Autorun List

Keys:

Y Normally harmless autorun.
N Not required, but may be started.
U User's choice. Start if necessary.
X Definitely not required. Usually Malware.
? Unknown

Filter:





View: All # A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Show all

Found 3127 autoruns. Autorun 201 to 300:

StatusAutorun nameCommandDescription
YScanRegistryScanregw.exeScans the Win98/Me system registry and makes back-ups at start-up - important should the registry become corrupt. Located in %windir%
XScanRegistryScanregw.exeAdded by the STATOR WORM! Note - this is not legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %System%. Runs from the registry RunServices key as opposed to the Run key
XScanRegistryN/AAdded by the DINOXI or DINOXI.B WORMS!
XScanRegistryscanregw.exeAdded by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in %System%
XScanRegistryupdate.exeAdded by the DWNLDR-FZY TROJAN!
NScanSoft OmniPage SE 4.0-reminderEreg.exe ereg.iniRegistration reminder for Ominpage SE version 4 from Scansoft (now Nuance)
NScanSoft PaperPort 7 Registration ReminderNAVBrowser.EXERegistration reminder for PaperPort 7 from Scansoft (now Nuance)
NScanSoft PDF Professional 4-reminderEreg.exe Ereg.iniRegistration reminder for PDF Converter Professional version 4 from Scansoft (now Nuance)
XScanSpywareScanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here
XScanSpyware v3.2Scanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here
XScanSpyware v3.5Scanner.exeScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here
UScanSys32sb32mon.exePart of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!
XscAppscApp.exeAdded by the STANDO-E WORM!
XscAppsuchost.exeAdded by the ACNATT.A WORM!
XscAppwmiprvse.exeAdded by the SILLYFDC-AW WORM!
NSCardSvrscardsvr.exeRelated to SmartCard readers and sometimes uses lots of system resources
XSCardSvrSCardSvr32.ExeAdded by the MOFEI.B WORM!
USCDEmuApp.exeSCDEmuApp.exeRelated to PowerISO - CD/DVD image file processing tool
USchdlr32Schdlr32.exeScheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled, this entry places an icon in the System Tray and will automatically load the main program and execute the backup at the set time - as long as the backup media is present
Xscheck45scheck45.exeRelated to unknown malware - hidden installer associated with it
Xschedlschedl.exeAdded by the VB-DVW WORM!
Uschedmschedm.exePart of Antivir PersonalEdition Classic anti-virus
XScheduIenrchk.exePremium rate adult content dialler
XScheduIrmsexploren.exeAdded by a variant of the SDBOT WORM!
XScheduIrshch.exeAdded by a variant of the SDBOT WORM!
XScheduIrsvchst.exeAdded by a variant of the SDBOT WORM!
XScheduIrwinagent.exeAdded by a variant of the SDBOT WORM!
UScheduleSchedule.exeScheduler for Mercury Ez View TV Tuner Card
NScheduled MaintenanceScheduled_Maintenance.exeScheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs
XSchedulerexpIorer.exeAdded by the TACTSLAY.A TROJAN! Note that the filename has a capital "i" in it
XSchedulerMSMSGS.EXEAdded by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in %System%\Config and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger
XScheduleroutIook.exeAdded by the TACTSLAY.A TROJAN! Note that the filename has a capital "i" in it
XSchedulersvcrhost.exeAdded by the TACTSLAY.A TROJAN!
XSchedulersvcshost.exeAdded by the TACTSLAY.A TROJAN!
XSchedulerwinagent.exeAdded by the TACTSLAY.B TROJAN!
USchedulerScheduler daemon.exeTenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleanings
XSchedulermsnexploren.exeAdded by the TACTSLAY.B TROJAN!
XSchedulersdhch.exeAdded by the TACTSLAY.B TROJAN!
XSchedulersvchst.exeAdded by the TACTSLAY.B TROJAN!
XScheduler Servicewsass.exeAdded by the LIOTEN.KX WORM!
Uscheduler_monitorinit_scheduler.exeScheduler for ReaConverter advanced image converter
Uscheduler_proxy Applicationscheduler_proxy.exeFound on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates), Rescue and Recovery (backup and system recovery), Message Center Plus and maybe others. It's exact function isn't known but if disabled, the "plan updates" button in the IBM System Update software will no longer be available, though the software will continue run properly
XSchedulerMgrnavchk.exePremium rate adult content dialer
XScheduling AgentScheduler.exeAdded by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect
XSchedulingAgantMMTASK.EXEAdded by the YAB.A TROJAN! Note - this is not the legitimate MusicMatch Jukebox file which has the same filename and is normally located in %ProgramFiles%\Musicmatch\Musicmatch Jukebox. This one is located in %Windir%
USchedulingAgentmstask.exeMS Scheduling Agent in Win98/Me/2K - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans. Located in %System% and loads via the HKLM\RunServices registry key
USchedulingAgentmstinit.exeMS Scheduling Agent in WinNT - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans. Located in %System% and loads via the HKLM\Run registry key with "/firstlogon" appended. Can also appear in WinXP (based upon the number of examples in a Google search) and rarely in Win98/Me/2K but we haven't seen it
XSchedulingAgentN/AAdded by the DINOXI or DINOXI.B WORMS!
XSchedulingAgentmstask.exeAdded by unidentified MALWARE! Note - this is not the MS Scheduling Agent in Win98/Me/2K. This one also loads via the HKLM\RunServices registry key but is located in %System% on a WinXP machine - where a file of that name does not normally exist
