| Status | Autorun name | Command | Description |
| U | eScan Scheduler | avkserv.exe | MicroWorld eScan antivirus scheduler |
| U | eScan Updater | Trayicos.exe | MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads |
| X | EScorcher | escorcher.exe | Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead |
| X | Esent Utl | esentutl.exe /waitservice | Added by the HORST.Q TROJAN! Note - this is not the legitimate esentutl.exe which is always located in %System%. This one is located in either %Windir%, %Windir%\System, %Temp%, %AppData%, %AppData%\Microsoft or %System%\drivers |
| X | Eservice | svchost.exe | Added by the MULAR.A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System\EService |
| N | ESFTP | esftp.exe | ESftp - FTP client for transfering files between a local PC and another remote computer |
| U | eSnips | ClientGW.exe | eSnips Client Gateway from eSnips |
| X | Esoh | Esoh123.exe | Added by the AGOBOT.FF WORM! |
| X | Especial | Deneca.bat | Added by the DELUZ VIRUS! |
| X | Esph | ortu.exe | PurityScan adware |
| N | ESPN BottomLine | bline.exe | ESPN BottomLine. "You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop, without even worrying about a browser. As long you keep the BottomLine running, you will continue to receive live scores and breaking news, and by clicking on any score or news item, you will be taken directly to the corresponding page on ESPN.com for a full break down." |
| ? | ESS Daemon | Essd.exe | Related to an ESS based soundacard. Is it required? |
| ? | essapm | essapm.exe | ESS Solo soundcard driver. Is it required? |
| Y | Essdc | essdc.exe | Related to an ESS Solo soundcard. Seems as though it's required |
| ? | ESSNDSYS | ESSNDSYS.EXE | Related to an ESS based soundacard. Is it required? |
| Y | ESSOLO | ESSOLO.exe | Sound card driver that re-instates itself every time it's removed |
| Y | esspk | esspk.exe | ESS Technology modem speaker driver file. Required to get on-line with this modem |
| U | EssSpkPhone | essspk.exe | ESS Technologies Call waiting, which gets installed by the drivers for V92 modems based on ESS Technologies chipsets |
| ? | eSupInit | eSupCmd.exe | Related to SupportSoft (aka Support.com) "Real-Time Service Management software". What does it do and is it required? |
| ? | eSupport | eSupCmd.exe | Related to SupportSoft (aka Support.com) "Real-Time Service Management software". What does it do and is it required? |
| X | Esutityde | osutityde.exe | Added by the SDBOT.BQD WORM! |
| X | ETB Tester | etbtest.exe | Added by the RBOT-ABR WORM! |
| X | etbrun | elit***32.exe [* = random char] | EliteBar adware |
| U | eTCertManger | eTCrtMng.exe | eToken Certificate Manager from Aladdin Knowledge Systems, Inc. A USB-based authentication, providing strong user authentication and password management solutions |
| X | ETD Security Scanner | ETDScanner.exe | ETD Security Scanner rogue security software - not recommended |
| U | ETDWare | ETDCtrl.exe | Elantech smart-pad touchpad driver for the Asus Eee PC range |
| X | eth0 driver | exec.exe | Added by the SPYBOT-Z WORM! |
| N | Ethernet | tcaudiag.exe | 3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs |
| X | ethernet | airftp.exe | Added by a variant of the SDBOT WORM! |
| X | ethernet | msnger.exe | Added by a variant of the SDBOT WORM! |
| X | ethernet | msftp.exe | Added by the SDBOT.BXJ WORM! |
| X | ethernet adapter | csrmss.exe | Added by a variant of the RBOT WORM! |
| X | Ethernet Driver | cmsrrs.exe | Added by a variant of the RBOT WORM! |
| X | Ethernet Drivers | smrrs.exe | Added by the RBOT-AAK WORM! |
| X | Ethernet Drivers | ethernet.exe | Added by the GAOBOT.CEZ WORM! |
| X | Ethernet Linking | ethernet.exe | Added by a variant of the IRCBOT TROJAN! |
| X | Etraffic | JavaRun.exe | TopMoxie adware |
