CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

spacer spacer

O23 List of Windows XP/NT services

Currently 4053 entries and growing...
Last updated on 2008-08-02 17:32:28 Eastern.

This list was originally started at SpywareAid with 730 entries and Matt gave CastleCops permission to host it. CastleCops has since (May 2005) been adding new entries to it here. The new items may not be in the original list but attempts are made to ensure the original is also updated. The full HTML list is here.

KEY:
  • "L" = Legitimate
  • "O" = Open to Debate
  • "X" = Malware/Bad
  • "?" - Unknown

    •   

    ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z




    Full List

    NameStatusFilenameDescription
    S3 Graphics Co., Ltd.XVTTrayp.exe W32/Sdbot-DHA Note:Located in C:\Windows (Win9x/Me), C:\%WINDIR% (Vista/XP/WinNT/2K)
    s3contrl (32-bit)XVTTray.exeAdded by a variant of the Backdoor.Win32.SdBot.cep family of worms and IRC backdoor Trojans. Note: located in \%WINDIR%\
    SafeBoot Configuration Manager
    (SafeBootConfigurationManager)    		LSBMGRNT.EXERelated to SafeBoot_Configuration Manager. Encryption software. Note: Located in \%Program Files%\SafeBoot\
    SafeBootAgentOsrvany.exeMicrosoft Windows application which allows an executable to be run as a service. If you have installed this service, fine, otherwise investigage. Can be used to load Malware.
    SafeGuard Easy Client (SgeClient)LSgeClient.exeRelated to SafeGuard_Easy Hard Disk Encryption from Utimaco. Note: Located in C:\Program Files\Utimaco\SafeGuard Easy\
    SafeGuard Easy Workstation Server (WksCfgSrv)LWksCfgSrv.exeRelated to SafeGuard_Easy Hard Disk Encryption from Utimaco. Note: Located in C:\Program Files\Utimaco\SafeGuard Easy\
    SafeGuard SGLOG Player (SgLogPlayer)LSgLogPlayer.exeRelated to SafeGuard_Easy Hard Disk Encryption from Utimaco. Note: Located in C:\WINDOWS\system32\
    SafeNet IKE Service (IREIKE)LIreIKE.exeRelated to Microsoft Virtual Private Network Client.
    SafeNet Monitor Service (IPSECMON)LIPSecMon.exeRelated to Microsoft Corp. Feature of the Layer Two Tunneling Protocol (L2TP).
    Samsung Update PlusLSLUBackgroundService.exeRelated to Samsung_AV_Station instant Playback of music photos, videos.
    SAMSvc (Security Account Manager)XSAMSvc.exeAdded by the W32/Tilebot-DL, WORM!
    Sandboxie Service (SandboxU)LSandboxieServer.exeRelated to SandBoxie Sand box application. Data may flow from the hard disk into the sandbox. But data never flows back from the sandbox into the hard disk. Note: Located in C:\Program Files\Sandboxie\
    Sandboxie Service (SbieSvc)LSbieSvc.exeRelated to Sandboxie Service. Intercepts changes to both your files and registry settings, making it virtually impossible for any software to reach outside the sandbox. Note: Located in \%Program Files%\Sandboxie\
    Sandra Data Service (SandraDataSrv)LRpcDataSrv.exeSiSoftware Sandra Lite 2005
    Sandra Service (SandraTheSrv)LRpcSandraSrv.exeSiSoftware Sandra Lite 2005
    Sansa Updater Service (SansaService)LSansaSvr.exeRelated to Sansa_Updater Service from Sandisk. Note: Located in C:\Program Files\SanDisk\Sansa Updater\
    SAP Business One BackUp Service (SBOBackUp)LB1backUp.exeL Related to SAP Business One gives you the information you need to select and implement business management software. Note: Located in \%Program Files%\SAP\SAP Business One ServerTools\BackUp\
    SAP Business One DI Server (SBODI_Server)LB1DI_Server.exeRelated to SAP_Business_One gives you the information you need to select and implement business management software. Note: Located in \%Program Files%\SAP\SAP Business One ServerTools\DI_Server\
    SAP Business One Early Watch Alert (B1EwaService)LEwaService.exeRelated to SAP Business One gives you the information you need to select and implement business management software. Note: Located in \%Program Files%\SAP\SAP Business One ServerTools\EWA\EwaService.exe
    SAP Business One License Manager 2005 (B1Lic2005)LB1License.exeL Related to SAP Business One gives you the information you need to select and implement business management software. Note: Located in \%Program Files%\SAP\SAP Business One ServerTools\License\
    SAP DB WWW (SAPDBWWW)Lwahttp.exeRelated to SAP_MaxDB The SAP Database System. Note: Located in \%Program Files%\SAPDB\indep_prog\web\pgm\
    SAPDB: WEB (SAP DBTech-WEB)Lkernel.exeRelated to SAP_MaxDB The SAP Database System. Note: Located in \%Program Files%\SAPDB\DEPEND\pgm\
    SAVRoam (SavRoam)LSavRoam.exeRelated to Norton/Symantec AntiVirus
    SAVScanLSAVScan.exeRelated to Norton AntiVirus Note: Located in \%Program Files%\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    sbchosy.batXsbchosy.batAdded by the Troj/GrayBir-AA TROJAN! Note: This trojan file is found in the Windows\Program Files or Winnt\Program Files folder.
