| Status | Autorun name | Command | Description |
| X | GetTheMusic | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| U | Getting started with MacDrive | MDGetStarted.exe | MacDrive 7 from Mediafour Corporation - "enables anyone using Windows Vista, XP, and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types, including CDs, DVDs, hard drives, floppy, Zip, Jaz, and more!" |
| X | getwin | winB_.exe | Added by the BANKER-HS TROJAN! |
| X | gf1.0.0.2 | ggf.exe | Added by the EDFON.A TROJAN! |
| X | gfxtray | rundll32 ctccw32.dll,findwnd | Added by the AGENT.AOU BACKDOOR! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted, The "ctccw32.dll" is located in %System% |
| X | ggePSKfpxtP | ggePSKfpxtP.exe | Added by the FAKEAV-DVV TROJAN! |
| X | Ghost Antivirus | GhostAV.exe | Ghost Antivirus rogue security software - not recommended, removal instructions here |
| X | Ghost Relay | [random filename] | Added by the DNSCHANG.EK TROJAN! |
| U | GhostSecuritySuite | gss.exe | Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools |
| Y | GhostStartService | GhostStartService.exe | Installed with older versions of Symantec's Norton Ghost backup software (either as a standalone product or as part of Norton SystemWorks). This is the background process required for Ghost to work in Windows - when you use the Ghost Explorer (browse/extract files from archives) or start Ghost tasks such as backup and restore. Starts via a registry "RunServices" key on Windows 98/Me and as a service on Windows 2K/XP |
| N | GhostStartTrayApp | GhostStartTrayApp.exe | System Tray access to older versions of Symantec's Norton Ghost backup software (either as a standalone product or as part of Norton SystemWorks) |
| Y | GhostSurfDelSatellite | DeleteSatellite.exe | Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning, you'll want to leave this file in place |
| X | gigabit.exe | gigabit.exe | Added by the BEAGLE.U WORM! |
| X | GigaByte | Cheatle.exe | Added by the SHODI.B VIRUS! |
| U | GIGABYTE Gamer HUD | HUD.exe | Gigabyte's Gamer HUD graphics card utility. Primarily used for overclocking to adjust the voltage and working frequency of the GPU, Shader, and video memory |
| U | GIGABYTE Gamer HUD Lite | HUD.exe | Lite version of Gigabyte's Gamer HUD graphics card utility. Primarily used for overclocking to adjust the voltage and working frequency of the GPU, Shader, and video memory |
| U | Giganews Accelerator | GiganewsAccelerator.exe | Giganews Accelerator from Giganews, Inc. - "a software-based news proxy which will allow you to compress headers and enable 256-bit SSL encryption, regardless of whether or not SSL is supported natively by your news client" |
| Y | Gilat SOM Enumerator | dllhost.exe | For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system |
| Y | GilatFTC | ftc.exe | For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system |
| X | gimmygames | [path to trojan] | Added by the DLOADR-LN TROJAN! |
| X | gimmysmileys | gimmysmileys.exe | GimmySmileys adware |
| X | GinaDll | ntgina.dll | Added by the ANIG.A WORM! |
| ? | GisdnLog | gisdnlog.exe | BT Digital Access USB |
| U | Glass2k | Glass2k.exe | "Glass2k is a small little program that allows Win2K/XP users to make any window transparent" |
| U | Glassy Calculator II | Glassy Calculator II.exe | Glassy Calculator II widget for the DesktopX desktop utility from Stardock Corporation. Once started, Glassy Calculator II.exe loads a file called "DXWidget.exe" and exits |
| U | Glassy Calculator II | GLASSY~1.EXE | Glassy Calculator II widget for the DesktopX desktop utility from Stardock Corporation. Once started, Glassy Calculator II.exe loads a file called "DXWidget.exe" and exits. This is the XP MSConfig entry where "Glassy Calculator II.exe" is shown as "GLASSY~1.EXE" |
| U | Glassy Calendar | Glassy Calendar.exe | Glassy Calendar widget for the DesktopX desktop utility from Stardock Corporation. Once started, Glassy Calendar.exe loads a file called "DXWidget.exe" and exits |
| U | Glassy Calendar | GLASSY~2.EXE | Glassy Calendar widget for the DesktopX desktop utility from Stardock Corporation. Once started, Glassy Calendar.exe loads a file called "DXWidget.exe" and exits. This is the XP MSConfig entry where "Glassy Calendar.exe" is shown as "GLASSY~2.EXE" |
| X | GLF Network Lan Monitor | NPFMNTOR.exe | Added by the RBOT-AGY WORM! |
| Y | Glide | Glidew32.exe | Cirque touchpad driver |
| X | Global Startup | WinDash.EXE | Detected by Kaspersky as the VB.Q WORM! |
| X | GlobalFlagACER | ACER.exe | Added by the VB.BL WORM! |
| X | GlobalFlagimglog | imglog.exe | Added by the AGENT-GYK TROJAN! |
| X | GlobalSCAPE | [random filename] | Added by the RBOT-AYM WORM! |
| U | GlobeCom_Full_Client_McciTrayApp | McciTrayApp.exe | System tray access to Motive's broadband configuration and repair utility - for GlobeCom\TELUS users |
