CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9466.22 of $21422.68
left sidedonated so farneed $11956.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

spacer spacer

O23 List of Windows XP/NT services

Currently 3876 entries and growing...
Last updated on 2008-05-09 18:10:24 Eastern.

This list was originally started at SpywareAid with 730 entries and Matt gave CastleCops permission to host it. CastleCops has since (May 2005) been adding new entries to it here. The new items may not be in the original list but attempts are made to ensure the original is also updated. The full HTML list is here.

KEY:
  • "L" = Legitimate
  • "O" = Open to Debate
  • "X" = Malware/Bad
  • "?" - Unknown

    •   

    ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z




    Full List

    NameStatusFilenameDescription
    Microsoft Windows System32Xwinservs.exeAdded by the W32/Tilebot-GU WORM! Note: This worm\trojan is located in C:\%WINDIR% Also been identified with the filename: winsysdir.exe
    Microsoft Windows System32Xwindll32.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\
    Microsoft Windows UpdateXwuautcl.exe Troj/Spybot-NQ Read the link, allows remote access
    Microsoft Windows Update (Microsoft Update)Xscvvhost.exeAdded by the W32/Forbot-FH WORM!
    Microsoft Windows Update (Microsoft Windows Update)Xmsconfig32.exeAdded by the W32/Tilebot-P WORM! Read the link, rootkit type stealth involved.
    Microsoft Windows Update (msupdate)Xcsrss.exeAdded by an unknown TROJAN!, Note: This has nothing to do with Microsoft Windows Update and this is not the legitimate Windows Process csrss.exe. (Which is found in the System32 folder.) This trojan file (csrss.exe) is found in the Windows or Winnt folder.
    Microsoft Windows Validation Service (Windows
    Validation Service)    		Xdevldr32.exeAdded by a variant of the WIN32.RBOT WORM! - Note - do NOT confuse with the legitimate Creative Labs devldr32.exe file. Note: located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    MicroSoft Windowz Update (MsFtUpd)XMsFtUpdateXP.exeAdded by the W32/Tilebot-BL WORM! Note: This worm\trojan file is found in the Windows or Winnt folder.
    Microsoft WMI Performance Adapter AddOn (WMIPerAddOn)Xwmiapsrv.exeAdded by an unknown variant of a backdoor TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\ NOT TO BE confused with C:\WINDOWS\System32\wbem\wmiapsrv.exe which is a Microsoft application
    Microsoft XP TCP Ack TimingXwinxptcp.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision.
    Microsoft(R) Windows(R) Operat (Microsoft Corporation)Xiexplorer.exeAdded by the Troj/Feutel-W TROJAN! Note: This is not the legitimate Windows Process (iexplore.exe) which is found in the Program Files\Internet Explorer folder. (Notice the difference in the spelling.) This trojan file (iexplorer.exe) is found in the System32\Internet Explorer folder.
    microsoftdvdhelp (MicrosoftDVD)Xmsdvd.exeAdded by the W32/Rbot-AWQ WORM! Note: This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    MicrosoftkeysdXsystemwin32.exe
    MilShieldCleanerLShieldService.exeRelated to Mil_Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activities. Note: Located in C:\Program Files\Mil Incorporated\Mil Shield\
    MindRetrieve Engine (MindRetrieve)LMindRetrieve.exe MindRetrieve Appears to be a personal desktop search engine.
    MindStorm AgentLsrvpxa.exeRelated to MindStorm_AnalyzerPro from Secure Associates. A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices.
    MindStorm AnalyzerPro ControllerLsrvctr.exeRelated to MindStorm_AnalyzerPro from Secure Associates. A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices.
    MindStorm AnalyzerPro Correlation EngineLsrvcor.exeRelated to MindStorm_AnalyzerPro from Secure Associates. A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices.
    MindStorm ControllerLsrvctr.exeRelated to MindStorm_AnalyzerPro from Secure Associates. A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices.
    MindStorm Correlation EngineLsrvcor.exeRelated to MindStorm_AnalyzerPro from Secure Associates. A security management tool for customers easy to manage report and analyze security events across heterogeneous security devices.
