| Status | Autorun name | Command | Description |
| Y | CleanUp | CleanUp.exe | Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case, the file is located in %System% and is listed under the HKLM\RunOnce registry key |
| X | CleanUp Antivirus | CU[random characters].exe | Cleanup Antivirus rogue security software - not recommended, removal instructions here |
| X | CleanUp3 | launcher.exe CleanUp3Up.exe | CleanUp3 rogue security software - not recommended, removal instructions here. Both files are located in %ProgramFiles%\CleanUp3 |
| ? | CleanupProgram | cleanup.exe | Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder |
| X | CleanupTool | SysRep.exe | CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family |
| X | CleanVMain | CleanV.exe | CleanV rogue security software - not recommended, removal instructions here |
| U | Clear meter bar | Clear meter bar .exe | Clear Meter Bar widget for the DesktopX desktop utility from Stardock Corporation. Displays free drive space, free memory, CPU usage and system running time on the desktop with a clear background. Once started, Clear meter bar .exe loads a file called "DXWidget.exe" and exits |
| U | Clear meter bar | CLEARM~1.EXE | Clear Meter Bar widget for the DesktopX desktop utility from Stardock Corporation. Displays free drive space, free memory, CPU usage and system running time on the desktop with a clear background. Once started, Clear meter bar .exe loads a file called "DXWidget.exe" and exits. This is the XP MSConfig entry where "Clear meter bar .exe" is shown as "CLEARM~1.EXE" |
| U | CleverKeys | CK.exe | CleverKeys - "is free software that provides instant access to definitions at Dictionary.com, synonyms at Thesaurus.com, facts at Reference.com and more - from almost all Windows programs, including word processors, Web browsers and most e-mail programs" |
| U | CleverKeys | ClvrKeys.exe | Older version of CleverKeys - which "is free software that provides instant access to definitions at Dictionary.com, synonyms at Thesaurus.com, facts at Reference.com and more - from almost all Windows programs, including word processors, Web browsers and most e-mail programs" |
| X | clfmon | clfmon.exe | Added by the TACTSLAY.E TROJAN! |
| X | clfmon | nvsvca32.exe | Added by the TACTSLAY.E TROJAN! |
| X | clfmon.exe | clfmon.exe | Added by the AGENT-BJ TROJAN! |
| N | CLHomeMediaServer | CLHomeMediaServer.exe | System Tray access to the CyberLink Live remote media access service |
| X | Cli Confg | cliconfig.exe | Added by a variant of the SPYBOT WORM! See here |
| X | CLI Services | clisrv.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| N | Click Radio Tuner | clickr~1.exe | ClickRadio - subscription service playing radio music via the internet |
| N | Click Tray Calendar | ClickT~1.EXE | ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc |
| N | ClickMe | ClickMe.exe | ClickM "JOKE" program |
| U | Clickoff | Clickoff.exe | Clickoff automatically dismisses annoying dialog boxes |
| X | ClickPotatoLiteSA | ClickPotatoLiteSA.exe | ClickPotato adware |
| N | ClickSight Launcher | cs.exe | Launcher for the ClickSight® marketing tool from ClickStream Technologies - which "is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product" |
| X | ClickTheButton | CTB.EXE | ClickTheButton adware |
| X | ClickTheButton | csrss.exe | ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a "drivers" subfolder |
| X | ClickTheButton | cd_load.exe | Added by the DOWNLOADER-MY TROJAN! |
| X | CLICONFG | CLICONFG.EXE | Added by the OPASERV.T WORM! |
| ? | Client Access API Daemon | cwbappcd.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | Client Access Check Version | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| ? | Client Access Express Welcome | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | Client Access Help Update | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| ? | Client Access PC5250 Sound | pcssnd.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. "The Client Access Express PC5250 emulator provides desktop users with a graphical user interface for existing iSeries applications" - see here. What does it do and is it required? |
| N | Client Access Service | CwbSvStr.Exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| ? | Client Access Taskbar | cwbuitsk.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| X | Client Agent | ipxwping.exe | Added by the PPDOOR-N TROJAN! |
| X | Client Agent | photes.exe | Added by the PPDOOR-P TROJAN! |
| X | Client Agent | [path to file] | Added by the PPDOOR-J TROJAN! |
| ? | Client agent for ARCserve | W95AGENT.EXE | Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? |
| Y | Client and Host Security Platform | ccApp.exe | Part of older versions of Symantec's security products including Norton 360, Norton Internet Security, Norton AntiVirus and the now discontinued Norton SystemWorks suite. Effectively the "master" process which calls the different program features and makes sure they are running. Auto-protect and E-mail check will not function without this |
| X | Client for Microsoft Networks | msclient32.exe | Added by the SDBOT-BXQ WORM! |
| N | Client Security Solution | cssauth.exe | Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect |
| X | Client Server Control Process | [path to trojan] | Added by the AGENT-HR TROJAN! |
| X | Client Server Run Time Proccess | csrsrv.exe | Added by a variant of the SDBOT WORM! |
| X | Client Server Runtime | [path to worm] | Added by the POEBOT-KR WORM! |
| X | Client Server Runtime Process | csrsss.exe | Added by the SDBOT-LD WORM! |
| X | Client Server Runtime Process | csrs.exe | Added by the LINKBOT.M WORM! |
| X | Client Server Runtime Process | smmss.exe | Backdoor TROJAN! Possible SDBOT-GEN variant |
| X | Client Update | wup.exe | Added by the OPANKI.O WORM! |
| Y | Cliente DLO | DLOClientu.exe | Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005 |
