| Status | Autorun name | Command | Description |
| X | clkhost | [path to trojan] | Added by the WIXUD-B TROJAN! |
| N | CLMemoSysTray | CLMemoSysTray.exe | System Tray access to YouMemo from CyberLink - which "is an extremely intuitive way to write notes and reminders in a fun and easy environment" and is "designed specifically as a multi-touch application supporting the latest touch hardware" |
| N | CLMemoSysTray Application | CLMemoSysTray.exe | System Tray access to YouMemo from CyberLink - which "is an extremely intuitive way to write notes and reminders in a fun and easy environment" and is "designed specifically as a multi-touch application supporting the latest touch hardware" |
| U | CLMFrontPanel | clmpanel.exe | System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost |
| U | CLMLServer | CLMLSvc.exe | CyberLink MediaLibrary Service - installed with Power2Go and PowerCinema from CyberLink and used to manage the media libraries, providing advanced file search, browsing and tracking. Also included with versions of PowerCinema bundled (and re-branded) with systems from Acer, Dell, ASUS and others. Some report it uses excessive system and memory resources |
| U | CLMLServer for HP TouchSmart | CLMLSvc.exe | CyberLink MediaLibrary Service - included with the version of CyberLink's PowerCinema installed on the HP Touchsmart range of desktops and notebooks and used to manage the media libraries, providing advanced file search, browsing and tracking. Some report it uses excessive system and memory resources |
| U | CLMLSvc | CLMLSvc.exe | CyberLink MediaLibrary Service - installed with Power2Go and PowerCinema from CyberLink and used to manage the media libraries, providing advanced file search, browsing and tracking. Also included with versions of PowerCinema bundled (and re-branded) with systems from Acer, Dell, ASUS and others. Some report it uses excessive system and memory resources |
| ? | clnwall | rundll.exe setupx.dll, InstallHinfSection ..delwall.inf | ?? |
| X | clock | [various filenames] | LiveChat Adware - known file names include: mssetup.exe, kstatus.exe, spoolsv.exe, sptsupd.exe, osk.exe, msswchx.exe, netdde.exe, msbkup.exe |
| X | Clock Manager | amsngr.exe | Added by the SDBOT-XM TROJAN! |
| X | ClockSync | Sync.exe | ClockSync - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available |
| U | ClockWise | CLOCKWISE.EXE | ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync |
| U | ClocX | ClocX.exe | ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms, etc |
| U | CloneCD | CloneCDTray.exe | System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | CloneCDElbyCDFL | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | CloneCDTray | CloneCDTray.exe | System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| ? | Clotusorgreg0 | prtStart.exe [path] Orgprt.exe | IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? |
| ? | CLPushUpdate | CLPushUpdate.exe | Part of the CyberLink Live remote media access service. It's exact purpose isn't know at present but it may be related to automatic updates |
| X | Clre | mmdc.exe | Added by the PURSCAN-AI TROJAN! |
| X | ClrSchLoader | [path to file] | ClearSearch adware |
| X | cls_pack.exe | cls_pack.exe | Added by the Malware Defense rogue security software. Also detected as the FAKEAV-AQB TROJAN! |
| X | CLSID | com.exe | Adult content dialler |
| X | CLSID | dll.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Adult content dialler |
| X | CLSID | plugin.exe | Adult content dialler |
| X | CLSID | sed.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension |
| X | CLSRSS | LSACS.EXE | Added by the SILLYFDC-X WORM! |
| U | Club-Internet_McciTrayApp | McciTrayApp.exe | System tray access to Motive's broadband configuration and repair utility - for Club-Internet users |
| U | ClUpdate | ClUpdate.exe | Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys |
| ? | CM-SmWizard | SmWizard.exe | SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? |
| U | cma | cma.exe | DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" |
| X | CMAPP | cmappclient.exe | CasClient adware - also detected as the CMAPP TROJAN! |
| N | Cmaudio | Rundll32 cmicnfg.cpl, CMICtrlWnd | System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel |
| X | Cmd | cmd32.exe | Added by the TANKED WORM! |
| X | cmd32 | configs.exe | Hijacker, also detected as the QURL-2 TROJAN! |
| X | cmd64 | cmd64.exe | CoolWebSearch Msconfd parasite variant |
| X | cmdbcs | cmdbcs.exe | Added by the LINEAG-GKW TROJAN! |
| X | cmdcon | cmdcon.exe | Added by the CRYPTER.A TROJAN! |
| X | cmds | vtsqn.dll | Added by a variant of the VUNDO TROJAN! |
| X | CmdShell.exe | CmdShell.exe | Added by the BCKDR-QHY BACKDOOR! |
| X | CME | cme.exe | Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | CmeSYS | CMEsys.exe | Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | CmeUPD | CMEupd.exe | Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | CMFibula | CMFibula.exe | CASClient adware |
