| Status | Autorun name | Command | Description |
| X | c | c:\archiv~1\win.com | Added by the CUYDOC TROJAN! |
| U | C-Media Echo Control | EchoCtrl.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer |
| N | C-Media Mixer | Mixer.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs |
| X | C:\lanmao.exe | BDQX.EXE | Added by the BIGDIPPER.A BACKDOOR! |
| U | C:\Program Files\dfjdkjfdkjfldjf\dfjdkjfdkjfldjf\winlogin.exe | CritProc.exe | KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself! |
| U | C:\Program Files\NetMeter\NetMeter.exe | NetMeter.exe | "Net Meter is a small, customizable network bandwidth monitoring program for Win9x/Me/NT4/2K/XP. NetMeter is and will always stay freeware. The program has been tested extensively on Win2K/XP, but it should work just as well on all other Win32 operating systems" |
| X | C:\WINDOWS\asam.exe | asam.exe | Added by the PEACOMM.E TROJAN! |
| X | C:\WINDOWS\IEXPLOR.EXE | IEXPLOR.EXE | "Pop Marketing" adware |
| X | C:\WINDOWS\system32\SetupCmd.exe | SetupCmd.exe | Detected by Kaspersky as the AGENT.AAW TROJAN! |
| X | C:\WINDOWS\VCMnet11.exe | VCMnet11.exe | Windows AFA Internet Enhancement - browser hijacker redirecting to adsourcecorp.com. Removal instructions here |
| X | C:\WINDOWS\WinTask.exe | WinTask.exe | "Pop Marketing" adware |
| U | C2K | CYB2K.EXE | CYBERsitter 2000 or 2001 - anti-adult content filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser |
| U | c32cs2 | c32cs2.exe | Cyber Sentinel - internet filtering software |
| X | C7 | [path to worm] | Added by the MEDIAKILL.A WORM! |
| Y | CA Anti-Spyware | CAPPActiveProtection.exe | Part of CA Anti-Spyware until 2009 (either as a stand-alone product or as part of a suite). Works in conjunction with the CA Pest Patrol Realtime Protection Service (ITMRTSVC) service to monitor software installations for potentially malicious behaviour, warn the user if any is detected and request user input on how to handle them |
| Y | CA Anti-Virus | CAVRID.exe | Real-time scanning engine for versions of CA Anti-Virus products until 2009 (both stand-alone and as part of security suites) - including eTrust EZ Antivirus, eTrust Vet Antivirus and a version available from Yahoo! Scans files for viruses and other malware when you access, create or download them |
| U | CA Personal Firewall | cafw.exe | Installed with older versions of CA Personal Firewall (either as a stand-alone product or as part of CA Internet Security Suite). The file opens the main firewall configuration Window but does not appear to run on startup - hence the "U" recommendation |
| Y | CA Personal Firewall | capfasem.exe | Runs the core program for older versions of CA Personal Firewall (installed as either as a stand-alone product or as part of CA Internet Security Suite) |
| ? | CA Personal Firewall | capfupgrade.exe | Installed with CA Personal Firewall (either as a stand-alone product or as part of CA Internet Security Suite). The exact purpose is unknown at present and it does not normally appear to run |
| U | CA Security Suite | casc.exe | Installed with both stand-alone security tools and suites from CA. Provides System Tray access to the Control Center - which indicates the current tool status and can be used to launch scans, updates or access product information. The icon changes appearance if a warning or issue is detected |
| U | CA Security Suite | cctray.exe | Installed with older versions of both stand-alone security tools and suites from CA. Provides System Tray access to the Control Center - which indicates the current tool status and can be used to launch scans, updates or access product information. The icon changes appearance if a warning or issue is detected and double-clicking on it gives details about the warning or the alert state |
| U | CA-AMAgent | amagent.exe | Unicenter Asset Management is a solution for proactively managing IT assets in a business environment. It provides full-featured asset tracking capabilities through automated discovery, hardware inventory, network inventory, software inventory, configuration management, software usage monitoring, license management and extensive cross-platform reporting |
| X | ca84c702-c758-4421-974e-b02662e76d7c_6 | rundll32.exe | Antimalware Defender rogue security software - not recommended, removal instructions here! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| X | ca84c702-c758-4421-974e-b02662e76d7c_6 | rundll32.exe ca84c702-c758-4421-974e-b02662e76d7c_6.avi | Antimalware Defender rogue security software - not recommended, removal instructions here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "ca84c702-c758-4421-974e-b02662e76d7c_6.avi" file is located in %System% and %AppData% |
