| Status | Autorun name | Command | Description |
| X | Spooler SubSystem Application | tcpsvc.exe | Added by the DLOADER-NY TROJAN! |
| X | Spooler SubSystem Application | websvc.exe | Added by the DLOADER-NY TROJAN! |
| X | Spooler Subsystem Application | smss.exe | Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup! |
| X | Spooler Subsytem App | spoolsvc.exe | Added by the SDBOT-MM WORM! |
| X | SpoolerSubSystemProcess | SpooI32.exe | Added by the EHKS.21 keylogger! Note - the "I" between "o" and "3" is a capital "i" not a lower case "L" |
| X | spoolms | spoolms.exe | Added by the LEGMIR-ARO TROJAN! |
| X | Spools Service Controller | spools.exe | Added by the KASSBOT-C WORM! |
| X | spoolserv | spoolserv.exe | Added by the SDBOT-PN WORM! |
| X | SpoolService | spolsv.exe | Added by the AGOBOT-CS WORM! |
| X | spoolsrv.exe | spoolsrv.exe | Added by an unidentified WORM or TROJAN! Located in %System% |
| X | Spoolsv | spoolsv.exe | Added by the ANTINNY.F WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Program Files%\Lotus |
| X | Spoolsv | Spoolsv.exe | Added by the CIADOOR.121 VIRUS! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir% |
| X | spoolsv | scvhosts.exe | Added by the SMALL-AW TROJAN! |
| X | spoolsv | svchost.exe | Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP |
| X | spoolsv | spoclsv.exe | Added by the FUJACKS-M WORM! |
| X | spoolsv | spoolsv.exe | Added by the ZAPCHAS-EE TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%\Temp\spoolsv |
| X | spoolsv | spoolvs.exe | Added by the AGENT-HNV TROJAN! |
| X | spoolsv | spoolsv.exe | Added by the ANTINNY-BH WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\Messenger |
| X | spoolsv | spoolsv.exe | Added by the OURXIN.C TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in a "spoolsv" subfolder |
| X | spoolsv manager | SpoolMgr.exe | Added by the ASSIRAL WORM! |
| X | spoolsv service | spoolsv32.exe | Added by the RBOT-AHP WORM! |
| X | spoolsv.exe | [random filename] | Added by the RBOT-JB WORM! |
| X | SPOOLSV32 | SPOOLSV32.EXE | Added by the CWS-I or HAZIF-B TROJANS! |
| X | SPOOLSV32.exe | SPOOLSV32.exe | Added by the STARTPAGE.O TROJAN! |
| X | spoolsvc | spoolsvc.exe | Added by the DROPPER-AT TROJAN! |
| X | spoolsvr | SPOOLSVR.EXE | Added by the RAYROB.A TROJAN! |
| X | spoolsvr32 | csmss.exe | Added by the AGENT-AU TROJAN! |
| X | spoolsvr32 | csmss32.exe | Added by the AGENT-AU TROJAN! |
| X | spoolsvs | wintre.exe | Added by the SDBOT.EGQ WORM! |
| X | spoolsvs | wincfy.exe | Added by a variant of the IRCBOT BACKDOOR! |
| X | spoolsvs.exe | spoolsvs.exe | Added by the DLOADER-RK TROJAN! |
| X | SPOOLSVU | SPOOLSVU.EXE | Added by the STARTPAGE.K hijacker |
| X | spoolsvv | spoolsvv.exe | Searchcentrix hijacker |
| X | Spoolvs | spoolvs.exe | Added by the SDBOT.AUS WORM! |
| X | Spore | MsNews.vbs | Added by the SORPE.A WORM! |
| X | Spore.b | Scmhlpr.vbs | Added by the SORPE.B WORM! |
| ? | SPP | run.exe | ?? |
| X | spp | regedit -s spp.reg | IE search hijacker - changes the default search to h**p://www.hotsearchbox.com/ie/. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file "spp.reg" is located in the root folder (ie, C:\) |
| ? | sppbridge | sppbridge.exe | Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? |
| U | Sprint DSL virtual assistant | matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". Sprint DSL Virtual Assistant is required to run with the Help and Support program. If you uncheck Sprint DSL Airtual Assistant and then run Help and Support it will add another Sprint DSL Virtual Assistant in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide |
| U | Sprint SmartView | SprintSV.exe | Sprint SmartView wireless connectivity manager which supports cards from multiple manufacturers including Intel, Netgear, D-Link and others |
| ? | SprintPort | SprintPortA.exe | Novatel wireless modem related. What does it do and is it required? |
