| Status | Autorun name | Command | Description |
| X | gouday.exe | readme.exe | Added by the BEAGLE.C WORM! |
| X | govurarope | Rundll32.exe retasevo.dll,s | Added by the BHO-HG TROJAN! The "retasevo.dll" file is found in %System% |
| X | GP Updater | gpupdater.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | GPLv3 | [random name].dll | Vundo adware |
| X | gpmce | window.exe | Added by the VB.CK WORM! |
| X | gqgqqger | gqgeqegl.exe | Added by the SDBOT-CLJ WORM! |
| X | gqvqevs | seeffkme.exe | Added by the SDBOT-QD WORM! |
| N | GRA | gra.exe | Looks at system resources at startup and warns you if they have dropped. Contains links to the Disk Clean Up, Defrag and Start Up Menu. It does have a link to a startup configuration utility. Similar to msconfig but can keep a list of disabled apps. Not really necessary. Only appears if you load the Gateway Startup Utility |
| ? | gramdate | 2Stop.exe | ?? |
| X | Graphic Driver | smss32.exe | Added by a variant of the RBOT WORM! |
| X | Graphic Loader | ntvdm32.exe | Added by a variant of the RBOT WORM! |
| X | Graphic Update | openglx.exe | Added by the IRCBOT.AMU WORM! |
| X | Graphics | _default.pif | Added by the AUTOSKY WORM! |
| X | Graphics adapter service | windll.exe | Added by the ATNAS.A WORM! |
| U | Gravis Appawareloader | dbserver.exe | Looks like it's associated with Gravis game controllers and the Keyset Manager, allowing the user to program the buttons for games that don't support them |
| U | Gravis Xperience Driver Support | Grxp4exe.exe | Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used |
| ? | GrdSys32 | GrdSys32.exe | X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand? |
| X | GreasyPalmUpdate | GreasyPalmUpdate.exe | SearchFast adware |
| X | GreatDefender | GreatDefender.exe | GreatDefender rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| X | GreatDefender.exe | GreatDefender.exe | GreatDefender rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| X | GreatDownloads | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| N | Greetings Workshop | GWREMIND.EXE | You really want to be reminded about somebody's birthday at the expense of resources? |
| X | gremier | wscript.exe gpremier.vbs | Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The "gpremier.vbs" file is located in %System% |
| X | Gremlin | intrenat.exe | Added by the DOOMJUICE WORM! |
| X | grgtgvgb.exe | [random].exe | Added by the AGENT-EBF TROJAN! |
| X | grinders | grinders.exe | Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example |
| N | Grokster | Grokster.exe | Grokster peer-to-peer (P2P) file-sharing client - now defunct |
| Y | Groove Virtual Office | Groove.exe | "Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings, store files and folders, save threaded discussions, scribble on whiteboards, share calendars, and track project information and timelines." Formerly by Groove Networks - now owned by Microsoft and part of MS Office |
| U | GrooveMonitor | GrooveMonitor.exe | Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. "A collaboration software program that helps teams work together dynamically and effectively, even if team members work for different organizations, work remotely, or work offline". GrooveMonitor is responsible for synchronizing the Groove workspaces between the users PC and those of other workspace participants. If you don't use Groove to collaborate with co-workers you can safely disable this entry |
| U | GrooveMonitor Utility | GrooveMonitor.exe | Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. "A collaboration software program that helps teams work together dynamically and effectively, even if team members work for different organizations, work remotely, or work offline". GrooveMonitor is responsible for synchronizing the Groove workspaces between the users PC and those of other workspace participants. If you don't use Groove to collaborate with co-workers you can safely disable this entry |
| U | GroupWise PDA Connect - 3CmPlm | AutoDet.exe | 3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell |
| U | GroupWise PDA Connect - GrpWse | Agnt.exe | GroupWise PDA Connect PDA synchronisation utility - from Novell |
| U | GroupWise PDA Connect - PocketPC | AUTODE~1.EXE | Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell |
| U | GroupWise PDA Connect - ScheduleSync | SCHEDU~1.EXE | ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell |
| N | GrpConv | grpconv.exe | Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article |
| X | GsAds | gms2.exe | PacerD Media/Pacimedia.com adware |
| ? | Gscbc | Gscbc.exe | ?? |
| X | gshp | zzgshp.vbs | Homepage hi-jacker |
| N | Gsiconexe | Gsicon.exe | ADSL modem monitor from Eicon Networks (now Dialogic). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities |
| ? | GsiFinal | rundll32 gspndll.dll,postInstall final | USB DSL modem related. What does it do and is it required? |
| ? | GSISETUP | [path] GsiInst.exe INSTALL [path] V205Res 13 | BT Voyager ADSL modem related - what does it do and is it required? |
| N | GSOrganizer | GSOrganizer.exe | GoldenSection Organizer (now WinOrganizer - personal information manager) |
| X | gssomatic | gssomatic.exe | Searchcentrix hijacker |
| Y | gStart | gStart.exe | Garmin Training Center® software for their sports GPS devices. "Track and analyze your fitness activities with Garmin Training Center. Use it to review activity history as well as create workouts and send them to your Garmin fitness device" |
| X | GStartup | GMT.exe | Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here |
| X | gsv | gsv.exe | Added by the ROBAL 1.0 backdoor TROJAN! |
| X | GT | GT.EXE | Added by the SDBOT-AJ WORM! |
