| Status | Autorun name | Command | Description |
| X | fool | fool.exe | Added by the SILLYFDC.BCV WORM! |
| Y | FoolProof | fpwinldr.exe | FoolProof Security PC security software from SmartStuff |
| Y | FoolProofSweep | ?? | Part of FoolProof Security PC security software from SmartStuff |
| N | Forbes | ForbesAlerts.exe | Forbes Business News Alerts - displays business news headlines in a little window on the screen |
| X | ForceShow | rundll32.exe QaBar.dll,ForceShowBar | AdultLinks.QBar parasite related! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "QaBar.dll" file is found in %System% |
| N | Forget Me Not | AGRemind.exe | Calendar reminder part of Broderbund's American Greetings® CreataCard® |
| U | forteManager | dthtml.exe | forteManager from LG. Rebranded version of Display Tune from Portrait Displays, Inc. - which "is the perfect software utility to initially set-up and adjust your display to achieve its optimum performance. All adjustments are made through a simple graphical user interface" |
| Y | FortiClient | FortiClient.exe | Fortinet security systems are the new generation of real time network protection systems |
| U | Fortis Secure Layer Config | cseinst.exe | Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information |
| X | fotos | fotos.exe | Added by the BANKER-FP TROJAN! |
| N | FotoStation Easy AutoLaunch | FotoStation Easy AutoLaunch.exe | Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either |
| U | Foul PX | FoulPX.exe | Foul PX, Optusnet usage stat checker |
| U | FourthDay | FourthDay.exe | The Fourth Day - "astronomical clock and almanac for your system tray" |
| X | FoWilCo | fowilco.exe | Added by the WOOTBOT.CR WORM! |
| X | foxdh | foxdhend.exe | Added by the MENGHUAN TROJAN! |
| X | foxdh | foxdh.exe | Added by the GWGHOST-Q TROJAN! |
| X | foxrxjh | foxrxjh.exe | Added by the GWGHOST-T TROJAN! |
| X | foxwudy9912 | service.exe | Added by the BANCOS-BT TROJAN! |
| Y | FP Loader | loadfp.exe | FoolProof Security - PC security software from SmartStuff |
| N | fpassist | fpassist.exe | Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer |
| ? | FPEXCNVT | ExCnvt.exe | Part of OpenText Fax Appliance, FaxPress (formerly Castelle FaxPress) - which "offers a combined hardware and software faxing solution, providing every possible computer-based, network fax option" |
| ? | FPWGMWZD | FPWGMWZD.exe | ?? |
| N | Fpx | mnmsrvc.exe | Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations |
| X | fqfeqajw | wycir.exe | Added by the MULTIDR-DA TROJAN! |
| X | fqfewn | xcze.exe | Added by the SDBOT-CJ WORM! |
| X | fqor | stub_113_4_0_4_0.exe | TargetSaver adware |
| X | FrameWork 2.5 | FrameWork.exe | Added by the RBOT-FMW WORM! Note - can terminate AV related processes |
| X | Framework module library | infocard.exe | Added by the BUZUS.AYX TROJAN! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft which is normally found in %Windir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation. This one is located in %System% |
| X | Framework Windows | frmwrk32.exe | Added by the FAKEAV-KS TROJAN! |
| X | FrameWorkService | smss.exe | Added by the KUKOO-A WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Inf |
| X | France | svchost.exe | Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| N | Fraps | FRAPS.EXE | Fraps® by Beepa Pty Ltd - is "a universal Windows application that can be used with games using DirectX or OpenGL graphic technology". It can show how many Frames Per Second (FPS) you are getting, allow you to take a screenshot with a single keypress or record a video |
| N | Free Download Manager | fdm.exe | "Free Download Manager" - see here |
| ? | Free Downloads Monitor | fdcmon.exe | ?? |
| N | Free DVD Direct | FreeDVDDirect.exe | Free DVD Direct - provides a program to access a peer-to-peer (P2P) file-sharing network (see here) |
| U | Free Key Logger | freekeylogger.exe | Free Key Logger keystroke logger/monitoring program - remove unless you installed it yourself! |
| U | Free Ram Optimizer | fro.exe | Free Ram Optimizer monitors your memory, and frees up ram if it falls below a certain minimum. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own mind |
