CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

spacer spacer

O23 List of Windows XP/NT services

Currently 4053 entries and growing...
Last updated on 2008-08-02 17:32:28 Eastern.


This list was originally started at SpywareAid with 730 entries and Matt gave CastleCops permission to host it. CastleCops has since (May 2005) been adding new entries to it here. The new items may not be in the original list but attempts are made to ensure the original is also updated. The full HTML list is here.

KEY:
  • "L" = Legitimate
  • "O" = Open to Debate
  • "X" = Malware/Bad
  • "?" - Unknown

  •   

    ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z




    Full List

    NameStatusFilenameDescription
    LANDesk Remote Control Service (ISSUSER)Lissuser.exeRelated to LANDesk_Remote_Control Service. Note: Located in C:\Program Files\LANDesk\LDClient\
    LANDesk® Management AgentLresidentagent.exePart of LANDesk Management Suite.
    lanmandrvXlanmandrv.sys Troj/Laqma-A Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K) Reduces system security. Read link
    LanSafe Power Monitor (LanSafe PM)LPowerMonitor.exeRelated to LanSafe_Power_Monitor from Powerware. Uninterruptible Power Supply Note: Located in C:\Program Files\Powerware\LanSafe\Bin\
    LanSafe Process ManagerLxyntservice.exeRelated to LanSafe_Process_Manager from Powerware. Uninterruptible Power Supply Note: Located in C:\Program Files\Powerware\LanSafe\Bin\
    LanScsi Helper ServiceLLDServ.exeRelated to XiMeta Inc.
    Lavasoft Ad-Aware Service (aawservice)Laawservice.exeRelated to Ad-Aware 2008
    Lavasoft Personal Firewall Service (LavasoftFirewall)Llpfw.exeRelated to Lavasoft_Personal_Firewall service. Note: Located in C:\Program Files\Lavasoft\Personal Firewall\
    LckFldServiceLLckFldService.exeRelated to Folder_Access will assist you to to protect your private data from unwanted access. Note: Located in C:\WINDOWS\system32\ More here
    LCSLlcs.exeRelated to 3Com Wireless USB Utility Located in C:\Program Files\3COM Technology Corporation
    LDDSERV (SAP DBTech-LDDSERV)Lkernel.exeRelated to SAP_MaxDB The SAP Database System. Note: Located in \%Program Files%\SAPDB\DEPEND\pgm\
    ldrsvcXclean_(random number).dll Troj/Bdoor-AEG File located in %temp%
    LEC TranslateDotNet ServerLLogoMedia TranslateDotNet Server.exeTranslates email, web pages, documents and instant messages. Made by the Language Engineering Company, for more information Click_Here File location is in the Program Files\Power Translator folder.
    Leica Microsystems Data Container V1LLMSDataContainerServer.exeRelated to Leica_Microsystems Now Vistec_Semiconductor_Systems advanced technologies in optics.
    Lexar JD31 (LxrJD31s)LLxrJD31s.exeLexar "JumpDrive" driver. From Lexar_Media_Inc
    Lexar Secure II (LxrSII1s)LLxrSII1s.exeRelated to Lexar_Media Inc. removable flash memory cards, USB flash drives, card readers etc...
    Lexar SG20LLxrSG20s.exeRelated to Lexar_Media Inc. Lexar offers a wide range of storage products. Note: Located in C:\WINDOWS\SYSTEM32\
    LexBce Server (LexBceS)LLEXBCES.EXELexmark Printer Service
    Lexmark Document Solutions Web ServerLtomcat.exeRelated to Lexmark_Document Solutions Web printer Server from Lexmark. Note: Located in \%Program Files%\Lexmark\Document Solutions\Services\tomcat\bin\
    LibUsb-Win32 - Daemon, Version 0.1.8.0Llibusbd-nt.exe LibUsb open-source USB driver
    LicCtrl Service (LicCtrlService)Lrunservice.exePart of the eLicense Copy Protection scheme employed by some software and games. (Castlecops Startup List)
    License AgentLcla.exeLicense Agent for the HiPath 1220 digital PBX system from Siemens. For more information Click_Here File location is in the Program Files\Licensing\License Agent\bin folder.