| Y | caaspydelayedscan | CAAntiSpyware.exe | Part of CA Anti-Spyware until 2009 (either as a stand-alone product or as part of a suite). Runs a delayed scan on the first boot after installation before exiting |
| Y | CaAvTray | CAVTray.exe | System Tray access to earlier versions of the CA antivirus products - including EZ Antivirus, eTrust Vet Antivirus and a version available from Yahoo! |
| X | Cabchk | Cabchk.exe | Added by the GEMA TROJAN! |
| X | Cabchk32 | Cabchk32.exe | Added by the GEMA TROJAN! |
| X | CABCInstall | CABCInstall.exe | Ignite Technologies (was CABC) content delivery software |
| X | Cable Modem Adapter | WindowsSec.exe | Added by the WOOTBOT.A WORM! |
| U | CacheBoost | trayicon.exe | CacheBoost "optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers, resulting in a performance boost" |
| X | CacheLoader | [path to trojan] | Added by the DLOADER-NZ TROJAN! |
| N | Cacheman | Cacheman.exe | Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up |
| Y | CacheMgr | CacheMgr.exe | Sophos Antivirus Remote Update |
| U | CacheSentry Pro | CacheSentry Pro.exe | "CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache" |
| N | CACStarter | cacstart.exe | Cash A Check - check writing software |
| U | Caddais BackupOnDemand | BODMon.exe | Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" |
| U | Cadenza | CdzSvc.exe | Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices |
| U | CADS | cads.exe | Cyber Sentinel - internet filtering software |
| U | CafeStation | CafeStation.exe | "CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations, manage customer database, sell products and generate detailed reports and statistics" |
| U | cafw | cafw.exe | Installed with older versions of CA Personal Firewall (either as a stand-alone product or as part of CA Internet Security Suite). The file opens the main firewall configuration Window but does not appear to run on startup - hence the "U" recommendation |
| U | cafwc | cafw.exe | Installed with older versions of CA Personal Firewall (either as a stand-alone product or as part of CA Internet Security Suite). The file opens the main firewall configuration Window but does not appear to run on startup - hence the "U" recommendation |
| N | CAgent | CAgent.exe | Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents |
| X | cAgOu | [filename].hta | Added by the KAKWORM WORM! |
| N | CahootWebcard | CahootWebcard.exe | "The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details". Run manually when needed |
| X | caidiysetup | diynetsetupuni.exe | DIYNet adware |
| Y | CAISafe | isafe.exe | E-mail scanning part of EZ Antivirus - part of the eTrust range of security products formerly available from CA but now discontinued. Available as a stand-alone product or as part of the EZ Armor suite. Runs as the CAISafe service in later product versions |
| U | CaISSDT | caissdt.exe | Installed with older versions of both stand-alone security tools and suites from CA. Provides System Tray access to the dashboard - which indicates the current tool status and can be used to launch scans, updates or access product information |
| N | Cal Reminder Shortcut | calrem.exe | Produces a pop-up reminder of events scheduled using the MS Office Calendar |
| X | calc | rundll32.exe [path] ntuser.dll,_IWMPEvents@0 | Added by the OPACHKI.A TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "ntuser.dll" file is located in %UserProfile% |
| X | calc | rundll32.exe calc.dll,_IWMPEvents@0 | Added by the OPACHKI.A TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "calc.dll" file is located in %System% |
| X | Calc Microsoft Windows | wincalc.exe | Added by an unidentified WORM or TROJAN! |
| X | CALC32 | CALC32.EXE | Added by the SPYBOT-EC WORM! |
| X | CalcScience | cscientist.exe | Added by the SDBOT.ACQ WORM! |
| U | Calendar | Calendar.exe | This entry can be added by PlainSight Desktop Calendar and older versions of Desktop iCalendar from Desksware and the older Calendar 200X - which is no longer supported by or available from the author |
| ? | Calendar 200X Monitor | calmonitor.exe | Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one |
| N | Calendar 200X Reminder | calendar.exe | Part of Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. Displays reminders for holidays, anniversaries, tasks, etc. Disabling this entry via the program also disables the Calendar 200X Monitor entry |
| ? | Calendar Monitor | calmonitor | Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present |
| U | Calendarscope | cs.exe | Calendarscope calendar software |
| X | calk | calk.exe | Added by the STARTPA-FH TROJAN! |
| X | Call Function System32 | sddriver.exe | Added by a variant of the SDBOT TROJAN! |
| X | Call32 | Call32.exe | Added by the SPAMMIT-H TROJAN! |
| Y | CallBumping | cbpopw.exe | Related to the Gazel 128 PCI ISDN adapter. Required if you use it |
