| Status | Autorun name | Command | Description |
| X | dwgrun | dwgrun.bat | Added by the DWGUN.A VIRUS! |
| U | DWHeartbeatMonitor | DWHeartbeatMonitor.exe | DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference |
| N | DwlClient | support.exe | Download manager for Dell support alerts |
| X | dwm | dwm.exe | Added by the AGENT-WS MALWARE! Note - this is not the legitimate Desktop Window Manager (dwm.exe) process from Vista/7 which loads as a service and is found in %System%. This one is located in %Temp% |
| X | dwqblwppx.exe | [random].exe | Okcashbackmall adware |
| X | dwqblwpvl.exe | [random].exe | Okcashbackmall adware |
| X | dwqblwrsq.exe | [random].exe | Okcashbackmall adware |
| U | DWQueuedReporting | dwtrig20.exe | Used to launch Microsoft Error Reporting (DW20.exe) - if, for example, there have been an error downloading malware definition updates for Windows Defender - which gives the user the chance to send the error report to Microsoft to improve their software |
| N | dwStart | FireWall.exe | The Shield firewall from pcsecurityshield.com. Not recommended by some (see here) and there are better free alternatives out there such as Zone Alarm. Located in %ProgramFiles%\PCSecurityShield\The Shield Firewall |
| U | dwtrig20 | dwtrig20.exe | Used to launch Microsoft Error Reporting (DW20.exe) - if, for example, there have been an error downloading malware definition updates for Windows Defender - which gives the user the chance to send the error report to Microsoft to improve their software |
| X | Dx | sys*.exe [* = random number] | Added by the DEXTER.A WORM! |
| X | Dx8compat | Dx8compat.exe | Added by the GEMA TROJAN! |
| X | dxdiag diagnose | msidxdia.exe | Added by a variant of the RBOT WORM! |
| X | dxdiags.exe | dxdiags.exe | Added by the CERTIF-G TROJAN! |
| X | DxDialog | dxdlg32.exe | Added by the VB-CXT TROJAN! |
| X | dxdll32 | ntxdll.exe | Added by the GAOBOT.CPX WORM! |
| N | dxdllreg | dxdllreg.exe | Registers with Windows the DLL (Dynamic Link Library) files that are part of Microsoft DirectX9. Created when you select "Yes" to check the "WHQL Digital signatures" in the DirectX9 files at the first time you open it after a manual installation or after a new application is installed that also installs DirectX9. This entry should only appear once and can cause boot error messages if it remains so remove it |
| N | DXDllRegExe | dxdllreg.exe | Registers with Windows the DLL (Dynamic Link Library) files that are part of Microsoft DirectX9. Created when you select "Yes" to check the "WHQL Digital signatures" in the DirectX9 files at the first time you open it after a manual installation or after a new application is installed that also installs DirectX9. This entry should only appear once and can cause boot error messages if it remains so remove it |
| X | DxLoad | DX3DRndr.exe | Added by the GIBE.B WORM! |
| N | DXM6Patch_981116 | p_981116.exe | Win32 cabinet self extractor. More info here |
| X | dxmsrv | dxmsrv.exe | Added by an unidentified WORM or TROJAN! |
| X | Dxsty | Dxsty.exe | Added by the GEMA TROJAN! |
| X | Dxupdate.exe | Dxupdate.exe | Added by the MAFEG WORM! |
| X | dxvid | dxvid.exe | Added by the DLUCA-Y TROJAN! |
| X | DyFuCA | optimize.exe | Adult content dialler - see here |
| X | DyFuCA Active Alert | actalert.exe | Adult content dialler - see here |
| X | Dynamic DHCP | dydhcp.exe | Added by the RINBOT.B BACKDOOR! |
| X | Dynamic Dns Binary | dynitora.exe | Added by the RBOT-WT WORM! |
| X | Dynamic Dns Binary | CMD16.EXE | Added by the RBOT-XM WORM! |
| X | Dynamic Dns Binary | winxp34.exe | Added by a variant of the RBOT WORM! |
| X | Dynamic Dns Binary | WinHelpcfn.exe | Added by a variant of the RBOT WORM! |
| X | Dynamic Link Library loader | Loader32.exe | Added by the KOL TROJAN! |
| U | DynDNS Updater | DynDNS.exe | Dynamic DNS IP address updater tool, used as a client for Dynamic DNS service providers such as http://www.DynDNS.org |
| N | DynDNS-Updater Traytool | ddutray.exe | DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually |
| X | DynHttp Dns Binary | dynizari.exe | Added by a variant of the RBOT WORM! |
| U | DynSite | DynSite.exe | DynSite - dynamic DNS client, also called an automatic IP updater |
| U | Dynu Basic Client | dynubas.exe | Dynu online dynamic IP update client. Useful when using a dial up modem |
| ? | DZKillMe | DZSAVEME.EXE | ?? |