    License Management (CLMTomcatStarterSvc)Ltomcat.exeRelated to Apache_Tomcat Owner: Alexandria Software Consulting.
    License Management Service ESDLLicence Manager ESD.exeRelated to the Licence_Manager_ESD.exe is the element5 License Management Service, used by some software for license checking and management. Leave it alone to ensure the software installed on your computer working properly. Note: located in C:\Program Files\Common Files\element5 Shared\Service\
    LicenseManagerSocketLLicenseManagerSocket.exeRelated to UIC License Manager a propriatiry Sofstware. Used to activate a software on customer computers for a specified length of time. Note: Located in C:\Program Files\Universal Instruments\License Manager\
    LifeView HID Service (LvHidSvc)Olvhidsvc.exeRemote access service by Animation Technologies Inc. Legitimate, but remote access could be considered dangerous unless monitored carefully.
    LightScribeService Direct Disc Labeling Service
    (LightScribeService)
    LLSSrvc.exe LightScribe related to Hewlett Packard
    Linksys Updater (LinksysUpdater)LLinksysUpdater.exeRelated to Linksys Router support update. Note: Located in \%Program Files%\Linksys\Linksys Updater\bin\
    LISTSERV (primary instance) (LISTSERV)LLSV.EXERelated to L-Soft a leading provider of email list management software, email marketing software and email list hosting services. Note: Located in \%ROOT%\LISTSERV\MAIN\
    LISTSERV SMTP Listener (LISTSERV-SMTP)LSMTPL.EXERelated to L-Soft a leading provider of email list management software, email marketing software and email list hosting services. Note: Located in \%ROOT%\LISTSERV\MAIN\
    LiveXqbuae.dll Troj/QQHelp-Gen Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (Vista/XP/WinNT/2K) Installs numerous files and other services. Read the link
    LiveShare P2P Server (RoxLiveShare)LRoxLiveShare.exeRelated to Roxio_Inc
    LiveShare P2P Server 10 (RoxLiveShare10)LRoxLiveShare10.exeRelated to Roxio_Inc Easy Media Creator 10. Note: Located in \%Program Files%\Common Files\Roxio Shared\10.0\SharedCOM\
    LiveShare P2P Server 9 (RoxLiveShare9)LRoxLiveShare9.exeRelated to Roxio_Inc
    LiveUpdateLLUCOMS~1.EXERelated to Norton Internet securty suite and provides up to date antivirus data for your Norton Anti-virus product. (Filename is LUCOMSERVER.EXE, or LUCOMSERVER_2_5.EXE)
    LiveUpdateLLuComServer_3_2.EXERelated to Symantec LiveUpdate
    LiveUpdateLLUCOMS~2.EXERelated to Norton Internet securty suite and provides up to date antivirus data for your Norton Anti-virus product. (Filename is LUCOMSERVER.EXE, or LUCOMSERVER_2_5.EXE)
    LiveUpdateLLuComServer_3_4.EXERelated to Symantec LiveUpdate
    LiveUpdateLLuComServer_3_0.EXERelated to Symantec LiveUpdate
    LiveUpdate NoticeLccSvcHst.exeRelated to LiveUpdate_Notice_Service from Symantec
    LiveUpdate Notice ServiceLPIFSvc.exeRelated to LiveUpdate_Notice_Service from Symantec Note: Located in C:\Program Files\Common Files\Symantec Shared\PIF\
    LiveUpdate Notice Service Ex (LiveUpdate Notice Ex)LccSvcHst.exeRelated to Symantec_Lic_NetConnect service. Note: Located in \%Program Files%\Common Files\Symantec Shared\
    lmab_deviceLLMabcoms.exeRelated to Lexmark products
    LmHostsXsvchost.exe -k LmHostsAdded by the Fuwudoor TROJAN!
    LMMng (memlow)Xmemlow.sysAdded by the Troj/Haxdoor-AA TROJAN!
    Loading Outpost ConnectionsXcmdtel.exeWin32.Bagz.i email virus
    Local Connection Manager (8NASCAR)XDWUXJ.DLL Troj/QQHelp-Gen Note:Located in C:\Windows\System\wbem (Win9x/Me), C:\%WINDIR%\System32\wbem (Vista/XP/WinNT/2K) Installs numerous files and other services. Read the link
