CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

spacer spacer

O23 List of Windows XP/NT services

Currently 4053 entries and growing...
Last updated on 2008-08-02 17:32:28 Eastern.


This list was originally started at SpywareAid with 730 entries and Matt gave CastleCops permission to host it. CastleCops has since (May 2005) been adding new entries to it here. The new items may not be in the original list but attempts are made to ensure the original is also updated. The full HTML list is here.

KEY:
  • "L" = Legitimate
  • "O" = Open to Debate
  • "X" = Malware/Bad
  • "?" - Unknown

  •   

    ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z




    Full List

    NameStatusFilenameDescription
    LMMng (memlow)Xmemlow.sysAdded by the Troj/Haxdoor-AA TROJAN!
    Loading Outpost ConnectionsXcmdtel.exeWin32.Bagz.i email virus
    Local Connection Manager (8NASCAR)XDWUXJ.DLL Troj/QQHelp-Gen Note:Located in C:\Windows\System\wbem (Win9x/Me), C:\%WINDIR%\System32\wbem (Vista/XP/WinNT/2K) Installs numerous files and other services. Read the link
    Local Network Service (algs)Xgettfo.exeAdded by a variant of the W32/SDBOT WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder. The filename can be different
    Local Security Authority (LASec)Xlsass.exeKaspersky 7.0.0.125 2007.11.26 Backdoor.Win32.SdBot.aad Note:Located in C:\Windows\Config (Win9x/Me), C:\%WINDIR%\Config (Vista/XP/WinNT/2K)
    Local Security Authority Server (LSaServ)Xlsasrv.exeDetected as W32/Hupigon.gen76 by F-Secure Note: Located in %windir%\cursors
    Local Security Authority Subsystem Library (LSA Server)Xlsasrv.exeAdded by the Win32/Amahkey.F TROJAN! Note: This trojan is located in C:\%WINDIR%\
    Local Security Authority Subsystem Service (lsass)Xlsass.exeAdded by the W32/Tilebot-AK or W32.Spybot.ABDO WORM! Note: This is not the legitimate Windows process lsass.exe (Which is always found in the System32 folder). This worm file is found in the Windows or Winnt folder.
    Local Security Authority System Service (lsass)Xlsass.exeAdded by the W32/Rbot-AJA WORM! Note: This is not the legitimate Windows process lsass.exe (Which is always found in the System32 folder). This worm file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    Local Security Policy (Windows Local Security Policy)Xwpablan.exeUnidentified SDbot, probable variant of "W32/Sdbot-CWR".
    Local Service (LocalSystem)Xchfmon.exeAdded by the W32/Agobot-AIM WORM! Note: This worm\trojan is located in C:\%WINDIR%\ Read the link, allows remote access, steal information ...
    LocalPassSvcsXlocalpst.dll W32/Mofei-X Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (Vista/XP/WinNT/2K) Installs multiple files. Read the link
    Log Manager (Manager)Xwinup.exe W32/Spybot-NV Located in C:\Windows directory
    Logical Disk Manager Administrative Service (dmadmin)Ldmadmin.exeRelated to Veritas logical disk manager
    Logitech (Logitech Checker)Xlogitech.exeAdded by a variant of the W32/SDBOT WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder
    Logitech Bluetooth Service (LBTServ)LLBTSERV.EXERelated to bluetooth products from Logitech
    Logitech Easy SynchronizationLservicestub.exeRelated to Logitech_Easy, SSynchronization Logitech Easy Synchronization application, which allows you to easily synchronize your Bluetooth devices with your PC by pressing the dedicated key on your Logitech keyboard. Leave it running if you find it useful. Note: Located in \%Program Files%\Logitech\Easy Synchronization\
    Logitech IncXLBTSERV.EXEIdentified by BitDefender antivirus as a variant of the Backdoor.Sdbot.DEXZ worm and IRC backdoor. Note: located in \%WINDIR%\
    Logitech MM50 Kernel DriversXmm50krnl.exe W32/Spybot-NT Read the link, allows remote access
    Logitech Process Monitor (LVPrcSrv)LLVPrcSrv.exeRelated to Logitech QuickCam Provides additional configuration options for these devices.
    Logitech QuickCam ManagerXmlqm.exeAdded by the W32/Sdbot-DIJ WORM! Note: located in \%WINDIR%\System32\dllcache\ Read the link, allows remote access
