| Status | Autorun name | Command | Description |
| X | XP HOT FIS | kbx.exe | Added by the FORBOT-GS WORM! |
| X | XP Loader | loaderxp.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | XP Protection Center | XPProtectionCenter.exe | XP Protection Center rogue security software - not recommended, removal instructions here |
| X | XP SecurityCenter | XPSecurityCenter.exe | XPSecurityCenter rogue security software - not recommended, removal instructions here |
| X | XP Service Pack | xpservicepack.exe | Added by the SDBOT.AQA WORM! |
| X | xp service pack 2 | xpsp2.exe | Added by the RBOT-KW WORM! |
| X | XP System | systemxp.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| U | XP Tools | xptools.exe | XPTools - "integrated suite of powerful PC Utilities to fix, speed up, maintain and protect your computer" |
| X | XP-078F2E4E | XP-078F2E4E.EXE | Added by the AUTORUN-SW WORM! |
| X | XP-C300C3AC | XP-C300C3AC.EXE | Added by the AUTORUN.EHW WORM! |
| X | xp_system | [filename] | Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004 |
| X | xp_system | winlogon.exe | Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe, which should not figure in Msconfig/Startup! |
| X | xp_system | services.exe | Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant, examples are 10066, 20001, 20088 |
| X | xp32win | xpupdater02.exe | Added by the MOSUCK-A TROJAN! |
| N | Xpadder | Xpadder.exe | "Xpadder simulates the keyboard and mouse using your gamepad" |
| ? | XPAgent | XPAgent.exe | Part of the IBM/XPoint Rapid Restore utility - normally located in %ProgramFiles%\XPOINT\AGENT folder. Appears as a service in XP/Vista and under the "RunServices" registry key in Win98. What does it do and is it required? |
| X | XPAgent | XPAgent.exe | Detected by Panda as the CLICKER.LE TROJAN! Do not confuse this with the IBM/XPoint Rapid Restore file which is normally located in %ProgramFiles%\XPOINT\AGENT folder. This one is found in %System% |
| X | XPAntivirus | XPAntivirus.exe | XPAntivirus rogue security software - not recommended, removal instructions here |
| X | XpAspy | [path to trojan] | Added by the DELF-WH BACKDOOR! |
| ? | xpcfg | xpcfg.exe | ?? |
| ? | Xpclient | xpclient.exe | Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? |
| U | XPCMonitor | XPCMonitor.exe | XPC Monitor Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | XPCPHOST Settings | xpcphost.exe | Added by a variant of the RBOT WORM! |
| X | XPdefender | XPdefender.exe | XPdefender rogue spyware remover - not recommended, removal instructions here |
| X | XPGuard | XP-Guard.exe | XP-Guard rogue security software - not recommended, removal instructions here |
| X | xpiupdate | xpiupdate.exe | Added by the RBOT-AAB WORM! |
| U | xPlanetControl | xPlanetControl.exe | Tool that displays a globe with current day/night zones and clouds on users desktop. |
| U | Xplay | XPlay.exe | Xplay 3 from Mediafour Corporation - "expands what you can do with any iPod, including the iPhone and iTouch, and a Windows computer." If not used regularily start manually before connecting the iPod/iTouch |
| U | XPlay.exe | XPlay.exe | Xplay 3 from Mediafour Corporation - "expands what you can do with any iPod, including the iPhone and iTouch, and a Windows computer." If not used regularily start manually before connecting the iPod/iTouch |
| X | Xplorer | Xplorer.exe | Added by the AUTOIT-BP WORM! |
| X | Xplorer | KHATRA.exe | Added by the AUTOIT.K TROJAN! |
| X | Xpnet | NetXp.exe | Added by the BANCBAN-AT TROJAN! |
| X | xpprotect | xpdeluxe.exe | XP Protector Deluxe rogue security software - not recommended, removal instructions here |
| X | XPShield | XP-Shield.exe | XP-Shield rogue security software - not recommended, removal instructions here |
| X | XPSoft | CVDAsDW.exe | Added by the SDBOT-SY WORM! |
| X | XPSP2 Firewall | xpsp2fw.exe | Added by the SMALL-RN TROJAN! |
| X | xpsp2install | xpsp2Update.exe | Added by the AGENT-DPK BACKDOOR! |
| X | xpsp2Update | xpsp2Update.exe | Added by the AGENT-DPK BACKDOOR! |
| X | xpstart | wini.exe | Added by the PICRATE.A WORM! |
| X | xpstat | winlogins.exe | Added by the RBOT-AAR WORM! |
| X | XPsys | XPsys.exe | Added by the DELF-KQ TROJAN! |
| X | xpsystem | y.exe | CoolWebSearch parasite variant |
| X | Xpsystem | SERVICES.EXE | Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\SERVICES |
| X | xpsystem | services.exe | CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | xpsystem | MSXMIDI.EXE | CoolWebSearch parasite variant, detected by Kaspersky as the SMALL.CW TROJAN! |
| X | xpupdate | updates.exe | Added by the BROPIA.L WORM! |
| X | XpyBurner | XpyBurner.exe | XpyBurner rogue spyware remover - not recommended, removal instructions here |
| X | xrt_Shell | xrt_vijr.exe | Added by the GOZI-GEN TROJAN! |
| X | xrt_Shell | xrt_brel.exe | Added by the AGENT.AJAT BACKDOOR! |
| X | xSafe | xSafe.exe | Added by the SILLYFDC.BAY WORM! |
| U | XSC SIP Client | X-Lite.exe | "CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download". For VOIP and broadband users |