| X | GT15J4R49V | cpuserv.exe | Identified as a variant of the Trojan.Win32.Radi.gu malware |
| U | GTVEpg | GTVEpg.exe | Part of Got All Media - control your TV tuner and other utilities from your PC |
| U | GTVRec | GTVRec.exe | Part of Got All Media - control your TV tuner and other utilities from your PC |
| N | Gtwatch | gtwatch.exe | Associated with a Mustec scanner and not required |
| X | gtydf | iisca.exe | Added by the CLAGGER-BB TROJAN! |
| X | gtydf | iscca.exe | Added by the DWNLDR-GTK TROJAN! |
| X | gtydf | ggrrgg.exe | Added by the DLOADR-AZK TROJAN! |
| U | Guard | Guard.exe | Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program |
| X | Guard Pro | VH339.exe | Guard Pro rogue security software - not recommended, removal instructions here |
| Y | Guard.Mail.ru.gui | GuardMailRu.exe | Associated with Mail.Ru - "the largest free e-mail service of the Runet". Guard Mail.Ru - is "a multifunctional safety management programs to protect your PC from unwanted user actions" |
| X | GuardCenter | GuardCenter.exe | GuardCenter rogue security software - not recommended |
| Y | GuardGui Application | GuardGui.exe | System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG. |
| U | Guardian | CMGrdian.exe | McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security, Browser Buddy, File Guardian and help. Included with older versions of McAfee Internet Security and possibly others |
| U | Guardian PC Security Tools | Pfft.exe | Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite |
| X | GuardPcs.exe | GuardPcs.exe | GuardPcs rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| X | GuardWWW | GuardWWW.exe | GuardWWW rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| X | guarnset | guarnset.exe | Adlogix adware |
| X | GuideOn | GuideOn.exe | PinGuide adware |
| X | gummy | gummy.exe | Added by the VANEBOT-AQ WORM! |
| X | GURL | gurl.exe | GURLWatcher spyware |
| U | GuruNet | GuruNet.exe | GuruNet lets you click on any word on your screen to get the relevant information you want |
| X | GustavVED | [filename].exe | Added by the OPASERV.H WORM! |
| X | gvagfxj | rundll32 ...gvagfxj.dll | Unidentified adware, spyware or virus |
| Y | GW Port Controller | PORTCT95.EXE | From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties, the file is known as "Smart Thru Fax Drive Spy" and is supplied by Samsung |
| N | GWInkMonitor | GWInkMonitor.exe | Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink, do you want to buy some! |
| X | gwiz | ntsystem.exe | Added by the NITWIZ.A TROJAN! |
| X | gwiz | arpl.exe | Detected by F-Prot as W32/Downloader-Sml-based |
| N | GWMDMMSG | GWMDMMSG.exe | Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly |
| U | GWMDMpi | GWMDMpi.exe | Patch for internal modems on Gateway 450 and 500 series laptops. Required for audio settings to be maintained and does not remain in memory once run |
| U | GWUM | gwum.exe | Gigabyte utility manager. Loads if you have a Gigabyte motherboard and got a full bundle of utilities installed. Monitors CPU, fans, BIOS etc. Only used by system "tweakers" |
| ? | gyy | gyy.exe | Possibly Gator (and therefore spyware) related? |
| U | H/PC Connection Agent | WCESCOMM.EXE | Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier), supporting mobile devices based upon the Windows CE OS (such as Pocket PC, Handheld PC and Windows Mobile). Automatically launches ActiveSync (if enabled) when the mobile device is connected. If disabled it will re-instate the next time ActiveSync runs - hence the reluctant "U" recommendation |
| Y | H2O | cledx.exe | Related to copyright protection products by SyncroSoft |
| U | H2OWIBU | CXWibu.exe | Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware |
| X | h4te Service Drivers | h4te.exe | Added by a variant of the RBOT WORM! |
| U | Habu | razerhid.exe | Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros |
| X | hachimitsu-lemon | hachimitsu-lemon.exe | Added by the HACHILEM TROJAN! |
| X | HackMuFpt | HackMuFpt.exe | Added by the SCLOG-AG TROJAN! |
| X | hadespeter | firefx_.exe | Added by the AGENT-QVT TROJAN! |
| X | hagent | avp.exe | Added by the "Herman Agent" remote access TROJAN! |
| X | Halflife | halflife2.exe | Added by the AGOBOT-OC BACKDOOR! Note - this file is not associated with Valve Corporation's Half-Life 2 game |
| U | HalifaxHowardCluster | skinkers.exe | "Howard the Weatherman" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages |
| U | HalloweenDesktop | HalloweenDesktop.exe | Animated desktop gadget included with the Halloween theme for MyColors from Stardock Corporation |
| Y | Hamachi | hamachi.exe | LogMeIn Hamachi remote control and VPN software |
| U | HaMFrontPanel | hampanel.exe | Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget, but otherwise pointless |
| U | Handy Backup 3.9 | hbagent.exe | Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers |
| X | HanUpdate | hanz.exe | Added by the RBOT-GLJ WORM! |
| N | Hard Disk Sentinel | HDSentinel.exe | Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find, test, diagnose and repair hard disk drive problems, display hard disk health, performance degradations and failures |
| X | Hard drive Controller | hdcontroller.exe | Added by the KIMAN.B WORM! |
| X | HardDriveGuard | SysRep.exe | HardDriveGuard rogue system error and cleaning utility - not recommended, removal instructions here. A member of the ErrClean family |
| U | Hardware Doctor | Hwdoctor.exe | Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds, voltages, temperatures. Only required if you're concerned about your system temperature - typically for "overclocked" systems |
| X | Hardware Monitor Service | mshms.exe | Added by the WOLLF-A TROJAN! |
| X | Hardware Profile | hxdef.exe | Added by the LOVGATE.AB WORM! |