| Status Code | Name | Command | Description |
| N | CyphTray | CyphTray.exe | Cypherus - encryption software |
| X | CyDoor | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| X | CydoorUpdate | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| X | CyberWolf | CyberWolf.exe | Added by the KICKIN.A (or CYDOG.C) WORM! |
| N | CyberMedia Agent | CMAGENT.EXE | Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled |
| X | cyberfree.exe | ****.dat [* = random char] | Unidentified adware |
| U | CyberLat Ram Cleaner | CLRamCleaner.exe | CyberLat RAM Cleaner is a program that Frees, Optimizes and Defrags your system's wasted memory (RAM). Some users swear by programs such as this but I suggest you read this article and make up your own mind |
| U | Cyber Trio | showmode.exe | From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs |
| U | Cyber-Defender 2003 | uwcdsvr.exe | Cyber Defender 2003 |
| N | Cyber | cyberchk.exe | Part of Belkins "Multimedia Cleaning Kit" and is
automatically installed when you run their optical disk drive cleaning utility - to remind
you to clean your drive after "x" amount of time has passed |
| N | CXMon | Hpi_Monitor.exe | Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs |
| ? | Cwcdschk.exe | Cwcdschk.exe | IBM Thinkpad related? |
| ? | cwbwlwiz | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | cwbsvstr | cwbsvstr.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| N | cwbinhlp | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| N | cwbckver | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| U | CWatch | cw.exe | ChatWatch - chat monitoring tool |
| Y | CVPND | cvpnd.exe | Sub-system used by Cisco VPN client for making a connection to a remote IPSec server |
| X | cvmonitor.exe | cvmonitor.exe | Added by the SDBOT.BV WORM! |
| N | CuteMX | CuteMX.EXE | File sharing utility |
| U | Customizer2000 | logon.exe | Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" |
| N | cursor | Screendragon_VS_Taskbar.exe | ScreenDragon video player |
| N | CursorXP | CursorXP.exe | CursorXP from Stardock - tool for creating mouse cursors |
| X | cuo | cuo.exe | Added by the BUGBEAR.A WORM! |
| Y | cuagentExe | Cuagent.exe | Command Antivirus related |
| ? | cttdpsrv | cttdpsrv.exe | ?? |
| U | CTsysVol | CTSYSVOL.exe | Creative sound card volume controls |
| N | CTStartup | CTEaxSpl.exe | Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard |
| N | CTRegRun | CTRegRun.exe | For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative |
| U | CtrlVol | CtrlVol.exe | Acer's on screen volume control using the Fn key |
| ? | CTPDPSRV | CTPDPSRV.EXE | Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required? |
| X | CTin10 | CTin10.exe | Added by the BANCOS.E TROJAN! |
| X | CTime | [path to trojan] | Added by the HTTPDOS TROJAN! |
| U | CTHELPER | CTHELPER.EXE | CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative?s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it |
| X | Ctfmon.exe | ctfmon32.exe | CoolWebSearch parasite related - hijacking to Slawsearch.com |
| X | ctfmon | taskmgr32*.exe [* = number] | Added by the SOWSAT.B WORM! |
| U | ctfmon | ctfmon.exe | CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here |
| N | CTDVDDet | CTDetect.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| N | CTDVDDet | CTDVDDet.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| X | CSV7P91 | CSV7P91.exe | ClearSearch adware related
|
| Y | ct | ct.exe | ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it |
| N | CTAVTray | CTAvTray.exe | For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ |
| X | CSV7P70 | CSV7P070.exe | ClearSearch adware related |
| U | CSS_Central | CSS_1631.EXE | CSS Communication Agent (95 Host) from Command Software Systems "CSS Central? provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console." |
| X | csss | Csss.exe | Added by the BALICK TROJAN! |
| Y | CSScheduleCheck | SCHWIZEX.EXE | Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot |
| X | CSRSX | [trojan filename] | Added by the WINSHELL.50.B TROJAN! |
| X | CSRSS Loader | csrsss.exe | Added by the AGOBOT.TX WORM! |
| X | CSRSWIN | [trojan filename] | Added by the WINSHELL.50 TROJAN! |
| X | CSRSS | CSRSS.EXE | Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling |
| X | csrsc | csrsc.exe | Added by an unidentified VIRUS, WORM or TROJAN! |
| ? | csc | csc.exe | ?? |
| U | CSINJECT.EXE | CSINJECT.EXE | Part of Quarterdeck/Norton CleanSweep. For a full description see here. An excerpt - "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes." |
| N | csaRem | spqmdmui.exe | Compaq modem country selection |
| Y | CSAV_CheckViruses | vchk.exe.exe | Part of Command AntiVirus |
| ? | Crystal 3D Audio Control | CWD3DSND.EXE | Crystal 3D Audio sound driver. Is it required? |
