 |
[random 6 char filename] Qoologic downloader trojan variant using random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) - do not confuse with the Kaspersky antivirus startup item, as described here More Information
|
 |
agentsvr.exe Malware, detected by Kaspersky as AdWare.Monker.a. NOTE: do NOT confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder More Information
|
 |
ASDAPI.EXE Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll More Information
|
 |
avp.exe Added by the RBOT-GCV WORM! Not to be confused with AOL's Active Virus Shield (by Kaspersky) More Information
|
 |
Cfgwiz32.exe Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) More Information
|
 |
csrss.exe Unidentified malware. Note - this file is placed in a C:\Windows\System\Level4 folder, and should NOT be confused with the legitimate csrss.exe process which is always located in the Winnt\System32 or Windows\System32 folder and should NOT figure in Msconfig/Startup! More Information
|
 |
ctfmon.exe Added by the RAIDYS TROJAN! Note - this should not be confused with the valid Office XP file, see here More Information
|
 |
cthelper.exe Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here More Information
|
 |
deinst_qfe001.exe Added by a variant of the Win32.Small TROJAN! - Do NOT confuse with the legitimate SpywareGuard application More Information
|
 |
devldr32.exe Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file More Information
|
|
dvt.exe Installation could be a crack/hack to NOD32 here. Seen and removed in many logs. Investigate it further and if this file is present C:\d_v_t.reg then it should be fixed. Not to be confused with the DICOM entry here. Both files are located in the Windows/Windir directory More Information
|
 |
Gadu-Gadu.exe Added by a variant of the IRC.BOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu More Information
|
 |
Gadu-Gadu.exe Added by a variant of the IRC.BOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu More Information
|
 |
gcasServ.exe Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name More Information
|
 |
IexpIore.exe Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer), the first has a captial "i" in place of lower case "L" More Information
|
 |
iPODService.exe Added by a variant of the RBOT WORM! Do NOT confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the Program Files\iPod\bin folder, and is implemented as a system service, thus NOT listed in Msconfig/Startup! More Information
|
 |
itunes.exe Added by the OSCABOT-L WORM! Note - this file will be placed in the Windows\System32 or Winnt\System32 folder, and should not be confused with the (legitimate) Apple iTunes process, always located in the Program Files\iTunes folder More Information
|
 |
java.exe Added by the MYDOOM.M or MYDOOM.N or other variants of the MYDOOM WORMS! Note - not to be confused with the valid Windows "java.exe" which resides in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K) or C:\Windows\System32 (WinXP) as this resides in C:\Windows or C:\Winnt More Information
|
 |
kavmm.exe Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor, the legitimate file will always be located in the Kaspersky Lab folder in Program Files More Information
|
 |
kazaalite.exe Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original, this one does not contain any advertising or tracking mechanisms More Information
|
 |
mcupdate.exe Added by the RBOT.XT WORM! Note - this file is located in the Windows\System32 or Winnt\System32 folder, and should not be confused with the McAfee antivirus executable as described here More Information
|
 |
mcvsrte.exe Added by an unidentified WORM! Note - do not confuse with the McAfee SecurityCenter file of the same name More Information
|
 |
MSGSRV32.EXE Added by the LITMUS.A TROJAN! Note - MSGSRV32.EXE in this case is in a Litmus sub-directory and is not to be confused with the valid version in C:\Windows\System More Information
|
 |
msgsvr32.exe Added by the DEADHAT.B WORM! Note - not to be confused with the valid "msgsrv32.exe" file which resides in the same directory (C:\Windows\System) on a Win9x/Me machine More Information
|
 |
msmsgs.exe Added by the ZLOB-I and ZLOB-H TROJANS! Note - not to be confused with msmsgs.exe, the well known MSN Instant Messaging application! More Information
|
|