| Status | Autorun name | Command | Description |
| U | H/PC Connection Agent | WCESCOMM.EXE | Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier), supporting mobile devices based upon the Windows CE OS (such as Pocket PC, Handheld PC and Windows Mobile). Automatically launches ActiveSync (if enabled) when the mobile device is connected. If disabled it will re-instate the next time ActiveSync runs - hence the reluctant "U" recommendation |
| Y | H2O | cledx.exe | Related to copyright protection products by SyncroSoft |
| U | H2OWIBU | CXWibu.exe | Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware |
| X | h4te Service Drivers | h4te.exe | Added by a variant of the RBOT WORM! |
| U | Habu | razerhid.exe | Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros |
| X | hachimitsu-lemon | hachimitsu-lemon.exe | Added by the HACHILEM TROJAN! |
| X | HackMuFpt | HackMuFpt.exe | Added by the SCLOG-AG TROJAN! |
| X | hagent | avp.exe | Added by the "Herman Agent" remote access TROJAN! |
| X | Halflife | halflife2.exe | Added by the AGOBOT-OC BACKDOOR! Note - this file is not associated with Valve Corporation's Half-Life 2 game |
| U | HalifaxHowardCluster | skinkers.exe | "Howard the Weatherman" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages |
| Y | Hamachi | hamachi.exe | LogMeIn Hamachi remote control and VPN software |
| U | HaMFrontPanel | hampanel.exe | Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget, but otherwise pointless |
| U | Handy Backup 3.9 | hbagent.exe | Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers |
| X | HanUpdate | hanz.exe | Added by the RBOT-GLJ WORM! |
| N | Hard Disk Sentinel | HDSentinel.exe | Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find, test, diagnose and repair hard disk drive problems, display hard disk health, performance degradations and failures |
| X | Hard drive Controller | hdcontroller.exe | Added by the KIMAN.B WORM! |
| X | HardDriveGuard | SysRep.exe | HardDriveGuard rogue system error and cleaning utility - not recommended, removal instructions here. A member of the ErrClean family |
| U | Hardware Doctor | Hwdoctor.exe | Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds, voltages, temperatures. Only required if you're concerned about your system temperature - typically for "overclocked" systems |
| X | Hardware Monitor Service | mshms.exe | Added by the WOLLF-A TROJAN! |
| X | Hardware Profile | hxdef.exe | Added by the LOVGATE.AB WORM! |
| X | Hardware Profile | hxdef.exe... | Added by the LOVGATE.Z WORM! |
| U | Hardware Sensors Monitor | hmonitor.exe | Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems |
| X | Hardware Shell Detection | WinHSD.exe | Added by a variant of the RBOT WORM! |
| U | Hare | hare.exe | Hare - improve and optimize performance of desktop/laptop PCs |
| U | Harmony 98 - CasioOrg | CasAgnt.exe | Enterprise Harmony 98 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000 |
| X | HataDuzelticisi | SysRep.exe | HataDuzelticisi, Turkish rogue system error and cleaning utility - not recommended. A member of the ErrClean family |
| X | HATAPE | [path to trojan] | Added by the BANKER-QF TROJAN! |
| U | HawkEye | HAWK_95.EXE | Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs |
| U | HawkEye IV Control Panel | HAWK_32.EXE | Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs |
| U | Hawking HWU54G Utility | HWU54G.exe | Wireless management utility for the HWU54G Mini Wireless-G USB Adapter from Hawking Technologies, Inc |
| U | Hawking Wireless Utility | HWU8DD.exe | Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies, Inc |
| X | Hbinst | Hbinst.exe | Hotbar adware |
| N | HC Reminder | hc.exe | For Compaq PC's. Help Compiler, crunches help database, will run without being in startup when needed |
| N | HCDetect | HCDetect.exe | MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification, detection, and Internet Connection Sharing (ICS) taskbar icon. Not required - network can be set-up manually, also has a known memory leak problem |
| X | hcen | hcen.exe | Added by the SMALL.LR TROJAN! |
| U | hcenter | tgcmd.exe | Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers, fix faults, etc. Also see the TgAddServer entry. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation" |
| U | hcenter | hcenter.exe | Bellsouth help center. Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers, fix faults, etc. Also see the TgAddServer entry. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation" |
| X | hchos | hchos.exe | Added by the SCAR.BVBM TROJAN! |
| X | hclean32.exe | hclean32.exe | Wareout - malware masquerading as a spyware and dialer remover |
| U | Hcontrol | hcontrol.exe | Hotkeys on an ASUS Notebook. Only required if you use the additional keys |
| X | hcontrol32.exe | hcontrol32.exe | Added by the VB-EUF WORM! |
| U | HControlUser | HControlUser.exe | Hotkeys on an ASUS Notebook. Only required if you use the additional keys |
| N | hcsystray | hc_tray.exe | Kuma Notifier for the Shootout! game from the History Channel. "It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information" |
