| Status | Autorun name | Command | Description |
| N | Windows Media Center | RunDLL32.exe ehuihlp.dll,BootMediaCenter | Starts Windows Media Center every time Vista (Home Premium or Ultimate) or Windows 7 (Home Premium, Professional or Ultimate) boots. Disable by unchecking the "Start Windows Media Center when Windows Starts" option via Windows Media Center → Tasks → Settings → General → Startup and Window Behaviour |
| X | Windows Media Center | smss.exe | Added by the WARBOT TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| N | Windows Media Connect 2 | WMCCFG.exe | Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network |
| X | Windows Media Driver | msnger.exe | Added by a variant of the RBOT WORM! |
| X | Windows Media Loader | wmloader.exe | Added by a variant of the GAOBOT WORM! |
| X | Windows Media Player | mcafe32.exe | Added by the RBOT-YO WORM! |
| X | Windows Media Player | wmplayer.exe | Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player |
| X | Windows Media Player | 50cent.exe | Added by a variant of the RBOT WORM! |
| X | Windows Media Player | mpwe.exe | Added by the RBOT-TT WORM! |
| X | Windows Media Player | msams.exe | Added by the RBOT.AHR WORM! |
| X | Windows Media Player | vmmreg32.exe | Added by the AGENT.AQO TROJAN! |
| X | Windows Media Player | msass43.exe | Added by the RBOT-RT WORM! |
| X | Windows Media Player | mpupdata.exe | Added by the SDBOT.BBG WORM! |
| X | Windows Media Player | wmplayerc.exe | Added by the SILLYFDC.DBG WORM! |
| X | Windows Media Player | mcafeee.exe | Added by the RBOT-SQ WORM! |
| X | Windows Media Player | wmediaplayer.exe | Added by the AGOBOT-NQ WORM! |
| X | Windows Media Player | MediaPIayer.exe | Added by the SDBOT-QO TROJAN! Note - the lower case "l" in "MediapIayer" is a capital "i" |
| X | Windows Media Player | [random filename] | Added by a variant of the RBOT WORM! |
| X | Windows Media Player | msa.exe | Added by the RBOT-SI WORM! |
| X | Windows Media Player 3.6 | wmpa36.exe | Added by a variant of the RBOT WORM! |
| X | Windows Media Player 3.6b | WMPA36B.EXE | Added by the RBOT-VV WORM! |
| X | Windows Media Player 3.6d | wmpa36d.exe | Added by the RBOT-YA WORM! |
| X | Windows Media Player 3.9 | wmpa36.exe | Added by a variant of the RBOT WORM! |
| X | Windows Media Player 6.1.2 | wmplayer612.exe | Added by the RBOT.AIB BACKDOOR! |
| X | Windows Media Player Service | wmedia.exe | Added by the RBOT.213504 WORM! |
| X | Windows Media Player Update | [random filename] | Added by the RBOT-ET WORM! |
| N | Windows Media Powerpoint Helper | NSPPTHLP.EXE | German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs |
| X | Windows Media Server | wmserv.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows Media Server! | wmserver.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows media service | crvss.exe | Added by the SDBOT.VP WORM! |
| X | Windows media service | crsss.exe | Added by the RBOT.ACY WORM! |
| X | Windows media service | Sygate32.exe | Added by the RBOT.ADE WORM! |
| X | Windows media services | cvrsss.exe | Added by the RBOT-MW WORM! |
| X | Windows Media SP.2.37 | [random filename] | Added by the LEMIR.C TROJAN! |
| X | Windows Media Updater | crease.exe | Added by the RBOT-ATI WORM! |
| X | Windows Media Upgrade | NeUpgrade.exe | Added by the RBOT.BMF TROJAN! |
| X | Windows Media Utility | wmediautil.exe | Added by a variant of the SPYBOT WORM! |
| X | Windows Memory Drivers | memretain.exe | Added by a variant of the IRCBOT TROJAN! |
| X | Windows Memory Manager | windowsmem.exe | Added by a variant of the IRCBOT TROJAN! See here |
| X | Windows Memory Running Services | memrun.exe | Added by the IRCBOT.BLL BACKDOOR! |
| X | Windows Memory Sharing | memoryshr.exe | Added by a variant of the IRCBOT TROJAN! |
| X | Windows Memory Sharing | memshare.exe | Added by the IRCBRUTE.AG TROJAN! |
| X | Windows Memory Sharing | memshr.exe | Added by the IRCBOT.MC BACKDOOR! |
| X | Windows Messaging System | [trojan filename].exe | Added by the THROD.A TROJAN! The filename is a random combination the following: ms, svc, win, 16, 32, 64, mes, prn, reg - "ms16prn.exe", for example - and is located in %System% |
| X | Windows Messanger Control Center | svchosl.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows Messanger Control Center | svhost.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows Messanger Control Center | winlogin.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows Messanger Control Center | winlogon.exe | Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | Windows Messanger Control Center | winsys.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Windows Messanger Controls Center | wind.exe | Added by the POISON.FN BACKDOOR! |
