| Status | Autorun name | Command | Description |
| X | KIT3 | hpprintqueue.exe | Added by the ADCLICK-DS TROJAN! |
| X | kjEenXNPEgLSP | kjEenXNPEgLSP.exe | Added by the FAKEAV-MD TROJAN! |
| U | KK Loader | loadkk.exe | KeyKey XP Professional from KeyKey.com. "Monitor Instant Messages, Chats, Emails, Web Site URLs, Passwords, Computer Programs, Start Up and Shut Down time and much more completely undetected to the user." |
| X | KKM Service | kkm.exe | Added by the NANPY-I WORM! |
| X | KL AntiFunLove | flcss.exe | Added by the FUNLOVE.4099 VIRUS! |
| U | KLog | Keyspy.exe | KeyLoggPro.B keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | klop | [path to file] | Added by the AGENT-WQ TROJAN! |
| X | klop | [random].tmp | Found with Trojan.Win32.StartPage.aw. Possibly a variant of the AGENT-WQ TROJAN! |
| U | klp | run32dll.exe | PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online |
| U | klp | explorer.exe | ComSurveilSys keystroke logger/monitoring program - remove unless you installed it yourself! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\PAL\CSS |
| U | KM9801U | MMHotKey.exe | Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen |
| X | kmmsoft | revo.exe | Added by the AUTORUN-QR WORM! |
| U | kmw_run.exe | kmw_run.exe | Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features |
| U | kmw_show.exe | kmw_show.exe | Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features |
| U | KN_PanelApp | PanelApp.exe | KnowledgePanel online survey software |
| X | KnowledgeBase GUI | wppewafaj.exe | Added by the RBOT-GRZ WORM! |
| N | Kodak Batch Transfer | pezdow1.exe | Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC |
| U | Kodak EasyShare software | EasyShare.exe | Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually |
| N | Kodak Picture Easy *.* Batch Transfer | PezDownload.exe | Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version |
| N | Kodak Picture Transfer Software | pts.exe | Looks for Kodak camera connection and media insertion. Available via Start -> Programs |
| N | Kodak Software Updater | backweb*****.exe | Software updater for Kodak Easyshare digital cameras |
| N | KODAK Software Updater | Kodak Software Updater.exe | Software updater for Kodak Easyshare digital cameras |
| Y | KodakCCS | KodakCCS.exe | Kodak DC File System Driver |
| X | kokv | iebar.exe | DesktopMedia A adware |
| U | Komunikator | tlen.exe | Tlen - a Polish language instant messaging client |
| U | KONICA MINOLTA magicolor 2400W STD | MSTMON_S.EXE | Konica Minolta Magicolor 2400W colour printer monitor |
| N | Konni Symbol Autostart | KonniSymbol.exe | Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5 |
| N | kontiki | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| Y | KPDrv4XP | KPDrv4XP.exe | Multimedia keyboard/keypad/mouse driver. Required if you use the additional keys |
| Y | KPFW32.EXE | KPFW32.EXE | KingSoft Personal Firewall |
| Y | KPFWSvc.EXE | KPFWSvc.EXE | KingSoft Personal Firewall |
| X | Kr0n1C | Kr0n1C.exe | Added by the BRONTOK-BO WORM! |
| X | krag | krag.exe | Added by the AGENT-FOW WORM! |
| U | Kraidman | Kraidman.exe | "Toshiba RAID Support is a Toshiba EasyGuard feature that uses RAID Level 1 technology to minimise downtime by protecting against data loss and ensuring quick data recovery" - for Toshiba laptops |
| U | Krait | razerhid.exe | Razer Krait gaming mouse driver - required if you use the additional features and programmed keys/macros |
| U | KREC32 | krec32.exe | KBMonitor keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | KRNL | Kernl32.exe | Added by the ZOMBY.B BACKDOOR! |
| U | krnl16 | elgolf.exe | Elgolf keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | Krnlcheck | csrss.exe | Added by the BOTNACHALA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| U | Krnlmod | Krnlmod.exe | Keystroke logger/monitoring program - remove unless you installed it yourself! |
| U | Kryptel Component Start | Kicker.exe | Kryptel encryption software |
| X | ksrlnhm | zxatgso.exe | Added by the DLOADER-LI TROJAN! |
| X | Ksrv32 | Ksrv32.exe | Added by the AGOBOT-PI WORM! |
| X | KTAX Auto Loader | ktax.exe | Added by the SDBOT-MZ WORM! |
| U | ktchnsnk | ktchnsnk.exe | HP program found with the Office Jet 500/600/700 series which initializes the Office Jet manager each time the computer is booted up or rebooted |
| Y | KTPWare | ktp.exe | Related to KTP Ware TSR Enhancements from ELANTECH |
| X | KV_HOST | cxjx.exe | Added by the LEGMIR-BB TROJAN! |
| X | KV2005 | word.EXE | Added by the VB-IW TROJAN! |
| X | kv3000 | lover.vbe | Added by the ZSYANG.B WORM! |
| X | kvasoft | kva8wr.exe | Added by the ONLINEG.ICC WORM! |
| X | kvern16.dll | regsvr32.exe kvern16.dll | DailyWinner adware. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The "kvern16.dll" file is found in %System% |
| X | kviurs | kav.exe | Added by the SILLYFDC.BBJ WORM! |
| X | KvmSecure.exe | KvmSecure.exe | KvmSecure rogue security software - not recommended, removal instructions here |
| X | Kvsc3 | Kvsc3.exe | Added by the PWS-ANM TROJAN! |
| X | kw3eef76 | rundll32.exe kw3eef76.dll,EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "kw3eef76.dll" file is found in %System% |
