| Type | Name | Status | Path/File | Description |
| Winlogon Notify | ddirectz | X | ddirectz.dll | Troj/Haxdoor-BS |
| Winlogon Notify | debugg | X | debugg.dll | Troj/Haxdoor-AC |
| Winlogon Notify | DeviceNP | L | %SYSDIR%\DeviceNP.dll | Hewlett-Packard |
| Winlogon Notify | DfLogon | L | LogonDll.dll | DeepFreeze |
| Winlogon Notify | dimsntfy | L | dimsntfy.dll | System file in Windows 2003 SP1 |
| Winlogon Notify | directpt | X | directpt.dll | Troj/Haxdoor-AX |
| Winlogon Notify | directut | X | directut.dll | Goldun variant |
| Winlogon Notify | divxps | X | %SYSDIR%\divxps.dll | Haxdoor variant |
| Winlogon Notify | divxrs | X | %SYSDIR%\divxrs.dll | Haxdoor |
| Winlogon Notify | docent0 | X | docent0.dll | Logger.Goldun variant (malware) |
| Winlogon Notify | docent2 | X | docent2.dll | Trojan.PWS.GoldSpy variant |
| Winlogon Notify | dpl1npwm | X | dpl1npwm.dll | Warezov/Stration-NZ |
| Winlogon Notify | DPWLN | L | DPWLEvHd.dll | DigitalPersona fingerprint reader |
| Winlogon Notify | drct16 | X | drct16.dll | Haxdoor |
| Winlogon Notify | drtw3a | X | drtw3a.dll | Haxdoor |
| Winlogon Notify | dvb03a and other ****3a (**** = random) | X | ****3a.dll | Haxdoor |
| Winlogon Notify | dvd4free | X | dvd4free.dll | Trojan/Spy.Goldun.de.1 |
| Winlogon Notify | dxmamcia | X | %SYSDIR%\dxmamcia.dll | Stration/Warezov variant |
| Winlogon Notify | EESP | L | eelsto.dll | Entrust® Entelligence Login |
| Winlogon Notify | eetvpn | X | eetvpn.dll | Troj/Haxdoor-DL |
| Winlogon Notify | efccdda | X | %SYSDIR%\efccdda.dll | Troj/Agent-GAU |
| Winlogon Notify | EFS | L | %SYSDIR%\sclgntfy.dll | Secondary Logon Service Notification |
| Winlogon Notify | EMClient | L | %SYSDIR%\EntWinlogon.dll | Spyware_Doctor_Enterprise_Client |
| Winlogon Notify | emldvc | X | emldvc.dll | Goldun variant |
| Winlogon Notify | emul65 | X | emul65.dll | Haxdoor variant |
| Winlogon Notify | eventss | X | atmpvc.dll | Troj/Festod-A |
| Winlogon Notify | ewsmsg | X | %SYSDIR%\ewsmsg.dll | Haxdoor |
| Winlogon Notify | explorer | X | explorer.dll | Troj/SCLog-B |
| Winlogon Notify | Extensions, H323TSP, Hints, Installer, Internet Settings, IPConfTSP, Media Center, MediaContentIndex, ModuleUsage | X | random named dll in the System32 folder | Variant of Adware.Look2Me |
| Winlogon Notify | extfpu | X | extfpu.dll | Goldun variant |
| Winlogon Notify | extxerox | X | extxerox.dll | Goldun variant |
| Winlogon Notify | f3dsl | X | MSplg7.dll | Troj/Goldun-R |
| Winlogon Notify | fanxctrl | X | fanxctrl.dll | Goldun variant |
| Winlogon Notify | feclipna | X | %SYSDIR%\feclipna.dll | W32/Stration-G |
| Winlogon Notify | flashdma | X | %SYSDIR%\flashdma.dll | Goldun |
| Winlogon Notify | flashdrvr | X | flashdrvr.dll | Troj/Haxdoor-BX |
| Winlogon Notify | FLWLEvents | L | FiberlinkNetProv.dll | FIBERLINK |
| Winlogon Notify | FolderGuard | L | FGuard32.dll | FolderGuard |
| Winlogon Notify | fsp_abwl | L | %SYSDIR%\fsp_abwl.dll | Access_Boss |
| Winlogon Notify | g, gg, gggg, gggggg, gs | X | adsldpbd.dll | Trojan-Downloader.Win32.Delf variant - CoolWebSearch |
| Winlogon Notify | gatexkey | X | gatexkey.dll | Haxdoor variant |
| Winlogon Notify | gatwxkey | X | gatwxkey.dll | Goldun variant |
| Winlogon Notify | GbPluginAbn | L | %PROGRAMFILES%\GbPlugin\gbiehabn.dll | G-Buster_Browser_Defense |
| Winlogon Notify | GbPluginBb | L | %PROGRAMFILES%\GbPlugin\gbieh.dll | G-Buster_Browser_Defense |
| Winlogon Notify | gdiwxp | X | gdiwxp.dll | Goldun variant |
| Winlogon Notify | gdowxp | X | gdowxp.dll | Goldun variant |
| Winlogon Notify | gdwxp3 | X | gdwxp3.dll | Goldun variant |
| Winlogon Notify | GoToAssist | L | G2AWinLogon. dll | Citrix GoToAssist |
| Winlogon Notify | GoToMyPC | L | G2WinLogon.dll | GoToMyPC |
| Winlogon Notify | Guardian | X | msg***.dll (*=a number) | http://sarc.com/avcenter/venc/data/adware.look2me.html |