| X | Windows messenger | messengers.exe | Added by the MYTOB.EI WORM! |
| X | Windows Messenger | msnsmgs.exe | Added by the RBOT-ANJ WORM! |
| X | Windows Messenger | msnmsg.exe | Added by the SPYBOT.BV WORM! |
| X | Windows Messenger 4.14 | landisc.exe | Added by the SDBOT-KR WORM! |
| X | Windows Messenger Connect | wmdsvc.exe | Added by the SLENFBOT.S WORM! |
| X | Windows Messenger Fileshare | wivsvc.exe | Added by the SILLYIM WORM! |
| X | Windows Messenger Live MSN | winlivemsnmessenger.exe | Added by a variant of the IRCBOT BACKDOOR! |
| X | Windows Messenger Live Startup | windowslivemsn.exe | Added by an unidentified WORM or TROJAN! See here |
| X | Windows Messenger Live Startup | windowsmsnlive.exe | Added by the DELF.DAX TROJAN! |
| X | Windows Messenger Messenger | winmsg.exe | Added by the VELKBOT.A WORM! |
| X | Windows Messenger Panel | wbcsvc.exe | Added by the IRCBOT.ADA BACKDOOR! |
| X | Windows Messenger Service | winsmsgr.exe | Added by the RBOT-VW WORM! |
| X | Windows Messenger Service | kaspersky.exe | Added by the MYTOB.HY WORM! |
| X | Windows Messenger Share | wmssvc.exe | Added by a variant of the IRCBOT TROJAN! See here |
| X | Windows Messenger Starter | wmvsvc.exe | Added by the DELF.DAX TROJAN! |
| X | windows messengers | hkcmds.exe | Added by the AGENT-CRZ TROJAN! |
| X | Windows MeTaLRoCk service | metalrock.exe | Added by the TASTYRED TROJAN! |
| X | Windows Micro Drivers | wupdates32.exe | Added by the RBOT-AEH WORM! |
| X | Windows Microsoft Service | [random filename] | Added by the AGENT-HCD TROJAN! |
| X | Windows Microsoft Service | jsopfuud.exe | Added by the AGENT-HCD TROJAN! |
| X | Windows Microsoft Services | [8 random letters].exe | Added by the KOLAB.AW WORM! |
| X | Windows Microsoft Update | wintask32.exe | Added by a variant of the SDBOT WORM! |
| X | Windows Microsoft Verifier | winauth23.exe | Added by a variant of the RBOT WORM! |
| U | Windows Mobile Device Center | wmdc.exe | Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista, supporting mobile devices based upon Windows Mobile 2003 or later. This is the registry entry for version 6.1 |
| U | Windows Mobile-based device management | wmdSync.exe | Part of Windows Mobile Device Center in Vista. Microsoft Windows Mobile Device Center enables you to set up new partnerships, synchronize content and manage music, pictures and video with Windows Mobile powered devices (Windows Mobile 2003 or later) |
| U | Windows Mobile-based device management | wmdc.exe | Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista, supporting mobile devices based upon Windows Mobile 2003 or later. This is the registry entry for version 6.0 |
| X | Windows mod Verifier | Windows-mod.exe | Added by the RBOT.DSU WORM! |
| X | Windows modez Verifier | winlogom.exe | Added by a variant of the RBOT WORM! |
| X | Windows modez Verifier | Windows-.exe | Added by the RBOT-DIO WORM! |
| X | Windows modez Verifier | taskmngr.exe | Added by a variant of the RBOT WORM! |
| X | Windows modez Verifier | winl0g0z.exe | Added by the RBOT-FNB WORM! |
| X | Windows modez Verifier | wuamguard.exe | Added by the RBOT.EZJ BACKDOOR! |
| X | Windows modez Verifier | w1nz0zz0.exe | Added by a variant of the SDBOT WORM! |
| X | Windows modez Verifier | Window2.exe | Added by a variant of the RBOT WORM! |
| X | Windows modez Verifier | WindowsLogon.exe | Added by a variant of the SDBOT WORM! |
| X | Windows modez Verifier | Wwuamguard.exe | Added by the RBOT.EZJ BACKDOOR! |
| X | Windows Monitor | winmon.exe | Added by the SDBOT.VB WORM! |
| X | Windows Monitor | arsetup.exe | Added by the SPAZBOX.A TROJAN! |
| X | Windows Monitor Services | winmonitor.exe | Added by the RBOT-XX WORM! |
| X | Windows Monitoring Service | winmon.exe | Added by a variant of the SDBOT WORM! |
| X | Windows More Choice | TopContext.exe | ZQuest adware |
| X | Windows Mouse Services | winmouse.exe | Added by the IRCBOT.AGA BACKDOOR! |
| X | Windows Mouse Services | winmouse64.exe | Added by the IRCBOT.AIA BACKDOOR! |
| X | Windows Mouse Utilities | mouseutils.exe | Added by the RBOT-ABU WORM! |
| X | Windows mplayercodex Services | MSPF.EXE | Added by a variant of the SDBOT WORM! This file is located in %System% |
| X | Windows ms Drivers | msnup32.exe | Added by the SDBOT-AAL WORM! |
| X | Windows MS Update 32 | fhm.exe | Added by the IRCBOT.GEN WORM! |
| X | Windows MS Update 32 | sucker.exe | Added by the FORBOT-GJ WORM! |
| X | Windows MS Update 32 | jebote.exe | Added by the FORBOT-GK WORM! |
| X | Windows MSConfig Startup Logger | winlog.exe | Added by the RBOT.BCU WORM! |
