Index Introduction Database Detailed Entries Updates Concise List HJT Forums Rogues Message Board

Windows startup programs - Database search

If you're frustrated with the time it takes your Windows 10/8/7/Vista/XP PC to boot and then it seems to be running slowly you may have too many programs running at start-up - and you have come to the right place to identify them. This is the original start-up programs (as opposed to processes/tasks) list - one of the most accurate and comprehensive. Services are not included - see below. For further information on this and how to identify and disable start-up programs please visit the Introduction page.

See here for further information on random entries - which are typically added by viruses and other malware or unwanted programs.

Last database update :- 29th September, 2017
52090 listed

You can search for any of the following terms to find and display entries in the start-up programs database but the minimum search is 3 characters and you must click on the "Search" button. Results are sorted by the Startup Item/Name field.

Alternatively, you can browse the full database (without the search facility) over a number of pages or you can use the alphabetical index below to list the entries for that letter by the Command/Data field, but the results may take longer to appear due to the number of them:

A | B | C | D | E | F | G | H | I | J | K | L | B | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

NOTE: Searching for common words (i.e. "the" or "where") will mean the results take longer to appear due to the number of them.

Please click on the Search button

8189 results found for S

Startup Item or Name Status Command or Data Description Tested
sysguardnXsSpyware Protect 2009 rogue spyware remover - not recommended, removal instructions hereNo
sXs.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %UserTemp%\sNo
s.exeXs.exeDetected by Trend Micro as WORM_AUTORUN.ABA. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
s.exeXs.exeDetected by Malwarebytes as Backdoor.Bot. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
winsoftXs.exeDetected by Dr.Web as Trojan.DownLoader10.26275 and by Malwarebytes as Backdoor.Messa.ENo
Microsoft Intell ManagementXs.exeDetected by McAfee as W32/Sdbot.worm!lq and by Malwarebytes as Backdoor.MessaNo
HKLMXs.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\system\system32No
PoliciesXs.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\system\system32No
SEXEXS.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.TJNo
AndroidUpdaterXs.exeDetected by Malwarebytes as Malware.Trace.E. Note - this entry loads from the Windows Startup folder and the file is located in %LocalAppData%\TemptempNo
HKCUXs.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\system\system32No
scainXs030109.Stub.exeDelfin Media Viewer adware relatedNo
s0l4risXs0l4ris.exeDetected by Dr.Web as Trojan.Siggen5.33692 and by Malwarebytes as Backdoor.Agent.ENo
WindowsDXs1.exeDetected by Panda as MSNDiablo.ANo
syXs2.exeAdded by a variant of Backdoor:Win32/Rbot. The file is located in %System%No
S24EvMon?S24EvMon.exeEvent Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required?No
S3apphkNS3apphk.exeA tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problemsNo
S3 Internal ChipXs3chip3.exeDetected by Sophos as W32/Agobot-FWNo
S3 InternalXs3chip4.exeDetected by Sophos as W32/Agobot-FQNo
S3HotkeyUs3hotkey.exeHotkey system tray icon to enable switching between monitors. Found on laptops with an S3 Twister integrated graphics cardNo
S3 Chip3Xs3int.exeDetected by Total Defense as Win32.Agobot.LM. The file is located in %System%No
S3Mon?S3Mon.exeS3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required?No
S3 Internal ChipXs3serv.exeDetected by Sophos as W32/Agobot-DDNo
S3TRAYUS3Tray.exeS3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start→ Settings → Control Panel → DisplayNo
s3tray2?s3tray2.exeS3 display configuration taskbar utility for S3 chipset based graphics cards?No
S3TRAYHP?S3trayhp.exeS3 Video driver related. What does it do and is it required?No
S3TraypUS3trayp.exeS3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start→ Settings → Control Panel → DisplayNo
My Search Bar EqXS4BAREQ.EXEMySearch parasiteNo
S4FUS4F.exeFilterPak from S4F, Inc - internet filtering softwareNo
s4helperXs4helper.exeSearchcentrix hijackerNo
UpdatesXs4t4n.vbeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserProfile%\s4t4nNo
s5markrunUS5mark.exeDetected by Malwarebytes as PUP.Optional.S5Mark. The file is located in %ProgramFiles%\S5. If bundled with another installer or not installed by choice then remove itNo
s8kxmrxc7dXs8kxmrxc7d.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserProfile%No
T81Z627Xsa-200622.exeDetected by Symantec as W32.Rontokbro@mm. The file is located in %Windir%No
T81Z627Xsa-310632.exeDetected by Kaspersky as Virus.Win32.Sality.bh. The file is located in %Windir%No
T81Z627Xsa-310733.exeDetected by Kaspersky as Virus.Win32.Virut.q and by Malwarebytes as Worm.AutoRun. The file is located in %Windir%No
T14Z840Xsa-532055.exeDetected by McAfee as W32/MoonLight.worm and by Malwarebytes as Worm.VB.UI. The file is located in %Windir%No
StayAliveUsa.exeStayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work."No
ttoolXsa23sl.exeDetected by Sophos as Troj/Bckdr-QZZNo
SA?Sa3.exeLogitech QuickCam related. Is it required?No
sdae4416Xsa3434.exeDetected by Malwarebytes as Worm.AutoRun.Gen. The file is located in %Recycled%\{SID}No
Sa3dsrvNSa3dsrv.exeFor Aureal based 3D soundcards. A3D sound features won't work with this disabledNo
Aureal A3D Interactive AudioYsa3dsrv.exeFor Aureal based 3D soundcards. A3D sound features won't work with this disabledNo
sAaAVcAvvOACSXsAaAVcAvvOACS.exeWindowsFixDisk rogue security software - not recommended, removal instructions hereNo
saapXsaap.exe180solutions adwareNo
Sabre ServerUsabserv.exePart of the Sabre computer reservations system/global distribution system (GDS) - used by airlines, railways, hotels, travel agents and other travel companies for reservations and ticketingNo
SabreserverUSABSERV.EXEPart of the Sabre computer reservations system/global distribution system (GDS) - used by airlines, railways, hotels, travel agents and other travel companies for reservations and ticketingNo
Sabre Printing StartUSabstart.exePart of the Sabre computer reservations system/global distribution system (GDS) - used by airlines, railways, hotels, travel agents and other travel companies for reservations and ticketingNo
Sabre Task Tray IconUSabstart.exePart of the Sabre computer reservations system/global distribution system (GDS) - used by airlines, railways, hotels, travel agents and other travel companies for reservations and ticketingNo
sacXsac.exeDetected by Symantec as Adware.180SearchNo
SACCXsacc.exeDetected by Symantec as Adware.SurfAccuracy and by Malwarebytes as Adware.SurfAccuracyNo
SurfAccuracyXsacc.exeDetected by Symantec as Adware.SurfAccuracy and by Malwarebytes as Adware.SurfAccuracyNo
sacfilter34Xsacfilter34.exeDetected by Sophos as Troj/Agent-WVZNo
Onluna SarviceXsachost.exeDetected by Sophos as Troj/Tofger-AANo
Onlune SarviceXsachost.exeDetected by Sophos as Troj/Daemoni-JNo
HostSrvXsachostx.exeAdded by the LOOKSKY.H WORM! Drops multiple files in %System%No
HostSrvXsachostx.exe...Added by the LOOKSKY.E WORM!No
sacnacfofgasXsacnacfofgas.exeDetected by McAfee as RDN/Generic.tfr!ee and by Malwarebytes as Trojan.Agent.USNo
SmartAudioUSACpl.exeConexant SmartAudio audio chipset driver and user interface - typically found in notebooksNo
sacrosanctUsacrosanct.exeDetected by Malwarebytes as PUP.Optional.DotDo. The file is located in %ProgramFiles%\micra. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
saczorqequisXsaczorqequis.exeDetected by Dr.Web as Trojan.Inject2.5583 and by Malwarebytes as Trojan.AgentNo
(Default)Xsad.exeDetected by Malwarebytes as Backdoor.Agent.E. Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %UserStartup%No
sad.exeXsad.exeDetected by Malwarebytes as Backdoor.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
MicroSoft ssas3s1XSADASDA.exeAdded by a variant of Backdoor:Win32/Rbot. The file is located in %System%No
SuperAdBlockerUSAdBlock.exe"SuperAdBlocker blocks all forms of advertising, including Flash ads, rich media, fly-ins, slide-ins, pop-ups, pop-unders, spyware and adware ads, and messenger ads." Now superseded by SUPERAntiSpywareNo
NAV Auto UpdateXSADNESS.EXEDetected by Sophos as W32/SpyBot-ENo
Microsoft Driver SetupXsadrive32.exeDetected by Sophos as W32/Autorun-BVN and by Malwarebytes as Worm.PalevoNo
Windows Service BaseXsafari.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %System%No
Remote Registry ServiceXsafari.exeDetected by McAfee as RDN/Generic Dropper!bo and by Malwarebytes as Backdoor.IRCBot.RSGenNo
ShellXsafe-hvdy.exeDetected by Dr.Web as Trojan.FakeAV.16386 and by Malwarebytes as Rogue.Agent.WPS. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "safe-hvdy.exe" which is located in %AppData%\RoamingNo
ShellXsafe-nict.exeWindows Prime Booster rogue security software - not recommended, removal instructions here. Note - this rogue adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "safe-nict.exe" which is located in %AppData%No
safe.bmpXsafe.bmpDetected by Malwarebytes as Ransom.FileLocker. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SysDesktopXSafe.exeDetected by Dr.Web as Trojan.DownLoader3.27042No
Steganos Privacy Suite 14USafe.exeLoads version 14 of the Steganos Safe encryption utility in windowed mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" not selected). This entry is for the version included with Steganos Privacy SuiteYes
Steganos Safe 14USafe.exeLoads version 14 of the Steganos Safe encryption utility in windowed mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" not selected) or minimized ("Start automatically on log on" with "Mimized start" also selected - which appends "-agent" to the startup entry)Yes
SafeUSafe.exeLoads version 14 of the Steganos Safe encryption utility in windowed mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" not selected) or minimized ("Start automatically on log on" with "Mimized start" also selected - which appends "-agent" to the startup entry)Yes
SAFE14_AgentUSafe.exeLoads version 14 of the Steganos Safe encryption utility in minimized mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" also selected)Yes
SAFE14_SafeUSafe.exeLoads version 14 of the Steganos Safe encryption utility in windowed mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" not selected)Yes
SSS14_SafeUSafe.exeLoads version 14 of the Steganos Safe encryption utility in windowed mode at startup (which is configured via Extras → Settings? → General Settings → "Start automatically on log on" with "Mimized start" not selected). This entry is for the version included with Steganos Privacy SuiteYes
SafeCareXSafeCare.exeSafeCare rogue security software - not recommended, removal instructions hereNo
NetScreen-RemoteUSafeCfg.exe"Juniper Networks NetScreen Remote VPN client is a virtual private network (VPN) client that you can install on a PC or laptop computer to send and receive secure communications over the Internet. NetScreen-Remote client is certified by the International Computer Security Association (ICSA) as an IPsec-compliant VPN solution"No
safeDrvXSafeDrv.exeDetected by McAfee as Generic.bfr!ce and by Malwarebytes as Trojan.AgentNo
SafeDrvsssXSafeDrvsss.exeDetected by Malwarebytes as Spyware.Agent. The file is located in %CommonFiles%No
SafeFighterXSafeFighter.exeSafeFighter rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
Browser Infrastructure HelperUSafeFinder.exeSafeFinder ad-supported browser enhancement by Linkury. Detected by Malwarebytes as PUP.Optional.SmartBar. The file is located in %LocalAppData%\Smartbar\Application. If bundled with another installer or not installed by choice then remove itNo
SafeGuardUSafeGuard.exeDetected by Malwarebytes as PUP.Optional.SafeGuard. Note - this entry loads from the Windows Startup folder and the file is located in %ProgramFiles%\SafeGuard. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
Safeguard.exeXSafeguard.exeSuper Spyware Killer rogue spyware remover - not recommended. The file is located in %ProgramFiles%\SuperSpywareKillerNo
SafeGuardUSafeGuardApp.exeDetected by Malwarebytes as PUP.Optional.SafeGuard. The file is located in %ProgramFiles%\SafeGuard. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
loadXSafeMicrosoft.exeDetected by Malwarebytes as Backdoor.Agent. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "SafeMicrosoft.exe" (which is located in %UserTemp%\SafeMicrosoft)No
Microsoft Safe Mode ManagerXsafemode.exeDetected by Microsoft as Worm:Win32/Slenfbot.JENo
SafeMyWebXsafemyweb.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserProfile%\My UserProgramsNo
SafeOFFNSafeOff.exeProvides protection that if user accidentally presses the power switch a dialog will pop up for confirmationNo
SafePcAvXSafePcAv.exeSafePcAv rogue security software - not recommended, removal instructions here. A member of the AntiAID familyNo
SafePrivacyXSafePrivacy.exeSafePrivacy rogue security software - not recommended, removal instructions hereNo
SafePrivateXSafePrivate.exeSafePrivate rogue security software - not recommended, removal instructions hereNo
Safer-SurfUSafer-Surf.exeDetected by Malwarebytes as PUP.Optional.SaferSurf - where * represents anything. The file is located in %ProgramFiles%\*Safer-Surf. If bundled with another installer or not installed by choice then remove itNo
SaferAutoLaunch_[hex characters]Usafer.exeSafer Browser by Safer Technologies LLC - "Our 'safer' technology will alert you when visiting unsafe websites and ensure that your computer encrypts your internet connection whenever possible. Combined with advanced Parental Controls and Web Of Trust integration, Safer Browser is the fastest, most secure browser on the market." Detected by Malwarebytes as PUP.Optional.SaferBrowser. The file is located in %ProgramFiles%\Safer Technologies\Safer Browser\Application. If bundled with another installer or not installed by choice then remove itNo
SaferBrowserUSaferBrowser.exeDetected by Malwarebytes as PUP.Optional.SaferBrowser. The file is located in %ProgramFiles%\SaferBrowser. If bundled with another installer or not installed by choice then remove itNo
SaferBrowserIsDefaultUSaferBrowserProtector.exeSafer Browser by Safer Technologies LLC - "Our 'safer' technology will alert you when visiting unsafe websites and ensure that your computer encrypts your internet connection whenever possible. Combined with advanced Parental Controls and Web Of Trust integration, Safer Browser is the fastest, most secure browser on the market." Detected by Malwarebytes as PUP.Optional.SaferBrowser. The file is located in %ProgramFiles%\Safer Technologies\Safer Browser\Application. If bundled with another installer or not installed by choice then remove itNo
SaferScanXSaferScan.exeSaferScan rogue security software - not recommended. Detected by Malwarebytes as Rogue.SaferScanNo
SafeSearchXsafesearch.exeSafeSearch adwareNo
UnshareXSafeShare.exeSafeShare peer-to-peer (P2P) file-sharing client often bundled with adware or spywareNo
CertificateRegistrationUSafeSignCertReg.exeSafeSign Certificate Registration Utility for Microsoft Crypto applicationsNo
SafeSpaceYSafeSpaceSysTray.exePart of SafeSpace (from Artificial Dynamics) which "eliminates the problem of malware by creating a secure barrier between your computer and the internet, protecting you and your personal information against known and unknown malware threats." No longer availableNo
SafeStripXSafeStrip.exeSafeStrip rogue security software - not recommended, removal instructions hereNo
SafeStripReminderXSafeStripReminder.exeSafeStrip rogue security software - not recommended, removal instructions hereNo
SafeSysXSafeSys.exeDetected by Trend Micro as WORM_AUTORUN.DMI and by Malwarebytes as Worm.AutoRunNo
SafeterraXSafeTerraUpdate.exeDetected by Symantec as Adware.SafeTerra and by Malwarebytes as Adware.AgentNo
SafeTestXSafeTest.exeDetected by Kaspersky as Trojan-Dropper.Win32.Microjoin.lzk and by Malwarebytes as Trojan.Agent. The file is located in %System%No
Safety Anti-Spyware 3XSafety Anti-Spyware 3.exeSafety Anti-Spyware rogue security software - not recommended, removal instructions hereNo
SafetyKeeperXSafetyKeeper.exeSafetyKeeper rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SafetyOneXSafetyOne.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%\SafetyOneNo
Safety OptimizerUSafetyOptimizer.exeSafety Optimizer is a high-grade software solution designed to protect your sensitive personal information against potential online threats caused by weak ciphers used by Internet servers. Safety Optimizer enhances your Internet Explorer security features and protects your privacy." Detected by Malwarebytes as PUP.Optional.SafetyOptimizer. The file is located in %ProgramFiles%\Safety Optimizer. If bundled with another installer or not installed by choice then remove itNo
SafetyPCXsafetypcup.exeSafetyPC rogue security software - not recommended, removal instructions hereNo
SafeXSafeWin.exeDetected by Symantec as Infostealer.FocosenhaNo
safe_url__2Usafe_url__2.exeDetected by Malwarebytes as PUP.Optional.BrowserSecurity. The file is located in %AppData%\Browser-Security. If bundled with another installer or not installed by choice then remove itNo
Sagate Security FirewallXsagate.exeDetected by Symantec as W32.Gaobot.BOWNo
Laptop AccessXSage.exeDetected by Sophos as W32/Sdbot-NBNo
SystemAgentUSage.exe"Microsoft Plus! System Agent automatically tunes your system, performing tasks such as disk optimization and error correction. It can also run any application at prescheduled times"No
SagemMonitorUSagemMonitor.exeMonitor for the Sagem F@st 1200 high speed ADSL routerNo
SAGENTSERVICEUSagent.exeTinySpyAgent commercial keystroke logger. Uninstall this software if you did not install it yourselfNo
SAgent2ExePathUSAgent2.exeMonitors printer status, ink levels, etc for EPSON printersNo
sagntXsagnt.exeAdware web downloaderNo
PrevxHomeYSAGUI.exePrevX (now Webroot) behaviour-based anti-malware protectionNo
PrevxProYSAGUI.exePrevX (now Webroot) behaviour-based anti-malware protectionNo
SAHagentXSahagent.exeShopAtHomeSelect parasiteNo
saharXsahar.exeDetected by Malwarebytes as Trojan.Ransom.Foreign. This entry loads from the HKCU\Run key and the file is located in %UserStartup%No
sahar.exeXsahar.exeDetected by Malwarebytes as Trojan.Ransom.Foreign. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SaitekAutoConfigureUsaicnfig.exeConfiguration for Saitek game controllersNo
saieXsaie.exe180solutions adwareNo
saihoiXsaihoi.exeDetected by Sophos as Troj/Mdrop-CUT and by Malwarebytes as Worm.SFDCNo
SmartAudioUSAIICpl.exeConexant SmartAudio audio chipset driver and user interface - typically found in notebooksNo
Configuration SoftwareNSaiMfd.exeSaitek MFD File System Driver - associated with the Saitek SST (Saitek Smart Technology) configuration software for their game controllers. Create a shortcut and run manually when requiredYes
SaiMfdNSaiMfd.exeSaitek MFD File System Driver - associated with the Saitek SST (Saitek Smart Technology) configuration software for their game controllers. Create a shortcut and run manually when requiredYes
Write DVD-R!Usaimon.exeSaimon's WriteDVD! "gives total support for DVD-RAM drives. It provides many functions such as setting partitions on DVD-RAM disks and FixDVD! can diagnose and repair UDF formatted disks"No
SAIMONUSaiMon.exeSaitek joystick driverNo
sainXsain.exeDetected by Symantec as Adware.180SearchNo
saisXsais.exe180solutions adwareNo
SaiSmartUSaiSmart.exe"Smart Button Special Sauce" - included with support software for some of the Saitek game controllers. Related to the "S", "Shift" or "Smart" button and gives gamers extra features on the buttons. Only required if you use this featureNo
SakoraXSakora.exeDetected by McAfee as Generic.dxNo
snhXsakura_no_hanabiratachi.exeDetected by Dr.Web as Win32.HLLW.Autoruner1.58968 and by Malwarebytes as Worm.AutoRun.ENo
SalaatTimeNSalaatTime.exe"Salaat Time is a FREE multi-function Islamic application that calculates the prescribed five daily Muslim prayer times as well as Qiblah direction for anywhere in the world"No
First Windows StartXSalah-Web.exeDetected by Malwarebytes as Trojan.Agent.FWS. The file is located in %System%No
salasotkojeqXsalasotkojeq.exeDetected by Dr.Web as BackDoor.Bulknet.1147 and by Malwarebytes as Backdoor.Agent.PDNo
Ela-SalatyNSalaty.exeEla-Salaty - Arabic program that helps you to remember times of prayerNo
Salsa###XSalsa###.exeDetected by Malwarebytes as Ransom.Salsa - where # represents a digit. The file is located in %CommonAppData%\DONOTDELETESALSANo
smsofterXsalss.exeDetected by McAfee as RDN/Downloader.a!p and by Malwarebytes as Trojan.ChinAdNo
salthotXsalthot.exeDetected by McAfee as RDN/Generic.bfr!ht and by Malwarebytes as Backdoor.Agent.CNMNo
SalusUSalus.exeDetected by Malwarebytes as PUP.Optional.Salus.PrxySvrRST. The file is located in %ProgramFiles%\Salus. If bundled with another installer or not installed by choice then remove itNo
msvcc25Xsalvage.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%No
salyXsaly*****.exeAdded by a variant of the AW.AWK TROJAN!No
Sam-sungXSam-sung.exeAdded by a variant of W32/Sdbot.wormNo
Skype UpdatXSamBroadCaster.exeDetected by Malwarebytes as Backdoor.XTRat. The file is located in %System%\InstallDirNo
SamBroadXSamBroadCaster.exeDetected by Malwarebytes as Backdoor.XTRat. The file is located in %System%\InstallDirNo
SAMcalUSAMcal.exeSamCal - calendar/reminder programNo
AKSMSSMEXsamDdlmdDple.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.DCENo
samezgyrovisXsamezgyrovis.exeDetected by McAfee as BackDoor-FAYA!99D15F1A0F3D and by Malwarebytes as Trojan.Agent.USNo
SamSvcDllXSamHostDll.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Trojan.AgentNo
SoftechXSample doc.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.Agent.DCENo
sampleXsample.exeDetected by Malwarebytes as Trojan.Agent.SMP. The file is located in %AppData%No
SampleXSample.exeDetected by Dr.Web as Trojan.DownLoader17.25697 and by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\New folderNo
msconfigXsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Temp%No
FFGTRXsample.exeDetected by Malwarebytes as Trojan.Agent.SMP. The file is located in %AppData%No
LOOKATFRMGXsample.exeDetected by McAfee as RDN/Generic PWS.y and by Malwarebytes as Trojan.Agent.SMPNo
testing.exeXsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Temp%No
(Default)Xsample.exeDetected by Malwarebytes as Trojan.Agent.SMP. Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %AppData%No
Windows FirewallXsample.exeDetected by Malwarebytes as Worm.PushBot. The file is located in %Temp%No
tmp_upXsample.exeQuickBar adwareNo
svchostXsample.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %UserTemp%No
chrome.exeXsample.exeDetected by Malwarebytes as Trojan.Agent.CRGen. The file is located in %UserTemp%No
javaXsample.exeDetected by Malwarebytes as Worm.Ainslot. The file is located in %Temp%No
BluetoothXsample.exeDetected by Sophos as Troj/Agent-OSHNo
Win UpdateXsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp%No
DDDDXsample.exeDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent.SMPNo
exeXsample.exeDetected by Malwarebytes as Trojan.Agent.SMP. The file is located in %AppData%No
Startup NameXsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp% - see hereNo
CCGLOGXsample.exeDetected by McAfee as RDN/Generic BackDoor!p and by Malwarebytes as Backdoor.Agent.DCNo
taskmangrXsample.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.DCENo
MSXsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
Windows Rundll32Xsample.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Temp%No
sidebarXSample.lnkDetected by Dr.Web as Trojan.DownLoader9.11246 and by Malwarebytes as Trojan.AgentNo
Security Accounts Manager SMXsamsm.exeAdded by the WOOTBOT.BC WORM!No
SamsongXSamsong.exeDetected by Trend Micro as WORM_SDBOT.BNENo
Samsung LinkUSamsung Link Launcher.exeLauncher for Samsung Link - which "is an integrated service that replaces AllShare Play on select Samsung devices and allows you to access content, including photos, music, videos and documents, from multiple storage locations on any connected device." Discontinued as of November 2016 with similar features now available via Samsung Smart ViewNo
Samsung LinkUSamsung Link Tray Agent.exeSystem Tray access to Samsung Link - which "is an integrated service that replaces AllShare Play on select Samsung devices and allows you to access content, including photos, music, videos and documents, from multiple storage locations on any connected device." Discontinued as of November 2016 with similar features now available via Samsung Smart ViewNo
RDSoundXSamsungGalaxyS2.exeDetected by McAfee as Generic.dx!bcs4 and by Malwarebytes as Trojan.AgentNo
RDSoundXSamSungGalyxSII.exeDetected by McAfee as Generic Downloader.x!ggx and by Malwarebytes as Backdoor.AgentNo
YeppStudioAgentNSamsungMediaStudioAgent.exeSamsung Media Studio MP3 player file management software - see here for an exampleNo
SamsungRapidAppUSamsungRapidApp.exePart of the Samsung Magician SSD utility which allows users to reach the maximum potential and proficiency of their Samsung SSDs. Notification utility for Samsung RAPID mode - with which you can "achieve over 2X faster performance through intelligent DRAM caching of data, for read acceleration and write optimization"No
SamsungXSamsungs.exeAdded by a variant of the IRCBOT BACKDOOR!No
PersSamDllXSamTrayConf.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Trojan.MSILNo
FireWire DriverXsamx.exeDetected by Symantec as Backdoor.Sdbot.AENo
Adobe Gama LoaderXsan.exeDetected by McAfee as RDN/Generic PWS.y!l and by Malwarebytes as Backdoor.MessaNo
SancMediaXSancMedia.exeDetected by Sophos as Troj/Mdrop-EYG and by Malwarebytes as Trojan.Dropper.MSNo
SandIconNSandIcon.exeSanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds, but once the software sees there's no reader, you get back the resourcesNo
SanDiskSecureAccess_Manager.exeUSanDiskSecureAccess_Manager.exe"SanDisk® SecureAccess™ Manager is an application installed on your computer desktop to help launch the SanDisk SecureAccess software, automatically and transparently, whenever you connect the SanDisk USB flash drive to your computer." Required if you regularly use a supported driveNo
sandunkixumoXsandunkixumo.exeDetected by McAfee as RDN/Generic Downloader.x!ia and by Malwarebytes as Trojan.Agent.USNo
SansaDispatchUSansaDispatch.exeSansa Updater - "The Sansa Firmware Updater is an application designed to deliver the latest firmware, software support, User Manuals right to your desktop"No
SANS ServiceXsansv.exeDetected by Sophos as W32/Vanebot-AHNo
Santa Bastards BitchXSANTAS.BITCH.txtAdded by the ATNAS.A WORM!No
System Applications ProfileXsap.exeDetected by Sophos as W32/Rbot-QFNo
Speech RecognitionUsapisvr.exePart of the Windows Speech Recognition feature in Windows 7/8.* - which "empowers users to interact with their computers by voice. It was designed for people who want to significantly limit their use of the mouse and keyboard while maintaining or increasing their overall productivity"No
[various names]XSAPSTR.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
BeawverXsaqevre.exeAdded by a variant of Backdoor.Ranky. The file is located in %System%No
sarever.exeXsarever.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Microsft UpdtesXsarvice.exeAdded by a variant of W32/Sdbot.wormNo
SASA INCXsasa.exeDetected by McAfee as RDN/Generic BackDoor!tj and by Malwarebytes as Backdoor.Agent.DCENo
SAService?SAservice.exeAssociated with CyberTrio from G-Tek Technologies - which allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs. What does it do and is it required?No
Syntax ScriptXsaskatcw.exeDetected by Sophos as W32/Sdbot-TENo
SaskTel Accelerated Dial-upUsasktelgui.exe"Experience faster surfing, downloading and e-mail by adding SaskTel Accelerated Dial-up Internet"No
usbXSASS.EXEDetected by Sophos as Troj/Funsta-ANo
sast32Xsast32-2.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%No
ScanDiscXsatan.exeAdded by the GREGSTAR TROJAN!No
SATARaidUSATARaid.exeRAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drivesNo
satmatXsatmat.exeVX2.Transponder parasite updater/installer relatedNo
sauXsau.exeDetected by Symantec as Adware.180SearchNo
sauobexXsauobex.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %UserProfile%No
SAUpdateUSAUpdate.exeBig Brother from Quest Software. System and network monitorNo
ATTBroadbandUpdateUSAUpdate.exeBig Brother from Quest Software. System and network monitorNo
SAutoLaunchExeUSAutoLaunchExe.exeSharp Zaurus PDA related, needed to synchronize information with a Desktop or NotebookNo
AntivirusXsav.exeSystem Antivirus 2008 rogue security software - not recommended, removal instructions hereNo
SAVAgentYSAVAgent.exePart of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly, e.g. automatically updating PCs used by dial-in home or out-of-office usersNo
WhenUSaveXSave.exeDetected by Symantec as Adware.Savenow and by Malwarebytes as Adware.WhenUNo
SaveXSave.exeDetected by Symantec as Adware.Savenow and by Malwarebytes as Adware.WhenUNo
SaveArmorXSaveArmor.exeSaveArmor rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveComXSaveCom.exeSaveCom rogue security software - not recommended, removal instructions hereNo
SaveCouponsUSaveCoupons.exeDetected by Malwarebytes as PUP.Optional.SaveCoupons. The file is located in %LocalAppData%\Programs\SaveCoupons\[version]. If bundled with another installer or not installed by choice then remove itNo
SaveDefenderXSaveDefender.exeSaveDefender rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveDefenseXSaveDefense.exeSaveDefense rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveInfoXSaveInfo.exeSaveInfo rogue security software - not recommended, removal instructions hereNo
SaveKeepXSaveKeep.exeSaveKeep rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveKeeperXSaveKeeper.exeSaveKeeper rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveMyWorkUSaveMyWork.exeSaveMyWork keystroke logger/monitoring program - remove unless you installed it yourself!No
SavenowXSaveNow.exeSaveNow adwareNo
SaveSoldierXSaveSoldier.exeSaveSoldier rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SaveDateXSaveStartDate.ExeUnidentified adwareNo
ssnUsaveup.exeDetected by Malwarebytes as PUP.Optional.SSN. The file is located in %AppData%\ssn. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
HKCUXsavhost.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%No
Microsoft Security CenterXsavservices.exeDetected by Sophos as W32/Rbot-ANUNo
ROCCAT Savu Gaming MouseUSavu Monitor.exeROCCAT Savu gaming mouse driver - required if you use the additional features and programmed keys/macrosNo
SAWXsaw.exeSmartAdware adwareNo
saxasfibdasaXsaxasfibdasa.exeDetected by McAfee as RDN/Generic Dropper!uz and by Malwarebytes as Trojan.Agent.USNo
say the TimeUSAYTIME.EXESay the Time by Provenio Software. This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularlyNo
Say The Time 5.0USAYTIME.EXESay the Time by Provenio Software. This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularlyNo
sazvabkofrimXsazvabkofrim.exeDetected by McAfee as RDN/Generic BackDoor!qt and by Malwarebytes as Trojan.Agent.USNo
Security AntivirusXSA[random].exeSecurity Antivirus rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecurityAntivirusNo
smXsa_exe.exeAdded by the OLFEB.A TROJAN!No
SBUSB.exe"The Acer soft button is a radial control on the screen that manages program icons, system settings/utilities, file folders and network locations." Included on Acer Tablet/Notebook PCs that support the Electromagnetic Resonance (EMR) stylus (such as the Travelmate C310) - which is used to input data in tablet modeNo
SB#XSB.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %Windir%No
CDLoaderUsb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
SysCheck32Usb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
System32Usb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
RegUpdateUsb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
Trunk32Usb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
ScanSys32Usb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
SystemcheckUsb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
WinSysCheckUsb32mon.exePart of SpyBuddy by ExploreAnywhere - "comprehensive computer monitoring software product that allows you to easily monitor all areas of your PC". See hereNo
SBAMTrayYSBAMTray.exeSystem Tray access to, and notifications for the VIPRE (and older CounterSpy) range of security software from GFI Software (was Sunbelt Software)No
SBAutoUpdateUsbautoupdate.exeSpywareBlaster auto-updaterNo
