| Status | Autorun name | Command | Description |
| X | 1 | KHATRA.exe | Added by the AUTOIT-BP WORM! |
| X | 1 | addit.exe | Added by the SDBOT-RI WORM! |
| N | 1&1 EasyLogin | EasyLogin.exe | 1&1 EasyLogin - quick access to webhost 1&1's Control Panel, Web-Mail and other applications via the System Tray |
| X | 1-sukarno | sukarno.exe | Added by the BRONTOK-CR WORM! |
| N | 1: | hpdrv.exe | HP utility for monitoring when and how many recoveries have been done |
| U | 101Clips | 101Clips.exe | 101Clips - "the simplest of all multi-clipboard programs. Just have it running minimized and it captures everything you cut or copy from other programs. It keeps the last 25" |
| X | 1029BB4B-16A9-4E77-AA3D-96930BD68EEC | sysockeu.exe | Added by the FAKEALERT-AH TROJAN! |
| X | 10Base-T | explore.exe | Added by the AGOBOT-IJ WORM! |
| X | 1111swapmgr.exe | 1111swapmgr.exe | Added by the BDOOR-IC BACKDOOR! |
| X | 123 | wintask.exe | Added by the LEGMIR-AY TROJAN! |
| X | 1234klsjdc uiar924c af | sxgnsvuxct.exe | Added by the FAKEALERT-AM TROJAN! |
| X | 1234klsjdc uiar924c af | sysvtypkbjx.exe | Added by the FAKEALERT-AM TROJAN! |
| X | 123Monitor | SpywareFreeMonitor.exe | 1-2-3 Spyware Free rogue spyware remover - not recommended, see here |
| X | 12CFG214-K641-12SF-N85P | vsbntlo.exe | Added by the SLENUGGA.A TROJAN! |
| X | 12CFG214-K641-24SF-N85P | ls888.exe | Added by the SLENUGGA.A TROJAN! |
| X | 12CFG214-K641-24SF-N85P | vsofat.exe | Added by the HAMWEQ.DD WORM! |
| X | 12CFG515-K641-55SF-N55P | vslmq.exe | Added by a variant of the SPYBOT WORM! |
| X | 12CFG515-K641-55SF-N66P | pqlmq.exe | Added by the SLENUGGA.A TROJAN! |
| X | 12CFG914-K641-26SF-N31P | vsexy1.exe | Added by the HAMWEQ.DD WORM! |
| X | 12CFG914-K641-26SF-N31P | vsse32.exe | Added by the SILLY.LC WORM! |
| X | 12CFG914-K641-26SF-N32P | vse432.exe | Added by the SLENUGGA.A TROJAN! |
| U | 12Ghosts Backup | 12backup.exe | 12Ghosts Backup - "Automatic Backups, HyperBackup for Multiple Versions, Registry Backup" |
| U | 12Ghosts Clip | 12clip.exe | 12Ghosts Clip - "Screen shots made easy" |
| U | 12Ghosts JustAWindow | 12window.exe | 12Ghosts JustAWindow - "Cover annoying ads, animated gifs, things you don't want to see" |
| U | 12Ghosts Popup-Killer | 12popup.exe | 12Ghosts Popup-Killer |
| U | 12Ghosts SaveLayout | 12autosl.exe | 12Ghosts SaveLayout - "Always (always!) keep the layout of your desktop icons" |
| U | 12Ghosts SetColor | 12color.exe | 12Ghosts SetColor - "Change your desktop icon text colors, also to transparent" |
| U | 12Ghosts ShowTime | 12showtime.exe | 12Ghosts Showtime - "Enhance the clock in your tray with font formatting, colors, date, time zones" |
| U | 12Ghosts Synchronize | 12sync.exe | 12Ghosts Synchronize - "Sync PC clock with an atomic clock over the Internet" |
| U | 12Ghosts Tower | 12tower.exe | 12Ghosts Tower - "Quickly access and manage all Ghosts (included in all packages)" |
| U | 12Ghosts TrayProtect | 12srvc.exe | 12Ghosts TrayProtect - "Hide tray icons, restore after a crash" |
| U | 12Ghosts Wash | 12wash.exe | 12Ghosts Wash - "Protect your privacy, clear browser history, delete and overwrite cache files" |
| N | 12Voip | 12Voip.exe | 12Voip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype |
| X | 12ZFG94-F641-2SF-K31P-5N1ER6H6L2 | service.exe | Added by the SILLY.LC WORM! |
