| Status | Autorun name | Command | Description |
| X | cfy | cfy.exe | Surfenhance.com SearchForIt adware variant |
| X | CGI Firewall Script | CGIAGENT.EXE | Added by the BROPIA-U WORM! |
| U | CGServer | cgserver.exe | Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs |
| X | Cgtask Services | cgtask.exe | Added by the LALA.B TROJAN! |
| X | Cgywin | cgywin32.exe | Added by the RBOT-AEI WORM! |
| U | ChamClock | ChamClock.exe | Chameleon Clock - system tray clock replacement |
| X | change-me-now | msgfix1.exe | Added by the SDBOT.ZD WORM! |
| U | ChangeICON | SPMSMON.EXE | Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem |
| ? | ChangeLines | chngline.exe | ?? |
| X | ChansonsMP3 | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| Y | Charter High-Speed Security Suite | fspex.exe | Charter High-Speed Security Suite - security software in collaboration with F-Secure |
| X | Chat login | chatlogin.exe | Added by the ANTINNY.F WORM! |
| N | Chatango | Chatango.exe | Chatango - "allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions, blogs, personal websites, Friendster profiles, and your visitors will be able to contact you instantly, without downloading anything, or registering. Alo use it to send email to your friends, allowing them to respond to you in real time!." The 'MessageCatcher' icon in the System Tray notifies you when you get a message. When you get a message, a little alert pops up, which you can click on and start chatting immediately |
| U | ChatStat | ChatStat.exe | ChatStat from ChatStat Technologies, Inc. Provides live chat assistance in up to 16 languages allows your operators to be more productive |
| N | Chcenter | chcenter.exe | IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" |
| X | Chckup | Netverchk.exe | Covert Sys Exec malware variant |
| X | chcp.exe | chcp.exe | Added by the SDBOT.BMH BACKDOOR! |
| X | che32 | che.ocx.vbs | Added by the ADENU-B VIRUS! |
| X | Cheatle | GigaByte.exe | Added by the SHODI.B VIRUS! |
| U | cheatmonitor | start.exe | CheatMonitor surveillance software. Uninstall this software unless you put it there yourself |
| X | Check | Check.exe | Added by the VB-DRN WORM! |
| N | Check for One Touch Update | wiseupdt.exe | Checks for updates for Visioneer OneTouch scanners |
| N | Check for TWS Updates | WiseUpdt.exe | Interactive Brokers - check for update to their standalone Java-based trading platform |
| U | Check Messenger | cmesseng.exe | Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness |
| U | Check&Get | Check&Get.exe | Check&Get from ActiveURLs. Manages your browser bookmarks and favorites. Monitors Web sites for changes and updates, captures and highlights the changed contents |
| N | CheckCustomWorksUpdate | CheckCWupdate.exe | Update checker, part of CustomWorks - "customize any embroidery designs to design your own unique creations" |
| U | CheckDialer | ChkDial.exe | Added by the CheckDialer modem connection monitoring tool |
| X | Checkdisk | mscas.exe | Added by the VAGON-A TROJAN! |
| X | CheckFaultKernel | mswdm.exe | Added by the SMALL-CSK TROJAN! |
| U | CheckIt | ToolBox.exe | CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parameters at intervals you specify |
| U | CheckIt 86 | CheckIt86.exe | CheckIt 86 popup blocker |
| Y | CheckMsgPlus | MsgPlusH.dll, VerifyInstallation | Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. |
| X | checkrun | elite***32.exe [* = random char] | EliteBar adware |
| X | checkrun | elitelsj32.exe | Added by the MULTIDR-ER TROJAN! |
| X | CheckScan32 | regload16.exe | Added by the AEBOT.K WORM! |
| ? | checktime | ct.exe | Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required? |
| Y | CheckVCR | IOMagic.exe | Driver for the I/OMagic Personal Video Recorder (DR-PCTV100) |
| X | CheckWinPerf | perfinfo.exe | Added by a variant of the IRCBOT TROJAN! |
| U | CherryKeyMan | KeyMan.exe | Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys |
| X | chiCkie | chiCkie.exe | Added by the CHIKO WORM! |
| U | ChicoSys | webtmr.exe | Child Control parental control software |
| U | ChikkaDefault | ChikkaLauncher.exe | Chikka PC text messanger and IM client |
| U | ChilyClient | ChilyClient.exe | Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself |
| X | china11msn | CHINA11MSN.EXE | Added by the ENVID.O WORM! |
| X | Chinagnq | vasdd.exe | Added by the SDBOT-SE WORM! |
| U | ChineseStar | cstar.exe | Chinese language support software |
| U | CHIPDRIVEPinManager | sokscmpn.exe | ChipDrive Smartcard software |
| U | CHIPDRIVESmartcardManager | SCMgr.exe | ChipDrive Smartcard software |
| X | CHK Disker | chkdsker.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | CHK NT | chkntf.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| N | ChkAdmin | CHKADMIN.EXE | Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" |