| X | ClientMan1 | mscman.exe | ClientMan parasite variant |
| N | Clik Status Monitor | toolsclickstat.exe | Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed |
| X | Clip Service Manager | clipmg.exe | Added by the DELF.DXJ TROJAN! |
| X | Clip Servicer | clipsrvc.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Clip Srv | clipsv.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | clipboard.exe | clipboard.exe | Added by an unidentified WORM or TROJAN! |
| N | Clipbook Service | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| U | clipdiary | clipdiary.exe | Clipdiary from Softvoile - "Free Clipboard Manager for keeping the clipboard history" |
| N | ClipMate5x | ClipMt5x.exe | Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clipmate6 | CLIPMT60.EXE | Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | ClipMate7 | ClipMate.exe | Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard |
| N | Clipomatic | Clipomatic.exe | Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data |
| N | Clipsrv | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| X | ClipSrv | clipserv.exe | Added by the SDBOT-AAV and SDBOT-AFE WORMS! |
| X | ClipSrv | CLIPBRD3D.EXE | Added by the MOFEI-D WORM! |
| X | ClipSrv | clipservr.exe | Added by the SDBOT-AFE WORM! |
| X | ClipSrv | clipsrv.exe /waitservice | Added by the HORST.Q TROJAN! Note - this is not the legitimate clipsrv.exe which is always located in %System%. This one is located in either %Windir%, %Windir%\System, %Temp%, %AppData%, %AppData%\Microsoft or %System%\drivers |
| X | Clipsvc | clipsv.exe | Added by the BLACKHOLE.F BACKDOOR! |
| N | ClipTrak | ClipTrak.exe | ClipTrak - clipboard extender |
| N | ClipTrakker | ClipTrakker.exe | Cliptrakker - clipboard extender |
| N | CLIStart | CLIStart.exe | Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs |
| X | clkhost | [path to trojan] | Added by the WIXUD-B TROJAN! |
| N | CLMemoSysTray | CLMemoSysTray.exe | System Tray access to YouMemo from CyberLink - which "is an extremely intuitive way to write notes and reminders in a fun and easy environment" and is "designed specifically as a multi-touch application supporting the latest touch hardware" |
| N | CLMemoSysTray Application | CLMemoSysTray.exe | System Tray access to YouMemo from CyberLink - which "is an extremely intuitive way to write notes and reminders in a fun and easy environment" and is "designed specifically as a multi-touch application supporting the latest touch hardware" |
| U | CLMFrontPanel | clmpanel.exe | System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost |
| U | CLMLServer | CLMLSvc.exe | CyberLink MediaLibrary Service - installed with Power2Go and PowerCinema from CyberLink and used to manage the media libraries, providing advanced file search, browsing and tracking. Also included with versions of PowerCinema bundled (and re-branded) with systems from Acer, Dell, ASUS and others. Some report it uses excessive system and memory resources |
| U | CLMLServer for HP TouchSmart | CLMLSvc.exe | CyberLink MediaLibrary Service - included with the version of CyberLink's PowerCinema installed on the HP Touchsmart range of desktops and notebooks and used to manage the media libraries, providing advanced file search, browsing and tracking. Some report it uses excessive system and memory resources |
| U | CLMLSvc | CLMLSvc.exe | CyberLink MediaLibrary Service - installed with Power2Go and PowerCinema from CyberLink and used to manage the media libraries, providing advanced file search, browsing and tracking. Also included with versions of PowerCinema bundled (and re-branded) with systems from Acer, Dell, ASUS and others. Some report it uses excessive system and memory resources |
| ? | clnwall | rundll.exe setupx.dll, InstallHinfSection ..delwall.inf | ?? |
| X | clock | [various filenames] | LiveChat Adware - known file names include: mssetup.exe, kstatus.exe, spoolsv.exe, sptsupd.exe, osk.exe, msswchx.exe, netdde.exe, msbkup.exe |
| X | Clock Manager | amsngr.exe | Added by the SDBOT-XM TROJAN! |
| X | ClockSync | Sync.exe | ClockSync - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available |
| U | ClockWise | CLOCKWISE.EXE | ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync |
| U | ClocX | ClocX.exe | ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms, etc |
| U | CloneCD | CloneCDTray.exe | System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | CloneCDElbyCDFL | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | CloneCDTray | CloneCDTray.exe | System tray for the now discontinued CloneCD. The only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| ? | Clotusorgreg0 | prtStart.exe [path] Orgprt.exe | IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? |
| ? | CLPushUpdate | CLPushUpdate.exe | Part of the CyberLink Live remote media access service. It's exact purpose isn't know at present but it may be related to automatic updates |
| X | Clre | mmdc.exe | Added by the PURSCAN-AI TROJAN! |
| X | ClrSchLoader | [path to file] | ClearSearch adware |
| X | cls_pack.exe | cls_pack.exe | Added by the Malware Defense rogue security software. Also detected as the FAKEAV-AQB TROJAN! |
| X | CLSID | com.exe | Adult content dialler |
| X | CLSID | dll.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Adult content dialler |
| X | CLSID | plugin.exe | Adult content dialler |
| X | CLSID | sed.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension |
| X | CLSRSS | LSACS.EXE | Added by the SILLYFDC-X WORM! |
| U | Club-Internet_McciTrayApp | McciTrayApp.exe | System tray access to Motive's broadband configuration and repair utility - for Club-Internet users |
| U | ClUpdate | ClUpdate.exe | Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys |
| ? | CM-SmWizard | SmWizard.exe | SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? |