| Status | Autorun name | Command | Description |
| X | winzip | ir_ftp.exe | Added by the BANCBAN-S TROJAN! |
| X | Winzip Application | winzip81.exe | Added by the RBOT-BKZ WORM! |
| X | Winzip Compression Utility | Winzip32.exe | Added by the SDBOT-UI BACKDOOR! |
| N | WinZip Quick Pick | WZQKPICK.EXE | Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up |
| X | WinZip Update | WinZip.exe | Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility |
| X | winzip32 | winzip32.exe | Added by the BANCBAN-OE TROJAN! Note - this is not part of the popular WinZip file compression utility |
| X | WinZix Service | wakeservice.exe | WinZix adware |
| X | winzSystam | xly.exe | Added by a variant of the SDBOT WORM! |
| X | WIP Config GUI | Winipcfgs.exe | Added by the RBOT-CN WORM! |
| U | Wireless 802.11g USB Adapter | ZDWlan.exe | Wireless LAN configuration utility for ZyDAS (now acquired by Atheros) based chipsets |
| U | Wireless Adapter Manager | ZDWlan.exe | Wireless LAN configuration utility for ZyDAS (now acquired by Atheros) based chipsets |
| X | Wireless Conections | WireConnect.exe | Added by the SDBOT-VF WORM! |
| U | Wireless Configuration Utility | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.14 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.15 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.31 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.32 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.51 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Configuration Utility HW.61 | WlanCU.exe | Wireless LAN configuration utility |
| U | Wireless Connection Manager | wirelesscm.exe | Wireless adapter configuration utility for D-Link's range |
| X | Wireless Connections | WIRECONNECT.EXE | Added by the SDBOT-VM WORM! |
| N | Wireless Console | wcourier.exe | ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices |
| N | Wireless Console 2 | wcourier.exe | ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices |
| N | Wireless Console 3 | wcourier.exe | ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices |
| U | Wireless LAN USB Dongle | ZDWlan.exe | Wireless LAN configuration utility for ZyDAS (now acquired by Atheros) based chipsets |
| U | Wireless PCI Card Configuration Utility | WMP11Cfg.exe | Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration |
| U | Wireless Presenter | Wireless Presenter.exe | "Use your Nokia phone as a remote control for your PC with Nokia Wireless Presenter. Using Bluetooth wireless technology, this software allows you to control your Windows desktop applications." Used in conjuction with phones that have the companion application installed, such as the 6290 and 6110 Navigator |
| X | Wireless Provider Server | wpsvr.exe | Added by the FORBOT-AD WORM! |
| U | Wireless Switching Setting Utility | Switcher.exe | On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN, Bluetooth, both) when turning the wireless switch on if disabled) |
| Y | Wireless-G Notebook Adapter | Gcc.exe | LinkSys Wireless-G Notebook Adapter driver |
| U | Wireless-G Notebook Adapter Utility | WPC54CFG.EXE | Utility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G) |
| X | Wireless.exe Nacional | Wireless.exe | Added by the VBINJ-T TROJAN! |
| U | WireLessKeyboard | PS2USBKbdDrv.exe | Wireless keyboard driver |
| U | WireLessKeyboard | StartAutorun.exe PS2USBKbdDrv.exe | Wireless keyboard driver |
| U | WireLessKeyboard | PS2USBKbdDrv.exe | Wireless keyboard driver. Note - the "Name" field has a space at the end |
| U | WireLessMouse | StartAutorun.exe MouseDrv.exe | Wireless mouse driver |
| U | WireLessMouse | MouseDrv.exe | Wireless mouse driver |
| U | WireLessMouse | MouseDrv.exe | Wireless mouse driver. Note - the "Name" field has a space at the end |
| X | wise | clockwise.exe | Added by the LAZAR-A TROJAN! |
| X | wistaantivirus | wistaantivirus.exe | Wista Antivirus rogue security software - not recommended, removal instructions here |
| X | WIZZ | dazzler.exe | Detected by Kaspersky as the DIALER.IS TROJAN! |
| N | wkcalrem | wkcalrem.exe | If you schedule an event at any time in Microsoft Works Calendar and set a reminder then a shortcut will be added to Start → All Programs → Startup so this reminder service loads every time Windows starts |
| N | WkDetect | WkDetect.exe | Checks for updates to MS Works |
| N | wkfud | wkfud.exe | A marketing program for MS Works |
| N | WksSb | WksSb.exe | The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file |
| X | WksSVC | EXPLORER.exe | Added by the MYTOB-BW WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System% |
| N | WkUFind | WkUFind.exe | MS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site. You can also turn of the automatic update feature within Picture It! - see here |
| X | Wkyo86 | [path to worm] | Added by the PITIN-A WORM! |
| X | wl | svhost32.exe | Added by the WOWPWS-AF TROJAN! |
| X | Wlan Drier | Winusb2.exe | Added by the WOOTBOT.DC WORM! |
| X | Wlan Driver | avscan.exe | Added by the WOOTBOT.DH WORM! |