SBC RoamingClientUSBCFL.exePart of AT&T FreedomLink Wi-Fi connection softwareNo
SBCSTrayYSBCSTray.exeSystem Tray access to Sunbelt CounterSpy antispyware software - now discontinued with users recommended to switch to VIPRENo
SBDrvDetUSBDrv.exeDetects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have oneNo
SBDrvDetNSBDrvDet.exeChecks to see if Creative sound card driver should be updatedNo
TaskmanXsbeb.exeDetected by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "sbeb.exe" (which is located in %AppData%)No
SBHCXsbhc.exeSuperBar parasiteNo
Windows bypass security SMSS ServiceXSbiCvy.exeDetected by Sophos as W32/Rbot-GRFNo
SandboxieControlUSbieCtrl.exe"SandBoxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer"No
[various names]Xsbin.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
Spam Blocker for Outlook ExpressXSBInst.exeSpam Blocker Utility adware by the people who provide the Hotbar adware. The file is typically located in %ProgramFiles%\SpamBlockerUtility\Bin\[version]No
Windows System Restore ConfigurationXSblhost.exeAdded by a variant of the SPYBOT WORM!No
startXsbmntr.exeDetected by ThreatTrack Security as Trojan-Downloader.Zlob.Media-Codec (fs) and by Malwarebytes as Trojan.Agent. This purports to be a Windows Media Player upgrade (with names such as "iCodecPack", "X Password Manager" and "Media-Codec") to allow the user to view adult oriented videos on certain websites - but actually downloads and installs additional malware on the user's machineNo
SBMPOPXSBMPop.exeSearchByMedia adware. The file is located in %ProgramFiles%\vci\SearchByMediaNo
SBMXNsbmx.exeSoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)No
SpamBlockerXSbOEAddOn.exeSpam Blocker Utility adware by the people who provide the Hotbar adware. The file is typically located in %ProgramFiles%\SpamBlockerUtility\Bin\[version]No
sboleoytXsboleoyt.exeDetected by Malwarebytes as Trojan.Cutwail. The file is located in %System%No
sboleoytXsboleoyt.exeDetected by Malwarebytes as Trojan.Cutwail. The file is located in %UserProfile%No
Microsoft Service BootXsboot.exeAdded by a variant of the IRCBOT BACKDOOR!No
SBoxSearchBarOSXSBoxSearchBar.exeDetected by Malwarebytes as Adware.KorAd. The file is located in %ProgramFiles%\ShareBox\SBoxSearchBarNo
SBoxSearchBarXSBoxSearchBarU.exeDetected by AVG as OpenShopper.A and by Malwarebytes as Adware.K.ShareBox. The file is located in %ProgramFiles%\ShareBox\SBoxSearchBarNo
MSRegScanUSBPDemo.exeSpyBoss Pro surveillance software. Uninstall this software unless you put it there yourselfNo
SystemBooster2009Xsbr_updater.exeSystemBooster2009 rogue system suite - not recommended, removal instructions hereNo
ServiceXsbs.vbsDetected by McAfee as RDN/Generic Dropper!uo and by Malwarebytes as Trojan.Agent.MNRNo
SYSTEM.MANAGEMENTXsbscmp20_mscorlib.exeDetected by McAfee as RDN/Generic Dropper!d and by Malwarebytes as Trojan.AgentNo
SC.exeXSBSCP.exeDetected by Malwarebytes as Trojan.FakeSupport. The file is located in %UserProfile%\Desktop - see hereNo
VinceXSBSCP.exeDetected by Malwarebytes as Trojan.TechSupportScam. The file is located in %ProgramFiles%\VinCE - see hereNo
ScriptBlockingYSBServ.exePart of the "Script Blocking" feature for older versions of Symantec's Norton AntiVirus which monitors script-based (ie, JavaScript, VB Script) viruses and alerts you of virus-like malicious behavior, stopping these viruses before they can infect your system. Runs as a service on an NT based OS (such as Windows 10/8/7/Vista/XP)No
EapcisetupNsbsetup.exeRockwell RipTide soundcard application software. Sound works without itNo
sbss LauncherXsbss.exeSideBySide adwareNo
SBUSAXSBUSA.exeSpam Blocker Utility adware by the people who provide the Hotbar adware. The file is typically located in %ProgramFiles%\SpamBlockerUtility\Bin\[version]No
SB WatchdogXSBWatchdog.exeSpyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBankNo
WeatherOnTrayXSbWeatherOnTray.exeSpam Blocker Utility adware by the people who provide the Hotbar adware. The file is typically located in %ProgramFiles%\SpamBlockerUtility\Bin\[version]No
6-susilo bXsby.exeDetected by Sophos as W32/Brontok-CRNo
Sound Blaster Z-Series Control PanelUSBZ.exeControl Panel for the Creative Sound Blaster Z-Series soundcards - which allows you to switch inputs, change sound effects and configure speaker settingsNo
scUsc.exeWatchdog 2.0 Software - monitoring programNo
SC2300CamCheck?sc23exec.exeRelated to the SiPix (now E Ink) SC-2300 Digital Cameras. What does it do and is it required?No
SC3300CCYSC3300CC.exeTwain driver for the SiPix SC3300 digital cameraNo
Advance-System-Care_LogonUscadv.exeDetected by Malwarebytes as PUP.Optional.AdvanceSystemCare. The file is located in %ProgramFiles%\Advance-System-Care. If bundled with another installer or not installed by choice then remove itNo
USB Electronic ScaleUScaleRelated to a USB Electronic Scale - manufacturer currently unknownNo
WINDOWS SYSTEM SCALPEXscalpe91.exeDetected by Sophos as W32/Mytob-HINo
Driver32XScam32.exeDetected by Symantec as W32.Sircam.Worm@mmNo
Scan&Repair2006.exeXScan&Repair2006.exeScan&Repair Utilities 2006 rogue system utility - not recommendedNo
antispyXscan.exeIE AntiVirus rogue security software - not recommended, removal instructions hereNo
TotalSecure2009Xscan.exeTotal Secure 2009 rogue security software - not recommended, removal instructions hereNo
UpdatesXscan.vbeDetected by Dr.Web as Win32.HLLW.Autoruner1.34949 and by Malwarebytes as Trojan.AgentNo
Scan01.exeXScan01.exeDetected by Malwarebytes as Trojan.MSIL. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Scan119XScan119.exeScan119 rogue security software - not recommended, removal instructions hereNo
2335dn Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Dell 2335 multifunction laser printerNo
3170 Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printerNo
WHITNEY_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX-4x21 Series multifunction printersNo
Whitney2_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX-4725 Series photocopierNo
WHITNEY2_XRX_S2PUScan2pc.exeScan to PC application for the scanning function of the Xerox Phaser 3200MFP multifunction laser printerNo
WhitneyXerox_S2PUScan2pc.exeScan to PC application for the scanning function of the Xerox WorkCentre PE220 Series multifunction laser printerNo
IRIS_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung CLX-3160 Series multifunction laser printerNo
IRIS_XRX_S2PUScan2pc.exeScan to PC application for the scanning function of the Xerox Phaser 6110MFP multifunction laser printerNo
Maple_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung CLX-216x Series multifunction printersNo
4x26 Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX4x26 multifunction laser printersNo
4x28 Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX4x28 multifunction laser printersNo
MFP1815_S2PUScan2pc.exeScan to PC application for the scanning function of the Dell Laser MFP 1815 multifunction printerNo
Scan2pcUScan2pc.exeScan to PC application for the scanning function of multiple multifunction printers from Dell, Samsung, Xerox, Ricoh and othersNo
Logan_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX-4500 Series multifunction printerNo
6200 Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Samsung CLX6200 multifunction laser printerNo
R2Plus_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX-4x20 Series multifunction printersNo
R2Ricoh_S2PUScan2pc.exeScan to PC application for the scanning function of the Ricoh MFP Type 103 multifunction printerNo
1455 Scan2PCUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX1455 multifunction printerNo
ELBERT_S2PUScan2pc.exeScan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printersNo
ELBERTRicoh_S2PUScan2pc.exeScan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printerNo
Win32GXScandisk.comDetected by Symantec as W32.EstrellaNo
MS ScandiskXscandisk.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %System% - see hereNo
MS ScandiskXscandisk.exeDetected by McAfee as BackDoor-AED and by Malwarebytes as Trojan.Agent.Gen. The file is located in %Windir%No
ScanDiskXscandisk.exeDetected by Symantec as W32.Ganda.A@mm. Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checkerNo
runXscandisk.exeDetected by McAfee as BackDoor-AED. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "run" value data to include the file "scandisk.exe" (which is located in %Windir%)No
scands32.exeXscands32.exeAdded by a variant of the ADCLICKER TROJAN!No
Scandsk2Xscandsk2.exeDetected by Sophos as W32/Agobot-PKNo
scandskx.exeXscandskx.exeDetected by Sophos as Troj/Dloadr-ARMNo
scanfdiskk97.dllXscanfdiskk97.dllDetected by Malwarebytes as Trojan.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ScanGuardUScanGuard.exeScanguard by SS Protect Limited - "Instantly enhance your device performance whilst protecting you against malicious malware and cyber threats that can infect your PC." Detected by Malwarebytes as PUP.Optional.ScanGuard. Note - this entry loads from the Windows Startup folder and the file is located in %ProgramFiles%\ScanGuard. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
Quick Heal AntiVirusUSCANMSG.EXEPart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Enables the "Quick Heal messenger service which provides important information about latest threats, updates and other information related to Quick Heal." Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
MessengerUSCANMSG.EXEPart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Enables the "Quick Heal messenger service which provides important information about latest threats, updates and other information related to Quick Heal." Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
SCANMSGUSCANMSG.EXEPart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Enables the "Quick Heal messenger service which provides important information about latest threats, updates and other information related to Quick Heal." Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
ScanSpywareXScanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see hereNo
ScanSpyware v3.2XScanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see hereNo
ScanSpyware v3.5XScanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see hereNo
hpScannerFirstBoot?scannerfb.exeHP scanner relatedNo
Microtek Scanner FinderUScannerFinder.exeMonitors whether a scanner is present. Provided with Microtek scannersNo
ScanPanel?ScanPanel.exeTrust Easy Webscan scanner related. What does it do and is it required?No
Scan registryXScanreg.exeDetected by McAfee as BackDoor-CEP.svr and by Malwarebytes as Trojan.BackdoorNo
Reg_WFTXscanreg32.comDetected by Sophos as Troj/SennaSpy-FNo
ScanRegistryXscanregv.exeDetected by McAfee as MasterLock.b. Note - do not confuse this with the legitimate ScanRegistry (scanregw.exe)No
[3-4 random letters]Xscanregw.exeDetected by Symantec as Adware.PurityScan - also see the archived version of Andrew Clover's page. Note - do not confuse this with the legitimate scanregw.exe which is always found in %Windir% on Win9x/ME machinesNo
ScanRegistryXscanregw.exeDetected by Sophos as W32/Nyxem-D. Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is located in %System%No
ScanRegistryXScanregw.exeDetected by Symantec as W32.Stator@mm. Note - do not confuse this with the legitimate scanregw.exe which is always found in %Windir% on Win9x/ME machines. This one is located in %System%No
ScanRegistryYScanregw.exeScans the WinMe/98 system registry and makes back-ups at start-up - important should the registry become corrupt. Located in %Windir%No
Microsoft Disk ScannerXscansdisk.exeDetected by Trend Micro as WORM_WOOTBOT.DTNo
[various names]XscanSYS.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
P3000x_S2PUScanToPc.exeDell Laser MFP 1600N network application for scanning files to the PCNo
HP Deskjet 3070 B611 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Deskjet 3070 B611 series AIO printer over a networkNo
HP Deskjet 3510 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Deskjet 3510 series AIO printer over a networkNo
HP Deskjet 3520 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Deskjet 3520 series AIO printer over a networkNo
HP ENVY 110 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP ENVY 110 series AIO printer over a networkNo
HP Officejet 4620 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet 4620 series AIO printer over a networkNo
HP Officejet 6500 E710a-f (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet 6500 E710a-f AIO printer over a networkNo
HP Officejet 6600 (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet 6600 AIO printer over a networkNo
HP Officejet 6700 (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet 6700 AIO printer over a networkNo
HP Officejet 7500 E910 (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet 7500 E910 AIO printer over a networkNo
HP Officejet Pro 8500 A910 (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet Pro 8500 A910 AIO printer over a networkNo
HP Officejet Pro 8600 (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Officejet Pro 8600 AIO printer over a networkNo
HP Photosmart 5510 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 5510 series AIO printer over a networkNo
HP Photosmart 5510d series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 5510d series AIO printer over a networkNo
HP Photosmart 5520 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 5520 series AIO printer over a networkNo
HP Photosmart 6510 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 6510 series AIO printer over a networkNo
HP Photosmart 6520 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 6520 series AIO printer over a networkNo
HP Photosmart 7510 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 7510 series AIO printer over a networkNo
HP Photosmart 7520 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart 7520 series AIO printer over a networkNo
HP Photosmart Plus B210 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Photosmart Plus B210 series AIO printer over a networkNo
HP Deskjet 3050 J610 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Deskjet 3050 J610 series AIO printer over a networkNo
HP Deskjet 3050A J611 series (NET)NScanToPCActivationApp.exeUtility that allows you to scan directly to your computer from the HP Deskjet 3050A J611 series AIO printer over a networkNo
Windows ServiceXScanvegw.exeDetected by Symantec as Backdoor.Delf and by Malwarebytes as Backdoor.BotNo
scAppXscApp.exeDetected by Trend Micro as TROJ_NELO.ANo
TwkSCardSrvNSCardS32.ExeUsed with Identive (was SCM Microsystems) Towitoko SMART card readers for card recognitionNo
jyokwey3vnWBh+VgYazHXscardsvr.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate Smart Card service for WinXP which shares the same filename and is located in %System%. This one is located in %AppData%\Microsoft\Internet ExplorerNo
defrag.exeXscardsvr.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate Smart Card service for WinXP which shares the same filename and is located in %System%. This one is located in %AppData%\Microsoft\Media PlayerNo
SCardSvrNScardSvr.exeFor Smart Card readers. Known to cause problems, especially for Windows 2000 users - see here. Probably not required unless you use such a device regularlyNo
NavAgent32XSCardSvr32.ExeDetected by Trend Micro as WORM_MOFEI.BNo
SCardSvrXSCardSvr32.ExeDetected by Trend Micro as WORM_MOFEI.BNo
scarpwinXscarpwin.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %System% - see hereNo
SearchEnhancementXscbar.exeSCBar/SearchEnhancement foistwareNo
darcXscbs.scrDetected by Dr.Web as Trojan.PWS.Banker1.14085 and by Malwarebytes as Trojan.Banker.ENo
Service ConnectionNsccenter.exeFor Compaq PC's. Part of BackwebNo
Services HostXScchost.exeDetected by Symantec as W32.HLLW.Donk and by Malwarebytes as Backdoor.BotNo
Alive SYstemXscchost.exeDetected by Sophos as Troj/Tofdrop-B and by Malwarebytes as Backdoor.BotNo
Key NameXscchost.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\windowexplorerNo
SystemsXscchost.exeDetected by Trend Micro as TROJ_DAEMOZ.A and by Malwarebytes as Backdoor.BotNo
Alive SYstemXscchostc.exeDetected by Sophos as Troj/Tofdrop-BNo
ScchostsyXscchostsy.exeDetected by Dr.Web as Trojan.DownLoader10.22499 and by Malwarebytes as Trojan.Downloader.ENo
Activex ReleaseXsccrss.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %AppData%\Microsoft - see hereNo
Microsoft Windows UpdateXsccvhost.exeDetected by Malwarebytes as Trojan.MWF.Gen. The file is located in %System%No
SCDEmuApp.exeUSCDEmuApp.exeRelated to PowerISO - CD/DVD image file processing toolNo
Configuration DriverXscghost.exeDetected by Sophos as W32/Sdbot-DLANo
System-Care_LogonUscgpcw.exeSystem Care is the world's most liked and preferred PC protection utility! The most efficient and simple-to-use tool for users to quickly optimize and get a clean and faster PC. Detected by Malwarebytes as PUP.Optional.GlobalPCWorks. The file is located in %CommonAppData%\System-Care. If bundled with another installer or not installed by choice then remove itNo
MS Windows UpdateXscguard.exeDetected by Sophos as W32/Rbot-YZNo
PCBackupXSchCàche.exeDetected by Malwarebytes as Trojan.Miner. The file is located in %Root%\TÅMPNo
Backup NOW! SchedulerUSchdlr32.exeScheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled, this entry places an icon in the System Tray and will automatically load the main program and execute the backup at the set time - as long as the backup media is presentYes
Schdlr32USchdlr32.exeScheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled, this entry places an icon in the System Tray and will automatically load the main program and execute the backup at the set time - as long as the backup media is presentYes
NTI Backup NOW! SchedulerUSchdlr32.exeScheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled, this entry places an icon in the System Tray and will automatically load the main program and execute the backup at the set time - as long as the backup media is presentYes
Windows Update SystemXscheb.exeDetected by Microsoft as Backdoor:Win32/IRCbot.FJ and by Malwarebytes as Trojan.Agent.WUGenNo
Windows ServicesXscheb.exeDetected by Sophos as Troj/Agent-QVV and by Malwarebytes as Backdoor.Agent.GenNo
Windows UpdateXscheb.exeDetected by Sophos as Troj/Agent-QVVNo
scheck45Xscheck45.exeRelated to unknown malware - hidden installer associated with itNo
Internet ExplorerXsched.exeDetected by Dr.Web as Trojan.Inject1.32549 and by Malwarebytes as Backdoor.Messa.GenNo
Apricorn Scheduler ServiceUschedhlp.exeScheduler for the Apricorn EZ Gig II implementation of the Acronis True Image backup software. From Acronis (courtesy of AnswersThatWork: "The program monitors the logons and logoffs on your PC and notifies the Acronis Scheduling system about them. It is started when a user logs into the system and terminates when the user logs off. Acronis True Image uses this program to schedule tasks on user logon/logoff and to run non-scheduled "Image creation" operation". Not required if you do not have scheduled jobsNo
Seagate Scheduler2 ServiceUschedhlp.exeScheduler for the Seagate DiscWizard and BlackArmor Backup implementations of the Acronis True Image backup software. From Acronis (courtesy of AnswersThatWork: "The program monitors the logons and logoffs on your PC and notifies the Acronis Scheduling system about them. It is started when a user logs into the system and terminates when the user logs off. Acronis True Image uses this program to schedule tasks on user logon/logoff and to run non-scheduled "Image creation" operation". Not required if you do not have scheduled jobsNo
schedhlpUschedhlp.exeScheduler for the Acronis True Image range of backup software. From Acronis (courtesy of AnswersThatWork: "The program monitors the logons and logoffs on your PC and notifies the Acronis Scheduling system about them. It is started when a user logs into the system and terminates when the user logs off. Acronis True Image uses this program to schedule tasks on user logon/logoff and to run non-scheduled "Image creation" operation". Not required if you do not have scheduled jobs. Also included in the Seagate DiscWizard, Seagate BlackArmor Backup, Maxtor (now Seagate) MaxBlast and Apricorn EZ Gig II implementations of True ImageYes
Acronis Scheduler HelperUschedhlp.exeScheduler for the Acronis True Image range of backup software. From Acronis (courtesy of AnswersThatWork: "The program monitors the logons and logoffs on your PC and notifies the Acronis Scheduling system about them. It is started when a user logs into the system and terminates when the user logs off. Acronis True Image uses this program to schedule tasks on user logon/logoff and to run non-scheduled "Image creation" operation". Not required if you do not have scheduled jobsYes
Acronis Scheduler2 ServiceUschedhlp.exeScheduler for the Acronis True Image range of backup software. From Acronis (courtesy of AnswersThatWork: "The program monitors the logons and logoffs on your PC and notifies the Acronis Scheduling system about them. It is started when a user logs into the system and terminates when the user logs off. Acronis True Image uses this program to schedule tasks on user logon/logoff and to run non-scheduled "Image creation" operation". Not required if you do not have scheduled jobs. Also included in the Maxtor (now Seagate) MaxBlast implementation of True ImageYes
WTIndicatorUSchedInd.exeWinTask - software that automates a variety of routine tasks quickly and simplyNo
schedlXschedl.exeDetected by Sophos as W32/VB-DVWNo
schedmYschedm.exePart of Avira AntiVir® PersonalEdition Classic antivirus - now superseded by Avira Free AntivirusNo
avira timeXschedmi.exeDetected by McAfee as W32/Spybot.worm!gNo
Task Scheduler EngineXschedsvc32.exeDetected by Sophos as W32/Rbot-ASJNo
TvrScheduleUSchedule.exeScheduler for Mercury Ez View TV Tuner CardNo
ScheduleUSchedule.exeScheduler for Mercury Ez View TV Tuner CardNo
Center AgentUScheduled.exeScheduler for HyperMedia Center from Kworld - "an integrated multimedia application that allows you to enjoy all of your digital entertainment - TV, home videos and photos. HyperMedia Center is especially designed for turning your PC/Laptop into an entertainment solution"No
Scheduled MaintenanceNScheduled_Maintenance.exeScheduler for an older version of iolo's System Mechanic utility suite. It can clean your registry and delete temporary files at defined intervalsNo
SchedulerUScheduler daemon.exeTenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleaningsNo
Windows Scheduler!Xscheduler.exeAdded by a variant of the IRCBOT BACKDOOR! See hereNo
XemiComputers SchedulerUScheduler.exeSmooth Program Scheduler from XemiComputers "will start any program you want at a scheduled time"No
DSSchedulerUScheduler.exeScheduler for Dynamic Submission by Apex Pacific - "Web site Promotion and Internet Marketing Software that allows you to perform automated search engine submission, Web site submission, and search engine optimization (SEO)"No
Service SchedulerXscheduler.exeDetected by Sophos as W32/Agobot-PHNo
MRU-Blaster SchedulerUscheduler.exeScheduler for MRU-Blaster from Brightfort (formerly Javacool Software) - which "is a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"No
Staffcop SchedulerUscheduler.exeStaffCop surveillance software. Uninstall this software unless you put it there yourselfNo
Scheduling AgentXScheduler.exeDetected by Symantec as Backdoor.SubwooferNo
TVT Scheduler ProxyUscheduler_proxy.exeFound on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates), Rescue and Recovery (backup and system recovery), Message Center Plus and maybe others. It's exact function isn't known but if disabled, the "plan updates" button in the IBM System Update software will no longer be available, though the software will continue run properlyYes
scheduler_proxy ApplicationUscheduler_proxy.exeFound on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates), Rescue and Recovery (backup and system recovery), Message Center Plus and maybe others. It's exact function isn't known but if disabled, the "plan updates" button in the IBM System Update software will no longer be available, though the software will continue run properlyYes
AdwareKiller_schedulesXschedules.exeEAdwareKiller rogue spyware remover - not recommendedNo
Laplink PDASync 3.1 - ScheduleSyncUScheduleSync.exeLaplink PDASync for ScheduleSync - PDA synchronisation utilityNo
XTNDConnect PC - ScheduleSyncUSCHEDU~1.EXEScheduleSync specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications"No
GroupWise PDA Connect - ScheduleSyncUSCHEDU~1.EXEScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from NovellNo
JavaUpdateSchedsXschedzs.exeDetected by Malwarebytes as Backdoor.Xtrat. The file is located in %Windir%No
SCHelper.exeNSCHelper.exeSpyware Cease spyware remover. Previous versions were regarded as a rogue (see here) because it reported false or exaggerated system security threats but the latest version tested (6.5.1) has a new interface and produces no exaggerated threats on a clean system. Not recommended due to the past historyYes
NovastorSchedulerdUSCHENGD.EXENovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need itNo
Schllhost.exeXSchllhost.exeDetected by Dr.Web as Trojan.Siggen6.12706No
SchmailiUSchmaili.exeSchmaili - "insert funny smiley faces into your mails by a simple mouse click"No
snprotXschngrd.exeDetected by Malwarebytes as Adware.Korad. The file is located in %AppData%\SearchNNo
StaskXschost.exeDetected by Dr.Web as Trojan.AVKill.33413 and by Malwarebytes as Backdoor.IRCBotNo
Update InstallXSchost.exeDetected by Symantec as W32.HLLW.Gaobot.AONo
Generic Host ProcessXSCHOST.EXEDetected by Sophos as W32/Rbot-NC and by Malwarebytes as Trojan.AgentNo
TaskhostXschost.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.DCENo
Hosting ControlerXschost.exeDetected by Dr.Web as Trojan.DownLoader9.26830 and by Malwarebytes as Trojan.Downloader.ENo
DriverXschost.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %Windir%No
IntranetXschost.exeDetected by Kaspersky as Backdoor.Win32.Rbot.rsv and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
MicrosoftXschost.exeDetected by Kaspersky as Backdoor.Win32.Rbot.feh and by Malwarebytes as Trojan.Agent.MSGen. The file is located in %System%No
Windows Service HostXschost.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
PoliciesXschost.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\windowsNo
avgXschost.exeDetected by Malwarebytes as Trojan.Injector.SC. The file is located in %System%\windowsNo
Microsoft Manage ServicesXschost.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %System%No
Windows UpdateXschost.exeDetected by Malwarebytes as Trojan.Inject. The file is located in %AppData%No
erroXschost.exeDetected by Malwarebytes as Trojan.Injector.SC. The file is located in %System%\windowsNo
schostXschost.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\ChromaNo
schost.exeXschost.exeDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
schost.exeXschost.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %System%No
schost.exeXschost.exeDetected by Dr.Web as Trojan.DownLoader10.28297 and by Malwarebytes as Trojan.Tibia. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SVCOSTDXschostd.exeDetected by Dr.Web as Trojan.MulDrop2.29725 and by Malwarebytes as Trojan.AgentNo
goolgeschotxy.exeXschotxy.exeDetected by McAfee as FakeAV-M.bfr!cNo
schovlookXschovlook.exeDetected by McAfee as FakeAV-M.bfr!cNo
AVSchedScanYSCHSC9X.EXEScheduler for Command AntiVirus for 9x/Me by Command Software Systems, Inc (who became Authentium, then Commtouch and now Cyren)No
SchSvrUSchSvr.exeScheduler installed with the Home Theater Remote Control or WinDVD Remote Control for older versions of the WinDVD software DVD player from Intervideo (now Corel). Required if you want to schedule recordings from your TV tuner cardNo
Home Theater SchSvrUSchSvr.exeScheduler installed with the Home Theater Remote Control for older versions of the WinDVD software DVD player from Intervideo (now Corel). Required if you want to schedule recordings from your TV tuner cardNo
Intervideo WinSchedulerUSchSvr.exeScheduler installed with the WinDVD Remote Control for older versions of the WinDVD software DVD player from Intervideo (now Corel). Required if you want to schedule recordings from your TV tuner cardNo
WinDVR SchSvrUSchSvr.exeScheduler installed with the WinDVD Remote Control for older versions of the WinDVD software DVD player from Intervideo (now Corel). Required if you want to schedule recordings from your TV tuner cardNo
systemmgrUschtasks.exeDetected by Malwarebytes as PUP.Optional.SystemManager. Note - this entry loads from the Windows Startup folder and the file is located in %System%. If bundled with another installer or not installed by choice then remove itNo
GoPcProUschtasks.exeGopcpro System Optimizer cleans all your Registry clutter and issues present in your system, leaving it much faster in speed and dynamic in performance. Detected by Malwarebytes as PUP.Optional.GoPcPro. Note - this entry loads from the Windows Startup folder and the file is located in %System%. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
NertaXschtasks.exeDetected by Malwarebytes as Trojan.TechSupportScam. Note - this entry loads from the Windows Startup folder and the file is located in %System%. Removal instructions hereNo
schupXschup.exeSmileCheck adwareNo
schustsXschusts.exeDetected by McAfee as PWS-Banker and by Malwarebytes as Backdoor.Agent.ENo
schustssXschustss.exeDetected by Dr.Web as Trojan.DownLoader7.12789 and by Malwarebytes as Trojan.Banker.ENo
schvostXschvost.exeDetected by McAfee as RDN/Generic.bfr!d and by Malwarebytes as Trojan.VBKryptNo
Microsoft Update 64 BITXschvost.exeDetected by Trend Micro as WORM_RBOT.CAU and by Malwarebytes as Backdoor.BotNo
SCHWIZEXYSCHWIZEX.EXEPart of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-bootNo
CSScheduleCheckYSCHWIZEX.EXEPart of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-bootNo
SecureCleanIECleanNSCIEClean.exeSecureClean - scans your system for hidden temporary files, deleted email messages, Internet histories and cachesNo
someXscit.exeDetected by ThreatTrack Security as Trojan-Downloader.Zlob.Media-Codec (fs) and by Malwarebytes as Trojan.Zlob. This purports to be a Windows Media Player upgrade (with names such as "iCodecPack", "X Password Manager" and "Media-Codec") to allow the user to view adult oriented videos on certain websites - but actually downloads and installs additional malware on the user's machineNo
SybaseCentral43Uscjview.exeRelated to SQL Anywhere from Sybase. A comprehensive package providing data management and data exchange technologiesNo
sckXsck.exeDetected by Sophos as Troj/VBInjec-DVNo
ServicesXscks32.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%No
sclauncherNsclauncher.exeSimpleCenter digital media player/manager that supports the iPod, Sony PSP, Xbox 360, some of the Nokia N-series mobile phones and othersNo
sclickXsclick.exeDetected by ThreatTrack Security as Trojan.FakeAlert (fs). The file is located in %ProgramFiles%\WinMsg or %UserTemp%No
SCMUSCM.exeMSI System Control Manager graphical utility for some of their laptops which allows the user to change the brightness/volume levels, switch the display off, change the power saving mode, eject a CD/DVD, and enable/disable the Wi-Fi, Bluetooth and webcamNo
SOS SQL DatabaseNscm.exeSQL Server Service Control Manager - part of Microsoft SQL Server. Available via Start → ProgramsNo
SQL ServerNscm.exeSQL Server Service Control Manager - part of Microsoft SQL Server. Available via Start → ProgramsNo
Service Control ManagerXscm.exeDetected by Sophos as W32/Agobot-GDNo
Stardust Screen Saver Control 2003USCMain.exeScreen Saver Control 2003 from Stardust Software - "is a standalone version of our popular screen saver add-on. It allows you to control and configure all your screen savers directly from the system tray"Yes
ScManagerXscman.exeAdded by the FORBOT-CW WORM!No
SurfChoiceUSCMan.exeSCMan is a utility that can control services on WinNT from the command line. This utility can create, start, pause, stop, delete services. Furthermore it can retrieve a service's current state, get the displayname for a service and vice versaNo
ExplorerXscmd.exeDetected by McAfee as Generic Downloader.x!g2z and by Malwarebytes as Trojan.AgentNo
CHIPDRIVESmartcardManagerUSCMgr.exeChipDrive Smartcard softwareNo
Spore.bXScmhlpr.vbsDetected by Symantec as VBS.Sorpe.B@mmNo
Smart Connect MonitorUSCMon.exeAppears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote VaioNo
Windows ServicesXscmsg.exeDetected by Malwarebytes as Backdoor.Agent.Gen. The file is located in %System%No
Security PatchXscmss.exeDetected by Sophos as W32/Rbot-ZWNo
ScanPanel?ScnPanel.exeScanner related - for models from Trust, Medion and others. What does it do and is it required?No