| N | kX Mixer | kxmixer.exe | Provides Mixer and Control functionality to KxProject Audio driver for EMU10k based soundcards |
| U | KX509 | kx509_kfwk5.exe | Kerberos Secure Authentication for Windows |
| X | kxswsoft | ierdfgh.exe | Added by the AUTORUN-AAT WORM! |
| U | KXT01_Keyboard | KXT01KB.EXE | Multimedia USB keyboard manager. Required if you use the additional keys |
| Y | KXT01_KPDrv4XP | KPDrv4XP.exe | Multimedia USB keyboard driver. Required if you use the additional keys |
| X | kxva | kxvo.exe | Added by the AUTORUN-DY WORM! |
| ? | KYE_Showicon | shwicon.exe | Card reader for memory cards from digital cameras. Is it required? |
| X | KYK Control Settings | KYSVCXD.EXE | Added by a variant of the RBOT WORM! |
| X | KYM Control Settings | phqghum.exe | Added by the RBOT.BQD WORM! |
| X | L0aders | faxneti.exe | Added by a variant of the SDBOT TROJAN! |
| X | l44sys** | freecell | Added by the VBS.LIDO WORM - where ** is a number between 1 and 12 |
| X | l44sys** | iexplore | Added by the VBS.LIDO WORM - where ** is a number between 65 and 76 |
| X | l44sys** | winmine | Added by the VBS.LIDO WORM - where ** is a number between 33 and 44 |
| X | L4r1$$a | L4r1$$a.pif | Added by the ASSIRAL-C WORM! |
| U | Lachesis | razerhid.exe | Razer Lachesis gaming mouse driver - required if you use the additional features and programmed keys/macros |
| U | LaCie Backup | LaCieBackup.exe | LaCie '1-Click' backup software for their range of mobile hard drives |
| U | laim | aimlite.exe | "AIM Lite is a reference application for testing some new client technology developed here at AOL®, with the goal of being a simple, fun, light IM client" |
| X | laltin | L90112201.Stub.exe | Delfin Media Viewer adware related |
| X | lameshit | [path to trojan] | Added by the LOWZONE-H TROJAN! |
| X | LAN | dhcp.exe | Added by the RBOT-GYI WORM! |
| X | Lan | Lan.exe | Added by the DELF-IT TROJAN! |
| X | LAN Driver | landriver32.exe | Added by the RBOT.BT WORM! |
| X | lanbrup | lanbrup.exe | SafeSurfing adware |
| U | Lancement Application Fax | faxtray.exe | System Tray access to Fax-Internet (by Axmapresse) and SafeFax (by Alliance MCA) internet fax software |
| N | Lancement rapide d'Adobe Reader | reader_sl.exe | Speeds up the time it takes to load the free Adobe Reader PDF file viewer. "The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files". Not required for Adobe Reader to function properly. French version |
| U | LANDeskInventoryClient | LDIScn32.exe | LANDesk® Management Suite software component |
| N | Language | Language.exe | Part of CyberLink's PowerDVD Blu-ray and DVD player. Detects the Windows language version at startup and changes some of the language settings in PowerDVD accordingly. Although it unloads after running, unless the PC has multi-national users then leave it disabled |
| N | Language Application | Language.exe | Part of CyberLink's PowerDVD Blu-ray and DVD player. Detects the Windows language version at startup and changes some of the language settings in PowerDVD accordingly. Although it unloads after running, unless the PC has multi-national users then leave it disabled |
| U | LanguageMonitor | Oplmsb01.exe | OKI Printer language support monitor |
| N | LanguageShortcut | Language.exe | Part of CyberLink's PowerDVD Blu-ray and DVD player prior to version 8. Detects the Windows language version at startup and changes some of the language settings in PowerDVD accordingly. Although it unloads after running, unless the PC has multi-national users then leave it disabled |
| X | LanGuard | languard.exe | Adware downloader - also detected as the SECONDT-C TROJAN! |
| X | LanGuard | [path to trojan] | Added by the DLOADER-VO TROJAN! |
| X | lanmanwrk.exe | lanmanwrk.exe | Added by the AGENT.AIA TROJAN! |
| U | LANMessage Pro | LANMES~1.exe | LANMessage Pro - "a powerful tool for communicating with other people on your office/home network" |
| U | LanSpeed2 | LanSpeed2.exe | Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card) |
| ? | LantronixRedirector | red32.exe | Related to either the Secure Com Port Redirector or Com Port Redirector from Latronix. What does it do and is it required? |
| ? | LanzarL2007 | [path] setup.exe | ?? |
| U | LaoKey | LaoKey.exe | Lao Script for Windows (LSWin) is an extension to the Windows operating system to allow Lao language to be used with many different Windows-based applications |
| U | Laplink PDASync 3.0 - LtNts4 | NtsAgnt.exe | Laplink PDASync for (IBM) Lotus Notes 4 - PDA synchronisation utility |
| U | Laplink PDASync 3.1 - PocketPC | AUTODE~1.EXE | Laplink PDASync for Windows Mobile Pocket PC - PDA synchronisation utility |
| U | Laplink PDASync 3.1 - ScheduleSync | ScheduleSync.exe | Laplink PDASync for ScheduleSync - PDA synchronisation utility |
| U | LapLink scheduler | Llsched.exe | Utility that automatically performs file transfers as unattended background operations |
| X | Laptop Access | Sage.exe | Added by the SDBOT-NB WORM! |
| X | Lar | Llass.exe | Added by the INOR-A TROJAN! |
| X | lar | [trojan filename] | Added by the ROXY.C TROJAN! |