    Local Network Service (algs)Xgettfo.exeAdded by a variant of the W32/SDBOT WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder. The filename can be different
    Local Security Authority (LASec)Xlsass.exeKaspersky 7.0.0.125 2007.11.26 Backdoor.Win32.SdBot.aad Note:Located in C:\Windows\Config (Win9x/Me), C:\%WINDIR%\Config (Vista/XP/WinNT/2K)
    Local Security Authority Server (LSaServ)Xlsasrv.exeDetected as W32/Hupigon.gen76 by F-Secure Note: Located in %windir%\cursors
    Local Security Authority Subsystem Library (LSA Server)Xlsasrv.exeAdded by the Win32/Amahkey.F TROJAN! Note: This trojan is located in C:\%WINDIR%\
    Local Security Authority Subsystem Service (lsass)Xlsass.exeAdded by the W32/Tilebot-AK or W32.Spybot.ABDO WORM! Note: This is not the legitimate Windows process lsass.exe (Which is always found in the System32 folder). This worm file is found in the Windows or Winnt folder.
    Local Security Authority System Service (lsass)Xlsass.exeAdded by the W32/Rbot-AJA WORM! Note: This is not the legitimate Windows process lsass.exe (Which is always found in the System32 folder). This worm file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    Local Security Policy (Windows Local Security Policy)Xwpablan.exeUnidentified SDbot, probable variant of "W32/Sdbot-CWR".
    Local Service (LocalSystem)Xchfmon.exeAdded by the W32/Agobot-AIM WORM! Note: This worm\trojan is located in C:\%WINDIR%\ Read the link, allows remote access, steal information ...
    LocalPassSvcsXlocalpst.dll W32/Mofei-X Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (Vista/XP/WinNT/2K) Installs multiple files. Read the link
    Log Manager (Manager)Xwinup.exe W32/Spybot-NV Located in C:\Windows directory
    Logical Disk Manager Administrative Service (dmadmin)Ldmadmin.exeRelated to Veritas logical disk manager
    Logitech (Logitech Checker)Xlogitech.exeAdded by a variant of the W32/SDBOT WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder
    Logitech Bluetooth Service (LBTServ)LLBTSERV.EXERelated to bluetooth products from Logitech
    Logitech Easy SynchronizationLservicestub.exeRelated to Logitech_Easy, SSynchronization Logitech Easy Synchronization application, which allows you to easily synchronize your Bluetooth devices with your PC by pressing the dedicated key on your Logitech keyboard. Leave it running if you find it useful. Note: Located in \%Program Files%\Logitech\Easy Synchronization\
    Logitech IncXLBTSERV.EXEIdentified by BitDefender antivirus as a variant of the Backdoor.Sdbot.DEXZ worm and IRC backdoor. Note: located in \%WINDIR%\
    Logitech MM50 Kernel DriversXmm50krnl.exe W32/Spybot-NT Read the link, allows remote access
    Logitech Process Monitor (LVPrcSrv)LLVPrcSrv.exeRelated to Logitech QuickCam Provides additional configuration options for these devices.
    Logitech QuickCam ManagerXmlqm.exeAdded by the W32/Sdbot-DIJ WORM! Note: located in \%WINDIR%\System32\dllcache\ Read the link, allows remote access
    LogMeInLLogMeIn.exeRelated to LogMeIn LogMeIn Rescue is used by IT helpdesks to provide instant remote support to customers and employees. Note: located in C:\Program Files\LogMeIn\
    LogMeIn Backup Maintenance Service (BackupMaint)LBackupMaint.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Backup Storage PC Service
    (LogMeInBackupService.exe)
    LLogmeInBackupService.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Backup VSS Service (LMIBackupVSSService.exe)Llmibackupvssservice.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Maintenance Service (LMIMaint)LRaMaint.exeRelated to LogMeIn LogMeIn Rescue is used by IT helpdesks to provide instant remote support to customers and employees. Note: located in C:\Program Files\LogMeIn\x86\
