| Type | Name | Status | Path/File | Description |
| Winlogon Notify | agpbrdg0 | X | agpbrdg0.dll | Troj/Banker-DMN |
| Winlogon Notify | alcomt | X | %SYSDIR\alcomt.dll | Goldun_variant
|
| Winlogon Notify | alcopt | X | %SYSDIR%\alcopt.dll | Haxdoor_variant |
| Winlogon Notify | Antiwpa | X | %SYSDIR%\antiwpa.dll | Illegal Windows crack |
| Winlogon Notify | App Management, App Paths, Applets, BITS, Control Panel, Controls Folder, CSCSettings, DateTime, Dynamic Directory, Explorer | X | random named dll in the System32 folder | Variant of Adware.Look2Me |
| Winlogon Notify | arm32reg | X | Documents\Settings\arm32.dll | Troj/Xorpix-F |
| Winlogon Notify | arprmdg0 | X | arprmdg0.dll | Troj/Haxdoor-DI |
| Winlogon Notify | artm_newreg | X | Documents and Settings\All Users\Documents\Settings\artm_new.dll | Trojan-Proxy.Win32.Xorpix |
| Winlogon Notify | asusrx20 | X | asusrx20.dll | Troj/Haxdoor-CZ |
| Winlogon Notify | ataswl | L | ataswl.dll | Webex |
| Winlogon Notify | ati2kaag | X | %SYSDIR%\ati2kaag.dll | Goldun variant |
| Winlogon Notify | ati2krtg | X | %SYSDIR%\ati2krtg.dll | Goldun variant |
| Winlogon Notify | atiddaxx | X | atiddaxx.dll | Goldun variant |
| Winlogon Notify | atietaxx | X | atietaxx.dll | Goldun variant |
| Winlogon Notify | atixdaxx | X | atixdaxx.dll | Goldun variant |
| Winlogon Notify | atixdbxx | X | atixdbxx.dll | Goldun variant |
| Winlogon Notify | atmgrtok | L | atmgrtok.dll | IBM |
| Winlogon Notify | audmgr | X | %SYSDIR%\audmgr32.dll | W32/Stratio-BW |
| Winlogon Notify | avgwlntf | L | avgwlntf.dll | AVG |
| Winlogon Notify | avldr | L | avldr.dll | Panda Titanium 2006 Antivirus |
| Winlogon Notify | avload32 | X | avload32.dll | Haxdoor.gj |
| Winlogon Notify | avpe32 | X | avpe32.dll | Haxdoor |
| Winlogon Notify | avpu32 | X | avpu32.dll | Troj/Haxdoor-ED |
| Winlogon Notify | avpx32 | X | avpx32.dll | Haxdoor |
| Winlogon Notify | AwayNotify | L | %Program Files%\Lenovo\AwayTask\AwayNotify.dll | Lenovo/IBMTools |
| Winlogon Notify | awtqq | X | awtqq.dll | Spyware.Virtumonde variant |
| Winlogon Notify | axdebugl | X | axdebugl.dll | TR/PSW.PdP.CT.1.E.3 |
| Winlogon Notify | blur | X | %SYSDIR%\[random named].dll | Trojan-Downloader.Win32.Small.esa |
| Winlogon Notify | bmtdhh | X | bmtdhh.dll | Haxdoor |
| Winlogon Notify | bnreg | X | C:\Documents and Settings\All Users\Documents\Settings\bn.dll | Trojan-Proxy.Win32.Xorpix.Fam |
| Winlogon Notify | bootrom8 | X | %SYSDIR%\bootrom8.dll | Goldun_variant |
| Winlogon Notify | botreg | X | bot.dll, partneship.dll, dn.dll in %All Users%\Documents\Settings | Xorpix-variant |
| Winlogon Notify | browsela | X | browsela.dll | Trojan.Downloader.Delf variant |
| Winlogon Notify | brwmgr | X | brwmgr32.dll | WORM_STRAT.EF |
| Winlogon Notify | bt848rom | X | bt848rom.dll | Troj/Goldun-CW |
| Winlogon Notify | Caveo | L | CaveoSVR.DLL | Caveo |
| Winlogon Notify | cdscsix3 | X | cdscsix3.dll | Goldun variant |
| Winlogon Notify | cfgmngr32, hk.dll, cfgmngr321.dll | X | cfgmngr32.dll | Trojan.Downloader.Delf variant |
| Winlogon Notify | ckpNotify | L | ckpNotify.dll | CheckPoint Security |
| Winlogon Notify | CMGShieldNP | L | \CMG Shield\CMGShieldNP.dll | Credant |
| Winlogon Notify | Command AntiVirus Download | L | Command AntiVirus Download.dll | Command AntiVirus |
| Winlogon Notify | ComPlusSetup | L | catsrvut.dll | Part of Microsoft ComPlus |
| Winlogon Notify | ConMain | X | ConMain.dat | Troj/Bdoor-CPK |
| Winlogon Notify | crehcjid | X | %SYSDIR%\crehcjid.dll | Lockspy_aka_Pharvest_Worm |
| Winlogon Notify | crypt | X | %SYSDIR%\crypts.dll | Downloader-BAR |
| Winlogon Notify | crypt32net | X | crypt32net.dll | Troj/Banworm-H |
| Winlogon Notify | crypta | X | cryptsa.dll | Downloader-BAR |
| Winlogon Notify | cryptimg | X | %SYSDIR%\cryptimg.dll | Trojan/Backdoor |
| Winlogon Notify | CwWLEvent | L | cwplc001.dll | Content_Watch |
| Winlogon Notify | davctool | X | davctool.dll | Stration/Warezov |