| X | eTrust | RealTimeMon.exe | Added by the DELF-EPG TROJAN! |
| Y | eTrust EZ Firewall | efpeadm.exe | EZ Firewall - part of the eTrust range of security products formerly available from CA but now discontinued. Available as a stand-alone product or as part of the EZ Armor suite |
| Y | eTrust PestPatrol | PPActiveDetection.exe | Real-time protection for eTrust PestPatrol Anti-Spyware - which became CA Anti-Spyware and is now included in CA AntiVirus Plus |
| U | eTrust PestPatrol Active Protection | PPActiveDetection.exe | Real-time protection for eTrust PestPatrol Anti-Spyware - which became CA Anti-Spyware and is now included in CA AntiVirus Plus |
| X | eTrust Realtime Monitor | realmon.exe | Added by the LAZAR.B TROJAN! Note - this is not the legitimate CA eTrust Antivirus file of the same name which is located in %ProgramFiles%\CA\eTrust\Antivirus. This one is located in %System% |
| ? | eTrust VPN Manager | evpn.exe | Related to eTrust VPN - part of the eTrust range of security products formerly available from CA but now discontinued. What does it do and is it required? |
| Y | eTrustCIPE | ezdsmain.exe | EZ Deskshield - part of the eTrust EZ Armor security suite formerly available from CA but now discontinued. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior |
| Y | eTrustPPAP | PPActiveDetection.exe | Real-time protection for eTrust PestPatrol Anti-Spyware - which became CA Anti-Spyware and is now included in CA AntiVirus Plus |
| X | eTunnel | winfw.exe | Added by an unidentified TROJAN! |
| U | Eudora | Eudora.exe | Eudora from Qualcomm allows you to receive and send Internet e-mails |
| X | EUP Service | eupsvc.exe | Added by the DELBOT-Q WORM! |
| U | EuroGlot | EuroGlot.exe | Euroglot - "multilanguage translating system, available in the languages Dutch, English, French, German, Spanish and Italian" |
| ? | Event Log | eventlog.exe | ?? |
| N | Event Planner Reminders | PLNRNote.exe | Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner |
| N | Event Planner Reminders Tray Icon | PLNRnote.exe | Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner |
| N | Event Reminder | pmremind.exe | Event reminder for calendar dates, etc from Broderbund PrintMaster. Disable using the program's own option (if available) or a startup manager as it will re-instate if disabled via MSConfig |
| X | EventApplicationCmd | smschk.exe | Added by the IRCBOT-AO TROJAN! |
| U | EVENTLISTENER | EvLstnr.exe | Used with a Nikon digital camera to recognize when the camera is plugged in |
| N | eventmgr | eventmgr.exe | Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs |
| X | eventwvr | eventwvr.exe | Added by the COSIAM_G TROJAN! |
| ? | EverioService | EverioService.exe | Related to the Cyberlink software supplied with JVC's Everio camcorders. What does it do and is it required? |
| U | EVGAPrecision | EVGAPrecision.exe | EVGA Precision overclocking utility - "allows you to fine tune your EVGA graphics card for the maximum performance possible, with Core/Shader/Memory clock tuning, real time monitoring support including in-game, Logitech Keyboard LCD Display support, and compatibility with almost all EVGA graphics cards." Also works with many other brands of NVIDIA GeForce based graphics cards |
| U | Evidence Cleaner | ecleaner.exe | Evidence Cleaner cleans up tracks left by your PC and Internet activities |
| N | Evidence Eliminator | ee.exe | Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis |
| X | Evil | Evil.exe | Added by the MYTOB.JM WORM! |
| N | evntsvc | evntsc.exe | Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK |
| U | EVOLOSTA | EVOLOSTA.EXE | Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID, peer-to-peer mode channel, link speed, WEP encryption options, and has enable/disable and rescan buttons. It is not needed if using Windows XP or higher, as they have this built-in to the control panel. Also, if the user is very sure that there is ONLY ONE network available to connect to, then they can remove this. If it is not in startup, and the user needs to run it, they can simply type EVOLOSTA in the Start -> Run dialog to run it |
| U | Evoluent Mouse Manager | EvoMouExec.exe | Mouse manager for Evoluent VertcialMouse |
| X | EvtHtm | evthtm.exe | Added by the DLUCA-EJ TROJAN! |
| U | EvtMgr6 | Setpoint.exe | Logitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc). Required if you want to use the advanced features or modify the default settings of these devices and located in %ProgramFiles%\Logitech\Setpoint |
| U | EW Message Server | msg32.exe | Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices |
| N | eWare Startup | iWareStart.exe | eWare iWare task bar. Not required |
| Y | ewido | ewido.exe | System Tray access to and notifications for Ewido Anti-Spyware 4.0. Ewido is now part of AVG Technologies so this has been superseded by AVG Anti-Virus which includes Anti-Spyware |
| Y | ewido anti-spyware | ewido.exe | System Tray access to and notifications for Ewido Anti-Spyware 4.0. Ewido is now part of AVG Technologies so this has been superseded by AVG Anti-Virus which includes Anti-Spyware |
| X | ewrgetuj | geurge.exe | Added by the AUTOINF-AK WORM! |
| X | Ewth | tasn.exe | PurityScan adware |
| X | ewupdater | ewupdater.exe | EasyWebSearch adware updater |
| X | example | [random filename].exe | Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR |
| N | Excite Platform | Exlaunch.exe | Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer |
| ? | Excite Private Messenger Pipe | x8impipe.exe | ?? |
| N | ExciteAssistantEXE | ASSISTANT.EXE | With Excite Assistant, you can access a wide variety of online information, including email, news, and stock quotes without having to have a browser window open |
| X | exdl.exe | exdl.exe | BargainBuddy adware |
| X | exe lptt01 | exe.exe | RapidBlaster variant (in a "exe" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | exe ml097e | exe.exe | RapidBlaster variant (in a "exe" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | exe.exe | exe.exe | System Defragmenter rogue utility - not recommended, removal instructions here |
| X | exec | [path to trojan] | Added by the AGENT.AVEN TROJAN! |
| X | exec | services.exe | Added by the AGENT-ZJ MALWARE! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\fonts |
| X | execfg4 | execfg4.exe | Added by the ELECTRON WORM! |
| X | ExecUser | ExecUser.exe | Added by a variant of the RBOT WORM! |
| ? | Execute | delfolders.exe | ?? |
| X | ExeName32 | Warm.scr | Added by the SCOLD WORM! |
| X | ExFilter | Rundll32.exe cdnspie.dll,ExecFilter | CNNIC Update pest. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "cdnspie.dll" file is located in %ProgramFiles%\CNNIC\Cdn |
| ? | exgiwsl | exgiwsl.exe | ?? |
| U | Exif Launcher | Exiflaquickdcr.exe | USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly |
| U | Exif Launcher | QuickDCF.exe | USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly |
| U | ExitKiller | Ekiller.exe | Exit Killer - automatically closes pop-up windows in your browser |
| X | exkataj | cbkdkiw.exe | Added by the FANBOT-F WORM! |
| ? | exmon | hpimoniter.exe | Some kind of hp digital camera maybe or a photo smart connection probe? |
| X | Exn | exn.exe | Added by the IRCBOT.RJ WORM! |
| X | exo.exe | exo.exe | Added by the AGOBOT.ALD WORM! |
| X | exp1orer.exe | exp1orer.exe | Added by the DLOAD-FG TROJAN! Notice the digit "1" used in both the startup entry and filename, rather than a lower case "L" |
| X | Expatch | [random filename] | Added by the PWSLMIR-G TROJAN! |
| X | expcrt | [random filename] | Added by a variant of the SLAPER TROJAN! |