| N | XSC SIP Client | X-PRO-Vonage.exe | Vonage SoftPhone X-PRO - allows you to use your computer as a phone by adding a fully functioning telephone interface to your PC |
| N | XSC SIP Client | sipgateXLite.exe | "sipgate x-Lite makes telephone calling possible directly over your PC. You only need a microphone and a sound card and/or a headset" |
| X | xserv | [path to trojan] | Added by the STUMPY-A TROJAN! |
| U | XStop95 | XStop95.exe | XStop - internet filter |
| X | xswdmse | [8 random letters].exe | Added by a variant of the SPYBOT WORM! See here |
| N | xswin | xswin.exe | Installed with a Xerox Work Centre Pro 555. Unchecking it removes an "out of system memory" error |
| ? | XTCsgloader | XTCsgloader.exe | Another Xupiter toolbar variant?? |
| X | xterm | vagqsqs.exe | Added by the SDBOT-TV WORM! |
| X | XTN Service Drivers | winxtn.exe | Added by the SDBOT-YK WORM! |
| U | XTNDConnect PC | XCPCMenu.exe | XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - 3CmPlm | Autodet.exe | 3Com Palm PC specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - CasioOrg | CasAgnt.exe | Casio Pocket PC specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - ErPhn2 | ErTray.exe | Sony Ericsson IrMC (Infrared Mobile Connectivity) phones and smartphones specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - LtNts4 | NtsAgnt.exe | (IBM) Lotus Notes 4 specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - MyPalm | MPTray.exe | Palm OS specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - PocketPC | AutoDetect.exe | Windows Mobile Pocket PC specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | XTNDConnect PC - ScheduleSync | SCHEDU~1.EXE | ScheduleSync specific translator for XTNDConnect PC - "award-winning desktop-sync application that enables you to easily synchronize your contacts, calendar, tasks, email and notes between your mobile devices and popular PC applications" |
| U | Xtra Help Assistant | matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". Xtra Help Assistant is required to run with the Help and Support program. If you uncheck Xtra Help Assistant and then run Help and Support it will add another Xtra Help Assistant in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide |
| X | Xtray | xtray_link.exe | Added by the VB.JL TROJAN! |
| U | XtreamLok License Manager | xl.exe | License manager for xLok (XtreamLok) - prevents software being reverse engineered |
| U | Xtrem parental control | pcx.exe | ParentXtreme - surveillance software. Uninstall this software unless you put it there yourself |
| X | XTServiceUpdate | XTServiceUpdate.exe | hahame.net adware downloader |
| X | XtTb.exe | XtTb.exe | Top-banners.com adware |
| ? | xuio.exe | xuio.exe | ?? |
| X | Xupiter Startup | XupiterStartup.exe | Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | XupiterCfgLoader | XTCfgLoader.exe | Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | XupiterCfgLoader | BWCfgLoader.exe | Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | xupiterstartup2003 | xupiterstartup2003.exe | Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | XupiterToolbarLoader | XupiterToolbarLoader.exe | Xupiter - adware and homepage hijacker. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | xuri49tkd | andy143.exe | Added by the KOOBFACE WORM! |
| U | xv_ctrl | v_ctrl.exe | 3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter" |
| X | xware | xware.exe | Malware downloader from xxsware.com, causes adult content popups |
| X | xware | cskware.exe | Malware downloader from xxsware.com, produces adult content popups |
| ? | XWMSUSBAPI | XWMSAPI.EXE | Part of the installation of a Xerox WorkCentre printer/scanner. Is it required? |
| X | xxcm | sys.exe | Added by the KRISWORM-A WORM! |
| X | xXjsKiNbkvU | xXjsKiNbkvU.exe | Added by the FAKEAV-DVL TROJAN! |
| X | xxsrSrv32 | xxsrsrv.exe | Added by the BANCSDE-E TROJAN! |
| X | xxxcxcxcx | xxxcxcxcx.exe | Added by the DWNLDR-IUR TROJAN! |
| X | XXXmpeg | XXXmpeg.exe | Adult content dialler |
| X | xxxvideo | xxxvideo.exe | AccessPlugin premium rate adult content dialler |
| X | xy | svhost32.exe | Added by the LINEAG-ABB TROJAN! |
| X | xzkadsfk10 | afslkfasl10.exe | Added by the ONLINEG-R TROJAN! |
| U | Y!TunnelBasic | YTBasic.exe | Y!TunnelBasic software provides additional features to Yahoo! Messenger |
| U | Y!TunnelPro | YTunnelPro.exe | Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia |
| U | Y!TunnelPro | YTPro.exe | Spam, bot and ad blocker for Yahoo! Messenger from Digital Asphyxia |
| U | Y'z Shadow | YzShadow.exe | Y'z Shadow 'adds a shadow effect to the windows in pursuit of the "beauty of a shadow". It also allows the user the option of making menus transparent' |
| U | Y'z Toolbar | YzToolBar.exe | Y'z Toolbar "allows the user to change the toolbar icons in Explorer and Internet Explorer. The user can also create and add their own themes" |
| X | y1959sar | sv711224030r.exe | Added by the BRONTOK-AK WORM and variants! |
| X | y1959sar | yesbron.com | Added by the BRONTOK-AK WORM and variants! |
