Dangerous File Processes In Windows - Part 5

Windll.exe (STEALER TROJAN)
Windll.exe should not be running at startup. It is likely a virus, spyware, trojan, or some other sort of malicious program. Use a virus scanner, and/or spyware removal tool to remove it.
Damage Level : Medium | High
Distribution Level: Low

Wintime.exe (Harnig Trojan)
wintime.exe is a virus which downloads other viruses, as well as terminates antivirus software. This virus also creates a phonebook entry, in which it tries to dial a high cost telephone number. This process is a security risk and should be removed from your system.
Harnig Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of wintime.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information
Damage Level : Highly Dangerous
Distribution Level: High

Winupdate.exe (WORM_FALSU.A/Spybot.Eas worm)
winupdate.exe is added to the system as a result of the WORM_FALSU.A virus. It is a backdoor Trojan horse and gives remote access to your computer. This process is a security risk and should be removed from your system. If found on your system make sure that you have downloaded the latest update for your antivirus application.
Spybot.Eas Worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of winupdate.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
Damage Level : High
Distribution Level: Unknown

Winxp.exe (W32.Beagle)
winxp.exe is a process which is registered as W32.Beagle.AG@mm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. The worm has its own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. This process is a security risk and should be removed from your system.
Damage Level : High
Distribution Level: Medium

Wmon32.exe (GAOBOT.BAJ/W32.Agobot-IT Trojan)
wmon32.exe is a process which is registered as the W32.Agobot-IT Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
Damage Level : High
Distribution Level: Medium

Wupdt.exe (Backdoor Trojan)
wupdt.exe is added to the system as a result of the IMISERV virus. It is a backdoor Trojan used to control a target computer from a remote location. This process is a security risk and should be removed from your system. If found on your system make sure that you have downloaded the latest update for your antivirus application.
Damage Level : High
Distribution Level: Medium

Xxx.exe (Unknown)
xxx.exe is registered as a downloader. This process usually comes bundled with a virus or spyware and its main role is to do nothing other than download other viruses/spyware to your computer. This process is a security risk and should be removed from your system.
Damage Level : Highly Dangerous
Distribution Level: Medium

Dangerous File Processes In Windows - Part 4

Service.exe (W32.Randex.R Trojan)
services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. This process also deals with the automatic starting of services during the comptuers boot-up and the stopping of servicse during shut-down. This program is important for the stable and secure running of your computer and should not be terminated.
Note: services.exe is also a process which is registered as the W32.Randex.R Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.
Damage Level : Very Low
Distribution Level: Very Low

Sndconfg16.exe (Worm)
This file is a worm! It is the WORM_SHAREBOT.A worm which uses P2P networks to infect users. This worm, when executed will dump a bunch of files in random folders (usually shared folders) with names.
Damage Level : High
Distribution Level: High

Sysconf32.exe (NOOMY.A WORM/W32/Agobot-FP Trojan)
Windows HTML file reader should not be running at startup. It is likely a virus, spyware, trojan, or some other sort of malicious program. Use a virus scanner, and/or spyware removal tool to remove it.
sysconf.exe is a process which is registered as W32/Agobot-FP Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
Damage Level : High
Distribution Level: Unknown


Syshosts.exe (W32.MyDoom.Y/Worm)
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Damage Level : Low/Medium
Distribution Level: Unknown

Tkbellexe.exe (W32.Lovgate/Worm)
W32.Lovgate is a Trojan that spreads through email and exploits buffer overrun vulnerability in the system. Once executed, Lovgate can allow unauthorized remote access to infected systems.
TkBellExe.exe is a mass-mailing worm Worm.Win32.LovGate.
TkBellExe.exe opens a back door on TCP port 6000.
TkBellExe.exe spreads via open network shares.
TkBellExe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Damage Level : Low/Medium
Distribution Level: Unknown

