| Status | Autorun name | Command | Description |
| Y | McAfee VirusScan | mcvsshld.exe | ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed, including scanning E-mails via the McAfee VirusScan E-mail Scan Module (McVSEscn.exe) |
| Y | McAfee VirusScan | oasclnt.exe | On-access real-time scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files for malware as you access, create, copy or download them |
| X | Mcafee VirusScan Manager | mvcsvm.exe | Added by the SILLYFDC.BBV TROJAN! |
| X | McAfee Windows Protection | mcafee32.exe | Added by a variant of the SPYBOT WORM! |
| N | McAfee Winguage | ?? | Part of McAfee Nuts & Bolts. "WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start → Programs |
| U | McAfee.InstantUpdate.Monitor | RuLaunch.exe | Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis |
| U | McAfeeDataBackup | McAfeeDataBackup.exe | McAfee Online Backup (formerly Data Backup) - "takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos". Available as a stand-alone product or included in Internet Security and Total Protection |
| Y | McAfeeFireTray | Firetray.exe | McAfee Desktop Firewall |
| X | MCAFEEIPS | setup.exe | Added by the WHITEWELL TROJAN! |
| X | McAfeeScanPlus | McAfeeScanPlus.exe | Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in %Windir%\system |
| Y | McAfeeUpdaterUI | UpdaterUI.exe | McAfee common updater user interface |
| Y | McAfeeUpdaterUI | UdaterUI.exe | Updater user interface for McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool |
| Y | McAfeeVirusScanService | Avsynmgr.exe | From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe), WebScanX (Webscanx.exe), VirusScan System Scan (Vshwin32.exe) and VirusScan Console (Avconsol.exe) under one application |
| Y | McAfeeWebscanX | WebScanX.exe | From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc |
| X | Mcaffe Antivirus | Mcafeescn.exe | Added by a variant of the SPYBOT WORM! |
| X | MCAFFE FLD LOADER | MCAFFEFLD.EXE | Added by the RBOT-PY WORM! |
| X | Mcaffee | mcsheild.exe | Added by the RBOT-FDP WORM! |
| Y | mcagent | mcagent.exe | McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection, Internet Security and VirusScan. As well as providing System Tray access (via the "M" icon) for product configuration it also communicates with McAfee's servers to manage updates and virus alerts |
| Y | mcagent_exe | mcagent.exe | McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection, Internet Security and VirusScan. As well as providing System Tray access (via the "M" icon) for product configuration it also communicates with McAfee's servers to manage updates and virus alerts |
| Y | MCAgentExe | mcagent.exe | McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection, Internet Security and VirusScan. As well as providing System Tray access (via the "M" icon) for product configuration it also communicates with McAfee's servers to manage updates and virus alerts |
| Y | mcappins | mcappins.exe | Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted |
| X | mceipww | [8 random letters].exe | Added by the ZHELATIN.EQ WORM! |
| N | McENUI | McENUI.exe | McAfee's EasyNetwork user interface - "enables secure file sharing, simplifies file transfers, and automates printer sharing among the computers in your home network." Part of McAfee's security products such as Total Protection and Internet Security |
| N | MChanger | MChanger.exe | Media Changer - utility that allows you to change wallpapers, sounds, themes, etc |
| X | MChk | sjzkp.exe | Added by the MDROP-CSP TROJAN! |
| U | MCI USB Icon | USBIcon.exe | MCI USB software used for managing a USB card reader |
| N | McLogLch_exe | McLogLch.exe | Related to McAfee security suite. This is a non-essential program, but should not be disabled unless suspected to be causing problems |
| X | MCM3 | mcm3.exe | ShopAtHome/SAHagent adware variant |
| Y | mcmnhdlr | mcmnhdlr.exe | Part of older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online. When Windows boots it checks whether a virus scan is necessary before you do anything with your PC. Typically, this would be the case if a scan was scheduled at boot-up or if a virus was found during a previous scan and VirusScan determined a scan should be run at this time |
