORIDE.I WORM!
    UWinPatrolWinPatrol.exeWinPatrol - "Manage Startup programs, tasks, cookies; will sniff out Worms, Trojan horses, Cookies, Adware, Spyware, Klez, Assumption and other malicious programs"
    Xwinphonics7536vbsystem35.exe setups.exe vb.vbAdded by a variant of the MUTIN-C TROJAN!
    YWinPoetWinPPPoverEthernet.exeWinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking
    NWinPopupWINPOPUP.EXEIntranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95, and maybe in WFWG 3.11. Normally it won't set itself up to run unless the user specifically adds it to startup
    Xwinpopupwinupie.exeAdware by Tradeexit.com
    XWinProfileCommand.exeAdded by the BUDDY TROJAN!
    XWinProfilesndcfg16.exeAdded by the SNDC.A WORM!
    XWinProtWinprot.exeAdded by the CHUPACABRA TROJAN!
    XWinProtserver.exeAdded by the CHUPACABRA TROJAN!
    UWinProxyWinProxy.EXE"WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP"
    Xwinpsdwinpsd.exeAdded by the MYDOOM.Q WORM!
    Xwinrarwinrar.exeCoolWebSearch parasite variant. Note - this is not the file zipping utility also known as WinRAR and it's located in C:Winnt or C:Windows
    Xwinrarshellwinrarshell32.exeAdded by the SALIRA TROJAN!
    XwinRegwinReg.exeAdded by the YAHA.H or YAHA.J WORMS!
    Xwinregsrvwinregsrv.exeAdded by the SYNRG TROJAN!
    XWinres32vis[path to worm]Added by the THRAX.A WORM!
    Nwinroutewinroute.exeWin-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process, also to log in to the console to view logs and change settings. Can be unchecked and the engine still runs and functions normally. Can then use provided shortcuts for administration of the program. Loaded in SERVICES on Windows 2k
    Xwinrunmsconfig.exeAdded by the WINUR.A WORM! Note - this is not the real msconfig.exe as it's located in C:winrun
    Xwinrunwinrun.exeAdded by the WINBUR.B WORM!
    XWinRunnersWinDrivers.exeAdded by the DULOAD.C WORM!
    Xwinsecurewinsecure.exeBrowser hijacker, redirecting to specificsearches.com
    XwinserverServer.txt.vbsAdded by the DELTAD.A WORM!
    UWinService32ssmgr.exe007 Spy Software - "stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"
    XWinServicesWinServices.exeAdded by the YAHA.K or YAHA.M WORMS!
    Xwinservnwinservn.exePurityScan/Clickspring adware
    Xwinservswinservs.exePurityScan/Clickspring adware
    XWinSetBrowseBasicUpdate.dll.vbsAdded by the BISCUIT.A WORM!
    ?Winshoewuadfdqr.exeProbably an unidentified VIRUS! Adds itself to 3 registry "Run" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed
    XWinShowUpdatecopy C:WINDOWSwinshow.new C:WINDOWSwinshow.dllWinshow parasiate related - from the "RunOnce" keys it replaces "winshow.dll" with a new version
    XWinSigNetXP.exeAdded by the BANKER-FN TROJAN!
    XWinsock2 driverSDJOIJE.EXEAdded by the SPYBOT.DR TROJAN!
    XWinsock2 driverMIRC32.exeAdded by the SPYBUZZ TROJAN!
    XWinsock2 driverkgzgjkpcw.exeAdded by the SDBOT.T TROJAN!
    XWinsock2 driverZONEALARM.EXEAdded by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program
    XWinsock2 driverWINCFG.SCRAdded by a variant of the SPYBOT WORM!
    XWinsock2 driverwinupdate.exeAdded by the SPYBOT-BX WORM!
    XWinsock2 driverSPOLSV.EXEAdded by the SPYBOT-CM WORM!
    XWinsock2 driverZonealarmupdate.exeAdded by a variant of the SPYBOT WORM!
    XWinsock2.dllWINLODR.SCRAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinsock32 driverTesting.exeAdded by the SPYBOT.B WORM!
    XWinsock32 driverlcd.exeAdded by the SPYBOT.B WORM!
    XWinsock32 driverSdjoije.exeAdded by the SPYBOT.B WORM!
    XWinsock32driverwin32server.scrAdded by the HACARMY TROJAN!
    XWinsock32driversp2XPupdate.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinsock32driverwin32server.exeAdded by the BACKDOOR-AZV TROJAN!
    XWinsock32driverZoneAlarmPr0.exeAdded by the HACKARMY-B TROJAN!
    XWinsock32driverZoneLockup.exeAdded by the HACARMY.D TROJAN!
    XWinsock32driverwin32server.exeAdded by the HACARMY.F TROJAN!
    XWinsock32driverwinXPupdate.exeAdded by the HACKARMY.9728 TROJAN!
    Xwinsockdrivertskmg.exeAdded by the SDBOT.GEN TROJAN or WARPIGS.C WORM!
    Xwinsockdriverwinsock2.2.exeAdded by a variant of the SPYBOT WORM!
    XWinSocketComponentnthost.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinSPFwindrv32.exeAdded by the MYDOOM.T WORM!
    XWinSPFwinspf32.exeAdded by the MYDOOM.S WORM!
    XWinSrvkn0x.exeAdded by the HOBBIT.F WORM!
    XWinSrvSHIZZLE.EXEAdded by the HOBBIT.C WORM!
    XWinsrvwinsrv.exeAdded by the OPASERV.T WORM!
    XWinStartWinStart.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinStartWscript.exe WinStart.vbsAdded by the CIAN.C WORM!
    XWinStartwinstart32.exeAdded by the PUROL WORM!
    XWinStartWinStart.pifAdded by the CONE.E WORM!
    XWinStart001WinStart001.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinStart001.EXEWinStart001.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinsta~1winsta~1.exeGoHip foistware
    XWinSth16WinSth16.exeAdded by the CAKE WORM!
    XwinstroRUN32DLL.exeAdded by the FTP_ANA TROJAN!
    XWinsvc32Winsvc32.exeHomepage hijacker
    UWinsysWinsys.exeWin-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it 
    XWINSYS[path to trojan]Added by the GOLDPLAY TROJAN!
    XWinSys32Winsys32.exeAdded by the CIGIVIP TROJAN or RECKUS WORM!
    Xwinsys32 Driverwinsys32.exeAdded by the LOONY-O TROJAN!
    UWinSysAppMonWinSysRM.exeHome & Family Content Filter related. See here
    Xwinsyslog lptt01
    winsyslog.exeVariant of the RapidBlaster parasite (in a "Winsyslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    XWinSysStartUpWKbLwTaskSystemDll.ExeAdded by the BACKZAT.G WORM!
    XWinSyst32winsyst32.exeAdded by the MORB WORM!
    XWinSystemwinsystem.exeAdded by the WHITEBAIT WORM!
    XWinsystemwinsystem.exeAdded by the BANCOS.CR TROJAN!
    XWinTaskWintask.exeAdded by the HIPO or LEMIR.F TROJANS!
    XWinTask driverwintask.exeAdded by the SMALL.ABD downloader TROJAN!
    UWinTasks Traybarwintasks.exeWinTasks - "Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task, but will actually make your system run faster and more smoothly than ever before"
    Xwintasks.exewintasks.exeAdded by the EVAMAN WORM!
    NWintercooler ProWINCOOL.EXEWintercooler Pro - utility that monitors CPU usage, RAM consumption and Internet connection speed
    NWinTidyWinTidy.exeDesktop icon manager from PC Magazine (Ziff-Davis) for Win95. Available via Start -> Programs
    XWintimeWintime.exeAdded by the HARNIG TROJAN!
    NWintime WtxploadWxpload.exe WintimePart of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet, if it's not already running. It then starts an application which manages the tablet messages. Since I leave the tablet unplugged unless I need to use it, I don't need this running at startup. I suspect that this program monitors a number of windows messages, so that when it's loaded, my regular mouse slows down - it acts like it 'sticks' entering and leaving windows. Certainly my performance returned to what I expected when I removed this item using MSCONFIG"
    XWinToolsWToolsA.exeWintools adware
    NWinTOTAL Schedulerguru.exeWinTOTAL Real estate appraisal software related
    XWinTraywintray.exeAdded by the LEGUARDIEN.B TROJAN!
    XwinupdRUNDLL32.EXE [random value].dll, _mainRDAdded by the MOTA.A WORM!
    Xwinupd.exewinupd.exeAdded by the BEAGLE.M or BEAGLE.N WORMS!
    XWinUPD32explorer.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    Xwinupdatwinupdat.exeAdded by the CANBOT.A WORM!
    XWinUpdateRBSKQQBO.EXEAdded by the VBSWG2B.A WORM!
    XWinUpdatewmbem.exeAdded by the REVCUSS.B TROJAN!
    XWinUpdate Loadermsnnm.exeAdded by the REVCUSS.C TROJAN!
    Xwinupdate.exewinupdate.exeAdded by the RADO TROJAN!
    Xwinupdate.regwinupdate.exeAdded by the SPYBOT.EAS WORM!
    Xwinupdate2846vbsystem35.exe msvbrun.exeAdded by a variant of the MUTIN-C TROJAN!
    XwinupdtRUNDLL32.EXE [random.dll]Added by the MABUT.A WORM!
    Xwinupdtlwinupdtl.exeSecondThought adware variant
    Xwinurwinrun.exeAdded by the WINBUR.B WORM!
    XWinux Piriax ServicePH32.EXEAdded by the RANDEX.G WORM!
    Xwinversionwinversion.exeBrowser hijacker, redirecting to specificsearches.com
    UWinVNCWinVNC.exeWinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet
    XWinVNCiexplorer.exeAdded by the EVIVINC VIRUS!
    Xwinwan lptt01winwan.exeVariant of the RapidBlaster parasite (in a "Winwan" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    Xwinwan ml097ewinwan.exeVariant of the RapidBlaster parasite (in a "Winwan" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    XwinXP33.exeAdded by the ANPES WORM!
    XWinXPplugin1.exeAdded by the Downloader-JW TROJAN!
    Xwinxpdll32.exewinxpdll32.exeAdded by a variant of the SMALL downloader TROJAN!
    UWinXPLoadRundll32 LoadDll, LoadExe WinXPLoad.exeCompaq hotkey related - required if you use the hotkeys
    Xwinzip[path to trojan]Added by the BANCOS.G or BANCOS.K TROJANS!