ScopedllXscopedll.exeDetected by Sophos as Troj/Crypter-E and by Total Defense as Win32.GemaNo
MCX UpdteXscorti.exeAdded by the RBOT-ARP WORM!No
Mi7sft sdceXscorti.exeDetected by Total Defense as Win32.Rbot.ELC. The file is located in %System% - see hereNo
StartupCop ProUscp.exeStartup Cop Pro startup program manager from PC MagazineNo
dorkXTrojan.BankerDetected by Malwarebytes as Trojan.Banker. The file is located in %Root%No
scploXscplo.exeDetected by Dr.Web as Trojan.Siggen6.8312 and by Malwarebytes as Trojan.K.DownloaderNo
SC2Xscprot4.exeDetected by ThreatTrack Security as Trojan.Win32.Agent.app. The file is located in %ProgramFiles%\SecCenterNo
CoupSeekUscpsk.exeDetected by Malwarebytes as PUP.Optional.CoupSeek. The file is located in %AppData%\CoupSeek. If bundled with another installer or not installed by choice then remove itNo
WINTXscpsv[various].exeDetected by Symantec as Adware.PurityScan - also see the archived version of Andrew Clover's page. The file is located in %System% - known example filenames include scpsvit.exe and scpsvtr.exeNo
ExplorerXscr.lnkDetected by Malwarebytes as Trojan.Agent. The file is located in %MyMusic%No
ScrXscr.scrDetected by Trend Micro as WORM_OPASERV.TNo
W32.ScranXScran.exeDetected by Symantec as W32.NarcsNo
ScrapPadNScrappad.exeScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paperNo
Micro CRC ProtocolXscrc32.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
Screen CalendarUscrcal.exeScreen Calendar allows you to create custom desktop wallpapers with built in active calendar and schedulerNo
WMI Standard Event Consumer - ScriptingXscrcons32.exeAdded by the RBOT-GRD WORM!No
IDC PC AudioXscrcos.exeDetected by McAfee as RDN/Generic BackDoor and by Malwarebytes as Trojan.Agent.IPAGenNo
IDC PC AudioXscrcos.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Trojan.Agent. The file is located in %Windir%\addinsNo
IDC PC AudioXscrcos.exeDetected by Malwarebytes as Trojan.Agent.IPA. The file is located in %Windir%\WinSxSNo
WMI Standard Event Consumer - hostingXscrcs.exeDetected by Trend Micro as WORM_IRCBOT.ATP. The file is located in %System%\wbemNo
screanXscrean.exeDetected by McAfee as RDN/Generic.dx!c2q and by Malwarebytes as Backdoor.Agent.ENo
screen_deserveXscreen-participate.exeDetected by Malwarebytes as Backdoor.Agent.STL. The file is located in %AppData%\ScreenstuffNo
screen_deserveXscreen-switch.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\ScreenstuffNo
screenchipXscreen.exeDetected by Dr.Web as Trojan.DownLoader10.20941 and by Malwarebytes as Backdoor.Messa.ENo
Microsoft Synchronization ManagerXscreen.exeAdded by the SDBOT-ACO WORM!No
Screencast-O-Matic TrayNScreencast-O-Matic.exeSystem Tray access to the download version of the Screencast-O-Matic one-click screen capture recording utilityNo
cursorNScreendragon_VS_Taskbar.exeScreenDragon video playerNo
ScreenHunter 4.0 FreeNScreenHunter.exeScreenHunter by Wisdom Software Inc - "award-winning screen capture solution to capture your screen, print and edit." Free versionNo
Wisdom-soft ScreenHunter 5.1 FreeNScreenHunter.exeScreenHunter by Wisdom Software Inc - "award-winning screen capture solution to capture your screen, print and edit." Free versionNo
Wisdom-soft ScreenHunter 5.1 ProNScreenHunter.exeScreenHunter by Wisdom Software Inc - "award-winning screen capture solution to capture your screen, print and edit." Pro versionNo
ScreenPrint32NScreenPrint32.exeScreenPrint32 screen capture and print utility by Provtech LimitedNo
WINPROXscreensave.exeDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.AdClickerNo
Windows System Cleaner 2012XScreenSaver.comDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
Screen Saver Pro 3.1XScreenSaverPro.scrDetected by Trend Micro as WORM_DORKBOT.CAP and by Malwarebytes as Trojan.Agent.SCRNo
Screenshot CaptorNScreenshotCaptor.exeScreenshot Captor by DonationCoder.com - "is a best-in-class tool for grabbing, manipulating, annotating, and sharing screenshots"No
Screen shot UtilityNScreenshotUtility.exeScreenshot Utility by QSX Software Group - is a "small, easy-to-use screen capture program that sits in the Windows system tray. When you press a hotkey, it captures and saves a snapshot of your screen to a JPG, GIF or BMP file"No
screenSHUUscreenSHU.exeScreenSHU screen capture utility - required if you want to use the save to cloud featureNo
ScreenUpUScreenUp.exeDetected by Malwarebytes as PUP.Optional.ScreenUp. The file is located in %AppData%\ScreenUp. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
ScreenViewXScreenView.exeScreenView spywareNo
SecureClean4RegManagerNscregmanager4.exePart of version 4 of SecureClean by WhiteCanyon Software - which 'allows you to permanently erase temporary, cached, and "deleted" files on an ongoing basis'No
Microsoft RestoreXscrgrd.exeDetected by Trend Micro as WORM_SPYBOT.BRNo
scrhosh.exe1Xscrhosh.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %AppData%No
Microsoft Windows UpdateXscrhost.exeDetected by Sophos as W32/Rbot-AOW and by Malwarebytes as Trojan.MWF.GenNo
WindowSystemMonitorXscrhost.exeAdded by the TILEBOT-DV WORM!No
Auto File System Conversion UtilityXscricon.exeDetected by Trend Micro as WORM_SDBOT.EYB and by Malwarebytes as Backdoor.AgentNo
RAX SYSTEMXscrigz.exeDetected by Trend Micro as WORM_MYTOB.KRNo
Windows UpdateXscrigz.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %System%No
ALGXScript.exeDetected by McAfee as Generic BackDoor.bfr!mNo
mozilaXScript.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %Windir%\mozillaNo
mozillaXScript.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %Windir%\mozillaNo
Java CompilerXScript.exeDetected by Symantec as W32.BakainNo
PoliciesXScript.exeDetected by McAfee as Generic BackDoor.bfr!m and by Malwarebytes as Backdoor.Agent.PGenNo
PADRAO%015XScript.exeDetected by McAfee as Generic BackDoor.bfr!m and by Malwarebytes as Backdoor.AgentNo
ScriptSentryYScriptsentry.exeScript Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardless. No longer availableNo
VelocidadSimpleXscrmain.exeVelocidadSimple rogue optimization utility - not recommendedNo
CrnsavaXscrnsave.pifDetected by Sophos as W32/Sdbot-ZVNo
Screen SaverXscrnsaver.scrDetected by Sophos as W32/Rbot-AGPNo
CrnsavsundXscrnsund.pifDetected by Sophos as W32/Sdbot-AJQNo
Scroll-In-Mouse V2.0USCROLL.EXEToolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special featuresNo
MS Screen SaverXscrsave.scrDetected by Sophos as W32/Rbot-AGTNo
Microsoft ServicesXscrss.exeDetected by Dr.Web as Trojan.MulDrop3.3123 and by Malwarebytes as Trojan.InfoStealer.ENo
scrssXscrss.exeDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%No
scrssXscrss.exeDetected by Sophos as W32/Rbot-GAE. The file is located in %System%No
scrssXscrss.exeDetected by Dr.Web as Trojan.Click.31705. The file is located in %Temp%No
scrssXscrss.exeDetected by Kaspersky as Net-Worm.Win32.Kolab.hmo and by Malwarebytes as Trojan.InfoStealer.E. The file is located in %Windir%No
scrss.exeXscrss.exeDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent.PLGen. The file is located in %LocalAppData%No
regsrvcXscrss.exeDetected by McAfee as RDN/Generic.bfr!ev and by Malwarebytes as Trojan.Agent.RGENo
scrsvcXscrsvc.exeDetected by Sophos as Troj/Agent-DSNo
ScrSvrXScrSvr.exeDetected by Symantec as W32.Opaserv.WormNo
ScrSvrOldXScrSvr.exeDetected by Symantec as W32.Opaserv.WormNo
System CSRSS PatchXscrtkfg.exeAdded by the RBOT-ADA WORM!No
SystemOPsvXscrtvc32.exeAdded by a variant of the SPYBOT WORM!No
scNscrubxp.exe"ScrubXP cleans a computer from temporary files and registry keys resulting from opening files and or using the Internet. ScrubXP will run automatically when your computer starts." No longer supportedNo
GooglexXscrxs.exeDetected by Dr.Web as Trojan.Siggen5.32930 and by Malwarebytes as Backdoor.Agent.GGLGenNo
olabisiXscs.exeDetected by McAfee as RDN/Generic.bfr!ic and by Malwarebytes as Backdoor.Agent.DCGenNo
scsaXscsa.exeDetected by McAfee as Generic Downloader.x and by Malwarebytes as Worm.IMP.Trace. Note - this entry loads from the Windows Startup folder and the file is located in %AppData%\Win74630177No
scsaXscsa.exeDetected by Dr.Web as Trojan.Inject1.153 and by Malwarebytes as Worm.IMP.Trace. Note - this entry loads from the Windows Startup folder and the file is located in %AppData%\Win88E6680FNo
Smart Connect SetupUSCSetup.exeAppears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote VaioNo
scsmsXscsms.exeDetected by Dr.Web as Trojan.DownLoader5.54532 and by Malwarebytes as Trojan.Banker. Note - this entry loads from the Windows Startup folderNo
Windows SpaceXscsrs.exeDetected by McAfee as RDN/Generic Dropper!d and by Malwarebytes as Backdoor.AgentNo
scssrr.exeXscssrr.exeDetected by Kaspersky as Backdoor.Win32.Bifrose.doub and by Malwarebytes as Backdoor.Agent.E. The file is located in %Windir%No
WinlogonXscssrr.exeDetected by Sophos as Troj/Agent-LXB and by Malwarebytes as Trojan.Agent.TraceNo
SecondChanceUsctray.exePower Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crashNo
SecureClean4TrayNsctray4.exeSystem Tray access to version 4 of SecureClean by WhiteCanyon Software - which 'allows you to permanently erase temporary, cached, and "deleted" files on an ongoing basis'No
SCTUINotifyYSCTUINotify.exePart of Windows SteadyState, which is designed to make life easier for people who set up and maintain shared computers - enabling the system administrator to prevent users from making changes to the system configuration, windows desktop, restricting program access, etc. It's intended for shared user environments such as internet cafés, libraries and schools but can be used in any environment. This entry displays the timeout messages on the restricted computer/account - which warns users how long they have until automatic log-off when they log-in and when there are only 2 minutes leftYes
Windows SteadyState - Session Timer Notify (UI)YSCTUINotify.exePart of Windows SteadyState, which is designed to make life easier for people who set up and maintain shared computers - enabling the system administrator to prevent users from making changes to the system configuration, windows desktop, restricting program access, etc. It's intended for shared user environments such as internet cafés, libraries and schools but can be used in any environment. This entry displays the timeout messages on the restricted computer/account - which warns users how long they have until automatic log-off when they log-in and when there are only 2 minutes leftYes
LogoffYSCTUINotify.exePart of Windows SteadyState, which is designed to make life easier for people who set up and maintain shared computers - enabling the system administrator to prevent users from making changes to the system configuration, windows desktop, restricting program access, etc. It's intended for shared user environments such as internet cafés, libraries and schools but can be used in any environment. This entry displays the timeout messages on the restricted computer/account - which warns users how long they have until automatic log-off when they log-in and when there are only 2 minutes leftYes
OmniPassUscureapp.exeOmniPass from Softex Inc. - secure password management softwareNo
ttoolXscvc.exeDetected by Sophos as Troj/Bckdr-OWMNo
Nortons AV SYSTEMXscvchost.exeDetected by Trend Micro as WORM_RBOT.AMKNo
TasksManagarXscvchost.exeDetected by Dr.Web as Trojan.Siggen6.8104 and by Malwarebytes as Backdoor.Agent.TMNo
scvchostXscvchost.exeDetected by McAfee as Generic Dropper!fhs and by Malwarebytes as Backdoor.Agent.SVC. The file is located in %AppData%No
scvchostXscvchost.exeDetected by Malwarebytes as Backdoor.Agent.SVC. The file is located in %System%No
Windows FrameworkXscvh0st.exeMalware installed by different rogue security software including SpyKillerPro and the XP AntiVirus seriesNo
Configuration LoaderXscvh0st.exeDetected by Sophos as W32/Agobot-AX and by Malwarebytes as Backdoor.Bot. Note the digit "0" in the filenameNo
scvhchost232Xscvhchost432.exeDetected by Malwarebytes as Trojan.Agent.SVC. The file is located in %Recycled%\{SID}No
scvhchost992Xscvhchost932.exeDetected by Malwarebytes as Trojan.Agent.SVC. The file is located in %Recycled%\{SID}No
Key NameXscvhoc.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\applicationNo
SystemIn_1Xscvhoss.exeDetected by Dr.Web as Trojan.Filespy.8 and by Malwarebytes as Trojan.AgentNo
WinUptadeXScvhost.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %ProgramFiles%\FontsNo
Microsoft Update ManagerXscvhost.exeDetected by Trend Micro as WORM_AGOBOT.AXJ and by Malwarebytes as Backdoor.BotNo
Internet Explorer HelperXscvhost.exeDetected by Trend Micro as TSPY_BANKER.BYK and by Malwarebytes as Trojan.BankerNo
Samsung AppstoreXscvhost.exeDetected by Microsoft as TrojanDownloader:Win32/Lacam.A and by Malwarebytes as Trojan.Agent.GenNo
Samsung AppstoreXscvhost.exeDetected by Microsoft as TrojanDownloader:Win32/Ratosto.A and by Malwarebytes as Trojan.Agent.GenNo
msconfigXscvhost.exeDetected by Sophos as Troj/Agent-DSF and by Malwarebytes as Backdoor.BotNo
Update CheckerXscvhost.exeDetected by Sophos as Troj/Agent-DSF and by Malwarebytes as Backdoor.BotNo
Microsoft Windows UpdataXscvhost.exeDetected by Total Defense as Win32.Rbot.CEM and by Malwarebytes as Trojan.MWF.Gen. The file is located in %System%No
WINTASKXscvhost.exeDetected by Sophos as W32/Mytob-I and by Malwarebytes as Backdoor.BotNo
SvchostsXSCVHOST.EXEDetected by Sophos as W32/Agobot-RQ and by Malwarebytes as Backdoor.BotNo
RAS Connection ServerXscvhost.exeDetected by Kaspersky as Backdoor.Win32.SdBot.too and by Malwarebytes as Trojan.Agent.Gen. The file is located in %System%No
Microsoft UpdateXscvhost.exeDetected by Sophos as W32/Rbot-AEM and by Malwarebytes as Backdoor.BotNo
MsWinLibraryXscvhost.exeDetected by Sophos as Troj/Banker-CLI and by Malwarebytes as Backdoor.BotNo
(Default)Xscvhost.exeDetected by Malwarebytes as Trojan.Agent.Gen. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %System%No
WindowsHostProtocolXscvhost.exeDetected by McAfee as Generic.bfr!cm and by Malwarebytes as Backdoor.AgentNo
SystemWindowsXscvhost.exeDetected by Sophos as W32/SillyFDC-CG and by Malwarebytes as Backdoor.BotNo
Winsock DriverXscvhost.exeDetected by Kaspersky as Backdoor.Win32.Rbot.aeu and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
SvchostXscvhost.exeDetected by Dr.Web as Trojan.KeyLogger.20218 and by Malwarebytes as Backdoor.Bot.E. The file is located in %AppData%No
SVCHOSTXscvhost.exeDetected by Symantec as W32.Mytob.E@mm and by Malwarebytes as Backdoor.Bot.E. The file is located in %System%No
svchostXscvhost.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Bot.E. The file is located in %Temp%\vhostNo
svchostXscvhost.exeDetected by McAfee as Generic.dx!bhqv and by Malwarebytes as Backdoor.Bot.E. The file is located in %Temp%\vhostNo
svchostXscvhost.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %UserTemp%No
svchostXscvhost.exeDetected by Kaspersky as Worm.Win32.Windaus.x and by Malwarebytes as Backdoor.Bot.E. The file is located in %Windir%No
svchostXscvhost.exeDetected by Kaspersky as Trojan.Win32.Genome.epvq and by Malwarebytes as Backdoor.Bot.E. The file is located in %Windir%\SYSTEMNo
Windows FirewalllXscvhost.exeDetected by Sophos as W32/Rbot-EK and by Malwarebytes as Backdoor.BotNo
Config LoaderXscvhost.exeDetected by Symantec as W32.HLLW.Gaobot.AE or W32.HLLW.Gaobot.AONo
SunJavaUpdateSchedXscvhost.exeDetected by Sophos as W32/Sdbot-AVX and by Malwarebytes as Backdoor.BotNo
System HostXscvhost.exeAdded by a variant of Backdoor:Win32/Rbot. The file is located in %System%No
ScvhostXScvhost.exeDetected by Malwarebytes as Trojan.Agent. Both files are located in %AppData%\System32No
scvhostXscvhost.exeDetected by Malwarebytes as Backdoor.SpyRat. This file is located in %ProgramFiles%\sysconfigNo
scvhostUscvhost.exeWiretap surveillance software - the file is located in %ProgramFiles%\Wiretap Professional. Uninstall this software unless you put it there yourselfNo
scvhostXscvhost.exeDetected by Sophos as W32/Agobot-LI and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
scvhostXscvhost.exeDetected by Kaspersky as Trojan.Win32.Mepaow.nfa and by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
Security CenterXscvhost.exeDetected by Sophos as W32/Rbot-TG and by Malwarebytes as Trojan.Agent.GenNo
Windows SQL management 1.33Xscvhost.exeDetected by Sophos as W32/Spybot-OB and by Malwarebytes as Backdoor.BotNo
Generic Host ProcessXscvhost.exeDetected by Kaspersky as Backdoor.Win32.Ciadoor.13.hx and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
scvhost.exeXscvhost.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %AllUsersProfile%No
scvhost.exeXscvhost.exeDetected by Sophos as Troj/Lohav-N and by Malwarebytes as Trojan.Agent.Gen. The file is located in %System%No
Scvhost.exeXScvhost.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %System%\ScvhostNo
startkeyXscvhost.exeDetected by Sophos as Troj/Bifrose-PM and by Malwarebytes as Backdoor.BotNo
AntiVirXscvhost.exeDetected by Sophos as Troj/Agent-DSF and by Malwarebytes as Backdoor.BotNo
only23XSCVHOST.exeDetected by Sophos as Troj/Bckdr-PUQ and by Malwarebytes as Backdoor.BotNo
RsTrayXscvhost.exeDetected by Dr.Web as Trojan.AVKill.29286 and by Malwarebytes as Trojan.Agent.GenNo
regsrvXscvhost.exeDetected by Trend Micro as BKDR_AGOBOT.ENo
Yahoo MessenggerXSCVHOST.exeDetected by Sophos as W32/Sohana-V and by Malwarebytes as Backdoor.BotNo
loadXScvhost.exeDetected by Sophos as W32/Autorun-AJNo
Windows UDP Control CenterXscvhost.exeDetected by Microsoft as Worm:Win32/Pushbot.EH and by Malwarebytes as Backdoor.BotNo
MSStartOptimizerXSCVHOST.EXEDetected by Sophos as Troj/Dasmin-FamNo
SDKXscvhost.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %Root%\folderNo
HKLMXScvhost.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.HMCPol.GenNo
Macromedia Flash UpdateXscvhost.exeAdded by a variant of Backdoor:Win32/Rbot. The file is located in %System%No
MSNXscvhost.exeDetected by Sophos as W32/IRCBot-ZW and by Malwarebytes as Backdoor.BotNo
Configuration LoaderXscvhost.exeDetected by Sophos as W32/Agobot-AAE and by Malwarebytes as Backdoor.BotNo
microsoft scvhost for windowsXscvhost.exeDetected by Sophos as W32/Randex-S and by Malwarebytes as Backdoor.BotNo
Windows Service HostXscvhost.exeDetected by Symantec as Backdoor.Sdbot.N and by Malwarebytes as Trojan.AgentNo
PoliciesXscvhost.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\FontsNo
PoliciesXScvhost.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\directory\Fonts\installNo
PoliciesXScvhost.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.Agent.PGenNo
Personal ComputerXscvhost.exeDetected by Sophos as W32/Rbot-AJE and by Malwarebytes as Backdoor.BotNo
Microsoft Update MachineXscvhost.exeDetected by Sophos as W32/Rbot-GS and by Malwarebytes as Backdoor.BotNo
icq liteXscvhost.exeDetected by Sophos as Troj/Agent-DSF and by Malwarebytes as Backdoor.BotNo
svchost.exeXscvhost.exeDetected by McAfee as Generic.dx!bh3g and by Malwarebytes as Backdoor.Bot.ENo
Microsoft Task ManagerXscvhost.exeDetected by Sophos as W32/Mytob-IT and by Malwarebytes as Backdoor.BotNo
Microsoft TCP ServiceXscvhost.exeDetected by Sophos as W32/Agobot-L and by Malwarebytes as Backdoor.BotNo
Winmgr.exeXscvhost.exeDetected by Trend Micro as WORM_AGOBOT.AFGNo
HKCUXscvhost.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\FontsNo
HKCUXScvhost.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.HMCPol.GenNo
NTSF MICROSOFT SYSTEMXscvhost.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%No
Windows UpdateXscvhost.exeDetected by Sophos as W32/Sdbot-XT and by Malwarebytes as Trojan.Agent.GenNo
Generic Host Process2 System BackupXscvhost2.exeDetected by Sophos as W32/Rbot-BAHNo
Microsoft SCVHOST32 ProtocolXscvhost32.exeDetected by Trend Micro as WORM_RBOT.ADPNo
SVCHost Protocol32Xscvhost32.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %System%No
Microsoft LSASS386 ProtocolXscvhost32.exeAdded by a variant of the SPYBOT WORM!No
Generic Host Process326a System BackupXscvhost326a.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
SSCDASXscvhostas.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.ENo
PoliciesXscvhostas.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.PGenNo
Windows ServicesXscvhoste.exeDetected by Symantec as W32.Spybot.OBZ and by Malwarebytes as Backdoor.Agent.GenNo
StarterXscvhosting.exeAdded by the SDBOT.RU WORM!No
starterXscvhostingg.exeDetected by Sophos as W32/Forbot-FBNo
Windows UpdateXscvhostr.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\StandartNo
Internet Explorer HelperXscvhosts.exeAdded by a variant of TSPY_BANKER.BYK and detected by Malwarebytes as Trojan.BankerNo
MsconfigXscvhosts.exeDetected by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %Windir%No
Update CheckerXscvhosts.exeDetected by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %Windir%No
sharMsnXscvhosts.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %AppData%No
spoolsvXscvhosts.exeDetected by Sophos as Troj/Small-AW and by Malwarebytes as Backdoor.BotNo
AntiVirXscvhosts.exeDetected by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %Windir%No
Yahoo MessenggerXscvhosts.exeDetected by Sophos as W32/Sohana-AH and by Malwarebytes as Backdoor.BotNo
Windows Host ServiceXscvhosts.exeAdded by the SPYBOT.NLI WORM!No
Windows Print SpoolerXSCVHOSTS.EXEAdded by a variant of WORM_SPYBOT.H. The file is located in %System%No
ICQ LiteXscvhosts.exeDetected by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %Windir%No
microssoftsXscvhosts.exeDetected by Sophos as Troj/Inject-GG and by Malwarebytes as Worm.Agent.P2PNo
LAN/WAN interfaceXscvhosts.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %CommonAppData%\Microsoft\Windows\Start Menu\Network (10/8/7/Vista) or %AllUsersProfile%\Start Menu\Network (XP)No
LAN/WAN interfaceXscvhosts.exeDetected by Dr.Web as Trojan.DownLoader8.46247 and by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %CommonFavorites%\NetworkNo
Windows UpdateXscvhosts.exeDetected by Malwarebytes as Trojan.Agent.SVCGen. The file is located in %Windir%No
Yahoo MessenggerXSCVHSOT.exeDetected by Sophos as W32/Hakag-A and by Malwarebytes as Backdoor.BotNo
QQKAVXscvhsot.exeDetected by Sophos as W32/QQRob-ABXNo
Microsoft Office StudioXscvhvst.exeDetected by Symantec as W32.Randex.CSTNo
Microsoft Update ManagerXscvideo.exeDetected by Sophos as W32/Sdbot-CVP and by Malwarebytes as Backdoor.BotNo
ccwx6n564d546vsdfdnnsxw6v5456scqscbnXscvit.exeDetected by Malwarebytes as Trojan.Agent.SCVI. The file is located in %AppData%\ccwx6n564d546vsdfdnnsxw6v5456scqscbn - see hereNo
WindowshostsXScvnostasc.exeDetected by Dr.Web as Trojan.DownLoader10.3730 and by Malwarebytes as Backdoor.Agent.ENo
WindowssllhostXScvnostasc.exeDetected by Dr.Web as Trojan.DownLoader10.3730 and by Malwarebytes as Backdoor.Agent.ENo
svchostXscvookMain.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %AppData%\MicrosoftNo
scvost.batXscvost.batDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
SYS1Xscvost.comDetected by Sophos as W32/AutoIt-JY and by Malwarebytes as Worm.AutoRunNo
scvost_serverXscvost.exeDetected by Dr.Web as Trojan.MulDrop5.6971 and by Malwarebytes as Backdoor.Agent.SCVNo
Yahoo MessenggerXscvshosts.exeDetected by Sophos as W32/Trax-A and by Malwarebytes as Backdoor.BotNo
SCVSHTOXSCVSHTO.exeDetected by Trend Micro as TROJ_VB.FPW and by Malwarebytes as Email.Worm.NTONo
Scvsrv32Xscvsrv32.exeDetected by Sophos as W32/Agobot-PMNo
VprocessXscvtw32.exeDetected by Sophos as W32/Agobot-FRNo
Microsoft Windows UpdateXscvvhost.exeDetected by Sophos as W32/Forbot-DH and by Malwarebytes as Trojan.MWF.GenNo
Winsock2 wqr1sXSCVVHOST.EXEDetected by Sophos as W32/Rbot-FSNNo
Yahoo MessenggerXSCVVHSOT.exeDetected by Sophos as W32/SillyFDC-AE and by Malwarebytes as Backdoor.BotNo
ScxaxsXScxaxs.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
Adobe Acrobat Speed LauncherNSC_Acrobat.exeSpeeds up the time it takes to load older versions of the Adobe Acrobat PDF creation/editing utility. Loads "acrobat_sl.exe" which quickly opens and closes all of the files that Acrobat will use when the application starts - allowing virus protection software to check these programs and add them to the list of safe files. Not required for Acrobat to function properlyYes
MonitorUSD Monitor.exe"Transfer data quickly between your memory card and your computer with SanDisk's Readers, Writers and Adapters"No
sdmmrnmXsd###.exeDetected by Malwarebytes as Trojan.Downloader.E - where # represents a digit. The file is located in %WinTemp% - see examples here and hereNo
SystemDoctor 2006 FreeXsd2006.exeSystemDoctor rogue security software - not recommended, removal instructions hereNo
Sd32infoXsd32info.exeDetected by Trend Micro as TROJ_CRYPTER.ANo
ApplicationXsdadp.exeDetected by Malwarebytes as Backdoor.Agent.BDB. The file is located in %AppData%No
SDaemonUsdaemon.exePC Security™ from Tropical Software - "is the ultimate in computer security, offering multiple locking systems for the windows environment and internet. Lock files, monitor programs activities, even detect intruders!"No
Key NameXsdasdasd.exeDetected by Malwarebytes as Trojan.Agent.KNGen. The file is located in %UserTemp%\adadsNo
useriniXSdat.exeDetected by Malwarebytes as Ransom.Winlock. The file is located in %AppData% - see hereNo
ShellXSdat.exeDetected by Malwarebytes as Trojan.Agent.RNS. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "Sdat.exe" (which is located in %AppData%, see here)No
vccacAXsdaxzl.exeDetected by Sophos as W32/Sdbot-RPNo
SpyDefenseYsdc.exeSpyDefense spyware remover by Everest Labs - no longer availableNo
startXsdcc.exeAdded by the AGENT.CSX TROJAN!No
sdchangeXsdchange.exeDetected by Malwarebytes as Trojan.Agent. Note - this entry loads from HKCU\Run and the file is located in %AppData%\Microsoft\Windows\dllcacheNo
sdchangeXsdchange.exeDetected by Malwarebytes as Trojan.Agent.SDC. Note - this entry loads from the Windows Startup folder and the file is located in %AppData%\Microsoft\Windows\dllcacheNo
Direct settingsXsdchost.exeAdded by the Daemoni.I TROJAN! The file is located in %System%No
Spybot-SD CleaningYSDCleaner.exeGenerated by Spybot - Search & Destroy 2 from Safer-Networking Ltd if it encounters files that cannot be deleted during runtime because they are locked by other processesNo
SDClientMonitorUsdclientmonitor.exeLANDesk® Management Suite software componentNo
Stardock CentralNsdctray.exeStardock Central from Stardock Corporation - "is an enhanced download manager that enables users to install and manage Stardock's software products." Now replaced by the Impulse digital distribution platformNo
Call Function System32Xsddriver.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
SDetect.exeNSDetect.exeScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" buttonNo
Scanner DetectorNSDetect.exeScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" buttonNo
SDF StartXSDF.exeDetected by Malwarebytes as Trojan.Keylogger. The file is located in %CommonAppData%\DLVAURNo
serverXsdfdsfsdf.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %Windir%\SpynetNo
ShellXsdfgdfsgdfgfd.exe,explorer.exeDetected by Malwarebytes as Trojan.Agent. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "sdfgdfsgdfgfd.exe" (which is located in %AppData%\dfgdfsgdfg)No
strkjhkXsdflkj3.exeAdded by an unidentified WORM or TROJAN - see hereNo
Start Network Scanner ToolUsdFTP.exePart of Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents"No
WinAmpAgentXsdhch.exeDetected by Total Defense as Win32.Tactslay.B. The file is located in %Windir%No
MsnExplorerXsdhch.exeDetected by Total Defense as Win32.Tactslay.B. The file is located in %Windir%No
SchedulerXsdhch.exeDetected by Total Defense as Win32.Tactslay.B. The file is located in %Windir%No
SvcH0stXsdhch.exeDetected by Total Defense as Win32.Tactslay.B. The file is located in %Windir%No
Server Daemon Host ManagerXsdhost.exeDetected by Sophos as W32/Rbot-GWCNo
SDIN AdapterXsdin.exeDetected by Sophos as W32/Forbot-APNo
sdjgfgsXsdjgfgs.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %Temp%No
Sdk**.exe [* = random char]XSdk**.exe [* = random char]CoolWebSearch/HomeSearch adware - for examples, see this logNo
Sdk**32.exe [* = random char]XSdk**32.exe [* = random char]CoolWebSearch/HomeSearch adware - for examples, see this logNo
sdkupdate22XSDK0mCORE.exeDetected by Sophos as W32/Forbot-DTNo
SDKcore Update Components2XSDKC0R3.exeDetected by Sophos as W32/Rbot-ABA. Note that the file is located in %System%, is read-only and hiddenNo
SDKCprordsXSDKc55rezzz.exeAdded by the RBOT.VD WORM!No
SDKz0rXSDKc55rezzz2.exeDetected by Sophos as W32/Sdbot-UNNo
SDK Core ComponentXsdkcore.exeDetected by Sophos as W32/Sdbot-WCNo
SDK Codre Function22Xsdkimddprovment2.exeDetected by Sophos as W32/Sdbot-YJNo
SDK Core FunctionXsdkimprovment.exeDetected by Trend Micro as WORM_RBOT.BHLNo
SDK Core Function2Xsdkimprovment2.exeAdded by the SPYBOT.OGX WORM!No
Mascro soft SDK updates2XSDKrepair2.exeDetected by Trend Micro as WORM_SDBOT.BXMNo
Microsoft sdk tempXsdktemp.exeAdded by the RBOT-ANP WORM!No
sdllxxxxxx.exeXsdllxxxxxx.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%\sdllxxxxxx.exeNo
MonitorSDUSDMonitor.exeSpyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see hereNo
SDOXsdo.exeDetected by Malwarebytes as Trojan.Agent.WW. The file is located in %ProgramFiles%\Windows NTNo
sdocXsdoc.exeDetected by McAfee as RDN/Generic Dropper!rg and by Malwarebytes as Backdoor.Agent.DCENo
Files DriverXsdphost.exeDetected by Sophos as W32/Sdbot-DKZ and by Malwarebytes as Backdoor.BotNo
SDPhotoBar.exeNSDPhotoBar.exeSmartDraw Photo - "organize, enhance, print, and share your photos. It's also a powerful graphic editor for creating images and web graphics." Superseded by FotoFinsh but no longer availableNo
StartSecurDocUSDPin.exeSecurDoc from WinMagic Inc - "Provides full disk encryption to protect sensitive information stored on laptops, desktops and PDAs"No
wqdfadadsXsdqdad.exeDetected by Trend Micro as TROJ_MULDROP.FNo
genserv pathXsdqdqg.exeDetected by Sophos as W32/Sdbot-RFNo
userinitXsdra64.exeDetected by Malwarebytes as Spyware.Zbot. The file is located in %AppData%No
sdrssXsdrss.exeDetected by Sophos as W32/Sdbot-SQNo
sadsXsdsa.exeDetected by Sophos as W32/Rbot-PANo
XtremeXsdsada.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%\Game\asdasdasdNo
sdsada.exeXsdsada.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%\Game\asdasdasdNo
sdsdXsdsd.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %System%\sdsd - see hereNo
sdsdsXsdsd.exeDetected by McAfee as RDN/Generic.bfr!fc and by Malwarebytes as Backdoor.Agent.ENo
sdsdXsdsdsd.exeDetected by Dr.Web as Trojan.DownLoader10.25683 and by Malwarebytes as Trojan.Agent.ENo
SSOmonXsdserver.exeDetected by Malwarebytes as Trojan.Vasdek. The file is located in %Temp%No
cvmsyslpdXsdservss.exeDetected by Sophos as Troj/Mailbot-BYNo
FlashPath MonitorNSDSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run! Tells you the battery status in the floppy disk adapter for smartmedia cardsNo
FlashPath StatusNSDSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run! Tells you the battery status in the floppy disk adapter for smartmedia cardsNo
Windows UpdaterXsdsys.exeDetected by Sophos as W32/Forbot-JGNo
Windows Updater 32Xsdsys.exeDetected by Trend Micro as WORM_WOOTBOT.JGNo
SystemTraySDUSDSystemTray.exeSpyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see hereNo
soundmenaXsdtartup.exeDetected by Kaspersky as Trojan-Spy.Win32.VB.asn and by Malwarebytes as Trojan.Agent.SD. The file is located in %Windir%No
TFS DesktopTrayUSDTray.exeSystem Tray access to the older TFS Desktop (which became BoKS Desktop and is now FoxT DesktopControl) from TFS Technology, Inc. (now Fox Technologies). Access management software which "allows for you to take control of local accounts on your Windows Desktop systems"No
Spybot - Search & DestroyYSDTray.exeSystem Tray access to, and notifications for Spybot - Search & Destroy 2 from Safer-Networking Ltd. The file is located in %ProgramFiles%\Spybot - Search & Destroy 2Yes
SDTrayUsdtray.exeSystem Tray access to RSA Keon Standalone Desktop (was Web PassPort) from RSA Security - which "makes it easy for our data center staff members to protect confidential customer financial data files with proven RSA Security encryption while locking down each of their individual PC desktops." The file is located in either %ProgramFiles%\RSA Security\RSA Keon Desktop\System or %ProgramFiles%\RSA Security\Web PassPort\Plug-In\systemNo
SDTrayYSDTray.exeSystem Tray access to, and notifications for Spybot - Search & Destroy 2 from Safer-Networking Ltd. The file is located in %ProgramFiles%\Spybot - Search & Destroy 2Yes
SDTrayYSDTrayApp.exeSystem Tray access to an older version of Spyware Doctor antispyware from PC Tools by Symantec (now discontinued)No
explorerXsdvEt.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %UserProfile%\explorerNo