| N | MCPLaunch | MCPLaunch.exe | Launcher for Message Center Plus "which alerts you when conditions arise on your computer that require your attention" on IBM/Lenovo ThinkCentre desktops, Thinkpad notebooks and Value Line systems. Message Center Plus will periodically scan a Lenovo server for new messages that are appropriate for your system and never collects or transmits any information about you or your computer |
| N | McRegWiz | mcregwiz.exe | Product registration wizard for McAfee's range of internet security tools |
| X | Mcrosoftr Update | Mcrosoftr.exe | Added by a variant of the RBOT WORM! |
| Y | McShld9x | mcshld9x.exe | Window 9x/Me on-access scanner for older McAfee's internet security products such as VirusScan and VirusScan Online which scans files in real-time for malware as you access, create, copy or download them |
| X | Mcsoft | gfeqzvq.exe | Added by the SDBOT-NV WORM! |
| Y | MCTskShd | mctskshd.exe | Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online and used to schedule tasks such as automatic updates, virus scans, etc. Starts via a registry "Run" key on Windows 98/Me and as a service on Windows 2K/XP/Vista |
| Y | mcui_exe | mcagent.exe | McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection, Internet Security and VirusScan. As well as providing System Tray access (via the "M" icon) for product configuration it also communicates with McAfee's servers to manage updates and virus alerts |
| Y | McUpdate | McUpdate.exe | Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online |
| Y | MCUpdateExe | McUpdate.exe | Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online |
| Y | McVsRte | mcvsrte.exe | Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online. Starts via a registry "RunServices" key on Windows 98/Me and as a service on Windows 2K/XP/Vista |
| Y | mcvsshld | mcvsshld.exe | ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed, including scanning E-mails via the McAfee VirusScan E-mail Scan Module (McVSEscn.exe) |
| X | MCX Update | wisp.exe | Added by the RBOT-AQH WORM! |
| X | MCX Updte | scorti.exe | Added by the RBOT-ARP WORM! |
| X | MD IE Plugin | md.exe | Marketdart spyware |
| X | MD IE Plugin | winy.exe | Adware |
| N | mdac_runonce | runonce.exe | Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe". |
| U | MDDiskProtect | MDDiskProtect.exe | Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - "a perfect way to share files between Mac OS and Windows." Unlike the standard version of MacDrive 7, this version is not Vista compatible but does "include support for striped Mac arrays created with ATTO ExpressStripe software." |
| U | MDDiskProtect.exe | MDDiskProtect.exe | Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - "a perfect way to share files between Mac OS and Windows." Unlike the standard version of MacDrive 7, this version is not Vista compatible but does "include support for striped Mac arrays created with ATTO ExpressStripe software." |
| X | mdetect | [path to trojan] | Added by the SPABOT TROJAN! |
| U | MDGetStarted | MDGetStarted.exe | MacDrive 7 from Mediafour Corporation - "enables anyone using Windows Vista, XP, and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types, including CDs, DVDs, hard drives, floppy, Zip, Jaz, and more!" |
| U | MDGetStarted.exe | MDGetStarted.exe | MacDrive 7 from Mediafour Corporation - "enables anyone using Windows Vista, XP, and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types, including CDs, DVDs, hard drives, floppy, Zip, Jaz, and more!" |
| X | Mdm | Mdm.vbs | Added by the WHITEHO VIRUS or TRAPPY WORM! |
| X | mdm | mdm.exe | Added by the LYDRA-F TROJAN! ! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only). This one is located in %Windir% |
| X | MDM Rock 4 | [8 random letters].exe | Added by the SDBOT.CHG BACKDOOR! |
| U | MDM7 | MDM.EXE | Used by developers for debugging and is a component of several MS products including Office and Visual Studio. Those who have encountered it have unchecked it with no degradation in performance. It may cause your computer to "hang" if you have Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendation. For this entry it loads under the "RunServices" key in 98/Me. It also loads as a service in XP/Vista. In both cases it's located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug |
| X | Mdmdll | mdmdll.exe | Added by the CRYPTER TROJAN! |
| X | Mdmdll32 | mdmdll32.exe | Added by a variant of the CRYPTER.C TROJAN! |
| X | MDN | MDNS.exe | Added by the SPYBOT.JPB WORM! |
| X | MDN | MDNZ.exe | Added by the RBOT.AQD WORM! |
| X | MDN | MDN.exe | Added by the RBOT.AOA WORM! |
| X | MDNS | service.exe | Mirar adware variant |
