| Status | Autorun name | Command | Description |
| N | FTPManager | FTPDM.exe | "Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another, remote computer system connected via a modem and telephone lines or by a local-area network (with upload transfer resume and download transfer resume)". Can be started manually |
| U | Ftpqueue | Ftpsched.exe | Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers |
| ? | FtpServer.exe | FtpServer.exe | Part of the Sharpdesk from Sharp Electronics. "A desktop-based, personal document management application that lets users browse, edit, search, compose, process, and forward both scanned and native electronic documents". What does it do and is it required? |
| U | ftutil2 | rundll32.exe ftutil2.dll, SetWriteCacheMode | Related to Promise Technology's FastTrak SX4030/4060 PCI ATA Raid 5 controller (and possibly others) |
| U | ftweak_RAMRush | RAMRush.exe | RAMRush by FTweak Inc - "is a free memory management and optimization tool. It can efficiently optimize memory usages of your Windows system, free up physical RAM and make your system work better" |
| U | ftweak_recyclebinex | RecycleBinEx.exe | RecycleBinEx by FTweak Inc - "a powerful and easy to use recycle bin manager for Windows Operating System. It extends and enhances the Windows recycle bin, and let you use many extra features in it" |
| U | FTweakFCleaner | FCleaner.exe | FCleaner by FTweak Inc - "is a freeware all-in-one Windows disk and registry cleaning and optimization tool. It removes unused files and invalid registry entries that are eating up your disk space and slowing your system down, tweaks your system and allows your Windows to run faster." Features include removing unused files, cleaning internet history, managing startup programs and a fully featured registry cleaner |
| X | FU | FUvirus.exe | Added by the VB-EJC TROJAN! |
| X | FuckD3w4 | FuckD3w4.exe | Added by the BRONTOK-DI WORM! |
| X | Fucker | fucker.vbs | Added by the CATCHER-A WORM! |
| N | FUFAXSTM | FUFAXSTM.exe | Epson fax utility for some of their AIO printers |
| U | FUIClearHis | freshui.exe | Part of Fresh UI from Freshdevices.com - "a fresh solution for configuring and optimizing Windows." This entry is added if you select any of the "on logon" options under "Covering Your Track" for "Clear Explorer History" and "Clear Internet Explorer History" and will have one or more numbers between 0 and 17 appended to the filename depending upon the option(s) selected. Once run it will exit |
| U | Fujitsu Hotkey Utility | IndicatorUty.exe | Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook, eg, when you press the hotkey for muting the sound, a loudspeaker icon with a cross on it is displayed |
| U | Fujitsu Menu | FjMnuIco.exe | From the "Fujitsu Menu" tray icon you have instant access to the Control Panel, Tablet pc keyboard, Tablet and pen settings, Fujitsu display controls, brightness control, sounds and audio devices, capture screen, capture window, organize favorites, power options, printers and faxes, LCD brightness MIN, LCD brightness MAX, Enable/disable Button Panel and the Fujitsu menu settings, which are customizable |
| X | fukerservice | fukerz.exe | Added by a variant of the RBOT WORM! |
| X | FUKLBAR | bar.exe | PurityScan adware |
| N | FullAudio | WMPImporter.exe | Used to import settings from Windows Media Player into Music Now software (from www.musicnow.com - which is no longer available) and possibly others |
| X | Fun | Fun.exe | Added by the COIDUNG-A WORM! |
| N | FusionHdtvTray | FusionHdtvTray.exe | FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software |
| U | FusionRC | FusionRC.exe | Remote control manager for DVICO FusionHDTV |
| U | FusionRemote | FusionRc.exe | Remote control manager for DVICO FusionHDTV |
| N | FusionTrayAgent | FusionHdtvTray.exe | FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software |
| X | fvek | fvek.exe | Added by the DRIVOL-A TROJAN! |
| Y | FveNotify | fveNotify.exe | Windows Vista - BitLocker Drive Encryption Notification Utility. Available with Enterprise and Ultimate versions of Vista, "BitLocker prevents a thief who boots another operating system or runs a software hacking tool from breaking Windows Vista file and system protections or performing offline viewing of the files stored on the protected drive" - see here |
| X | FW Manager | fwcheck.exe | Added by the DELBOT-H WORM! |
| X | FWDMON.EXE | fwdmon.exe | Added by the PROXY-S TROJAN! |
| Y | fwenc.exe | fwenc.exe | Check Point SecuRemote VPN client - "dynamic and fixed IP addressing for all ISP services - dial-up, cable modem, or DSL - the ideal solution for telecommuters and mobile workers" |