| X | 13CFG914-K641-26SF-N31P | vsse33.exe | Added by the SLENUGGA.A TROJAN! |
| U | 1455 Scan2PC | Scan2pc.exe | Scan to PC application for the scanning function of the Samsung SCX1455 multifunction printer |
| X | 15886941 | 15886941.exe | Added by the RANSOMLOCK.F TROJAN! |
| ? | 17779Proj2002 | N/A | ?? |
| X | 180adsolution | 180adsolution.exe | 180solutions adware |
| X | 180ax | 180ax.exe | 180Search adware |
| X | 180ClientStubInstall | stubinstaller****.exe [* = digit] | 180Solutions adware related |
| X | 180ClientStubInstall | [path to trojan] | 180Solutions adware related |
| X | 180ClientStubInstall | ******.tmp [* = random digit/char] | 180Solutions adware related |
| X | 180sa | 180sa.exe | 180Search adware |
| X | 1916435341.exe | 1916435341.exe | Added by the DLOADR-AXU TROJAN! |
| X | 196_150_ni | 196_150_ni.exe | WinFixer web installer - "foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here |
| X | 197_150_ni_3 | 197_150_ni_3.exe | WinFixer web installer - "foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here |
| X | 197_150_ni_7 | 197_150_ni_7.exe | WinFixer web installer - "foistware", pretending to be system optimization, protection and recovery software - stealth installed, see here |
| U | 1A:MacVisionTrayMonitor | TrayMonitor.exe | Part of MacVision by Jeff Bargmann - an discontinued program that makes your PC's desktop look and feel incredibly like that of a Macintosh OS8 computer. Handler that puts the icons that are in your system tray into the MacVision taskbar, beside the clock |
| Y | 1A:Stardock MCP | mcpserver.exe | Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications |
| Y | 1A:Stardock TrayMonitor | TrayServer.exe | For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX |
| X | 1ay9e1 | 7em1.exe | Added by the BCKDR-RGU BACKDOOR! |
| U | 1cla | 1cla.exe | 1 Click & Lock from Softstack.com - "a system tray security utility you can use to secure your desktop when you step away from your PC. It's secure and very easy-to-use. Just define a password, and select Lock to hide and deny access to your desktop to anyone without the proper password." The same program as Access Lock and Access Controller (and maybe others) - the same file for the same version is used by all programs but the filename is different in each case |
| U | 1cla.exe | 1cla.exe | 1 Click & Lock from Softstack.com - "a system tray security utility you can use to secure your desktop when you step away from your PC. It's secure and very easy-to-use. Just define a password, and select Lock to hide and deny access to your desktop to anyone without the proper password." The same program as Access Lock and Access Controller (and maybe others) - the same file for the same version is used by all programs but the filename is different in each case |
| ? | 1CmailS | NETMAIL.EXE | ?? |
| X | 1on1 | 1on1.exe | Adult content dialler |
| U | 1Srv32 | SpyAgent4.exe | SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC" |
| X | 1u7 | 1u7.exe | Added by the MURBAC-A TROJAN! |
| U | 1Win32Cfg | SpyBuddy.exe | SpyBuddy from ExploreAnywhere, Inc - is the "dependable computer monitoring solution that will reveal what your child or employee is really doing on the computer" |
| U | 1Win32Cfg | Keyloggerpro.exe | Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | 1WinCfg32 | WebMailSpy.exe | WebMailSpy spyware |