    SBHookSvcLSBHookSvc.exeRelated to Motive_Communications Broadband service. Note: Located in C:\PROGRAM FILES\NETASSISTANT\SMARTBRIDGE\
    SbPF.LauncherLSbPFLnch.exeRelated to Sunbelt Personal Firewall. Note: Located in \%Program Files%\Sunbelt Software\Personal Firewall\
    SBRLLA For FM Advisor (SBRLLA)LSBRSVC.EXERelated to SBRLLA_For_FM_Advisor FUJITSU computer. Note: Located in \%Program Files%\Fujitsu\sa\api\
    SBSD Security Center Service (SBSDWSCService)LSDWinSec.exeRelated to SpyBot_and_Destroy Security Center Service integration with Vista Windows Security Center. Microsoft ships Windows Defender with Vista, however, Spybot-S&D can now easily integrate into the Vista Security Center; which will then monitor if Spybot-S&D is up-to-date and whether the permanent protection (TeaTimer) is running or not. This update will only show on Vista systems, since previous Windows versions do not offer anti malware integration into WSC. Note: Located in \%Program Files%\Spybot - Search & Destroy\
    SCA (Service Control Application)XSYSTEM.EXEUnknown virus
    ScanRouterDriverV2Lsrscandr.exeRelated to Ricoh Document System Server Information Service. Note: Located in \%Program Files%\RDS\
    scheduler (schedul3.exe)Xschedul3.exeAdded by the W32/Rbot-AVX TROJAN! Note: This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    Scheduling Agent (Mstinit)Xmstinit.exeAdded by the W32/Tilebot-IO WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    schscntLschscnt.exeRelated to Command AntiVirus for Windows Component, made by Command Software Systems, Inc. Which merged with Authentium in 2002.
    SCNDmem (winlow)Xwinlow.sysAdded by the Troj/Haxdoor-AF TROJAN!
    Scorer Service (ScorerService)Lstscor.exeRelated to Sentry_At_Home Parental Controls software. Note: Located in \%WINDIR%\System32\
    screen shots (epep)Xscreenshot.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.
    Scribe AdminServerLAdminServer.exeRelated to Scribe Admin. Server. Data integration between Salesforce and Microsoft Dynamics GP. Note: Located in \%Program Files%\Scribe\
    ScriptBlocking Service (SBService)LSBServ.exeRelated to Norton/Symantec AntiVirus.
    ScriptLogic Service (SLClient)LslClient.exeRelated to ScriptLogic Remote management and control for I.T. personnel. Note: Located in \%WINDIR%\System32\
    ScsiAccessLScsiAccess.EXEAlcohol Software's CD/DVD writing application
    SCSMS32 (SCSMS)Xscmsm32.exeAdded by the SDBOT.CCN or SDBOT.CEZ WORM! Read the link, rootkit type stealth involved.
    SCWatch 4.0Lscwatch4.exeRelated to White Canyon - protect against identity theft software. - http://www.whitecanyon.com/index.php
    SDCAgentLESRVANY.EXERelated to Service_Deliver_Center from IBM Global Services, SRM (Server Resource Management). Note: Located in \%Program Files%\SDC\
    SDJB ManagerLsdjbmgr.exePanasonic\SD-JukeboxV3
    sdkXlsass.exe W32/Sdbot-DEF Read the link, allows remote access
    sdktempXMicrosoft.exeAdded by the SDBOT.CGM WORM! Read the link, rootkit type stealth involved.
    sdktemp (sdktemp)XSDKTEMP.EXEAdded by the W32/Tilebot-A WORM! Read the link, rootkit type stealth involved.
    sdktemp (sdktemp)Xaxdcfasb.exeAdded by the W32/Sdbot-AGI WORM! Read the link, rootkit type stealth involved.
    SDPAUMS server serviceLsdpasvc.exeMatsushita Electric Industrial Co.,Ltd.
    SDServiceLSDService.exeRelated to Spyware_Detector from Max Secure. Note: Located in C:\Program Files\SpywareDetector\
    Seagate CommunicationXseagatecom.exeAdded by the W32/Spybot-NF WORM! Note: This worm\trojan is located in C:\%WINDIR%\System32\dllcache\ (XP/WinNT/2K)
    Seagate Page Server (pageserver)Lpageserver.exeRelated to Seagate Page Server. Now owned by Business_Objects Note: Located in C:\Program Files\Seagate Software\WCS\
    Seagate Web Component Server (WebCompServer)LWebCompServer.exeRelated to Seagate Web Component Server. Now owned by Business_Objects Note: Located in C:\Program Files\Seagate Software\WCS\
    Search Engine Commando Schedule ServiceLScheduleService.exeRelated to Search Engine Commando
    SecdrvXsecdrv.sys Troj/Pushu-Gen Note:Located in C:\Windows\System\Drivers (Win9x/Me), C:\%WINDIR%\System32\Drivers (XP/WinNT/2K) May also have an additional services installed. Read link
    Secondary .NET Framework (SVSNET)Xsvsnet.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Secure (Secure Windows NT)Xsecure.exeIdentified as the Backdoor.Win32.Iroffer malware. Note: Located in \%WINDIR%\System32
    Secure Port Server (Server Administrator)Lomaws32.exeRelated to Dell Open Management system. http://www.what-process.com/process-info.aspx?p=omaws32.exe
    Secure Socket LayerXssls.exeAdded by the W32/Spybot-NE WORM! Note: This worm\trojan is located in C:\%WINDIR%\System32\dllcache\ (XP/WinNT/2K)
    Secure SSL System (Secure)Xsecuressl.exeAdded by the Haxdoor.Fam HAXDOOR! Note: Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Secured Process (secureprocess)Xsecureprocs32.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.
    SecureLockWare ?LENCRDLG.exeRelated to SecureLockWare from BUFFALO INC. Secure Lock Ware’s 256-bit capable AES encryption provides powerful protection for data on your portable USB devices. Note: Located in \%Program Files%\BUFFALO\Encrdisk\
    Securemaker Disk Defragmenter Service (smdefrag)Lsmdefrag.exeRelated to Securemaker Tool to clean your computer of unwanted files and much more. Note: Located in \%Program Files%\SECUREMAKER\
    Security Accounts Center (Security Accounts Center)Xwindowo.exeAdded by the Troj/Bckdr-AWQ TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
    Security Accounts Manager (SamSs)Llsass.exeRelated to Security_Accounts_Manager for servers. Note: Located in \%WINDIR%\system32\
    Security Accounts ManagesXTIMPlatform.exe Troj/Delf-EWW
    Security Agent (scagent)Xscagent.exeAdded by the Troj/Dload-LV TROJAN! Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Security Logs Service (SLSVS)XSM1OGSVC.EXEAdded by the Troj/Tenant-A TROJAN! Note: This trojan file is found in the System32 folder.
