| Status | Autorun name | Aufruf | Beschreibung |
| Y | Kaspersky Anti-Virus 2006 | avp.exe | System Tray access to and notifications for Kaspersky Anti-Virus 2006 from Kaspersky Lab. Runs together with a related service - AVP - which runs a separate instance of the same file |
| Y | Kaspersky Anti-Virus 2006 (Beta) | avp.exe | System Tray access to and notifications for Kaspersky Anti-Virus 2006 from Kaspersky Lab. Runs together with a related service - AVP - which runs a separate instance of the same file |
| Y | Kaspersky Anti-Virus 2009 | avp.exe | System Tray access to and notifications for Kaspersky Anti-Virus 2009 from Kaspersky Lab. Runs together with a related service - Kaspersky Anti-Virus (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Anti-Virus 6.0 | avp.exe | System Tray access to and notifications for Kasperksy Anti-Virus 6.0 from Kaspersky Lab. Runs together with a related service - Kaspersky Anti-Virus 6.0 (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Anti-Virus 7.0 | avp.exe | System Tray access to and notifications for Kasperksy Anti-Virus 7.0 from Kaspersky Lab. Runs together with a related service - Kaspersky Anti-Virus 7.0 (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Anti-Virus Monitor | AvpM.exe | Kaspersky Anti-Virus Lite - no longer available |
| X | Kaspersky Antivirus | KasperskyAV.exe | Added by a variant of the RBOT WORM! |
| X | Kaspersky Email Security | javaupd.exe | Added by the SWARLEY.A WORM! |
| Y | Kaspersky Internet Security | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 7.0 from Kaspersky Lab. Runs together with a related service - Kaspersky Internet Security 7.0 (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Internet Security 2006 | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 2006 from Kaspersky Lab. Runs together with a related service - AVP - which runs a separate instance of the same file |
| Y | Kaspersky Internet Security 2006 (Beta) | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 2006 from Kaspersky Lab. Runs together with a related service - AVP - which runs a separate instance of the same file |
| Y | Kaspersky Internet Security 2009 | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 200#9 from Kaspersky Lab. Runs together with a related service - Kaspersky Internet Security (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Internet Security 6.0 | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 6.0 from Kaspersky Lab. Runs together with a related service - Kaspersky Internet Security 6.0 (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Internet Security 7.0 | avp.exe | System Tray access to and notifications for Kasperksy Internet Security 7.0 from Kaspersky Lab. Runs together with a related service - Kaspersky Internet Security 7.0 (AVP) - which runs a separate instance of the same file |
| Y | Kaspersky Password Manager | stpass.exe | Kaspersky Password Manager from Kaspersky Lab - "is an indispensable tool for the active Internet user. It fully automates the process of entering passwords and other data into websites and saves the user from going to the trouble of creating and remembering multiple passwords" |
| Y | Kaspersky PURE | stpass.exe | My Password Manager from an earlier version of Kaspersky PURE. Password management utilty which automates the process of entering passwords and other data into websites and saves the user from going to the trouble of creating and remembering multiple passwords |
| Y | Kaspersky Total Security | avp.exe | System Tray access to and notifications for an earlier version of the Kaspersky PURE security software. Runs together with a related service - Kaspersky PURE (AVP) - which runs a separate instance of the same file. This is the Vista/7 MSConfig and Windows Defender entry |
| X | kaspersky32 | kasperskyLabs32.exe | Added by the RBOT-GOT WORM! |
| X | KasperskyAv | kaspersky.exe | Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky anti-virus |
| X | KasperskyAVEng | Kasperskyaveng.exe | Added by the NETSKY.V WORM! |
| Y | KasperskyPasswordManager | stpass.exe | Kaspersky Password Manager from Kaspersky Lab - "is an indispensable tool for the active Internet user. It fully automates the process of entering passwords and other data into websites and saves the user from going to the trouble of creating and remembering multiple passwords" |
| X | KAT | KAT.vbs | Added by the SOAD-D WORM! |
| U | KatMouse | KatMouse.exe | KatMouse - utility to enhance the functionality of mice with a scroll wheel, offering 'universal' scrolling, etc |