| X | Cryptographic Service | ******.exe [* = random char] | Added by the KORGO.W or KORGO.X or KORGO.AB WORMS! |
| X | cronos | MARCO!.SCR | Added by the OPASERV.G WORM! |
| X | Crusty | dmcpl.exe | Added by the RUSTY WORM! |
| N | CriticalUpdate | Wucrtupd.exe | MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site |
| U | CreativeMixer | CTMIX32.EXE | Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon |
| N | CreativeDiscNotifier | CTNOTIFY.EXE | For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel |
| X | Creative.exe | Creative.exe | Added by the PROLIN WORM! |
| N | Creative WebCam Tray | Camtray.exe | Creative WebCam tray control - can be started manually
|
| N | Creative Service for CDROM Access | Ctsvccda.exe | Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs |
| N | Creative PCI Audio Configuration Utility | starter.exe | System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer |
| N | Creative MediaSource Go | CTCMSGo.exe | "Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats" |
| N | Creative AGP Wizard | agpwiz.exe | Part of Creative's BlasterControl |
| N | Creative Launcher | CTLauncher.exe | For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs |
| N | CreateCD50 | Createcd50.exe | Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs |
| N | CreateCD | Createcd.exe | Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs |
| X | Create A Monster | createAMonster.exe | Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related
|
| U | Creata Mail | JMSrvr.exe | Creata_Mail. Smileys, stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express
|
| X | CRC Value Verifier | Crsss64.exe | Added by the RBOT-NY WORM!
|
| X | CRC Value Verifier | crsss32.exe | Added by a variant of the RBOT WORM! |
| N | CrazyTalk Serve | rundll32.exe CrazyTalk.dll, DIIServeMediaFile | CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS |
| U | cracked_windows1 | cracked_windows1.exe | Cracked Windows popup killer |
| ? | CQSCP2PS | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| ? | CQSCP2P SERVER | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| X | cqlyg | world_cup_.bat | Added by the WCUP.A WORM! |
| X | Cpusave32 | Cpusave32.exe | Added by the GEMA TROJAN! |
| X | Cpusave | Cpusave.exe | Added by the GEMA TROJAN! |
| U | CPUcool | Cpucool.exe | Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel |
| X | cpr | cpr | Adroar.com adware downloader |
| X | CPU Manager | cpumgr.exe | Added by the PANDEM.B WORM! |
| N | Cpqset | Cpqset.exe | Default settings software in Hewlett Packard notebook |
| Y | CPQSTUTFIX | stutfix.exe | For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton |
| U | cpqns | cpqnpcss.exe | Related to Compaq.Net - not required if you don't use that |
| N | CPQINKAGENT | cpqinkag.exe | That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) |
| U | CPQInet Runtime Service | CpqInet.exe | For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers |
| U | cpqek | kcpqek.exe | For Compaq PC's. Easy Access button support for the keyboard |
| U | cpqeaui | cpqeaui.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| U | CPQEASYACC | cpqeadm.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| Y | CPQCalib | CPQCalib.exe | Compaq PowerCon power management software for laptops |
| N | CPQDFWAG | CpqDfwAg.exe | For Compaq PC's. Runs Compaq diagnostics on every boot |
| N | CPQBootPerfDB | CPQBootPerfDB.EXE | See the entry for Compaq Message Server |
| Y | CPQAcDc | CPQAcDc.exe | Compaq PowerCon power management software for laptops |
| U | CPQAlert | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| ? | CPortPatch | cppatch.exe | CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? |
| X | cpntmgc | winmgts.exe | MagicControl downloader trojan variant |
| X | cpntmgc | simcss.exe | MagicControl downloader trojan variant |
| X | cpntmgc | navpmc.exe | MagicControl downloader trojan variant |
| Y | CPD_EXE | CPD.EXE | Firewall bundled with McAfee VirusScan 6.* |
| X | cpntmgc | wincomp.exe | MagicControl downloader trojan variant |
| U | CPBrWtch | CPBrWtch.exe | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CPATR10 | CPATR10.EXE | Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast |
| ? | CPA9P2PSERVER | CPA9P2PS.exe | Found on a Compaq Presario but what is it? |
| U | CP32NOT | CP32BTN.EXE | For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons |
| X | couponica | couponica.exe | Adware - see here |
| ? | Coupon Offers | ?? | ?? |
| N | CountrySelection | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| N | Country Select | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| U | CostAware | niIPCApp.exe | NetInternals CostAware - download quota measuring tool |
| N | CorrectConnect | CConnect.exe | Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available |
