| Status | Autorun name | Command | Description |
| U | Symantec NetDriver Warning | SNDWarn.exe | Part of Symantec Live Update - displays the warning when you need to update the firewall database |
| U | Symantec PIF AlertEng | PIFSvc.exe | Symantec LiveUpdate Notice Service |
| X | Symantec Secure Server | svrhost.exe | Added by the IRCBOT-UB TROJAN! |
| X | Symantec Security | symantec32.exe | Added by the RANDEX.PR or RANDEX.YR WORMS! |
| X | Symantec Security Addon | nvsvc.exe | Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here |
| X | Symantec Security Routine Addon | navpaw.exe | Added by the AGOBOT-ES BACKDOOR! |
| X | Symantec Security Routine Addon for Microsoft Windows | navpxaw32.exe | Added by the AGOBOT-GJ TROJAN! |
| Y | Symantec Security Technologies | ccApp.exe | Part of older versions of Symantec's security products including Norton 360, Norton Internet Security, Norton AntiVirus and the now discontinued Norton SystemWorks suite. Effectively the "master" process which calls the different program features and makes sure they are running. Auto-protect and E-mail check will not function without this |
| X | Symantec Service | ccApp.exe | Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename |
| X | symanteccsysconf | bsyys.scr | Added by the VACILL-A WORM! |
| X | SymantecFilterCheck | svhost.exe | Added by the BANKER-EEO TROJAN! |
| X | SymantecFilterCheck | gmilogof.exe | Added by the BANKER-EKC TROJAN! |
| X | SymantecFilterCheck | [path to trojan] | Added by the BANKER-EIN TROJAN! |
| X | SymantecFilterCheck | bsyys.scr | Added by the BANLOAD.DZC TROJAN! |
| X | SymAV | SymAV.exe | Added by the NETSKY.U WORM! |
| U | SymKeepAlive | CKA.exe | Part of Symantec's now discontinued Norton SystemWorks security and utility suite. Keeps a dial-up modem connection alive |
| X | Symlcs | [path to file] | Added by the YASPY-A TROJAN! |
| X | Symmetrical Network | symmec.exe | Added by the DELBOT-N WORM! |
| U | SymmTime | GeTTime.exe | SymmTime from Symmetricon - freeware utility that "synchronizes your PC clock to Coordinated Universal Time (UTC), the high precision atomic time standard" |
| U | SymmTime | SymmTime.exe | Older version of SymmTime from Symmetricon - freeware utility that "synchronizes your PC clock to Coordinated Universal Time (UTC), the high precision atomic time standard" |
| U | SymmTime Application | GeTTime.exe | SymmTime from Symmetricon - freeware utility that "synchronizes your PC clock to Coordinated Universal Time (UTC), the high precision atomic time standard" |
| Y | Sympatico Security Manager | Rps.exe | Main program for the Sympatico Security Manager internet security suite for Bell Canada ISP customers - sourced by Radialpoint |
| X | SymRun | N/A | Added by the KANGAROO-A TROJAN! |
| X | SymRun | ccApps.exe | Added by the KAGEN-A TROJAN! |
| N | SymTray - Norton SystemWorks | SymTray.exe | Keeps all System Tray icons for older versions of Symantec's now discontinued Norton SystemWorks utility suite together to reduce clutter. SystemWorks includes Norton Anti-Virus, Norton Utilities, Norton CleanSweep and others - dependent upon the version |
| U | Synaptics Pointing Device Driver | SynTPEnh.exe | Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads, which are common on many laptops. Required to display the System Tray icon and support enhanced features such as Tap Zones, Virtual Scrolling and EdgeMotion. If you don't use these features this can safely be disabled. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll |
| U | Synaptics Pointing Device Driver | SynTPLpr.exe | Synaptics TouchPad driver helper - included with drivers for Synaptics based TouchPads, which are common on many laptops. Works in conjunction with SynTPEnh and is required if you use any of the enhanced features such as Tap Zones, Virtual Scrolling and EdgeMotion |
| Y | SynAsusAcpi | SynAsusAcpi.exe | Part of the Synaptics touchpad driver for the Asus Eee PC range |
| U | Sync Data | Hndsync.exe | Pocket Real Estate - mobile synchronization manager |
| X | Sync Server | drwatsoon.exe | Added by the WATSOON.A TROJAN! |
| U | Sync-It | Syncit.exe | Sync-It - synchronizes the system clock with time servers on the internet |
| U | SyncAgent | syncagent.exe | Ghost Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | Synchronization Agent | mobsynca.exe | Added by the RANDEX-E WORM! |
| U | Synchronization Manager | mobsync.exe | Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline, such as documents, calendars, and e-mail messages. Available via Start → All Programs → Synchronize, this entry appears if you select Setup → "When I log on to my computer" |
| X | Synchronization Manager | rservers.exe | Added by the FORBOT-FM WORM! |
| X | Synchronization Messager | [trojan filename].exe | Added by the THROD.A TROJAN! The filename is a random combination the following: ms, svc, win, 16, 32, 64, mes, prn, reg - "ms16prn.exe", for example - and is located in %System% |
| X | syncman | winsync.exe | Added by the MANCSYN-A TROJAN! |
| X | syncman | wuaucldt.exe | Added by the NAMSYS-A TROJAN! |
| X | SyncMan | SyncMan.exe | Added by the AGENT-BNYL TROJAN! |
| X | SyncManager | msorunner.exe | Added by a variant of the TACTSLAY TROJAN! |