    Security Platform Management Service (IFXSpMgtSrv)LIFXSPMGT.exeRelated to Security_Platform_Management Service from Infineon Technologies. Note: Located in C:\WINDOWS\system32\
    Security Service (JVWC)Xsvchost.exeAdded by a variant of the TrojanProxy:Win32/Chumpoke.gen!A malware Note: This worm\trojan is located in \%WINDIR%\System32\svcd\
    Security System ManagerXspoolvc.exe W32/Sdbot-DCW Read the link, allows remote access
    Security Task ManagerXspoolvc.exeAdded by the W32/Tilebot-IX WORM! Note: Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Security Windows services (WinSecurServ05)Xsvchost.exeUnknown malware Note: Located in \%WINDIR%\System32\\Microsoft\ This infection should not be confused with the legitimate \%WINDIR%\System32\svchost.exe file. Note: Use SDFix under supervision.
    Security_ServiceLTmrService.exe Related to Child Control 2007 Lets you set time limits for the PC and the Internet, and block or filter unwanted Internet content. Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Securom User Access for Windows 2000 and Windows XP a
    technology by Sony DADC (UserAccess)    		Luseraccess.exeRelated to Sony DADC Blu-ray Disc is the next generation optical disc format.
    SecuROM User Access Service (UserAccess)LUAService.exeAdded by SecuROM
    SecuROM User Access Service (V7) (UserAccess7)LUAService7.exeUsed by virtual CD programs like Alcohol to access CD images protected by SecureROM.
    Senao Network ControllerXwinsno.exe W32/Vanebot-AU Read the link, steals information
    Sentinel Keys Server (SentinelKeysServer)Lsntlkeyssrvr.exeRelated to Sentinel_Keys_Server from SafeNet Inc. Disks and Files encryption. Note: Located in \%Program Files%\Common Files\SafeNet Sentinel\Sentinel Keys Server\
    Sentinel Protection Server (SentinelProtectionServer)Lspnsrvnt.exeRelated to one of the SafeNet_Inc programs or services.
    Sentry 2020LSentryService.exewww.softwinter.com
    SerDgeonServer (SerDry_igeon_Server)XIExplore.exeAdded by the Troj/Feutel-AC TROJAN! Note: This is not the legitimate Windows process IExplore.exe (Which should be found in the Program Files\Internet Explorer folder.) This worm\trojan file (IExplore.exe) is found in the Windows or Winnt folder.
    Serv-U FTP Server (Serv-U)OServUDaemon.exeRelated to Serv-U an FTP server from RhinoSoft.com NoteIf you did not install this server you should remove it.
    Server 2.0 (Server 2.0)XServer.exeAdded by the Troj/GrayBrd-AN TROJAN! Note: This worm\trojan file is found in the Windows or Winnt folder.
    Server Advance (ServerAC)XSecurity.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Server Management ServiceXsvchost.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.)
    Server Network Debug (SerND)XNetDebug.exe W32/VB-DOS Note: Located in %windir%\system32
    Server VSS SystemXsysvrs32.exe W32/Sdbot-DES Read the link, allows remote access
    Servers Alive (salive)Lserversalive.exeRelated to Servers_Alive a network monitoring tool
    ServiceXService.exeAdded by the Troj/SrchSpy-A TROJAN! Note: This is not the legitimate Windows process services.exe (Notice the difference in the spelling.) This trojan file (Service.exe) is also found in the System32 folder. Do not confuse the two!
    ServiceXService.exeAdded by the Haxdoor.Fam HAXDOOR! Note: Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    SERVICE (WINDOWS)Xspoolsvc.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Service 8 (Service Filter)Xsmncs.exeAdded by the W32/Tilebot-CK WORM! which attempts to spread to remote network shares and messaging applications
    Service Cache Terminal (SVCTERM)Xsvscache.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Service Configurator (Service_v1)Xservice.exeAdded by the Backdoor.Win32.SdBot.aad TROJAN! Note: This trojan is located in \%WINDIR%\Config\
    Service Controller (Services)Xservices.exe W32/Sdbot-DDT Read the link, allows remote access
    Service Cvasvr (Service Cvas)Xcsvas.exeSpyware Worm reported as Backdoor.Win32.SdBot.aad by Kaspersky Anti-Virus
    Service de l'iPod (iPod Service)LiPodService.exeRelated to Apple iPod
    Service de lancement de WlanCfg (Wlancfg)Lwlancfg.exeDriver for wireless router. Owner: Inventel-Found in C:\Program Files\Inventel\Gateway\
    Service Hosts (ServiceHost)Xshost.exeAdded by the W32/Rbot-AXG WORM! Note: This worm file is found in the Windows or Winnt folder.
    Service Ithea (itheaService)LitheaSvc.EXERelated to ITHEA a french protection software. Note: Located in \%WINDIR%\System32\
    Service Logon Protocol (SVSLOG)Xsvslogon.exeAdded by an unknown variant of a backdoor TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\
    Service ManagerXtesting.exeAdded by a of the IRCBot family of worms and IRC backdoor Trojans. Note: located in \%WINDIR%\
    Service name: MessengerXsystem32.exeSee Symantec Trojan.Esteems.B Location: C\Windows\system\system32.exe (9X\ME) or C\Windows or Winnt\system32\system32.exe (NT\2000\XP)
    Service name: MessengerXzone-h.ddo.jp.exe -k netsvcsTrojan.Esteems.C See Symantec Location: C:\Winnt\System32 ( NT/2000), or C:\Windows\System32 (XP).
