| Status Code | Name | Command | Description |
| N | CyphTray | CyphTray.exe | Cypherus - encryption software |
| X | CyDoor | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| X | CydoorUpdate | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| X | CyberWolf | CyberWolf.exe | Added by the KICKIN.A (or CYDOG.C) WORM! |
| N | CyberMedia Agent | CMAGENT.EXE | Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled |
| X | cyberfree.exe | ****.dat [* = random char] | Unidentified adware |
| U | CyberLat Ram Cleaner | CLRamCleaner.exe | CyberLat RAM Cleaner is a program that Frees, Optimizes and Defrags your system's wasted memory (RAM). Some users swear by programs such as this but I suggest you read this article and make up your own mind |
| U | Cyber Trio | showmode.exe | From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs |
| U | Cyber-Defender 2003 | uwcdsvr.exe | Cyber Defender 2003 |
| N | Cyber | cyberchk.exe | Part of Belkins "Multimedia Cleaning Kit" and is
automatically installed when you run their optical disk drive cleaning utility - to remind
you to clean your drive after "x" amount of time has passed |
| N | CXMon | Hpi_Monitor.exe | Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs |
| ? | Cwcdschk.exe | Cwcdschk.exe | IBM Thinkpad related? |
| ? | cwbwlwiz | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | cwbsvstr | cwbsvstr.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| N | cwbinhlp | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| N | cwbckver | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| U | CWatch | cw.exe | ChatWatch - chat monitoring tool |
| Y | CVPND | cvpnd.exe | Sub-system used by Cisco VPN client for making a connection to a remote IPSec server |
| X | cvmonitor.exe | cvmonitor.exe | Added by the SDBOT.BV WORM! |
| N | CuteMX | CuteMX.EXE | File sharing utility |
| U | Customizer2000 | logon.exe | Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" |
| N | cursor | Screendragon_VS_Taskbar.exe | ScreenDragon video player |
| N | CursorXP | CursorXP.exe | CursorXP from Stardock - tool for creating mouse cursors |
| X | cuo | cuo.exe | Added by the BUGBEAR.A WORM! |
| Y | cuagentExe | Cuagent.exe | Command Antivirus related |
| ? | cttdpsrv | cttdpsrv.exe | ?? |
| U | CTsysVol | CTSYSVOL.exe | Creative sound card volume controls |
| N | CTStartup | CTEaxSpl.exe | Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard |
| N | CTRegRun | CTRegRun.exe | For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative |
| U | CtrlVol | CtrlVol.exe | Acer's on screen volume control using the Fn key |
| ? | CTPDPSRV | CTPDPSRV.EXE | Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required? |
| X | CTin10 | CTin10.exe | Added by the BANCOS.E TROJAN! |
| X | CTime | [path to trojan] | Added by the HTTPDOS TROJAN! |
| U | CTHELPER | CTHELPER.EXE | CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative?s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it |
| X | Ctfmon.exe | ctfmon32.exe | CoolWebSearch parasite related - hijacking to Slawsearch.com |
| X | ctfmon | taskmgr32*.exe [* = number] | Added by the SOWSAT.B WORM! |
| U | ctfmon | ctfmon.exe | CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here |
| N | CTDVDDet | CTDetect.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| N | CTDVDDet | CTDVDDet.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| X | CSV7P91 | CSV7P91.exe | ClearSearch adware related
|
| Y | ct | ct.exe | ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it |
| N | CTAVTray | CTAvTray.exe | For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ |
| X | CSV7P70 | CSV7P070.exe | ClearSearch adware related |
| U | CSS_Central | CSS_1631.EXE | CSS Communication Agent (95 Host) from Command Software Systems "CSS Central? provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console." |
| X | csss | Csss.exe | Added by the BALICK TROJAN! |
| Y | CSScheduleCheck | SCHWIZEX.EXE | Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot |
| X | CSRSX | [trojan filename] | Added by the WINSHELL.50.B TROJAN! |
| X | CSRSS Loader | csrsss.exe | Added by the AGOBOT.TX WORM! |
| X | CSRSWIN | [trojan filename] | Added by the WINSHELL.50 TROJAN! |
| X | CSRSS | CSRSS.EXE | Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling |
| X | csrsc | csrsc.exe | Added by an unidentified VIRUS, WORM or TROJAN! |
| ? | csc | csc.exe | ?? |
| U | CSINJECT.EXE | CSINJECT.EXE | Part of Quarterdeck/Norton CleanSweep. For a full description see here. An excerpt - "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes." |
| N | csaRem | spqmdmui.exe | Compaq modem country selection |
| Y | CSAV_CheckViruses | vchk.exe.exe | Part of Command AntiVirus |
| ? | Crystal 3D Audio Control | CWD3DSND.EXE | Crystal 3D Audio sound driver. Is it required? |