| X | 2-suharto | suharto.exe | Added by the BRONTOK-CR WORM! |
| X | 2020Downloader | mssvr.exe | 2020Search Toolbar |
| X | 2177F056-0AA6-4D6C-A944-13F71F341C29 | sysokuaw.exe | Added by the FAKEALERT-AH TROJAN! |
| X | 222qo3j | ypgz2y.exe | Added by the AGENT-RFJ TROJAN! |
| U | 2335dn Scan2PC | Scan2pc.exe | Scan to PC application for the scanning function of the Dell 2335 multifunction laser printer |
| U | 24Online Client | CyberoamClient.exe | Related to Cyberroam from Elitecore Technologies Ltd |
| X | 250kg | 250kg.exe | Added by the AUTORUN-TI WORM! |
| X | 252 | winmgr.exe | Added by the LEGMIR-AT TROJAN! |
| X | 27 | slsorve.exe | Added by the SLSORVE-A TROJAN! |
| X | 27 | csrss32.exe | Added by the SLSORVE-D TROJAN! |
| X | 27 | msm32.exe | Added by the SLSORVE-E TROJAN! |
| U | 2Gis Update Notifier | 2GISTrayNotifier.exe | System Tray update notifications for 2GIS - a free electronic directory of organizations with a city map covering Russian and Ukraine cities |
| X | 2k6 updatz | crss3.exe | Added by the RBOT-CPD WORM! |
| X | 2kowmeuswvw3 | security.exe | AntiVirus Solution 2010 rogue security software - not recommended, removal instructions here |
| X | 2kowmeuswvw3 | securetystudio.exe | Security Inspector 2010 rogue security software - not recommended, removal instructions here |
| X | 2kowmeuswvw3 | securityhelper.exe | AntiVirus System 2011 rogue security software - not recommended, removal instructions here |
| X | 2Search | main.exe | 2Search adware |
| X | 2thousandbuck | [path to file] | Added by the RANKY.L TROJAN! |
| U | 2wSysTray | 2portalmon.exe | 2Wire Homeportal user interface |
| X | 3-habibie | habibie.exe | Added by the BRONTOK-CR WORM! |
| U | 3170 Scan2PC | Scan2pc.exe | Scan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printer |
| X | 32-bit Thunking service | thunk32.exe | Added by the DERDERO.A WORM! |
| X | 32.exe | nvscv32.exe | Added by the AGENT-LOL TROJAN! |
| X | 333 | svchost.exe | Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a "Syswm1i" directory |
| X | 360antiarp | [path to trojan] | Added by the PASTA.AIB TROJAN! |
| Y | 36X Raid Configurer | JMRaidSetup.exe | JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers |
| X | 38682532 | 38682532.exe | Added by the AGENT-MCM TROJAN! |
| X | 388529725448 | AutomaticUpdates.exe | Added by the SDBOT-DEN WORM! |
| ? | 39ELTFH25Z8SKF | Ezg1q5.exe | Seems to be associated with software by Resplendence SP ? |
| Y | 3c1807pd | 3cmlink.exe 3cpipe-3c1807pd | 3Com WinModem driver. See here for more WinModem information |
| Y | 3capplnk | 3capplnk.exe | US Robotics Modem driver |
| N | 3cdminic | 3CDMINIC.EXE | 3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards |
| Y | 3CM Link | 3cmcnkw.exe | Required for a US Robotics WinModem as it provides the link to Windows - won't work without it |
| Y | 3Cmlink | 3CmlinkW.exe | For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information |
| ? | 3Com Launcher | Launcher.exe | Related to networking products from 3Com Corporation. What does it do and is it required? |
| N | 3ComDMIAgent | 3CDMINIC.EXE | 3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards |
| Y | 3cpipe-USRpdA | USRmlnkA.exe | Modem driver files from US Robotics |
| X | 3D Text | 3D Text.scr | Added by the JERMY.A WORM! |
| X | 3d_sound | 3d_sound.exe | Added by the RIADOS-A TROJAN! |