MSN HomeXsdwd.exeDetected by Trend Micro as TROJ_SDBOT.NRNo
PC Dynamics SdwMon32Usdwmon32.exeSafeHouse "Personal Privacy" protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encryptedNo
SafeHouseSystemTrayUSDWTRAY.EXESafeHouse "Personal Privacy" system tray icon - PP protects and hides your private and personal photos, videos, files and folders by making them "invisible" and encryptedNo
PSAXLSLXsdxl.exeDetected by McAfee as RDN/Generic.dx!w and by Malwarebytes as Trojan.Agent.TBUNo
sdxsys32Xsdxsys32.exeDetected by Sophos as Troj/Brogger-ANo
SE-TrayMenuUSE-TrayMenu.exeSE-TrayMenu by SE-SOFT.COM - "Use SE-TrayMenu to gain quick access to most frequently used applications and system commands via a customizable popup menu"Yes
spXse.dll,DllInstallSTARTPAGE.M hijackerNo
Search-ExeXSE.exeSearch-Exe hijackerNo
updatesstXSE2010.exeSecurity Essentials 2011 rogue security software - not recommended, removal instructions hereNo
Security essentials 2010XSE2010.exeSecurity Essentials 2010 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecurityEssentials2010No
Se4nHWIDGenXSE4NHWIDGEN.exeDetected by Dr.Web as Trojan.DownLoader8.18651 and by Malwarebytes as Backdoor.Agent.SWDNo
st5h5ss5e4XTrojan.Agent.WNLDetected by Malwarebytes as Trojan.Agent.WNL. The file is located in %AppData%No
s5retys5er5XTrojan.Agent.WNLDetected by Malwarebytes as Trojan.Agent.WNL. The file is located in %Windir%No
Seagate 2GHK2Q3E Product RegistrationNSeagate 2GHK2Q3E Product Registration.exeLeaderTech's PowerREGISTER registration reminder for Seagate storage productsNo
Seagate Product RegistrationNSeagate Product Registration.exeLeaderTech's PowerREGISTER registration reminder for Seagate storage productsNo
SeahawksScreenServerUSeahawksScreenServer.exeScreensaver for the Seattle Seahawks NFL football team - part of Sports Illustrated's MySI desktop download (by MercurySports Network) for streaming information on NFL football teams. No longer supportedNo
SeahawksScreenServerSvcUSeahawksScreenServer.exeScreensaver for the Seattle Seahawks NFL football team - part of Sports Illustrated's MySI desktop download (by MercurySports Network) for streaming information on NFL football teams. No longer supportedNo
sealmonUsealmon.exeSealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and EmailNo
SeaMonkey Quick LaunchNSeaMonkey.exeQuick launch for SeaMonkey from Mozilla - 'The all-in-one application formerly known as the "Mozilla Application Suite", containing a web browser, a mail and newsgroups client, an HTML editor, web development tools, and an IRC chat client"No
Mozilla Quick LaunchNSEAMON~1.EXEQuick launch for SeaMonkey from Mozilla - 'The all-in-one application formerly known as the "Mozilla Application Suite", containing a web browser, a mail and newsgroups client, an HTML editor, web development tools, and an IRC chat client"No
SearchAndDestroyMFCXSearch And Destroy.exeSearch And Destroy rogue security software - not recommended, removal instructions hereNo
Windows SecurityXSearch Files.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp%No
search.cmdXsearch.cmdDetected by Sophos as Troj/DwnLdr-KLV and by Malwarebytes as Trojan.Tophos. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
search.cmd_.exeXsearch.cmd_.exeDetected by Malwarebytes as Trojan.Cossta. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
WhenUSearchXSearch.exeWhenUSearch adwareNo
MoveSearchXSearch.exeDetected by Symantec as Adware.PigSearch and by Malwarebytes as Adware.PigSearch. The file is located in %ProgramFiles%\wsearchNo
SearchAndDestroySchedulerXSearchAndDestroy.exeSearch And Destroy rogue security software - not recommended, removal instructions hereNo
SearchAndDestroyTXSearchAndDestroy.exeSearch And Destroy rogue security software - not recommended, removal instructions hereNo
searcharmorUsearcharmor.exeDetected by Malwarebytes as PUP.Optional.PayByAds. The file is located in %AppData%\searcharmor\searcharmor\[version] - see an example here. If bundled with another installer or not installed by choice then remove itNo
mswsplXsearchbarcash.exeSearchBarCash adwareNo
SearchKFXsearchboaster.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%\Microsoft\Windows\MicrosoftsearchNo
Search DefenderUSearchDefender.exeIncluded with an older version of SpeedItup. Warns you when programs attempt to change Internet Explorer's default search providerNo
SearchEngineProtection?SearchEngineProtection.exeInstalled with an older version of the Oberon Gamesbar from Oberon Media which is provided to "help fans of casual games have a quick and easy access to all the new games available to play. Part of Internet Explorer, the Gamesbar will keep your games at your fingertips." Powered by Google this probably protected the default search engine usedNo
SearchEye SE.exeXSearchEye SE.exeSearchEye adwareNo
winsXSearchFilterHot.exeDetected by McAfee as Generic.dx!b2cl and by Malwarebytes as Trojan.RATNo
FBSearchXSearchGuardPlus.exeFast Browser Search/Search Guard Plus parasite - installed with "Make the Web Better" applications such as My Web Tattoo, My Face LOL and Google Easy Money Kit. See here and here for more informationNo
Search HelperXSearchHelper.exeDetected by Dr.Web as Trojan.DownLoader23.51876No
Microsoft ConfigXsearchindex.exeDetected by Malwarebytes as Trojan.Dropper. The file is located in %UserTemp%No
SearchIndexXSearchIndex.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Temp%No
searchindex.exeXsearchindex.exeDetected by Kaspersky as Trojan-Dropper.Win32.Dapato.mhl. The file is located in %AppData%No
WANTIVIRSERVICEXSearchIndexer.exeDetected by McAfee as Ransom and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate Windows Search (SearchIndexer.exe) service which runs a service and is located in %System%. This one is located in %AppData%\MicrosoftNo
SearchIndexerXSearchIndexer.exeDetected by Malwarebytes as Backdoor.Agent.DCEGen. The file is located in %MyDocuments%\MSDCSCNo
haldriverXSearchIndexerDB.exeDetected by Dr.Web as Trojan.DownLoad3.28337 and by Malwarebytes as Trojan.Agent.HLNGenNo
Search KeeperUSearchKeeper.exeDetected by Malwarebytes as PUP.Optional.MySoftToday.ShrtCln. The file is located in %Windir%. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
SearchkeyStartUpXsearchkey.exeDetected by Malwarebytes as Adware.SearchKey. The file is located in %ProgramFiles%\searchkey - see hereNo
searchlikeXsearchlike.exeDetected by Malwarebytes as Adware.Korad. The file is located in %LocalAppData%\searchlikeNo
SearchLiteXSearchLite.exeDetected by McAfee as Generic.bfrNo
Windows DefenderXSearchlndexer.exeDetected by McAfee as Generic.grp!ha. Note the "l" in the filename - which is located in %Root%\SYSTEM32No
PoliciesXSearchlndexer.exeDetected by McAfee as Generic.grp!ha and by Malwarebytes as Backdoor.Agent.PGen. Note the "l" in the filename - which is located in %Root%\SYSTEM32No
SearchlndexerXSearchlndexer.exeDetected by Malwarebytes as Backdoor.CyberGate. Note the "l" in the filename - which is located in %Root%\directory\CyberGate\SYSTEM32No
SearchlndexerXSearchlndexer.exeDetected by McAfee as Generic VB.i and by Malwarebytes as Backdoor.CyberGate. Note the "l" in the filename - which is located in %Root%\SYSTEM32No
SearchMoreKnowDesktopSearchUSearchMoreKnowDesktopSearch.exe"Search More Now is a set of free tools tailor designed to enhance your browsing experience. From casual browsing to all of your shopping needs, our tools help you find the best information, deals, and options that exist anywhere on the internet!" Detected by Malwarebytes as PUP.Optional.Yontoo. Note - this entry loads from the Windows Startup folder and the file is located in %CommonAppData%\SearchMoreKnow. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
searchnavXsearchnav.exeSearchNav adware - IEFeatures/Popnav variantNo
SearchNavVersionXsearchnavversion.exeSearchNav adware - IEFeatures/Popnav variantNo
SSLXSearchNDestrou.exeDetected by Sophos as W32/Sdbot-WGNo
search OnXsearchon.exeDetected by McAfee as Generic.bfr!ep and by Malwarebytes as Adware.SearchOnNo
SearchPotXSearchPot.exeDetected by Malwarebytes as Adware.SearchPot. The file is located in %ProgramFiles%\SearchPotNo
YSearchProtectionUSearchProtection.exe"Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!" The file is located in %ProgramFiles%\Yahoo!\Search ProtectionNo
Search ProtectionUSearchProtection.exe"Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!" The file is located in %ProgramFiles%\Yahoo!\Search ProtectionNo
SearchProtectionUSearchProtection.EXEDetected by Malwarebytes as PUP.Optional.SearchProtection. The file is located in %AppData%\Search Protection or %CommonAppData%\Search Protection If bundled with another installer or not installed by choice then remove itNo
SearchProtectionUSearchProtection.exe"Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!" The file is located in %ProgramFiles%\Yahoo!\Search ProtectionNo
InstallX Search Protect for YahooUsearchprotector.exeInstallX Search Protect for Yahoo browser enhancement. Detected by Malwarebytes as PUP.Optional.InstallX. The file is located in %AppData%\InstallX Search Protect for Yahoo. If bundled with another installer or not installed by choice then remove itNo
SearchSetterXsearchsetter[1].exeBrowser hijacker - redirecting to FindWhateverNow.com. The file is located in %System%No
SearchSettingsUSearchSettings.exeDetected by Malwarebytes as PUP.Optional.Spigot. The file is located in %CommonFiles%\Spigot\Search Settings. If bundled with another installer or not installed by choice then remove itNo
SearchSpyXSearchSpyMenu.exeSearchSpy rogue spyware remover - not recommended, removal instructions hereNo
SearchSquire[number]XSearchSquire[number].exeSearchSquire adwareNo
searchtolbaXsearchtolba.exeDetected by McAfee as Generic.dx!bh3c and by Malwarebytes as Backdoor.AgentNo
searchtolba.exeXsearchtolba.exeDetected by McAfee as Generic.dx!bh3c and by Malwarebytes as Backdoor.AgentNo
SearchUpgraderXSearchUpgrader.exeDetected by Trend Micro as SPYW_KEENVAL.MNo
vqqlxplxkloopbkhgfpvlwvjĂdXSearchWin.exeDetected by Dr.Web as Trojan.DownLoader7.27975 and by Malwarebytes as Trojan.Banker.SWGenNo
XEQCUUIRBTBMXLWGBMENPYCQFXSearchWin.exeDetected by McAfee as PWS-Banker and by Malwarebytes as Trojan.Banker.SWGenNo
vagrdqegymkroaaofugmxemqagXSearchWin.exeDetected by Dr.Web as Trojan.DownLoader7.12457 and by Malwarebytes as Trojan.Banker.SWGenNo
NCFHKGQVRCPYSMTXKTCDIUTEUÞXSearchWin.exeDetected by Malwarebytes as Trojan.Banker.SWGen. The file is located in %Temp%No
INWVIPGRHHAPVAHRVACEIYMAOQXSearchWin.exeDetected by Malwarebytes as Trojan.Banker.SWGen. The file is located in %Temp%No
KYSPXETYVHNCFPQGBAUVASFEWFXSearchWin.exeDetected by McAfee as Generic Downloader.x and by Malwarebytes as Trojan.Banker.SWGenNo
StartNow Search ProtectUsearch_protect.exeStartNow toolbar by Conduit Ltd. Detected by Malwarebytes as PUP.Optional.StartNow. The file is located in %ProgramFiles%\StartNow Toolbar. If bundled with another installer or not installed by choice then remove itNo
PoliciesXSearcIndexer.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\FontsNo
HKCUXSearcIndexer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\FontsNo
[foreign characters] Microsoft Windows SearchXSearhcIndexer.exeDetected by Malwarebytes as Spyware.Imminent. The file is located in %AppData%\MicrosoftWindowsSearchNo
O7E4KBFZJOXSEBuPMd.exe.lnkDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.Agent.DCENo
ShellXSEBuQMe.exe,explorer.exeDetected by McAfee as RDN/Generic.bfr!fc. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "SEBuQMe.exe" (which is located in %AppData%\E6e9nrI8)No
SecureExpertCleanerXsec.exeSecure Expert Cleaner rogue privacy program - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecureExpertCleanerNo
Windows applicatonXsec.exeDetected by McAfee as RDN/Generic.dx!d2h and by Malwarebytes as Trojan.AgentNo
runXsec5dec.exeDetected by Symantec as W32.Atak.G@mmNo
Second CopyUSecCopy.exeSecond Copy® by Centered Systems - "is the perfect automatic backup software designed for Windows XP and above. It makes a backup of your data files to another directory, internal or external hard disk or to a computer across the network"No
Second Copy 2000USecCopy.exeSecond Copy® by Centered Systems - "is the perfect automatic backup software designed for Windows XP and above. It makes a backup of your data files to another directory, internal or external hard disk or to a computer across the network"No
*Security CenterXsecctr.exeDetected by Trend Micro as WORM_SDBOT.BRONo
secdrive.exeXsecdrive.exeAdded by a variant of the SPYBOT WORM! See hereNo
(Default)Xsechost.exeDetected by Malwarebytes as Trojan.Banker. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %LocalAppData%No
mse_secAppXsechttp.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %AppData%\SechttpsNo
loadXSecret.batDetected by Dr.Web as Trojan.MulDrop4.9061 and by Malwarebytes as Trojan.Ransom. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "Secret.bat" (which is located in %Temp%)No
secirXsecret.exeDetected by Dr.Web as Trojan.DownLoader10.8716 and by Malwarebytes as Trojan.Downloader.XNNo
SecretXSecret.exeDetected by Sophos as Troj/Delf-LWNo
SECRETMAKERUsecretmaker.exeSecretmaker is a combination of eight privacy-defending programs, including Spam Fighter Pro, Worm Hunter, Pop-Up Killer, Banner Blocker, Cookie Eraser, Privacy Protector, History Cleaner, and Garbage CleanerNo
Windows UpdateXSecretStub.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %Windir%No
secserv.exeXsecserv.exeDetected by Panda as an EasySearch adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computerNo
Security Server DBXsecserver.exeDetected by Microsoft as Worm:Win32/Slenfbot.AAPNo
Security Service DBXsecservice.exeDetected by Microsoft as Worm:Win32/Slenfbot.ABFNo
Security ShieldXsecshield.exeDetected by McAfee as Generic PWS.y and by Malwarebytes as Trojan.Agent.GenNo
secsrvrcXsecsrvrc.exeDetected by Kaspersky as Trojan-Spy.Win32.SCKeyLogNo
System Event ManagerXsecsvc.exeDetected by Trend Micro as WORM_RBOT.BMYNo
Security ServiceXsecsvc.exeDetected by Sophos as W32/Rbot-GGF and by Malwarebytes as Backdoor.BotNo
Network SecurityXsecsvc.exeDetected by Sophos as W32/Rbot-ALXNo
secsvc32Xsecsvcnt.exeDetected by Total Defense as "Global Patrol 1.31". The file is located in %System%No
SecsysUSECSYS.EXEUltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!No
PLAYERMXsecui.exeDetected by Malwarebytes as Trojan.Banker.BMB. The file is located in %AppData% - see hereNo
SecUpdXSecUpd.exeDetected by McAfee as Ransom and by Malwarebytes as Trojan.Agent.RNSNo
WinUpdateXSecUpdater.exeDetected by Malwarebytes as Spyware.PasswordStealer. The file is located in %AppData%No
SecurityUpdaterXSecUpdater.exeDetected by Dr.Web as Win32.HLLW.Silka.49No
Security AgentXsecurag.exeDetected by Sophos as Troj/Bancban-FNo
SecureXSecure.exeDetected by McAfee as RDN/Generic Dropper!tz and by Malwarebytes as Backdoor.Agent.DCENo
BatXsecure2.batDetected by Symantec as Backdoor.IRC.Zcrew.CNo
Win32 Security ProtocolXsecure32.exeDetected by Sophos as W32/Rbot-ETINo
Winsecure AntivirusXSecureantivirus.exeAdded by a variant of the SPYBOT WORM!No
MicrosoftCorpXsecurebind.exeDetected by Malwarebytes as Trojan.Agent.MSGen. The file is located in %System% - see hereNo
MicrosoftNAPCXsecurebind.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System% - see hereNo
SecureCleanerXSecureCleaner.exeSecureCleaner rogue spyware remover - not recommended, removal instructions hereNo
SecureFighterXSecureFighter.exeSecureFighter rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
securefile.cplXsecurefile.cplDetected by Malwarebytes as Trojan.Banker.E. The file is located in %AppData%No
SecureItProUSecureitpro470p.exeSecureIt Pro - lock your computer when you're not there, to stop malicious users from accessing your desktopNo
SecureKeeperXSecureKeeper.exeSecureKeeper rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecureKeeper. A member of the AntiAID familyNo
SecureMessengerXSecureMessenger.exeDetected by McAfee as RDN/PWS-Banker and by Malwarebytes as Trojan.Banker.PRCNo
Security MonitorXsecuremon.exeDetected by Microsoft as Worm:Win32/Slenfbot.ABHNo
Microsoft InformationXsecurenet.exeAdded by the SDBOT.AJM WORM!No
SecurePcAvXSecurePcAv.exeSecurePcAv rogue security software - not recommended, removal instructions here. A member of the AntiAID familyNo
Security Center DistributionXsecuresec.exeDetected by Microsoft as Worm:Win32/Slenfbot.AAJNo
Security SystemXsecuresys.exeDetected by Microsoft as Worm:Win32/Slenfbot.AATNo
2kowmeuswvw3Xsecuretystudio.exeSecurity Inspector 2010 rogue security software - not recommended, removal instructions hereNo
SecureUpgradeUSecureUpgrade.exeSecureUpgrade part of Embassy Security Center from Wave Systems Corp. - which "lets you manage all the functions of your Trusted Platform Modules (TPMs) and self-encrypting drives (SEDs) - hardware security features already embedded in most business-class PCs and tablets"No
SecureVeteranXSecureVeteran.exeSecureVeteran rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
SecureWarriorXSecureWarrior.exeSecureWarrior rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
[random]Xsecurewinload32x.exeDetected by Sophos as Troj/OptixP-NNo
securit.vbsXsecurit.vbsDetected by Malwarebytes as Trojan.Agent.VB. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Security CentralXSecurity Central.exeSecurity Central rogue security software - not recommended, removal instructions hereNo
Microsoft Security EssentialsXSecurity Essentials.exeDetected by McAfee as RDN/Generic.bfr!gy and by Malwarebytes as Rogue.MSENo
Security iGuardXSecurity iGuard.exeSecurity iGuard rogue spyware remover - not recommended, removal instructions hereNo
Security MonitorXSecurity Monitor.exeSecurity Monitor 2012 rogue security software - not recommended, removal instructions hereNo
Security ScanXSecurity Scan.exeDetected by Dr.Web as Trojan.DownLoader9.25535 and by Malwarebytes as Trojan.Agent.SSNo
Security SolutionXSecurity Solution.exeDetected by McAfee as DNSChanger.cq.e and by Malwarebytes as Rogue.SecuritySolutionNo
Security Solution 2011XSecurity Solution.exeSecurity Solution 2011 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecuritySolutionNo
Windows SecurityXsecurity.exeDetected by Malwarebytes as Trojan.MSIL. The file is located in %Temp%No
2kowmeuswvw3Xsecurity.exeAntiVirus Solution 2010 rogue security software - not recommended, removal instructions hereNo
MicroUpdateXSecurity.exeDetected by Malwarebytes as Backdoor.Agent.DCEGen. The file is located in %Temp%\MSDCSCNo
SecuritasXSecurity.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.IMNNo
securityXsecurity.exeDetected by Malwarebytes as Backdoor.Agent.TRJ. The file is located in %AppData%No
SecurityXSecurity.exeDetected by Dr.Web as BackDoor.Siggen.48877 and by Malwarebytes as Backdoor.Agent.DCEGen. The file is located in %AppData%\MSDCSCNo
SecurityXSecurity.exeDetected by McAfee as RDN/Generic BackDoor!ok and by Malwarebytes as Backdoor.Agent.SCGen. The file is located in %AppData%\SecurityNo
SecurityXSecurity.exeDetected by McAfee as RDN/Generic.tfr!du and by Malwarebytes as Trojan.Agent.VLS. The file is located in %LocalAppData%\ValesksNo
SecurityXSecurity.exeDetected by Dr.Web as Trojan.DownLoader10.51045 and by Malwarebytes as Backdoor.Agent.SCGen. The file is located in %Temp%\SecurityNo
Disk KeeperXsecurity.exeDaosearch adwareNo
hiyaXSecurity.exeDetected by Dr.Web as Trojan.StartPage.60532 and by Malwarebytes as Trojan.Agent.ENo
loadXsecurity.exeDetected by Malwarebytes as Trojan.Agent.FL. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "security.exe" (which is located in %UserTemp%\C:)No
Security.exeXSecurity.exeDetected by Malwarebytes as Trojan.Agent.S. The file is located in %AppData%No
Security.exeXSecurity.exeDetected by Dr.Web as Trojan.PWS.Siggen1.907 and by Malwarebytes as Trojan.Agent.S. The file is located in %CommonAppData%\maldonadoNo
Security.exeXSecurity.exeDetected by Dr.Web as Trojan.PWS.Siggen1.907 and by Malwarebytes as Trojan.Regrun. The file is located in %CommonAppData%\maldonadoNo
security.exeXSecurity.exeDetected by Malwarebytes as Trojan.Agent.S. Note - this entry loads from HKCU\Run and the file is located in %UserStartup%No
security.exeXsecurity.exeDetected by Dr.Web as Trojan.DownLoader10.49870. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Security.ExeXSecurity.ExeDetected by Dr.Web as Trojan.MulDrop5.46219 and by Malwarebytes as Trojan.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
security.exeXsecurity.exeDetected by McAfee as Downloader.gen.a. The file is located in %Windir%No
HKLMXSecurity.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\IntelNo
PoliciesXSecurity.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\IntelNo
HKCUXSecurity.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\IntelNo
UpdatesXsecurity.exeDetected by Malwarebytes as Trojan.Agent.MS. The file is located in %AppData%\MicrosoftNo
security.vbsXsecurity.vbsDetected by Dr.Web as Trojan.DownLoader11.26426 and by Malwarebytes as Trojan.Agent.Script. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Security 2009XSecurity2009.exeSecurity 2009 rogue security suite - not recommended, removal instructions hereNo
Windows Security UpdateXsecurity32.exeAffilred adwareNo
Microsoft Security UpdateXsecurity32.exeDetected by Sophos as Troj/Delf-JJNo
SecurityBoanXSecurityBoan.exeSecurityBoan rogue security software - not recommended, removal instructions hereNo
Aluria Security CenterNSecurityCenter.exeAluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware companyNo
SecurityCenterXsecuritycenter.exeEntry added by Desktop Security 2010, Antivirus Studio 2010 and other rogue security software - not recommendedNo
Microsoft Secure Messenger.NET ServiceXsecuritychk.exeDetected by Trend Micro as WORM_WOOTBOT.KNo
DCPstrAppYSecurityDeviceInfoSetRegistryString.exePart of the Dell ControlPoint Security Manager - which "provides access to your security, user identification, fingerprint readers, and smartcard security technology". Dell ControlPoint is "designed to simplify and unify the execution of what should be simple system functions" and "integrates best-of-breed software and utility solutions into one helpful solution"No
SecurityFighterXSecurityFighter.exeSecurity Fighter rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
2kowmeuswvw3Xsecurityhelper.exeAntiVirus System 2011 rogue security software - not recommended, removal instructions hereNo
Antivirus Protection 2012 SHXsecurityhelper.exeAntivirus Protection 2012 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.AntiVirusProtectionNo
Security ManagerXsecuritymanager.exeAntiVirus System 2011 rogue security software - not recommended, removal instructions here. Note - this is not the valid Comcast security program typically located in %ProgramFiles%\Comcast\Security Manager\app. This one is located in %AppData%\AntiVirus System 2011No
Security ManagerUSecurityManager.exeA ComCast Internet software suite that provides a variety of features (firewall, popup blocker, parental controls, etc) to help ensure your computer is secure, and your information is kept private. Located in %ProgramFiles%\Comcast\Security Manager\appNo
Security Monitor 2012 SecurityXsecuritymanager.exeSecurity Monitor 2012 rogue security software - not recommended, removal instructions hereNo
Security Solution 2011 SecurityXsecuritymanager.exeSecurity Solution 2011 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.SecuritySolutionNo
AntiVirus AntiSpyware 2011 SecurityXsecuritymanager.exeAntivirus AntiSpyware 2011 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.AntiVirusAntiSpyware2011No
Antivirus Protection 2012 SMXsecuritymanager.exeAntivirus Protection 2012 rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.AntiVirusProtectionNo
securityscanXsecurityscan.exeDetected by Malwarebytes as Trojan.Agent.SC. The file is located in %AppData%\Microsoft\logNo
SecuritySoldierXSecuritySoldier.exeSecurity Soldier rogue security software - not recommended, removal instructions here. A member of the WiniGuard familyNo
tvncontrolXsecuritysvc.exeDetected by Dr.Web as Trojan.DownLoader11.26506 and by Malwarebytes as Misused.Legit. Note - this is not the legitimate TightVNC entry of the same name which loads the file "tvnserver.exe" from %ProgramFiles%\TightVNC. This file is located in %Windir%No
Security UtilityUsecurityutility.exeDetected by Malwarebytes as PUP.Optional.SecurityUtility. The file is located in %ProgramFiles%\securityutility\securityutility\[version]. If bundled with another installer or not installed by choice then remove itNo
DisplaySwitchXsecuritywindrv.exeDetected by Malwarebytes as Trojan.Agent.WS. The file is located in %Templates%No
Security Inspector 2010XSecurity_Inspector_2010.exeSecurity Inspector 2010 rogue security software - not recommended, removal instructions hereNo
SESyncXSED.exeDownloadWare adwareNo
CLSIDXsed.exeOnlineDirect - Switch dialer and hijacker variant, see hereNo
SEEDBROWN.exeXSEEDBROWN.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Trojan.Banker.ENo
gqvqevsXseeffkme.exeDetected by Sophos as W32/Sdbot-QDNo
seekerXseeker.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\seekerNo
seeker.exeXseeker.exeDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
seekmoXseekmo.exeSeekmo Search Assistant adware. The file is typically located in %ProgramFiles%\seekmoNo
SeekmoSAXSeekmoSA.exeSeekmo Search Assistant adware - detected by Malwarebytes as Adware.Seekmo. The file is typically located in %ProgramFiles%\Seekmo\bin\[version]No
seervee.exeXseervee.exeDetected by Malwarebytes as Trojan.Backdoor.FFI. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
seeveXseeve.exeMedload adwareNo
C0NIMEXsefix.exeDetected by Dr.Web as Trojan.DownLoader6.47103 and by Malwarebytes as Trojan.Agent. Note the number "0" in the nameNo
seg.vbsXseg.vbsDetected by Malwarebytes as Trojan.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Seguridad.exeXSeguridad.exeDetected by McAfee as Generic.tfr!a and by Malwarebytes as Trojan.BankerNo
Service RuntimeXsEi.exeDetected by Dr.Web as Trojan.DownLoader11.20547 and by Malwarebytes as Trojan.Agent.GenNo
Selection ToolsUSelection Tools.exeDetected by Malwarebytes as PUP.Optional.SelectionTools. The file is located in %AppData%\WTools\Selection Tools. If bundled with another installer or not installed by choice then remove itNo
SelectRebatesXSelectRebates.exeSelectRebates adwareNo
SelfHostUtil?selfhost.exeThe file is located in %Windir%No
SelfPrivacyXSelfPrivacy.exeSelfPrivacy rogue security software - not recommended, removal instructions hereNo
[various names]Xseli.exeMediaMotor adwareNo
HKLMXSelina.jpgDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\svchost.exeNo
PoliciesXSelina.jpgDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\svchost.exeNo
HKCUXSelina.jpgDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\svchost.exeNo
selmodevolXselmodevol.exeDetected by Kaspersky as Trojan-PSW.Win32.LdPinch.angm. The file is located in %AppData%No
RoflcopteurXseman.exeAdded by an unidentified WORM or TROJAN!No
SemanticInsightXSemanticInsight.exeRXToolbar adware. Software that displays pop-up/pop-under advertisements when the primary user interface is not visibleNo
Bron-SpizaetusXsempalong.exeDetected by Sophos as W32/Brontok-E and by Malwarebytes as Worm.BrontokNo
SeMSUSeMS.exePCsms - tool that enables you to send sms text messages from your PC to any UK mobile phoneNo
senderXsender.exeDetected by Dr.Web as Trojan.DownLoader8.15996 and by Malwarebytes as Trojan.BankerNo
SendMailUSendMail.exePart of the MySuperSPy surveillance software. Uninstall this software unless you put it there yourself. Located in %ProgramFiles%\MyssNo
QQXsendmess.exeDetected by Symantec as Trojan.QQMessNo
senewsys32Xsenewsys32.exeDetected by Malwarebytes as Worm.AutoRun.Gen. The file is located in %Recycled%\{SID)No
System Error NotificationXsenr32.exeDetected by Sophos as Troj/Poison-BT and by Malwarebytes as Backdoor.BotNo
sensacionais_videos.exeXsensacionais_videos.exeDetected by Dr.Web as Trojan.Siggen6.8052 and by Malwarebytes as Trojan.Agent.VDGen. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SensivaUSensiva.exeSymbol Commander from Sensiva - makes the use of your PC, laptop, Tablet PC, and Pocket PC much easier and much faster. It recognizes your handwriting with unparalled performance and executes commands in a snap. Just by using your mouse, pen, or touchpad, simply draw symbols to execute actions instantlyNo
SENS Keyboard V4 LauncherUSENSKBD.EXEHot-key manager for some Samsung notebooks - required if you use the keysNo
SENS Keyboard V6 LauncherUSENSKBD.EXEHot-key manager for some Samsung notebooks - required if you use the keysNo
Quick Heal AntiVirusYsensor.exePart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Optionally scans the system boot area for programs trying to automatically execute before Windows loads and keeps a watch on some system files which are commonly patched (or replaced) by malware. Feature not supported on Windows 10/8/7/Vista systems. Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
Startup ScanYsensor.exePart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Optionally scans the system boot area for programs trying to automatically execute before Windows loads and keeps a watch on some system files which are commonly patched (or replaced) by malware. Feature not supported on Windows 10/8/7/Vista systems. Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
SensorYsensor.exePart of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Optionally scans the system boot area for programs trying to automatically execute before Windows loads and keeps a watch on some system files which are commonly patched (or replaced) by malware. Feature not supported on Windows 10/8/7/Vista systems. Also included by vendors who use the Quick Heal engine such as Omniquad and iQonYes
sentinelmonUsentinelmon.exePCSentinel's Smoking Gun! surveillance software. Uninstall this software unless you put it there yourselfNo
CrisysTec SentryXSentry.exeCrisysTec Sentry rogue privacy program - not recommendedNo
SENTRYXSENTRY.exeFrom IP Insight. Allows website owners "to instantly determine the precise geographic location, connection speed and detailed demographics of every visitor to your website". Will be detected by most firewalls and the majority of home users should disable itNo
RNBOStartUsentstrt.exeProgram used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such toolsNo
senzwbsys32Xsenzwbsys32.exeDetected by Malwarebytes as Worm.AutoRun.Gen. The file is located in %Recycled%\{SID)No
Sepate Security FirewallXsepate.exeDetected by Total Defense as Win32.Rbot.BLC. The file is located in %System%No
Sony Ericsson PC SuiteNSEPCSuite.exeSystem Tray access to Sony Ericsson PC Suite (now replaced by PC Companion) which "connects your phone to your computer and expands the capabilities of your phone". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phoneYes
SEPCSuiteNSEPCSuite.exeSystem Tray access to Sony Ericsson PC Suite (now replaced by PC Companion) which "connects your phone to your computer and expands the capabilities of your phone". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phoneYes
septpop06apseptXseptpop06apsept.exeMediaMotor.Popupwithcast adwareNo
Windows Live FamilyXSEPWDN.EXEDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.Agent.DPTNo
Microsoft Windows Media Player 12.0XSEPWDN32.EXEDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.MWF.GenNo
avnortXserbw.exeDetected by Symantec as W32.Serflog.ANo
ltwobXserbw.exeDetected by Symantec as W32.Serflog.ANo
serpeXserbw.exeDetected by Symantec as W32.Serflog.ANo
searchindexXserchindex.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %AppData%No
SystemXsereame.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %Windir%No
mservXseres.exeDetected by Sophos as W32/Agent-LIL and by Malwarebytes as Trojan.FakeAlertNo
36OSafeUpdateXseria.exeDetected by Kaspersky as Trojan.Win32.Agent.fajk. The file is located in %CommonFiles%No
Gunz SerialkeyXSerialkey.exeDetected by McAfee as RDN/Generic BackDoor and by Malwarebytes as Backdoor.Agent.DCENo
SerialsXserials.exeAny one of a variety of worms and trojansNo
SERIAL UPDATE2013XSerials2013.exeDetected by Malwarebytes as Backdoor.Agent.SR. The file is located in %AppData%No
F4JXSerious.exeDetected by Sophos as W32/Mirsa-BNo
AnthraxXSerious.exeDetected by Sophos as W32/Mirsa-BNo
JusticeXSerious.exeDetected by Sophos as W32/Mirsa-BNo
FourXSerious.exeDetected by Sophos as W32/Mirsa-BNo
EbolaXSerious.exeDetected by Sophos as W32/Mirsa-BNo
loadXSerious.exeDetected by Sophos as W32/Mirsa-B. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "Serious.exe" (which is located in %Root%)No
FathersXSerious.exeDetected by Sophos as W32/Mirsa-BNo
System ServiceXserious.exeDetected by Sophos as W32/Rbot-FMV. Note - deactivates the Microsoft Internet Connection Firewall (ICF)No
