| Status | Autorun name | Command | Description |
| X | ctfmona | ctfmona.exe | Added by the DLOADR-BME TROJAN! |
| X | CTFMONSS | CTFMONSS.EXE | Added by the CWS-F TROJAN! |
| X | ctfmoon | microsoftconfigurator.exe | Added by the DELF-ALS TROJAN! |
| X | ctfmun | ctfmun.exe | Added by the AGENT.ACEZ TROJAN! |
| X | ctfnnon | ctfmon.exe | Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir% |
| X | ctfnom | rundIl32.exe | Added by the LEGMIR-AW TROJAN! |
| X | ctfnom.exe | SVOHOST.exe | Added by the DIGIDOR-A TROJAN! |
| X | ctfnom.exe | OSRSS.exe | Added by the DLOADER-UQ TROJAN! |
| X | cthelp | cthelp.exe | Added by the SDBOT TROJAN! |
| U | CTHELPER | CTHELPER.EXE | CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative's sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it |
| X | CTHelper | cthelper.exe | Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here |
| X | CTHELPER | svhost.exe | Added by the SDBOT-RZ WORM! |
| X | CTime | [path to trojan] | Added by the HTTPDOS TROJAN! |
| X | CTin10 | CTin10.exe | Added by the BANCOS.E TROJAN! |
| X | CtModule | CtModule.exe | Added by the CLICKER-EG TROJAN! |
| X | CTMON.EXE | cfmon.exe | Added by the CLCKR-AN TROJAN! |
| U | CTNMRUN | ctnmrun.exe | Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected |
| ? | CTPDPSRV | CTPDPSRV.EXE | Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required? |
| N | CTPerformanceUtility | CTPowUti.exe | Related to Creative PowerSysTrayApp. This program is a non-essential process, but should not be terminated unless suspected to be causing problems |
| X | ctpmon | ctpmon.exe | Registry Cleaner rogue - not recommended, removal instructions here |
| N | CTRegRun | CTRegRun.exe | For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative |
| U | CtrlVol | CtrlVol.exe | Volume control key on Acer, Fujitsu and other laptops |
| ? | CTSched | CTSched.exe | Creative Task Scheduler. What does it do and is it required? |
| N | CTStartup | CTEaxSpl.exe | Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard |
| U | CTSVolFE | CTSVolFE.exe | Creative Labs Mixer applet for the Sound Blaster Audigy |
| U | CTSVolFE.exe | CTSVolFE.exe | Creative Labs Mixer applet for the Sound Blaster Audigy |
| N | CTSyncU.exe | CTSyncU.exe | Creative Sync Manager - synchronizes music tracks on your computer with your player |
| U | CTsysVol | CTSysVol.exe | Creative sound card volume controls |
| ? | cttdpsrv | cttdpsrv.exe | ?? |
| X | CTUpdate | ctupdclt.exe | Added by the RBOT-ABG WORM! |
| N | CTxfiHlp | CTXFIHLP.EXE | Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card |
| N | CTXFIREG | CTxfiReg.exe | Creative Labs sound card driver related. It appears that it isn't required and maybe registration related |
| X | Ctykd | [path to file] | SMALL.SN spyware |
| N | CTZDetec.exe | CTZDetec.exe | Auto-detect feature of Creative Media Lite which assists you in managing your music, ripping CDs and transferring other stored music to your Zen Stone MP3 player |
| X | CU1 | VCClient.exe | Associated with the Surf Sidekick adware and should be removed |
| X | CU2 | VCMain.exe | Associated with the Surf Sidekick adware and should be removed |
| Y | cuagentExe | Cuagent.exe | Command Antivirus related |
| X | CueX44 | Dago.exe | Added by the PUNYA-B WORM! |
| X | CueX44_stil_here | WINLOGON.EXE | Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! |
| X | cuo | cuo.exe | Added by the BUGBEAR.A WORM! |
| U | Currency | windowsintd.exe | Intruder keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | Current Security Config | csecure.exe | Added by the RBOT-AMO WORM! |
| X | Current32 | msnpla.exe | Added by the SDBOT-DIS WORM! |
| X | CurrentVersion | recyclebin.exe | Added by the AUTORUN-AZX WORM! |
| N | CurseClient | CurseClient.exe | CurseClient add-on manager for World of Warcraft and Warhammer Online games |
| N | cursor | Screendragon_VS_Taskbar.exe | ScreenDragon video player |
| U | CursorFX | CursorFX.exe | CursorFX from Stardock Corporation - cursor editing and management utility. Required if you use any cursors or effects supplied with or created by CursorFX |