| X | CoreSrv | coresrv.exe | Some IRC trojans/worms use this - see here for more information |
| ? | CORESYS | coresys.exe | ?? |
| N | CorelMedia FoldersIndexer8 | MFINDE~1.EXE | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| N | CorelMedia FoldersIndexer8 | MFindexer.exe | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| N | Corel Reminder | NAVBROWSER.EXE | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | CorelCENTRAL 10 | I_26dadCC.exe | CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs |
| N | Corel Registration Reminder | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Registration | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Family & Friends reminders | CFFREM.EXE | Corel Family & Friends - all-in-one calender, address book and list manager. Part of Corel Print House Magic |
| N | Corel Desktop Application Director | dadx.exe | The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs |
| U | CoreCenter | CORECE~1.EXE | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| N | Corel Colleagues & Contacts Reminders | cffrem.exe | Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of Corel Print Office |
| U | CoreCenter | CoreCenter.exe | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| N | Copyright | mwcpyrt.exe | Displays copyright information on IBM ThinkPads |
| U | CopernicPerUserTaskMgr | CopernicPerUserTaskMgr.exe | Automatic tasking feature of Copernic Pro multi-search engine tool |
| X | coolwebprogram | clrssn.exe | CoolWebSearch parasite variant |
| N | Coolwallpaper | cwm_tray.exe | Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers |
| U | CoolSwitch | taskswitch.exe | ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen |
| X | CoolMP3 | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| X | CoolDownloads | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| U | Cool Desk | cdesk.exe | Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you |
| U | CookieWall | cookie.exe | CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CookiePatrol | CookiePatrol.exe | CookiePatrol - PestPatrol's cookie interceptor stopping spyware cookies |
| U | CookieJar | Cookiejar.exe | Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cookie Pal | CPBRWTCH.EXE | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cookie Cop 2 | CookieCop.exe | Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| X | ControlPanel | host32.exe internat.dll, LoadKeyboardProfile | Added by a vairant of the DELF.DW TROJAN! |
| X | ControlPanel | rundll32 internat.dll, LoadKeyboardProfile | CoolWebSearch parasite variant |
| N | Controller | WFXCTL32.EXE | From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs |
| X | Controlled Resource System Service | crss.exe | Added by the AGOBOT.GH WORM! |
| N | ControlCentreTray | XWCTray.exe | System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc |
| N | ControlCenter2.0 | brctrcen.exe | Brother scanner 'Control Center' application - can be started manually
|
| X | Control Panel | System.exe | Added by the DANI TROJAN! |
| N | control panel | smctrlw.exe | System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card |
| X | Control handler | ***********.exe [* = random char] | CoolWebSearch parasite variant
|
| X | Control | rundll32.exe ctrlpan.dll, Restore ControlPanel | CoolWebSearch parasite variant |
| X | ContinueInstall | bpsinstall.exe | BrowserAid parasite |
| X | ContentService | winservn.exe | Homepage hijacker |
| X | ContentDownload | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| ? | Contacte | contacte.exe | Some kind of driver? |
| X | conscorr | conscorr.exe | Added by the STUBBY.C TROJAN! |
| X | Cons | consol32.exe | Hijacker - redirects to a p0rn portal, where foistware like ISTBar gets stealth installed |
| X | Connect2Party | connect2party.exe | Adult content dialler |
| N | Connection Manager | CManager.exe | SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service |
| N | Conmgr | conmgr.exe | Starts Winfax pro at startup |
| U | ConMgr.exe | conmgr.exe | Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut |
| X | Configuration Wizard | Cfgwiz32.exe | Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) |
| U | Configuration Utility | wlanutil.exe | NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards) |
| N | Configuration Utility | CONFIG.EXE | Controls linksys wireless connection. Available from the Desktop |
| X | Configuration Service | suchost.exe | Added by the TREB TROJAN! |
| X | Configuration Manager | Cnfgldr.exe | Added by the SDBOT TROJAN! |
| X | Configuration Manager | CNFGLD32.EXE | Added by the SDBOT TROJAN! |
| X | Configuration Loading | configldr.exe | Added by the AGOBOT-EC WORM! |
| X | Configuration Loading | svchos1.exe | Added by the GAOBOT.DK WORM!