    NWinZip Quick PickWZQKPICK.EXEAdded with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up
    XWin_api_driversystem.exeAdded by the REVIRD TROJAN!
    XWin_LibraryINISvc.exeAdded by the ANARCH WORM!
    Xwin_upd.exeWINdirect.exeAdded by the MITGLIEDER.M TROJAN!
    Xwin_upd2.exeWINdirect.exeAdded by the BEAGLE.AO WORM!
    XWin_vaderWin_vader.vbsAdded by the INVASION.A VIRUS!
    XWIP Config GUIWinipcfgs.exeAdded by the RBOT-CN WORM!
    UWireless PCI Card Configuration UtilityWMP11Cfg.exeUtility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration
    XWireless Provider Serverwpsvr.exeAdded by the FORBOT-AD WORM!
    UWireless-G Notebook Adapter UtilityWPC54CFG.EXEUtility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G)
    Nwjviewwjview.exeMS tool used to view window-based Java applications from the command line
    Nwkcalremwkcalrem.exeProduces a pop-up reminder of events scheduled using the MS Works Calendar
    NWkDetectWkDetect.exeChecks for updates to MS Works
    Nwkfudwkfud.exeA marketing program for MS Works
    NWksSbWksSb.exeThe Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file
    NWkUFindWkUFind.exeMS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site
    XWlan DrierWinusb2.exeAdded by the WOOTBOT.DC WORM!
    XWlan Driveravscan.exeAdded by the WOOTBOT.DH WORM!
    NWLAN Status Tray AppletWLANSTA.EXESystem Tray icon for checking the status of a Wireless LAN
    YWLAN_Cfg.exeWLAN_Cfg.exeLinksys Instant Wireless USB Network Adapter driver
    Xwm41a398rundll32.exe [path] wm41a398.dll, EnableRunDLL32LZIO.com adware downloader
    XWMAudioservices.exeAdded by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
    XWMAudiowinlogon.exeAdded by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup!
    NWMBootN/AAssociated with Logitech Wingman game controllers. Not required but what does it do?
    UWMIEXE.exewmiexe.exeNT component, used by Windows Millennium to detect  Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed. Check here for some details on what to do to stop it loading
    XWminfWminf.exeAdded by the GEMA TROJAN!
    XWminfoWminfo.exeAdded by the GEMA TROJAN!
    Xwmiprvwmiprv.exeAdded by the RBOT-WM WORM!
    YWMP54Gv4WMP54Gv4.exeLinksys WMP54G Wireless-G PCI Adapter driver
    Xwmsys32wmsys32.exeAdded by the BANPAES.B TROJAN!
    ?WM_LOGINMSGLOGIN.EXEPart of McAfee Firewall. What is it for and is it needed?
    XWNADWNAD.EXESpyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like
    XWNSCwns*****.exe [* = random char]PurityScan/Clickspring adware
    UWNSIwnscp**.exe [* = random char]PurityScan/Clickspring adware
    XWNSIwnscpsu.exePurityScan/Clickspring adware
    XWNSIwnscpsv.exePurityScan/Clickspring adware
    XWNSTwns*****.exe [* = random char]PurityScan/Clickspring adware
    NWoowatchWatch.exeWanadoo ISP software, not required
    NWordWebwweb32.exeWordWeb - free theasaurus and dictionary. Start manually
    ?Workfloworkflow.exeRelated to BroadJump Client Foundation - broadband troubleshooting software installed by various companies. Is it required?
    NWorks Calendar Reminderwkcalrem.exeProduces a pop-up reminder of events scheduled using the MS Works Calendar
    NWorksFUDwkfud.exeA marketing program for MS Works
    UWorkstation Schedulerwm95.exeDesktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled, it is required, otherwise, it is useless and a memory hog
    XWorkstation Serviceswrkstn.exeAdded by the RBOT-OJ WORM!
    UWorm Detectorwd.exeWorm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam
    Xwormexewinstart.exeAdded by the EARLYBIRD WORM!
    Xwovaxwovax.exeAdded by the DAQA.A TROJAN!
    NWpctrlwpctrlnt.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    NWpctrlwpctrl95.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    Nwpctrl95wpctrlnt.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    Nwpctrl95wpctrl95.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    YWPCycle.exeWpCycleWin.exeAdded when selecting Mplayer2 to open media files. Forces other codes to Wait for Previous instructions to end, preventing instability of your CPU (freezing)
    Xwpds.exedoriot.exeAdded by the SMALL-KY TROJAN!
    XWQKWQK.exeAdded by a variant of the KLEZ WORM!
    ?wrWR.EXE??
    ?WR Commandwr.exe??
    NWrCtrlWrCtrl.exeWin-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not work, but you can manually start/stop the service with a shortcut the program installs at any time
    XWRDialerWrDialer.exeWinPoet DSL dialler
    ?WRECK GUARD????
    ?WregBioswregbios.exeDesktop Management BIOS (DMI BIOS) related. Apparently invokes the DosBios.exe file. Is it required?
    Uwrexecwrexec.exeWatch Right - monitoring program, part of the PowerTools add-on for AOL. Records instant messages, E-mail, chat. Watch Right appears to be, and functions as an online clock updater which connects with the U.S. National Institute of Standards and Technology. It was designed for parents who wish to keep an eye on what their children are doing online
    ?wristewriste.exe??
    Xws2helpws2help.exeAdded by a variant of the SMALL.AN TROJAN!
    XWSAConfigurationwmon32.exeAdded by the GAOBOT.BAJ WORM!
    XWSAConfigurationsvchostt.exeAdded by the AGOBOT.ZT WORM!
    XWSAConfigurationrpcxmn32.exeAdded by the AGOBOT.ABG WORM!
    ?wsbklitewsbklite.exeRelated to the Acer Soft Button on Acer Tablet PCs. Appears to do nothing so is it required?
    UWSchedulerWScheduler.exeWindows Scheduler - "schedule unattended running of applications, batch files, scripts and much more. Also, you can schedule popup reminders so you'll never forget reminders, tasks and other events."
    Xwscript.exevabian.vbsAdded by the VABI VIRUS!
    Xwserverwserver.exeAdded by the NETSKY.AC or SASSER.G WORMS!
    UWServiceWService.exeTablet client Driver for UC-Logic Pen/Graphics Tablet
    XWSSAConfigurationwmmon32.exeAdded by the AGOBOT-KC WORM!
    XWstat32 driverWstat32.exeAdded by the LOONBOT TROJAN!
    Ywstimebwstimeb.exeUsed with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it
    Ywswpdwswpd.exeUsed with some models of Panasonic, Epson and NEC printers. Some older drivers known to have a "memory leak". Needed for printing to work 
    NWT Game ChannelGameChannel.exeWildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWT Game Channelwtgamechannel.exeWildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWT GameChannelGameChannel.exeWildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWT GameChannelwtgamechannel.exeWildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    UWTIndicatorSchedInd.exeWinTask - software that automates a variety of routine tasks quickly and simply
    XWTSIwapisvit.exePurityScan/Clickspring adware
    XWTSSwap***.exe [* = random char]PurityScan/Clickspring adware
    XWTSSwapicc.exePurityScan/Clickspring adware
    XWTSSwapiit.exePurityScan/Clickspring adware
    XWTSSwapisu.exePurityScan/Clickspring adware
    XWTSSwapisvsu.exePurityScan/Clickspring adware
    XWTSTwapisvtr.exePurityScan/Clickspring adware
    YWUOLServiceWUOLService9x.exeRemote wakeup status agent. Part of Novell's ZenWorks. Processes Wake-up on LAN requests (turn on a computer remotely on LAN)
    XWUPDiglmtray.exeAdded by the TZET WORM!
    Xwupdtwupdt.exeAdded by the IMISERV.A TROJAN!
    YWUSB11B.exeWUSB11B.exeLinksys WUSB11 WLAN USB adapter
    ?WUx_RegSvrRegSvr32.exex is any number??
    Xwvsvcwvsvc.exeAdded by the AGOBOT.YM WORM!
    Xwww.hidro.4t.comenbiei.exeAdded by the BLASTER.F WORM!
    Xwww.symantec.comoz11111.exeAdded by the MYDOOM.W WORM
    NWXProcMgr ModuleWXprocMgr.exeTVTonic from Wavexpress - "enjoy 3 full-screen, DVD-quality video channels for FREE". Allows data content to be downloaded and synchronized on your system
    Xwzhelperwzhelper.exeSearchcentrix hijacker
    Xw32w32.exeAdded by the SOKEVEN TROJAN!
    XW32.ScranScran.exeAdded by the NARCS WORM!
    Xw32alanismope.scrAdded by the SINALA WORM!
    XW32Load[random filename].scrAdded by the CASPID WORM!
    Xw32supw32sup.exeAdult content dialler
    XW32TcWTC32.scrAdded by the VOTE.D or VOTE.K WORMS!
    XW3KNetworkrundll32.exe w3knet.dll, dllinitrunAdvertising spyware. Check here for more info on this particular one
    YW75P2PSERVERW75P2PS.EXEPrinter utility which is required in order to make the printer work correctly
    ?W815DMW815DM.exe??
    NWanadoo Messenger.exeWanadoo Messenger.exeWanadoo ISP instant messenger client
    YWanMPSvcWanMPSvc.exeAn AOL component, the Wan miniport (ATW) service. If you delete this and logon, AOL reports a problem with your internet connection, and reinstalling AOL doesn?t help
    XWAPIwts**.exe [* = random char]PurityScan/Clickspring adware
    Nwar-ftpd.exeWAR-FTPD.EXEWar FTP Daemon from JGAA's Internet - FTP client
    XWardosyslaunch.exeAdded by the ADLCICKER.G TROJAN!
    Nwarezwarez.exeWarez P2P client
    UWarnerwarner.exeAlso known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files
    UWarnetwarnet.exeWarnet - system cleanup software
    UWarning: do not remove it!fpplock.exePart of Folder Password Expert by ZQS Software Team - "a software program to restrict access to the folders that contain your sensitive data"
    NWARSVRwar-ftpd.exe"War FTP Daemon - the original free FTP server for windows"
    UWashAndGo - Cleanup of old Backupfileschecker.exeWashAndGo - temp file cleaner
    UWasherwasher.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    NWasherie.exewasherie.exeCookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer, specific for cleaning the IE cache and cookies. Available via Start -> Programs
    Uwashindexwashidx.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    XWastwast.exeGrokster ads updater
    NWatchwatch.exeFound to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted
    ?Watch1200UBWATCH.EXE??