    Mini USB DriverXsvñhîst.exe Troj/Proxy-CY Note: Located in %windir%\system32 Read the link, allows remote access
    MINIServer (MiNiService)XMiniServer.exeAdded by the Troj/LittleW-E TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
    MioNet Service (MioNet)LMioNetManager.exeRelated to MioNet from MioNet now owned by Western Digital. Access any file on your remote MioNet computer from another MioNet computer. Note: Located in \%Program Files%\MioNet\
    Miramar AppleTalk File ServerLATSERVER.EXERelated to Miramar_AppleTalk_File_Server Now owned by Pure Networks, Inc. PC MACLAN will permit the transfer of data from PC to Mac. Note: Located in \%Program Files%\Miramar\PC MACLAN\
    Miramar AppleTalk Print ServerLATSPOOL.EXERelated to Miramar_AppleTalk_Print_Server Now owned by Pure Networks, Inc. PC MACLAN will permit the transfer of data from PC to Mac. Note: Located in \%Program Files%\Miramar\PC MACLAN\
    MirraSync Service (Mirra.Service)Lmirra.service.exeRelated to Mirra_Server from Seagate Tech. Persornal server. Note: Located in \%Program Files%\mirra\
    Miscrosoft Updates Service 4Xmsupd4.exeTrojan-Downloader.Win32.Agent.gn
    Miscrosoft Updates Service 5Xmsupd5.exeTrojan. TROJ_LODMEDUD.A
    MkSUpdateIntLMkSUpdateInt.exe ArcaVir an AntiVirus software from Poland. A procuct of ArcaBit Sp. z o.o
    MkS_ScanLmks_scan.exe ArcaVir an AntiVirus software from Poland. A product of ArcaBit Sp. z o.o
    mks_vir antivirus monitor (MksVirMonSvc)Lmksmonsv.exe ArcaVir an AntiVirus software from Poland. A product of ArcaBit Sp. z o.o
    MLKKBDNTDriverOMLKKBDNTService.exeUnknown
    MMX Virtualization ServiceXmmx464.sysAdded by the Goldun.J TROJAN! Read the link, rootkit type stealth involved.
    MMX2 Virtualization ServiceXmmx464.sysAdded by the Goldun.J TROJAN! Read the link, rootkit type stealth involved.
    MNSFrameworkLMNSFramework.exeMobile Net Switch enables you to use your computer on more than one network with the click of a button. Note: Located in C:\WINDOWS\system32 (XP NT)
    MobilePre Installer (MobilePreInstallerService)LMPInst.exeRelated to MobilePre_Installer USB Bus-powered Preamp and audio interface from M-Audio. Note: Located in \%Program Files%\M-Audio MobilePre\Install\
    Mobility Client (ArtourService)Lartsvc.exeRelated to IBM_Mobility_Client Note: Located in C:\Program Files\IBM\Mobility Client\
    MobilityServiceLMobilityService.exeRelated to Modibily_Service from Acer. Note: Located in \%ROOT%\Acer\Mobility Center\
    MOBSYNCXMOBSYNC.EXEAdded by the SDBOT.CNT WORM! Read the link, rootkit type stealth involved.
    modlb (modlb)Xmodlb.exeAdded by the W32/Tilebot-BF WORM! Note: This worm\trojan file is found in the Windows or Winnt folder.
    mondrv (mondrv)Xmondrv.sysAdded by the TROJ_ROOTKIT.M TROJAN! Read the link, rootkit type stealth involved.
    MONDVXMONDV.SYSAdded by the Troj/Rootkit-Z TROJAN! Read the link, rootkit type stealth involved.
    MonSvcNTLMonSvcNT.exeRelated to AhnLab Monitor service from AhnLab, Inc. Note: Located in \%Program Files%\AhnLab\V3\
    Morrin Thumbnail Synchronized Service 5 (MrnTS_Sync5)?MrnTS_Sync5.exeFrom Morrin Corporation? http://forums.spywareinfo.com/index.php?act=ST&f=18&t=43573
    Motor de Spy Sweeper de Webroot
    (WebrootSpySweeperService)    		LSpySweeper.exeRelated to Webroot Sortwre inc. Spyware protection software. Note: Located in \%Program Files%\Webroot\Spy Sweeper\
    Motorola Digital Audio Player ManagerLMotorolaDAP.exeRelated to Motorola Inc. Motorola Digital Audio Player.
    Mouse Button Monitor (mousebm)Xmousebm.exeAdded by the W32.Esbot.A WORM!
    Mouse Click Monitor (mousecm)Xmousecm.exeAdded by the W32/Sdbot-ZQ Worm!
    Mouse Cursor Monitor (mousecrm)Xmousecrm.exeAdded by the W32/Sdbot-ABQ WORM!
    Mouse Hardware Sync (mousehs)Xmousehs.exeAdded by the Troj/Bdoor-HU WORM! Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    Engine Version 2.0 by CastleCops
    2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved.
    Acceptable Use Policy. Use signifies your agreement.
    140ppm 0.391s (0.009s)
    Making cybercriminals unhappy since 2002*
    In Memory of Trpm
    spacer spacer