| X | Cryptographic Service | ******.exe [* = random char] | Added by the KORGO.W or KORGO.X or KORGO.AB WORMS! |
| X | cronos | MARCO!.SCR | Added by the OPASERV.G WORM! |
| X | Crusty | dmcpl.exe | Added by the RUSTY WORM! |
| N | CriticalUpdate | Wucrtupd.exe | MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site |
| U | CreativeMixer | CTMIX32.EXE | Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon |
| N | CreativeDiscNotifier | CTNOTIFY.EXE | For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel |
| X | Creative.exe | Creative.exe | Added by the PROLIN WORM! |
| N | Creative WebCam Tray | Camtray.exe | Creative WebCam tray control - can be started manually
|
| N | Creative Service for CDROM Access | Ctsvccda.exe | Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs |
| N | Creative PCI Audio Configuration Utility | starter.exe | System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer |
| N | Creative MediaSource Go | CTCMSGo.exe | "Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats" |
| N | Creative AGP Wizard | agpwiz.exe | Part of Creative's BlasterControl |
| N | Creative Launcher | CTLauncher.exe | For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs |
| N | CreateCD50 | Createcd50.exe | Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs |
| N | CreateCD | Createcd.exe | Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs |
| X | Create A Monster | createAMonster.exe | Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related
|
| U | Creata Mail | JMSrvr.exe | Creata_Mail. Smileys, stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express
|
| X | CRC Value Verifier | Crsss64.exe | Added by the RBOT-NY WORM!
|
| X | CRC Value Verifier | crsss32.exe | Added by a variant of the RBOT WORM! |
| N | CrazyTalk Serve | rundll32.exe CrazyTalk.dll, DIIServeMediaFile | CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS |
| U | cracked_windows1 | cracked_windows1.exe | Cracked Windows popup killer |
| ? | CQSCP2PS | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| ? | CQSCP2P SERVER | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| X | cqlyg | world_cup_.bat | Added by the WCUP.A WORM! |
| X | Cpusave32 | Cpusave32.exe | Added by the GEMA TROJAN! |
| X | Cpusave | Cpusave.exe | Added by the GEMA TROJAN! |
| U | CPUcool | Cpucool.exe | Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel |
| X | cpr | cpr | Adroar.com adware downloader |
| X | CPU Manager | cpumgr.exe | Added by the PANDEM.B WORM! |
| N | Cpqset | Cpqset.exe | Default settings software in Hewlett Packard notebook |
| Y | CPQSTUTFIX | stutfix.exe | For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton |
| U | cpqns | cpqnpcss.exe | Related to Compaq.Net - not required if you don't use that |
| N | CPQINKAGENT | cpqinkag.exe | That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) |
| U | CPQInet Runtime Service | CpqInet.exe | For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers |
| U | cpqek | kcpqek.exe | For Compaq PC's. Easy Access button support for the keyboard |
| U | cpqeaui | cpqeaui.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| U | CPQEASYACC | cpqeadm.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| Y | CPQCalib | CPQCalib.exe | Compaq PowerCon power management software for laptops |
| N | CPQDFWAG | CpqDfwAg.exe | For Compaq PC's. Runs Compaq diagnostics on every boot |
| N | CPQBootPerfDB | CPQBootPerfDB.EXE | See the entry for Compaq Message Server |
| Y | CPQAcDc | CPQAcDc.exe | Compaq PowerCon power management software for laptops |
| U | CPQAlert | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| ? | CPortPatch | cppatch.exe | CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? |
| X | cpntmgc | winmgts.exe | MagicControl downloader trojan variant |
| X | cpntmgc | simcss.exe | MagicControl downloader trojan variant |
| X | cpntmgc | navpmc.exe | MagicControl downloader trojan variant |
| Y | CPD_EXE | CPD.EXE | Firewall bundled with McAfee VirusScan 6.* |
| X | cpntmgc | wincomp.exe | MagicControl downloader trojan variant |
| U | CPBrWtch | CPBrWtch.exe | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CPATR10 | CPATR10.EXE | Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast |
| ? | CPA9P2PSERVER | CPA9P2PS.exe | Found on a Compaq Presario but what is it? |
| U | CP32NOT | CP32BTN.EXE | For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons |
| X | couponica | couponica.exe | Adware - see here |
| ? | Coupon Offers | ?? | ?? |
| N | CountrySelection | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| N | Country Select | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| U | CostAware | niIPCApp.exe | NetInternals CostAware - download quota measuring tool |
| N | CorrectConnect | CConnect.exe | Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available |