| X | mds.exe | mds.exe | Added by the MADS-A TROJAN! |
| ? | MDS_Menu | MUIStartMenu.exe | Part of MediaShow and MediaEspresso (formerly MediaShow Expresso) from CyberLink. The exact purpose of this entry is unknown at present but it unloads from memory once run |
| U | MDSA Sentinel X | smss.exe | SentinelX surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the smss.exe process which is always located in %System%. This one is located in %ProgramFiles%\MDSA Software |
| X | mdwmdmsp | mdwmdmsp.exe | Adware - detected by Kaspersky as the AGENT.AM TROJAN! |
| N | MECA | Meca.exe | Meca cross-platform communications technology, branded messengers will connect with AOL, MSN, Yahoo!, and ICQ users |
| X | MedGS | MEDGS1.exe | PacerD Media/Pacimedia.com adware |
| X | Media Access | MediaAccK.exe | WindUpdates MediaPass adware |
| X | Media Adapter | bitblt.exe | Added by the HANSAH-A WORM! |
| U | Media Card Companion Monitor | MCC Monitor.exe | Monitor for Media Card Companion from ArcSoft. "Automates the tedious processes associated with downloading and sharing files from digital cameras, card readers, and other removable media" |
| U | Media Codec Update Service | update.exe | Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated |
| X | Media Gateway | MediaGateway.exe | WindUpdates MediaPass adware |
| X | Media Load | msn32.exe | Added by a unidentified WORM or TROJAN! |
| U | Media Manager Indexer | AIRSVCU.EXE | Part of MS Visual InterDev, Media Manager is an easy media file management system that works in conjunction with Windows Explorer. The Media Manager Indexer is a program that indexes all the information about your media files and puts it into a database |
| X | Media Pass | MediaPassK.exe | WindUpdates MediaPass adware |
| X | Media Pass | MediaPass.exe | WindUpdates MediaPass adware |
| X | Media Player | media.exe | Added by the FLDMEDIA-A TROJAN! |
| X | Media Player | wmplayer.exe | Added by a variant of the AGOBOT.BM WORM! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player |
| X | Media Player | Sysdll.exe | Added by the BANKER-BR TROJAN! |
| X | Media Player | Sysnet.exe | Added by the BANKER.MW TROJAN! |
| X | Media Player | iexplorer.exe | Added by the BANKER.MW TROJAN! |
| X | Media Player Update | xpsp1mfh.exe | Added by a variant of the RBOT WORM! |
| X | Media Plug x.1.2 | msdm.exe | Added by the MULDROP.352 VIRUS! |
| X | Media Server | msdts.exe | Added by a variant of the IRCBOT TROJAN! |
| X | Media Service | msn64.exe | Added by the SPYBOT.EV WORM! |
| X | Media service | msnmsgxr.exe | Added by the SDBOT.TF WORM! |
| X | Media service | SYSTEM64.EXE | Added by the RBOT.QV WORM! |
| X | Media service | notpad.exe | Added by a variant of the AGOBOT/GAOBOT WORM! |
| X | Media Services | [filename].exe | Added by the AGENT-BA BACKDOOR! |
| X | Media Software UPdater | sscs.exe | Added by the RBOT-ABE WORM! |
| X | Media Transfer Protocals | msstc.exe | Added by a variant of the IRCBOT TROJAN! |
| X | Media X Services | MSNGRx.exe | Added by the RBOT.AUL WORM! |
| X | Media-XP-Service-Pack3 | msnzx.exe | Added by the SDBOT-ACW WORM! |
| X | media_manager | mediaman.exe | Mini-Player, IMESH related foistware |
| X | media_stub | stub.exe | Mini-Player, IMESH related foistware |
| X | MEDIA32 | [path to trojan] | Added by the PURSCAN-Z TROJAN! |
| U | MediaButtons | MediaButtons.exe | Supports the eject button on the front on the Dell Studio Hybrid desktop. If disabled, the user will have to eject the CD/DVD by opening My Computer, right-clicking on the drive and selecting "Eject" from the available options |
| X | mediacodec.exe | mediacodec.exe | Added by the VSCODEC PRO TROJAN! |
| N | MediaFace Integration | Sethook.exe | Fellowes Neato® cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" |
| U | Mediafour Mac Volume Notifications | MACVNTFY.EXE | Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - "a perfect way to share files between Mac OS and Windows." Unlike the standard version of MacDrive 7, this version is not Vista compatible but does "include support for striped Mac arrays created with ATTO ExpressStripe software." |
| U | Mediafour MacDrive | MacDrive.exe | MacDrive 7& MacDrive 6 CrossStripe Edition from Mediafour Corporation - "a perfect way to share files between Mac OS and Windows." Version 6 is not Vista compatible but doesn "include support for striped Mac arrays created with ATTO ExpressStripe software." |