    NWatch Dog Programwatchdog.exeFor Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do
    NWatchdogWatchdog.exeDefinitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others), launches from the Startup folder in the Start Menu, but not required as they give instructions on removing it on their webpage
    NWaveTop LauncherWaveTop.exeWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop Receiver 1N/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop Receiver 2N/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWaveTop Upload ManagerN/AWaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98
    NWbiffWbiff.exeWbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received
    ?WbuttonWbutton.exeRelated to the Wacom Penabled driver on Acer Tablet PCs. Appears to do nothing so is it required?
    NWCESCOMMWCESCOMM.EXEActive sync for use with Windows CE based palm PC
    Uwcmdmgrwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    Nwcmdmgr.exewcmdmgr.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    Uwcmdmgrlwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    UWCOLOREALcoloreal.exeMakes colours sharper and brighter, but will only work with coloreal capable monitors
    ?WCPCwintsvcc.exe??
    XWCPIwintsvit.exePurityScan/Clickspring adware
    XWCPSWint**.exe [* = random char]PurityScan/Clickspring adware
    XWCPTwintsvtr.exePurityScan/Clickspring adware
    UWD Button ManagerWDBtnMgr.exeButton manager installed with a western digital external disk drive. Allows you to back up your system with one click
    XWDInfowdinfo.exeAdult content dialler
    Xwdskctlwdskctl.exeIEPlugin spyware
    Xwdwctrlwdwctrl.exeAdded by the DLUCA.E TROJAN!
    NWEATHERWEATHER.EXEWeatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs
    NWeatherCastWeather.exeWeather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight
    XWeatherOnTrayWeatherOnTray.exeHotbar's Weather Forecast tool for your desktop - adware
    NWeatherWatcherww.exeWeatherWatcher - weather reporting in the System Tray
    Xweb******.exe [* = random char]Added by a variant of the EASTO.A TROJAN!
    ?Web Search????
    Yweb3trapweb3trap.exePC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs, etc 
    Xwebalizewebalize.exeSearchcentrix hijacker
    NWebArmyKnifeWAK.exeWeb Army Knife - a suite of web site developer's tools
    Xwebassistwebassist.exeAdware popup generator
    ?Webcam Go Sti Service Applicationwbcgosvc.exeControl software for the portable Creative Video Blaster Webcam Go digital camera/PC web cam. What does it do and is it required?
    NWebcamRT.exeWEBCAMRT.exeFor Logitech Web Cams. Not required - camera works fine without it
    XWebceleratorwebcel.exeWebcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Spyware and troublesome - see here
    XWebCheckWebCheck.pifAdded by the CONE.C or CONE.F WORMS!
    XWebCpr0WebCpr0.exeWeb_CPR/TopMoxie adware
    XWebdav.exewebdav.exeIRC DDoS bot which gives the hacker full control over your system
    XWebHancer Agentwhagent.exeSystem Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here
    XwebHancer Survey CompanionwhSurvey.exeWebHancer foistware - traffic measurement service that uses a client agent that is stealth installed on user machines, gathering detailed data about sites visited, their performance and, most important, what the user actually does while there
    XWebInstallWebInstall.exeClipGenie adware downloader
    XWebInstall2WebInstall.exeClipGenie adware downloader
    NWebKeyWebKey.exeWebKey from JB Utilities. Utility to keep track of login data required when browsing the internet
    NWebOutfitterTraysttray.exeIntel WebOutfitter service System Tray icon
    NWebposition Gold 2wpsche~1.exeScheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines
    XWebRebates0WebRebates0.exeWebRebates adware
    Uwebsaverlivewebsaverlive.exeWebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle
    XWebSavingsfromEbatesWebSavingsfromEbatesrun.exeWeb Savings From Ebates Software, a shopping tool that opens pop-up windows
    XWebSavingsFromEbates0WebSavingsFromEbates0.exeWeb Savings From Ebates Software, a shopping tool that opens pop-up windows
    XWebScanDEFSCANGUI.EXEStop-Sign from eAccelerration. Detects spyware, malware, viruses and keyloggers and stops popups. Spyware in itself - see their privacy statement here
    Nwebscanstopsignav.exeeAcceleration Stop-Sign related - not recommended, see note
    YWebScanXWebScanX.exeFrom McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc
    Xwebsearchwjview ...websearch.exe"Web Savings" From Ebates Software, a shopping tool that opens pop-up windows
    XWebSecureAlertWebSecureAlert.exeWebSecureAlert. "Can help protect your browser security and privacy". However, it's by GAIN Publishing, and will display pop up ads on your computer screen based on your online Web surfing behavior
    ?WebServerVBI_SE~1.EXERelated to a Pinnacle sound card. What does it do and is it needed?
    NWebshotsWebshots Tray.exeScreensaver program that automatically downloads from the webshots web site
    NWebshotswebsho~1.exeScreensaver program that automatically downloads from the webshots web site
    XWebSpecialsrundll32 [path] webspec.dllWebSpecials spyware
    XWebsxInt*****.exeAdult content dialler - where ***** are random
    YWebtrapwebtrap.exePart of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating
    YWebTrapNT.exeWebTrapNT.exePart of PC-Cillin Anti-Virus software. Checks visited web-sites for malicious Java and ActiveX elements
    UWebWasherwwasher.exeFree Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs
    NWelcomeWelcome.exeLaunches the Welcome to Windows tutorial on boot up
    ?WEPstatWepstat.exeCisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be "U". Can anybody confirm this?
    Xwersdsdoriot.exeAdded by the JECT.C TROJAN!
    NWetSockwetsock.exeRoboMagic Wetsock - weather reporting in the System Tray
    NWFGStartupWFGStartup.exeWorld Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones"
    Uwfipsiphider.exeICQ (messaging/chat program) anti-bomb software. "WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed." For more information about ICQ bombs see here
    NWFXCTL32.EXEWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
    Ywfxsnt40wfxsnt40.exeWinFax 10.0 and maybe earlier versions. The program that opens the port for WinFax and not normally in the start menu. Needed if you want to run WinFax
    ?WFXSwtchWFXSWTCH.exeRelated to WinFax. What does it do and is it required?
    YWG511WLUWG511WLU.exeNetgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card
    UWGWLocalManagerWGWLocalManager.exePart of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creating a shortcut, running it only when connecting to the internet. If internet is used often, it's recommended to leave it in startup so it starts with the system
    Xwhagentwhagent.exeSystem Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here
    UWheelMouse4DMAIN.EXEMouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide
    UWheelMouseAMOUMAIN.EXEA4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features
    XWhenUSaveSave.exeRebranded version of SaveNow advertising spyware
    XWhenUSearchSearch.exeWhenUSearch adware
    XWhvlxdWhvlxd.exeAdded by the W32.LXD.MIRC TROJAN!
    NWIAWizardMenuRUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenuStill Image Class Installer - installed with a webcam
    ?WildTangent CDARUNDLL32.exe cdaEngine0400.dll,cdaEngineMainPart of the WildTangent on-line games system. What does it do and is it required?
    UWildTangent Web Driver updaterwcmdmgrl.exeWeb Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWildwire MonitorWWMon.exeThis places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem
    NWillow RoadWillowRoad.exeWillow Road Screen Saver
    Xwinregedit -s ..win.dllAdded by the SEEKER.K TROJAN!
    Xwinxwinxrpc32.exeAdded by the AGOBOT-MV WORM!
    UWin Chimeswinchi~1.exeWinChimes - enhancement software for the system clock that runs in the system tray
    XWin CommWinComm.exeWebRebates related adware
    XWin Commandcommand32.exeAdded by the AGOBOT.XQ WORM!
    XWin Commandcommand32.exeAdded by the AGOBOT.XQ WORM!
    XWIN HOST PROCESSWIN HOST PROCESS.EXEAdded by the KEYLOGGER.CLONE TROJAN!
    XWin l5oahderwinampa.exeAdded by the SPYBOTER.GEN VIRUS! Not the valid Winamp Agent which uses the same filename. This resides in the System32 sub-folder wheras real one is located in the winamp folder
    ?win namestat.exe??
    XWin Serverwinserv.exeAdded by the IMISERV.A TROJAN!
    XWin Server Updtwupdt.exeAdded by the IMISERV.A TROJAN!
    Xwin updatewupda32.exeAdded by the SDBOT.J WORM!
    XWin USB 2.0 USB DriverHPPrint.exeAdded by the SPYBOT.DNB WORM!
    XWIN-BUGSFIXWIN-BUGSFIX.EXEAdded by the LOVELETTER (I LOVE YOU) VIRUS!
    XWin2Drv[worm filename]Added by the WINTOO WORM!
    XWIN32WIN32.EXEAdded by the RATEGA TROJAN!
    Xwin32Shakira_1997_Part_1_.Mpeg_.scrAdded by the MYLIFE.N WORM!
    Xwin32Setup_32.exeAdded by the EVILBOT.B TROJAN!
    XWin32Win32.exeAdded by the ISRAZ.A WORM!
    Xwin32winsrv32.exeAdded by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites
    Xwin32WinSetup.exeAdded by the EVILBOT.B TROJAN!
    XWin32 Configurationvideosd32.exeAdded by the SDBOT.TT WORM!
    XWin32 Configurationdllhelp.exeAdded by the SDBOT.UL WORM!
    XWin32 Device LoaderWin32ldr.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWin32 DRK Driverwdrk32.exeAdded by the WOOTBOT.CY WORM!
    XWin32 exe filewinstr32.exeAdded by a variant of the SPYBOT WORM!
    XWin32 ExplorerExplorer32.exeStartPa-MN homepage hijacker
    XWin32 FRT Drivermsfr32.exeAdded by a variant of the FORBOT WORM!
    XWin32 Kernel core componentKernel32.pifAdded by the MOKS VIRUS!
    XWin32 Ms Auto UpdaterAutomsUPD.exeAdded by a variant of the RBOT WORM!
    Xwin32 regeditmsn32.exeAdded by an unidentified WORM or TROJAN!
