If you are finding that numerous programs are running from the ntuserlitelist folder on your computer, then you are infected with the s5Mark infection. When installed, the %LocalAppData%ntuserlitelist folder will be created that contains numerous subfolders named dataup, regtool, and svcvmx. Each of these folders contain unwanted programs that make it so you are unable to launch your security programs and will constantly connect to remote sites.
This article was published first at Remove the Ntuserlitelist Adware & Trojans
Source: Bleeping Virus