|
| X | Configuration Loader | syscfg32.exe | Added by the SDBOT.B TROJAN! |
| X | Configuration Loader | systemry.exe | Added by a variant of the AGOBOT/GAOBOT WORM! |
| X | Configuration Loader | MSTasks.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | loadcfg32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | IEXPL0RE.EXE | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | msnss.exe | Added by the GAOBOT.AUS WORM! |
| X | Configuration Loader | msgfix.exe | Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS! |
| X | configuration loader | winicfg32.exe | Added by the GAOBOT.GEN!POLY WORM! |
| X | Configuration Loader | svhst.exe | Added by the GAOBOT.YC WORM! |
| X | Configuration Loader | confgldr.exe | Added by the POLYBOT WORM! |
| X | Configuration Loader | sysinfo.exe | Added by the GAOBOT.FQ WORM!
|
| X | Configuration Loader | microsoft.exe | Added by the GAOBOT.JB WORM! |
| X | Configuration Loader | Winreg.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | System.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | sw32.exe | Added by the AGOBOT.BQ WORM! |
| X | Configuration Loader | Servicess.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | Service.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | dosrun32.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | windex.exe | Added by the GAOBOT.BZ WORM! |
| X | Configuration Loader | wincrt32.exe | Added by the GAOBOT.BF WORM! |
| X | Configuration Loader | sycfg34.exe | Added by the GAOBOT.AN WORM! |
| ? | Configuration Loader | lfass.exe | ?? |
| X | Configuration Loader | service5.exe | Added by the GAOBOT.AF WORM! |
| X | Configuration Loader | cmd32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | aim95.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration File | Winset32.exe | Added by the FLUX.101 TROJAN!
|
| X | Configuration Loaded | wupdated.exe | Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS! |
| X | Configuration Default | Wuxat.exe | Added by the SPYBOT-CA WORM!
|
| X | Configuration | [filename] | Added by the SDBOT-ML WORM!
|
| N | ConfigServices | Config.exe | Part of initial setup on a Compaq PC |
| U | ConfigSafe | AUTOCHK.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| U | ConfigSafe | CFGSAFE.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| X | ConfiggLoader | cart322.exe | Added by the GAOBOT.DJ WORM! |
| X | Config33.exe | Config33.exe | Added by the SDBOT.T TROJAN!
|
| X | Config Loader2 | explores.exe | Added by the GAOBOT.BT WORM! |
| X | Config Loader for Microsoft Windows | mwincfg32.exe | Added by the AGOBOT.BD WORM! |
| X | Config Loader | scvhost.exe | Added by the GAOBOT.AE or GAOBOT.AO WORMS! |
| X | Config Loader | sysldr32.exe | Added by the GAOBOT WORM! |
| X | Config Loader | svchosl.exe | Added by the GAOBOT.P WORM! |
| X | Config Loadatiorin | I3Explorer.exe | Added by the SDBOT.H TROJAN! |
| X | Config Loadation | iEEexplore.exe | Added by the SDBOT.H TROJAN! |
| X | comxt | comxt.exe | Added by the COMXT TROJAN! |
| X | Config | service.exe | Added by the ISRAZ.B WORM! |
| X | ComTry Web Searcher | wstray.exe | Comtry MP3 Downloader related - spyware |
| N | COMSMDEXE | comsmd.exe | 3Com tray icon |
| X | Compatibility Service Process | regsvs.exe | Added by the GAOBOT.YN WORM! |
| N | CompaqSystray | cpqpscp.exe | Compaq System Tray icon |
| N | CompaqPrinTray | printray.exe | Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop |
| ? | CompaqHW Comp Manager | cpqhcm.exe | Running on a Compaq laptop - any ideas? |
| N | Compaq Video CD Watcher | ?? | For Compaq PC's. MPEG viewer |
| U | Compaq PK Daemon | cpqkl.exe | For Compaq laptops for programming user configurable keys. Not required unless you use them |
| N | Compaq Message Server | COMPAQ-RBA.EXE | Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not required and can cause problems |
| U | Compaq Knowledge Center | silent.exe & matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support". You decide |
| N | Compaq Internet Setup | inetwizard.exe | For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list |
| N | Compaq DMI | cpqdmi.exe | Compaq version of the Desktop Management Interface |
| N | Compaq Computer Corp SCCenter Module | SCCENTER.EXE | For Compaq PC's. Part of Backweb |
| ? | Compaq Computer Security | Rundll32.exe SECURE32.CPL, Service | ?? |
| X | COMMAND | command.exe | Added by the QQPASS.E TROJAN! |
| N | CommCtr | commctr.exe | "Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!". Available via Start -> Programs |
| U | Compaq Alerter | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| X | Command | Gotit.exe | Added by the TITOG WORM! |
| X | Command | system.exe | Added by the GATECRASH.A or GATECRASH.B TROJANS!