    LogMeInLLogMeIn.exeRelated to LogMeIn LogMeIn Rescue is used by IT helpdesks to provide instant remote support to customers and employees. Note: located in C:\Program Files\LogMeIn\
    LogMeIn Backup Maintenance Service (BackupMaint)LBackupMaint.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Backup Storage PC Service
    (LogMeInBackupService.exe)
    LLogmeInBackupService.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Backup VSS Service (LMIBackupVSSService.exe)Llmibackupvssservice.exeRelated to LogMeIn from 3am Labs, Inc. Note: Located in \%Program Files%\LogMeIn Backup\
    LogMeIn Maintenance Service (LMIMaint)LRaMaint.exeRelated to LogMeIn LogMeIn Rescue is used by IT helpdesks to provide instant remote support to customers and employees. Note: located in C:\Program Files\LogMeIn\x86\
    Logon Process (WinLogon)Xwinlogon.exeAdded by a the Win32.IRCBot.zx Spyware WORM! a variant of the W32/IRCBot-UN Note: This worm\trojan is located in C:\%WINDIR%\
    LOGON suport serviceXIES4SERVICE.SYSAdded by the Goldun.G TROJAN! Note: This trojan file is found in the System32 folder.
    Logon Task ManagerXsymon.exeAdded by the Worm_Ircbot_Gen TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\System32\dllcache\ (XP/WinNT/2K)
    Logon Terminal ManagerXspoolsc.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
    LogonSvc (LogonSvcID)Llogonsvc.exeRelated to E-Pop web conferencing Note: Located in C:\Program Files\E-Pop\
    Lookout Citadel Server (LkCitadelServer)Llkcitdl.exeRelated to Lookout_Citadel_Server From National Instruments, Inc. Note: Located in C:\WINDOWS\system32\
    Lotus Notes Single LogonLnslsvice.exeIBM Lotus Notes Single Logon Service - http://www.anti-spy.info/process/nslsvice.exe.html
    lpclLlpcl.exeRelated to Warranty_Corporation_of_America More here Note: Located in \%WINDIR%\
    Lpdriver (Lpdriver)Xlpdriver.sysAdded by the W32/Tilebot-H or W32/Sdbot-ADG WORM! Note: This worm file is found in the System32 folder.
    LPTRDC server (LPTRDCsrv)Xctfmon.exeIdentified as TrojanDownloader:Win32/Fourta.A Malware Note: located in \%WINDIR%\ Note: Use SDFix under supervision.
    LSA ServerXlsasrv.exe Win32/IrmBot.worm.215040 Note: Located in %windir%
    LSA Shel (Export Version)Xlsass.exeAdded by the W32/Tilebot-HQ WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    LSA Shell Export-VersionXlsass.exeAdded by the W32/Tilebot-IU WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder.
    lsass (lsass)Xlsass.exeAdded by the W32/Rbot-AIC WORM! Note: This is not the legitimate Windows process. (Which is always found in the System32 folder.) This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    lsass (Workstations)Xautoexec.exeAdded by the W32/Sdbot-AFN WORM! Note: This worm file is found in the System32 folder.
    LsassFTP daemon (LsassFTPD)XLsassFtpd.exeAdded by the SDBOT.CDW WORM! Read the link, rootkit type stealth involved.
    LsassFTPzz daemon (LsassFTPDzz)XLsassFtpdz.exeAdded by the W32/Rbot-ARL WORM! Note: This worm\trojan file is found in the Windows or Winnt folder. Read the link, rootkit type stealth involved.
    LsdiorwLlsdiorw.exePart of macdisk
    LucentIKELLucentIKESvc.exeRelated VPN_ IPSec Client from Lucent. Note: Located in \%Program Files%\IPSec Client\
    LVCOMSerLLVComSer.exeRelated to LVCOMSer from Logitech. Note: Located in \%Program Files%\Common Files\LogiShrd\LVCOMSER\
    LVSrvLauncherLSrvLnch.exe Related to Logitech products
    LWWLicenseServiceLLWWLicenseService.exeRelated to Wolters_Kluwer The Professional's First Choice for information, tools and solutions that help professionals make their most critical decisions. Note: located in C:\Program Files\Common Files\WoltersKluwerLWW Shared\Service\
    lxba_deviceLlxbacoms.exeRelated to Lexmark_International and its printer services. Note: Located in C:\WINDOWS\SYSTEM32\
    lxbc_deviceLlxbccoms.exeRelated to Lexmark_International and its printer services. Note: Located in \%WINDIR%\System32\

    Engine Version 2.0 by CastleCops

    spacer spacer