    XWin32 Rundll LoaderRundll32.exeAdded by the SDBOT.A TROJAN! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:Windows directory. The version created by this virus is saved in the C:WindowsSystem directory
    XWin32 Services1wuamngr1.exeAdded by the SDBOT-PV WORM!
    XWin32 SSL Driverwinssv.exeAdded by the FORBOT-BH WORM!
    XWin32 System Spoolspoolsvc.exeAdded by the SDBOT.UK WORM!
    XWin32 USB Driverwinxpinit.exeAdded by the SDBOT.AA TROJAN!
    XWin32 USB Drivermvsecn.exeAdded by the FORBOT-BK WORM!
    XWin32 Usb Driversvhosint32.exeAdded by the FORBOT-BE or FORBOT-J WORMS!
    XWin32 USB2 Driverwin32usb.exeAdded by the SPYBOT.DHV WORM!
    XWin32 USB2 Driversmsc.exeAdded by the SDBOT.FO WORM!
    XWin32 USB2 Driversvchosting.exeAdded by the FORBOT.J or SDBOT.HU WORM!
    XWin32 USB2 Driversys32.exeAdded by the WOOTBOT.X WORM!
    XWin32 USB2 Driversys32snd.exeAdded by the FORBOT-AN WORM!
    XWin32 USB2 Driverwind32.exeAdded by the FORBOT-AH WORM!
    XWin32 USB2 Driverwinupdate.exeAdded by the AGOBOT.YE WORM!
    XWin32 USB2.0 Driver386.exeAdded by the IRCBOT.D WORM!
    XWin32 USB2.0 Driverrundll16.exeAdded by the WOOTBOT.H WORM!
    XWin32 USB2.0 Driverw32usb2.exeAdded by the SPYBOT.DN WORM!
    XWin32 USB2.0 Driverservice.exeAdded by the SDBOT-QF WORM!
    XWin32 Wmls Driverwinitr32.exeAdded by the WOOTBOT.B WORM!
    Xwin32.exewin32.exeAdded by the STARTPAGE TROJAN!
    XWin32BaseServiceMODWintask.exeAdded by the NAVIDAD WORM!
    Xwin32clfwin32clf.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWin32DLLWin32DLL.vbsAdded by the LOVELETTER (I LOVE YOU) VIRUS!
    XWin32dllWin32dll.exeAdded by the BANPAES TROJAN!
    XWin32GKernel32.comAdded by the ESTRELLA TROJAN!
    XWin32GScandisk.comAdded by the ESTRELLA TROJAN
    Xwin32gbwin32gb.exeAll-In-One-Telcom (adult content dialler) variant
    Xwin32infowin32info.exeAdult content dialler
    Xwin32inisystroy.exeAdded by the IRC.ALADINZ.C TROJAN!
    XWin32RServer.comAdded by the ESTRELLA TROJAN!
    YWIN32SLWin32sl.exePart of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. The specific function of this is to load MIF's in order for Dell OpenManage Client to work
    XWIN32SNDSbanc.exeAdded by an unidentified WORM or TROJAN!
    XWin32system[random filename]Added by the DDV.B WORM!
    XWin32Systemwin32s.exeAdded by the MYDOOM.V WORM!
    XWin32SystemMonitor***.exe [* = random char]Browser hijacker
    Xwin32uswin32us.exeAll-In-One-Telcom (adult content dialler) variant
    Xwin32usbdssrs.exeAdded by the RBOT-RA WORM!
    Xwin32_i lptt01win32_i.exeVariant of the RapidBlaster parasite (in a "win32_i" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    Xwin32_i ml097ewin32_i.exeVariant of the RapidBlaster parasite (in a "win32_i" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    XWin386Win386.exeAdded by the GOSUSUB VIRUS!
    XWin386sp32.dllHomepage hijacker. Not a dll but a regfile in disguise
    XWIN3S2SNDSwinabsmod.exeAdded by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well"
    XWIN3S2SNDSwiniprtx.exeAdded by the AGENT.DN TROJAN - known to BOClean as "CWS/INDEX", "shuts down anything that wants to open and is used as a spam proxy as well"
    XWin64 Compatibility Checkload win64.drvCoolWebSearch parasite variant
    XwinactiveWINACTIVE.EXEActive variant of LOP.com hijacker - see here
    XWinActiveJWinActiveJ.exeAdded by the ROTARRAN VIRUS!
    XWinad ClientWinad.exeWinAd adware by eXact Advertising
    Xwinadmwinadm.exeBrowser hijacker - redirecting to Search-World.net. Related to the SMALL.LR TROJAN!
    XWinahlp.exeWinahlp.exeAdded by a variant of the VAGRNOCKER TROJAN!
    Xwinallapwinallap.exeAdded by the DELF.E TROJAN!
    Xwinallapuwinallapu.exeAdded by the DELF.E TROJAN!
    XWinampwinamp.htaHijacker - re-directing to adult content sites. Note - this isn't the real Winamp
    XWinamp media playerwinapa.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    UWinampaWINAMPa.exeLoads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs
    XWinampawinampa.exeAdded by the AGOBOT-GS WORM!
    XWinampa AgentWINAMPA.EXEAdded by the SPYBOT-BR WORM! Note - this is NOT the Winamp Media Player
    UWinampAgentWINAMPa.exeLoads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs
    XWinApiwinapix.exeAdded by a variant of the TIBSER.A downloader TROJAN!
    XWinappwinpup32.exeProduces popup ads to adult content sites
    XWinApp32msapp.exeAdded by the RSBOT TROJAN!
    XWinAuthwinlogon.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the valid winlogon.exe process
    UWinBackup SchedulerWbsched.exeLIUtilities WinBackup scheduler - backup software
    UWinBarWinBar.exe"WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls"
    XWinbedwinbed.exeHijacker
    XWinCheckWinCheck.exeAdded by the PWS-CY TROJAN!
    NWINCINEMAMGRWINCIN~1.EXEWinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs
    NWinCinemaMgrWinCinemaMgr.exeWinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs
    XWinCSRSSMSGRT32.EXEAdded by the REWINDO-A TROJAN!
    Xwind.exewind.exeAdded by the MITGLIEDER.BD TROJAN!
    XWIND0WSWIND0WS.exeAdded by the SPYBOT.DQ WORM!
    NWinDateswindates.exeWinDates is a calendar, date organizer and event reminder program from Rockin' Software
    Xwindbswinxtc.exeAdded by the AGOBOT-WD WORM!
    XWindewinde.exeAdded by the DLUCA TROJAN!
    XwindefWin32sp.vbsAdded by the ANPES WORM!
    Xwindirwinrun.exeAdded by the WINBUR.B WORM!
    XWindllWindll.exeAdded by the TRYNOMA TROJAN!
    UWINDLLWSYS.EXESTARR key logger. "It logs almost everything that goes through the box. It logs all key strokes, all passwords transacted even if they weren't keyed in, all web sites visited, every program launched including the path to that program, and more"
    Xwindllwindll32.exeAdded by the ASTEF or RESPAN WORMS!
    XWindll.exeWindll.exeAdded by the STEALER TROJAN!
    XWindll32Windll32.exeAdded by the MSNPWS TROJAN!
    Xwindllsys32.exewindllsys32.exeAdded by a variant of the MITGLIEDER.BY TROJAN!
    XWinDNSwindns32.exeAdded by the GAOBOT.WX WORM!
    XWindoes Kernelkernel32.exeAdded by the KICKIN.A (or CYDOG.C) WORM!
    XWindowexplore.exeAdded by the GAOBOT.ADW WORM!
    XWindow LoaderDos32.exeAdded by the GAOBOT.AO WORM!
    XWindow Monitorwinmon32.exeAdded by the SDBOT.RT WORM!
    UWindow WasherwwDisp.exeWindows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
    Xwindow.exewindow.exeAdded by the MITGLIEDER.H or MITGLIEDER.J TROJANS!
    Xwindow2ssvchost.exeAdded by the IRCBOT.H TROJAN!
    UWindowBlindswbload.exeWindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins
    XWindowEnhancerWinex.exeSCbar foistware variant
    UWindowFXwfxload.exeStardock WindowFX - "Allows you to add an unprecedented number of special effects to windows"
    XWindowsKernel32.exeAdded by the TENDOOLF WORM!
    XWindowsmsdos98.exeAdded by the PWSTEAL TROJAN!
    XWindowsWindows.exeAdded by the KAZMOR, BOBBINS & ALADINZ.D TROJANS!
    XWindowsexplorer.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    Xwindows[path to trojan]Added by the AIMWIN TROJAN!
    Xwindowshkey.exeAdded by the GAOBOT.AFW WORM!
    Xwindowssystem copy.exeAdded by the SALGA.A WORM!
    XWindows (random character)diskcheck.exeAdded by the SINGU.B TROJAN!
    UWindows Acceleratorssetup.exeKeySpy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
    XWindows AdControlWinAdCtl.exeWindupdates adware variant
    XWindows AdServiceWinAdServ.exeWindupdates adware variant
    XWindows AdToolsWinAdTools.exeWindupdates adware variant
    Xwindows auto updatepenis32.exeAdded by the BLASTER (or MSBLAST.A) WORM!
    Xwindows auto update msblast.exeAdded by the BLASTER.B WORM!
    XWindows Automatic Updatewuamgrder.exeAdded by a variant of the RBOT WORM!
    XWindows Automatic Updatesdvldr.exeAdded by the RBOT.MF WORM!
    Xwindows automationmslaugh.exeAdded by the BLASTER.E WORM!
    XWindows Automationmsdspr.exeAdded by the SOLAME.A WORM!
    XWindows backupsystemss.exeAdded by a variant of the SPYBOT WORM!
    XWindows Backup ConfigurationIEXPLORER.exeAdded by the GAOBOT.AZ WORM!
    XWindows Ba?lang?? Dosyas?sistem.exeAdded by the MUZK WORM!
    XWindows Communicatorwincomm.exeAdded by the AGOBOT-BH WORM!
    XWindows Compliant[random filename]Added by the RBOT-IR WORM!
    XWindows ConfigSSYS.EXEAdded by the SPYBOT-DA WORM!
    XWindows Config LoaderWincfg32.exeAdded by the SILVERFTP TROJAN!
    XWindows Configurationwsys32.exeAdded by the GAOBOT.FB WORM!