    Service name: MessengerX514.exeTrojan.Esteems.D See Symantec Location C:\Windows\System32 (XP) C:\Winnt\System32 (NT\2000)
    Service Norton AntiVirus Auto-Protect (navapsvc)Lnavapsvc.exeRelated to Norton/Symantec AntiVirus.
    Service Request MonitorLRxMon.exeRelated to Roxio EasyCD Creator application.
    Service SchedulerXscheduler.exeW32/Agobot-PH See Sophos Unknown owner: Location: C:\WINDOWS\System32\scheduler.exe -service
    Service Security Manager (scekrnl)Xscekrnl.exeAdded by the Backdoor.Win32.Agent.alx TROJAN! Note: Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Service Updater (servfjhf)Xservfjhf.exeIdentified as Downloader.Agent.dxm by AVG Anti-Spyware Note: located in \%WINDIR%\
    Service1Lwindowsserviceexample.exeRelated to Microsoft .Net Application. VB.NET_Forums
    Service32 (Service Sequence)Xservices32.exeAdded by the W32/Tilebot-C WORM! Read the link, rootkit type stealth involved.
    Service: Access Remote PC Service 4.3 (RpcSvr4x)Orpcsetup.exe Access_Remote_PC remote access software. Legitimate, but remote access could be considered dangerous unless monitored carefully.
    Service: LicenseManagerReminderLLicenseManagerReminder.exeRelated to UIC License Manager a propriatiry Sofstware. Used to activate a software on customer computers for a specified length of time. Note: Located in C:\Program Files\Universal Instruments\License Manager\
    Service: Microsoft Net API (NETAPI)Xntps.exeAdded by the Backdoor.Win32.SdBot.aad as identified by Kaspersky. TROJAN! Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Service: Network Client (nwclnta)Xnetclna.exeTroj/Boxed-I. Owner:Unknown. Location: C:\WINDOWS\system32\netclna.exe
    ServiceHost32XServiceHost32.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\System32 Note: Use SDFix under supervision.
    ServiceLayerLServiceLayer.exeRelated to Nokia Connectivity Library software. Note: located in C:\Program Files\Common Files\PCSuite\Services\
    ServiceMXServiceM.exeAdded by Trojan/Backdoor W32/Suspicious_M.gen TROJAN! Note: Located in \%WINDIR%\System32\Common Files\ArcSoft\Connection Service\Bin\
    serviceMangr (tcphost.exe)XTCPHOST.EXEAdded by the SDBOT.CSG WORM! Read the link, rootkit type stealth involved.
    servicesXservices.exe W32/Sdbot-CXP Note: Located in %windir% Read the link, allows remote access
    Services (Ini Service Ku)Xservices.com Troj/Winlock-C
    Services an controller-settingsXservices.exeAdded by the W32/Tilebot-HY WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    Services Manager (svcmngr)Xconfig.exe Troj/DllLoad-C Read the link, steals information
    services32 (Content List Management Sub System)Xservices32.exeAdded by the W32/Esbot-B WORM! Note: This worm\trojan file is found in the Windows or Winnt folder.
    Servicess_ServerXServicess.exeA variant of the Feutel/Hupigon infection. Note: rootkit type stealth involved.
    Servicio Auto-Protect de Norton AntiVirus (navapsvc)Lnavapsvc.exeRelated to Norton/Symantec AntiVirus.
    Servicio Bonjour (Bonjour Service)LmDNSResponder.exeCreate's a network of computers and smart devices. Made by Apple Computer, Inc. For more information Click_Here File location is in the Program Files\Gizmo Project folder.
    Servicio COM de grabacióe CD de IMAPILimapi.exeRelated to Image_Mastering_Applications_Programming_Interface from Microsoft used for CD recording. Note: Located in C:\WINDOWS\System32\
    Servicio COM de grabación de CD de IMAPI (ImapiService)Limapi.exeRelated to Image_Mastering_Applications_Programming_Interface from Microsoft used for CD recording. Note: Located in C:\WINDOWS\System32\
    Servicio de alertaLservices.exeSpanish Windows 2000 alert service.
    Servicio de ayuda TCP/IP NetBIOSLservices.exeSpanish Windows 2000 Help service TPC/IP NetBIOS
    Servicio de faxLfaxsvc.exeSpanish Windows 2000 fax service
    Servicio de uso compartido de red del Reproductor de
    Windows Media (WMPNetworkSvc)    		Lwmpnetwk.exeRelated to Windows_Media_Player Network Sharing Service.Note: Located in %ProgramFiles%\Windows Media Player\
    Servicio del administrador de discos lóosLdmadmin.exeSpanish Windows 2000 logical disk manager administrative service
    Servicio del administrador de discos lógicos (dmadmin)Ldmadmin.exeRelated to Veritas logical disk manager
    Servicio del iPod (iPod Service)LiPodService.exeRelated to Apple iPod.
    Servicio RunAsLservices.exeSpanish Windows 2000 RunAs service
    Serviço iPod (iPod Service)LiPodService.exeRelated to Apple iPod.
    ServidorLservices.exeSpanish Windows 2000 "server"
    Servidor de RPC de eTrust Antivirus (InoRPC)LInoRpc.exeAssociated with eTrust Antivirus/InoculateIT
    Servidor de tareas de eTrust Antivirus (InoTask)LInoTask.exeAssociated with eTrust Antivirus/InoculateIT
    Servidor de tiempo real de eTrust Antivirus (InoRT)LInoRT.exeRelated to eTrust's AntiVirus Internet Security solution.
    Servies Unknow SrvX001.exe Win-Trojan/Downloader.6656.DW
    Servizio iPod (iPod Service)LiPodService.exeRelated to Apple iPod.
