| Status | Autorun name | Command | Description |
| U | X Server | X.exe | "XoftWare for Windows" enables you to run network-based UNIX programs ("X programs" or "clients") side-by-side with Windows applications on your personal computer. You can also share programs and computing resources with host computers connected to your PC over a network |
| U | X-Cleaner Deluxe | xcleaner.exe | X-Cleaner Deluxe - privacy and anti-spy application |
| U | X-Cleaner Freeware | XCLEAN~1.EXE | X-Cleaner Freeware - "cookie cleaning, Internet cache cleaning, scans for many popular spy software packages and performs permanent file shredding" |
| N | X-Grabber | sswizard.exe | ScreenShot Wizard |
| X | x[Number from 1 to 7] | x[Number from 1 to 7].exe | Added by the DADOBRA-A TROJAN! |
| X | x~{{dybel | x~{{dy8%nsn | Added by the AGOBOT.DQ WORM! |
| U | X1 | X1.exe | Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine |
| U | X1 System Tray | X1Systray.exe | Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine |
| U | X10 Device Network Service | x10nets.exe | Belongs to X10 video streaming device(s) |
| X | X10Weax | WTHRTRAY.EXE | WeatherCheck - "bring the latest local weather to your desktop". Not recommended as it reportedly pops ads, and contains no uninstaller |
| U | X1FileMonitor.exe | X1FileMonitor.exe | Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine |
| U | x3watch | x3watch.exe | "program helping with online integrity. Whenever you browse the internet and accesses a site which may contain questionable material, the program will save the site name on your computer. Approximately every 30 days, a person of your choice (an accountabiltiy partner) will receive an e-mail containing all possible questionable sites you may have visited within the month. This information is meant to encourage an open and honest conversation between friends and help us all be more accountable" |
| X | x3yy | [path to trojan] | Added by the TANNICK TROJAN! |
| U | X4ALLNL | wdfsctl.exe | XS4All Webdisk - web space management utility for the Dutch ISP |
| N | Xanadu | Xanadu.exe | Xanadu - free language and translation wizard from Foreignword |
| ? | XboxStat | XboxStat.exe | Xbox 360 related. What does it do and is it required? |
| ? | xBrotherMeCom | BrMeCom.exe | Related to Brother MFC-9200c printer. What does it do and is it required? |
| U | xbtl | bootldr.exe | Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | xcanxbwv | axcvqvzk.exe | Added by the RANDEX.AR WORM! |
| X | xccinit | rundll33.exe xccdf16_090131a.dll | Added by the BUZUS-AD TROJAN! Note - the "rundll33.exe" file is located in %System%\inf and the "xccdf16_090131a.dll" file is located in %Windir% |
| X | xccinit | rundll33.exe xccdf16_090305a.dll | Added by the BUZUS-AF TROJAN! Note - the "rundll33.exe" file is located in %System%\inf and the "xccdf16_090305a.dll" file is located in %Windir% |
| X | xcfdhtyjkx | keepSafe.exe | Added by the KILLAV.KAX TROJAN! |
| X | Xcpy1 | Xcpy1.exe | FlashEnhancer adware |
| X | xcxdsaa7 | slcskxsdl7.exe | Added by the ONLINEG-K TROJAN! |
| U | XDeskCal | XDeskCal.exe | "XDeskCal is a fully customizable Desktop calendar that will allows users to display 'to do' list, appointments,and holidays on the screen . It is a lightweight application that doesn't use much system resources or take much space on your desktop" |
| X | xDRam rar procx | xwinupdaterarx.exe | Added by the RILER-W TROJAN! |
| X | xdxqa | dewa.exe | Added by the SDBOT-YB WORM! |