    XWindows ControlControl.exeBrowser hijacker. NOTE - On Win9x systems it will overwrite the Windows file of the same name in the Windows directory, so therefore it will be necessary to extract a fresh copy of the file from the Windows setup cabs!
    XWindows Data Serverautodisc.exeAdded by the SPYBOT-CB WORM!
    XWindows Dcom2 Fixmscom32.exeAdded by the RBOT-QT WORM!
    XWindows debug loggingwinlogg.exeAdded by the RBOT-OY WORM!
    XWindows debug loggingwinloggs.exeAdded by the RBOT-QN WORM!
    XWindows Debuggerwindbg.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows DLL LoaderRUNDLL16.EXEAdded by the DOMWIS TROJAN!
    XWindows DLL Loaderdefragfat32z.exeAdded by the LINKBOT.A WORM!
    XWindows DLL Loaderrundll32.exeAdded by the WHIPSER-B WORM! Note - rundll32.exe file is placed in the WindowsSystem folder, wheras the legitimate rundll32.exe is located in the C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP)
    XWindows DLL Loaderdefragfat32pi.exeAdded by the RBOT-QQ WORM!
    XWindows DNS Daemonwindnsd.exeAdded by the WOOTBOT.AS WORM!
    XWindows Drive CompatibilitySystem32Driver32.exeAdded by the SUPOVA.Z WORM!
    XWindows Driver Servicesmsdrvs32.exeAdded by the WOOTBOT.L WORM!
    XWindows Explorer[filename].exeAdded by the SDBOT TROJAN! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    XWindows ExplorerLsas.exeAdded by the GAOBOT.AO WORM! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    XWindows Explorerolecom32.exeAdded by an unidentified WORM or TROJAN!
    XWindows Explorer ShellWinexec32.exeAdded by the REDIST.B WORM!
    XWindows Explorer Update Build 1142EXPLORER32.EXEAdded by the KaZaA based KWBOT or KWBOT.Y WORMS!
    XWindows Explorer-3212WINRE16.EXEAdded by the HARDOC WORM!
    NWindows Eyes??For blind people, gives a voice description of items on the screen. Windows application which gives you total control over what you hear, when you hear it, and how you hear it. Available via Start -> Programs
    UWindows Guardianthehel1iawgrd32.exePart of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
    UWindows GuardianFawgrd32.exePart of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
    XWindows Help Filewinhelper32.exeAdded by the SDBOT-QK TROJAN!
    XWindows Help Managersvchost32.exeAdded by the RBOT-OZ WORM!
    XWindows Help Servicewinhelpsv.exeAdded by the RBOT-LP WORM!
    ?Windows Help SystemHelp.pif??
    XWindows Host Devicehostsvc.exeAdded by the ZOOTY-A WORM!
    XWindows HTML file readerSysconf32.exeAdded by the NOOMY.A WORM!
    XWindows Internet Protocolwinproc32.exeCoolWebSearch parasite variant
    XWindows JavaScript DaemonWinjsd.exeAdded by the WOOTBOT.AF WORM!
    ?Windows Loadwindows.com??
    XWindows Loaderwstart32.exeAdded by the GAOBOT.CA WORM!
    XWindows loggingwinlogd.exeAdded by the RBOT-ON WORM!
    XWindows Loginexplored.exeAdded by the GAOBOT.SY WORM!
    XWindows Logonwinlogin.exeAdded by the SPYBOT-C TROJAN!
    XWindows Logon ProcedureSvchoste.exeAdded by a variant of the SPYBOT WORM!
    XWindows Management Instrumentationmwd.exeAdded by the GRAPS WORM!
    XWindows Managerwinmants.exeAdded by the MANTAS WORM!
    XWindows mangementwinlogonn.exeAdded by the RANDEX.FC WORM!
    XWindows Media Playerwmediaplayer.exeAdded by the AGOBOT-NQ WORM!
    XWindows Media PlayerWMP23.exeAdded by a variant of the RBOT WORM!
    XWindows Media PlayerMediaPIayer.exeAdded by the SDBOT-QO TROJAN! - note, the executable is called 'MediapIayer', with an 'i' !)
    XWindows Media Playermsass43.exeAdded by a variant of the RBOT WORM!
    NWindows Media Powerpoint HelperNSPPTHLP.EXEGerman software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
    XWindows media servicecrvss.exeAdded by the SDBOT.VP WORM!
    XWindows media servicescvrsss.exeAdded by the RBOT-MW WORM!
    XWindows Media SP.2.37[random filename]Added by the LEMIR.C TROJAN!
    XWindows MeTaLRoCk servicemetalrock.exeAdded by the TASTYRED TROJAN!
    XWindows Monitorwinmon.exeAdded by the SDBOT.VB WORM!
    XWindows Monitoring Servicewinmon.exeAdded by a variant of the SDBOT WORM!
    XWindows NetsWinNET.exeAdded by the RBOT-MO WORM!
    XWindows Network Servicewinvc32.exeAdded by the RBOT.RY WORM!
    XWindows Networkingwinsys32.exeAdded by the GAOBOT.FL WORM!
    XWindows Nivedia DriversysMGT.exeAdded by a variant of the RBOT WORM!
    XWindows NNT[path to trojan]Added by the RANKY.E TROJAN!
    XWindows NT 32ntlogin32.exeAdded by the RANDEX.BRD WORM!
    XWindows NT Loginntlogin32.exeAdded by the SDBOT.WG WORM!
    XWindows NT Service Namewinshock.exeAdded by the RBOT-PK WORM!
    XWindows OEM Toolswinres32.exeAdded by the SPYBOT.FD WORM!
    XWindows OLE Automation Serverole32aut.vbeCoolWebSearch parasite related browser hijacker
    ?Windows Print SpoolerSCVHOSTS.EXESuspicious due to the similarity to the valid "svchost.exe" file
    XWindows Print SpoolerNavAgent32.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows Print SpoolerSVEHOST.EXEAdded by the SPYBOT.H WORM!
    XWindows Registrymsnmsg.exeAdded by a variant of the RBOT WORM!
    XWindows Registry Cleanerwinclean.exeAdded by a variant of the SPYBOT WORM!
    XWindows Registry Express Loaderregexpress.exeAdded by the FORBOT-CJ WORM!
    XWindows Registry Scanregscan32.exeAdded by the RBOT.KE WORM!
    XWindows Registry Securitycrss.exeAdded by a variant of the IRC.BOT TROJAN!
    XWindows Registry Startupwind32.exeAdded by the AGOBOT-BZ WORM!
    XWindows reportswchost.exeAdded by the SMALL.GV VIRUS!
    XWindows Runtime Helpwin32hlp.exeAdded by a variant of the AIMVISION TROJAN!
    XWindows Runtime HelpWinRunHelp.wrhAdded by a variant of the AIMVISION TROJAN!
    XWindows SAomniscient.exeBLAZEFIND adware
    XWindows securesetver32.exeAdded by the SPYBOT.EP WORM!
    XWindows Security Assistantrundll32.vbeCoolWebSearch parasite variant
    XWindows Security Assistantwinsec.exeCoolWebSearch parasite variant
    XWindows Security Modulemodule.exeAdded by a variant of the RBOT WORM!
    XWindows Service Hostscvhost.exeAdded by the SDBOT.N TROJAN!
    XWindows Service Hostsvchost.exeAdded by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XWindows Servicesservice.exeAdded by the RANDEX.R WORM!
    XWindows Services Hostsvchost.exeAdded by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XWindows Services Updatesvch0st.exeAdded by a variant of the RBOT WORM!
    ?Windows shellwin70.exe??
    XWindows Shell Library Loaderload shell.dll /c /setCoolWebSearch parasite variant
    Xwindows shellext.32mschost.exeAdded by the BLASTER.K WORM!
    XWindows Sound DriverSndMon32.exeAdded by a variant of the SPYBOT WORM!
    XWindows Sound ManagerSndMon32.exeAdded by the FORBOT-BU WORM!
    XWindows SP2 UpdateSp2update.exeAdded by the WOOTBOT.BS WORM!
    XWindows SpoolerSPOOLSRV.EXEAdded by the SPYBOT.P WORM!
    XWindows SSL Filewinssv.exeAdded by the WOOTBOT.CA WORM!
    XWindows Startupwinsta~1.exeGoHip foistware
    XWindows Startupwinstartup.exeGoHip foistware
    XWindows StartupWdrun32.exeAdded by the GAOBOT.AO WORM!
    XWindows Startupservices21.exeAdded by the AGOBOT-MX WORM!
    XWindows Startup 32 Bitssysrun32.exeAdded by a variant of the DARKSUN TROJAN!
    XWindows SyncroAdSyncroAd.exeBlazeFind "Windupdates" targeted advertizing
    XWindows System ConfigurationSYSCFG16.EXEAdded by the WISDOOR.Z TROJAN!
    XWindows System Managerwinsystem.exeAdded by the RBOT-AN WORM!
    XWindows System Manager Procwinsmc.exeAdded by the RBOT.JH WORM!
    XWindows System Restore ConfigurationSblhost.exeAdded by a variant of the SPYBOT WORM!
    XWindows System RestorerSystemRestorer.exeAdded by the DULOAD.C WORM!
    XWindows System Serivcewinserv.exeAdded by a variant of the RBOT WORM!
    Xwindows system servicewinsock.exeAdded by the RBOT-MR WORM!
    UWindows System Traymsni.exeIambigbrother monitoring software
    XWindows System Trayswhost.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWindows Task ManagerACCOUNT_DETAILS.DOC.exeAdded by the QUATERS.A WORM!
    XWindows Task Managertaskmgn.exeUnidentified malware, either a variant of the WIN32.RBOT WORM, or part of a Casino Palazzo foistware install
    XWindows TaskAdWintaskad.exeWindupdates adware variant
    XWindows TCP/IPwintcp.exeAdded by the AGOBOT-ZH WORM!
    XWindows Telnet Serverwintel.exeAdded by the AGOBOT-MW WORM!
    XWindows Time ServerTimeSRV.exeAdded by the SPYBOT.DNC WORM!
    XWindows Update[filename]Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites
    XWindows Updateiexplorere.exeAdded by the GAOBOT.AP WORM!
    Xwindows updateuddater.exeAdded by the LEOX TROJAN!
    XWindows Updatewudate.exeAdded by the AGOBOT.ML WORM!