|
| U | Comm Driver | commh32.exe | G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! |
| U | COMDRV32 | svdhost.exe | Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Note - asks for permission to contact the IP address of http://www.protectcom.com/ |
| X | COMCFG | comcfg.exe | Added by the TOADCOM.A TROJAN! |
| U | ComAgent | ComAgent.exe | ComAgent - MDaemon's instant messaging client |
| X | ComcastSUPPORT | tgkill.exe | Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs |
| N | COM-IP | COMIP.EXE | COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) |
| X | COM++ System | svchost.exe... | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | exploier.exe | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | suchost.exe | Added by a variant of the LOVGATE WORM! |
| X | Com+ Sys | csrs.exe | Added by the FORBOT-BT WORM!
|
| X | COM+ System Applications | lsas.exe | Added by the AGOBOT.SE WORM! |
| X | COM Service | msdrce.com | Added by the BEASTY.I TROJAN! |
| X | COM+ Event System | DRWTSN16.EXE | Added by a variant of the LOVGATE WORM! |
| X | COM Service | msjclh.com | Added by the PLUX TROJAN! |
| X | COM Service | msynvr.com | Added by the BEASTY.G TROJAN! |
| X | COM Service | mscom32.com | Added by the BEASTY.H TROJAN! |
| N | Colorific Control Panel | Hgcctl95.exe | From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor |
| U | coloreal | coloreal.exe | Makes colours sharper and brighter, but will only work with coloreal capable monitors |
| X | Coldlife -icmp | Systray.exe | Added by the FLOOD.AV TROJAN! Note - this is not the legitimate SysTray.exe |
| U | Codename Dashboard | dashboard.exe | Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have any information you want, on your desktop, all the time" |
| N | CnxDslTaskBar | CnxDslTb.exe | Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems |
| X | CnsMin | Rundll32.exe CNSMIN.DLL, Rundll32 | CnsMin "Chinese Keywords" hijacker related |
| X | CnsMax | Internat.exe | Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir% |
| X | Cnfrm32 | cnfrm.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| N | cnet | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| X | CNBABE | CNBABE.EXE | Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing |
| X | Cn323 | cnfrm33.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| X | cmx32 | cmx32.exe | Added by the GEMA.D TROJAN! |
| X | cmt101 | cmt101.exe | Added by a variant of the CRYPTER.C TROJAN! |
| X | cmsound | vcsystem.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmssSystemProcess | csmss.exe | Added by the AGENT-CO TROJAN!