| Y | kav | avp.exe | System Tray access to and notifications for older versions of internet security products from Kaspersky Lab - including Internet Security and Anti-Virus. Runs together with a related service - such as Kaspersky Internet Security (AVP) - which runs a separate instance of the same file. Also AOL's Active Virus Shield (by Kaspersky) - now discontinued. Found in either a Kaspersky or AOL sub-directory |
| X | kav | kav.exe | Added by the DOGROBOT TROJAN! Note - this is not a valid old version of Kaspersky AV and is located in %System% |
| X | kava | kavo.exe | Added by the LINEAG-GLG TROJAN! |
| X | KAVFOX | win1ogoin.exe | Added by the GWGHOST-M TROJAN! |
| X | kavir | kavir.exe | Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example |
| X | Kavirs | Kavirs.exe | Added by the AGENT-OJC TROJAN! |
| X | Kavirs1 | Kavirs1.exe | Added by the AGENT-OPY TROJAN! |
| X | KAVPersonal | svchost.exe | Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| Y | KAVPersonal50 | Kav.exe | Kaspersky Anti-Virus Personal 5.0 |
| X | KAVPersonal90 | wscntfy.exe | Added by the BANKER-FZ TROJAN! Note - this is not the legitimate Windows Security (wscntfy.exe) file which is located in %System%. This one is located in %Windir% |
| Y | KavPFW | KavPFW.exe | KingSoft Personal Firewall |
| X | KavRuns | Windll.exe | Added by the TRYNOMA TROJAN! |
| X | kavs | svchost.exe | Added by the AGENT-GLC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| Y | KavStart | KAVStart.exe | KingSoft Personal Firewall |
| Y | kavsvc | kavsvc.exe | Kaspersky antivirus |
| X | KavSvc | [random].exe | Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe, rzazzi.exe, ivpaan.exe) |
| X | KAVutil | [worm filename] | Added by the WINTOO.B WORM! |
| N | KAZAA | kazaa.exe | KAZAA is a file-sharing program which unfortunately being ad-based includes "Cy-door" adware. Check here for information about "Cy-door" and here for a program that can remove it |
| N | KAZAA | [path] kpp.exe [path] kazaalite.kpp | System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed |
| X | Kazaa Download Accelerator Updater (required) | regsvr32 kdp****.dll [* = random char] | SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System% |
| X | Kazaa lptt01 | kazaa.exe | RapidBlaster variant (in a "kazaa" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it. Note - this is not the valid KaZaA file sharing program which has the same executable name |
| X | Kazaa ml097e | kazaa.exe | RapidBlaster variant (in a "kazaa" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it. Note - this is not the valid KaZaA file sharing program which has the same executable name |
| X | KAZAACuf | 9 | Added by the KITRO.D (or ARGEN.A) WORM! |
| N | kazaalite | kazaalite.exe | Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original, this one does not contain any advertising or tracking mechanisms |
| N | KaZooM | KaZooM.Exe | KaZoom from Blue Haven Media - "add-on application that automatically speeds up the download process and finds the files you want with far more power than regular KaZaA searches" |
| X | kb | AUTO.txt | Added by the BRONTOK-CV WORM! |
| X | KB1883574.exe | KB1883574.exe | Malware Destructor 2011 rogue security software - not recommended, removal instructions here |
| Y | KB891711 | KB891711.exe | Installed by the Windows KB891711 critical update, see this security bulletin - this file reportedly needs to continue running in order to patch the vulnerability, at least until a more practical solution is found. There have however been reports of fatal exception errors in systems running Windows 98, and in such a case Microsoft advises to either uninstall the patch (Add/Remove Programs) or prevent it from running at startup |
| Y | KB918547 | KB918547.EXE | Bug-fix for a Microsoft graphics rendering engine vulnerability - see here. Windows 98/Me only |
| Y | KB926239 | rundll32.exe apphelp.dll, ShimFlushCache | Microsoft KB926239 fix. Windows Media Player 10 may close unexpectedly on a Windows XP-based computer |
| U | KBD | KBD.EXE | Multimedia keyboard manager. Required if you use the multimedia keys |
| U | KBD | KbdStub.EXE | Key Watcher from HP - watches for Multimedia Keys on HP keyboards |
| U | KBD MediaCenter | MEDIACTR.EXE | Multimedia keyboard manager. Required if you use the multimedia keys |
| X | kbddrv32 | kbddrv32.exe | Added by the CRYPTER.A TROJAN! |
| X | kbddrvinf | kbddrvinf.exe | Added by the CRYPTER.A TROJAN! |
| X | KbEkKJuBmaVdP | KbEkKJuBmaVdP.exe | Added by the FAKEAV-DIM TROJAN! |
| X | KBR95674904.exe | KBR95674904.exe | Added by the BCKDR-RHB BACKDOOR! |
| N | KCeasy | KCeasy.exe | KCeasy - a Windows peer-to-peer filesharing application which uses giFT as its 'back end' foundation. The networks currently supported are OpenFT and Gnutella |
| U | KClient | kstatus.exe | KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet |
| X | Kcrner | Kcrner.exe | Added by the LINEAG-AIL TROJAN! |