| U | CallCenter Main Application | V3calmcp.exe | "V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answering machine capability, and sophistcated data communications." Main application |
| U | CallCenter Printer Interface | V3faxecp.exe | "V3 Inc. CallCenter is a free 32-bit, integrated fax, voicemail and data communications application with a simple to use interface providing fax send and receive functionality, basic (single mailbox) answering machine capability, and sophistcated data communications." Fax printer |
| N | CallControl | ftctrl32.exe | FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows |
| ? | calmonitor | calmonitor.exe | Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one |
| ? | calmonitor | calmonitor | Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present |
| U | Camaro Calendar | Camaro Calendar.exe | Calendar gadget included with the Camaro theme for MyColors from Stardock Corporation |
| U | Camaro Clock | Camaro Clock.exe | Clock gadget included with the Camaro theme for MyColors from Stardock Corporation |
| U | Camaro Weather | Camaro Weather.exe | Weather gadget included with the Camaro theme for MyColors from Stardock Corporation |
| N | CamCheck | CamCheck.exe | NuCam camera software related |
| U | Cameno | Cameno.exe | Cameno is a program which brings tabbed windows to MSN Messenger 6.0 and above |
| U | Camera Assistant Software | traybar.exe | Camera Assistant Software utility for Toshiba laptops - allows you to take pictures with and control the integrated WebCam |
| U | Camera Detector | CAMDET~*.EXE | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| U | Camera Detector | Camdetect.exe | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| U | Camera Detector | DEVDET~*.EXE | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| ? | CameraApplicationLauncher | CameraApplicationLaunchpadLauncher.exe | Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required? |
| U | CameraAssistant | CameraAssistant.exe | Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom, for example. If you don't use the camera on a daily basis create your own shortcut and run it manually when required |
| N | Camfrog | CamfrogNet.exe Camfrog Video Chat.exe | Camfrog video chat software by Camshare Inc |
| N | Camio Viewer | IXApplet.exe | Part of Sierra Image Expert, an image viewing program that comes with digital cameras which shows pictures that are in the camera before downloading them |
| N | Camio Viewer 1.8.7 | IXApplet.exe | Part of Sierra Image Expert, an image viewing program that comes with digital cameras which shows pictures that are in the camera before downloading them |
| N | Camio Viewer 2.0 | IXApplet.exe | Part of Sierra Image Expert, an image viewing program that comes with digital cameras which shows pictures that are in the camera before downloading them |
| N | Camio Viewer 3.2 | IXApplet.exe | Part of Sierra Image Expert, an image viewing program that comes with digital cameras which shows pictures that are in the camera before downloading them |
| ? | CamMonitor | hpqcmon.exe | From HP and related to digital imaging |
| Y | CamWizard | CamWizrd.exe | Launches the Logitech Camera Wizard on the first reboot after installing versions of Logitech QuickCam webcam software |
| N | Canada | Canada.exe | Known to be a dialler - but is it maliscous or clean? |
| U | Canary | canary-std.exe | Canary keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | candy | command32.exe | Added by the RBOT-LV WORM! |
| X | candynet | Taskmsg.exe | Added by the RBOT-NA WORM! |
| U | CANoe | CANoe32.exe | CANoe from Vector Informatik. Development and test tool for Engine Control Units (ECU) based upon the CAN, LIN, MOST, FlexRay, Ethernet and J1708 bus systems |
| U | Canon MultiPASS Status Monitor | monitr32.exe | Cannon Multi-Pass status monitor |
| ? | Canon PC1200 iC D600 iR1200G Status Window | CAPM1LAK.EXE | Cannon printer related - is it required in startup? |
| U | CanonMyPrinter | BJMyPrt.exe | Printer software for Canon Bubblejet printers |
| U | CanonSolutionMenu | CNSLMAIN.exe | Canon's Solution Menu dialog box leads you quickly toward documentation, utilities, and help files |
| ? | CAP3ON | CAP3ONN.EXE | Canon driver, purpose unknown. Is it required in startup? |
| Y | capfasem | capfasem.exe | Runs the core program for older versions of CA Personal Firewall (installed as either as a stand-alone product or as part of CA Internet Security Suite) |
| N | Capfax | capfax.exe | PhoneTools fax software |
| ? | capfupgrade | capfupgrade.exe | Installed with older versions of CA Personal Firewall (either as a stand-alone product or as part of CA Internet Security Suite). The exact purpose is unknown at present and it does not normally appear to run |
| U | CAPing | CAPing.exe | Citibank Citianywhere software |