runXSerious.exeDetected by Sophos as W32/Mirsa-B. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "run" value data to include the file "Serious.exe" (which is located in %Root%)No
NetBalancerUSeriousBit.NetBalancer.Tray.exeSystem Tray access to the NetBalancer traffic control and monitoring tool by SeriousBit - "Browse and do any internet activity comfortably even when your download manager or torrent client downloads huge files from internet - just lower their network priority with NetBalancer"No
WinscxprocessXSerisSerc.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%No
ToolBarXseriusdat.exeDetected by Microsoft as TrojanSpy:Win32/Bancos.ACJNo
JASERVMINXserivecs.exeDetected by McAfee as RDN/Generic PWS.y!b2k and by Malwarebytes as Backdoor.Agent.ENo
searchgoosgXserkle.exeDetected by Malwarebytes as Adware.K.GSearch. The file is located in %ProgramFiles%\searchgoosgNo
Microsoft WinUpdatesXserm32.exeDetected by Trend Micro as WORM_RBOT.GENo
SErmYcVkqxTXSErmYcVkqxT.exeDetected by Sophos as Troj/CeeInjec-KNo
serrdctl.exeYserrdctl.exe"Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modemsNo
serrrrver.exeXserrrrver.exeDetected by Dr.Web as Trojan.DownLoader11.25640 and by Malwarebytes as Trojan.Downloader.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
serrvXserrv.exeDetected by Sophos as W32/Stration-BBNo
Microsoft Windows ServicesXSersices.exeDetected by Sophos as W32/Sdbot-NO and by Malwarebytes as Trojan.MWF.GenNo
Configuration LoaderXseru32.exeDetected by Sophos as W32/Sdbot-VR and by Malwarebytes as Backdoor.BotNo
ISTRATORXSeruice.exeDetected by Malwarebytes as Trojan.StartPage. The file is located in %Root%No
Serv-U® File ServerUServ-U-Tray.exeSystem Tray access for the Serv-U® FTP Server server which allows the user to (amongst others) start the Management Console, stop the server and display notificationsYes
Serv-U® File Server Tray ApplicationUServ-U-Tray.exeSystem Tray access for the Serv-U® FTP Server server which allows the user to (amongst others) start the Management Console, stop the server and display notificationsYes
Serv-U-TrayUServ-U-Tray.exeSystem Tray access for the Serv-U® FTP Server server which allows the user to (amongst others) start the Management Console, stop the server and display notificationsYes
ServUTrayIconUServ-U-Tray.exeSystem Tray access for the Serv-U® FTP Server server which allows the user to (amongst others) start the Management Console, stop the server and display notificationsYes
Serv-UNserv-u32.exe"Serv-U® FTP Server is a simple and secure FTP server software for Windows and Linux which provides FTP and secure FTP (FTPS) services that are compatible with nearly all FTP clients"No
Jusched (TM)Xserv.exeDetected by Malwarebytes as Trojan.Agent.SVR. The file is located in %AppData%\InstallNo
HKLMXserv.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
PoliciesXserv.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %AppData%\dirNo
PoliciesXserv.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\installNo
HKCUXserv.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\dirNo
HKCUXserv.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
Generic Service ProcessXserv1ces.exeDetected by Sophos as W32/Agobot-JK and by Malwarebytes as Backdoor.IRCBot.GenNo
Service ManagerXserv3manager.exeDetected by Sophos as W32/Sdbot-AGO and by Malwarebytes as Worm.PassmaNo
Rout111Xserv454.exeDetected by McAfee as W32/Sdbot.worm.genNo
PoliciesXserv55er.exeDetected by McAfee as RDN/Generic.bfr!er and by Malwarebytes as Backdoor.Agent.PGenNo
SSSSS1Xserv55er.exeDetected by McAfee as RDN/Generic.bfr!er and by Malwarebytes as Backdoor.Agent.ENo
HKLMS1Xserv55er.exeDetected by McAfee as RDN/Generic.bfr!er and by Malwarebytes as Backdoor.Agent.ENo
servantXservant.exeDetected by Malwarebytes as Trojan.Agent.SVR. The file is located in %AppData% - see hereNo
BANSXservbandDetected by McAfee as Generic Downloader.x and by Malwarebytes as Trojan.Downloader.BNSNo
Services Management ClientsXservc.exeAdded by a variant of Backdoor.Rizo.A. The file is located in %System%\inetsrvNo
WINDOWS SYSTEMXservce.exeDetected by Sophos as W32/Mytob-EI and by Malwarebytes as Backdoor.AgentNo
ServicerXservcr.exeDetected by Trend Micro as TROJ_SDBOT.BAHNo
Services ManagementsXservcs.exeDetected by Sophos as W32/Rbot-GUCNo
Microsoft Windows UpdateXservcs.exeDetected by Symantec as Backdoor.Sdbot.AL and by Malwarebytes as Trojan.MWF.Gen.No
Windows UpdateXservcshost.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %CommonFiles%\SystemNo
SystemXservdmwe.exeDetected by McAfee as RDN/Generic BackDoor!b2u and by Malwarebytes as Backdoor.Agent.WUNo
Key2?serve.exeThe file is located in %System%No
HKLMXServe2.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\System32No
HKCUXServe2.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\System32No
NDIS AdapterXServenxp.exeDetected by Trend Micro as WORM_SPYBOT.LYNo
NDIS AdapterXservenxpp.exeDetected by Sophos as W32/Forbot-GPNo
serverXserverDetected by Malwarebytes as Stolen.Data. The file is located in %AppData%No
InternetXserver ??.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%No
Win32RXServer.comDetected by Symantec as W32.EstrellaNo
sysserXserver.dllDetected by Trend Micro as WORM_RAHACK.ANo
HKCUXserver.exeDetected by McAfee as RDN/Generic.dx!q and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\installNo
HKCUXserver.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\msnmgr.exe\installNo
HKCUXserver.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bjhg and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\spynetNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\WinUpdateNo
HKCUXserver.exeDetected by Sophos as Troj/Agent-AFNE and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\directory\CyberGate\installNo
HKCUXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\directory\CyGate\installNo
HKCUXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.nws and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\installNo
WindowsUpXserver.exeDetected by McAfee as Generic BackDoorNo
HKCUXServer.exeDetected by Sophos as Mal/MSPose-VB and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\InstallDirNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\intel\installNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\svchost.exeNo
HKCUXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\Temp\InstallDirNo
HKCUXServer.exeDetected by McAfee as Generic.bfr!cs and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\WinDirNo
random_stringXServer.exeDetected by Malwarebytes as Backdoor.Agent.Generic. The file is located in %AppData%\server - see hereNo
HKCUXserver.exeDetected by Malwarebytes as Trojan.Backdoor. The file is located in %System%No
serverXserver.exeDetected by Dr.Web as Trojan.DownLoader7.25508 and by Malwarebytes as Trojan.Sasfis. The file is located in %AppData%No
HKCUXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\%tamp%No
ServerXServer.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.Agent.SVRGen. The file is located in %AppData%\AppNo
SimpleCBXserver.exeDetected by Malwarebytes as Backdoor.XTRat. The file is located in %System%\installNo
HKCUXserver.exeDetected by McAfee as RDN/Generic.bfr!m and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\drcr.exeNo
serverXserver.exeDetected by Dr.Web as Trojan.MulDrop4.26221 and by Malwarebytes as Trojan.Agent. The file is located in %AppData%\FolderNameNo
HKCUXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\explorerNo
ServerXServer.exeDetected by Dr.Web as Trojan.PWS.Siggen1.15823 and by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%\MicroNo
HKCUXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
serverXServer.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\ServerNo
testXserver.exeDetected by Malwarebytes as Trojan.Backdoor.DF. The file is located in %Windir%No
VFDLYE4JCNL5JXServer.exeDetected by McAfee as RDN/Autorun.worm!cy and by Malwarebytes as Backdoor.Agent.ENo
HKCUXserver.exeDetected by Sophos as Troj/Inject-XD and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\InstallDirNo
ServerXServer.exeDetected by McAfee as Keylog-Spynet.gen.g and by Malwarebytes as Backdoor.SpyNet. The file is located in %AppData%\SpyNetNo
HKCUXserver.exeDetected by McAfee as Generic PWS.y!1xx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\LargeNo
ServerXserver.exeDetected by McAfee as PWS-FAHB!EF21253AD423 and by Malwarebytes as Backdoor.Agent.ISGen. The file is located in %Cookies%\InstallDirNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\Net32No
serverXserver.exeDetected by Trend Micro as WORM_DELTAD.A. The file is located in %Windir% and %System%No
Win32Xserver.exeDetected by Kaspersky as Trojan.Win32.Llac.bsvc and by Malwarebytes as Worm.Autorun. The file is located in %System%\installNo
HKCUXserver.exeDetected by Sophos as W32/Rebhip-U and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\spynetNo
Realtek AudioXserver.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %System%\MicrosoftNo
ServerXserver.exeDetected by Malwarebytes as Trojan.Sasfis. The file is located in %LocalAppData%No
win32Xserver.exeDetected by McAfee as BackDoor-EEH and by Malwarebytes as Backdoor.BotNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\SystemNo
ServerXServer.exeDetected by Kaspersky as Backdoor.Win32.Xtreme.bid. The file is located in %ProgramFiles%\InstallDirNo
HKCUXServer.exeDetected by McAfee as Generic.bfr!ej and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\SYSTEM32No
ServerXServer.exeDetected by Malwarebytes as Trojan.Backdoor.DF. The file is located in %ProgramFiles%\Windaws MessengerNo
HKCUXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.cxsz and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\WinDir - see hereNo
serverXserver.exeDetected by Malwarebytes as Trojan.Backdoor.CH. The file is located in %System%No
FirmwareBootDeviceXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
HKCUXServer.exeDetected by McAfee as Generic.bfr!dd and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\WinlogNo
ServerXServer.exeDetected by McAfee as RDN/Generic BackDoor!p and by Malwarebytes as Backdoor.Agent. The file is located in %System%\InstallDirNo
HKCUXserver.exeDetected by McAfee as PWS-Zbot.gen.lm and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\tempNo
IDO PortXserver.exeDetected by McAfee as Generic.dx!bb3tNo
ServerXServer.exeDetected by McAfee as Keylog-Spynet.gen.g and by Malwarebytes as Backdoor.SpyNet. The file is located in %System%\SpyNetNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\windowsupdate\installNo
ServerXServer.exeDetected by McAfee as RDN/Generic.dx!dq and by Malwarebytes as Trojan.Sasfis. The file is located in %Temp%No
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\windowsupdate\java15No
ServerXServer.exeDetected by Malwarebytes as Backdoor.Agent.SVR.Generic. The file is located in %UserStartup%No
HKCUXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %UserTemp%\InstallDirNo
ServerXServer.exeDetected by Malwarebytes as Trojan.Inject.DF. The file is located in %UserTemp%\SpyNet - see hereNo
UltraVNC SCXServer.exeDetected by Dr.Web as Trojan.DownLoader13.15288 and by Malwarebytes as Trojan.Agent.AutoItNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\CursorsNo
serverXserver.exeDetected by Sophos as Troj/Singu-Q and by Malwarebytes as Trojan.Sasfis. The file is located in %Windir%No
HKCUXServer.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\driveNo
ServerXServer.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %Windir%\hosterNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\dropbocNo
ServerXServer.exeDetected by McAfee as Generic BackDoor!fqc and by Malwarebytes as Trojan.MSIL. The file is located in %Windir%\InstallDirNo
wSILlzCwXBSrQXServer.exeDetected by McAfee as RDN/Generic.dx!ctf and by Malwarebytes as Backdoor.Agent.LLZNo
HKCUXserver.exeDetected by Sophos as Troj/Agent-NLT and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\installNo
ServerXServer.exeDetected by Malwarebytes as Trojan.Backdoor.SPY. The file is located in %Windir%\msNo
HKCUXserver.exeDetected by Trend Micro as TROJ_LETHIC.SMA and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\InstallDirNo
ServerXServer.exeDetected by McAfee as RDN/Generic.dx!ev and by Malwarebytes as Backdoor.Agent. The file is located in %Windir%\SpyNetNo
HKCUXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\officeNo
HKCUXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.ytd and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\serverNo
Default KeyXServer.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\Default Folder - see hereNo
FaceXserver.exeDetected by Malwarebytes as Backdoor.Poison. The file is located in %UserTemp%No
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\UpdateNo
Fuk YouXServer.exeDetected by Malwarebytes as Trojan.MSIL. The file is located in %UserTemp%No
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\win32 - see hereNo
HKCUXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\WinDirNo
HKCUXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.khw and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\WindowsNo
aaa.exeXserver.exeDetected by Malwarebytes as Trojan.VBAgent. The file is located in %UserTemp%No
PolicuesXserver.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %System%\installNo
Google...XServer.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.SVRGenNo
hvytirdt eudXserver.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %System%\installNo
WindowsUpdateXserver.exeDetected by Kaspersky as Trojan.Win32.Llac.spo and by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%\Nvidia-DriverNo
CamfrogXserver.exeDetected by Malwarebytes as Backdoor.Agent. Note - this is not the legitimate Camfrog video chat software by Camshare Inc. The file is located in %System%\InstallNo
AudioClientXserver.exeDetected by Malwarebytes as Trojan.KeyLogger. The file is located in %AppData%No
jxupdateXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
SQLXserver.exeAdded by the PUNYA-B WORM!No
Windows SidebarXserver.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %Windir%\install - see hereNo
fileXserver.exeDetected by Malwarebytes as Trojan.Backdoor.DF. The file is located in %Windir%No
Java(TM) Update SchedulerXserver.exeDetected by Dr.Web as WBackDoor.Bladabindi.2639No
(Default)Xserver.exeDetected by Malwarebytes as Backdoor.Agent.E. Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %AppData%No
MicroUpdateXserver.exeDetected by McAfee as PWS-FAHB!EF21253AD423 and by Malwarebytes as Backdoor.Agent.DCEGenNo
Server.exeXServer.exeDetected by McAfee as RDN/Generic.dx!ckp and by Malwarebytes as Trojan.FakeMS. The file is located in %AppData%\Adobe\UpdatesNo
MSQMXserver.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %System%\MicrosoftNo
Server.exeXServer.exeDetected by Malwarebytes as Trojan.FakeMS. The file is located in %AppData%\Microsoft\Windows\Start Menu\Programs\Adobe\Updates (10/8/7/Vista) or %UserProfile%\Start Menu\Programs\Adobe\Updates (XP)No
ChromeXServer.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\AppNo
Server.exeXServer.exeDetected by McAfee as RDN/Generic PWS.y and by Malwarebytes as Backdoor.Agent.MCW. The file is located in %AppData%\MicroWinNo
ChromeXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %CommonAppData%\fatima\fatima\1.0.0.0\dirNo
server.exeXserver.exeDetected by Malwarebytes as Backdoor.SpyNet.M. The file is located in %Root%\dir\install\installNo
ChromeXServer.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.E. The file is located in %Temp%No
KXServer.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.ISGenNo
server.exeXserver.exeDetected by Symantec as Backdoor.Smokodoor. The file is located in %System%No
Server.exeXServer.exeDetected by Malwarebytes as Backdoor.Agent.SVR.Generic. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
DefendXserver.exeDetected by McAfee as Generic.bfrNo
Server.exeXserver.exeDetected by Malwarebytes as Backdoor.RAT.Gen. Note - the file is located in %UserStartup% and its presence here ensures it runs when Windows startsNo
SERVER.EXEXSERVER.EXEDetected by Sophos as Troj/BushTro122 and by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
server.exe1Xserver.exeDetected by Kaspersky as Backdoor.Win32.Bifrose.ahrh and by Malwarebytes as Trojan.AgentNo
CerberusXserver.exeDetected by McAfee as W32/Pate.b and by Malwarebytes as Backdoor.AgentNo
RealtekSoundXServer.exeDetected by Malwarebytes as Backdoor.Agent.ISGen. The file is located in %System%\InstallDir - see hereNo
Mozilla FirefoxXServer.exeDetected by Malwarebytes as Backdoor.Bladabindi. The file is located in %AppData%\fsociety\FolderNo
Windows DefenderXserver.exeDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
svchostXserver.exeDetected by McAfee as PWS-Zbot.gen.afr and by Malwarebytes as Backdoor.Bot.E. The file is located in %AppData%No
Windows DefenderXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\install - see hereNo
svchostXserver.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %AppData%\serveNo
Windows DefenderXserver.exeDetected by McAfee as Generic.bfrNo
explorerXServer.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
svchostXserver.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %AppData%\serverNo
Windows DefenderXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Root%\directory\Windows Update\HKLMCUM\install - see hereNo
EXPLORERXServer.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
svchostXserver.exeDetected by Dr.Web as Trojan.DownLoader7.851 and by Malwarebytes as Backdoor.Bot.E. The file is located in %Temp%No
Windows DefenderXserver.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Trojan.Agent. The file is located in %Root%\installNo
svchostXserver.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %Windir%No
Windows DefenderXserver.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Trojan.Agent. The file is located in %System%\installNo
RegistryKeyXserver.exeDetected by Kaspersky as Trojan.Win32.LogonInvader.a and by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
Windows DefenderXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%\install - see hereNo
WO99g66W99qYXserver.exeDetected by Malwarebytes as Trojan.VBInject. The file is located in %System%\installNo
RegistryKeyXserver.exeDetected by McAfee as Generic BackDoor!d2e and by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%No
dllhostXserver.exeDetected by Malwarebytes as Trojan.Inject. The file is located in %System%\dmwNo
RegistryKeyXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%No
SysstemXserver.exeDetected by Malwarebytes as Trojan.Downloader.S. The file is located in %Windir% - see hereNo
dllhostXserver.exeDetected by McAfee as RDN/Generic.bfr!ic and by Malwarebytes as Backdoor.Agent.DLHNo
RegistryKeyXserver.exeDetected by Kaspersky as Trojan.Win32.Scar.bdjh and by Malwarebytes as Trojan.Agent. The file is located in %System% - see hereNo
RegistryKeyXserver.exeDetected by McAfee as Generic.mfr and by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
WINLOGONXServer.exeDetected by McAfee as Generic.bfr!dd and by Malwarebytes as Trojan.Agent.Trace. The file is located in %Root%\WinDirNo
svcrhost.exeXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %System%No
WinLogonXserver.exeDetected by Malwarebytes as Trojan.Agent.Trace. The file is located in %UserTemp%No
update22Xserver.exeDetected by Dr.Web as Trojan.DownLoader10.49681 and by Malwarebytes as Backdoor.Agent.ENo
EthernetXserver.exeDetected by McAfee as RDN/Generic.bfr!hh and by Malwarebytes as Backdoor.Agent.ENo
jfjbgyeey eurXserver.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %System%\installNo
BAGAXserver.exeDetected by McAfee as RDN/Generic Dropper and by Malwarebytes as Backdoor.Agent.SVRNo
Ethernet AdapterXserver.exeDetected by McAfee as RDN/Generic.bfr!hh and by Malwarebytes as Backdoor.Agent.ENo
web.exeXserver.exeDetected by Malwarebytes as Backdoor.NanoCore. The file is located in %UserTemp%No
scvhostXServer.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%\InstallDirNo
javaaeXServer.exeDetected by Dr.Web as Trojan.DownLoader20.6517 and by Malwarebytes as Trojan.Agent.JVNo
UNL5JJWUPD4NEOXServer.exeDetected by McAfee as RDN/Generic PWS.y!ut and by Malwarebytes as Backdoor.Agent.ENo
startkeyXserver.exeDetected by Sophos as Troj/Bifrose-DB and by Malwarebytes as Backdoor.BotNo
javaasXServer.exeDetected by Dr.Web as Trojan.DownLoader20.6517 and by Malwarebytes as Trojan.Agent.JVNo
hdaudioXserver.exeDetected by Kaspersky as Trojan.Win32.Llac.spo and by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%\Nvidia-DriverNo
sbdhrfgbXserver.exeDetected by Dr.Web as Trojan.DownLoader10.37953 and by Malwarebytes as Backdoor.Agent.ENo
dreamsXserver.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
ASXserver.exeDetected by McAfee as RDN/Generic.bfr!ff and by Malwarebytes as Backdoor.Agent.SVRGenNo
Microsoft Svchost Service mainXServer.exeDetected by Dr.Web as Trojan.DownLoader7.23976No
AudiosfxXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
SESTIEMSXServer.exeDetected by McAfee as RDN/Generic.dx!bc and by Malwarebytes as Backdoor.AgentNo
KrisXServer.exeDetected by McAfee as RDN/Downloader.a!rq and by Malwarebytes as Backdoor.Agent.KRNo
ProtectionXserver.exeDetected by Sophos as Mal/VBInject-ASNo
msnger.exeXserver.exeDetected by McAfee as RDN/Generic.bfr!mNo
JKEIIGHLPLEHLPAXserver.exeDetected by McAfee as RDN/Generic.dx!cl3 and by Malwarebytes as Backdoor.Agent.ENo
Protection2Xserver.exeDetected by Sophos as Mal/VBInject-ASNo
sDFSDFsdfXServer.exeDetected by Malwarebytes as Backdoor.Agent.ISGen. The file is located in %Windir%\InstallDirNo
SDFSDfsdfsdfXServer.exeDetected by Malwarebytes as Backdoor.Agent.ISGen. The file is located in %Windir%\InstallDirNo
w32ntdll.exeXserver.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %System%No
AppXserver.exeDetected by McAfee as Generic.dx!bbdl and by Malwarebytes as Backdoor.Agent.ENo
loadXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.Agent.Gen. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "Server.exe" (which is located in %AppData%\InstallDir) and also adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" entry pointing to the same fileNo
microsoftXServer.exeDetected by Sophos as W32/Rebhip-N and by Malwarebytes as Trojan.Agent.MSGen. The file is located in %Windir%\InstallDirNo
AdobeupdateXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp%No
JavaJDKXserver.exeDetected by Malwarebytes as Backdoor.Messa.E. The file is located in %System%\installNo
MicrosoftXserver.exeDetected by McAfee as RDN/Generic.dx!d2x and by Malwarebytes as Trojan.Agent.E.Generic. The file is located in %Windir%\ladmsNo
sservicesXserver.exeDetected by McAfee as Generic PWS.diNo
system of pcXserver.exeDetected by Malwarebytes as Trojan.VBAgent. The file is located in %UserTemp% - see hereNo
msnmgrXServer.exeDetected by Malwarebytes as Backdoor.Agent.ISGen. The file is located in %Windir%\InstallDirNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AllUsersStartup%\installNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\installNo
EXPLORERSXServer.exeDetected by McAfee as RDN/Generic.dx!bc and by Malwarebytes as Backdoor.AgentNo
HKLMXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\InstallDirNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\svchost.exeNo
icgXserver.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir%No
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\installNo
HKLMXServer.exeDetected by Kaspersky as Backdoor.Win32.Xtreme.bid and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\InstallDirNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\MSNNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\system32 - see hereNo
HKLMXserver.exeDetected by McAfee as RDN/Generic.dx!q and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\installNo
SystemXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
HKLMXserver.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\msnmgr.exe\installNo
HKLMXserver.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bjhg and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\spynetNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\dir\install\WinUpdateNo
HKLMXserver.exeDetected by Sophos as Troj/Agent-AFNE and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\directory\CyberGate\installNo
HKLMXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\directory\CyGate\installNo
HKLMXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.nws and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\installNo
HKLMXServer.exeDetected by Sophos as Mal/MSPose-VB and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\InstallDirNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\intel\installNo
Microsoft SecurityXserver.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %System%\MicrosoftNo
EWGWXServer.exeDetected by Malwarebytes as Trojan.Backdoor.DF. The file is located in %Windir%No
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\svchost.exeNo
HKLMXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\Temp\InstallDirNo
HKLMXServer.exeDetected by McAfee as Generic.bfr!cs and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\WinDirNo
HKLMXserver.exeDetected by Malwarebytes as Trojan.Backdoor. The file is located in %System%No
HKLMXserver.exeDetected by McAfee as RDN/Generic.bfr!m and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\drcr.exeNo
HKLMXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\explorerNo
HKLMXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
SkypeXServer.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.SVRGenNo
StartupXserver.exeDetected by Malwarebytes as Backdoor.Agent.SVR. The file is located in %UserTemp% - see hereNo
HKLMXserver.exeDetected by Sophos as Troj/Inject-XD and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\InstallDirNo
SkypeXserver.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %Windir%\installNo
Gestor de tarefas windowsXserver.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %Windir%\installNo
HKLMXserver.exeDetected by McAfee as Generic PWS.y!1xx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\LargeNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\Net32No
NXServer.exeDetected by McAfee as RDN/Generic PWS.y!sp and by Malwarebytes as Backdoor.Agent.SVRENo
SpyGateKeyXServer.exeDetected by Malwarebytes as Trojan.FakeMS. The file is located in %AppData%\Adobe\UpdatesNo
HKLMXserver.exeDetected by Sophos as W32/Rebhip-U and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\spynetNo
Xploit ServerXserver.exeDetected by ESET as Agent.XH and by Malwarebytes as Trojan.Backdoor.DVNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\SystemNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %AllUsersStartup%\installNo
HKLMXServer.exeDetected by McAfee as Generic.bfr!ej and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\SYSTEM32No
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %AppData%\installNo
HKLMXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.cxsz and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\WinDirNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %AppData%\svchost.exeNo
HKLMXServer.exeDetected by McAfee as Generic.bfr!dd and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\WinlogNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\installNo
HKLMXserver.exeDetected by McAfee as PWS-Zbot.gen.lm and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\tempNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\LargeNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\windowsupdate\installNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\system32 - see hereNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Temp%\windowsupdate\java15No
PoliciesXserver.exeDetected by Symantec as W32.Spyrat and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\Dir\installNo
Avast Anti VirusXserver.exeDetected by McAfee as RDN/Generic.dx!d2x and by Malwarebytes as Backdoor.Agent.SVRNo
HKLMXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %UserTemp%\InstallDirNo
PoliciesXserver.exeDetected by McAfee as RDN/Generic.dx!q and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\installNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\CursorsNo
PoliciesXserver.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\msnmgr.exe\installNo
HKLMXServer.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\driveNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\sexoNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\dropbocNo
PoliciesXserver.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bjhg and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\spynetNo
HKLMXserver.exeDetected by Sophos as Troj/Agent-NLT and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\installNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\WinUpdateNo
HKLMXserver.exeDetected by Trend Micro as TROJ_LETHIC.SMA and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\InstallDirNo
PoliciesXserver.exeDetected by Sophos as Troj/Agent-AFNE and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\directory\CyberGate\installNo
HKLMXServer.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\officeNo
PoliciesXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\directory\CyGate\installNo
HKLMXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.ytd and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\serverNo
Nvidia/ATI-DiverXserver.exeDetected by Kaspersky as Trojan.Win32.Llac.spo and by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%\Nvidia-DriverNo
PoliciesXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.nws and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\installNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\UpdateNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\intel\installNo
HKLMXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\win32 - see hereNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\svchost.exeNo
HKLMXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\WinDirNo
Java updateXserver.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %Windir%\installNo
PoliciesXServer.exeDetected by McAfee as Generic.bfr!cs and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\WinDirNo
SSSSXserver.exeDetected by McAfee as RDN/Generic.bfr!ff and by Malwarebytes as Backdoor.Agent.SVRGenNo
aIi9FwLiiVlrXServer.exeDetected by McAfee as RDN/Generic BackDoor!yx and by Malwarebytes as Trojan.Agent.SVRNo
HKLMXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.khw and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\WindowsNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\windows.old\installNo
itunesappXserver.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %AppData%No
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%No
itunesdatawriteXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\installNo
PoliciesXserver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\installNo
PoliciesXserver.exeDetected by McAfee as Generic PWS.y!1xx and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\LargeNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\Net32No
PoliciesXserver.exeDetected by Sophos as W32/Rebhip-U and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\spynetNo
svchost.exeXserver.exeDetected by Malwarebytes as Backdoor.Bot.E. The file is located in %UserTemp%No
itunestartupXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\SystemNo
PoliciesXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.cxsz and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\WinDirNo
PoliciesXServer.exeDetected by McAfee as Generic.bfr!dd and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\WinlogNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Temp%\windowsupdate\installNo
Spy-NetXserver.exeDetected by Trend Micro as BKDR_POISON.IM. The file is located in %System%\Spy-NetNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Temp%\windowsupdate\java15No
UpdateXServer.exeDetected by Malwarebytes as Trojan.MSIL. The file is located in %UserTemp%No
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\CursorsNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\dropbocNo
PoliciesXserver.exeDetected by Sophos as Troj/Agent-NLT and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\installNo
PoliciesXserver.exeDetected by McAfee as RDN/Generic.bfr!z and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\LargeNo
PoliciesXServer.exeDetected by Kaspersky as Trojan.Win32.Llac.ytd and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\serverNo
sexoXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\dir\install\sexoNo
PoliciesXserver.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\win32 - see hereNo
PoliciesXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\WinDirNo