| X | kdmsx | [8 random letters].exe | Added by the SDBOT.AIJ BACKDOOR! |
| N | kdx | KHost.exe | Verisign Kontiki Delivery Management System - Windows-based client software that enables secure delivery of content to users' desktops |
| U | KE9801 | DriBat32.exe | KE9801 multimedia keyboard driver - required if you use the multimedia keys |
| X | Keenvalue | Keenvalue.exe | KeenVal adware |
| U | KeePass | KeePass.exe | Open source KeePass Password Safe password manager by Dominik Reichl - "which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file." See the comparison page for the differences between versions |
| U | KeePass 2 PreLoad | KeePass.exe | Part of version 2.x of the open source KeePass Password Safe password manager by Dominik Reichl - "which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file." See the comparison page for the differences between versions. Preloads parts KeePass into memory - not required if you have also enabled the program to run at startup (Options → Integration) |
| U | KeePass Password Safe | KeePass.exe | Version 1.x of the open source KeePass Password Safe password manager by Dominik Reichl - "which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file." See the comparison page for the differences between versions |
| U | KeePass Password Safe 1.* | KeePass.exe | Version 1.x of the open source KeePass Password Safe password manager by Dominik Reichl - "which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file." See the comparison page for the differences between versions. Vista/7 MSConfig and Windows Defender entry where 1.* represents the version number |
| U | KeePass Password Safe 2 | KeePass.exe | Version 2.x of the open source KeePass Password Safe password manager by Dominik Reichl - "which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file." See the comparison page for the differences between versions |
| X | KeepCop | KeepCop.exe | KeepCop rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| X | KeepCop.exe | KeepCop.exe | KeepCop rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| Y | KeepSafe | keepsafe.exe | KeepSafe from Stardock Corporation - "the intermediate step needed to secure data between backups. It saves your important files in real-time as you work on them" |
| U | KEI | rundll32.exe [path] KEI.dll | IKL surveillance software. Uninstall this software unless you put it there yourself |
| X | keiop | keiop.exe | Added by the VB-ERU TROJAN! |
| X | kell | liser.exe | Added by the AGENT.AUTP TROJAN! |
| U | KEMailKb | KEMailKb.EXE | Multimedia keyboard/keypad manager. Required if you use the additional keys |
| ? | Kemet | kemet.exe | ?? |
| X | keniz | keniz.exe | Added by the AUTORUN-AZL WORM! |
| U | KeNotify | KeNotify.exe | Toshiba utility found on their laptops. This program is responsible for the Toshiba LapTop Help 'FlashCards' utility that sits at the top of the screen giving easy access to the 'F keys' alternative functions such as Lock,Power Mode,Sleep etc |
| X | kERe | kERe.exe | Added by the BRONTOK-BT WORM! |
| U | Kerio VPN Client | kvpnclient.exe | Kerio VPN Client |
| X | kern64dll | [random filename] | Added by the TARNO.J TROJAN! |
| X | Kernal Fault Check | ntosrkl.exe | Added by a variant of the SDBOT WORM! |
| X | kernctl32 | rundll32 kctl32.dll, initialize | Added by the AGENT.AT TROJAN! |
| X | Kerne0223 | Kerne0223.exe | Added by the LEGMIR-ZA TROJAN! |
| X | Kernel | bboy.exe | Added by the MUMU.B WORM! |
| X | Kernel | services.exe | Added by the FOOZ-A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | kernel | kernel.exe | Added by the MATCASH.CF TROJAN! |
| X | Kernel | Update.exe | Added by the DELF-FN TROJAN! |
| X | Kernel | system.vbs | Added by the VBS/VIPINA VIRUS! |
| X | KERNEL 32 | SKERNEL32.com | Added by the SEMAPI-A WORM |
| U | Kernel and Hardware Abstraction Layer | KHALMNPR.EXE | Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice, trackballs, etc). When using SetPoint to adjust the mouse sensitivity it is maintained separately from the Windows setting, but is combined with the Windows setting to determine the final sensitivity. For this reason, this entry sets the Windows setting to 0 so it doesn't affect the one you set in SetPoint and then unloads. A separate instance of KHALMNPR.EXE loads via the main Setpoint.exe program to control communication between your radio/bluetooth wireless mouse/keyboard and SetPoint |
| X | Kernel Drivers | systemproc.exe | Added by the DWNLDR-ISX TROJAN! |
| X | Kernel Fault Check | ntvbm.exe | Added by the RBOT-CKP WORM! |
| X | Kernel Faults | ftphost.exe | Added by the RBOT.BHU WORM! |
| X | Kernel Loader | ntkrnl.exe | Added by the CERVIVEC.A WORM! |
| X | Kernel Manager | krnlmgr.exe | Added by the JUNY.A TROJAN! |