| N | CmFlywaveName | CmFlywav.exe | Driver for Linksys Wireless-G Music Bridge |
| U | CMGrdian | CMGrdian.exe | McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security, Browser Buddy, File Guardian and help. Included with older versions of McAfee Internet Security and possibly others |
| U | CMGShieldUI | CMGShieldUI.exe | UI for CMG (CREDANT Mobile Guardian) Shield from Credant Technologies. "The CMG Shield resides on devices and external media to enforce security policies even if the device is disconnected from the network." Used to protect sensitive corporate on laptops, handhelds, smartphones, USB drives and CD-DVDs |
| X | CMMan | CMMan.exe | Added by the CMAPP TROJAN! |
| X | Cmmon32Sys | cmmon32.exe | Added by the SMALL.CL TROJAN! |
| X | cmonitor | startupmon.exe | SystemDoctor rogue security software - not recommended, removal instructions here |
| X | cmonitor | pasmon.exe | SystemDoctor rogue security software - not recommended, removal instructions here |
| U | CmPCIaudio | RunDll32 CMICNFG3.CPL, CMICtrlWnd | Registers the Control Panel applet for a C-Media PCI sound card |
| U | CMPDPSRV | CMPDPSRV.EXE | Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more". Installed with some Compaq and Lexmark printers |
| X | Cmpnt | Devices2.exe | Added by the TOMPAI-D TROJAN! |
| X | Cmpnt | mainsv.exe | Added by the TOMPAI-C TROJAN! |
| X | cmrsf | cmrsf.exe | Added by the DELF-HU TROJAN! |
| X | cmrss | cmrss.exe | Added by the DELF.DU TROJAN! |
| X | cmrss | crmss.exe | Added by the DLOADER-EK TROJAN! |
| X | cmrss | [path to trojan] | Added by the DLOADER-QQ TROJAN! |
| X | cmrst | cmrst.exe | Added by the BANCOS.S TROJAN! |
| X | cmrst | cmrst.scr | Added by the DLOADER-FP TROJAN! |
| X | cms | iserver.exe | Added by the DLOADER-WK TROJAN! |
| X | CMSally | callmesally.exe | Added by the CASAL.A TROJAN! |
| U | CMSETTINGS | ctmn.exe | Part of NetNanny Chat Monitor |
| X | cmsound | vcpdll.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmsound | vcsystem.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmss | system.exe | Added by a variant of the RBOT WORM! |
| X | cmssapp | iexplore_.exe | Added by the BANCBAN-CQ TROJAN! |
| X | cmssapp | iexplore.exe | Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | cmssSystemProcess | csmss.exe | Added by the AGENT-CO TROJAN! |
| X | cmssSystemProcess | mcsmss.exe | Added by the PROXYSER-F TROJAN! |
| X | cmssSystemProcess | csms.exe | Added by the AGENT-Y TROJAN! |
| X | CmSTP | cmstp.exe /waitservice | Added by the HORST.Q TROJAN! Note - this is not the legitimate cmstp.exe which is always located in %System%. This one is located in either %Windir%, %Windir%\System, %Temp%, %AppData%, %AppData%\Microsoft or %System%\drivers |
| X | CMSystem | CMSystem.exe | CASClient adware |
| X | cmt101 | cmt101.exe | Added by a variant of the CRYPTER.C TROJAN! |
| ? | CmUCRRun | CmUCReye.exe | Related to Medion Display Information. What does it do and is it required? |
| X | cmutil | cmutil.exe | Added by the AGENT-DFN TROJAN! |
| U | CMWorkstation | cmwkse.exe | Cyber Monitor 2004 by Enter - "professional billing, monitoring and management system for Internet cafes, libraries, schools, hotels and other institutions that provide computers for public use" |
| X | cmx32 | cmx32.exe | Added by the GEMA.D TROJAN! |
| X | Cn323 | cnfrm33.exe | Added by the MIMAIL.G WORM! |
| X | Cn911 | ODBCJET.exe | Added by the BIFROSE-PR TROJAN! |
| X | CNBABE | CNBABE.EXE | Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing |
| N | cnet | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| Y | cnfgCav | CMain.exe | Part of Comodo Antivirus |
| X | Cnfrm32 | cnfrm.exe | Added by the MIMAIL.D WORM! |
| X | CnsMax | Internat.exe | Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir% |
| X | CnsMin | Rundll32.exe [path] CNSMIN.DLL, Rundll32 | CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| Y | CnwiDeviceAgent | cnwida.exe | Part of the Canon imagePROGRAF W8400 printer management software |
| Y | CnxAdslL | CnxAdslL.exe | DLink, Zoom, or Conexant modem driver |
| X | cnxdmqje | ehalxqqtssd.exe | Added by the AGENT-OEC TROJAN! |
| N | CnxDslTaskBar | CnxDslTb.exe | Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems |
| U | CobBU | CobBU.exe | Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
| U | Cobian | Cobian.exe | Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
| U | Cobian Backup | cbInterface.exe | System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required |
| U | Cobian Backup | CobBU.exe | Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
| U | Cobian Backup 10 | Cobian.exe | Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
| U | Cobian Backup 10 Interface | cbInterface.exe | System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required |
| U | Cobian Backup 6 | CobBU.exe | Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
| U | Cobian Backup 7 | CobBU.exe | Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required |