| X | CoreSrv | coresrv.exe | Some IRC trojans/worms use this - see here for more information |
| ? | CORESYS | coresys.exe | ?? |
| N | CorelMedia FoldersIndexer8 | MFINDE~1.EXE | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| N | CorelMedia FoldersIndexer8 | MFindexer.exe | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| N | Corel Reminder | NAVBROWSER.EXE | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | CorelCENTRAL 10 | I_26dadCC.exe | CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs |
| N | Corel Registration Reminder | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Registration | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Family & Friends reminders | CFFREM.EXE | Corel Family & Friends - all-in-one calender, address book and list manager. Part of Corel Print House Magic |
| N | Corel Desktop Application Director | dadx.exe | The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs |
| U | CoreCenter | CORECE~1.EXE | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| N | Corel Colleagues & Contacts Reminders | cffrem.exe | Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of Corel Print Office |
| U | CoreCenter | CoreCenter.exe | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| N | Copyright | mwcpyrt.exe | Displays copyright information on IBM ThinkPads |
| U | CopernicPerUserTaskMgr | CopernicPerUserTaskMgr.exe | Automatic tasking feature of Copernic Pro multi-search engine tool |
| X | coolwebprogram | clrssn.exe | CoolWebSearch parasite variant |
| N | Coolwallpaper | cwm_tray.exe | Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers |
| U | CoolSwitch | taskswitch.exe | ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen |
| X | CoolMP3 | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| X | CoolDownloads | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| U | Cool Desk | cdesk.exe | Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you |
| U | CookieWall | cookie.exe | CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CookiePatrol | CookiePatrol.exe | CookiePatrol - PestPatrol's cookie interceptor stopping spyware cookies |
| U | CookieJar | Cookiejar.exe | Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cookie Pal | CPBRWTCH.EXE | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cookie Cop 2 | CookieCop.exe | Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| X | ControlPanel | host32.exe internat.dll, LoadKeyboardProfile | Added by a vairant of the DELF.DW TROJAN! |
| X | ControlPanel | rundll32 internat.dll, LoadKeyboardProfile | CoolWebSearch parasite variant |
| N | Controller | WFXCTL32.EXE | From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs |
| X | Controlled Resource System Service | crss.exe | Added by the AGOBOT.GH WORM! |
| N | ControlCentreTray | XWCTray.exe | System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc |
| N | ControlCenter2.0 | brctrcen.exe | Brother scanner 'Control Center' application - can be started manually
|
| X | Control Panel | System.exe | Added by the DANI TROJAN! |
| N | control panel | smctrlw.exe | System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card |
| X | Control handler | ***********.exe [* = random char] | CoolWebSearch parasite variant
|
| X | Control | rundll32.exe ctrlpan.dll, Restore ControlPanel | CoolWebSearch parasite variant |
| X | ContinueInstall | bpsinstall.exe | BrowserAid parasite |
| X | ContentService | winservn.exe | Homepage hijacker |
| X | ContentDownload | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| ? | Contacte | contacte.exe | Some kind of driver? |
| X | conscorr | conscorr.exe | Added by the STUBBY.C TROJAN! |
| X | Cons | consol32.exe | Hijacker - redirects to a p0rn portal, where foistware like ISTBar gets stealth installed |
| X | Connect2Party | connect2party.exe | Adult content dialler |
| N | Connection Manager | CManager.exe | SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service |
| N | Conmgr | conmgr.exe | Starts Winfax pro at startup |
| U | ConMgr.exe | conmgr.exe | Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut |
| X | Configuration Wizard | Cfgwiz32.exe | Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) |
| U | Configuration Utility | wlanutil.exe | NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards) |
| N | Configuration Utility | CONFIG.EXE | Controls linksys wireless connection. Available from the Desktop |
| X | Configuration Service | suchost.exe | Added by the TREB TROJAN! |
| X | Configuration Manager | Cnfgldr.exe | Added by the SDBOT TROJAN! |
| X | Configuration Manager | CNFGLD32.EXE | Added by the SDBOT TROJAN! |
| X | Configuration Loading | configldr.exe | Added by the AGOBOT-EC WORM! |
| X | Configuration Loading | svchos1.exe | Added by the GAOBOT.DK WORM!