    XWindows Updatewupdate.exeWengs adware
    Xwindows updatesychost.exeAdded by the LEOX.B WORM!
    XWindows UpdateWuamgrd.exeAdded by a variant of the SPYBOT WORM!
    XWindows Updateinetinf.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWindows Updatehost32.exeAdded by the RBOT-GU WORM!
    Xwindows updatewuraclt.exeAdded by the RBOT-PO WORM!
    Xwindows updateWuanclt.exeAdded by the RBOT.XZ WORM!
    XWindows Updateebay.exeAdded by the GAOBOT.BUU WORM!
    XWindows Updatewindows.exeAdded by the RBOT-RB WORM!
    XWindows Update AutoUpdate Client Productwuauct.exeAdded by the AGOBOT.ACL WORM!
    XWindows Update Checker[random filename]Adware downloader trojan
    XWindows update configsvhost.exeAdded by the SDBOT-PF WORM!
    Xwindows update configuratorsvghost.exeAdded by a variant of the SPYBOT WORM!
    XWindows Update Filesdnetc.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - wupdmgr.exe is the real Windows Update
    XWindows Update Managerwupdmngr.exeAdded by the RANDEX.BTB WORM!
    XWindows Update Manager for NTwupdmgr32.exeAdded by the SDBOT.AH WORM!
    XWindows Update Monitoring Servicewinupdt.exeAdded by the RBOT-PL WORM!
    XWindows Update Processwmiprvsc.exeAdded by the SDBOT-CB WORM!
    XWindows Update Servicecsrs.exeAdded by the AGOBOT-NI WORM!
    XWindows Update Servicesmcg.exeAdded by the SDBOT.QY WORM!
    XWindows Update Service 2004/2005systemupdate.exeAdded by the RBOT-JE WORM!
    XWindows Update V6[random filename]Added by the RBOT-KT WORM!
    XWindows Update.exeN/AHomepage hijacker, see here
    XWindows Updaterwupdmgr32.exeAdded by a variant of the DOS.AUTOCAT TROJAN!
    NWindows Version Checkver_chk.exeVersion checker for CyberAudioLibrary ("A new way to exchange information through the Internet")
    XWindows videovide_32.exeAdded by a variant of the AGOBOT/GAOBOT WORM!
    XWindows Video Acquisition (WVA)wvsvc.exeAdded by the AGOBOT.YM WORM!
    XWindows Video Driversvideons32.exeAdded by the GAOBOT.AZT WORM!
    XWindows-SystemSystem32.exeAdded by the LOGPOLE.C WORM!
    XWindows-TCP-IPrfkampig.exeAdded by the GIPMA TROJAN!
    XWindows32rundll.exeAdded by the AGOBOT-LK or AGOBOT-ND WORMS!
    XWindowsAgentWindowsAgent.exeAdded by the GOP.G WORM!
    XWindowsAPI.DLLServer5.exeAdded by the "Fear and Hope" TROJAN!
    XWindowsCriticalUpdatewindows_critical_update.exeAdded by the ASTEF or RESPAN WORMS!
    XWindowsKeyUpdatemaster.exeAdded by the JOSAM WORM!
    XWindowsMGMWinmgm32.exeAdded by the SOBIG WORM and LALA.C TROJAN!
    XWindowsRegistration[random filename]Added by the RBOT-NO WORM!
    XWindowsRegKey Autoupdate[random filename]Added by a variant of the RBOT WORM!
    XWindowsRegKey upd4te2d4te*********.exe [* = random char]Added by the RBOT.XQ WORM!
    XWindowsRegKey update[random filename]Added by a variant of the RBOT WORM!
    XWindowsRegKey%$ updatemsi332.exeAdded by the RBOT-IX WORM!
    XWindowsRegKey%updateethernet32m.exeAdded by the RBOT-EN WORM!
    XWindowsRegKeys updatewinsysi.exeAdded by the SDBOT.WE WORM!
    XWindowsSetup[path to trojan]Added by the EZBOT TROJAN!
    XWindowsUpdWindowsUpd4.exeVirtuMonde adware
    XWindowsUpd1WindowsUpd1.exeVirtuMonde adware
    XWindowsUpd2WindowsUpd2.exeVirtuMonde adware
    XWindowsUpdatewindows_update.exeAdded by the LOFNI WORM!
    XWindowsUpdatesvchost.exeAdded by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
    XwindowsupdateRPCX1sQ3.exeAdded by the IRCBOT.B TROJAN!
    XWindowsUpdateUSRINIT.EXEAdded by the MADDIS.B WORM!
    XWindowsUpdate Servicewuautlc.exeAdded by the RBOT-NR WORM!
    XWindowsXP Updatewindowsxpupdate.exeAdded by the RBOT-PB WORM!
    XWindows_SerivceSERVICE.exeAdded by the WOOTBOT.AH WORM!
    XWindows_Updatessvthost.exeAdded by a variant of the SPYBOT WORM!
    XWindows_VXDuser32.exeAdded by the PWSTEAL.PPORT TROJAN!
    XWindowz Update V2.0Explorer.exeAdded by the YODO WORM! Note - the valid "explorer.exe" is located in C:Windows or C:Winnt whereas this one is located in the System32 sub-directory
    XWinDriv32WinDriv32.exeAdded by the SMALL-BA TROJAN!
    Xwindrvwindrv32.exeAdded by an unidentified VIRUS, WORM or TROJAN! - possibly a strain of OBLIVION or BIONET
    XWinDrvwindrvx.exeAdded by a variant of the TIBSER.A downloader TROJAN!
    UWinDSL MTU-AdjustWinDSL_MTU.exeAdjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung
    ?WinDSL_MTUWinDSL_MTU.exeMay be realted to Tiscali broadband, if so is it required?
    XWinDSNXWin????.exeAdded by the DNSX TROJAN!
    XWindUpdates[path to trojan]Added by the AGENT.BF TROJAN!
    XWindUpdatesWinUpdt.exeBlazeFind "Windupdates" targeted advertizing
    UWINDVDpatchCTHELPER.EXECTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative?s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it
    NWinDVR SchSvrSchSvr.exeWinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs
    NWinDVRCtrlWinDVRCtrl.exeControl center software for an AOpen VA1000 TV tuner card
    XWindws Configuration LoaderLEXPLORE.exeAdded by the SODABOT WORM!
    XWinEssentialKeyhost.exeHijacker - hailing from jraun.com
    XWinEssentialkeyword.exeJraun.com hijacker
    XWinExecWinexec.exe.vbsAdded by the AINESEY.A WORM!
    XWinExec32WinExec32.exeAdded by the KAZWIN WORM!
    UWinFast ScheduleWfwiz.exeLeadtek WinFast TV tuner scheduler
    UWinfast2KLoadDefaultRundll32.exe Wf2kcpl.dll, DllLoadDefaultSettingsLoads default settings for Leadtek Winfast graphics cards
    UWinfast_2KWF2k.exeSystem Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card
    UWinFast_GammaRundll32.exe wfcpl.dll, DllLoadGammaRampSettingsLoads if you change the gamma settings on Leadtek WinFast graphics cards
    UWinFast_Taskbarrundll32.exe wftask.dll, WFDllLoadDefaultSettingsLoads default settings for Leadtek WinFast graphics cards
    XWinFavoritesWinFavorites.exe1Loudmarketing.com adware downloader
    NWinFax PRO ControllerWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
    YWinFaxAppPortStarterwfxsnt40.exeWinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
    Xwinfontwinfont.exeAdded by the DEATH TROJAN!
    UWinFoxV2WF2k.exeSystem Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card
    XWinFXcssrs.exeAdded by the AGOBOT.FX WORM!
    XWinGateWinGate.exeAdded by a variant of the LOVGATE WORM!
    UWinGate Engine Monitorwgengmon.exeWinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine, and appears in the system tray of each workstation on the network reassuring clients that their workstations have connectivity with the WinGate Server
    XWinGate initializeWinGate.exeAdded by a variant of the LOVGATE WORM!
    Xwingowingo.exeAdded by the BEAGLE.AW or BEAGLE.AV WORMS!
    NWinGuage ProWGPRO32.EXEPart of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs
    YWinguardWGFE95.EXEDr Solomon's Virex antivirus
    UWinGuard Prowgp.exeWinguard Pro
    NWinHackerrundll32.exe wh95.dll, HackMeTweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free
    XWinhelpwinhe1p.exeAdded by the QQPASS.E TROJAN!
    XWinHelpWinHelp.exeAdded by a variant of the LOVGATE WORM! Note - "winhelp.exe" resides in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP) whereas the valid "winhelp.exe" resides in C:Windows or C:Winnt
    XWinHelprealsched.exeAdded by a variant of the LOVGATE WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name
    XWinhelpTkBellExe.exe...Added by a variant of the LOVGATE WORM!
    Xwinhlp3.exewinhlp3.exeAdded by a variant of the EASTO.A TROJAN!
    XWinhlp32Wscript.exe ..Msexec32.vbsAdded by the GANT.B WORM!
    Xwinhlp32.exewinhlp32.exeAdded by a variant of the EASTO.A TROJAN!
    Xwinhlpp32.exewinhlpp32.exeAdded by the GAOBOT.SY WORM!
    XWinhostwintt.exeAdded by the LOLAWEB.B TROJAN!
    XWinhostwin.exeAdded by the DLOADER-AP TROJAN!
    Xwininet32wininet32.exeAdded by the RAZNEW-A TROJAN!
    Xwininetdwininetd.exeAdded by the WINET TROJAN!
    Xwininitwininit.exeAdded by the WOLLF.16 TROJAN!
    XWink*.exeWink*.exe [* = random char]Added by a variant of the KLEZ WORM!
    UWinkb6winkb6.exePart of We-Blocker, works in tandem with syswb6. Both files are needed to run WeBlocker. Required if We-Blocker is installed
    XWinKernelWinKer.exeAdded by the MIRAB or SERVIDOR TROJANS!
    XWinKernel[path to worm]Added by the PLEA VIRUS!
    Xwinkernel32wWin32.comAdded by the BANSAP TROJAN!
    UWinKeywinkey.exeLoads Copernic's WinKey. Used to map out Windows key hotkey combinations. Not required for the system, but is necessary for this to be running if you use these hotkey combos
    Xwinlibs.exewinlibs.exeAdded by the EVAMAN.C WORM!