XSchedulingAgentmstasks.exeAdded by the MSIC BACKDOOR!
NSCHelper.exeSCHelper.exeSpyware Cease spyware remover. Previous versions were regarded as a rogue (see here) because it reported false or exaggerated system security threats but the latest version tested (6.5.1) has a new interface and produces no exaggerated threats on a clean system. Not recommended due to the past history
XSchijfBewakerSysRep.exeSchijfBewaker, Dutch rogue system error and cleaning utility - not recommended. A member of the ErrClean family
XSchijfControleurGDC.exeSchijfControleur Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family
USchmailiSchmaili.exeSchmaili - insert animated smilies into your e-mail
Xschost[path to trojan]Added by the TJSERV.D TROJAN!
NSchSvrSchSvr.exeWinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs
YSCHWIZEXSCHWIZEX.EXEPart of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot
Xsck121helpsyss.exeAdded by a variant of the MAILBOT TROJAN!
Nsclaunchersclauncher.exeSimpleCenter digital media player/manager that supports the iPod, Sony PSP, Xbox 360, some of the Nokia N-series mobile phones and others
Xsclicksclick.exeAdded by the FAKEALERT TROJAN!
XScManagerscman.exeAdded by the FORBOT-CW WORM!
Xscopedllscopedll.exeAdded by a variant of the CRYPTER.C TROJAN!
NScotia OnLine Recoveryetdirrcv.exeScotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process
NScotia OnLine Security v*.* Recoveryetdirrcv.exeScotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process
Xscoupasincra.exeAdded by the SDBOT-ST WORM!
Xscoupas[worm filename]Added by the SDBOT.ALC WORM! The most common filename is "sincras.exe"
XScrscr.scrAdded by the OPASERV.T WORM!
NScrapPadScrappad.exeScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper
Xscrbmk[path to trojan]Added by the DLOADER-VP TROJAN!
UScreen Calendarscrcal.exeScreen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler
UScreen Guardlaunch.exePart of Access Denied security and privacy software
UScreen Guard Message Scansgms.exePart of Access Denied security and privacy software
XScreen Saverscrnsaver.scrAdded by the RBOT-AGP WORM!
NScreen Saver ControlFSScrCtl.exeScreen saver control applet used by the "Stardust Screen Saver Toolkit", SolidWorks and Hubble Space Telescope screen savers (and possibly others). Lets you control your installed screensavers from a System Tray icon
NScreenHunter 4.0 FreeScreenHunter.exe"ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"
NScreenPrint32ScreenPrint32.exeScreenPrint32 screen capture software - can be launched manually
XScreenSaverPlusrundll32.exe MSA64CHK.dll,DllMostrarMatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System%
XScreenViewScreenView.exeScreenView spyware
?screxescruser2k.exe??
?scriptscript.batMaybe associated with DOS on a Win9x machine
YScriptBlockingSBServ.exePart of the "Script Blocking" feature for older versions of Symantec's Norton AntiVirus which monitors script-based (ie, JavaScript, VB Script) viruses and alerts you of virus-like malicious behavior, stopping these viruses before they can infect your system. Loads via the registry "Run" or "RunServices" keys in 98/Me and as a service in XP
YScriptSentryScriptsentry.exeScript Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly
UScroll-In-Mouse V2.0SCROLL.EXEToolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features
Xscrollerfpapli.exeCoolWebSearch parasite variant
Xscrssscrss.exeAdded by the HACDEF-R TROJAN!
Xscrsvcscrsvc.exeAdded by the AGENT-DS TROJAN!
XScrSvrScrSvr.exeAdded by the OPASERV WORM!
XScrSvrOld[worm filename]Added by the OPASERV WORM!
YScsiScsi.exeSCSI Miniport driver
Xscssrr.exeServices.exeAdded by the VB-EMX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%
Xsctrlmgrsescmgr.exeAdded by a variant of the DWNLDR-GAH TROJAN!
YSCTUINotifySCTUINotify.exePart of Windows SteadyState, which is designed to make life easier for people who set up and maintain shared computers - enabling the system administrator to prevent users from making changes to the system configuration, windows desktop, restricting program access, etc. It's intended for shared user environments such as internet cafés, libraries and schools but can be used in any environment. This entry displays the timeout messages on the restricted computer/account - which warns users how long they have until automatic log-off when they log-in and when there are only 2 minutes left
Xscvhostsvzhost.exeAdded by a variant of the SPYBOT WORM!
Uscvhostscvhost.exeWiretap surveillance software. Uninstall this software unless you put it there yourself
Xscvhostscvhost.exeAdded by the AGOBOT-LI WORM!
UscvhostOverSpy.exeOverSpy surveillance software. Uninstall this software unless you put it there yourself
Xscvhost loaderixplore.exeAdded by the SDBOT-CY TROJAN!
Xscvhost.exescvhost.exeAdded by the LOHAV-N TROJAN!
XScvsrv32scvsrv32.exeAdded by the AGOBOT-PM BACKDOOR!
Xsd32infosd32info.exeAdded by the CRYPTER.A TROJAN!
Page: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

The autorun list is presented in association with Sysinfo.org

Our Tip: Emsisoft Anti-Malware - Best In Test!

Emsisoft Anti-Malware is the best of 19 tested antivirus programs - Test by MRG - Malware Research Group - June 2009
Read more about the test winner