    Servizio Norton AntiVirus Auto-ProtectLnavapsvc.exeRelated to Norton Antivirus
    sessionsimXsssnsml.exe Troj/Dloadr-BBB Also creates an additional service "typemgr2"
    settingsXSETTINGS.EXEAdded by the SDBOT.CHY WORM! Read the link, rootkit type stealth involved.
    SF FrontLine Drivers Auto Removal (v1) (sfrem01)Lsfrem01.exeRelated to SF_FrontLine Drivers Auto Removal from Star-Force. Note: Located in C:\WINDOWS\system32\
    SFTRANSFER (SFTRANSFER)X(Unknown at this time.)Added by the Backdoor.Brakkeshell TROJAN! Note: In the Description field under Services it wil show as: Secure file transfer protocol
    SFUSVCLSFUSVC.exe KYOCERA_MITA Scanner File Utility used with Kyocera Mita scanners/faxes. Note: located in C:\Program Files\Kyocera Mita\FileUtility\
    SgeCtlLSGECTL.EXEUtimaco Safewares SAFEGUARD
    Sharing Messenger Folders Windows XP (SMFWX)Xbhagent.exe W32/Sdbot-CZS Note: Located in %windir% Read the link, allows remote access
    Sharp Device Manager ServiceLsdmservice.exeRelated to Sharp_Device_Manager printer service form Sharp. Note: Located in \%Program Files%\sharp\sharp device manager\
    SharpAccountant2LSharpAccountant2Service.exeRelated to Sharp_Device_Manager printer service form Sharp. Note: Located in \%Program Files%\sharp\SharpAccountant2\
    Shavlik HFNetChkPro ServiceLHFNetChkProService.exeHFNetChkPro distributes Microsoft patches to client machines
    SHDSERVLshdserv.exe Horizon DataSys Rollback Rx
    Shiva VPN ClientLicsrv.exeRelated to Eicon Networks Corporation
    SHOVEXSHOVE.exe Troj/Agent-EOM
    SigmaTel Audio Service (STacSV)Lstacsv.exeRelated to SigmaTel_Audio_Service Part of the C-Major Audio driver. Note: Located in C:\Program Files\SigmaTel\C-Major Audio\WDM\
    Sigmatel PassThru (PassThru)Lpassthru.exeRelated to Sigmatel
    SiS WirelessLan Service (SiSWLSvc)LSiSWLSvc.exeRelated to Sis_Wireless_Lan LAN controller
    SiSoftware Database Agent Service (SandraDataSrv)LRpcDataSrv.exeRelated to Sandra_Lite from SiSoftware Ltd. System benchmarking software. Note: Located in \%Program Files%\SiSoftware\Win32\SiSoftware Sandra Lite XI.SP2\
    SiSoftware Deployment Agent Service (SandraAgentSrv)LRpcAgentSrv.exeRelated to SiSoftware_Deployment_Agent service. An information & diagnostic utility. Note: Located in \%Program Files%\SiSoftware\SiSoftware Sandra Lite XII.SP2c\
    SiSoftware Sandra Agent Service (SandraTheSrv)LRpcSandraSrv.exeRelated to Sandra_Lite from SiSoftware Ltd. System benchmarking software. Note: Located in \%Program Files%\SiSoftware\SiSoftware Sandra Lite XI.SP2\
    Sistema de ayuda de tarjeta inteligenteLSCardSvr.exeThe application belonging to the Microsoft Windows Operating System, which provides the authentication facilities for smart security cards on your local system.
    SiteAdvisor ServiceLSAService.exeRelated to SiteAdvisor Service from McAfee. Note: Located in C:\Program Files\SiteAdvisor\[4 digits number\
    SiteMinder Authentication Service (SmServAuth)LService_AuthSrvr.exeRelated to Cold_Fusion from Macromedia, inc.
    SiteMinder Authorization Service (SmServAz)LService_AzSrvr.exeRelated to Cold_Fusion from Macromedia, inc.
    Skype Messenger (Skype)Xskype32.exeAdded by the W32.Mytob.ML WORM! Note: This worm file is found in the System32 folder. Read the link, rootkit type stealth involved.
    SleepyLservice.exeRelated to Sashazur LLC A utililty to prevents computer use at night. For schools, libraries, businesses etc.
    SlimServer (slimsvc)Lslim.exeRelated to SlimServer Note: Located in C:\Program Files\SlimServer\server\
    SlimServerMySQLLmysqld.exeRelated to Slimserver
    SLMDriver (SLMDriver)Xslm32.sysAdded by the Troj/Rootkit-AA TROJAN! Note: This trojan file is found in the System32 folder. Read the link, rootkit type stealth involved.
    SLPMONXLslpservice.exeRelated to Seiko Printers. Provides additional configuration options for these devices. Note: located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    slysomXslysom.exeAdded by a variant of the RBOT family of IRC Backdoor trojan. Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision.
    SMART Board ServiceLSMARTBoardService.exeRelated to SMART Technologies inc.
    Smart Card Client (SCardClnt)XSCardClnt.exeAdded by the W32/Codbot-K WORM! Note: located in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (XP/WinNT/2K)
    Smart Card HelperXscardsvr32.exeAdded by the W32.Femot_worm! . NOTE: do not confuse this with the legitimate Smart Card Helper service, which uses the filename SCardSvr.exe!
    Smart Card Reader Helper (scrhcust)Xsvchost.exe Troj/Zapchas-DO Note: Located in %Root%\RECYCLED\S-1-5-21-3252328098-71414409-2463015037-500\ Allows others to access the computer
    Smart Card Supervisor (mmc)Xmmc.exe W32/Dzan-A Read the link, allows remote access
    SMART Web ServerLWebServer.exeRelated to SMART_Web_Server from SMART Tech. Inc. Transform your classroom with SMART education solutions. Note: Located in \%Program Files%\SMART Technologies Inc\SMART Board Software\
    SmartGenie (LxrSGe10s)LLxrSge10s.exeRelated to SmartGenie_toolbar customizable toolbar, offers many helpful research tools making it possible for you to navigate the Web as well as carry out powerful research.