|
| X | Configuration Loader | syscfg32.exe | Added by the SDBOT.B TROJAN! |
| X | Configuration Loader | systemry.exe | Added by a variant of the AGOBOT/GAOBOT WORM! |
| X | Configuration Loader | MSTasks.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | loadcfg32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | IEXPL0RE.EXE | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | msnss.exe | Added by the GAOBOT.AUS WORM! |
| X | Configuration Loader | msgfix.exe | Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS! |
| X | configuration loader | winicfg32.exe | Added by the GAOBOT.GEN!POLY WORM! |
| X | Configuration Loader | svhst.exe | Added by the GAOBOT.YC WORM! |
| X | Configuration Loader | confgldr.exe | Added by the POLYBOT WORM! |
| X | Configuration Loader | sysinfo.exe | Added by the GAOBOT.FQ WORM!
|
| X | Configuration Loader | microsoft.exe | Added by the GAOBOT.JB WORM! |
| X | Configuration Loader | Winreg.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | System.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | sw32.exe | Added by the AGOBOT.BQ WORM! |
| X | Configuration Loader | Servicess.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | Service.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | dosrun32.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | windex.exe | Added by the GAOBOT.BZ WORM! |
| X | Configuration Loader | wincrt32.exe | Added by the GAOBOT.BF WORM! |
| X | Configuration Loader | sycfg34.exe | Added by the GAOBOT.AN WORM! |
| ? | Configuration Loader | lfass.exe | ?? |
| X | Configuration Loader | service5.exe | Added by the GAOBOT.AF WORM! |
| X | Configuration Loader | cmd32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | aim95.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration File | Winset32.exe | Added by the FLUX.101 TROJAN!
|
| X | Configuration Loaded | wupdated.exe | Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS! |
| X | Configuration Default | Wuxat.exe | Added by the SPYBOT-CA WORM!
|
| X | Configuration | [filename] | Added by the SDBOT-ML WORM!
|
| N | ConfigServices | Config.exe | Part of initial setup on a Compaq PC |
| U | ConfigSafe | AUTOCHK.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| U | ConfigSafe | CFGSAFE.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| X | ConfiggLoader | cart322.exe | Added by the GAOBOT.DJ WORM! |
| X | Config33.exe | Config33.exe | Added by the SDBOT.T TROJAN!
