| Status | Autorun name | Aufruf | Beschreibung |
| X | [various names] | prcmon.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Preliminary.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | prgsys0984.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | progmen.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | qwe.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | RtlFindVal.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SAPSTR.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | sbin.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | scanSYS.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Serviceprocess.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SetupExeDll.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Shaitan1678.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | slamm.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | sound64.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SpyElim.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | srbho.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | ssweeper.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | StartCpl.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | startman.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | StatusCheck.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | stuffmon.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | sysconf16.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SysEntry.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | sysmon12.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | syspanel.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SysSupport.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | SYSTRAV.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | TemplateDongle.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | teqq32.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Testimonials.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | TForm1.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | TorontoMail.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Trayz.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | TRPT.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | trycrt.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | elf.exe | Elf is a hacker program, tied to a trojan server |
| X | [various names] | crsrs.exe | Added by the FORBOT-AK WORM! |
| X | [various names] | Windows32.exe | Added by any of a number of WORM or TROJAN variants |
| X | [various names] | bling.exe | Added by the RBOT-NI WORM! |
| X | [various names] | mediaplayer32.exe | Added by a variant of the RBOT WORM! |
| X | [various names] | winlogon32.exe | Added by an unidentified WORM or TROJAN! |
| X | [various names] | svchostss.exe | Added by a variant of the RBOT WORM! |
| X | [various names] | win32snd.exe | Added by the RBOT-DQ WORM! |
| X | [various names] | shch.exe | Premium rate adult content dialler |
| X | [various names] | PasswdMon.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | runload32.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | dstart2.exe | Adware - detected by Kaspersky as the SMALL.ALW TROJAN! |
| X | [various names] | msdos32.exe | Added by a variant of the AGENT.AH TROJAN! |
| X | [various names] | sitebar.exe | Added by an unidentified TROJAN! |
| X | [various names] | driver32.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | _ctcp.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | 10010.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | 321102.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | 34763.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | abrek.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | ActionScr.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | AliceSD.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | AppMasterCenter.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | atl_helper.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | ATLIEHELPER.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | avpmondll.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | awinrar.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | backd.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | backorif.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | barint.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | bhoserv.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | bingo9.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | bnui.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Bogobot.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | borlandg.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | BoundRec.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | br0ken.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Brong32.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | clamav.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | cmon14.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | cnftips.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | control64.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | corrida.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | CToolBar.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page. This is not the same as the legitimate IE toolbar called Crawler Toolbar which uses the same filename |
| X | [various names] | DCC_send.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | defect08.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | Dest068.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | [various names] | dialer423.exe | Fake startup entry created by the Wareout rogue spyware and dialer remover - not recommended, removal instructions here. Archived version of Andrew Clover's original page |
| X | \IEService.exe | IEService.exe | FastFind adware variant |
| X | \Pribi.exe | Pribi.exe | FastFind adware variant |
| X | \SysInit | svchost.exe | Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files |
| X | \tools.exe | tools.exe | FastFind adware variant |
| X | ^`d}qZxu | ~`d}qzxu3zYF | Added by the GAOBOT.GEN!POLY WORM! |
| N | ^SetupICWDesktop | icwconn1.exe | Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start → All Programs → Accessories → Communication (or similar) anyway |
| X | _ | mzqdd.exe | Added by the AGENT.BZB TROJAN! |
| X | _ | dcbcg.exe | Added by the AGENT-HMT TROJAN! |
| Y | _AntiSpyware | MssCli.exe | Part of McAfee AntiSpyware |
| Y | _AntiSpyware | masalert.exe | Part of McAfee AntiSpyware |
| X | _Cat1 | nmmst.exe | Added by the SMALL.SD TROJAN! |
| X | _Cat2 | nmstt.exe | Added by the SMALL-DT TROJAN! |
| X | _Cat3 | msmsgrxp.exe | Added by a variant of the SMALL-DT downloader TROJAN |
| X | _Cat4 | msmsgr2.exe | Added by the SMALL-EB TROJAN! |
| X | _explore manager | _explore.exe | Added by the SPEXTA-C TROJAN! |
| X | _Hazafibb | [path to file] | Added by the ZAFI.B WORM! |
| X | _mzu_stonedrv2 | _mzu_stonedrv2.exe | Added by a variant of the DWNLDR-FTB TROJAN! |