    SmartLinkServiceLslmdmsr.exeslmdmsr.exe installed alongside Smartlink communication products and offers additional support to the modem service. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.
    SmartLinkService (SLService)Lslserv.exe slserv.exe is installed alongside Smartlink communication products and offers additional support to the modem service. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.
    SmartTrust Smart Card Server (Smartscaps)LSmartscaps.exePlatform for integrating security functions with mobile services. For more information Click_Here
    SmartWiServiceLSmartWiService.exeRelated to Sony_SmartWi SmartWi technology is the seamless integration of three wireless technologies: Wide Area Network (WAN)132, 802.11bg wireless LAN1, and Bluetooth®4 technologies.
    SMBus Upgrade Service for Windows 2000 and above
    (ibmsmbus)    		Libmsmbus.exeRelated to SMBus on IBM computers. SMBus is the System Management Bus defined by Intel® Corporation in 1995. It is used in personal computers and servers for low-speed system management communications. Note: located in C:\WINDOWS\System32\ibmsmbus.exe
    SMONITORXSMONITOR.SYSAdded by the TROJ_ROOTKIT.V TROJAN! Read the link, rootkit type stealth involved.
    SMS Agent Host (CcmExec)LCcmExec.exeRelated to SMS_Agent (CCM) = change and configuration management. Note: Located in \%WINDIR%\System32\CCM\
    SMS Help Center (SMS32)Xsmss32.exeAdded by an unknown variant of a backdoor TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\
    smscXsmsc.exeAdded by the W32/Tilebot-GW WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    smsccXsmscc.exeAdded by the W32/Sdbot-CPG WORM! Note: This worm\trojan is located in C:\%WINDIR%
    smsmangerXsmsmanger.exeAdded by the Backdoor.SdBot.xd as identified by ewido. Note: This worm\trojan is located in C:\%WINDIR%\ More: here
    SMSS (SMSS)Xsmss.exeAdded by the W32/Tilebot-V WORM! Note: This worm file is found in the Windows or Winnt folder.
    SMTP CaptureLsmtpcap.exeRelated to NSi's AutoStore from Notable Solutions, Inc. Capture documents and securely saving the content in your business applications.
    Snake SockProxy Service (SkServer)Xwuauserv.exeVariant of Troj/VB-ZD See Sophos
    SNARELSnareCore.EXERelated to InterSect_Alliance Open Source agents to provide a log collection, analysis, reporting and archival resource.
    SnareIISLSnareIIS.EXERelated to InterSect_Alliance Open Source agents to provide a log collection, analysis, reporting and archival resource.
    SndDRV (MS Sound Driver) (SndDRV)Xsnddrv.exeAdded by the W32/Rbot-BSC WORM! Note: This worm file is found in the System32 folder.
    SNM WLAN ServiceLSNMWLANService.exeRelated to Network_Manager from Samsung. Note: Located in \%Program Files%\samsung\Samsung Network Manager\
    SNMPTrapd Service (SNMPTrapdService)Lsnmptrapd.exeRelated to MKS_Toolkit
    Snoop Free Service (SnoopFreeSvc)LSnoopFreeSvc.exeAnti-keylogging software made by SnoopFree_Software._
    Socks-Cap (Sc32Inch)XSc32Inch.exeAdded by WORM_SDBOT.DIN WORM! Rookit infection Note: located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    soft Xpansion MSO2PDFLmso2pdf-serv.exeRelated to soft_Xpansion provides for applications an ability to use digital documents in PDF format, incl. PDF/A. Note: Located in \%Program Files%\soft Xpansion\Office to PDF\
    Softex OmniPass Service (omniserv)LOmniserv.exeRelated to Softex OmniPass security solution which handles passwords on your computer.
    SoftGrid Client (sftlist)Lsftlist.exeRelated to SoftGrid from Microsoft. A core component of the Desktop Optimization Pack for IT professionals. Note: Located in \%Program Files%\Softricity\SoftGrid for Windows Desktops\
    SoftGrid Virtual Service Agent (sftvsa)Lsftvsa.exeRelated to SoftGrid from Microsoft. A core component of the Desktop Optimization Pack for IT professionals. Note: Located in \%Program Files%\Softricity\SoftGrid for Windows Desktops\
    Software Jukebox v2.0 ServiceLSoftware Jukebox v2.0 Service File.exeRelated to BlueLabelle Jukebox v2.0 from MPEGX.com
    Software Secure Service (SSISvr32)Lssisvr32.exeRelated to Software_Secure service. Enables students to take an exam in a secure environment using Microsoft® Word and Excel. Note: Located in C:\WINDOWS\system32\
    SolidPDFConverterReadSpool (ScReadSpool)LSolidPdfService.exeRelated to Solid_Converter_PDF from VoyagerSoft - Turn your PDFs into documents you can edit.
    SolidWorks Licensing Service (audieqaai)Xlmguh.exeAdded by a variant of the Backdoor.Oderoor Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision. Note:Random names are used for the service and filename.
    Sonica Theater Installer
    (SonicaTheaterInstallerService)    		LSTinst.exeRelated to Sonica_Theater from M-Audio. Turn your computer into a fully functional multiformat surround-sound monitoring environment. Note: Located in C:\Program Files\C:\Program Files\M-Audio Sonica Theater\Install\
    SonicStage Back-End ServiceLSsBeSvc.exeRelated to Sonic Stage Back-End service from SONY. Note: Located in \%Program Files%\Common Files\Sony Shared\AVLib\
    SonicStage SCSI Service (SSScsiSV)LSSScsiSV.exeRelated to Sony Corp.
