| Status | Autorun name | Command | Description |
| U | HSON | HSON.exe | Toshiba HotStart button support for instant-on entertainment on their laptops |
| U | HSTrans | hstrans.exe | Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen |
| ? | HsuGuiControl | HsuGuiControl.exe | Part of the Starband Internet satellite client. What does it do and is it required? |
| U | hsys | HSYS.EXE | Keylogger Express keystroke logger/monitoring program - remove unless you installed it yourself! |
| U | Hti | npdor.exe | Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required |
| X | HTML Help System | hhs.pif | Added by the RBOT-ATB WORM! |
| X | HTML32 Help System | hhs32.pif | Added by the RBOT-ATE WORM! |
| U | HTpatch | htpatch.exe | HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6% |
| X | HtProtect | AVprotect.exe | Added by the NETSKY.L WORM! |
| X | htssv32.exe | htssv32.exe | Added by a variant of the SDBOT TROJAN! |
| X | HTTP Tunneling Server | mstunnel.exe | Added by the RBOT.EDL WORM! |
| X | http://www.lienvandekelder.be | LienVandeKelder.exe | Added by the MYTOB-AZ WORM! |
| X | http://www.lienvandekelder.be | Lien Van de Kelder.exe | Added by the MYTOB-AP WORM and variants! |
| X | http://www.lienvandekelder.be | Lien Vande Kelder.exe | Added by the MYTOB-AQ WORM! |
| X | http://www.lienvandekelder.be | Lien vd Kelder.exe | Added by the MYTOB-M WORM! |
| X | http://www.lienvandekelder.be | Lien.exe | Added by the MYTOB-CZ WORM! |
| X | http://www.lienvandekelder.be | Lientjeuh.exe | Added by the MYTOB-P WORM! |
| X | http://www.lienvandekelder.be | LienVdK.exe | Added by the MYTOB-U WORM! |
| X | http://www.lienvandekelder.be | Van de Kelder Lien.exe | Added by the MYTOB-BF WORM! |
| X | http://www.lienvandekelder.be | We Love Lien Van de Kelder.exe | Added by the MYTOB-CV WORM! |
| X | http://www.lienvandekelder.com | Lien Van de Kelder.exe | Added by the MYTOB-EQ WORM! |
| X | http://www.lienvandekelder.com/ | LienVandeKelder.exe | Added by the MYTOB-EO WORM! |
| X | httpd | c_pan.exe | Added by a variant of the DELF-A TROJAN! |
| X | httpd | deamon.exe | Added by the TACTSLAY.C TROJAN! |
| X | httpd | msgaol.exe | Added by the TACTSLAY.C TROJAN! |
| X | httpd | s_menu.exe | Added by the TACTSLAY.C TROJAN! |
| X | httpd | browse.exe | Added by the TACTSLAY.C TROJAN! |
| X | https-ssl | https.exe | Added by the MOEGA.D WORM! |
| U | HughesNet Tools | matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". HughesNet Tools is required to run with the Help and Support program. If you uncheck HughesNet Tools and then run Help and Support it will add another HughesNet Tools in the startup menu. If you remove the HughesNet Tools in the add/remove program some help menus in help and support will not be available. You decide |
| ? | huhdir | huhdir.exe | ?? |
| X | huigezi | HgzServer.exe | Added by the GRAYBIRD.C TROJAN! |
| X | huigezi | SP00LSV.EXE | Added by the GRAYBIRD.J BACKDOOR! Note the digit "0" in the command |
| X | huySosat | huysosat.exe | Added by the MDROP-RG TROJAN! |
| X | Hvewsveqmg | ANACON.EXE | Added by the NACO.A WORM! |
| X | Hvid | Hvid.exe | Added by the GEMA TROJAN! |
| U | HW_OPENEYE_OUC_blueconnect | ouc.exe | Update client for the blueconnect mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_Cricket Broadband EC1705 | ouc.exe | Update client for the Cricket Broadband mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_MegaFon Internet | ouc.exe | Update client for the MegaFon Internet mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_PC Suite | ouc.exe | Update client for a mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_PLAY ONLINE | ouc.exe | Update client for the Play Online mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_Reliance Netconnect | ouc.exe | Update client for the Reliance Netconnect mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_T-Mobile Internet Manager | ouc.exe | Update client for the T-Mobile Internet Manager mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_tele.ring Verbindungsmanager | ouc.exe | Update client for the tele.ring mobile (USB) management tool by Huawei Technologies Co., Ltd |
| U | HW_OPENEYE_OUC_Telekom Internet Manager | ouc.exe | Update client for the Telekom Internet Manager mobile (USB) management tool by Huawei Technologies Co., Ltd |