    XWinLibUpdatelibupdate.exeAdded by the BIONET series of TROJANS such as BIONET.31 or BIONET.310
    XWinLibUpdate32libupdate32.exeAdded by the BIONET.405 TROJAN!
    XWinLibUpdtelibupdte.exeAdded by the BIONET.318 TROJAN!
    XWinlinkwinlink32.exeAdded by the GAOBOT.AAY WORM!
    XWinlmewindll.exeAdded by the GOP.F WORM!
    XWinLoader[random filename]Added by variants of the SUBSEVEN TROJAN!
    Xwinlocatorupdateupdatewinlocator.exeLocator adult content toolbar related
    XWinLoginwinlogin.exeAdded by the AGOBOT-IX WORM!
    XWinlogin.exelog.exeAdded by a variant of the AGENT.AH downloader TROJAN!
    Xwinlogin.exelogfile.exeAdded by the AGENT.AH TROJAN!
    Ywinlogonwinlogon.exeWindows Logon Process - handles user logons described here
    Xwinlogonwinlogon.exeHijacker or adult content dialler - file is located in C:Windows or C:Winnt, and not in it's System or System32 subdirectory, as is the case with the legitimate Windows Logon (winlogon.exe) process
    Xwinlogonwinlogin.exeAdded by the RANDEX.E WORM!
    Xwinlogonwinlogon.exeAdded by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! File is located in C:Windows or C:Winnt, and not in it's System or System32 subdirectory
    XWinlogon.exeN/ACoolWebSearch parasite related - resets home page to an adult material site
    XWinLsassservicec.exeAdded by the SCANE WORM!
    XWinLsass[path to trojan]Added by the SCANE WORM!
    Xwinltmpvwinln.exeAdded by the TCXMEDI-C TROJAN!
    Xwinltmpvwutop.exeAdded by the TCXMEDI-C TROJAN!
    XWinmainwinmain.exeOne of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. BOClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled!
    ?WinManagerschost.exe??
    Uwinmatrix.exeWinMatrixXP.exeWinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop
    UWinMemWinMem.exeWinMem Cleaner - part of Ultra WinCleaner Utility Suite. Makes more memory available for your programs and the Operating System. It also defragments your system
    XWinMenssagewinmax.exeAdded by the BANCOS.B TROJAN!
    NWinMgmtWinMgmt.exeUsed for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here
    XWinMgr32winmgr32.exeAdded by the MIMAIL.P WORM!
    XWinMineD4NG3.vbsAdded by the BISCUIT.A WORM!
    Ywinmodemwmexe.exeSoftware for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information
    XWinMsrv32WinMsrv32.exeAdded by the GAOBOT.AFJ WORM!
    Nwinmysqladminwinmysqladmin.exeStarts the MySQL database admin tool
    NWinMySQLadmin Toolwinmysqladmin.exeStarts the MySQL database admin tool
    Xwinnetwinnet.exeCommonName Toolbar spyware. To uninstall see here
    ?Winnov MenuWnvMenu.ExeWinnov Video Capture Card related. What does it do and is it required?
    ?Winnov RemoteWnvRsvr.ExeWinnov Video Capture Card related. What does it do and is it required?
    ?Winnov StatusWvStatus.ExeWinnov Video Capture Card related. What does it do and is it required?
    XWinNtBBWinntBB.exeAdded by the DULOAD.C WORM!
    Xwinocx32winocx32.exeAdded by the PROTORIDE.I WORM!
    UWinPatrolWinPatrol.exeWinPatrol - "Manage Startup programs, tasks, cookies; will sniff out Worms, Trojan horses, Cookies, Adware, Spyware, Klez, Assumption and other malicious programs"
    Xwinphonics7536vbsystem35.exe setups.exe vb.vbAdded by a variant of the MUTIN-C TROJAN!
    YWinPoetWinPPPoverEthernet.exeWinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking
    NWinPopupWINPOPUP.EXEIntranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95, and maybe in WFWG 3.11. Normally it won't set itself up to run unless the user specifically adds it to startup
    Xwinpopupwinupie.exeAdware by Tradeexit.com
    XWinProfileCommand.exeAdded by the BUDDY TROJAN!
    XWinProfilesndcfg16.exeAdded by the SNDC.A WORM!
    XWinProtWinprot.exeAdded by the CHUPACABRA TROJAN!
    XWinProtserver.exeAdded by the CHUPACABRA TROJAN!
    UWinProxyWinProxy.EXE"WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP"
    Xwinpsdwinpsd.exeAdded by the MYDOOM.Q WORM!
    Xwinrarwinrar.exeCoolWebSearch parasite variant. Note - this is not the file zipping utility also known as WinRAR and it's located in C:Winnt or C:Windows
    Xwinrarshellwinrarshell32.exeAdded by the SALIRA TROJAN!
    XwinRegwinReg.exeAdded by the YAHA.H or YAHA.J WORMS!
    Xwinregsrvwinregsrv.exeAdded by the SYNRG TROJAN!
    XWinres32vis[path to worm]Added by the THRAX.A WORM!
    Nwinroutewinroute.exeWin-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process, also to log in to the console to view logs and change settings. Can be unchecked and the engine still runs and functions normally. Can then use provided shortcuts for administration of the program. Loaded in SERVICES on Windows 2k
    Xwinrunmsconfig.exeAdded by the WINUR.A WORM! Note - this is not the real msconfig.exe as it's located in C:winrun
    Xwinrunwinrun.exeAdded by the WINBUR.B WORM!
    XWinRunnersWinDrivers.exeAdded by the DULOAD.C WORM!
    Xwinsecurewinsecure.exeBrowser hijacker, redirecting to specificsearches.com
    XwinserverServer.txt.vbsAdded by the DELTAD.A WORM!
    UWinService32ssmgr.exe007 Spy Software - "stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"
    XWinServicesWinServices.exeAdded by the YAHA.K or YAHA.M WORMS!
    Xwinservnwinservn.exePurityScan/Clickspring adware
    Xwinservswinservs.exePurityScan/Clickspring adware
    XWinSetBrowseBasicUpdate.dll.vbsAdded by the BISCUIT.A WORM!
    ?Winshoewuadfdqr.exeProbably an unidentified VIRUS! Adds itself to 3 registry "Run" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed
    XWinShowUpdatecopy C:WINDOWSwinshow.new C:WINDOWSwinshow.dllWinshow parasiate related - from the "RunOnce" keys it replaces "winshow.dll" with a new version
    XWinSigNetXP.exeAdded by the BANKER-FN TROJAN!
    XWinsock2 driverSDJOIJE.EXEAdded by the SPYBOT.DR TROJAN!
    XWinsock2 driverMIRC32.exeAdded by the SPYBUZZ TROJAN!
    XWinsock2 driverkgzgjkpcw.exeAdded by the SDBOT.T TROJAN!
    XWinsock2 driverZONEALARM.EXEAdded by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program
    XWinsock2 driverWINCFG.SCRAdded by a variant of the SPYBOT WORM!
    XWinsock2 driverwinupdate.exeAdded by the SPYBOT-BX WORM!
    XWinsock2 driverSPOLSV.EXEAdded by the SPYBOT-CM WORM!
    XWinsock2 driverZonealarmupdate.exeAdded by a variant of the SPYBOT WORM!
    XWinsock2.dllWINLODR.SCRAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinsock32 driverTesting.exeAdded by the SPYBOT.B WORM!
    XWinsock32 driverlcd.exeAdded by the SPYBOT.B WORM!
    XWinsock32 driverSdjoije.exeAdded by the SPYBOT.B WORM!
    XWinsock32driverwin32server.scrAdded by the HACARMY TROJAN!
    XWinsock32driversp2XPupdate.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinsock32driverwin32server.exeAdded by the BACKDOOR-AZV TROJAN!
    XWinsock32driverZoneAlarmPr0.exeAdded by the HACKARMY-B TROJAN!
    XWinsock32driverZoneLockup.exeAdded by the HACARMY.D TROJAN!
    XWinsock32driverwin32server.exeAdded by the HACARMY.F TROJAN!
    XWinsock32driverwinXPupdate.exeAdded by the HACKARMY.9728 TROJAN!
    Xwinsockdrivertskmg.exeAdded by the SDBOT.GEN TROJAN or WARPIGS.C WORM!
    Xwinsockdriverwinsock2.2.exeAdded by a variant of the SPYBOT WORM!
    XWinSocketComponentnthost.exeAdded by an unidentified VIRUS, WORM or TROJAN!
    XWinSPFwindrv32.exeAdded by the MYDOOM.T WORM!
    XWinSPFwinspf32.exeAdded by the MYDOOM.S WORM!
    XWinSrvkn0x.exeAdded by the HOBBIT.F WORM!
    XWinSrvSHIZZLE.EXEAdded by the HOBBIT.C WORM!
    XWinsrvwinsrv.exeAdded by the OPASERV.T WORM!
    XWinStartWinStart.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinStartWscript.exe WinStart.vbsAdded by the CIAN.C WORM!
    XWinStartwinstart32.exeAdded by the PUROL WORM!
    XWinStartWinStart.pifAdded by the CONE.E WORM!
    XWinStart001WinStart001.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinStart001.EXEWinStart001.exeFrom IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge
    XWinsta~1winsta~1.exeGoHip foistware
    XWinSth16WinSth16.exeAdded by the CAKE WORM!
    XwinstroRUN32DLL.exeAdded by the FTP_ANA TROJAN!
    XWinsvc32Winsvc32.exeHomepage hijacker
    UWinsysWinsys.exeWin-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it 
    XWINSYS[path to trojan]Added by the GOLDPLAY TROJAN!
    XWinSys32Winsys32.exeAdded by the CIGIVIP TROJAN or RECKUS WORM!
    Xwinsys32 Driverwinsys32.exeAdded by the LOONY-O TROJAN!
    UWinSysAppMonWinSysRM.exeHome & Family Content Filter related. See here
    Xwinsyslog lptt01
    winsyslog.exeVariant of the RapidBlaster parasite (in a "Winsyslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    XWinSysStartUpWKbLwTaskSystemDll.ExeAdded by the BACKZAT.G WORM!
    XWinSyst32winsyst32.exeAdded by the MORB WORM!
    XWinSystemwinsystem.exeAdded by the WHITEBAIT WORM!