    SonicStageMonitoringLSonicStageMonitoring.exeRelated to Sony GigaPocket multimedia entertainment center.
    SonicWALL Agent ServiceLswAgent.exeRelated to Network Associates, Inc.
    SonicWALL NetExtender Service (SONICWALL_NetExtender)LNEService.exeRelated to SonicWALL_NetExtender Service from SonicWall Inc. Note: Located in \%Program Files%\SonicWALL\SSL-VPN\NetExtender\
    SonicWall VPN Client Service (RampartSvc)LRampartSvc.exeSonicWall client for VPN access.
    Sony Network Analysis ToolXwinsony.exe W32/Spybot-NS Read the link, allows remote access
    Sony SCSI Helper ServiceLSonySCSIHelperService.exeRelated to Related to Sony Corporation.
    Sony SPTI Service (SPTISRV)LSptisrv.exeRelated to Sony Corporation
    Sony SPTI Service for DVE (ICDSPTSV)LIcdSptSv.exeRelated to Sony SPTI Service Note: Sony Inc. Located in C:\%WINDIR%\System32 (XP/WinNT/2K)
    Sony TV Tuner ControllerLhalsv.exeSony computers
    Sony TV Tuner ManagerLRM_SV.exeSony computers
    Sony TVTA ManagerLSMceMan.exeRelated to Sony Corporation.
    Sophos AgentLManagementAgentNT.exeRelated to Sophos AntiVirus protection software.
    Sophos Anti-VirusLSWEEPSRV.SYSBy Sophos Plc
    Sophos Anti-Virus (SAVService)LSavService.exeRelated to Sophos AntiVirus protection software.
    Sophos Anti-Virus (SWEEPSRV.SYS)LSWEEPSRV.SYSSophos Virus protection program. http://www.sophos.com/support/knowledgebase/article/378.html
    Sophos Anti-Virus NetworkLSWNETSUP.EXEBy Sophos Plc
    Sophos Anti-Virus status reporter (SAVAdminService)LSAVAdminService.exeRelated to Sophos AntiVirus protection software.
    Sophos Anti-Virus UpdateLSWUPDATE.EXEBy Sophos Plc
    Sophos AutoUpdate AgentLAutoUpdateAgentNT.exeRelated to Sophos AntiVirus protection software.
    Sophos AutoUpdate ServiceLALsvc.exeRelated to Sophos AntiVirus protection software. Auto Update service.
    Sophos Cache Manager (CacheMgr)Lcachemgr.exeRelated to Sophos AntiVirus protection software. Remove Update service.
    Sophos Database Notification Service (sdbnsrvc)LSdbnsrvc.exeRelated to Sophos_Control_Center a central console that permits administration of Sophos Anti-Virus SBE over the entire network from one location. Note: Located in C:\Program Files\Sophos\Control Center\
    Sophos EMLibUpdate AgentLEMLibUpdateAgentNT.exeRelated to Sophos_Remote_Management_System from Sophos. Note: Located in \%Program Files%\Sophos\SCC\Remote Management System\
    Sophos Management ServiceLMgntSvc.exeRelated to Sophos_Remote_Management_System from Sophos. Note: Located in \%Program Files%\Sophos\SCC\
    Sophos Message RouterLRouterNT.exeRelated to Sophos AntiVirus protection software.
    Sophos SBE Certification ManagerLCertificationManagerServiceNT.exeRelated to Sophos_Control_Center a central console that permits administration of Sophos Anti-Virus SBE over the entire network from one location. Note: Located in C:\Program Files\Sophos\Control Center\
    Sophos SBE ManagementServiceLSbeMss.exeRelated to Sophos_Control_Center a central console that permits administration of Sophos Anti-Virus SBE over the entire network from one location. Note: Located in C:\Program Files\Sophos\Control Center\
    SOptionLSOption.exeRelated to Ricoh Document System Server Information Service. Note: Located in \%Program Files%\RDS\
    Sound Sservice Driver (Sound Service)Xcfmon.exeSee Here
    SoundMAX Agent Service (SoundMAX Agent Service
    (default))    		LSMAgent.exeSoundMAX Sound Device
    SP Software InstallerLsp_SWIns.exeSmartPipes SecureSite is a scalable, reliable, and secure software platform for the creation and management of advanced IP services. - http://www.smartpipes.com/SecureSite.htm
    SPAMfighter Update ServiceLsfus.exeRelated to SPAMfighter from Spamfighter for Microsoft Outlook, Outlook Express and Windows Mail. Note: Located in \%Program Files%\SPAMfighter\
    SPBBCSvcLSPBBCSvc.exeRelated to Symantec Internet security suite and assists in keeping your computer up to date from Internet bound viruses.
    SPCSUtilityServiceLSPCSUtilityService.exeRelated to Sprint_Sierra_Wireless service. Note: Located in C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\
    spdcheckXSPDCHECK.EXEAdded by the SDBOT.BZE WORM! Read the link, rootkit type stealth involved.
    Spectrum24 Event Monitor (S24EventMonitor)LS24EvMon.exeIntel Corporation
    Speed Disk serviceLnopdb.exeNorton Speed Disk
    SpeedTouch 330 Manager (st330service)Lst330service.exeRelated to SpeedTouch_330_Manager from THOMSON Telecom. Note: Located in \%Program Files%\Thomson SpeedTouch/ST330/service/
    spkrmonLspkrmon.exeSoundMAX SpeakerMonitor service
    SPM License Server (spmd)Lspmd.exeRelated to SPM_License from mental images GmbH. RealityServer® is the unique server-based, scalable infrastructure software platform for creating and deploying 3D Web Services and other applications and application Note: Located in C:\WINDOWS\System32\spm\
    SPM License Server (spmd)Lspmdib.exe Related to Software_Protection_Manager from SoftImage. Note: Located in C:\WINDOWS\system32\spm\
    spmgrLspmgr.exeRelated to Sony VAIO/ASUS laptops and provides additional configuration options for these devices. This program is non-essential process to the running of the system, but should not be terminated unless suspected to be causing problems.
    spoolXspoollv.exeAdded by the W32/Sdbot-AES WORM! Note: This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    spoolXSPOOLLV.EXEAdded by the SDBOT.CTI WORM! Note: This worm file is found in the System32 folder. (NT/2000/XP) Read the link, rootkit type stealth involved.