| X | Fwr Command Module | fwr.exe | Added by the SDBOT-PP WORM! |
| N | fwrastrc | fwrastrc.exe | Dial-up software for Friendly Technologies/1NationOnLine free ISP |
| U | fwservice | fwservice.exe | Firewall function of eAcceleration Stop-Sign security software - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| X | FX | ieloader.exe | Added by the SMALL.RR TROJAN! |
| X | fxapimm | rundll32.exe [path] fxapimm.dll | Added by the MDROP-DKE TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "fxapimm.dll" file is located in %AppData%\appMaindb |
| X | Fxoekm | miyhart.exe | Added by the SDBOT-CZQ WORM! |
| U | fxredir | fxredir.exe | Canon MultiPASS fax redirector |
| X | FXTJTQ | sqlwidb.exe | Added by the DWNLDR-ITH TROJAN! |
| X | fzg | svhost32.exe | Added by the DLOADER.BDK TROJAN! |
| Y | G DATA AntiVirus Tray Application | AVKTray.exe | System Tray access to and notifications for the range of internet security products from G Data Software AG - including NotebookSecurity, TotalSecurity, InternetSecurity and AntiVirus. If this entry is disabled, the core product functions will work properly but you will lose quick access to the main window and miss notifications of potential problems and updates. Also used by versions of Lavasoft's Ad-Aware Total Security |
| Y | G DATA AntiVirus Trayapplication | AVKTray.exe | System Tray access to and notifications for the range of internet security products from G Data Software AG - including NotebookSecurity, TotalCare, InternetSecurity and AntiVirus. If this entry is disabled, the core product functions will work properly but you will lose quick access to the main window and miss notifications of potential problems and updates |
| Y | G Data InternetSecurity | AVKTray.exe | System Tray access to and notifications for the range of internet security products from G Data Software AG - including NotebookSecurity, TotalSecurity, InternetSecurity and AntiVirus. If this entry is disabled, the core product functions will work properly but you will lose quick access to the main window and miss notifications of potential problems and updates. Also used by versions of Lavasoft's Ad-Aware Total Security |
| Y | G Data Personal Firewall | GDFirewallTray.exe | Part of the firewall included with the NotebookSecurity, TotalSecurity and InternetSecurity internet security products from G Data Software AG. Access to the firewall options is included in the main "G Data AntiVirus Tray Application" (AVKTray.exe) entry and although the name would suggest this adds a further tray icon it doesn't. Although the exact purpose is therefore unknown it's recommended you leave it running. Also used by versions of Lavasoft's Ad-Aware Total Security |
| Y | G Data Security Software | AVKTray.exe | System Tray access to and notifications for the range of internet security products from G Data Software AG - including NotebookSecurity, TotalSecurity, InternetSecurity and AntiVirus. If this entry is disabled, the core product functions will work properly but you will lose quick access to the main window and miss notifications of potential problems and updates. Also used by versions of Lavasoft's Ad-Aware Total Security |
| X | g.exe | g.exe | Added by the GRAYBIRD.Q TROJAN! |
| X | G_Host | gHost.exe | Added by the AUTOIT-BP WORM! |
| X | G_Server.exe | G_Server.exe | Added by the FEUTEL-C TROJAN! |
| X | G_Server1.2.exe | G_Server1.2.exe | Added by the GRAYBIRD-Z TROJAN! |
| X | G00123 | [worm filename] | Added by the BUGBROS WORM! |
| X | G0mez | G0mez.vbs | Added by the GORMLEZ-A WORM! |
| X | G3 | GSMedia3.exe | Malware downloader - detected by Kaspersky as the VB.UX TROJAN! |
| ? | g3dctl | g3dctl.exe | ?? |
| X | G4G | [random filename] | Detected as Trojan-Downloader.Win32.VB.fki |
| U | G6FTP Server Tray Monitor | G6FTPTray.exe | System Tray monitoring tool for Gene6 FTP Server - "an advanced FTP server software for Windows developed specifically for security and high performance requirements" |
| X | ga6pcw | ga6pcw.exe | Part of the AVSystemCare rogue security software and other members of this family. See here for more examples |
| X | gabougool | nounina.exe | Added by the AGENT-JVX TROJAN! |
| X | gac | gac.exe | Part of VirusVakt, Swedish rogue security software - not recommended. A member of the AVSystemCare family |
| ? | GACService | GACService.exe | Related to a Gemplus product. What does it do and is it required? |
| X | gadcom | gadcom.exe | Added by the AGENT-HIC TROJAN! |