| X | HWINFO* | HWINFO* | Added by the PUROL WORM! where * is a random character |
| Y | HWinst | N/A | For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out |
| X | Hwp | system_wc.exe | Eziin adware |
| X | hws | hws.exe | Added by the STARTPA-CT TROJAN! |
| U | HWSetup | HWSetup.exe hwSetUP | "Toshiba Hardware Setup is the Toshiba configuration management tool available through Windows." Allows the user to change BIOS, hard disk, memory, boot disk priority and other settings |
| X | hxadsec | [path to trojan] | Added by the ADCLICK-AP TROJAN! |
| X | HXDL.EXE | HXDL.EXE | Attune HelpExpress - spyware. Disable and uninstall - see here |
| X | HXIUL.EXE | HXIUL.EXE | Attune HelpExpress - spyware. Disable and uninstall - see here |
| U | HydarVisionDesktopManager | desk95.exe | ATI's HydraVision desktop management software, allowing for multi-monitor support, as included in ATI HydraVision versions 2.5 and earlier. Has been reported to cause problems, such as this one. HydraVision can be uninstalled through Add/Remove Programs |
| U | HydraDM | HydraDM.exe | Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which "customizes the behaviour of windows and dialog boxes, allows you to set up Hotkeys for navigation in multiple display configurations and applies special effects like transparency and shadows to you desktop" |
| U | HydraMD | HydraMD.exe | Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which "creates, organizes and arranges up to nine active multi-monitor desktop combinations and allows you to cycle between them with a mouse." There is an optional System Tray icon or a hotkey can be configured to cycle through the desktops |
| U | HydraVisionDesktopManager | desk98.exe | ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup |
| U | HydraVisionDesktopManager | HydraDM.exe | Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which "customizes the behaviour of windows and dialog boxes, allows you to set up Hotkeys for navigation in multiple display configurations and applies special effects like transparency and shadows to you desktop" |
| U | HydraVisionViewport | viewport.exe | ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup |
| U | HydraVisionViewPort | HydraMD.exe | Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which "creates, organizes and arranges up to nine active multi-monitor desktop combinations and allows you to cycle between them with a mouse." There is an optional System Tray icon or a hotkey can be configured to cycle through the desktops |
| X | Hyper Files | phfhost.exe | Added by the AGENT-JQO TROJAN! |
| X | Hyper Start | instantmsgrs.exe | Added by the RBOT-NH WORM! |
| X | I am not Ranky. I am eTunnel! | msyervice.exe | Added by an unidentified WORM or TROJAN! |
| X | I am not Ranky. I am eTunnel! | winsys.exe | Added by an unidentified WORM or TROJAN! |
| X | I am not Ranky. I am eTunnel! | disney.exe | Added by an unidentified WORM or TROJAN! |
| X | I just want to say I love Milko and I need a drink | svchost.exe | Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data |
| X | I-Worm.GiGu | uGiG.eXe | Added by the GINK WORM! |
| X | I/O Controllers | svcnet.exe | Added by the TIBIK-B TROJAN! |
| X | ϵͳע�ï½ï¿½ï¿½ | zhuruqi.exe | Added by the QHOST.V TROJAN! |
| X | I386 | I386.exe | Added by the MYPOWER WORM! |
| ? | I81SHELL | I81SHELL.exe | Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard |
| U | i8kfangui | I8kfanGUI.exe | I8kfanGUI - Dell Inspiron/Latitude/Precision fan control utility |
| U | IAAnotif | Iaanotif.exe | Part of Intel® Matrix Storage Manager (formally known as Intel® Application Accelerator and Intel® Application Accelerator RAID Edition). Used in conjunction with the event monitor service (IAANTMON - Iaantmon.exe) to display event notifications (such as RAID volume status changes, HDD I/O errors or HDD SMART event) via a System Tray icon when an event occurs. Via this icon you can then choose to launch the Intel Matrix Storage Console or ignore the current alert |
| Y | iamapp | iamapp.exe | Symantec's now discontinued Norton Personal Firewall - also included in Norton Internet Security. Formally AtGuard by WRQ until their acquisition by Symantec |
| X | Iamnacho On Irc.MusIrc.com Is a Homosexual! | XBox64.exe | Added by the RANDEX.Y WORM! |
| ? | IaNvSrv | IaNvSrv.exe | Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required? |