| U | CursorGizmo | CursorGizmo.exe | Cursor Gizmo - cursor management utility |
| U | CursorXP | CursorXP.exe | CursorXP (now replaced by CursorFX) from Stardock Corporation - cursor editing and management utility. Required if you use any cursors or effects supplied with or created by CursorXP |
| U | Curtain | Curtain.exe | Curtain (from Chaotic Visions) - "is a Windows utility which gives you the power to hide any window or group of windows to your system tray" |
| U | Customizer2000 | logon.exe | Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" |
| N | CuteMX | CuteMX.EXE | File sharing utility |
| X | Cvfjx | ANACON.EXE | Added by the NACO.A WORM! |
| X | cvhnykzx | keepSafe.exe | Added by the KILLAV.KAX TROJAN! Note - this is not the legitimate KeepSafe from Stardock Corporation which shares the same filename and is normally located in a %ProgramFiles%\Stardock subfolder. This one is found in %System% |
| X | cvmonitor.exe | cvmonitor.exe | Added by the SDBOT.BV WORM! |
| X | cvmsyslpd | sdservss.exe | Added by the MAILBOT-BY TROJAN! |
| Y | CVPND | cvpnd.exe | Sub-system used by Cisco VPN client for making a connection to a remote IPSec server |
| U | CW | cw4.exe | Chat Watch "is a monitoring and logging software for online chat and instant messaging programs" |
| U | CWatch | cw.exe | ChatWatch - chat monitoring tool |
| N | cwbckver | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| N | cwbinhlp | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| N | cwbsvstr | cwbsvstr.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| ? | cwbwlwiz | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| ? | Cwcdschk.exe | Cwcdschk.exe | IBM Thinkpad related? |
| U | cwcptray | cwcptray.exe | Related to ContentWatch Parental Control internet filter |
| X | cwingllib | atllsimm.exe | Added by a variant of the SDBOT WORM! |
| X | cwintool | cwintool.exe | Added by the SMALL.ZZJ TROJAN! |
| X | cwriter | ucookw.exe | Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples |
| X | cwriter | cwriter.exe | Part of PcRaiser, SystemOptimizer2008, VelocidadSimple and other rogue optimization utilities - not recommended |
| U | cwupdate | cwupdate.exe | ContentProtect from ContentWatch - internet filter |
| X | cximddl | ldfrmmd.exe | Added by the BUZUS.CQMU TROJAN! |
| N | CXMon | Hpi_Monitor.exe | Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software" |
| X | cybansos | cyban.exe | Added by the TATERF-V WORM! |
| N | Cyber | cyberchk.exe | Part of Belkins "Multimedia Cleaning Kit" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after "x" amount of time has passed |
| U | Cyber Trio | showmode.exe | From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs |
| U | Cyber-Defender 2003 | uwcdsvr.exe | Cyber Defender 2003 |
| N | Cyber-shot Viewer Media Check Tool | SPUVolumeWatcher.exe | Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it |
| N | Cyber-shot Viewer Media Check Tool | SPUVOL~1.EXE | Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it |
| X | CyberDefender Early Detection Center | _cdas[random].exe | CyberDefender Early Detection Center rogue security software - not recommended. On testing with a clean image, this reported registry entries pointing to the legitimate Java "jqs_plugin.dll" file (located in %ProgramFiles%\Java\jre6\lib\deploy\jqs\ie as the Anticlear rogue (see an example here). In addition, it claimed that the installer for an older version of HashTab contained W32.MalwareF.KJAE and quarantined a valid 7-zip file ("7zCon.sfx" in %ProgramFiles%\7-Zip) as W32/Malware. Also read this post where a Tech Support person uses other free tools such as MBAM to fix a problem |
| X | CyberDefender Early Detection Center | cdas[random].exe | CyberDefender Early Detection Center rogue security software - not recommended. On testing with a clean image, this reported registry entries pointing to the legitimate Java "jqs_plugin.dll" file (located in %ProgramFiles%\Java\jre6\lib\deploy\jqs\ie as the Anticlear rogue (see an example here). In addition, it claimed that the installer for an older version of HashTab contained W32.MalwareF.KJAE and quarantined a valid 7-zip file ("7zCon.sfx" in %ProgramFiles%\7-Zip) as W32/Malware. Also read this post where a Tech Support person uses other free tools such as MBAM to fix a problem |