|
| X | Config Loader2 | explores.exe | Added by the GAOBOT.BT WORM! |
| X | Config Loader for Microsoft Windows | mwincfg32.exe | Added by the AGOBOT.BD WORM! |
| X | Config Loader | scvhost.exe | Added by the GAOBOT.AE or GAOBOT.AO WORMS! |
| X | Config Loader | sysldr32.exe | Added by the GAOBOT WORM! |
| X | Config Loader | svchosl.exe | Added by the GAOBOT.P WORM! |
| X | Config Loadatiorin | I3Explorer.exe | Added by the SDBOT.H TROJAN! |
| X | Config Loadation | iEEexplore.exe | Added by the SDBOT.H TROJAN! |
| X | comxt | comxt.exe | Added by the COMXT TROJAN! |
| X | Config | service.exe | Added by the ISRAZ.B WORM! |
| X | ComTry Web Searcher | wstray.exe | Comtry MP3 Downloader related - spyware |
| N | COMSMDEXE | comsmd.exe | 3Com tray icon |
| X | Compatibility Service Process | regsvs.exe | Added by the GAOBOT.YN WORM! |
| N | CompaqSystray | cpqpscp.exe | Compaq System Tray icon |
| N | CompaqPrinTray | printray.exe | Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop |
| ? | CompaqHW Comp Manager | cpqhcm.exe | Running on a Compaq laptop - any ideas? |
| N | Compaq Video CD Watcher | ?? | For Compaq PC's. MPEG viewer |
| U | Compaq PK Daemon | cpqkl.exe | For Compaq laptops for programming user configurable keys. Not required unless you use them |
| N | Compaq Message Server | COMPAQ-RBA.EXE | Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not required and can cause problems |
| U | Compaq Knowledge Center | silent.exe & matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support". You decide |
| N | Compaq Internet Setup | inetwizard.exe | For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list |
| N | Compaq DMI | cpqdmi.exe | Compaq version of the Desktop Management Interface |
| N | Compaq Computer Corp SCCenter Module | SCCENTER.EXE | For Compaq PC's. Part of Backweb |
| ? | Compaq Computer Security | Rundll32.exe SECURE32.CPL, Service | ?? |
| X | COMMAND | command.exe | Added by the QQPASS.E TROJAN! |
| N | CommCtr | commctr.exe | "Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!". Available via Start -> Programs |
| U | Compaq Alerter | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| X | Command | Gotit.exe | Added by the TITOG WORM! |
| X | Command | system.exe | Added by the GATECRASH.A or GATECRASH.B TROJANS!
|
| U | Comm Driver | commh32.exe | G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! |
| U | COMDRV32 | svdhost.exe | Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Note - asks for permission to contact the IP address of http://www.protectcom.com/ |
| X | COMCFG | comcfg.exe | Added by the TOADCOM.A TROJAN! |
| U | ComAgent | ComAgent.exe | ComAgent - MDaemon's instant messaging client |
| X | ComcastSUPPORT | tgkill.exe | Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs |
| N | COM-IP | COMIP.EXE | COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) |
| X | COM++ System | svchost.exe... | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | exploier.exe | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | suchost.exe | Added by a variant of the LOVGATE WORM! |
| X | Com+ Sys | csrs.exe | Added by the FORBOT-BT WORM!
|
| X | COM+ System Applications | lsas.exe | Added by the AGOBOT.SE WORM! |
| X | COM Service | msdrce.com | Added by the BEASTY.I TROJAN! |
| X | COM+ Event System | DRWTSN16.EXE | Added by a variant of the LOVGATE WORM! |
| X | COM Service | msjclh.com | Added by the PLUX TROJAN! |
| X | COM Service | msynvr.com | Added by the BEASTY.G TROJAN! |
| X | COM Service | mscom32.com | Added by the BEASTY.H TROJAN! |
| N | Colorific Control Panel | Hgcctl95.exe | From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor |
| U | coloreal | coloreal.exe | Makes colours sharper and brighter, but will only work with coloreal capable monitors |
| X | Coldlife -icmp | Systray.exe | Added by the FLOOD.AV TROJAN! Note - this is not the legitimate SysTray.exe |
| U | Codename Dashboard | dashboard.exe | Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have any information you want, on your desktop, all the time" |
| N | CnxDslTaskBar | CnxDslTb.exe | Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems |
| X | CnsMin | Rundll32.exe CNSMIN.DLL, Rundll32 | CnsMin "Chinese Keywords" hijacker related |
| X | CnsMax | Internat.exe | Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir% |
| X | Cnfrm32 | cnfrm.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| N | cnet | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| X | CNBABE | CNBABE.EXE | Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing |
| X | Cn323 | cnfrm33.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| X | cmx32 | cmx32.exe | Added by the GEMA.D TROJAN! |
| X | cmt101 | cmt101.exe | Added by a variant of the CRYPTER.C TROJAN! |
| X | cmsound | vcsystem.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmssSystemProcess | csmss.exe | Added by the AGENT-CO TROJAN!
