Autorun Details: (Default)

Name: (Default)
Command: media_driver.exe
Status: Definitely not required. Usually Malware.
Description: Added by the TUPEG VIRUS! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: Shania.vbs
Status: Definitely not required. Usually Malware.
Description: Added by the SHANIA BACKDOOR! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: NOTEPAD.exe
Status: Definitely not required. Usually Malware.
Description: Added by the RUSTY WORM! Note - not to be confused with the valid Windows "NOTEPAD" text editor! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: [random filename].exe
Status: Definitely not required. Usually Malware.
Description: Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: twunk_32.exe
Status: Definitely not required. Usually Malware.
Description: Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: winhelp.exe
Status: Definitely not required. Usually Malware.
Description: Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: spolsvr2.exe
Status: Definitely not required. Usually Malware.
Description: Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: winbas12.exe
Status: Definitely not required. Usually Malware.
Description: Adware, CoolWebSearch parasite related - detected by Kaspersky as the VB.DU TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: Systrsy.exe
Status: Definitely not required. Usually Malware.
Description: Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: llsass.exe
Status: Definitely not required. Usually Malware.
Description: Added by the PROXY-GG TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: syspol.exe
Status: Definitely not required. Usually Malware.
Description: Added by the DREMN-B TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (default)
Command: winlog.exe
Status: Definitely not required. Usually Malware.
Description: Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (default)
Command: rundll32.exe [path to DLL file],Do98Work
Status: Definitely not required. Usually Malware.
Description: Added by the HESIVE.B TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run, HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: winligom.exe
Status: Definitely not required. Usually Malware.
Description: Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run, HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: 5640.exe
Status: Definitely not required. Usually Malware.
Description: Added by the DOWNLD-ABF TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run, HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: ajsha5.exe
Status: Definitely not required. Usually Malware.
Description: Added by the SPYBOT-NX WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run, HKLM\RunServices and HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: QQUpdate.exe
Status: Definitely not required. Usually Malware.
Description: Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: Mcafee.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AGENT.AY TROJAN! Note - this is not a valid McAfee program and is located in %System%. This malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: fada.exe
Status: Definitely not required. Usually Malware.
Description: Added by the VB.HEI TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run, HKLM\RunServices and HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: Default.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\RunOnce & HKCU\RunOnce in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: KEYBOARD.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: msarti.com
Status: Definitely not required. Usually Malware.
Description: Added by the SILLYFDC.CJ WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\..\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: gbpm.exe
Status: Definitely not required. Usually Malware.
Description: Added by the DLOADR.ZZD WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: msnupdate.exe
Status: Definitely not required. Usually Malware.
Description: Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: regedit.exe /s appboost.reg
Status: Definitely not required. Usually Malware.
Description: Added by the APPIX.D WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file "appboost.reg" is located in %Windir%

Name: (Default)
Command: xtreme.exe
Status: Definitely not required. Usually Malware.
Description: Added by the DROPR-CZ TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (default)
Command: WINLOGON.EXE
Status: Definitely not required. Usually Malware.
Description: Added by the DELF-LP TROJAN! Note - this malware actually changes the value data of the "(default)" key in HKCU\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: diagcfg.exe
Status: Definitely not required. Usually Malware.
Description: Added by the GWGIRL BACKDOOR! Note - this malware actually changes the value data of the "(Default)" key in HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: asdfsd343f.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AUTORUN-BBB WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (default)
Command: svchost.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AUTORUN-CN WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a %ProgramFiles%\Common Files\Services. Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: avg.exe
Status: Definitely not required. Usually Malware.
Description: Added by the BANKER-ETV TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: axeWen.exe
Status: Definitely not required. Usually Malware.
Description: Added by the SCAR-AL WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: ifconfig.exe
Status: Definitely not required. Usually Malware.
Description: Added by the RBOT-GFW WORM! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run, HKLM\RunServices and HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: winweng.exe
Status: Definitely not required. Usually Malware.
Description: Added by the AGENT-SB MALWARE! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Name: (Default)
Command: ctmon.exe
Status: Definitely not required. Usually Malware.
Description: Added by the BANCOS.AAN TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank

Back to the autorun list

The autorun list is presented in association with Sysinfo.org

Our Tip: Emsisoft Anti-Malware - Best In Test!

Emsisoft Anti-Malware is the best of 19 tested antivirus programs - Test by MRG - Malware Research Group - June 2009
Read more about the test winner