| X | SyncMon | adslcomdos.exe | Added by the CLUNKY-A TROJAN! |
| X | SyncMon | fixcomdos.exe | Added by the CLUNKY-B TROJAN! |
| X | syncpatch | syncpatch.exe | MyClean rogue security software - not recommended, removal instructions here |
| X | SynNglp | MsgrUpd.exe | Added by the BANKER-EZM TROJAN! |
| X | SynNglp | synnglp.exe | Added by the DELF.MP TROJAN! |
| ? | SynSetup | SynTP.tmp RunOnce.exe | Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required? |
| X | Syntax | windows32.exe | Added by the SDBOT.CQ WORM! |
| X | Syntax Script | systacq.exe | Added by the SDBOT.AI WORM! |
| X | Syntax Script | saskatcw.exe | Added by the SDBOT-TE WORM! |
| U | SynTPEnh | SynTPEnh.exe | Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads, which are common on many laptops. Required to display the System Tray icon and support enhanced features such as Tap Zones, Virtual Scrolling and EdgeMotion. If you don't use these features this can safely be disabled. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll |
| U | SynTPLpr | SynTPLpr.exe | Synaptics TouchPad driver helper - included with drivers for Synaptics based TouchPads, which are common on many laptops. Works in conjunction with SynTPEnh and is required if you use any of the enhanced features such as Tap Zones, Virtual Scrolling and EdgeMotion |
| U | SynTPStart | SynTPStart.exe | Synaptics Pointing Device starter belonging to Synaptics Pointing Device Driver |
| X | syre32 | syre32.exe | Added by the VBNA.B WORM! |
| X | sys | regedit /s sys.reg | Raxmus adware. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file "sys.reg" is located in %Windir% |
| X | sys | regedit sysdllwm.reg | CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN! |
| X | sys | Fonts.exe | Added by the AUTORUN.BUK WORM! |
| X | sys | rundll32.exe | Added by the LINEAG-G TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in %Windir% (98/ME) or %System% (NT/2K/XP). This one is located in %Windir%\Intel |
| X | Sys Ren | SysRen.exe | Part of FlashEnhancer adware |
| X | Sys**.exe [* = random char] | Sys**.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| X | Sys**32.exe [* = random char] | Sys**32.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| X | Sys-Stat | wuapdxe.exe | Added by the SDBOT.HK WORM! |
| X | sys[random numbers] | [path to file] | WinBo adware |
| X | SYS_CLEAN | Service.exe | Added by the FLOPCOPY WORM! |
| U | Sys_Kl | sys_kl.exe | SysKeylog surveillance software. Uninstall this software unless you put it there yourself |
| X | Sys_Run | ghost.exe | Added by the LINEAGE-N TROJAN! |
| X | sys_Runtt1 | explorer.exe | Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles% |
| X | sys_up1 | svchostsys.exe | Added by the MULTIDR-FL TROJAN! |
| X | sys008 | sys008.exe | Hijacker, also detected as the STARTPA-GK TROJAN! |
| X | sys009 | sys009.exe | Added by the STARTPA-ZB TROJAN! |
| X | SYS1 | system.exe | Added by the SILLYFDC-AP WORM! |
| X | SYS1 | explorar.exe | Added by the SILLYFDC.BDJ WORM! |
| X | SYS1 | scvost.com | Added by the AUTOIT-JY WORM! |
| X | SYS2 | bad1.exe | Added by the SILLYFDC-AP WORM! |
| X | sys201 | sys209.exe | Added by the STARTPA-ZY TROJAN! |
| X | Sys29 | win***32.exe [* = random char] | EliteBar adware |
| X | SYS3 | bad2.exe | Added by the SILLYFDC-AP WORM! |
| X | sys32 | SYS32.EXE | Added by the FLUX.E BACKDOOR! The file is located in %System% |
| X | sys32 | sysx32.exe | Added by the KVEX-A VIRUS! |
| X | Sys32 | Sys32.exe | Added by the AUTORUN-KL WORM! The file is located in %Windir% |
| X | sys32_nov | sys32_nov.exe | Added by the AGENT-LAX TROJAN! |
| U | sys32cmd | sys32win.exe | Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | sys32dll | sys32dll.exe | Added by the AIMDES.B WORM! |
| U | sys32sql | sys32win.exe | Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! |
| U | Sys32V2Contoller | mw2mmgr32.exe | FamilyKeyLogger.a keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | sys33 | sys33.exe | Added by the AGOBOT-WJ WORM! |
| X | SYS4 | bad3.exe | Added by the SILLYFDC-AP WORM! |
| X | sys64_nov | sys64_nov.exe | Added by the MUTANT.FKA TROJAN! |
| X | SysA | win***32.exe [* = random char] | EliteBar adware |
| U | SysAgent | SysAgent.exe | SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of |
| X | SysAI | SysAI.exe | AproposMedia adware |
| X | sysalgg | sysalgg.exe | Added by the TIBS.BF WORM! |
| X | Sysanalysing | myrvc.exe | Added by the AUTORUN-RD WORM! |
| X | SysAntivirus 2009 | sysav.exe | SysAntivirus 2009 rogue security software - not recommended, removal instructions here |
| U | sysApp | sklgr.exe | SuperKeylogger surveillance software. Uninstall this software unless you put it there yourself |
| X | SysATW | sysatw.exe | Added by the VANEBOT-AM WORM! |
| X | sysav | winav.exe | WinPC Antivirus rogue security software - not recommended, removal instructions here |
| U | SysBkup | [path to file] | Keyspy keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | SysBoot | syskernel.exe | Added by the AUTORUN-EY WORM! |
| U | Sysbot | sysbot.exe | Spector - spying (or monitoring) software to record internet activity |
| X | Syscenter | syscenter.exe | Added by the CRYPTER TROJAN! |