|
| X | cmsound | vcpdll.exe | Added by the TCXMEDI-D downloader TROJAN! |
| U | CMPDPSRV | CMPDPSRV.EXE | Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more." Installed with some Compaq and Lexmark printers |
| ? | CMGrdian | CMGrdian.exe | One of the McAfee shared components. What does it do and is it required? |
| X | CmeUPD | CMEupd.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CmeSYS | CMEsys.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CME | cme.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | cmdcon | cmdcon.exe | Added by the CRYPTER.A TROJAN! |
| X | Cmd | cmd32.exe | Added by the TANKED WORM! |
| N | Cmaudio | Rundll32 cmicnfg.cpl, CMICtrlWnd | System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel |
| U | cma | cma.exe | DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" |
| ? | CM-SmWizard | SmWizard.exe | SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? |
| X | CLSID | msgplus.exe | Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
|
| X | CLSID | plugin.exe | Adult content dialler |
| X | CLSID | sed.exe | Adult content dialler |
| X | CLSID | dll.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Adult content dialler |
| X | CLSID | com.exe | Adult content dialler |
| ? | Clotusorgreg0 | prtStart.exe Orgprt.exe | Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? |
| X | ClrSchLoader | Loader.exe | Clearsearch variant of IGetNet |
| U | CloneCDTray | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | CloneCDElbyCDFL | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | CloneCD | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | ClockWise | CLOCKWISE.EXE | ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync |
| X | ClockSync | Sync.exe | ClockSynck - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available |
| ? | clnwall | rundll.exe setupx.dll, InstallHinfSection ..delwall.inf | ?? |
| U | CLMFrontPanel | clmpanel.exe | System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost |
| N | ClipTrakker | ClipTrakker.exe | Cliptrakker - clipboard extender |
| N | ClipTrak | ClipTrak.exe | ClipTrak - clipboard extender |
| N | Clipsrv | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | Clipomatic | Clipomatic.exe | Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data |
| N | Clipmate6 | CLIPMT60.EXE | Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clipbook Service | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | ClipMate5x | ClipMt5x.exe | Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clik Status Monitor | toolsclickstat.exe | Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed |
| X | ClientMan1 | mscman.exe | Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" |
| X | Client Server Runtime Process | csrsss.exe | Added by the SDBOT-LD WORM! |
| ? | Client agent for ARCserve | W95AGENT.EXE | Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? |
| N | Client Access Service | CwbSvStr.Exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| N | Client Access Help Update | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| ? | Client Access Express Welcome | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | Client Access Check Version | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| X | CLICONFG | CLICONFG.EXE | Added by the OPASERV.T WORM! |
| X | ClickTheButton | MSCStat.exe | ClickTheButton Downloader-MY adware |
| X | ClickTheButton | csrss.exe | ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! |
| X | ClickTheButton | CTB.EXE | ClickTheButton Downloader-MY adware |
| U | Clickoff | Clickoff.exe | Clickoff automatically dismisses annoying dialog boxes |
| N | Click Tray Calendar | ClickT~1.EXE | ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc |
| ? | CleanupProgram | cleanup.exe | In a C:Sonysys folder - Sony Vaio related? |
| N | Click Radio Tuner | clickr~1.exe | ClickRadio - subscription service playing radio music via the internet |
| N | Cleanup | ONICTASK.EXE | Internet Cleanup from Aladdin Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet |
| U | CleanTemp | CleanTemp.exe | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| U | CleanTemp | CLEANT~1.EXEB | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| N | CleanSweep Useage Watch | CSUSEM32.EXE | Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time |
| U | CleanSweep Smart Sweep- Internet Sweep | Csinsm32.exe | Automatic logging of installs from Norton CleanSweep - available via Start -> Programs |
| U | CLCLSet | CLCL.exe | CLCL clipboard caching utility |
| ? | CleanEasyImg | cleanall.exe | ?? |
| X | Classes | mstart.exe | "Switch" adult content dialler
|
| X | Classes | MSTAR2.EXE | "Switch" adult content dialler
|
| X | Classes | srv2.exe | "Switch" adult content dialler |
| X | Classes | srv.exe | "Switch" adult content dialler |