| U | SpriteService | SpriteService.exe | Sprite Backup is a backup application for Windows Mobile Pocket PC or Smartphone |
| X | Sproc32 | sproc32.exe | Added by the RIGHTU-A TROJAN! |
| X | sprof | sprof.exe | Added by the RENOS.G TROJAN! |
| U | sprtcmd | sprtcmd.exe | Self-help support tool for a number of high-speed internet providers and computer suppliers such as Comcast, Qwest and Dell. Identifies and automatically fixes typical problems that may occur with your high-speed internet service. Provided by SupportSoft, Inc |
| X | Spruce - Auto Update | Spruce.exe | Rabio "Search Enhancer" adware variant |
| U | SPSTEALT | SmartProtectorPro.exe | Smart Protector Pro - internet privacy tool that erases tracks, MRU lists, etc |
| U | SPSTEALT | SmartProtector-Pro.exe | Smart Protector Pro internet eraser from SmartSoft - "keeps out prying eyes and protects your private data on all Windows systems" |
| U | spstore | storesp.exe | Softprobe by Module Computer Engineering Ltd - "is designed to provide a visually pleasing analysis, which displays the activity performed on computers by individual computer-users" |
| X | spsvc | spsvc.exe | Spagent spyware |
| U | Spy Blocker | spyblocker.exe | SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using a spyware removal tool that some applications containing spyware subsystems may not run correctly or at all. No longer available |
| U | Spy Protector | SpyProtector.exe | Included in the full version of Security Task Manager, Spy Protector prevents keyboard and mouse monitoring, warns when the registry is changed and eliminates internet activity and work traces |
| X | Spy Protector | srcss.exe | SpyProtector rogue security suite - not recommended, removal instructions here |
| X | Spy Protector | lsascs.exe | Spy Protector rogue security software - not recommended, removal instructions here |
| X | Spy-Control | Spy-Control.exe | Spy-Control spyware remover - not recommended, see here |
| U | Spy-Keylogger | skl.exe | SpyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | SPY_NET_RAT | SPY_NET_RAT.exe | Added by a variant of the AGENT-LRO TROJAN! |
| X | SpyAway | spyaway.exe | SpyAway rogue spyware remover - not recommended |
| X | SpyAxe | spyaxe.exe | SpyAxe rogue spyware remover - not recommended |
| X | SpyBan | SpyBan.exe | SpyBan rogue spyware remover - not recommended, removal instructions here |
| X | SpyBlast | SpyBlast.exe | Spyware killer that is in effect autoinstalled foistware, targeted by SpyBot, among others |
| U | SpyBlocker | spyblocker.exe | SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using a spyware removal tool that some applications containing spyware subsystems may not run correctly or at all. No longer available |
| X | SpyBlocs | SpyBlocs.exe | SpyBlocs rogue spyware remover - not recommended |
| X | SpyBlocs | GLF*.exe [* = random chars] | SpyBlocs rogue spyware remover - not recommended, removal instructions here |
| X | SpyBlocs3.0 | SpyBlocs3.0.exe | SpyBlocs rogue spyware remover - not recommended |
| Y | Spybot - Search & Destroy | TeaTimer.exe | Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. "Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future". Also provides System Tray access to Spybot S&D and detects when processes want to change critical registry settings such as the startup entries - giving the user the option to allow/deny the change |
| U | Spybot-S&D | SpybotSD.exe | Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck, autofix and autoclose |
| Y | SpybotDeleting***** | [cmd or command] /c del [path] [filename] | Generated by Spybot Search & Destroy if it encounters files that cannot be deleted during runtime because they are locked by other processes. For example, C:\WINDOWS\SchedLgU.Txt is the scheduler log file and is locked by Windows as long as it runs. For operating system compatibility reasons the autorun entries are generated with cmd and command. These entries should be left alone and will be removed on the next reboot/login. **** represents a combination of a single letter and up to 4 numbers |