| U | XE 8x LM Status | lmsxxe.exe | Xerox XE8 series laser printer status monitor |
| X | Xecuter.bat | psexec.bat | Added by the BOOHOO WORM! |
| U | XemiCo | ADC.EXE | XemiComputers Active Desktop Calendar |
| U | XemiComputers Scheduler | Scheduler.exe | Smooth Program Scheduler from XemiComputers "will start any program you want at a scheduled time" |
| X | xerox | Twain.exe | Added by the AGENT.CBLX TROJAN! |
| U | Xerox PanelMgr | SSMMgr.exe | Monitors ink levels, paper present and other parameters for some Xerox printers |
| ? | XeroxEndeavorBackgroundTask | xGKOHbgnd.exe | Associated with a Xerox multifunction and/or scanner. What does it do and is it required? |
| N | XeroxRegistation | EReg.exe | Registration reminder from Leader Technologies for software from Xerox |
| U | XeroxScannerDaemon | XrxFTPLt.exe | Xerox Scanner Daemon - driver for Xerox Scanner model fu621d |
| ? | XeroxScanUtility | xrxzipui.exe | Associated with a Xerox multifunction and/or scanner. What does it do and is it required? |
| U | XFilesDialog | XFilesDialog.EXE | "XFilesDialog is designed to improve all the (more or less standard) Windows file dialogs (Open / Load / Save)" |
| Y | XFILTER | xfilter.exe | Filseclab Personal Firewall Professional Edition |
| N | Xfire | Xfire.exe | Terratec DMXFire 1024 soundcard control panel |
| U | Xfire Music | xfiremusic.exe | XfirePlus Music plugin is a program written to display your currently playing music into your Xfire Status. Currently the program supports 10 different music players and is packed with features to make it work just for you |
| X | xflash | xflash.exe | Added by the BANCJ-A TROJAN! |
| X | xftpGraber | Xftpgraber.exe | Added by the ENVID.C WORM! |
| ? | XGIWatchDog | XWatDog.exe | Related to XGI Technology's Volari graphics cards - what does it do and is it required? |
| X | xhehjnnlqercber | regsvr32.exe [random name].dll | MxliveMedia adware. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System% |
| X | XHFHGEBDbadw | XHFHGEBDbadw.exe | Added by the AGENT-NHN TROJAN! |
| X | xhi | xhi.exe | Added by the SCLOG-A TROJAN! |
| X | xhrmy | Xhrmy.exe | HyperLinker adware |
| X | xibquxs | rnxntup.exe | Added by a variant of the ORCU.B TROJAN! |
| ? | xicon | xicon.exe | Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? |
| X | XiD | mmx.exe | Added by the ANALOGX TROJAN! |
| X | xInsIDE | xInsIDE.exe | Added by the ADLOAD.BH TROJAN! Note - this should not be confused with the valid IDE configuration utility from JMicron Technology which is normally located in %Windir%\RaidTool and uses the same filename. This one is located in %ProgramFiles%\xInsIDE |
| U | xInsIDE | xInsIDE.exe | JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool |
| Y | XircWinModem4 | ltcm000c.exe | WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information |
| U | xitami | Xiwin32.exe | Xitami Multiplatform Open Source web server |
| ? | xkstartup | RunDll32 InstZ82.dll, SetUsbPrinterPort | On a system with a Lexmark printer |
| X | xlb | xlb.cpl | Added by the BANCOS.VO TROJAN! |
| X | xln | xln.cpl | Added by the BANCOS.VO TROJAN! |
| X | xload | [path to trojan] | Added by the VB-AGP TROJAN! |
| X | xload32 | netdd.exe | Added by the NETSPY TROJAN! |
| X | xloadnet | xloadnet.exe | Added by the VB.NCK TROJAN! |
| X | xlr | xlr.exe | Added by the BANCOS.VO TROJAN! |
| X | xlr2 | xlr2.exe | Added by the BANCOS.VO TROJAN! |
| X | XML Service | msxml.exe | Added by the RBOT-HD WORM! |
| X | XMLmedia 10.0 | wmsdkns.exe | Added by the FAKEALERT TROJAN! |