PoliciesXserver.exeDetected by Kaspersky as Trojan-Dropper.MSIL.Agent.khw and by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\WindowsNo
System Services MonitorXserver.exeBifrost malwareNo
ctfmonXserver.exeDetected by Malwarebytes as Trojan.Passwords. The file is located in %UserTemp%No
msclrXServer.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%\msclrNo
SerXServer.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %AppData%\SpyNet - see hereNo
Adobe UpdatesXServer.exeDetected by McAfee as Generic PWS.y and by Malwarebytes as Trojan.Agent. Note - this is not a legitimate Adobe entryNo
JavaUpdateXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Trojan.Agent. The file is located in %AppData%\InstallDirNo
JavaupdateXserver.exeDetected by McAfee as RDN/Generic.dx!d2x and by Malwarebytes as Backdoor.Agent.SVR. The file is located in %Windir%\ladmsNo
killXserver.exeDetected by Malwarebytes as Trojan.Backdoor.SVR. The file is located in %Windir%No
Microsoft.ExeXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
BRUNOXServer.exeDetected by McAfee as RDN/Generic BackDoor!rv and by Malwarebytes as Backdoor.Agent.ENo
Microsoft.ExeXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %System%\Sistem32No
svchXserver.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.SVRNo
DropboxXServer.exeDetected by McAfee as RDN/Generic PWS.y!ta and by Malwarebytes as Backdoor.Agent.SVR. Note - this is not a legitimate Dropbox entryNo
AVGXserver.exeDetected by Malwarebytes as Backdoor.Agent.SVRGen. The file is located in %ProgramFiles%\installNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AllUsersStartup%\installNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\installNo
HKCUXServer.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\InstallDirNo
xtnbTaRjJOa6JYXServer.exeDetected by McAfee as RDN/Ransom!ec and by Malwarebytes as Backdoor.Agent.RNDNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %AppData%\svchost.exeNo
pcServerXserver.exeSsppyy spywareNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\installNo
HKCUXServer.exeDetected by Kaspersky as Backdoor.Win32.Xtreme.bid and by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\InstallDirNo
Windows UpdateXserver.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\MSNNo
HKCUXserver.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %ProgramFiles%\system32 - see hereNo
PluginXServer.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
RunProgXServer.exeDetected by Trend Micro as BKDR_OPTIX.04.A and by Malwarebytes as Trojan.AgentNo
WinSecXserver.net.exeDetected by Dr.Web as Trojan.DownLoader5.6137No
HKCUXserver.scrDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\installNo
HKLMXserver.scrDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\installNo
PoliciesXserver.scrDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\installNo
winserverXServer.txt.vbsDetected by Trend Micro as WORM_DELTAD.ANo
serverexXServer.txt.vbsDetected by Trend Micro as WORM_DELTAD.ANo
server.vbeXserver.vbeDetected by Malwarebytes as Trojan.Agent.VBS. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ZtgServerSwitchXserver.vbsZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spywareNo
Server BackboneXserver05.exeAdded by the RBOT-ZM WORM!No
QUEMAJUNBINOPOLISXServer1.exeDetected by McAfee as Generic VB.n and by Malwarebytes as Backdoor.AgentNo
Windows DefenderXServer1.exeDetected by McAfee as Generic Dropper.acj and by Malwarebytes as Trojan.Agent.GenNo
Server201112RXServer201112R.exeDetected by Sophos as Troj/DotNet-G and by Malwarebytes as Backdoor.BotNo
HKCMXserver32.exeDetected by Malwarebytes as Wor.Rebhip. The file is located in %System%\LargeNo
HKLMXserver32.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\LargeNo
PoliciesXserver32.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\LargeNo
Server4PCYServer4PC.exeSatellite receiver control program that is responsible for handling TV, radio and internet - on systems from TechniSat for exampleNo
Windows DefendersXserver4test111.exeDetected by McAfee as RDN/Generic.bfr!faNo
WindowsAPI.DLLXServer5.exeDetected by Pest Patrol as Fear and HopeNo
AudioClientXserverb.exeDetected by Malwarebytes as Trojan.Agent.Gen. The file is located in %AppData%No
serverCXserverC.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.Agent.RBNo
[random]XServere.exeAdded by the LEGMIR-AQM TROJAN!No
HKCU OKOKOXservero.exeDetected by McAfee as Generic PWS.diNo
HKLM OOKOXservero.exeDetected by McAfee as Generic PWS.diNo
PoliciesXservero.exeDetected by McAfee as Generic PWS.di and by Malwarebytes as Backdoor.Agent.PGenNo
HKCUXServers.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\InstallDir - see hereNo
HKLMXServers.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Windir%\InstallDir - see hereNo
AudioClientXservertest.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %AppData%No
ServerxXServerx.exeDetected by Total Defense as Win32/Madangel Family and by Malwarebytes as Virus.Madang. The file is located in %System%No
serverx.exeXserverx.exeDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
PoliciesXserverz.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Windir%\installNo
Server_1.exeXServer_1.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ContainerXServer_latest.exeDetected by Dr.Web as Trojan.AVKill.32680 and by Malwarebytes as Trojan.Agent.AVKNo
Server_protected.exe2XServer_protected.exeDetected by McAfee as RDN/Generic Dropper and by Malwarebytes as Backdoor.XTRat.ENo
uberkXserver_ready.exeDetected by Dr.Web as Trojan.MulDrop5.34182 and by Malwarebytes as Trojan.Agent.RTNo
javaservuXserves.exeDetected by McAfee as RDN/Generic PWS.y!b2i and by Malwarebytes as Backdoor.Agent.ENo
SearchNet_UpXServeUp.exeSearchNet adwareNo
windowsXserveurr.exeDetected by Malwarebytes as Trojan.Agent.SVR. The file is located in %AppData%No
WinServHostXservhost.exeDetected by Symantec as Trojan.Yorasa and by Malwarebytes as Trojan.Agent.ENo
servi.exeXservi.exeDetected by Dr.Web as Trojan.KillFiles.9383 and by Malwarebytes as Trojan.Cossta. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
servi.exeXservi.exeDetected by Dr.Web as Trojan.MulDrop5.58936 and by Malwarebytes as Trojan.Cossta. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
run windowsXservic.batDetected by McAfee as Reboot-APNo
Sygate Personal Firewall StartXservic.exeDetected by Sophos as W32/Rbot-RYNo
Microsoft Update 32Xservic.exeDetected by Sophos as W32/Rbot-AXN and by Malwarebytes as Backdoor.BotNo
Microsoft .Net FrameworkXservic.exeDetected by Sophos as Troj/Agent-GUUNo
A_Studio™3Xservicas.exeDetected by Dr.Web as Win32.HLLW.Autoruner1.51974 and by Malwarebytes as Worm.AutoItNo
WINDOWS SYSTEMnXservicces.exeDetected by Sophos as W32/Mytob-ELNo
services.exeXservice.batDetected by Sophos as Troj/Mdrop-BSWNo
Windows ScreensaverXService.exeAdded by the KELVIR.P WORM!No
Microsoft ServiceXservice.exeDetected by Sophos as W32/IRCBot-XX and by Malwarebytes as Backdoor.RbotNo
RunServicesXservice.exeDetected by Symantec as W32.VebispNo
RunServicesXservice.exeDetected by Symantec as W32.Vebisp and by Malwarebytes as Worm.VBNo
Windows Updates SvcsXservice.exeDetected by Dr.Web as BackDoor.IRC.Bot.1050 and by Malwarebytes as Backdoor.Bot.E.GenericNo
Audio DriverXservice.exeDetected by McAfee as RDN/Generic PWS.y!yp and by Malwarebytes as Trojan.Agent.ENo
WinNT 32Xservice.exeDetected by Dr.Web as Trojan.DownLoader9.46504 and by Malwarebytes as Backdoor.Agent.ENo
Services DefenseXservice.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\MozillaNo
HKCUXservice.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %Root%\Restore\acounts\AllNo
Microsoft UpdateXservice.exeDetected by McAfee as Exploit-DcomRpc.gen and by Malwarebytes as Backdoor.BotNo
WinDLL (service.exe)Xservice.exeDetected by Kaspersky as Email-Worm.Win32.Agent.bx and by Malwarebytes as Backdoor.Bot.E.Generic. The file is located in %Windir%No
Microsoft UpdatesXservice.exeDetected by Kaspersky as Backdoor.Win32.Poison.hpt and by Malwarebytes Anti-Malware as Backdoor.Bot. The file is located in %System%No
SecurenetXservice.exeDetected by Malwarebytes as Spyware.Keylogger. The file is located in %Root%\Drivers\chipsetNo
WinPatrolXservice.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not a legitimate WinPatrol entry and the file is located in %Windir%\services\rc0No
Windows Net CfgXservice.exeAdded by a variant of Backdoor:Win32/RbotNo
Registry Value NameXservice.exeDetected by Sophos as W32/Rbot-AHT and by Malwarebytes as Backdoor.BotNo
ConfigXservice.exeDetected by Symantec as W32.Israz.B@mm and by Malwarebytes as Backdoor.BotNo
smss32winxXservice.exeDetected by McAfee as w32/sober.j@mm and by Malwarebytes as Backdoor.BotNo
ImagXservice.exeDetected by Malwarebytes as Trojan.FakeMS. The file is located in %Windir%\systemNo
MDNSXservice.exeMirar adware variantNo
Messenger ServiceXservice.exeDetected by Sophos as Troj/Dloadr-BVG and by Malwarebytes as Backdoor.Bot.E.GenericNo
Windows ServiceXservice.exeDetected by Sophos as W32/IRCbot-ACV and by Malwarebytes as Backdoor.Bot.E.GenericNo
serviceXservice.exeDetected by Kaspersky as Worm.Win32.Bybz.cza and by Malwarebytes as Worm.AutoRun. The file is located in %AppData%\MicrosoftNo
serviceXservice.exeDetected by Dr.Web as Trojan.DownLoader6.9646 and by Malwarebytes as Trojan.VB.Agent. The file is located in %AppData%\serviceNo
serviceXservice.exeDetected by Sophos as Troj/Agent-FPO and by Malwarebytes as Trojan.Agent. The file is located in %System%No
ServiceXService.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%\SystemFiles - see hereNo
ServiceXservice.exeDetected by Sophos as W32/Autorun-CBB and by Malwarebytes as Worm.AutoRun. The file is located in %UserTemp%\oldiesNo
Windows TaskmanagerXservice.exeDetected by Microsoft as Worm:Win32/Pushbot.ORNo
ServiceXService.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %UserTemp%\serviceNo
ServiceXService.exeDetected by Sophos as W32/Kelvir-BI and by Malwarebytes as Backdoor.Bot.E.Generic. The file is located in %Windir%No
Microsoft CorpoXservice.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%No
systr2XSERVICE.exeDetected by Sophos as W32/VB-DQY and by Malwarebytes as Backdoor.BotNo
AdobeReaderProXservice.exeDetected by Sophos as W32/Rbot-BCA and by Malwarebytes as Backdoor.BotNo
Service ControllerXservice.exeDetected by Symantec as Trojan.Prevert and by Malwarebytes as Backdoor.BotNo
Win32 USB2.0 DriverXservice.exeDetected by Sophos as W32/Sdbot-QF and by Malwarebytes as Backdoor.BotNo
Windows Logon ServiceXservice.exeDetected by Sophos as W32/Rbot-GAGNo
VMGOATPOSTREBOOTANALYSISXservice.exeDetected by McAfee as Scar.gen.c and by Malwarebytes as Trojan.AgentNo
Windows_SerivceXSERVICE.exeDetected by Trend Micro as WORM_WOOTBOT.AHNo
Windows svchostXservice.exeDetected by Microsoft as Worm:Win32/Pushbot.DU and by Malwarebytes as Backdoor.Bot.E.GenericNo
service managerXservice.exeDetected by Trend Micro as TROJ_DONBOMB.A and by Malwarebytes as Backdoor.Bot.E.GenericNo
MicrosoftXservice.exeDetected by McAfee as Generic.bfr!eh and by Malwarebytes as Worm.AutoRunNo
antivirusXservice.exeDetected by Dr.Web as Trojan.Inject1.19802 and by Malwarebytes as Trojan.Agent.AVNo
Configuration LoaderXService.exeDetected by Symantec as W32.HLLW.Gaobot.AO and by Malwarebytes as Backdoor.BotNo
DellSCNservice.exeDell Solution Center - web-based educational and troubleshooting toolNo
Service ProcessXservice.exeDetected by Sophos as Troj/Dcmbot-C and by Malwarebytes as Backdoor.AgentNo
MSN BETAXservice.exeDetected by Trend Micro as WORM_RBOT.AUUNo
r_serverXservice.exeDetected by Sophos as Troj/Multidr-CP and by Malwarebytes as Backdoor.BotNo
WindowsServiceXservice.exeDetected by Sophos as W32/Autorun-VPC and by Malwarebytes as Backdoor.Bot.E.GenericNo
System ServiceXService.exeDetected by Dr.Web as Trojan.Inject.63084 and by Malwarebytes as Worm.AutoRunNo
Service.exeXService.exeDetected by Malwarebytes as Trojan.Agent.E. Note - this entry loads from HKCU\Run and the file is located in %AppData%No
service.exeXservice.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\Scansoft - see hereNo
itunes.exeXService.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Temp%\AppLaunchNo
service.exeXservice.exeDetected by Malwarebytes as Trojan.Agent. Note - this entry loads from HKLM\Run and HKCU\Run and the file is located in %Temp%No
12ZFG94-F641-2SF-K31P-5N1ER6H6L2Xservice.exeDetected by Trend Micro as WORM_SILLY.LC and by Malwarebytes as Worm.AutoRun.GenNo
service.exeXservice.exeDetected by Malwarebytes as Spyware.Passwords. Note - this entry loads from HKCU\Run and the file is located in %UserProfile%\DesktopNo
service.exeXservice.exeDetected by Kaspersky as Trojan-GameThief.Win32.Batist.bjh and by Malwarebytes as Trojan.Agent.SVRGen. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Service.exeXService.exe"servedby.advertising" popup generatorNo
System Service ApplicationXservice.exeDetected by McAfee as Generic.dx!zsg and by Malwarebytes as Backdoor.Bot.E.GenericNo
WindowsServicesXservice.exeDetected by Symantec as W32.Folmess and by Malwarebytes as Backdoor.AgentNo
runlogxXservice.exeDetected by McAfee as w32/sober.j@mm and by Malwarebytes as Backdoor.BotNo
SYS_CLEANXService.exeDetected by Symantec as W32.HLLW.FlopcopyNo
Microsoft Security Monitor ProcessXservice.exeDetected by McAfee as W32/Sdbot.worm and by Malwarebytes as Backdoor.Bot.E.Generic. The file is located in %Windir%No
MS BitDefenderXservice.exeDetected by Malwarebytes as Spyware.Agent. The file is located in %AppData%\BitLockerNo
PoliciesXservice.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %Root%\Restore\acounts\AllNo
PoliciesXservice.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\MicrosoftNo
servicemngXservice.exeDetected by Sophos as W32/Tame-C and by Malwarebytes as Backdoor.BotNo
Windows ServicesXservice.exeDetected by Symantec as W32.Randex.R and by Malwarebytes as Backdoor.Agent.GenNo
ServicesXservice.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%No
MyappXservice.exeHomepage hijackerNo
Windows UpdateXservice.exeDetected by McAfee as Generic.dx!bbdz and by Malwarebytes as Trojan.Agent.ENo
Clean upXservice.exe cleanup.batDetected by Sophos as Troj/Agent-FPYNo
Windows smss serviceXservice.exe smss.exeDetected by Sophos as Troj/Agent-FPYNo
ShellXService.exe,explorer.exeDetected by Malwarebytes as Hijack.ShellA.Gen. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "Service.exe" (which is located in %AppData%\Windows)No
SERVICE.PACK####.exeXSERVICE.PACK####.exeDetected by Malwarebytes as Backdoor.Agent.E - where # represents a digit. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows starts - see examples here and hereNo
ServiceXService.pifDetected by Sophos as W32/Assiral-CNo
Service2XService2.exeIdentified as a variant of the Win32.Iroffer malware. Located in %Windir%\Drivers\IntelNo
Windows ServicesXservice2.exeDetected by Sophos as Mal/VB-ZH and by Malwarebytes as Backdoor.BotNo
Windows UpdateXservice2.exeDetected by Sophos as Mal/VB-ZHNo
Kernel ServicesXservice32.exeDetected by Sophos as Troj/Prx-BNo
Microsoft Service ManagerXservice32.exeAdded by a variant of W32.IRCBot. The file is located in %System%No
6G98D2X74VXservice32.exeDetected by Kaspersky as Trojan-Downloader.Win32.Murlo.in and by Malwarebytes as Trojan.Agent.RND. The file is located in %Windir%No
service32Xservice32.exeDetected by Sophos as W32/Agobot-STNo
ICU-SuckerXService32.exeDetected by Kaspersky as Trojan-Notifier.Win32.IllNotifier.d. The file is located in %Windir%No
ToxicUpdateXservice32.exeDetected by McAfee as RDN/Generic.bfr!fb and by Malwarebytes as Backdoor.Agent.TXNo
MS Security HotfixXservice5.exeDetected by Symantec as W32.HLLW.Gaobot.AGNo
SERVICEXSERVICE5.exeDetected by Symantec as W32.BakainNo
loadXSERVICE5.exeDetected by Symantec as W32.Bakain. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "SERVICE5.exe" (which is located in %System%\System32\tkZ16Fk)No
Configuration LoaderXSERVICE5.exeDetected by Symantec as W32.HLLW.Gaobot.AF and by Malwarebytes as Backdoor.BotNo
Serve UserXSERVICE5.exeDetected by Symantec as W32.BakainNo
pushbotXservice52.exeAdded by a variant of Worm:Win32/Pushbot - a family of worms that spread using MSN MessengerNo
Service64.exeXService64.exeDetected by Malwarebytes as Trojan.Injector.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
QGuan10in1Uservice72564.exeDetected by Malwarebytes as PUP.Optional.UpUpdata. The file is located in %AppData%\UPUpdata. If bundled with another installer or not installed by choice then remove itNo
vnetXservice86.exeDetected by Malwarebytes as Trojan.Agent.UKN. The file is located in %Root%No
QGuan10in12Uservice90132.exeDetected by Malwarebytes as PUP.Optional.UpUpdata. The file is located in %AppData%\UPUpdata. If bundled with another installer or not installed by choice then remove itNo
Windows svchostXserviceaaa.exeDetected by Microsoft as Worm:Win32/Pushbot.ER and by Malwarebytes as Backdoor.IRCBotNo
Windows svchostXserviceam.exeDetected by Microsoft as Worm:Win32/Pushbot.EY and by Malwarebytes as Backdoor.IRCBotNo
Windows svchostXservicean.exeDetected by Kaspersky as Trojan.Win32.Agent.afxl and by Malwarebytes as Backdoor.IRCBot. The file is located in %Windir%No
WinLsassXservicec.exeDetected by Symantec as W32.ScaneNo
BredbandsbolagetYservicecenter.exeServicecenter for broadband services provided by the Swedish ISP BredbandsbolagetNo
ServicecenterYServicecenter.exeServicecenter for broadband services provided by the Swedish ISP BredbandsbolagetNo
serviceconnectXserviceconnect.exeDetected by Trend Micro as WORM_AGOBOT.AIRNo
winservicexXservicedata.exeDetected by Malwarebytes as Worm.Agent. The file is located in %System%No
WindowsServicesHXservicedhs.exeDetected by Sophos as W32/Agobot-JDNo
Windows OS ServicesXservicedll.exeDetected by Dr.Web as Trojan.Coinbit.25 and by Malwarebytes as Trojan.Agent.MNRNo
WindowsOS ServicesXservicedll.exeDetected by Dr.Web as Trojan.Coinbit.22 and by Malwarebytes as Trojan.Agent.MNRNo
Microsoft DLL ServiceXservicedll.exeDetected by Microsoft as Worm:Win32/Slenfbot.EDNo
WLSXServiceDownLoader.exeDetected by McAfee as RDN/Generic Downloader.x!kz and by Malwarebytes as Trojan.Downloader.WLSNo
SkypeXservicees.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\MicrosoftNo
PoliciesXservicees.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\MicrosoftNo
AudioXservicees.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\MicrosoftNo
WindowsMediaPlayerXserviceFire.exeDetected by McAfee as RDN/Generic Dropper and by Malwarebytes as Backdoor.Agent.WMGenNo
ServiceGKXServiceGK.exeDetected by McAfee as RDN/Generic.tfr!eb and by Malwarebytes as Trojan.Agent.IGXNo
Windows UpdaterXServiceHost.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %Windir%No
Windows Service ExecXServiceLayer.exeDetected by Sophos as W32/Spybot-OI. Note - do not confuse this with the Nokia service of the same name which resides in %CommonFiles%\PCSuite\Services or %ProgramFiles%\PC Connectivity Solution. This one is located in %Windir%No
servicelayerXservicelayer.exeDetected by McAfee as FakeAlert-DA and by Malwarebytes as Trojan.PasswordStealer. Note - do not confuse this with the Nokia service of the same name which resides in %CommonFiles%\PCSuite\Services or %ProgramFiles%\PC Connectivity Solution. This one is located in %Windir%No
jmesoft?ServiceLoader.exeInstalled on some IBM/Lenovo computers that have JME keyboards. The file is located in %Windir%\jmesoftNo
USB DeviceXservicelog.exeDetected by Trend Micro as WORM_WOOTBOT.CBNo
Wind Logd FileXservicelogd.exeAdded by a variant of Backdoor:Win32/Rbot. The file is located in %System%No
Intel AppUp(SM) centerUserviceManager.lnkThe Intel AppUp® center delivers all the latest PC apps, all in one convenient place. With tons of apps from functional to fun-there's no better place to get more out of your PC than the Intel AppUp® center." Required if you want to use apps installed by Intel AppUp, otherwise the DRM built into the store software will not allow you to access without this process or AppUp.exe running. No longer supportedNo
Service ManagerXserviceManager.scrDetected by Malwarebytes as Worm.Passma. The file is located in %UserTemp%No
Service ManagerXSERVICEMGR.EXEDetected by Sophos as W32/PassMail-D and by Malwarebytes as Worm.PassmaNo
Microsoft Servicez ManagerXservicemgrz.exeDetected by Sophos as W32/Rbot-ASNNo
System ServiceXservicent.exeDetected by Sophos as W32/Rbot-AJVNo
MicrosoftXP Service Pack 2Xservicepack2.exeDetected by Trend Micro as WORM_RBOT.NGNo
[various names]XServiceprocess.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
System Service HostXServicer.exeDetected by McAfee as RDN/Generic.bfr!ic and by Malwarebytes as Trojan.Agent.SSHNo
ServiceXServicerun.exe Service.exeDetected by Dr.Web as Trojan.DownLoader10.2304 and by Malwarebytes as Worm.AutoRunNo
SVEEHOSTXservicesDetected by Malwarebytes as Backdoor.AgentNo
SVEEHOST.EXEXservicesDetected by Malwarebytes as Backdoor.AgentNo
services.batXservices.batDetected by Malwarebytes as Trojan.Agent.BAT.Generic. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Windows ServicesXservices.batDetected by McAfee as RDN/Generic.dx!ctt and by Malwarebytes as Backdoor.BotNo
Services MultimediaXServices.comDetected by McAfee as RDN/PWS-Banker!cv and by Malwarebytes as Trojan.Banker.ENo
Services SoundXServices.comDetected by McAfee as RDN/PWS-Banker!cv and by Malwarebytes as Trojan.Banker.ENo
ServivesXServices.comDetected by Malwarebytes as Trojan.Banker.E. The file is located in %System%\driversNo
WindowsNT ServicesXServices.comDetected by BitDefender as the DELF.OFC TROJAN! See hereNo
ServicesXServices.comDetected by McAfee as RDN/PWS-Banker!cv and by Malwarebytes as Trojan.Banker.ENo
ServicesXservices.exeDetected by McAfee as RDN/Generic.dx!cqk and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "drivers" sub-folderNo
Windows UpdateXservices.exeDetected by Malwarebytes as Worm.Brontok. The file is located in %AppData%No
MSOfficeXservices.exeDetected by Sophos as Troj/Dloader-EU. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in an "MSOffice" sub-folderNo
servicesXservices.exeDetected by McAfee as Generic.bfr!dq and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "services" sub-folderNo
servicesXservices.exeDetected by Kaspersky as Backdoor.Win32.Poison.cdxd and by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "Win32\Services" sub-folderNo
servicesXservices.exeDetected by Dr.Web as Trojan.DownLoader10.4179 and by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %UserProfile%\AppData\RoamingNo
ServicesXservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one loads from the HKCU\RunOnce key and is located in %Windir%No
ServicesXservices.exeDetected by Symantec as W32.Mydoom.M@mm and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one loads from the HKLM\Run key and is located in %Windir%No
ServicesXServices.exeDetected by Symantec as Trojan.Syginre. Note - this is not the legitimate services.exe process which is always located in %System%. This one loads from the HKLM\RunServices key and is located in %Windir%No
servicesXservices.exeDetected by Dr.Web as Trojan.DownLoader8.12440 and by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
KernelXservices.exeDetected by Sophos as Troj/Fooz-A and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
runservicesXservices.exeDetected by McAfee as BackDoor-DUM. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
MketaXservices.exeDetected by McAfee as Generic.dx!zbk and by Malwarebytes as Trojan.Downloader. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
ttplayXservices.exeDetected by Malwarebytes as Trojan.ChinAd. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %CommonFiles%\TencentNo
Microsoft Service ControllerXservices.exeDetected by Sophos as W32/Kalel-D. Note - this is not the legitimate services.exe processNo
PlutoXservices.exeDetected by Dr.Web as Trojan.StartPage.44997. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Templates%No
System Update2Xservices.exeDetected by Sophos as Troj/Autotroj-C. Note - this is not the legitimate services.exe process which is always located in %System%No
wservicezXservices.exeDetected by Malwarebytes as Backdoor.IRCBot. The file is located in %AppData%\MicrosoftNo
_SystemBootXservices.exeDetected by Sophos as Troj/Sober-Q. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\Help\HelpNo
AutoAdministratorXSERVICES.EXEDetected by Sophos as W32/Punya-A. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Root%\Application Data\WINDOWSNo
Services Control ManagerXservices.exeDetected by Sophos as Troj/Delf-CGI. Note - this malware replaces the legitimate services.exe process which is always located in %System%No
_WinCheckXservices.exeDetected by Symantec as W32.Sober.V@mm and by Malwarebytes as Email.Worm.SB. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\ConnectionStatus\MicrosoftNo
_WinDataXservices.exeDetected by Sophos as W32/Sober-AD. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\PoolDataNo
Services ControllerXservices.exeDetected by Sophos as Troj/Ciadoor-F and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
_WindowsXservices.exeDetected by Symantec as W32.Sober.X. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\WinSecurityNo
_WinINetXservices.exeDetected by McAfee as W32/Sober.r@MM. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\ConnectionStatusNo
Spooler de ImpressXservices.exeDetected by Sophos as Troj/Agent-NEX and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %UserProfile%No
_WinStartXservices.exeDetected by Symantec as W32.Sober.O@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\Connection Wizard\StatusNo
Spooler de ImpressãoXservices.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %UserProfile%No
Services LogonXservices.exeDetected by Symantec as W32.Crowt.A@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Templates%No
Microsoft ServicesXservices.exeDetected by Symantec as Backdoor.Alets and by Malwarebytes as Backdoor.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
HKCUXservices.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "services32" sub-folderNo
Microsoft Updater v2Xservices.exeDetected by Sophos as W32/AutoRun-BCI and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\MicrosoftNo
Services NetworkXServices.exeDetected by Sophos as W32/Swisyn-E. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
Services ProcessXservices.exeSpyware - detected by Kaspersky as the SMALL.X TROJAN! Note - this is not the legitimate services.exe processNo
Services StartupXservices.exeDetected by Symantec as W32.Crowt.A@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %CommonFiles%No
upDpacketoXservices.exeDetected by Sophos as W32/Nafbot-A and by Malwarebytes as Worm.P2P. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Microsoft UpdatesXservices.exeDetected by Malwarebytes as Backdoor.Bot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %UserTemp%No
WSVCSUSERVICES.EXEWSLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a WALI\SVCS sub-directoryNo
{357AA41A-B7A8-4632-A27D-5B980B25CF43}Xservices.exeFakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in the "inetsrv" sub-folderNo
services.exeXservices.exeDetected by McAfee as Trojan.DownLoader7.20426 and by Malwarebytes as Trojan.Startup. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
GlitchInstrumentationXServices.exeDetected by Dr.Web as Trojan.Siggen2.45813No
services.exeXservices.exeDetected by Malwarebytes as Backdoor.Agent.E. Note - this entry loads from the HKCU\Run key and it is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
services.exeXservices.exeDetected by Malwarebytes as Worm.Brontok. Note - this entry loads from the HKLM\Run key and it is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
services.exeXservices.exeDetected by Malwarebytes as Trojan.VBKrypt. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir% and loads from the HKLM\Run keyNo
Services.EXEXservices.exeDetected by Symantec as W32.HLLW.Kazping. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir% and loads from the HKLM\Run & HKLM\RunServices keysNo
Services++Xservices.exeDetected by Symantec as W32.SillyFDC.BDM. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Recycled%No
TEXTCONVXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
MS Service ManagerXservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Temp% - see hereNo
Microsoft Windows Update ClientXservices.exeDetected by McAfee as W32/Autorun.worm.gen and by Malwarebytes Anti-Malware as Trojan.MWF.Gen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
[system]Xservices.exeDetected by Kaspersky as P2P-Worm.Win32.Socks.oi and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "drivers" sub-folderNo
SysServiceUSERVICES.EXENSKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %ProgramFiles%\NSkeyloggerNo
ServicesAdministratorXSERVICES.EXEDetected by Sophos as W32/Punya-B and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %LocalAppData%\WINDOWSNo
SysServicesXSERVICES.EXEDetected by Sophos as Troj/Delf-EY and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
scssrr.exeXServices.exeDetected by Sophos as Troj/VB-EMX and by Malwarebytes as Backdoor.Agent.ENo
MSWUpdateXservices.exeDetected by Sophos as Troj/VB-FDP and by Malwarebytes as Trojan.Agent.Gen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
RPCser32gXservices.exeDetected by Sophos as W32/Ritdoor-B and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
[3-4 random letters]Xservices.exeDetected by Symantec as Adware.PurityScan - also see the archived version of Andrew Clover's page. Note - this is not the legitimate services.exe process which is always located in %System%No
RPCser32g1Xservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
BuildLabXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
RPCser32g3Xservices.exeDetected by Trend Micro as BKDR_PREXOT.D and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Local ServiceXservices.exeDetected by Sophos as W32/P2Pworm-T and by Malwarebytes as Backdoor.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\CursorsNo
RPCser32g4Xservices.exeDetected by Trend Micro as BKDR_PREXOT.E and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
RPCserv32Xservices.exeDetected by Symantec as W32.Mydoom.AL@mm and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Windows ServiceXservices.exeDetected by Sophos as W32/Kalel-A. Note - this is not the legitimate services.exe processNo
RPCserv32gXSERVICES.EXEDetected by Trend Micro as WORM_BOBAX.AD. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Windows LoginXServices.exeDetected by McAfee as Generic.dx!wyl and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Root%No
MSN32Xservices.exeDetected by McAfee as Generic PWS.y. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\msappsNo
Flash MediaXservices.exeDetected by Symantec as Backdoor.IRC.Bot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %UserTemp%No
ServiceXservices.exeDetected by McAfee as RDN/Generic.dx!cqk and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "drivers" sub-folderNo
Microsoft Visual SourceSafeXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
MicrosoftsXservices.exeDetected by Dr.Web as Trojan.Inject.62622 and by Malwarebytes as Backdoor.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\MicrosoftsNo
Srv32WinXservices.exeDetected by Trend Micro as TROJ_DLOADER.UEF and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %ProgramFiles%No
TaskhostXservices.exeDetected by Dr.Web as Trojan.Packed.23496 and by Malwarebytes as Trojan.Buterat. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
srvcXServices.exeDetected by Malwarebytes as Worm.Brontok. The file is located in %AppData%No
msservicesXservices.exeMsnSpyMaster surveillance software. Uninstall this software unless you put it there yourself! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in an "msystem" sub-directoryNo
WinCheckXservices.exeAdded by the SOBER.S WORM! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\ConnectionStatus\MicrosoftNo
Windows Logon ApplicationXservices.exeDetected by Sophos as Troj/Ciadoor-L and by Malwarebytes as Backdoor.Bot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Microsoft Win32 Process Host ServiceXservices.exeDetected by Dr.Web as Trojan.DownLoader9.40994 and by Malwarebytes as Trojan.Agent.MWE. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
GolumXservices.exeAdded by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe processNo
BaRloNdDiLhepXservices.exeDetected by Trend Micro as WORM_AUTORUN.CBQ. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "~A~m~B~u~R~a~D~u~L~²" sub-folderNo
golummXservices.exeDetected by Sophos as Troj/Dloader-ET. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "golumm" sub-folderNo
SuperBar.ComponentXservices.exeAdded by the SMALL-AQ TROJAN! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in the "inetsrv" sub-folderNo