    Logon Process (WinLogon)Xwinlogon.exeAdded by a the Win32.IRCBot.zx Spyware WORM! a variant of the W32/IRCBot-UN Note: This worm\trojan is located in C:\%WINDIR%\
    LOGON suport serviceXIES4SERVICE.SYSAdded by the Goldun.G TROJAN! Note: This trojan file is found in the System32 folder.
    Logon Task ManagerXsymon.exeAdded by the Worm_Ircbot_Gen TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\System32\dllcache\ (XP/WinNT/2K)
    Logon Terminal ManagerXspoolsc.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    LogonSvc (LogonSvcID)Llogonsvc.exeRelated to E-Pop web conferencing Note: Located in C:\Program Files\E-Pop\
    Lookout Citadel Server (LkCitadelServer)Llkcitdl.exeRelated to Lookout_Citadel_Server From National Instruments, Inc. Note: Located in C:\WINDOWS\system32\
    Lotus Notes Single LogonLnslsvice.exeIBM Lotus Notes Single Logon Service - http://www.anti-spy.info/process/nslsvice.exe.html
    lpclLlpcl.exeRelated to Warranty_Corporation_of_America More here Note: Located in \%WINDIR%\
    Lpdriver (Lpdriver)Xlpdriver.sysAdded by the W32/Tilebot-H or W32/Sdbot-ADG WORM! Note: This worm file is found in the System32 folder.
    LPTRDC server (LPTRDCsrv)Xctfmon.exeIdentified as TrojanDownloader:Win32/Fourta.A Malware Note: located in \%WINDIR%\ Note: Use SDFix under supervision.
    LSA ServerXlsasrv.exe Win32/IrmBot.worm.215040 Note: Located in %windir%
    LSA Shel (Export Version)Xlsass.exeAdded by the W32/Tilebot-HQ WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    LSA Shell Export-VersionXlsass.exeAdded by the W32/Tilebot-IU WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    lsass (lsass)Xlsass.exeAdded by the W32/Rbot-AIC WORM! Note: This is not the legitimate Windows process. (Which is always found in the System32 folder.) This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    lsass (Workstations)Xautoexec.exeAdded by the W32/Sdbot-AFN WORM! Note: This worm file is found in the System32 folder.
    LsassFTP daemon (LsassFTPD)XLsassFtpd.exeAdded by the SDBOT.CDW WORM! Read the link, rootkit type stealth involved.
    LsassFTPzz daemon (LsassFTPDzz)XLsassFtpdz.exeAdded by the W32/Rbot-ARL WORM! Note: This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    LsdiorwLlsdiorw.exePart of macdisk
    LucentIKELLucentIKESvc.exeRelated VPN_ IPSec Client from Lucent. Note: Located in \%Program Files%\IPSec Client\
    LVCOMSerLLVComSer.exeRelated to LVCOMSer from Logitech. Note: Located in \%Program Files%\Common Files\LogiShrd\LVCOMSER\
    LVSrvLauncherLSrvLnch.exe Related to Logitech products
    LWWLicenseServiceLLWWLicenseService.exeRelated to Wolters_Kluwer The Professional's First Choice for information, tools and solutions that help professionals make their most critical decisions. Note: located in C:\Program Files\Common Files\WoltersKluwerLWW Shared\Service\
    lxba_deviceLlxbacoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxbc_deviceLlxbccoms.exeRelated to Lexmark_International and its printer services. Note: Located in \%WINDIR%\System32\
    lxbf_deviceLlxbfcoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxbk_deviceLlxbkcoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxbs_deviceLlxbscoms.exeRelated to LXB_Device LXB provides, secure backup.
    lxbt_deviceLlxbtcoms.exeLexmark International services. http://www.lexmark.com/
    lxbu_deviceLlxbucoms.exeRelated to Lexmark Printers. Provides additional configuration options for these devices
    lxbx_deviceLlxbxcoms.exeRelated to Lexmark International, Inc Printer service. Note: located in C:\WINDOWS\System32\