| X | gadkgak12 | fsafsakx12.exe | Added by the ONLINEG-N TROJAN! |
| N | Gadu-Gadu | gg.exe | Polish language Instant Messaging client |
| N | Gadwin PrintScreen | PrintScreen.exe | Gadwin PrintScreen - utility to capture, print or save the current window |
| X | GAELICUM.EXE | GAELICUM.EXE | Added by the PENTA-A TROJAN! |
| X | gah95on6 | gah95on6.exe | ShopAtHome/SAHagent adware |
| U | gaim | gaim.exe | Gaim is an instant messenger client with capability to connect to AIM, ICQ, MSN Messenger, Yahoo, IRC, Jabber, Gadu-Gadu and Zephyr networks |
| U | Gainward | TBPanel.exe | Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel |
| X | Gallery | thG.exe | Added by the AUTORUN-JR WORM! |
| ? | GalleryPlayerCM | GalleryPlayerCM.exe | Related to GalleryPlayer by RGB Labs - "Discover the easiest way to acquire, organize and display the world's finest art and photography: with GalleryPlayer you can own high definition art and photography from the world's finest museums and galleries." No longer available - is it required? |
| ? | GalleryPlayerDM | GalleryPlayerDM.exe | Related to GalleryPlayer by RGB Labs - "Discover the easiest way to acquire, organize and display the world's finest art and photography: with GalleryPlayer you can own high definition art and photography from the world's finest museums and galleries." No longer available - is it required? |
| X | game | shit.exe | Added by the Netclap Gold backdoor TROJAN! |
| X | game | patcher.scr | Added by the PSW-ED TROJAN! |
| N | Game Device | JOYUPDRV.EXE | Genius game controller profile activator |
| X | Game House | GameHouse.exe | Added by the DELF-DRA WORM! |
| N | GameDrive | GDTask.exe | GameDrive from FarStone - virtual CD/DVD drive emulator that allows you to run your PC games without the disc. Available via Start → Programs |
| X | Games Acceleration | svshost.exe | EasySearch adware |
| X | Games Acceleration | [path to trojan] | Added by the SMUTSRCH-A TROJAN! |
| X | Games Acceleration | svshost1.exe | Added by the DLOADR-AWD TROJAN! |
| X | Games toolbar | rundll32.exe [path] tbGame.dll DllShowTB | Topconverting.com/180Search "Games Toolbar" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| N | GameSpot | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| N | GameTracker | GTLite.exe | GameTracker - "Keep track of and launch all your games from one application with the Game Tracker Client. Instantly announce on your profile and to your friends what game and on which server you are playing!" |
| U | gameutil.exe | gameutil.exe | Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot |
| X | gamma | svchost.exe | Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies |
| U | GammaHotKeys | setgamma.exe | Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop |
| X | gangsta | gangsta.exe | Added by the RIMA.A BACKDOOR! |
| U | GARO Status Monitor | cnwism.exe | Print monitor for certain Canon printers |
| X | gaSrv | gaSrv.exe | Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader |
| X | gaSrve | gaSrve.exe | Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader |
| X | Gate Personal Firewall | Systpl.exe | Added by the RBOT.ADC WORM! |
| N | Gateway Extended Warranty | GWCares.exe | Gateway Extended Warranty reminder |
| X | Gator | gator.exe | Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | Gator eWallet | gator.exe | Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | Gay_Sexy_** | Gay_Sexy_**.exe | Premium rate adult content dialler (where * is a random char) |
| U | GazelDisplay | gsyno.exe | BT Digital Access USB - Gazel ISDN installation System Tray icon |
| X | GB_Net_Protect | GB_Net_Protect.exe | Added by the BANKER-FBZ TROJAN! |
| Y | GBMHome7Agent | GBMAgent.exe | Genie Backup Manager Home 7 - backup software |
| Y | GBMLite7Agent | GBMAgent.exe | Genie Backup Manager Lite 7 - backup software |
| Y | GBMPro7Agent | GBMAgent.exe | Genie Backup Manager Pro 7 - backup software |
| X | Gbp Service | [path to trojan] | Added by the BANBRA.GQU TROJAN! The most common filename seen is "dchcp.exe" but examples have been seen where the filename is "spoolsvr32.exe" |
| Y | GBSpaceMan | SpaceMan.exe | GreenBorder - secure your browsing activities on the internet |
| X | gCac | gcac.exe | Added by the TACTSLAY.U TROJAN! |
| X | gcasDtServ | gcasDtServ.exe | Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup |
| Y | gcasServ | gcasServ.exe | Giant Antipsyware - now superseded by Microsoft's Windows Defender |
| X | gcasServ | realsched.exe | Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name |