| U | GlobeTrotter Connect | globetrotter connect.exe | GlobeTrotter Connect - easy-to-use software application that "simplifies the management of Windows-based broadband Internet connections to WWAN networks, worldwide, automatically configuring connection to the service provider according to the SIM card inserted" |
| X | Glock Suite 1.1 | glock32.exe | Added by the TINY.GV TROJAN! |
| X | GLSetIT32 | msiexec16.exe | Added by the OPTIX PRO TROJAN! |
| X | GLSetIT32 | isass.exe | Added by a variant of the OPTIX PRO TROJAN! |
| X | GLSetT32 | smsiexec.exe | Added by the OPTIX-D TROJAN! |
| ? | gluon | gluon.exe | In a gluon/bin sub-directory |
| X | glv | glv.exe | Added by the DLOADER-NG TROJAN! |
| U | Gmail Checker | Gmail Checker.exe | Gmail Checker widget for the DesktopX desktop utility from Stardock Corporation. Checks for new E-mail on Google via their Atom feed. Once started, Gmail Checker.exe loads a file called "DXWidget.exe" and exits |
| U | Gmail Checker | GMAILC~1.EXE | Gmail Checker widget for the DesktopX desktop utility from Stardock Corporation. Checks for new E-mail on Google via their Atom feed. Once started, Gmail Checker.exe loads a file called "DXWidget.exe" and exits. This is the XP MSConfig entry where "Gmail Checker.exe" is shown as "GMAILC~1.EXE" |
| X | GMedia2 | GSM2.exe | Malware downloader - detected by Kaspersky as the VB.UX TROJAN! |
| X | GMedia2 | GSMedia3.exe | Malware downloader - detected by Kaspersky as the VB.UX TROJAN! |
| Y | Gmouse | Gmouse.exe | Amouse mouse driver - required if you use non-standard Windows driver features |
| X | Gmsvc32 | gmsvc32.exe | Added by the AGOBOT.ABN WORM! |
| U | Gnetmous | gnetmous.exe | Genius mouse driver - required if you use non-standard Windows driver features |
| U | GNETMOUSE | gnetmouse.exe | Genius mouse driver - required if you use non-standard Windows driver features |
| X | GNP Generic Host Process | svchost.exe | Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup! |
| ? | gnub | gnub.exe | ?? |
| X | go | cvir.exe | Added by the SILOV-A WORM! |
| X | Go And Start | svdll32.exe | Added by the RBOT.AI BACKDOOR! |
| X | Go!Zilla | gozilla.exe | Download manager for resuming downloads and choosing multiple download locations. Advertising spyware |
| X | Go!Zilla Monster Downloads | Go.exe | Download manager for resuming downloads and choosing multiple download locations. Advertising spyware |
| U | GoBack | GBMenu.exe | System Tray access to Roxio's GoBack system restoration software (before it became Norton GoBack) - which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty, performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag and not required for WinMe/XP users - but recommended for Win9x/NT/2K users. Previously released by Adaptec and Wild File |
| U | GoBack | GBTray.exe | System Tray access to Roxio's GoBack system restoration software (before it became Norton GoBack) - which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty, performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag and not required for WinMe/XP users - but recommended for Win9x/NT/2K users. Previously released by Adaptec and Wild File |
| Y | GoBack Polling Service | GBPoll.exe | Part of Symantec's Norton GoBack system restoration software - which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty, performing the same functions with extra features as System Restore on WinMe/XP systems. Provides essential background support services for GoBack and loads via the registry "Run" or "RunServices" keys in 98/Me and as a service in XP. Disable before running Scandisk or Defrag and not required for WinMe/XP users - but recommended for Win9x/NT/2K users. Previously released by Roxio, Adaptec and Wild File |
| X | GOG | GOG.exe | Added by the PHILIS.B VIRUS! |
| X | goidr | goidr.exe | Goidr adware |
| X | golbola | windows32.exe | Added by the BANKER.CIY TROJAN! |
| X | GoldenAntiSpy | pgs.exe | GoldenAntiSpy rogue security software - not recommended. A member of the AVSystemCare family |
| U | Goldensoft_MndlSvr | MndlSvr.exe | Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200X for true multitasking |
| X | Golum | services.exe | Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | golumm | services.exe | Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a "golumm" subfolder |
| X | good | badvir.exe | Added by the SILOV-B WORM! |
| X | google | google.exe | Added by the RBOT-AMW WORM! |
| U | Google Desktop | GoogleDesktop.exe | Google Desktop - "a desktop search application that provides full text search over your email, files, music, photos, chats, Google Mail, web pages that you've viewed and more. By making your computer searchable, Google Desktop puts your information easily within your reach and frees you from having to manually organise your files, emails and bookmarks" |