    XWinsystemwinsystem.exeAdded by the BANCOS.CR TROJAN!
    XWinTaskWintask.exeAdded by the HIPO or LEMIR.F TROJANS!
    XWinTask driverwintask.exeAdded by the SMALL.ABD downloader TROJAN!
    UWinTasks Traybarwintasks.exeWinTasks - "Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task, but will actually make your system run faster and more smoothly than ever before"
    Xwintasks.exewintasks.exeAdded by the EVAMAN WORM!
    NWintercooler ProWINCOOL.EXEWintercooler Pro - utility that monitors CPU usage, RAM consumption and Internet connection speed
    NWinTidyWinTidy.exeDesktop icon manager from PC Magazine (Ziff-Davis) for Win95. Available via Start -> Programs
    XWintimeWintime.exeAdded by the HARNIG TROJAN!
    NWintime WtxploadWxpload.exe WintimePart of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet, if it's not already running. It then starts an application which manages the tablet messages. Since I leave the tablet unplugged unless I need to use it, I don't need this running at startup. I suspect that this program monitors a number of windows messages, so that when it's loaded, my regular mouse slows down - it acts like it 'sticks' entering and leaving windows. Certainly my performance returned to what I expected when I removed this item using MSCONFIG"
    XWinToolsWToolsA.exeWintools adware
    NWinTOTAL Schedulerguru.exeWinTOTAL Real estate appraisal software related
    XWinTraywintray.exeAdded by the LEGUARDIEN.B TROJAN!
    XwinupdRUNDLL32.EXE [random value].dll, _mainRDAdded by the MOTA.A WORM!
    Xwinupd.exewinupd.exeAdded by the BEAGLE.M or BEAGLE.N WORMS!
    XWinUPD32explorer.exeAdded by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
    Xwinupdatwinupdat.exeAdded by the CANBOT.A WORM!
    XWinUpdateRBSKQQBO.EXEAdded by the VBSWG2B.A WORM!
    XWinUpdatewmbem.exeAdded by the REVCUSS.B TROJAN!
    XWinUpdate Loadermsnnm.exeAdded by the REVCUSS.C TROJAN!
    Xwinupdate.exewinupdate.exeAdded by the RADO TROJAN!
    Xwinupdate.regwinupdate.exeAdded by the SPYBOT.EAS WORM!
    Xwinupdate2846vbsystem35.exe msvbrun.exeAdded by a variant of the MUTIN-C TROJAN!
    XwinupdtRUNDLL32.EXE [random.dll]Added by the MABUT.A WORM!
    Xwinupdtlwinupdtl.exeSecondThought adware variant
    Xwinurwinrun.exeAdded by the WINBUR.B WORM!
    XWinux Piriax ServicePH32.EXEAdded by the RANDEX.G WORM!
    Xwinversionwinversion.exeBrowser hijacker, redirecting to specificsearches.com
    UWinVNCWinVNC.exeWinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet
    XWinVNCiexplorer.exeAdded by the EVIVINC VIRUS!
    Xwinwan lptt01winwan.exeVariant of the RapidBlaster parasite (in a "Winwan" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    Xwinwan ml097ewinwan.exeVariant of the RapidBlaster parasite (in a "Winwan" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
    XwinXP33.exeAdded by the ANPES WORM!
    XWinXPplugin1.exeAdded by the Downloader-JW TROJAN!
    Xwinxpdll32.exewinxpdll32.exeAdded by a variant of the SMALL downloader TROJAN!
    UWinXPLoadRundll32 LoadDll, LoadExe WinXPLoad.exeCompaq hotkey related - required if you use the hotkeys
    Xwinzip[path to trojan]Added by the BANCOS.G or BANCOS.K TROJANS!
    NWinZip Quick PickWZQKPICK.EXEAdded with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up
    XWin_api_driversystem.exeAdded by the REVIRD TROJAN!
    XWin_LibraryINISvc.exeAdded by the ANARCH WORM!
    Xwin_upd.exeWINdirect.exeAdded by the MITGLIEDER.M TROJAN!
    Xwin_upd2.exeWINdirect.exeAdded by the BEAGLE.AO WORM!
    XWin_vaderWin_vader.vbsAdded by the INVASION.A VIRUS!
    XWIP Config GUIWinipcfgs.exeAdded by the RBOT-CN WORM!
    UWireless PCI Card Configuration UtilityWMP11Cfg.exeUtility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration
    XWireless Provider Serverwpsvr.exeAdded by the FORBOT-AD WORM!
    UWireless-G Notebook Adapter UtilityWPC54CFG.EXEUtility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G)
    Nwjviewwjview.exeMS tool used to view window-based Java applications from the command line
    Nwkcalremwkcalrem.exeProduces a pop-up reminder of events scheduled using the MS Works Calendar
    NWkDetectWkDetect.exeChecks for updates to MS Works
    Nwkfudwkfud.exeA marketing program for MS Works
    NWksSbWksSb.exeThe Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file
    NWkUFindWkUFind.exeMS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site
    XWlan DrierWinusb2.exeAdded by the WOOTBOT.DC WORM!
    XWlan Driveravscan.exeAdded by the WOOTBOT.DH WORM!
    NWLAN Status Tray AppletWLANSTA.EXESystem Tray icon for checking the status of a Wireless LAN
    YWLAN_Cfg.exeWLAN_Cfg.exeLinksys Instant Wireless USB Network Adapter driver
    Xwm41a398rundll32.exe [path] wm41a398.dll, EnableRunDLL32LZIO.com adware downloader
    XWMAudioservices.exeAdded by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
    XWMAudiowinlogon.exeAdded by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup!
    NWMBootN/AAssociated with Logitech Wingman game controllers. Not required but what does it do?
    UWMIEXE.exewmiexe.exeNT component, used by Windows Millennium to detect  Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed. Check here for some details on what to do to stop it loading
    XWminfWminf.exeAdded by the GEMA TROJAN!
    XWminfoWminfo.exeAdded by the GEMA TROJAN!
    Xwmiprvwmiprv.exeAdded by the RBOT-WM WORM!
    YWMP54Gv4WMP54Gv4.exeLinksys WMP54G Wireless-G PCI Adapter driver
    Xwmsys32wmsys32.exeAdded by the BANPAES.B TROJAN!
    ?WM_LOGINMSGLOGIN.EXEPart of McAfee Firewall. What is it for and is it needed?
    XWNADWNAD.EXESpyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like
    XWNSCwns*****.exe [* = random char]PurityScan/Clickspring adware
    UWNSIwnscp**.exe [* = random char]PurityScan/Clickspring adware
    XWNSIwnscpsu.exePurityScan/Clickspring adware
    XWNSIwnscpsv.exePurityScan/Clickspring adware
    XWNSTwns*****.exe [* = random char]PurityScan/Clickspring adware
    NWoowatchWatch.exeWanadoo ISP software, not required
    NWordWebwweb32.exeWordWeb - free theasaurus and dictionary. Start manually
    ?Workfloworkflow.exeRelated to BroadJump Client Foundation - broadband troubleshooting software installed by various companies. Is it required?
    NWorks Calendar Reminderwkcalrem.exeProduces a pop-up reminder of events scheduled using the MS Works Calendar
    NWorksFUDwkfud.exeA marketing program for MS Works
    UWorkstation Schedulerwm95.exeDesktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled, it is required, otherwise, it is useless and a memory hog
    XWorkstation Serviceswrkstn.exeAdded by the RBOT-OJ WORM!
    UWorm Detectorwd.exeWorm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam
    Xwormexewinstart.exeAdded by the EARLYBIRD WORM!
    Xwovaxwovax.exeAdded by the DAQA.A TROJAN!
    NWpctrlwpctrlnt.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    NWpctrlwpctrl95.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    Nwpctrl95wpctrlnt.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    Nwpctrl95wpctrl95.exeWinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties
    YWPCycle.exeWpCycleWin.exeAdded when selecting Mplayer2 to open media files. Forces other codes to Wait for Previous instructions to end, preventing instability of your CPU (freezing)
    Xwpds.exedoriot.exeAdded by the SMALL-KY TROJAN!
    XWQKWQK.exeAdded by a variant of the KLEZ WORM!
    ?wrWR.EXE??
    ?WR Commandwr.exe??
    NWrCtrlWrCtrl.exeWin-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not work, but you can manually start/stop the service with a shortcut the program installs at any time
    XWRDialerWrDialer.exeWinPoet DSL dialler
    ?WRECK GUARD????
    ?WregBioswregbios.exeDesktop Management BIOS (DMI BIOS) related. Apparently invokes the DosBios.exe file. Is it required?
    Uwrexecwrexec.exeWatch Right - monitoring program, part of the PowerTools add-on for AOL. Records instant messages, E-mail, chat. Watch Right appears to be, and functions as an online clock updater which connects with the U.S. National Institute of Standards and Technology. It was designed for parents who wish to keep an eye on what their children are doing online
    ?wristewriste.exe??
    Xws2helpws2help.exeAdded by a variant of the SMALL.AN TROJAN!
    XWSAConfigurationwmon32.exeAdded by the GAOBOT.BAJ WORM!
    XWSAConfigurationsvchostt.exeAdded by the AGOBOT.ZT WORM!
    XWSAConfigurationrpcxmn32.exeAdded by the AGOBOT.ABG WORM!
    ?wsbklitewsbklite.exeRelated to the Acer Soft Button on Acer Tablet PCs. Appears to do nothing so is it required?
    UWSchedulerWScheduler.exeWindows Scheduler - "schedule unattended running of applications, batch files, scripts and much more. Also, you can schedule popup reminders so you'll never forget reminders, tasks and other events."
    Xwscript.exevabian.vbsAdded by the VABI VIRUS!
    Xwserverwserver.exeAdded by the NETSKY.AC or SASSER.G WORMS!
    UWServiceWService.exeTablet client Driver for UC-Logic Pen/Graphics Tablet
    XWSSAConfigurationwmmon32.exeAdded by the AGOBOT-KC WORM!
    XWstat32 driverWstat32.exeAdded by the LOONBOT TROJAN!
    Ywstimebwstimeb.exeUsed with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it
    Ywswpdwswpd.exeUsed with some models of Panasonic, Epson and NEC printers. Some older drivers known to have a "memory leak". Needed for printing to work 
    NWT Game ChannelGameChannel.exeWildTangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
    NWT Game Channel