Dangerous File Processes In Windows - Part 3

Java.exe (Java)
The process called java.exe, is used to run programs written in the Java language. Terminating this process will end any java programs that are running at the time. If you find that it is causing problems from your system, you should terminate it.java.exe is an application that does NOT appear to be a security risk.
The Process Server database currently registers java.exe to Sun Microsystems.
This is part of Java Runtime. java.exe is related to javaw.exe, jucheck.exe, jusched.exe,
Whenever you have a concern about a file like java.exe, feel free to visit our Anonymous Surfing section to help verify your file you are not giving away too much personal information.
The Process Server database is updated often, but inaccuracies may still exist, often caused by viruses named after valid files such as Java. Always verify your results just to play it safe.
Damage Level: Low
Distribution Level: High


Kazza.exe (kazza/Optix Trojan)
If a process named kazza.exe is running on your computer, you may have been infected with a strain of the Optix Trojan. kazza.exe is considered to be a security risk, not only because antivirus programs flag kazza as a trojan, but also because other sites consider it a Trojan as well. kazza is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of kazza.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information. The Process Server database currently registers kazza.exe to Optix Trojan.
Damage Level : High
Distribution Level: Low


Nvsc32.exe (Backdoor.IRC.Bot Trojan)
nvsc32.exe is a process which is registered as Backdoor.IRC.Bot Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
Level of Danger: Medium
Distribution Level: Medium


Re_file.exe (W32.Beagle)
This worm spreads via the Internet as an attachment to infected messages. Infected messages will be sent to all email addresses harvested from the victim machine.
The worm is also able to download other files from the Internet without the knowledge or consent of the user. The worm itself is a PE EXE file. The file is 40,565 bytes in size.
Re_file.exe is a mass-mailing worm W32.Beagle.BO@mm.
Re_file.exe spreads by e-mail.
Re_file.exe opens a back door on TCP port 80.
Re_file.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svc.exe
%System%\re_file.exe
%Windir%\eml.exe
Damage Level: Highly Dangerous
Distribution Level: High


Sagate.exe (GAOBOT.BOW WORM)
Sagate Security Firewall should not be running at startup. It is likely a virus, spyware, trojan, or some other sort of malicious program. Use a virus scanner, and/or spyware removal tool to remove it. Added by the GAOBOT.BOW WORM
Level of Danger: High
Distribution Level: Medium

Dangerous File Processes In Windows - Part 2

Drvddll.exe (Beagle X worm)
drvddll.exe is a process which is registered as the W32.BAGLE.AJ, W32.BAGLE.AP and W32.BAGLE.X worms. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment.
Beagle X worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of drvddll.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
drvddll.exe is considered to be a security risk, not only because antivirus programs flag Beagle X worm as a trojan, but also because other sites consider it a Trojan as well.
Beagle X worm is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of drvddll.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information.
Damage Level: Low
Distribution Level: Unknown

Funny.exe (aprilcone.a worm)
funny.exe is considered to be a security risk, not only because antivirus programs flag aprilcone.a worm as a virus, but also because a number of users have complained about its performance.
aprilcone.a worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of funny.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
Damage Level: Low
Distribution Level: High

Fvprotect.exe (Netsky.P worm)
fvprotect.exe is considered to be a security risk, not only because antivirus programs flag Netsky.P worm as a virus, but also because a number of users have complained about its performance.
Netsky.P worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of fvprotect.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
Damage Level: Medium
Distribution Level: Medium

isass.exe (Futro Trojan)
isass.exe is considered to be a security risk, not only because antivirus programs flag Futro Trojan as a trojan, but also because other sites consider it a Trojan as well.
Futro Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of isass.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information.
Damage Level: Medium
Distribution Level: Medium


Jammer2nd.exe (Netsky)
jammer2nd.exe is considered to be a security risk, not only because antivirus programs flag Netsky as a virus, but also because a number of users have complained about its performance.
Netsky is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of jammer2nd.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
Damage Level: Medium
Distribution Level: High