| X | free-save | [path to risk] | Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself |
| X | FreeAttention | eqsefeqe.exe | Added by an unidentified WORM or TROJAN! |
| N | Freebie Notes | FreebieNotes.exe | Freebie Notes by Power Soft - create electronic notes (stickers) |
| N | FreeCall | FreeCall.exe | FreeCall - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype |
| U | Freecorder FLV Service | FLVSrvc.exe | Part of Applian Technologies Freecoder (save video and audio from the web and convert to many popular formats - formally known as ak & Record Toolbar). "Allows the video history tool to save videos you've played from your computer's cache" - see here. As it's based upon the Ask.com toolbar it sets your default search engine to Ask if not unchecked |
| Y | Freedom | Freedom.exe | Freedom from Zero Knowledge, Inc (now Radialpoint). Provides anti-virus, personal firewall, parental controls and a pop-up blocker. Also safeguards your personal information, encrypts your passwords and much more. No longer available |
| Y | Freedom | Rps.exe | Main program for internet security suites by Radialpoint. Radialpoint also source online security services for ISP customers such as Virgin Media, AT&T, Bell Canada, TELUS Corporation and Verizon Online |
| Y | FreeFallProtection | FF_Protection.exe | Found on some Dell laptops (any maybe others which include an STMicroelectronics accelerometer) - provides protection for supported hard disks when a fall or sudden movement is detected by "parking" the drive reading heads to avoid damage |
| U | FreeMem Pro | FMEMPRO.EXE | FreeMem Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| U | FreeMemVn2 | FreeMem.exe | FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| X | FreeMP3download | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| N | FreePDF Assistant | fpassist.exe | Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer |
| N | FreePDF_Assistant | fpassist.exe | Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer |
| U | FreeRAM XP | FreeRAM XP Pro *.exe | FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| U | FreeRAM XP | FreeRAM XP Pro.exe | FreeRAM XP Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| X | freestyle | lockx.exe | Added by the RBOT-ATH WORM! |
| U | freesurfer | fs20.exe | EMS Free Surfer mk II - pop-up stopper |
| X | freexstyle | lockbar.exe | Added by the LOXBOT.D WORM! |
| X | freexstyle | lockbr.exe | Added by the LOXBOT.C WORM! |
| X | freinst | pgs.exe | Part of the AVSystemCare rogue security software and other members of this family. See here for more examples |
| U | Fresh Desktop | freshdesktop.exe | Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals |
| N | freshclam | freshclam.exe | Auto update agent of the open source Clamwin virus scanner |
| N | FreshDownload | FD.EXE | Fresh Download from Freshdevices.com - "is a download manager for Internet Explorer that helps you downloading files from the Internet, such as your favorite freeware/shareware, mp3 files, movie files, picture collections, etc" |
| U | freshUI | freshui.exe | Part of Fresh UI from Freshdevices.com - "a fresh solution for configuring and optimizing Windows." This entry is added if you select any of the "on logon" options under "Covering Your Track" for "Clear Explorer History" and "Clear Internet Explorer History" and will have one or more numbers between 0 and 17 appended to the filename depending upon the option(s) selected. Once run it will exit |
| ? | frguk | shdrkmck.exe | ?? |
| ? | FridaysInHellInstaller | FridaysInHellInstaller.exe | ?? |
| X | FriendlyType | lsass.exe | Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup! |
| X | FriendlyTypeName | services.exe | Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | FriendlyTypeName | winlogon.exe | Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! |
| N | FriendlyWebQuick-Launch | SELFCERT.EXE | selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well |
| U | FRISK FP-Scheduler | F-Sched.exe | Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis |
| ? | FRITZ!DSL Startcenter | StCenter.exe | FRITZ! ISP software "StartCenter" User interface that allows you to manage, tweak and diagnose many aspects of your internet connection - is it required? |
| U | FRITZ!webProtect | FwebProt.exe | Firewall included in FRITZ! ISP DSL software |
| N | Fromine WinPopup | winpopup.exe | Instant Messenger program |
| X | froody | timoty.exe | Added by an unidentified malware |
| N | FrostWire On Startup | FrostWire.exe | FrostWire peer-to-peer (P2P) file-sharing client. As all peer-to-peer file-sharing clients are used to distribute large amounts of data between multiple users make sure you have good, up-to-date virus protection and check any downloads. Note that by default FrostWire installs the Ask.com toolbar which can be avoided (see here) |
| X | Frsk | frsk.exe | Unidentified adware downloader trojan |
| X | frun | derc32xz.exe | Added by an unidentified TROJAN! |
| Y | FRW_EXE | FRW.EXE | ConSeal Signal9 firewall - now McAfee Personal firewall |
| Y | frxmxins | frxmxins.exe | ATI 3D Studio MAX/VIZ driver |
| X | FS Agent | fagent.exe | Added by the VOLVER-B TROJAN! |
| X | FS6519 | FS6519.dll.vbs | Added by the SOLOW.B WORM! |
| Y | fsaa | fsaa.exe | F-Secure antivirus Authentication Agent - creates and stores private keys used by a client to access servers |
| N | FSCBoss | FSCBoss.exe | Free Store Club shop online software |
| ? | FSDPSRV | FSDPSRV.exe | ?? |
| X | fsdsft | [path to backdoor] | Added by the RANKY.S BACKDOOR! |
| X | FSH | svcnva.exe | Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.KA TROJAN! |
| U | fsp | fsp.exe | Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents |
| Y | fspr | FolderShield.exe | Folder Shield - hide personal files and folders |
| N | FSScrCtl | FSScrCtl.exe | Screen saver control applet used by the "Stardust Screen Saver Toolkit", SolidWorks and Hubble Space Telescope screen savers (and possibly others). Lets you control your installed screensavers from a System Tray icon |
| U | fsserv | fserv.exe | Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time |
| U | fssui | fsui.exe | System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. "With Family Safety, you decide how your kids experience the Internet. Limit searches, monitor and block or allow websites, and decide who your kids can communicate with in Windows Live Spaces, Messenger, or Hotmail". Note - disabling this entry does not disable Family Safety and prevent it monitoring a users activity or restricting access |
| U | fssui | fssui.exe | System Tray access to and notifications from Windows Live OneCare Family Safety - part of the Live OneCare range and now superseded by Windows Live Family Safety which is part of Windows Live Essentials. Allows you to decide how your kids experience the Internet by limiting searches, monitoring and blocking/allowing websites and deciding who your kids can communicate with in Messenger or Hotmail. Note - disabling this entry does not disable Family Safety and prevent it monitoring a users activity or restricting access |
| X | fstsvc | rundll32.exe fstsvc.dll,start | Added by the AKBOT-AA WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "fstsvc.dll" file is found in %System% |
| U | fsui | fsui.exe | System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. "With Family Safety, you decide how your kids experience the Internet. Limit searches, monitor and block or allow websites, and decide who your kids can communicate with in Windows Live Spaces, Messenger, or Hotmail". Note - disabling this entry does not disable Family Safety and prevent it monitoring a users activity or restricting access |
| X | FSW | FSW.exe | FreeScratchAndWin parasite |
| U | FSWebServer | fsws.exe | Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services |
| X | ftk | ftkclean.exe | FlashEnhancer adware |
| X | FtkCPY | ftkcpy.exe | FlashEnhancer adware |
| U | FtLnSOP_setup | FtLnSOP.exe | Fujitsu scanner utility |
| U | FTMSFLT(USB) | FTMSFLTU.EXE | Fujitsu's Touch Panel Message Notifier |
| X | FTP FOR WINDOWS | ftpwin32.exe | Added by a variant of the RBOT WORM! |
| X | FTPGraber | FTPGraber.exe | Added by the DLOADER-DT TROJAN! |