LiveUpdate32Xservices.exeDetected by McAfee as PWCrack-Winspy!c. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\isasNo
AutoUpdate32Xservices.exeDetected by McAfee as PWCrack-WinSpy. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\debug64No
Microsoft WindowsXservices.exeDetected by Malwarebytes as Backdoor.IRCBot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
Windows PoliciesXservices.exeDetected by Malwarebytes as Backdoor.Agent.SRV. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\security\servicesNo
sservicesXservices.exeSpyOnePro spyware. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %System%\sopdirNo
Torjan ProgramXservices.exeAdded by the AUTEX.C WORM! Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Windows Service ControllerXservices.exeDetected by Sophos as W32/Kalel-B. Note - this is not the legitimate services.exe processNo
Windows DesktopXservices.exeDetected by Sophos as Troj/DwnLdr-JAN and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
xp_systemXservices.exeDetected by Sophos as Troj/Krepper-N and variants and by Malwarebytes as Trojan.Downloader. Note - this is not the legitimate services.exe process which is always located in %System%. The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant, examples are 10066, 20001, 20088No
winsrv3Xservices.exeDetected by Sophos as W32/Nafbot-A and by Malwarebytes as Worm.P2P. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Windows Service HostXservices.exeDetected by Sophos as Mal/Autorun-BB and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\microsoftNo
systemXservices.exeDetected by Sophos as Troj/Delf-LQ and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\HELPNo
 WinCheckXservices.exeDetected by Symantec as W32.Sober.V@mm and by Malwarebytes as Email.Worm.SB. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\ConnectionStatus\Microsoft and note the space at the beginning of the "Startup Item" fieldNo
sysinitXservices.exeDetected by Sophos as Troj/NewIfrm-A. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %System%\golummNo
 WinDataXservices.exeDetected by Sophos as W32/Sober-AD. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\PoolData and note the space at the beginning of the "Startup Item" fieldNo
 WindowsXservices.exeDetected by Symantec as W32.Sober.X. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\WinSecurity and note the space at the beginning of the "Startup Item" fieldNo
Windows Update ServiceXservices.exeDetected by Malwarebytes as Backdoor.Agent.SRV. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\security\servicesNo
 WinINetXservices.exeDetected by McAfee as W32/Sober.r@MM. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\ConnectionStatus and note the space at the beginning of the "Startup Item" fieldNo
 WinStartXservices.exeDetected by Symantec as W32.Sober.O@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\Connection Wizard\Status and note the space at the beginning of the "Startup Item" fieldNo
DHCP32Xservices.exeDetected by Kaspersky as Trojan-Spy.Win32.WinSpy.ag. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\displayNo
Norton Auto-ProtectXSERVICES.exeDetected by Symantec as W32.Ahker.B@mm and by Malwarebytes as Trojan.Agent. Note - this is no part of Norton AV and this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
WINDQ32_TRLVXservices.exeDetected by McAfee as Generic VB.z and by Malwarebytes as Trojan.Downloader. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %ProgramFiles%\Winqows PublrlvNo
ComMessenger32Xservices.exeDetected by Dr.Web as Trojan.PWS.Siggen.40403 and by Malwarebytes as Backdoor.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\dataNo
MqutaXservices.exeDetected by Malwarebytes as Trojan.Downloader. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
ccAppsXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
FriendlyTypeNameXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
Amie Release V6.9DXservices.exeDetected by Sophos as Troj/VB-EAN and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
PagefileManagerXservices.exeDetected by Dr.Web as BackDoor.Poison.9892 and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Root%\Pagefile System VolumeNo
winupdaterXservices.exeDetected by Malwarebytes as Trojan.Reconyc. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\Microsoft\Windows\Start Menu\Programs\Windows (10/8/7/Vista) or %UserProfile%\Start Menu\Programs\Windows (XP)No
execXservices.exeDetected by Sophos as Mal/Agent-ZJ and by Malwarebytes as Trojan.Clicker. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\fontsNo
Service[UserName]XSERVICES.EXEDetected by Sophos as W32/Brontok-BH. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %LocalAppData%\WINDOWSNo
HKLMXservices.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "services32" sub-folderNo
XpsystemXSERVICES.EXEDetected by Trend Micro as TROJ_DAEMOZ.A. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %System%\SERVICESNo
xpsystemXservices.exeCoolWebSearch parasite variant. Note - this is not the legitimate services.exe processNo
AdRotator.ApplicationXservices.exeFakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in the "inetsrv" sub-folderNo
ServiceAdministratorXSERVICES.EXEDetected by Symantec as W32.Korron.B. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %LocalAppData%\WINDOWSNo
SERVICEADMINISTRATOR.[ComputerName]XSERVICES.EXEDetected by McAfee as Generic VB.i and by Malwarebytes as Trojan.FakeAlert. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %LocalAppData%\WINDOWSNo
RegDoneXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
DDXPPXCEXservices.exeDetected by Sophos as Mal/Autorun-AH and by Malwarebytes as Trojan.ClickerNo
DDXPPXFTPXservices.exeDetected by Dr.Web as Trojan.MulDrop4.54521 and by Malwarebytes as Trojan.Agent.ENo
Microsoft (R) Windows Protected Content Restoration ServiceXservices.exeDetected by Trend Micro as BKDR_AGENT.AGV. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\etcNo
NetXservices.exeDetected by Sophos as Troj/Bravo-C and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
ServiceControlAppXservices.exeDetected by Symantec as W32.SillyFDC.BDO. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Root%No
ServiceeXservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %UserTemp%No
Microsoft (R) Windows TCP/IP Socket LayerXservices.exeDetected by Trend Micro as BKDR_RBOT.ARM. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\winsockNo
ConfigVirXservices.exeDetected by Sophos as W32/Autorun-DV. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a ~A~m~B~u~R~a~D~u~L~ sub-folderNo
SchedulerXservices.exeDetected by Malwarebytes as Worm.Brontok. The file is located in %AppData%No
WMAudioXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
Mirosoft ServicesXservices.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.Agent.WMS. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Templates%\Microsoft ServicesNo
PoliciesXservices.exeDetected by Malwarebytes as Backdoor.Agent.PGen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "services32" sub-folderNo
ServiceMonitorXservices.exeDetected by McAfee as RDN/Generic.dx!cwf and by Malwarebytes as Trojan.Agent.BCA. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
PoliciesXservices.exeDetected by Malwarebytes as Backdoor.Agent.PGen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\installNo
WindowsXservices.exeDetected by Sophos as Troj/Dloadr-GW. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in a "Windows" sub-folderNo
WindowsXservices.exeDetected by Sophos as W32/Sober-Z. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\WinSecurityNo
Windows ServicesXservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\Windows ServicesNo
NTSet32Xservices.exeDetected by Sophos as Troj/WinSpy-C. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\dll32No
Windows ServicesXservices.exeDetected by Sophos as Troj/Agent-MVC and by Malwarebytes as Backdoor.Agent.Gen. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
Microsoft Security ServiceXservices.exeDetected by Malwarebytes as Backdoor.Agent.SRV. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\security\servicesNo
runXservices.exeDetected by Sophos as Troj/Krepper-N and variants and by Malwarebytes as Trojan.Downloader. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\inet10066No
HTMLXServices.exeDetected by Trend Micro as WORM_SILLY.GS and by Malwarebytes as Trojan.Agent. The file is located in %Windir%\ProFileNo
SystemBootXservices.exeDetected by Sophos as Troj/Sober-Q. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\Help\HelpNo
Microsoft UpdatXservices.exeDetected by Symantec as MSIL.Elasrofah. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %ProgramFiles%\Internet ExplorerNo
ServicesXServices.exeDetected by Malwarebytes as Trojan.Agent. Note - this entry loads from the HKCU\Run key and it is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
1SPCUservices.exeSpytech SentryPC "enables you to control, restrict and monitor access and usage of your PC. You can control how long and when users are allowed to use the computer, prevent the use of specific programs, block access to certain websites, restrict access to Windows functions and more." Also see hereNo
servicesXservices.exeDetected by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%No
servicesXservices.exeDetected by Dr.Web as Trojan.DownLoader6.3759 and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\MicrosoftNo
servicesXservices.exeDetected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %AppData%\servicesNo
SystemCheckXservices.exeDetected by Sophos as W32/Sober-M. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\Config\systemNo
servicesXservices.exeDetected by Kaspersky as Trojan-Downloader.Win32.Delf.bmc and by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Recycled%\ServicesNo
.ProgXservices.exeDetected by Symantec as W32.Neveg.B@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%\systemNo
servicesXServices.exeDetected by Malwarebytes as Worm.Spambot. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %System%\1C110F2ANo
ServiceXservices.exe -servDetected by Symantec as W32.Netsky@mm. Note - this is not the legitimate services.exe process which is always located in %System%. This one is located in %Windir%No
taskhostKVXservices1br.batDetected by Malwarebytes as Trojan.Agent.E.BAT. The file is located in %UserProfile%No
Windows StartupXservices21.exeDetected by Sophos as W32/Agobot-MXNo
Sygate Personal Firewall StartXservices32.exeDetected by Sophos as W32/Rbot-MBNo
system32.exeXservices32.exeAdded by a variant of W32.IRCBot. The file is located in %System%No
wxpdrvXservices32.exeDetected by Microsoft as Backdoor:Win32/Bafruz and by Malwarebytes as Backdoor.AgentNo
Win ServicesXServices32.exeAdded by the SYGINRE TROJAN!No
Microsoft System DebugXservices32.exeDetected by Trend Micro as WORM_RBOT.AKHNo
Wins Update 32Xservices32.exeDetected by Sophos as W32/Forbot-FNNo
System33Xservices33.exeDetected by Sophos as W32/Rbot-VQNo
MSNXservices51651.exeDetected by Sophos as Troj/IRCBot-AALNo
win32servXservicesetup.exeAdded by a variant of Worm:Win32/Pushbot - a family of worms that spread using MSN MessengerNo
ServicesNotifyUServicesNotify.exeDefender Pro AntispyNo
DHCP Client PatcherXservicespatcher.exeDetected by Malwarebytes as Trojan.Downloader.E. The file is located in %LocalAppData%\TORNo
Windows ServicessXServicess.exeDetected by Dr.Web as Trojan.StartPage.56213 and by Malwarebytes as Trojan.StartPageNo
HKCUXServicess.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
services.exeXservicess.exeDetected by Sophos as Troj/MSNSpy-B and by Malwarebytes as Trojan.AgentNo
Configuration LoaderXServicess.exeDetected by Symantec as W32.HLLW.Gaobot.AO and by Malwarebytes as Backdoor.BotNo
PoliciesXServicess.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\installNo
capricornXservicest.exeDetected by Malwarebytes as Backdoor.Agent.CPR. The file is located in %ProgramFiles%\D360SHADSYSNo
servicestub.exeXservicestub.exeAdded by the RBOT.CN BACKDOOR!No
Camra UpdatesXserviceswu.exeDetected by Trend Micro as WORM_RBOT.BPQNo
usbdrvXservicetask.exeAdded by a variant of the SDBOT BACKDOOR!No
TestXServiceUpdate.exeDetected by McAfee as Generic.bfrNo
PoliciesXServiceUpdate.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Backdoor.Agent.PGenNo
Windows UpdateXserviceupdater.exeDetected by Malwarebytes as Ransom.Stampado.Generic. The file is located in %AppData%No
Microsoft Update MachineXservicez.exeDetected by Trend Micro as WORM_SPYBOT.BI and by Malwarebytes as Backdoor.BotNo
System ServiceXservicez.exeDetected by Sophos as W32/Rbot-AOYNo
Serices HostinXservicez.exeDetected by Microsoft as Worm:Win32/Slenfbot.MFNo
Windows ServicesXservicez.exeDetected by Malwarebytes as Backdoor.Agent.Gen. The file is located in %Windir%No
Adobe Reader Speed LauncherXservice[3 random digits].exeDetected by Symantec as W32.Wergimog.B. The file is located in %AppData%\Microsoft - see examples here and hereNo
Adobe Reader Speed LauncherXservice[random number].exeDetected by Symantec as W32.Wergimog. The file is located in %System%No
Adobe Reader Speed LauncherXservice[random number].exeDetected by Symantec as W32.Wergimog. The file is located in %Windir%No
SERVICE_PACK####.exeXSERVICE_PACK####.exeDetected by Malwarebytes as Backdoor.Agent.E - where # represents a digit. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows starts - see an example hereNo
ZipCloud UpdateXservice_update.exeDetected by Malwarebytes as Trojan.Agent.MNR. The file is located in %AppData%\[folder] - see examples here and hereNo
servicoXservico.exeDetected by Sophos as Troj/Banker-DKENo
ASP.NET State ServiceXservicos..exeDetected by Sophos as Troj/Dadobra-INo
PadraoXservicos.exeDetected by Malwarebytes as Trojan.Banker.BLG. The file is located in %CommonAppData% - see hereNo
services.exeXservics.exeDetected by Microsoft as Trojan:Win32/Vhorse.VQ. The file is located in %System%No
servicsXservics.exeDetected by Sophos as Troj/Singu-JNo
servics.exeXservics.exeDetected by Microsoft as Backdoor:Win32/Mocbot.AFNo
SkypeXservics.exeDetected by Malwarebytes as Trojan.Banker.AI. The file is located in %System%\driversNo
policiesesXservicse.exeDetected by McAfee as RDN/Generic BackDoor and by Malwarebytes as Backdoor.Agent.PGenNo
servicse.exeXservicse.exeDetected by McAfee as RDN/Generic BackDoor and by Malwarebytes as Backdoor.Agent.HKP. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
k3ym4nXservicsmjr.exeDetected by Sophos as W32/Rbot-RWNo
Microsoft Update MachineXservicz.exeDetected by Sophos as W32/Rbot-HU and by Malwarebytes as Backdoor.BotNo
ryan1918Xservidevice.exeDetected by Sophos as W32/Rbot-GVRNo
servieca.vbeXservieca.vbeDetected by Dr.Web as Trojan.DownLoader8.16780 and by Malwarebytes as Trojan.Banker. Note - this entry loads from the HKLM\Run and HKCU\Run keys and the file is located in %Temp%No
servieca.vbeXservieca.vbeDetected by Dr.Web as Trojan.DownLoader8.16780 and by Malwarebytes as Trojan.Banker. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Servieca.vbsXServieca.vbsDetected by Malwarebytes as Trojan.Agent.VBS. The file is located in %Temp%No
Servieca.vbsXServieca.vbsDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent.VBS. The file is located in %UserProfile%No
Servieca.vbsXServieca.vbsDetected by McAfee as Generic.dx and by Malwarebytes as Trojan.Agent.VBS. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Windows Server InformationXservinfo.exeDetected by Sophos as W32/Forbot-ENNo
ashcapXservirsess.exeSpySure spywareNo
NvCplDeamonXservise.exeAdded by the AUTORUN-BNY WORM!No
Windows ServserXserviser.exeAdded by a variant of W32.IRCBot. The file is located in %Windir%No
servisesXservises.exeDetected by Sophos as Troj/Agent-JUJNo
WINDOWS SYSTEMXservises.exeDetected by Sophos as W32/Zotob-I and by Malwarebytes as Backdoor.AgentNo
Microsoft Update MachineXserviz.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%No
MicroUpdateXservizi.exeDetected by McAfee as Generic Dropper and by Malwarebytes as Backdoor.Agent.DCNo
serviziXservizi.exeDetected by McAfee as RDN/Generic Dropper!ga and by Malwarebytes as Backdoor.Agent.DCNo
SERVlCEXSERVlCE.EXEDetected by Sophos as W32/Agobot-UB. Note the lower case "L" in both fieldsNo
SVCHOSTXSERVlCES.EXEDetected by Sophos as Troj/Delf-LF and by Malwarebytes as Backdoor.Bot.E. Note that the filename has a lower case "L" in place of an upper case "i"No
loadXservlog.exeDetected by Sophos as W32/Todnab-B. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "servlog.exe" (which is located in %System%)No
Server Application for MFP ServerYServoApp.exeMulti Function Printer (MFP) server agent for products such as Belkin's Wireless G All-in-One Print Server and ZyXEL's NPS-520 which allow multiple computers to use networked all-in-one printers. Required for the MFP Server Agent (MFPAgent.exe) to run properly - whether it's set to start manually or automaticallyYes
ServoAppYServoApp.exeMulti Function Printer (MFP) server agent for products such as Belkin's Wireless G All-in-One Print Server and ZyXEL's NPS-520 which allow multiple computers to use networked all-in-one printers. Required for the MFP Server Agent (MFPAgent.exe) to run properly - whether it's set to start manually or automaticallyYes
Client RuntimeXservoc.exeDetected by Malwarebytes as Trojan.Dropper.JJbot. The file is located in %UserTemp%No
AudioClientXservresr.exeDetected by Malwarebytes as Trojan.Injector. The file is located in %CommonAppData%No
javaservXservs.exeDetected by McAfee as RDN/Generic PWS.y!zp and by Malwarebytes as Backdoor.Agent.ENo
SystemXservseame.exeDetected by Malwarebytes as Backdoor.Agent.SVR. The file is located in %Windir%No
Windows Host ServiceszXservsice.exeDetected by Dr.Web as Trojan.DownLoader5.11917 and by Malwarebytes as Backdoor.AgentNo
Windows USB MonitorXservupdate.exeDetected by Trend Micro as TROJ_IRCBRUTE.AQ. The file is located in %System%No
ServUTrayIconUServUTray.exeSystem Tray access for the Serv-U® FTP Server server which allows the user to (amongst others) start the Management Console, stop the server and display notificationsNo
irwftpXserwices.exeDetected by McAfee as PWS-Banker and by Malwarebytes as Trojan.Agent.ENo
SystemXserwin.exeDetected by Sophos as Troj/LdPinch-BNNo
asaRegasaXses.exeDetected by Malwarebytes as Spyware.Agent.E. The file is located in %AppData%No
Session ClientUsescli.exeSurfSpy keystroke logger/monitoring program - remove unless you installed it yourself!No
sctrlmgrXsescmgr.exeDetected by McAfee as generic!bg.fnm and by Malwarebytes as Backdoor.BotNo
SystemsXsescmgr.exeDetected by Sophos as Troj/DwnLdr-GAH and by Malwarebytes as Backdoor.BotNo
Driver Control Manager v8.2Xsesdessecetra.exeDetected by McAfee as W32/Sality.gen.z and by Malwarebytes as Trojan.AgentNo
Driver Control Manager v8.1Xsesdessetri.exeDetected by Sophos as Troj/ZXC-Q and by Malwarebytes as Trojan.AgentNo
PPK Setup(Server)USEServe.exeProgrammable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button, collect your e-mail automatically with one key stroke. You can also program your PPK to turn on your SuperSlim Notebook at a predetermined time and perform simple tasks - completely unattended"No
Driver Control Manager v7.7Xsesnaesttoo.exeDetected by Sophos as W32/AutoInf-CU and by Malwarebytes as Trojan.AgentNo
Windows NT Session ManagerXsess.exeAdded by a variant of Backdoor:Win32/RbotNo
Windows Session ManagerXsession.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %CommonAppData%\sessionmanageNo
irc sessionXsessionmgr.exeDetected by Sophos as W32/Sdbot-ACENo
WebGuardYSessionMonitor.exeActivityMon WebGuard by Advanced Software - "will notify you (or your children for example) when you have visited such a suspicious site. Using it you can avoid troubles with owners of mentioned sites and meaningless communication with them. ActivityMon WebGuard supports all currently available versions of Microsoft's Windows operating systems." No longer availableNo
QWS3270 SessionsUsessions.exeQWS3270 Secure terminal emulation softwareNo
SessMgrXsessmgr.exe /waitserviceDetected by Microsoft as TrojanDownloader:Win32/Horst.Q. Note - this is not the legitimate sessmgr.exe which is always located in %System%. This one is located in either %Windir%, %Windir%\System, %Temp%, %AppData%, %AppData%\Microsoft or %System%\driversNo
sestem.exeXsestem.exeDetected by McAfee as RDN/Generic Dropper and by Malwarebytes as Backdoor.Agent.TRJ. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SestemXSestemiy.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %Windir%\systemkiDirNo
SestemxXSestemiy.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %Windir%\systemkiDirNo
SeStPageXSeStPage.exeDetected by Dr.Web as Trojan.DownLoader10.15753 and by Malwarebytes as Adware.KoradNo
SES ServiceXsesvc.exeDetected by Sophos as W32/Sdbot-CZUNo
googlechromXset.exeDetected by Malwarebytes as Spyware.Imminent. The file is located in %LocalAppData%\smdNo
SiSSetCDfmt?SetCDfmt.exeRelated to a Silicon Integrated Systems Corp (SiS) product?No
HPLJ ConfigYSetConfig.exeConnects the system to networked HP Laserjet printerNo
Update local?SetCPQLC.exeRunning on a Compaq desktop. The file is located in %Windir%No
Microsoft« ActiveX Debugger NTXsetdebugnt.exeDetected by Sophos as Troj/Bancos-CZNo
Microsoft ActiveX Debugger NTXsetdebugnt.exeDetected by Sophos as Troj~Bancos/DONo
SetDefaultSCRUSetDefaultSCR.exeSets the default screen saver on some Lenovo PCs to the stock one installed at the factory - which can be a feature video of the productNo
SetDefPrtNSetDefPrt.exeUsed to set a Brother printer/copier/scanner as the default printer after installationNo
UniPrintUSetDfltSettings.exeDrivers for Uniprint, a printing help for Terminal Services and Citrix which recieves downloaded files from a Uniprint enabled server and prints them locally allowing for truly universal printing through Terminal Services or CitrixNo
Microsoft SetDLL32Xsetdll32.exeDetected by Trend Micro as WORM_RBOT.OZNo
GammaHotKeysUsetgamma.exePart of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktopNo
SetHookNSethook.exeFellowes Neato® cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar"No
MediaFace IntegrationNSethook.exeFellowes Neato® cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar"No
ZNCEPGWQJZVGFECYFHADXsethost.exeDetected by Malwarebytes as Backdoor.Messa. The file is located in %Temp%No
SETI DriverNSETI Driver.exeSETI Driver by Mike Ober - used in conjunction with the command line SETI@home client. No longer supported following the update to SETI@home to use BOINCNo
SETI Driver.exeNSETI Driver.exeSETI Driver by Mike Ober - used in conjunction with the command line SETI@home client. No longer supported following the update to SETI@home to use BOINCNo
SetiDriverNSETI Driver.exeSETI Driver by Mike Ober - used in conjunction with the command line SETI@home client. No longer supported following the update to SETI@home to use BOINCNo
SETI@homeNSETI@home.exe"SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data"No
seticlientNSETI@home.exe"SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data"No
SetIconNSetIcon.exeInstalled by a 6-in-1 (4 Media Card slots, a floppy drive and a USB connection) device. Constantly updates the icons for the four Media Card slots that it has and is a resource hogNo
setingsc.exeXsetingsc.exeDetected by McAfee as Generic VB.i and by Malwarebytes as Trojan.AgentNo
SetiQueueNsetiqueue.exeProvides work unit buffering for Seti@Home clientsNo
SetiSpyNSetiSpy.exeSETI Spy by Roelof J. Engelbrecht - 'is a little program I wrote to "spy" on the progress and performance of the SETI@home client. I call it a "spy" because I tried to make it as unobtrusive as possible.' No longer supported following the update to SETI@home to use BOINCNo
SetiSpy.exeNSetiSpy.exeSETI Spy by Roelof J. Engelbrecht - 'is a little program I wrote to "spy" on the progress and performance of the SETI@home client. I call it a "spy" because I tried to make it as unobtrusive as possible.' No longer supported following the update to SETI@home to use BOINCNo
SetPointUSetpoint.exeLogitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc) - required if you want to use the advanced features or modify the default settings of these devices and located in %ProgramFiles%\Logitech\Setpoint or %ProgramFiles%\Logitech\SetpointP - depending upon the version. Or Set Point from Easy Desk Software - a "small utility that automatically sets System Restore points for WinME/XP" which is located in %ProgramFiles%\Easy Desk Utilities\Set PointYes
SetPointXSetPoint.exeAdded by the RBOT-BWI WORM! Note - this is not the valid Logitech Setpoint mouse and keyboard entry that uses the same filename and is located in %ProgramFiles%\Logitech\Setpoint or Set Point from Easy Desk Software which is located in %ProgramFiles%\Easy Desk Utilities\Set Point. This one is located in %System%No
EDRestoreUSetpoint.exeSet Point from Easy Desk Software - "small utility that automatically sets System Restore points for WinME/XP"No
EvtMgr6USetpoint.exeLogitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc). Required if you want to use the advanced features, modify the default settings or be notified of low battery status (for wireless devices). Located in %ProgramFiles%\Logitech\SetpointPYes
Logitech SetPointUSetpoint.exeLogitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc). Required if you want to use the advanced features, modify the default settings or be notified of low battery status (for wireless devices). Located in %ProgramFiles%\Logitech\Setpoint or %ProgramFiles%\Logitech\SetpointP - depending upon the versionYes
Logitech SetPoint Event Manager (UNICODE)USetpoint.exeLogitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc). Required if you want to use the advanced features, modify the default settings or be notified of low battery status (for wireless devices). Located in %ProgramFiles%\Logitech\SetpointPYes
Microsoft UpdateXSetPoints.exeDetected by Kaspersky as Backdoor.Win32.Rbot.aepf and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
SetRefreshUSetRefresh.exeFound on some Compaq & HP PCs. SetRefresh is a utility which attempts to optimize the monitor's refresh rate, and in some cases the resolution, for the best user experience. See "here for more infoNo
settdebugx.exeXsettdebugx.exeDetected by Trend Micro as TROJ_FAKEAV.BOO and by Malwarebytes Anti-Malware as Trojan.FakeAlertNo
hao123SettingXSetting.exeDetected by Dr.Web as Trojan.StartPage.51763 and by Malwarebytes as Trojan.StartPageNo
settingXsetting.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%No
setting.vbsXsetting.vbsDetected by Dr.Web as VBS.Siggen.7504. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
JAVAXsettings.exeDetected by Malwarebytes as Trojan.Inject. The file is located in %AppData%\JavaNo
SettingsXSettings.exeDetected by McAfee as RDN/Generic.dx!dbk and by Malwarebytes as Backdoor.Agent.VNo
settingsxx.exeXsettingsxx.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %Root%\settingsxx.exe - see hereNo
user64Xsetup#.exeDetected by Malwarebytes as Trojan.Banker - where # represents a single digit. The file is located in %Root%No
Logitech Desktop MessengerNsetup-8876480.exeInstaller for Logitech Desktop Messenger included with older versions of the software for Logitech products - which automatically checks for software upgrades and new products, services and special offers from LogitechNo
MkevcXsetup.exeDetected by McAfee as W32/Ramnit.a and by Malwarebytes as Trojan.DownloaderNo
HKCUXSetup.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
ProgramFilesXSetup.exeDetected by Dr.Web as Trojan.DownLoader10.1010 and by Malwarebytes as Trojan.Downloader.PFGenNo
chromeXsetup.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %Windir% - see hereNo
chromeXsetup.exeDetected by Malwarebytes as Trojan.StartPage.AI. Note - this is not a legitimate file for the Google Chrome browser and it is located in %Windir%No
Windows AcceleratorsUsetup.exeKeySpy keystroke logger/monitoring program - remove unless you installed it yourself!No
Sleet DDOS SetupXSetup.exeDetected by McAfee as Generic.dx. The file is located in %CommonAppData%\Microsoft\Windows\Start Menu (10/8/7/Vista) or %AllUsersProfile%\Start Menu (XP)No
UserinitXsetup.exeDetected by Dr.Web as Trojan.Siggen6.24041 and by Malwarebytes as Trojan.AgentNo
svchostXSETUP.EXEDetected by Symantec as W32.Setclo and by Malwarebytes as Backdoor.Bot.ENo
chrome.exeXsetup.exeDetected by Malwarebytes as Trojan.Agent.CRGen. The file is located in %UserTemp%No
nvdriversXsetup.exeDetected by Malwarebytes as Trojan.Agent.NV. The file is located in %AppData%No
zzzhpsetup?setup.exeThe file is located in %Root%. What does it do and is it required?No
AntiVirusXSetUp.exeDetected by Malwarebytes as Misused.Legit.VBC. The file is located in %System%\AntiViNo
InstallNAIProduct?SETUP.EXECould be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This is located in %Root%\Vsc or %Root%\Vsp. Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?No
MyVBAppXsetup.exeDetected by Kaspersky as the Trojan-Dropper.Win32.VB.kb. The file is located in %Root%No
RjLyraInstaller?setup.exeThe file is located in %Root%No
setup.exeXsetup.exeDetected by Malwarebytes as Trojan.MSIL. Note - this entry loads from the HKLM\Run and HKCU\Run keys and the file is located in %AppData%No
setup.exeXsetup.exeDetected by Malwarebytes as Trojan.MSIL. Note - the file is located in %UserStartup% and its presence here ensures it runs when Windows startsNo
setup.exeXsetup.exeDetected by Malwarebytes as Trojan.MSIL. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
setup.exeXsetup.exeDetected by Sophos as Troj/Goldun-GB. The file is located in %Windir%No
SkypeXSetup.exeDetected by Malwarebytes as Trojan.Hijacker.URL. Note - this is not a legitimate entry for the popular Skype VOIP software and the file is located in %UserTemp%No
RLDNXsetup.exeDetected by McAfee as RDN/Generic PWS.y!tt and by Malwarebytes as Backdoor.Agent.RDLNo
h16938sVXsetup.exeDetected by Malwarebytes as Trojan.Agent.UKN. The file is located in %UserProfile%\V41TNo
MquvcXsetup.exeDetected by Malwarebytes as Trojan.Downloader. The file is located in %Windir%No
WindowsServiceXsetup.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bgsp and by Malwarebytes as Trojan.Agent. The file is located in %Root%\prefetcherNo
HKLMXSetup.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%\installNo
WindowsAudioXsetup.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bgsp and by Malwarebytes as Trojan.Agent. The file is located in %Root%\prefetcherNo
Google ChromiumXsetup.exeDetected by Dr.Web as Trojan.Siggen6.17423 and by Malwarebytes as Backdoor.Agent.CHRGenNo
SigmaTel AudioNsetup.exeSigmatel (acquired by IDT and now Tempo Semiconductor, Inc.) audio driverNo
ServiceApplicationXSetup.exeDetected by Malwarebytes as Trojan.MSIL. The file is located in %CommonPictures%\Sample PicturesNo
WindowsSetupXSetup.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.DCNo
CcleanerXSetup.exeDetected by Malwarebytes as Spyware.Password. The file is located in %AppData%No
PoliciesXSetup.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %System%\installNo
WindowsXsetup.exeDetected by Dr.Web as Worm.Siggen.6969 and by Malwarebytes as Trojan.AgentNo
Sweep95YSETUP.EXEPart of an older version of Sophos anti-virus softwareNo
MCAFEEIPSXsetup.exeAdded by the WHITEWELL TROJAN!No
Tango?Setup.exeTango Broadband access software. Is it required?No
WindowsDisplayXsetup.exeDetected by Kaspersky as Trojan-Spy.Win32.Zbot.bgsp and by Malwarebytes as Trojan.Agent. The file is located in %Root%\prefetcherNo
loadXsetup.exe.lnkDetected by Malwarebytes as Trojan.Redlonam. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "setup.exe.lnk" (which is located in %UserTemp%\FolderN)No
OESETXsetup60.exeDetected by AhnLab as Win-Trojan/Warezdl.28672No
HighspeeddownloaderXSetupClickHere.EXEHomepage hijacker, redirecting to "turbo-search101.com" - see hereNo
C:\WINDOWS\system32\SetupCmd.exeXSetupCmd.exeDetected by Kaspersky as the AGENT.AAW TROJAN!No
[various names]XSetupExeDll.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
MemConfigXSetupIE.comDetected by Symantec as W32.HLLW.TaplakNo
TaskmanXSetupin.exeDetected by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "Setupin.exe" (which is located in %Recycled%\{SID})No
setupmss.exeXsetupmss.exeDetected by McAfee as PWS-Banker and by Malwarebytes as Trojan.Banker. The file is located in %CommonAppData%No
setupmss.exeXsetupmss.exeDetected by McAfee as RDN/Downloader.a!rd and by Malwarebytes as Trojan.Banker.Gen. The file is located in %LocalAppData%No
setupmss.exeXsetupmss.exeDetected by McAfee as Generic.bfr!db. The file is located in %Temp%No
shareXsetupmsxs.exeDetected by McAfee as Generic.bfr!cvNo