    Spool SubSystem AppXlsass.exeAdded by the W32/Tilebot-HD WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.)
    Spool SubSystem AppXSpool.exeAdded by a variant of the SDBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.
    SpoolServiceXspolsv.exe -servicePossibly added by a W32/Agobot variant.
    SpoolsvXspoolsv.exeAdded by the Troj/IRCBot-VA TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\
    spoolvXspoolv.sysAdded by the TROJ_ROOTKIT.S TROJAN! Read the link, rootkit type stealth involved.
    Spot GPS Maxim (SpotGPSMaxim)LSpot2741.exeRelated to Spot_GPS_Maxim GPS front-end receiver with Royal Philips Electronics' innovative Spot GPS Software. Note: Located in \%Program Files%\CoPilot\Navigator9\App\
    Sprint PCS v3 Utility ServiceLCMSPCSUtilSvc.exeRelated to Sprint_PCS_Connection_Manager Service Utility. Note: Located in \%Program Files%\Sprint\Sprint PCS Connection Manager\
    Spss License Manager (SpssLM)Lspss_lmd.exehttp://www.spss.com/spss/licensing.htm
    Spy Emergency Shield Service (SpyEmrgSrv)LSpyEmergencySrv.exeRelated to Spy_Emergency from NETGATE Technologies. Security software. Note: Located in C:\Program Files\NETGATE\Spy Emergency 2006\
    Spy-Keylogger (SpyKeyloggerService)Xskls.exeIdentified as Spyware.SpyKeylogger SPYWARE! Spyware.SpyKeylogger is a security risk that records keystrokes. Must be manually uninstalled via Start\settings\control panel\Add_Remove programs.
    SpyDetectSVCLSpywareDetectorSVC.exeSpyware Detector, Adware/Spyware remover - initially considerered a "rogue" program. The latest version has since apparently mended its ways: see note
    Spyware Doctor Auxiliary Service (sdAuxService)Lsvcntaux.exeRelated to Spyware-doctor from PC Tools. Detects, removes and blocks all types of Spyware. Note: Located in \%Program Files%\Spyware Doctor\
    Spyware Doctor Enterprise ClientLEntClient.exeRelated to Spyware_Doctor Enterprise Client from PC Tools. Note: located in \%WINDIR%\EMClient\
    Spyware Doctor Service (sdCoreService)Lswdsvc.exeRelated to Spyware-doctor from PC Tools. Detects, removes and blocks all types of Spyware. Note: Located in \%Program Files%\Spyware Doctor\
    Spyware Terminator Clam Service (sp_clamsrv)Lsp_clamsrv.exePart of Spyware Terminator, located in %program files%\WinClamAVShield
    Spyware Terminator Realtime Shield Service (sp_rssrv)Lsp_rsser.exeRelated to SpywareTerminator Spyware Remover. Note: Located in C:\Program Files\Spyware Terminator\
    SpywareCleanerServiceOSCService.exeOwner:Secure Computer, LLC. May show as Unknown owner. Related to Spyware Cleaner Note: Not recommended.
    SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ)Lsqlservr.exeMicrosoft SQL Server 2005 Express that is installed with Accounting Professional and with Accounting Express from Microsoft.
    SQL Server (MSSQLSERVER) (MSSQLSERVER)Lsqlservr.exeRelated to Microsoft_SQL_server suite.
    SQL Server (SQL2005) (MSSQL$SQL2005)Lsqlservr.exeRelated to Microsoft_SQL_server suite.
    SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS)Lsqlservr.exeRelated to Microsoft_SQL_server suite.
    SQL Server Agent (MSSQLSERVER) (SQLSERVERAGENT)LSQLAGENT90.EXERelated to Microsoft_SQL_Server_Agent
    SQL Server Agent (SQL2005) (SQLAgent$SQL2005)LSQLAGENT90.EXERelated to Microsoft_SQL_Server_Agent
    SQL Server Analysis Services (SQL2005) (MSOLAP$SQL2005)Lmsmdsrv.exeRelated to Microsoft_SQL_server suite.
    SQL Server FullText Search (SQL2005) (msftesql$SQL2005)Lmsftesql.exeRelated to Microsoft_SQL_server suite.
    sql-smssXsql-smss.exeAdded by the W32/Tilebot-GI WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    sqldpsXsqldps.exeAdded by the W32/Tilebot-GV WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    sqlmanagementXsqlmanagement.exeAdded by the W32/Tilebot-GB WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    sqlserver (sqlserver)Xsqlserv.exeAdded by the SDBOT.BZO WORM! Read the link, rootkit type stealth involved.
    SQLSERVERAGENTLsqlagent.EXERelated to Microsoft SQL Server
    sqlsrvd (sqlsrvdaemon)X_sqlexec.exePossible new variant of W32.Spybot.NLX. Location: C:\Windows (9X\XP) or C:\Winnt (NT\2000). See Symatec
    SRS Labs License ServiceLsrslabslicenseservice.exeRelated to SRS_Labs Audio Service. Note: Located in C:\Program Files\Common Files\SRS Labs Shared\
    srvcmXsrvcm.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.
    ssdfghjklXNETDDF.EXEAdded by the SDBOT.BXN WORM! Read the link, rootkit type stealth involved.
    SSH Client for WindowsXwinshp.exe Win32/Duiskbot.BE Note: Located in %System%\dllcache\
    SSL VPN-Plus ServiceL