    lxby_deviceLlxbycoms.exeRelated to Lexmark Printer service. Note: located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    LXCCCustomerConnect (audieqaah)Xlmgug.exeAdded by a variant of the Backdoor.Oderoor Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision. Note:Random names are used for the service and filename.
    lxcc_deviceLlxcccoms.exeRelated to Lexmark International, inc. Communication module for Lexmark products. Disabling will cause loss of functionality.
    lxcd_deviceLlxcdcoms.exeRelated to Lexmar Lexmark International, Inc. Printers Note: Located in C:\WINDOWS\System32\
    LXCECustomerConnectLLXCEserv.exeAppears to be related to Lexmark printers
    lxce_deviceLlxcecoms.exeRelated to Lexmark, Inc. printers
    lxcf_deviceLlxcfcoms.exeLexmark printer related
    LXCGCustomerConnectLLXCGserv.exeRelated to Lexmark_Inkjet_printer Spool driver. Note: Located in C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\
    lxcg_deviceLlxcgcoms.exeRelated to Lexmark printer
    lxcj_deviceLlxcjcoms.exeRelated to Related to Lexmark printers. Note: Located in \%WINDIR%\System32\
    lxcq_deviceLlxcqcoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxcr_deviceLlxcrcoms.exeRelated to Lexmark 2400 series printer monitor software. Disabling will cause loss of functionality. Note: Located in C:\Program Files\Lexmark 2400 Series\
    lxct_deviceLlxctcoms.exeRelated to Lexmark_International and its printer services. red]Note: Located in C:\WINDOWS\SYSTEM32\
    lxcv_device Llxcvcoms.exe Windows Vista driver for Lexmark Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (Vista/XP/WinNT/2K)
    lxcy_deviceLlxcycoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxcz_device Llxczcoms.exeRelated to Lexmark printers
    lxdcCATSCustConnectServiceLlxdcserv.exeAdded by Lexmark printer software Located in C:\WINDOWS\system32spool\DRIVERS\W32X86\3\\
    lxdc_deviceLlxdccoms.exeAdded by Lexmark printer software Located in C:\WINDOWS\system32
    lxddCATSCustConnectServicelxddserv.exeRelated to lxdd_CATS_Cust_Connect_Service for Lexmark printers. Note: Located in \%WINDIR%\System32\spool\DRIVERS\W32X86\3\
    lxddCATSCustConnectServiceLlxddserv.exeRelated to Lexmark printers. Note: Located in \%WINDIR%\System32\spool\DRIVERS\W32X86\3\\
    lxdd_deviceLlxddcoms.exeRelated to lxdd_device for Lexmark printers. Note: Located in \%WINDIR%\System32\
    lxdiCATSCustConnectServiceLlxdiserv.exeRelated to Related to Lexmark printers Note: Located in %windir%\System32\spool\DRIVERS\W32X86\3\\
    lxdi_deviceLlxdicoms.exeRelated to Related to Lexmark printers Note: Located in %windir%\System32\
    lxdj_deviceLlxdjcoms.exeRelated to Lexmar International, Inc. Printers Note: Located in C:\WINDOWS\System32\
    lxdk_deviceLlxdkcoms.exeRelated to Lexmar International, Inc. Printers Note: Located in C:\WINDOWS\System32\
    lxdvCATSCustConnectServiceLlxdvserv.exeRelated to Lexmark Printers. Note: Located in %windir%\System32\spool\DRIVERS\W32X86\3\\
    lxdv_deviceLlxdvcoms.exeRelated to Lexmark Printers. Note: Located in %windir%\System32\
    lxdwCATSCustConnectServiceLlxdwserv.exeRelated to lxdd_CATS_Cust_Connect_Service for Lexmark printers. Note: Located in \%WINDIR%\System32\spool\DRIVERS\W32X86\3\
    lxdw_deviceLlxdwcoms.exeRelated to Related to Lexmark printers Note: Located in %windir%\System32\
    Lync USB Auditor Service (LyncUSBServ)Llyncusb.exeRelated to Lync_USB A toolkit that delivers an integrated removable media device discovery and auditing solution for enterprise IT management applications.

    Engine Version 2.0 by CastleCops

    spacer spacer