| U | SpybotSD | SpybotSD.exe | Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck, autofix and autoclose |
| Y | SpybotSD TeaTimer | TeaTimer.exe | Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. "Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future". Also provides System Tray access to Spybot S&D and detects when processes want to change critical registry settings such as the startup entries - giving the user the option to allow/deny the change |
| U | SpybotSnD | SpybotSD.exe | Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck, autofix and autoclose |
| X | Spybott lptt01 | spybott.exe | RapidBlaster variant (in a "spybott" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | Spybott ml097e | spybott.exe | RapidBlaster variant (in a "spybott" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | SpyBrowser | SpyBro.exe | Spionfrei/SpyBro rogue spyware remover - not recommended, removal instructions here |
| X | SpyBurner | SpyBurner.exe | SpyBurner rogue spyware remover - not recommended, removal instructions here |
| X | SpyClean | 1ClickSpyClean.exe | 1 Click Spy Clean uses a database that was stolen from SpybotS&D. Not recommended, see here |
| X | SpyClean | SpyClean.exe | SpyClean rogue spyware remover - not recommended |
| U | SpyClock 4 Personal | spycl4.exe | SpyClock surveillance software. Uninstall this software unless you put it there yourself |
| U | SpyCop ScanCheck | MAIN.EXE | SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan |
| X | SpyCrush | SpyCrush.exe | SpyCrush rogue spyware remover - not recommended, removal instructions here |
| X | SpyCrush 3.1 | SpyCrush 3.1.exe | SpyCrush rogue spyware remover - not recommended, removal instructions here |
| X | SpyCrush 3.2 | SpyCrush 3.2.exe | SpyCrush rogue spyware remover - not recommended, removal instructions here |
| X | SpyCrush 3.3 | SpyCrush 3.3.exe | SpyCrush rogue spyware remover - not recommended, removal instructions here |
| X | SpyCut | SpyCut.exe | SpyCut rogue spyware remover - not recommended |
| X | SpyCut Monitor | spycut_monitor.exe | SpyCut rogue spyware remover - not recommended |
| X | SpyDawn | SpyDawn.exe | SpyDawn rogue spyware remover - not recommended, removal instructions here |
| X | SpyDevastator | SpyDevastator.exe | SpyDevastator rogue security software - not recommended, removal instructions here |
| U | SpyEmergency | SpyEmergency.exe | SpyEmergency security software from Netgate |
| Y | SpyEraser | SpyEraser.exe | SpyEraser spyware remover from Uniblue Systems Limited - now discontinued. Provides System Tray access and also required for the real-time Live Guard feature to work to monitor and check for BHOs, toolbars, search hooks, etc |
| X | SpyEx | Winllogo.exe | Added by the PRSKEY-A WORM! |
| X | SpyFalcon | SpyFalcon.exe | SpyFalcon rogue spyware remover - not recommended |
| X | SpyFighter | SpyFighter.exe | SpyFighter rogue spyware remover - not recommended, removal instructions here |
| X | SpyFighterMonitor | SpyFighter.exe | SpyFighter rogue spyware remover - not recommended, removal instructions here |
| X | SpyFighterUpdate | AutoUpdate.exe | SpyFighter rogue spyware remover - not recommended, removal instructions here |
| X | SpyGuarder | spyguarder.exe | SpyGuarder rogue security software - not recommended, removal instructions here |
| X | SpyGuardPro | pgs.exe | SpyGuardPro rogue security software - not recommended. A member of the AVSystemCare family |
| X | SpyHazard | SpyHazard.exe | SpyHazard rogue spyware remover - not recommended, removal instructions here |
| X | SpyHealer | SpyHealer.exe | SpyHeal rogue spyware remover - not recommended |
| X | SpyHeals | SpyHeals.exe | SpyHeals rogue security software - not recommended |