| N | HD Audio Control Panel | RtHDVCpl.exe | Realtek HD Audio Manager, installed with the Vista drivers for on-board Realtek HD audio codecs. Unless you have the default (but optional) System Tray icon enabled, the only purpose this entry serves is to detect and allow you to configure any devices plugged into the jacks - such as headphones and a microphone. With the System Tray icon enabled it will also inform you when devices are removed and give you access to the Sound Manager and other multimedia functions. The Sound Manager is also available via the Control Panel and this entry is therefore only required if you regularly change sound schemes |
| N | HDAShCut | HDAShCut.exe | High definition audio page shortcut for Realtek audio devices - not required |
| U | HDAudDeck | HDAudioCPL.exe | Vista control panel for VIA Vinyl HD Audio Codecs from VIA Technologies, Inc - such as the VT1708B |
| U | HDAudDeck | HDeck.exe | XP control panel for VIA Vinyl HD Audio Codecs from VIA Technologies, Inc - such as the VT1708B |
| X | HDAudio | hda.exe | Added by the TACTSLAY.U TROJAN! |
| X | HDAudio Driver 1.0 | [random filename].exe | Added by the TEADOOR-D TROJAN! |
| X | HDAudio Driver 2.0 | [random filename].exe | Added by the TEADOOR-E TROJAN! |
| U | HDDControlGuard | HDDControlGuard.exe | Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access |
| U | HDDControlGuard.exe | HDDControlGuard.exe | Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access |
| U | HDDHealth | hddhealth.exe | HDD Health is a "full-featured failure-prediction agent for machines using Windows 95, 98, NT, Me, 2000 and XP. Sitting in the system tray, it monitors hard disks and alerts you to impending failure" |
| U | HDDlife | HDDlife.exe | HDDlife checks the health of your hard drives at regular intervals and informs you about the results of these checks |
| ? | HDhelp | tbhdhelp.exe | Associated with Philips Edge series soundcards. Is it required? |
| X | hdlfoe df98ndf | svchots.exe | Added by a variant of the RBOT WORM! |
| X | hdlpscom | [8 random letters].exe | Added by the RBOT-FUL WORM! |
| X | HDriveSweeper | HDriveSweeper.exe | HDriveSweeper rogue privacy program - not recommended, removal instructions here |
| N | HDtray | HDtray.exe | Philips Edge Series Control Panel Tray Utility - system tray icon for a Philips Edge series soundcards. Available via Start -> Settings -> Control Panel |
| X | he3bbcff | rundll32.exe he3bbcff.dll,EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "he3bbcff.dll" file is found in %System% |
| X | he3e3fc4 | rundll32.exe he3e3fc4.dll, EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "he3e3fc4.dll" file is found in %System% |
| X | Hekio Startups | Hnksvc32.exe | Added by the AGOBOT-QE WORM! |
| X | HELLBOT TEST | 1hellbot.exe | Added by the MYDOOM.BO WORM! |
| X | HELLBOT3 | coolbot.exe | Added by the MYTOB.AB WORM! |
| X | hellfire | svchost.exe | Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | hellodolly | shost.exe | Added by the YODO WORM! |
| X | HelloInt | hello3.exe | Added by the CASAL.A TROJAN! |
| X | helloserv | helloserv.exe | Added by the ZHELATI.BHA WORM! |
| X | helloworld | nb32ext2.exe | Added by the MYDOOM.BV WORM! |
| X | helloworld | nb32ext3.exe | Added by the MYTOB.JT WORM! |
| X | helloworld3 | nb32ext4.exe | Added by the RITDOOR.A WORM! |
| ? | Help | helpext.exe | ?? |
| X | help | help.scr | Added by the BANCOS-BBU TROJAN! |
| X | Help | Wizardnil.exe | Added by the BANCOS-BCZ TROJAN! |
| X | Help | lshost.exe | Identified as a variant of the Trojan-Clicker.Win32.Delf.aro malware |
| X | Help Temp Files | netreg.exe | Added by the FORBOT-EM WORM! |
| X | Help Temp Files | emp32.exe | Added by the FORBOT-EC WORM! |
| U | HelpCenter | sprtcmd.exe /P HelpCenter | Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft, Inc). Identifies and automatically fixes typical problems that may occur with your high-speed internet service |
| U | HelpCenter4.1 | sprtcmd.exe /P HelpCenter4.1 | Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft, Inc). Identifies and automatically fixes typical problems that may occur with your high-speed internet service |
| X | helpctl.exe | helpctl.exe | Added by the GASLIDE TROJAN! |
| X | Helper | eschlp.exe | Added by the BLASTER.T WORM! |
| X | HELPER | greece_nm.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | Netherlands.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | new_zealand.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | sweden.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | canada.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | france.exe | AsdPlug premium rate adult content dialer variant |
| X | HELPER | temp532.exe | AsdPlug premium rate adult content dialer variant |
| X | helper.dll | rundll32.exe [path] helper.dll | CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| X | HelpExp.exe | HelpExp.exe | Attune HelpExpress - spyware. Disable and uninstall - see here |
| X | helpmanager | spoler.exe | Added by the RANDEX.J WORM! |
| X | helpo | helpo.exe | Added by the BANLOA-BU TROJAN! |
| X | helpw | helpw.exe | Adware downloader |
| X | hen | [filename].exe | Added by the TARNO.G TROJAN! |
| X | heomstool | heomstool.exe | Added by the HEOMS TROJAN! |
| Y | HEProtect | HSockPE.exe | Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite |
| ? | HerculesCamService | CamService.exe | Related to the Hercules Dualpix HD Webcam. What does it do and is it required? |
| X | hErcUnes | softhost.exe | Added by the GARROCH WORM! |
| X | herjek | herjek.exe | Added by the NUWAR.APJ WORM! |
| U | Hermes Messenger | DGDRHE~1.EXE | A LAN messenger alternative to WinPopUp - Digital Dreams Software |