| X | CyberDefender Early Detection Center | ISSIntro.exe | CyberDefender Early Detection Center rogue security software - not recommended. On testing with a clean image, this reported registry entries pointing to the legitimate Java "jqs_plugin.dll" file (located in %ProgramFiles%\Java\jre6\lib\deploy\jqs\ie) as the Anticlear rogue (see an example here). In addition, it claimed that the installer for an older version of HashTab contained W32.MalwareF.KJAE and quarantined a valid 7-zip file ("7zCon.sfx" in %ProgramFiles%\7-Zip) as W32/Malware. Also read this post where a Tech Support person uses other free tools such as MBAM to fix a problem |
| X | cyberfree.exe | ****.dat [* = random char] | Unidentified adware |
| U | Cyberhawk | CHTray.exe | Cyberhawk from Novatix. Protects against viruses, spyware, identity theft |
| U | CyberLat Ram Cleaner | CLRamCleaner.exe | CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| U | CyberLat Ram Cleaner | CyberLat Ram Cleaner 1.1.exe | CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind |
| U | cyberlink brs | brs.exe | Part of CyberLink's PowerDVD Blu-ray and DVD player. Allows the user to change the region coding of their player (as long as it isn't hardware coded) up to a maximum of 5 times |
| N | CyberLink Live | CLHomeMediaServer.exe | System Tray access to the CyberLink Live remote media access service |
| ? | CyberLink Live | CLPushUpdate.exe | Part of the CyberLink Live remote media access service. It's exact purpose isn't know at present but it may be related to automatic updates |
| U | CyberLink MediaLibrary Service | CLMLSvc.exe | Installed with Power2Go and PowerCinema from CyberLink and used to manage the media libraries, providing advanced file search, browsing and tracking. Also included with versions of PowerCinema bundled (and re-branded) with systems from Acer, Dell, ASUS and others. Some report it uses excessive system and memory resources |
| N | CyberLink PlayMovie | PMVService.exe | Preloads movie related parts of CyberLink's PowerCinema digital home entertainment software to speed up the launch of that feature. Only required on slower/older systems |
| N | CyberLink PowerCinema | PCMAgent.exe | Preloads parts of CyberLink's PowerCinema digital home entertainment software to speed up the launch of the main program. Only required on slower/older systems and if disabled it loads when required via an instance of svchost.exe |
| N | Cyberlink PowerCinema 3.0 | PCMService.exe | Part of Cyberlink's PowerCinema - which can be used to watch movies, play music and even watch TV in a central location. Commonly, PC manufacturers will base their own multimedia player/organizer on PowerCinema (such as Dell's Media Experience and Acer's Arcade Deluxe). Disabling this entry will not prevent PowerCinema working and doing so can prevent problems such as the screensaver not starting or a laptop not entering standby/hibernation/sleep-mode |
| N | CyberLink TV Enhance | TVEService.exe | Preloads TV related parts of CyberLink's PowerCinema digital home entertainment software to speed up the launch of that feature. Only required on slower/older systems |
| N | CyberLink YouCam Tray | YouCamTray.exe | System Tray access to YouCam from CyberLink - effects software for webcams |
| N | CyberMedia Agent | CMAGENT.EXE | Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled |
| U | CyberPatrolNew | cphq.exe | "CyberPatrol is one of the most powerful and popular client-based, browser independent, Internet safety software solutions for Windows-based standalone PCs available today" |
| X | CyberWolf | CyberWolf.exe | Added by the KICKIN.A (or CYDOG.C) WORM! |
| X | CyDoor | CD_Load.exe | CyDoor adware |
| X | CydoorUpdate | CD_Load.exe | CyDoor adware |
| ? | CYNHKey | CYNHKey.exe | ?? |