|
| X | cmsound | vcpdll.exe | Added by the TCXMEDI-D downloader TROJAN! |
| U | CMPDPSRV | CMPDPSRV.EXE | Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more." Installed with some Compaq and Lexmark printers |
| ? | CMGrdian | CMGrdian.exe | One of the McAfee shared components. What does it do and is it required? |
| X | CmeUPD | CMEupd.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CmeSYS | CMEsys.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CME | cme.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | cmdcon | cmdcon.exe | Added by the CRYPTER.A TROJAN! |
| X | Cmd | cmd32.exe | Added by the TANKED WORM! |
| N | Cmaudio | Rundll32 cmicnfg.cpl, CMICtrlWnd | System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel |
| U | cma | cma.exe | DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" |
| ? | CM-SmWizard | SmWizard.exe | SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? |
| X | CLSID | msgplus.exe | Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
|
| X | CLSID | plugin.exe | Adult content dialler |
| X | CLSID | sed.exe | Adult content dialler |
| X | CLSID | dll.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Adult content dialler |
| X | CLSID | com.exe | Adult content dialler |
| ? | Clotusorgreg0 | prtStart.exe Orgprt.exe | Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? |
| X | ClrSchLoader | Loader.exe | Clearsearch variant of IGetNet |
| U | CloneCDTray | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | CloneCDElbyCDFL | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | CloneCD | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | ClockWise | CLOCKWISE.EXE | ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync |
| X | ClockSync | Sync.exe | ClockSynck - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available |
| ? | clnwall | rundll.exe setupx.dll, InstallHinfSection ..delwall.inf | ?? |
| U | CLMFrontPanel | clmpanel.exe | System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost |
| N | ClipTrakker | ClipTrakker.exe | Cliptrakker - clipboard extender |
| N | ClipTrak | ClipTrak.exe | ClipTrak - clipboard extender |
| N | Clipsrv | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | Clipomatic | Clipomatic.exe | Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data |
| N | Clipmate6 | CLIPMT60.EXE | Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clipbook Service | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | ClipMate5x | ClipMt5x.exe | Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clik Status Monitor | toolsclickstat.exe | Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed |
| X | ClientMan1 | mscman.exe | Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" |
| X | Client Server Runtime Process | csrsss.exe | Added by the SDBOT-LD WORM! |
| ? | Client agent for ARCserve | W95AGENT.EXE | Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? |
| N | Client Access Service | CwbSvStr.Exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| N | Client Access Help Update | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| ? | Client Access Express Welcome | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | Client Access Check Version | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| X | CLICONFG | CLICONFG.EXE | Added by the OPASERV.T WORM! |
| X | ClickTheButton | MSCStat.exe | ClickTheButton Downloader-MY adware |
| X | ClickTheButton | csrss.exe | ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! |
| X | ClickTheButton | CTB.EXE | ClickTheButton Downloader-MY adware |
| U | Clickoff | Clickoff.exe | Clickoff automatically dismisses annoying dialog boxes |
| N | Click Tray Calendar | ClickT~1.EXE | ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc |
| ? | CleanupProgram | cleanup.exe | In a C:Sonysys folder - Sony Vaio related? |
| N | Click Radio Tuner | clickr~1.exe | ClickRadio - subscription service playing radio music via the internet |
| N | Cleanup | ONICTASK.EXE | Internet Cleanup from Aladdin Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet |
| U | CleanTemp | CleanTemp.exe | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| U | CleanTemp | CLEANT~1.EXEB | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| N | CleanSweep Useage Watch | CSUSEM32.EXE | Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time |
| U | CleanSweep Smart Sweep- Internet Sweep | Csinsm32.exe | Automatic logging of installs from Norton CleanSweep - available via Start -> Programs |
| U | CLCLSet | CLCL.exe | CLCL clipboard caching utility |
| ? | CleanEasyImg | cleanall.exe | ?? |
| X | Classes | mstart.exe | "Switch" adult content dialler
|
| X | Classes | MSTAR2.EXE | "Switch" adult content dialler
|
| X | Classes | srv2.exe | "Switch" adult content dialler |
| X | Classes | srv.exe | "Switch" adult content dialler |
| X | Classes | run_21.exe | "Switch" adult content dialler |
| X | Classes | intl.exe | "Switch" adult content dialler |
| X | Classes | int1.exe | "Switch" adult content dialler |
| Y | Cjstcom | Cjstcom.exe | Canon printer BJ status language monitor |
| N | CitiVAN | CitiVAN.exe | Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again |
| X | Cissi | Cissi.exe | Added by the CISSI.A WORM! |
| N | CISrvr Program | CISRVR.EXE | Related to internet setup on Compaq PC's |
| N | CIJxP2PSERVER | CIJxP2PS.EXE | Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 |
| X | CiaBackdoor | msldr.com | Added by a VIRUS! |
| X | cihost.exe | cihost.exe | Added by the LINST TROJAN! |
| ? | ChronitelInitTV | CHTVINIT.EXE |