| ? | Iap | iap.exe | Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely? |
| U | ias | ias.exe | InvisibleASpy keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | IASHLPR | IASHLPR.EXE | Added by the OPASERV.T WORM! |
| ? | IAStorIcon | IAStorIcon.exe | Related to Intel® Rapid Storage Technology - which "provides new levels of protection, performance, and expandability for desktop and mobile platforms. Whether using one or multiple hard drives, users can take advantage of enhanced performance and lower power consumption." What does it do and is it required? |
| X | iasx | iasx.exe | Added by the NURECH TROJAN! |
| X | ibin | [path to trojan] | Added by the PERDA-C TROJAN! |
| X | ibm | ibm.exe | Added by the LEGMIR-AH TROJAN! |
| Y | IBM Client Security | certtool.exe | Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk), use the password manager or file/folder encryption options |
| N | IBM Client Security Software | csecwiz.exe | Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once, after the software has been installed and the notebook rebooted for the first time. If the wizard isn't completed a shortcut is available via the Start menu until it is |
| X | IBM Keyboard Driver | ikeybdrv.exe | Added by the SDBOT.IC BACKDOOR! |
| Y | IBM Password Manager | pwmgr.exe | Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager "enables you to manage your sensitive and easy-to-forget login information, such as user IDs, passwords, and other personal information, with IBM Client Security. The IBM Client Security Password Manager stores all information through the IBM Security Chip so that your UVM user authentication policy controls access to your secure applications and Web sites." Can also be used with or without the Fingerprint Reader on select models |
| N | IBM RecordNow! | RecordNow.exe | IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions |
| U | IBM ThinkPad EasyEject Support Application | EzEjMnAp.Exe | EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually." Configuration and performing of EasyEject actions is available via Fn+F9 key combination on some models |
| N | IBM ThinkPad EasyEject Tray Utility | EZEJTRAY.EXE | System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually." Configuration and performing of EasyEject actions is available via Fn+F9 key combination on some models |
| N | IBM ThinkPad Tray Utility | TP98TRAY.EXE | System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. "The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility, you can setup or change your device configurations for ThinkPad hardware and options" |
| U | IBM ThinkPad Utility | NPDTray.exe | System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models |
| U | IBM TrackPoint Accessibility Features | tp4ex.exe | Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as "Click Sound", "Button Lock" and "Cross Hair cursor" are enabled this entry will run at startup. If none of the accessibility features are used it remains as a startup entry but doesn't run |
| ? | IBM Warranty Notification | ERTS0749.exe | IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? |
| Y | IBM_PWMGR | pwmgr.exe | Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager "enables you to manage your sensitive and easy-to-forget login information, such as user IDs, passwords, and other personal information, with IBM Client Security. The IBM Client Security Password Manager stores all information through the IBM Security Chip so that your UVM user authentication policy controls access to your secure applications and Web sites." Can also be used with or without the Fingerprint Reader on select models |
| N | ibmmessages | ibmmessages.exe | "The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current" |
| ? | Ibmmon.exe | Ibmmon.exe | ?? |
| U | Ibmpmsvc | ibmpmsvc.exe | Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn, F3, F4 & F12 - which have specific functions to control the standby and hibernate buttons. Not required if you don't plan to go into standy or hibernate modes |
| ? | IBMPRC | ibmprc.exe | IBM application - what does it do and is it required? |
| U | IBMUltraBayHotSwapCPLLoader | IBMBAY2N.EXE | Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops |
| ? | IBMUltraBayHotSwapSound | IBMBAYSN.EXE | Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound? |