| X | ChkDisk | chk_disk.exe | Added by an unidentified WORM or TROJAN! |
| X | chkdrv | iemon.exe | Detected by Symantec as the ADCLICKER TROJAN! |
| X | chkdsk | autoexec.bat | Added by the ANPES WORM! |
| U | ChkMail | ChkMail.exe | Mail-checking utility supplied with some Acer and ASUS notebooks that uses an LED to notify the user when an E-mail has arrived |
| U | ChoiceMail | CHOICEMAIL.EXE | ChoiceMail from DigiPortal Software. Block spam with an Email firewall |
| X | Choke | Choke.exe -blahhh | Added by the CHOKE WORM! |
| X | chope | runlli32.exe | Added by the QQPASS-U TROJAN! |
| X | chostsv | chostsv.exe | Added by the BANPAES.C TROJAN! |
| U | CHotKey | mhotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| U | CHotKey | MK9805.EXE | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| U | CHotKey | zHotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol , vol-, mute, etc. Only required for extended features |
| N | Christmas Music Player | Christmas Music Player.exe | "Christmas Music Player brings the music of the Christmas Holiday to your desktop" |
| ? | ChromeMark | keysh.exe | Related to this. Don't know what keysh.exe does though and if it's required |
| ? | ChronitelInitTV | CHTVINIT.EXE | ?? |
| U | chrono | chrono.exe | Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)." Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over |
| X | Ci Servs | SysTuwin.exe | Added by the AGENT-NIQ TROJAN! |
| X | Ci Servs | oldbin.exe | Added by the DWNLDR-IOZ TROJAN! |
| X | Ci Servs | newbin.exe | Added by the RIMECUD-BC TROJAN! |
| X | Ci Servs | oldbi.exe | Added by the AUTORUN-BNA WORM! |
| X | Ci Servs | Sontiwin.exe | Added by the VB-PD MALWARE! |
| X | Ci Svr | cisvr.exe | Added by the IRCBOT.AWN BACKDOOR! |
| X | ci1gnt | ci1gnt.exe | Detected by Kaspersky as the AGENT.DHU TROJAN! |
| X | CiaBackdoor | msldr.com | Added by a VIRUS! |
| X | cihost.exe | cihost.exe | Added by the LINST TROJAN! |
| Y | CIJ2P2PSERVER | CIJ2P2PS.EXE | Compaq IJ200 printer utility which is required in order to make the printer work correctly |
| Y | CIJ3P2PSERVER | CIJ3P2PS.EXE | Compaq IJ300 printer utility which is required in order to make the printer work correctly |
| Y | CIJ7P2PSERVER | CIJ7P2PS.EXE | Compaq IJ700 printer utility which is required in order to make the printer work correctly |
| Y | CIJ9P2PSERVER | CIJ9P2PS.EXE | Compaq IJ900 printer utility which is required in order to make the printer work correctly |
| Y | Cingular Communication Manager | CingularCCM.exe | Cingular Communication Manager - now taken over by AT&T. "provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email, the Internet, business applications and corporate intranets, mobile users can be more productive while they're out of the office" |
| X | Cinnabd Prompt32 | CmdPrompt32.pif | Added by the ASSIRAL-B WORM! |
| N | CIO | che7e1~1.exe | ChatItOut webcam chat program |
| X | Ciodiag | DECCONF.EXE | Added by the STRAT.EL TROJAN! |
| X | CirebonPunya | XXrocks.exe | Added by the BHARAT.A WORM! |
| X | Cisco Systems | [path to worm] | Added by the AUTORUN.UHR WORM! |
| U | Cisco Systems VPN Client | ipsecdialer.exe | Cisco VPN Client - lets local users gain Administrator privileges on the operating system |
| U | Cisco Systems VPN Client | vpngui.exe | Sets up IPSec communications for Cisco's VPN Client |
| N | CISrvr Program | CISRVR.EXE | Related to internet setup on Compaq PC's |
| X | Cissi | Cissi.exe | Added by the CISSI.A WORM! |
| X | Cisvc | cisvc.exe /waitservice | Added by the HORST.Q TROJAN! Note - this is not the legitimate cisvc.exe which is always located in %System%. This one is located in either %Windir%, %Windir%\System, %Temp%, %AppData%, %AppData%\Microsoft or %System%\drivers |
| U | CitiUCS | CitiUCS.exe | Citibank Virtual Account Numbers - "With this free service for Citi cardmembers, you never have to give out your real credit card number online" |
| N | CitiVAN | CitiVAN.exe | Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again |
| X | Civa | Civa.exe | Added by the SDBOT.ARI WORM! |
| X | cjb | cjb.exe | Added by the AGENT.ALZE TROJAN! |
| X | cjb | cjb*.exe | Added by a variant of the AGENT.ALZE TROJAN - where * is a random digit and the file is located in %ProgramFiles%\cjb |
| X | CJET | CJet.exe | FFToolBar adware toolbar |
| Y | Cjstcom | Cjstcom.exe | Canon printer BJ status language monitor |
| U | CKA | CKA.exe | Part of Symantec's now discontinued Norton SystemWorks security and utility suite. Keeps a dial-up modem connection alive |
| Y | ClamWin | ClamTray.exe | ClamWin antivirus |
| U | class454~@# | class454.exe | XPSpy surveillance software. Uninstall this software unless you put it there yourself |