| U | Google Desktop Search | GoogleDesktop.exe | Google Desktop - "a desktop search application that provides full text search over your email, files, music, photos, chats, Google Mail, web pages that you've viewed and more. By making your computer searchable, Google Desktop puts your information easily within your reach and frees you from having to manually organise your files, emails and bookmarks" |
| X | Google Earth | [random filename] | Added by the RBOT-AXK TROJAN! |
| N | Google Earth Viewer | GOOGLEMAPS.EXE | Google Earth "combines satellite imagery, maps and the power of Google Search to put the world's geographic information at your fingertips" |
| U | Google IME Autoupdater | GooglePinyinDaemon.exe | Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone, depending on the system) and then presenting the user with a list of possible characters with that pronunciation |
| X | google Intrenet Explorer | google.pif | Added by the RBOT-ARA WORM! |
| U | Google Pinyin 2 Autoupdater | GooglePinyinDaemon.exe | Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone, depending on the system) and then presenting the user with a list of possible characters with that pronunciation |
| U | Google Quick Search Box | GoogleQuickSearchBox.exe | Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the "Start" button and Quick Launch toolbar and "lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it" |
| X | Google service | Googlesetup.exe | Added by the IRCBOT-RJ WORM! |
| X | Google Service FR | GO0GLEFREE.EXE | Added by a variant of the SPYBOT WORM! |
| X | google toolbar | ggtb32.exe | Added by the AGOBOT-RR WORM! |
| X | Google Toolbar | SPY_NET_RAT.exe | Added by the AGENT-LRO TROJAN! |
| N | Google Update | GoogleUpdate.exe | Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update |
| X | Google Update | GoogleUpdate.exe | Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System% |
| N | Google Updater | GOOGLE~1.EXE | Downloads and installs updates for Google applications (Google Earth, Google Desktop, etc.) |
| N | Google Updater | GoogleUpdater.exe | Downloads and installs updates for Google applications (Google Earth, Google Desktop, etc.) |
| X | Google Updater | sysDriver.exe | Added by the IRCBOT-C MALWARE! |
| X | GoogleBot.exe | GoogleBot.exe | Added by the GB TROJAN! |
| N | GoogleDCClient | GoogleDCC.exe | Google Compute Client - only present if you installed the Google Toolbar with "Google Compute" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser, click on the little double-helix on the Google Toolbar, and click "Stop Computing". No longer supported |
| U | GoogleDesktop | GoogleDesktop.exe | Google Desktop - "a desktop search application that provides full text search over your email, files, music, photos, chats, Google Mail, web pages that you've viewed and more. By making your computer searchable, Google Desktop puts your information easily within your reach and frees you from having to manually organise your files, emails and bookmarks" |
| U | GoogleQuickSearchBox | GoogleQuickSearchBox.exe | Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the "Start" button and Quick Launch toolbar and "lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it" |
| U | googletalk | googletalk.exe | Google Talk "enables you to call or send instant messages to your friends for free-anytime, anywhere in the world". Can be launched manually |
| U | GoogleToolbarNotifier | GoogleToolbarNotifier.exe | Part of Google Toolbar (from version 4 onwards) for IE. "Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved |
| X | GoogleUpdate | googleupdate.exe | Added by the FYNLOSKI-A BACKDOOR! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in the main %AppData% directory |
| X | GoogleUpdater3 | GoogleMapper.exe | Added by the ROUTROBOT WORM! |
| X | gotnewupdate000.exe | gotnewupdate000.exe | Added by the FAKEAV-BGA TROJAN! |
| U | GoToAssist Express Customer | g2ax_service.exe | Citrix GotoAssist Express - "provides you with live-support capability. Easily view and control your customers' computers online to quickly resolve their technical issues." End customer's version |
| U | GoToAssist Express Expert | g2ax_start.exe | Citrix GotoAssist Express - "provides you with live-support capability. Easily view and control your customers' computers online to quickly resolve their technical issues." Support expert's version |
| U | GoToMeeting | g2mstart.exe | Citrix GotoMeeting - web conferencing and online meeting tool which "allows you to host an online meeting with up to 15 people - so you can do more and travel less" |
| U | GoToMyPC | g2svc.exe | Citrix GoToMyPc - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser |
| U | GoTrusted | GoTrusted Secure Tunnel.exe | "GoTrusted is the fast, easy way to secure your PC's Internet data and protect your privacy" |
| X | GotSmiley | GotSmiley.exe | GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