| X | xmnfuruwk | rnxntup.exe | Added by the ORCU.B TROJAN! |
| X | xmstart | xuming.exe | Added by the GMIN-A WORM! |
| U | Xnet2 | xnet2.exe | Green Dam Youth Escort content control software. Internet filtering software that the Chinese government requires to be installed on all new computers sold in China after July 1, 2009. According to some reports this has now been either delayed or cancelled |
| X | XNSearchAssistant | SrchAsst.exe | iWon Search Assistant - spyware |
| Y | XoftSpy | XoftSpy.exe | XoftSpy antispyware software by Pareto Logic |
| X | xor | svchost.exe | Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a "xor" subfolder |
| X | xor | svshost.exe | Added by the AGENT.DC TROJAN! |
| X | Xordate | wuauclt10.exe | Added by the RBOT-GKN WORM! |
| X | Xordate | wuauclt11.exe | Added by the RBOT-GLI WORM! |
| X | Xordate | wuauclt12.exe | Added by the RBOT-GLQ WORM! |
| X | Xordate | wuauclt13.exe | Added by the RBOT-GLM WORM! |
| X | xp | winis.exe | Added by the RBOT-WO WORM! |
| X | Xp | p2pnetworking.exe | Added by the SDBOT.XA WORM! |
| X | XP Antispyware 2009 | XP_AntiSpyware.exe | XP AntiSpyware 2009 rogue spyware remover - not recommended, removal instructions here |
| X | XP Antivirus | xpantivirus.exe | XPAntivirus rogue security software - not recommended, removal instructions here |
| X | XP Antivirus | xpa.exe | XP Antivirus rogue security software - not recommended |
| X | XP Cleaner | xpc.exe | XP Cleaner rogue cleaning utility - not recommended, removal instructions here |
| X | XP HOT FIS | kbx.exe | Added by the FORBOT-GS WORM! |
| X | XP Loader | loaderxp.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | XP Protection Center | XPProtectionCenter.exe | XP Protection Center rogue security software - not recommended, removal instructions here |
| X | XP SecurityCenter | XPSecurityCenter.exe | XPSecurityCenter rogue security software - not recommended, removal instructions here |
| X | XP Service Pack | xpservicepack.exe | Added by the SDBOT.AQA WORM! |
| X | xp service pack 2 | xpsp2.exe | Added by the RBOT-KW WORM! |
| X | XP System | systemxp.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| U | XP Tools | xptools.exe | XPTools - "integrated suite of powerful PC Utilities to fix, speed up, maintain and protect your computer" |
| X | XP-078F2E4E | XP-078F2E4E.EXE | Added by the AUTORUN-SW WORM! |
| X | XP-C300C3AC | XP-C300C3AC.EXE | Added by the AUTORUN.EHW WORM! |
| X | xp_system | [filename] | Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004 |
| X | xp_system | winlogon.exe | Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe, which should not figure in Msconfig/Startup! |
| X | xp_system | services.exe | Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant, examples are 10066, 20001, 20088 |
| X | xp32win | xpupdater02.exe | Added by the MOSUCK-A TROJAN! |
| N | Xpadder | Xpadder.exe | "Xpadder simulates the keyboard and mouse using your gamepad" |
| ? | XPAgent | XPAgent.exe | Part of the IBM/XPoint Rapid Restore utility - normally located in %ProgramFiles%\XPOINT\AGENT folder. Appears as a service in XP/Vista and under the "RunServices" registry key in Win98. What does it do and is it required? |
| X | XPAgent | XPAgent.exe | Detected by Panda as the CLICKER.LE TROJAN! Do not confuse this with the IBM/XPoint Rapid Restore file which is normally located in %ProgramFiles%\XPOINT\AGENT folder. This one is found in %System% |
| X | XPAntivirus | XPAntivirus.exe | XPAntivirus rogue security software - not recommended, removal instructions here |