| U | WLAN Manager | WLANManager.exe | Wireless management utility for the T-Com Speedport W 100 Card WLAN PCMCIA card |
| N | WLAN Status Tray Applet | WLANSTA.EXE | System Tray icon for checking the status of a Wireless LAN |
| Y | WLAN_Cfg.exe | WLAN_Cfg.exe | Linksys Instant Wireless USB Network Adapter driver |
| U | wlancfg | wlancfg.exe | Inventel wireless router related - required in order to automatically connect to the Net at bootup |
| Y | wlancfg5 | wlancfg5.exe | NetGear WG311v3 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient |
| N | WLANSTA.EXE | WLANSTA.EXE | System Tray icon for checking the status of a Wireless LAN |
| X | wlinles | svchost.exe | Added by the LIJI-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the "spool" sub-folder |
| X | WLiveCD.exe | WLiveCD.exe | Added by the VB-EQI TROJAN! |
| X | wlm | [path to trojan] | Added by the BANCOS-BCY TROJAN! |
| X | wlsass | wlsass.exe | Added by the RANKY.CY TROJAN! |
| N | wltray | wltray.exe | System tray access to wireless LAN card configuration options |
| N | wltray.exe | wltray.exe | System tray access to wireless LAN card configuration options |
| X | WLWin | WINSYS.EXE | Added by the NAVER.A WORM! |
| X | wm | svhost32.exe | Added by the LINEAGE.CIS TROJAN! |
| N | WM VCR | WMVCR.exe | WM Recorder allows you to record Windows Media(tm) streaming Video or Audio content. Can be accessed via Start Menu -> Programs |
| ? | WM_LOGIN | MSGLOGIN.EXE | Part of McAfee Firewall. What is it for and is it needed? |
| Y | Wm24Pan | Wm24Pan.Exe | ESI external sound card driver |
| X | wm41a398 | rundll32.exe wm41a398.dll, EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wm41a398.dll" file is found in %System% |
| X | WMAudio | services.exe | Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | WMAudio | winlogon.exe | Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! |
| N | WMBoot | N/A | Associated with Logitech Wingman game controllers. Not required but what does it do? |
| N | WMC_RebootCheck | unregmp2.exe | Corrects problems with installations of Windows Media Player from version 9 onwards - see here and search for "unregmp2.exe" |
| X | wmcbaaca | rundll32.exe wmcbaaca.dll, EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wmcbaaca.dll" file is found in %System% |
| X | WMDM PMSP Service | cssrss.exe | Added by the KNOCKIT-A TROJAN! |
| X | WMedia32 | wmedia32.exe | Added by the BANGER TROJAN! |
| X | WMI Application Interface | wmiapi.exe | Added by the SPYBOT.RBY WORM! |
| X | WMI Performance Adapter Services | wmiapsrvs.exe | Added by the RBOT.COU BACKDOOR! |
| X | WMI Service Client | wmispv.exe | Added by the AUTORUN-ASX WORM! |
| X | WMI Standard Event Consumer - hosting | scrcs.exe | Added by the IRCBOT.ATP WORM! |
| X | WMI Standard Event Consumer - Scripting | scrcons32.exe | Added by the RBOT-GRD WORM! |
| X | wmi32 | wmimgmt.exe | Added by the AUTORUN-AVX WORM! |
| X | wmi32 | winmgmt.exe | Added by the AUTORUN.HT WORM! |
| U | WMIEXE.exe | wmiexe.exe | NT component, used by Windows Millennium to detect Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed |
| X | Wminf | Wminf.exe | Added by the GEMA TROJAN! |
| X | Wminfo | Wminfo.exe | Added by the GEMA TROJAN! |
| X | wmiprevse | wmiprevse.exe | Added by the BANKER-EPN TROJAN! |
| X | wmiprv | wmiprv.exe | Added by the RBOT-WM WORM! |
| X | wmisrv | wmisrv.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | wmon | jusched.exe | Added by the AGOBOT-OW WORM! Note that this is not the legitimate Oracle (was Sun Microsystems) file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System% |
| X | WMP Auto Update | WINMEDUP.EXE | Added by the RBOT.CF WORM! |
| Y | WMP54Gv4 | WMP54Gv4.exe | Linksys WMP54Gv4 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first, disabling slipcore and slipgui are insufficient |
| X | wmplayer | vergon1885.exe | Added by the BRONTOK-DG WORM! |
| X | wmplayer | lsrvc.exe | Added by the SDBOT-CRY WORM! |
| X | wmplayer | mplayer2.exe | Added by the VB.AG WORM! |
| X | wmplayer | wmplayer.exe | Added by the BANCOS.VN TROJAN! Note - this is not the valid Windows Media Player as the file is located in %Root%\MessengerPlus rather than %ProgramFiles%\Windows Media Player |
| X | wmplayer | wmplayer.exe | Added by the AGOBOT-JH WORM! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player |
| X | wmplayer.exe | wmplayer.exe | Added by the BANCBAN-CZ TROJAN! Note - this is not the valid Windows Media Player as the file is located in %Windir% rather than %ProgramFiles%\Windows Media Player |
| U | WMPNSCFG | WMPNSCFG.exe | Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music, videos, and pictures to others on the network. This entry is used to notify users when new media rendering devices are found on the network (including media players and other PCs running Windows Media Player 11) - see here for a more detailed explanation |
| ? | WMPVer | WMPVer.EXE | Dritek System Inc. 3DMouse related. A 3D Mouse works in all 3-dimensions instead of the usual 2, similar to the Ninteno Wii Remote - see here. What does it do and is it required? |