loadXSetupp.lnkDetected by Malwarebytes as Backdoor.Agent.PDL. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "Setupp.lnk" (which is located in %AppData%\Microsoft\Windows\WdiService)No
setupstart.exeXsetupstart.exeDetected by Malwarebytes as Trojan.SpyEyes. The file is located in %Root%\setupstart.exeNo
explorerXsetupsvc.exeDetected by McAfee as Generic VB.i and by Malwarebytes as Trojan.AgentNo
setupsvc.exeXsetupsvc.exeDetected by McAfee as Generic.bfr!db and by Malwarebytes as Trojan.BankerNo
setupsvcs.exeXsetupsvcs.exeDetected by McAfee as Generic.bfr!cvNo
setupwid.exeXsetupwid.exeDetected by McAfee as Generic VB.i and by Malwarebytes as Trojan.Banker. The file is located in %CommonAppData%No
setupwid.exeXsetupwid.exeDetected by McAfee as Generic.bfr!db. The file is located in %Temp%No
win32XSetup_32.exeDetected by Symantec as Backdoor.Evilbot.B and by Malwarebytes as Backdoor.Agent.GenNo
NI.UGESU_0001_N122M0303Xsetup_de.exeInstaller for the SysKontroller rogue security software - see hereNo
NI.UGES_0001_N108M2006Xsetup_en.exeInstaller for the MyContentAssistant rogue privacy toolNo
NI.UGEST_0001_N122M0303Xsetup_it.exeInstaller for the SysLibero rogue security software - see hereNo
_SetvXSetv.comAdded by the BESAM WORM!No
defrag.exeXsetver.exeDetected by Malwarebytes as Trojan.Agent.ED. The file is located in %AppData%\Sun\Java\Deployment\cache\6.0\3No
Windows secureXsetver32.exeDetected by Trend Micro as WORM_SPYBOT.EPNo
SetVrcXsetvrc.exeDetected by Symantec as W32.HLLW.HuntocxNo
disable_nasty_checksXsetx SEE_MASK_NOZONECHECKS 1Detected by Trend Micro as TSPY_ZBOT.WNA and by Malwarebytes as Trojan.Agent.ENo
dataXsevc.exeDetected by McAfee as Generic PWS.y and by Malwarebytes as Trojan.Agent.DTA. The file is located in %ProgramFiles%\MrverNo
dataXsevc.exeDetected by McAfee as PWS-Mmorpg.gen and by Malwarebytes as Trojan.Agent.DTA. The file is located in %ProgramFiles%\TrveNo
Sysctrls32Xsevchost.exeDetected by Kaspersky as Backdoor.Win32.Rbot.adf. The file is located in %System%No
sevchostXsevchost.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.SVCNo
sevchost.exeXsevchost.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.SVC. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SevenUpXsevenup.exeAdded by the DELF TROJAN!No
360[foreign characters]Xsever.exeDetected by Dr.Web as Trojan.PWS.Gamania.38730 and by Malwarebytes as Backdoor.Agent.SNNo
(Default)Xsever.exeDetected by Malwarebytes as Trojan.Backdoor. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %Windir%\SHELLNEWNo
severXsever.exeDetected by McAfee as RDN/Generic BackDoor!yz and by Malwarebytes as Backdoor.Agent.MCRNo
sever.exeXsever.exeDetected by Dr.Web as Trojan.MulDrop5.34392 and by Malwarebytes as Trojan.Agent.SVR. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
jusodlXsevere.exeDetected by Sophos as W32/QQRob-ADN and by Malwarebytes as Password.StealerNo
alligtXsevere.exeDetected by Symantec as W32.Slurk.A and by Malwarebytes as Password.StealerNo
Severe Weather AlertsUSevereWeatherAlerts.exeSevere Weather Alerts - "Get desktop notifications when storms are heading your way." Detected by Malwarebytes as PUP.Optional.SevereWeatherAlerts. Note - this entry loads from the Windows Startup folder and the file is located in %LocalAppData%\SevereWeatherAlerts. If bundled with another installer or not installed by choice then remove itNo
Severe Weather Alerts AppUSevereWeatherAlertsApp.exeSevere Weather Alerts - "Get desktop notifications when storms are heading your way." Detected by Malwarebytes as PUP.Optional.SevereWeatherAlerts. Note - this entry loads from the Windows Startup folder and the file is located in %LocalAppData%\SevereWeatherAlerts. If bundled with another installer or not installed by choice then remove itNo
dataXsevic.exeDetected by McAfee as RDN/Generic PWS.y!bc3 and by Malwarebytes as Trojan.Agent.DTANo
SEVICE.PACK####.exeXSEVICE.PACK####.exeDetected by Malwarebytes as Backdoor.Agent.Gen - where # represents a digit. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows starts - see an example hereNo
SevilerUSeviler.exeDetected by Malwarebytes as PUP.Optional.Elex. The file is located in %AppData%\GameLauncher\Seviler. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
ACubFcHlbrMCmFpXsevnz.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
Configuration ServecieXsewins.exeDetected by Sophos as W32/Sdbot-COHNo
sex ana.exeXsex ana.exeDetected by Malwarebytes as Backdoor.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SEX.exeXSEX.exeDetected by Malwarebytes as Trojan.Agent.SX. The file is located in %Temp% - see hereNo
sex.exeXsex.exeDetected by Malwarebytes as Backdoor.Bifrose. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SCXsexcam.exeDetected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%No
staskXsexfile.exeDetected by McAfee as W32/Autorun.worm.gen and by Malwarebytes as Worm.AutoRun.ENo
hsimXsexgame.exeAdded by unidentified malwareNo
Sex MessengerNsexmessenger.exeSex Messenger - "Now, discover the new way to date hundreds of women online. No more spam, no more annoying ads, no more aggressive mailing"No
SexnowXSexnow.exeDetected by Sophos as Dial/Senow-BNo
SexShowsXSexShows.exeDetected by Dr.Web as Dialer.Adultchat.80 and by Malwarebytes as Trojan.Dialer.SXENo
SextXSext.exeDetected by Dr.Web as Trojan.AVKill.31458 and by Malwarebytes as Trojan.Agent.ENo
sexxx.vbsXsexxx.vbsDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Sygate Personal FirewallXsexy.exeDetected by Sophos as W32/Rbot-XYNo
sexy.exeXsexy.exeDetected by Kaspersky as Trojan.Win32.Refroso.djjg and by Malwarebytes as Backdoor.IRCBot. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows startsNo
sexy.exeXsexy.exeDetected by Kaspersky as Backdoor.Win32.IRCBot.jvw and by Malwarebytes as Backdoor.IRCBot. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Sexy2000.exe.exeXSexy2000.exe.exeDetected by Dr.Web as Trojan.Siggen6.17275 and by Malwarebytes as Backdoor.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ULOVEJFXsexyfr.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.AgentNo
LOVEFSDXsexyfr.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.AgentNo
LOFUTDSXsexyfr.exeDetected by McAfee as Generic BackDoor and by Malwarebytes as Backdoor.AgentNo
sexymligofpeXsexymligofpe.exeDetected by Malwarebytes as Trojan.Inject. The file is located in %UserProfile%No
SystemTasksXsexypicz.exeAdult content dialerNo
Sexy_BlondesXSexy_Blondes.exePremium rate Adult content dialer - see hereNo
Sexy_sgXSexy_sg.exePremium rate Adult content dialerNo
WallPaperXsf.exeDetected by Dr.Web as Trojan.PWS.Banker1.8620 and by Malwarebytes as Trojan.Banker.ENo
sfXsf.exeSurfEnhance adwareNo
Safeguard 2009Xsf2009.exeSafeguard 2009 rogue spyware remover - not recommended, removal instructions hereNo
Snappy FaxNsf4.exeSnappy Fax desktop fax program with an extensive set of features - version 4No
Smart File AdvisorNsfa.exeSmart File Advisor by Filefacts.net - "will be able to identify the type of the file you want to open even if it has a wrong file extension by analysing parts of the file content." In addition, Smart File Advisor "can also help you get the latest Software Updates as soon as they become available. Out of date software can be a big security risk for your computer"No
SPAMfighter AgentUSFAgent.exeSPAMfighter anti email spam filterNo
ShellXsfcconfig.exe,explorer.exeDetected by McAfee as RDN/Generic BackDoor!b2q and by Malwarebytes as Backdoor.Agent.DCE. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "sfcconfig.exe" (which is located in %AppData%\sfCMAIN)No
cftmonXsfcmonit.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %CommonFiles%\SystemNo
HotKeyXSFCsrvc.pifDetected by Sophos as W32/AutoIt-OC and by Malwarebytes as Trojan.YahloverNo
Files DriverXsfdhost.exeDetected by Sophos as W32/Agobot-AJC and by Malwarebytes as Backdoor.BotNo
sffstatXsffstat.exeDetected by Dr.Web as Trojan.DownLoader11.24512 and by Malwarebytes as Backdoor.Agent.ENo
Microsoft .NET Framework 4Xsfg44894g.exeDetected by Malwarebytes as Trojan.Krypt. The file is located in %UserTemp%No
Audio Device ManagerXsfhgj.exeDetected by Sophos as W32/IRCBot-ZANo
SonicFocusNSFIGUI.EXESonic Focus - "enhances music, movie and game sound by analyzing compressed audio streams in realtime, then restoring and enriching audio back to its original performance qualities"No
SFIGUINSFIGUI.EXESonic Focus - "enhances music, movie and game sound by analyzing compressed audio streams in realtime, then restoring and enriching audio back to its original performance qualities"No
sfirefox.exeXsfirefox.exeDetected by Malwarebytes as Spyware.PasswordStealer.MSIL. The file is located in %AppData%\Frfx\data\d\f\g\eNo
sfitaXsfita.exeAdded by the FAVADD-H TROJAN!No
mssfosXsfool.exeAdded by the RANDEX.EUS WORM!No
Snappy Fax Printer Agent?sfpagent.exeRelated to the Snappy Fax desktop fax program. What does it do and is it required?No
Snappy Fax Printer virtual printer agent?sfpagent.exeRelated to the Snappy Fax desktop fax program. What does it do and is it required?No
sfpcUsfpc.exeSpy4PC surveillance software. Uninstall this software unless you put it there yourselfNo
srMaEKdMpIEyiFifcXsFpoAkPxnMmSYBXjD.exeDetected by Sophos as Troj/Mdrop-EVT and by Malwarebytes as Backdoor.AgentNo
Microsoft PC Health Remote Assistance File Open & Save controlsXsfrcdlg32.exeDetected by Sophos as W32/Rbot-AVYNo
SoftGridTrayUSFTTray.exeSystem Tray access to SoftGrid from Microsoft - "the only virtualization solution that delivers applications that are never installed and dynamically delivered, on demand"No
SfWinStartInfoUsfWinStartupInfo.exeSparkasse SFIRM32 Online Banking softwareNo
smXsf_exe.exeAdded by the OLFEB.A TROJAN!No
SuperProServerXSG360.EXEDetected by McAfee as RDN/Downloader.a!oi and by Malwarebytes as Trojan.Agent.NTSNo
systechXsgasys.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %System%No
SgecryptYSGECRYPT.exeSafeGuard Easy from Sophos (formerly by Utimaco) - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks"No
Microsoft UpdateXsghost.exeDetected by Trend Micro as WORM_SDBOT.AKV and by Malwarebytes as Backdoor.BotNo
sginstUsginst.exeeAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendationNo
sgkAJE.exeXsgkAJE.exeDetected by Malwarebytes as Trojan.Backdoor.XTR. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SpywareGuardYsgmain.exe"SpywareGuard provides a real-time protection solution against spyware"No
cpuminer-gpuUsgminer.cmdCPU Miner - uses your computer's resources to mine digital currency for the developer. Detected by Malwarebytes as PUP.Optional.CPUMiner. The file is located in %AppData%\cpuminer\sgminer. If bundled with another installer or not installed by choice then remove itNo
Screen Guard Message ScanUsgms.exePart of Access Denied security and privacy softwareNo
MSRegScanUSGP.exeSpyGator surveillance software. Uninstall this software unless you put it there yourselfNo
SGPUpdaterXsgpUpdaters.exeFast Browser Search/Search Guard Plus parasite - installed with "Make the Web Better" applications such as My Web Tattoo, My Face LOL and Google Easy Money Kit. See here and here for more informationNo
SyGateServiceUsgserv95.exeSyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start → ProgramsNo
SGTBox?SGTBox.exeCanon scanner related. What does it do and is it required?No
sgtrayUsgtray.exeStorageGuard from Veritas (now Symantec). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backupsNo
UpdateManagerUsgtray.exeStorageGuard from Veritas (now Symantec). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups. This version by SonicNo
StorageGuardUsgtray.exeStorageGuard from Veritas (now Symantec). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backupsNo
StoreGridYSGTray.exeSystem Tray access to StoreGrid online backup and data protection software from Vembu Technologies Pvt. Ltd. Required for scheduling to workNo
sGYdOWNVnv.exeXsGYdOWNVnv.exeDetected by Malwarebytes as Rogue.Agent. The file is located in %WinTemp%No
Security GuardXSG[random characters].exeSecurity Guard rogue security software - not recommended, removal instructions hereNo
shell32.dllXsh32.exeDetected by Malwarebytes as Trojan.Agent.SHGen. The file is located in %System%No
shacker.exeXshacker.exeDetected by McAfee as RDN/Generic PWS.y and by Malwarebytes as Trojan.Downloader.SHNo
WindowsMNGXShades.exeDetected by Dr.Web as Trojan.DownLoader4.16266 and by Malwarebytes as Backdoor.MessaNo
WINDOWSXShadesRatCrypted.exeDetected by McAfee as Generic.dx and by Malwarebytes as Backdoor.Agent.ENo
ShadowYShadow.exeNTI Shadow - an "award-winning easy-to-use backup application that automatically protects your photo, music, video, and various data files. It makes data restoring as easy as dragging and dropping files from one place to another"No
Shadow w0rmXShadow.exeDetected by Dr.Web as Trojan.DownLoader11.16836 and by Malwarebytes as Worm.AgentNo
hp center UINShadowBar.exeUser Interface for HP Center - see the BACKWEB-******.exe entryNo
ShadowUser Pro EditionUShadowUser.exeShadowUser™ by ShadowStart (now StorageCraft) - "provides non-restrictive, easy to use desktop security and protection for Windows operating systems. ShadowUser is the best way to prevent unwanted or deliberate changes from being made to a PC." No longer available - see hereNo
[various names]XShaitan1678.exeFake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original pageNo
CorpFireXShakar.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%No
CorpSoftXShakar.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %ProgramFiles%No
win32XShakira_1997_Part_1_.Mpeg_.scrDetected by Symantec as W32.Mylife.N@mmNo
shambl3r*Xshambl3r.exeDetected by Symantec as W32.Remabl.Worm - where * represents 2 to 11No
loadXshambl3r.exeDetected by Symantec as W32.Remabl.Worm. This entry loads from the "load=" section of WIN.INI (in %Windir%) on Win9x/Me and the "shambl3r.exe" file is located in %Windir%No
(Default)XShania.vbsDetected by Symantec as VBS.Shania. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blankNo
SHAProcXSHAProc.exeAdded by the WINKO.AO WORM!No
Windows TechnologyXshare.exeDetected by McAfee as RDN/Generic Dropper!tw and by Malwarebytes as Trojan.Agent.SSNo
Search Malware ProcessXshare.exeDetected by Dr.Web as Trojan.MulDrop5.6387 and by Malwarebytes as Trojan.Agent.ENo
ShareazaNShareaza.exeShareaza P2P clientNo
ShareBoxXShareBoxC.exeDetected by AVG as OpenShopper.A and by Malwarebytes as Adware.ShareBox. The file is located in %ProgramFiles%\ShareBoxNo
Parallels Shared Internet Applications?sharedintapp.exePart of Parallel Tools utility suite for guest operating systems included with virtualization software from Parallels - such as Parallels WorkstationNo
SharedInternetApplication?sharedintapp.exePart of Parallel Tools utility suite for guest operating systems included with virtualization software from Parallels - such as Parallels WorkstationNo
sharedpremXsharedprem.exeDetected by Symantec as W32.Makecall.TrojanNo
Microsoft .NET Framework v1.0 compatibilityXSharedReg.exeDetected by McAfee as RDN/Generic Downloader.x!jt and by Malwarebytes as Backdoor.Agent.DCENo
ShareIt Service.exeXShareIt Service.exeDetected by Dr.Web as Trojan.DownLoader23.51876 and by Malwarebytes as Trojan.Crypt. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ShareXNShareX.exeSystem Tray access to and notifications for the ShareX screen capture, file sharing and productivity tool - which "is a free and open source program that lets you capture or record any area of your screen and share it with a single press of a key"Yes
SharpEyeServerXSharpEyeServer.exeDetected by McAfee as RDN/Generic BackDoor!sc and by Malwarebytes as Backdoor.Agent.SPENo
SharpTrayUSharpTray.exePart of the Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents"No
SHCenter.exeNshcenter.exeIMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files"No
WinAmpAgentXshch.exeDetected by Sophos as Troj/Bdoor-EBNo
SheduIerXshch.exeDetected by Sophos as Troj/Bdoor-EBNo
QuicktimeXshch.exePremium rate Adult content dialerNo
MsnExplorerXshch.exeDetected by Sophos as Troj/Bdoor-EBNo
NeroXshch.exePremium rate Adult content dialerNo
[various names]Xshch.exePremium rate Adult content dialerNo
ScheduIeXshch.exeAdded by a variant of Troj/Bdoor-EBNo
ScheduIrXshch.exeAdded by a variant of Troj/Bdoor-EBNo
SvcH0stXshch.exeDetected by Sophos as Troj/Bdoor-EBNo
Windws Services32Xshchost32.exeDetected by McAfee as RDN/Sdbot.bfr and by Malwarebytes as Backdoor.IRCBot.ENo
ShellCommandXshcmp32.exeAdded by the REMCON-A TROJAN!No
g7jhctXshctch.exeDetected by Dr.Web as Trojan.MulDrop4.25279 and by Malwarebytes as Trojan.Agent.SHNo
Systcm-cXshdar.EXEDetected by McAfee as Generic.mfr and by Malwarebytes as Worm.AutoRunNo
System-SCXshdar.EXEDetected by McAfee as Generic.mfr and by Malwarebytes as Worm.AutoRunNo
shdefXshdef.exeDetected by Sophos as Troj/VB-DVSNo
FHPageXshdochp.exeDetected by PC Tools (now Symantec) as Trojan-Downloader.Delf.KS. The file is located in %System%No
FHStartXshdocsvc.exeDetected by PC Tools (now Symantec) as Trojan-Downloader.Delf.KS. The file is located in %System%No
Windows Service ProcessorXshdocvw.exePcPrivacyCleaner rogue security software - not recommended. The file is located in %System%No
shdwaiXshdwai.exeDetected by McAfee as RDN/Generic.tfr and by Malwarebytes as Trojan.Agent.RNDNo
shearch.exeXshearch.exeDetected by Dr.Web as Trojan.DownLoader9.39467 and by Malwarebytes as Trojan.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
SHEEVA.exeXSHEEVA.exeDetected by McAfee as RDN/Generic.tfr!dz and by Malwarebytes as Trojan.Banker.ENo
UPDATEXsheikh dark final v2.exeDetected by Malwarebytes as Backdoor.Agent.DC. The file is located in %AppData%No
SysShellDllXshell.batDetected by Dr.Web as Win32.HLLW.Autoruner2.17783 and by Malwarebytes as Worm.AutoRun.ENo
shell.exeXshell.exeDetected by Dr.Web as Trojan.Inject1.41868 and by Malwarebytes as Backdoor.Agent.DCE. The file is located in %AppData%No
Shell.exeXShell.exeDetected by Trend Micro as WORM_EMERLEOX.S and by Malwarebytes as Trojan.Agent. The file is located in %System%No
Shell.exeXShell.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp%No
Windows ShellXshell.exeDetected by Sophos as W32/Mytob-CA and by Malwarebytes as Backdoor.AgentNo
MicroUpdateXshell.exeDetected by Dr.Web as Trojan.Inject1.41868 and by Malwarebytes as Backdoor.Agent.DCENo
(Default)XShell.exeDetected by Malwarebytes as Trojan.Backdoor.ZE. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %System%No
Office Source EngineXshell.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserTemp%No
WOOKIT?Shell.exe appLaunchClientZone.shlWanadoo (which was rebranded as Orange and is now part of EE) broadband ISP relatedNo
MOBKIT?Shell.exe appLaunchClientZone.shlMobistar (which was rebranded as Orange and is now part of EE) broadband ISP relatedNo
Shell32.dllXshell32Detected by Kaspersky as Backdoor.Win32.DarkKomet.eku and by Malwarebytes as Backdoor.Agent.DCEGenNo
Shell32XShell32.comDetected by Symantec as Backdoor.Lithium. Note - this is not the legitimate Internet Explorer (iexplore.exe)No
Secure32XShell32.com StartUpAdded by the BRONTOK-CJ WORM!No
defaultXshell32.exeDetected by Symantec as Backdoor.BingheNo
ROOT2Xshell32.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %Windir%\systemNo
Shell32.exeXShell32.exeDetected by Dr.Web as Trojan.DownLoader5.11870 and by Malwarebytes as Backdoor.Agent. The file is located in %System%No
shell32.exeXshell32.exeDetected by Dr.Web as Trojan.DownLoader10.46091 and by Malwarebytes as Backdoor.Agent. The file is located in %Temp%No
ShellXShell32.exeDetected by Dr.Web as Trojan.MulDrop2.38337No
LTSMSGXShell32.exeDetected by Symantec as Infostealer.Lemir.BNo
shell32.exe.exeXshell32.exe.exeDetected by Dr.Web as Trojan.DownLoader10.46091. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Shell32XShell32.vbsDetected by Symantec as VBS.Scafene@mmNo
Win32DriverXShell32Driver.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.ENo
Shellapi32XShellapi32.exeDetected by Symantec as Backdoor.NetDevilNo
MicrosoftShellXShellcomm.exeDetected by Sophos as Troj/Bancban-QG and by Malwarebytes as Trojan.Agent.MSGenNo
ShelldaemonXShelldaemon.exeAdded by a variant of the AGENT.ALN TROJAN!No
shelldirexx.exeXshelldirexx.exeDetected by Dr.Web as Trojan.Siggen6.21914 and by Malwarebytes as Backdoor.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
wesspellXshelldm.exeDetected by Microsoft as Win32/Lethic and by Malwarebytes as Trojan.DownloaderNo
ShellDown.exeXShellDown.exeDetected by McAfee as W32/Autorun.bfr and by Malwarebytes as Worm.AutoRun.ENo
ShellExXShellEx.exeDetected by Symantec as Backdoor.AnakhaNo
SMSERIALWORKERSTARTXshellexcon.exeDetected by Intel Security/McAfee as FakeAlert-AH. The file is located in %Windir%. Installed with the SpyBurner spyware remover - which is not recommended, see hereNo
shell updateXshellexec.exeDetected by Sophos as W32/Rbot-ANCNo
ExplorerXshellexp.exeDetected by Sophos as Troj/Agent-ZY and by Malwarebytes as Trojan.AgentNo
ExplorerXshellexpl.exeDetected by Symantec as Backdoor.Sheldor and by Malwarebytes as Trojan.AgentNo
loadXShellExt.exeDetected by Malwarebytes as Backdoor.Agent.PDL. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "ShellExt.exe" (which is located in %AppData%\Microsoft)No
ShellApiXSHELLMSN.EXEDetected by Trend Micro as BKDR_NETDEV.BNo
shellsystemXshellsystem.exeDetected by Symantec as Trojan.UpchanNo
Shell Tray WindowXShellTraywnd.exeDetected by Sophos as Troj/Stultdor-ANo
StartWindowsXShellWindows.cplDetected by Malwarebytes as Trojan.Banker.E. The file is located in %AppData%\WinlogonSetupNo
W5SHFAXshfacvs.exeDetected by Malwarebytes as Trojan.Agent.FA. The file is located in %AppData%\sdchfaNo
Microsoft® Windows® Operating SystemXshfusion.exeDetected by Sophos as Mal/Agent-AIP and by Malwarebytes as Trojan.AgentNo
shginaXshgina.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %AppData%\shginaNo
shhXshh.exeDetected by Malwarebytes as Backdoor.Agent.H4. The file is located in %AppData%\shh - see hereNo
sshhXshh.exeDetected by Malwarebytes as Backdoor.Agent.H4. The file is located in %AppData%\shh - see hereNo
shhostXshhost.exeDetected by Total Defense as Backdoor.Win32.Agent.ce. The file is located in %ProgramFiles%\OutLasterNo
shicoxpNshicoxp.exeInstalled with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows ExplorerNo
Shield SecurityXshield.exeAdded by a variant of Backdoor.Rizo.A. The file is located in %System%\ComNo
Shield.exeXshield.exeDetected by Microsoft as Trojan:Win32/Scar.VNo
SpyWare ShieldUShield.exeAcronis Privacy Expert Spyware Shield - is "a special tool that monitors your system for suspicious applications and components. Spyware Shield gets enabled during its remote installation. You can enable or disable it any time you want (either locally or remotely)"No
Shield32 SecurityXshield32.exeAdded by a variant of Backdoor.Rizo.A. The file is located in %System%\ComNo
Windows ExplorerXshield32.exe.exeDetected by Kaspersky as Trojan.Win32.VB.qnz. The file is located in %System%\adobe ActiveXNo
media playerXshield32.exe.exeDetected by Kaspersky as Trojan.Win32.VB.qnz. The file is located in %System%\adobe ActiveXNo
msnmsgerXshield32.exe.exeDetected by Kaspersky as Trojan.Win32.VB.qnz. The file is located in %System%\adobe ActiveXNo
ShieldSafenessXShieldSafeness.exeShieldSafeness rogue security software - not recommended, removal instructions here. Detected by Malwarebytes as Rogue.ShieldSafeness. A member of the WiniGuard familyNo
ShieldSoftUshieldui.exeDetected by Malwarebytes as PUP.Optional.WhiteSmoke. The file is located in %AppData%\ShieldSoft\UI\bin. If bundled with another installer or not installed by choice then remove itNo
MilShieldSlaveUShieldWorker.exeMil Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activitiesNo
Intel UpdateXshihab.exeDetected by McAfee as RDN/Generic Downloader.x!id and by Malwarebytes as Trojan.Agent.MNRGenNo
ShineXshine.exeDetected by Symantec as W32.HLLC.HappylowNo
TigerXShine.exeAdded by a variant of W32.HLLC.Happylow. The file is located in %Windir%No
ShinoBOTXShinoBOT.exeDetected by McAfee as RDN/Generic Dropper!ub and by Malwarebytes as Backdoor.Bot.SHONo
Run RunOnceNShipUPS.EXEOlder version of the UPS WorldShip utility used to create and manage your UPS shipmentsNo
TESTNAME.EXEXshit.exeDetected by Malwarebytes as Backdoor.Agent. The file is located in %AppData%\windirNo
LeckmichXShit.exeDetected by Malwarebytes as Backdoor.Agent.DC. The file is located in %UserProfile%\DesktopNo
gameXshit.exeAdded by the Netclap Gold backdoor TROJAN!No
WinSrvXSHIZZLE.EXEDetected by Trend Micro as WORM_HOBBIT.CNo
ShortKeys LiteNshklite.exeShortKeys Lite - free, limited version of ShortKeys by Insight Software Solutions - "a Windows text replacement utility designed to help you type faster and more accurately. Create abbreviations (shortkeys) for longer words and phrases - which will save you time and ultimately money"No
shellbnXshlext32.exeMalware installed by different rogue security software including SpyKillerPro and the XP AntiVirus seriesNo
5stg3tXXshltedit.exeAproposMedia adware - detected by Microsoft as Trojan:Win32/AproposMedia. Also see the archived version of Andrew Clover's page. The file is located in %System%No
MSOfficeCfgXshman.exePremium rate adult content dialerNo
QTSvcXshman.exePremium rate Adult content dialerNo
NAVCheckXshman.exePremium rate adult content dialerNo
SystemServiceXshman.exePremium rate Adult content dialerNo
ShockwaveFlashsXShockwaveFlashs.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %System%No
Putty SuiteXshoot.exeDetected by McAfee as RDN/Generic.bfr!hi and by Malwarebytes as Backdoor.Agent.ENo
SAHBundleXshop1003.exeShopAtHomeSelect parasiteNo
ShopAtHomeUpdaterNShopAtHomeUpdater.exeUpdater for ShopAtHome.com - "your one-stop savings spot for online coupons, printable coupons and deals plus earn up to 35% Cash Back from thousands of online stores"No
ShopAtHomeWatcherNShopAtHomeWatcher.exePart of ShopAtHome.com - "your one-stop savings spot for online coupons, printable coupons and deals plus earn up to 35% Cash Back from thousands of online stores"No
shopbaconXshopbacon.exeDetected by Malwarebytes as Adware.K.ShopBacon. The file is located in %ProgramFiles%\shopbaconNo
ShopForUUshopforu.exeDetected by Malwarebytes as PUP.Optional.PayByAds. The file is located in %AppData%\shopforu\shopforu\[version]. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
Browser Infrastructure HelperUShopop.exeShopop ad-supported browser enhancement by Linkury. Detected by Malwarebytes as PUP.Optional.SmartBar. The file is located in %LocalAppData%\Smartbar\Application. If bundled with another installer or not installed by choice then remove itNo
ShopSafeNShopSafe.exeCreated by Orbiscom (now MasterCard) for MNBA (now Bank of America) - ShopSafe creates a temporary card number each time you make an online purchaseNo
ShopsaferUshopsafer.exeShopSafer shopping browser add-on. Detected by Malwarebytes as PUP.Optional.ShopSafer. The file is located in %ProgramFiles%\Shopsafer\Shopsafer. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
Shop To WinXShopToWin.exeJackpotRewards.ShopToWin adwareNo
Shop To WinUShopToWin.exeShop to Win provides its members with a unique opportunity to earn chances to win $500 by shopping at over 4,000 participating online retailers-winners guaranteed!" Detected by Malwarebytes as PUP.Optional.ShopToWin. The file is located in %ProgramFiles%\Shop To Win. If bundled with another installer or not installed by choice then remove itNo
shopwitUshopwit.exeDetected by Malwarebytes as PUP.Optional.ShopWit. The file is located in %LocalAppData%\shopwit\shopwit\[version]. If bundled with another installer or not installed by choice then remove itNo
Shop-witUshopwit.exeDetected by Malwarebytes as PUP.Optional.ShopWit. The file is located in %LocalAppData%\shopwit\shopwit\[version]. If bundled with another installer or not installed by choice then remove itNo
ShoreTel Personal Call ManagerUShoreTel.exeShorTel Personal Call Manager - allows you to "use your PC or laptop to manage voice communications with co-workers, customers and business associates"No
ShortKeysNSHORTKEY.EXEShortKeys by Insight Software Solutions - "a Windows text replacement utility designed to help you type faster and more accurately. Create abbreviations (shortkeys) for longer words and phrases - which will save you time and ultimately money"No
ShortKeys 2Nshortkey.exeShortKeys by Insight Software Solutions - "a Windows text replacement utility designed to help you type faster and more accurately. Create abbreviations (shortkeys) for longer words and phrases - which will save you time and ultimately money"No
ShortKeys 3Nshortkey.exeShortKeys by Insight Software Solutions - "a Windows text replacement utility designed to help you type faster and more accurately. Create abbreviations (shortkeys) for longer words and phrases - which will save you time and ultimately money"No
k8dxvgdXshosct.exeDetected by Dr.Web as Win32.HLLW.Lime.2663 and by Malwarebytes as Trojan.Agent.SHONo
wdefenderXshost.exeDetected by McAfee as RDN/Generic.bfr!dNo
shost.exeXshost.exeDetected by Dr.Web as Trojan.KillFiles.14886 and by Malwarebytes as Trojan.Tibia. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
loadXshost.exeDetected by McAfee as RDN/Generic.bfr!d. Note - this entry modifies the legitimate HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" value data to include the file "shost.exe" (which is located in %AppData%\driver) and also adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows "load" entry pointing to the same fileNo
hellodollyXshost.exeDetected by Symantec as W32.Yodo@mmNo
wfirewallXshost.exeDetected by McAfee as RDN/Generic.bfr!dNo
schostXshost.exeDetected by McAfee as RDN/Generic.bfr!d and by Malwarebytes as Trojan.AgentNo
rpc Win32Xshost32.exeDetected by Sophos as W32/Rbot-ABLNo
shosts..exeXshosts..exeDetected by McAfee as Generic Downloader.x!fza and by Malwarebytes as Trojan.FakeMSNo
shostss..exeXshostss..exeDetected by Malwarebytes as Malware.Packer.T. The file is located in %UserProfile%\IENo
shotjumbXshotjumb.exeDetected by Malwarebytes as Trojan.Downloader. The file is located in %AppData%\shotjumbNo
sHotKeyYsHotKey.exeSpecial function key manager for Chicony keyboards - see hereNo
ShottyNShotty.exeShotty by Thomas Baumann - "is an application to take pictures from your computers screen (called screenshots) or from one application only. Unlike other applications that does this Shotty provides various other features that are useful to modify the taken screenshot"Yes
Shotty - Tiny but impressive screenshot utilityNShotty.exeShotty by Thomas Baumann - "is an application to take pictures from your computers screen (called screenshots) or from one application only. Unlike other applications that does this Shotty provides various other features that are useful to modify the taken screenshot"Yes
ShowBatteryBarUShowBatteryBar.exeBatteryBar by Osiris Development - "is a simple, straight-forward, battery meter that monitors the status of your battery and displays your battery's status in the taskbar"No
ShowbehindXSHOWBEHIND.EXEAdvertisement display which can be stopped hereNo
ShowboxUShowbox.exeDetected by Malwarebytes as PUP.Optional.MultiPlug. Note - this entry loads from the Windows Startup folder and the file is located in %CommonAppData%\{GUID}. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
ShowFFXShowFF.exeFFToolBar adware toolbarNo
CyberTrioModeInfoUShowMode.exeCyberTrio from G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCsNo
Browser Infrastructure HelperUShowPass.exeShowPass ad-supported browser enhancement by Linkury. Detected by Malwarebytes as PUP.Optional.SmartBar. The file is located in %LocalAppData%\Smartbar\Application. If bundled with another installer or not installed by choice then remove itNo
ShowWndUShowWnd.exeFound on Gateway computers (and maybe others) - see here. "Showwnd is included with the Chicony keyboard software and is used by the software to stop the keyboard driver's taskbar entry from reappearing. It is not necessary to remove the keyboard software, however if you wish it can be removed through Add or Remove Programs"No
SHPC32USHPC32.exePort monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabledNo
mbahrphuXshpxxnhv.exeDetected by Malwarebytes as Trojan.Agent.SZ. The file is located in %LocalAppData%No
DelayShredNShrCL.EXEMcAfee Shredder - not required at startup. You can run it manually via McAfee Security CenterNo
MicosoftartupXshrl.exeDetected by Sophos as W32/Sdbot-JQNo
Rogers SHSUshs.exe"Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free"No
RHSI SHSUSHS.exe"Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free"No
SHSUSHS.exe"Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free"No
ShStatEXEYSHSTAT.EXEPart of McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security toolNo
HD Audio ProcessXshswsc.exeDetected by Malwarebytes as Trojan.MSIL. The file is located in %UserProfile%No
Windows Update 63X</