your database shows 2 entries, one with an X and one with a Y. I've noticed this on a couple of different entries. how can you tell if the one you have is the legitimate one?

Look at the file locations for zlclient.exe. If it is not in the location specified as the safe (Y) ones, then it is most likely malware.