| X | Classes | run_21.exe | "Switch" adult content dialler |
| X | Classes | intl.exe | "Switch" adult content dialler |
| X | Classes | int1.exe | "Switch" adult content dialler |
| Y | Cjstcom | Cjstcom.exe | Canon printer BJ status language monitor |
| N | CitiVAN | CitiVAN.exe | Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again |
| X | Cissi | Cissi.exe | Added by the CISSI.A WORM! |
| N | CISrvr Program | CISRVR.EXE | Related to internet setup on Compaq PC's |
| N | CIJxP2PSERVER | CIJxP2PS.EXE | Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 |
| X | CiaBackdoor | msldr.com | Added by a VIRUS! |
| X | cihost.exe | cihost.exe | Added by the LINST TROJAN! |
| ? | ChronitelInitTV | CHTVINIT.EXE | ?? |
| ? | ChromeMark | keysh.exe | Related to this. Don't know what keysh.exe does though and if it's required |
| N | Christmas Music Player | TTEST6.EXE | "Christmas Music Player brings the music of the Christmas Holiday to your desktop" |
| U | CHotKey | zHotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol , vol-, mute, etc. Only required for extended features |
| U | CHotKey | MK9805.EXE | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| U | CHotKey | mhotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| X | Choke | Choke.exe-blahh | Added by the CHOKE WORM! |
| X | chostsv | chostsv.exe | Added by the BANPAES.C TROJAN! |
| X | chkdsk | c:autoexec.bat | Added by the ANPES WORM! |
| U | ChineseStar | cstar.exe | Chinese language support software |
| N | CHKADMIN | CHKADMIN.EXE | Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" |
| U | CherryKeyMan | KeyMan.exe | Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys |
| ? | checktime | ct.exe | Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required? |
| Y | CheckMsgPlus | MsgPlusH.dll, VerifyInstallation | Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. |
| U | Check Messenger | cmesseng.exe | Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account |
| U | CheckIt | ToolBox.exe | CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parameters at intervals you specify |
| X | Cheatle | GigaByte.exe | Added by the SHODI.B VIRUS! |
| N | Check for One Touch Update | wiseupdt.exe | Checks for updates for Visioneer OneTouch scanners |
| N | Chcenter | chcenter.exe | IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" |
| N | Chatango | Chatango.exe | Chatango - "allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions, blogs, personal websites, Friendster profiles, and your visitors will be able to contact you instantly, without downloading anything, or registering. Alo use it to send email to your friends, allowing them to respond to you in real time!." The 'MessageCatcher' icon in the System Tray notifies you when you get a message. When you get a message, a little alert pops up, which you can click on and start chatting immediately |
| ? | ChangeLines | chngline.exe | ?? |
| U | ChamClock | ChamClock.exe | Chameleon Clock - system tray clock replacement |
| X | Cgtask Services | cgtask.exe | Added by the LALA.B TROJAN! |
| U | CGServer | cgserver.exe | Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs |
| X | cftmon32 | taskmgr*.exe [* = number] | Added by the SOWSAT.C and SOWSAT.J WORMS! |
| ? | cFosInst_Check | cfosinst.exe | cFos DSL Modem driver related. What does it do and is it required? |
| ? | cFosDNT | cFosDNT.exe | cFos DSL Modem driver related. What does it do and is it required? |
| N | cfgwiz | cfgwiz.exe | Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it |
| Y | cfgintpr | cfgintpr.exe | Configuration Interpreter - part of Tiny Personal Firewall V4 |
| X | CFDStart | WinMuschi.exe | WINMUSCHI dialler |
| N | CFD | CFD.exe | BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs |
| X | cesmain.dll | cmail.dll, Rundll32 | CnsMin "Chinese Keywords" hijacker related |
| ? | CEPA | wsot.exe | ?? |
| X | center | [random name]32.exe | Added by the BOFRA.A WORM! |
| X | CentralProcessor | taskimgr.exe | Added by the BANCOS.J TROJAN! |
| X | Cekirge | [path to worm] | Added by the KERGEZ.A WORM! |
| ? | Ceic | Ceic.exe | ?? |
| ? | CeEKEY | CeEKey.exe | Toshiba Satellite E-Key related. Is it required? |
| U | CeEPOWER | cepmtray.exe | Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed, Monitor Shut Off, Hard Drive Shut-Off, Monitor Brightness, System Stand-by and System Hibernate times |
| N | CDTray | CDTray.exe | On HP PCs, this is the small CD icon next to the time |
| N | CDInterceptor | cdi.exe | CD indexer for measuring the speed of CD players |
| X | cddrv32 | cddrv32.exe | Added by a variant of the CRYPTER.C TROJAN! |
| X | Cdcompat | Cdcompat.exe | Added by the GEMA TROJAN! |
| N | CDANTSRV | CDANTSRV.exe | C-Dilla License Management software. Used for any program that uses C-dilla Protection, example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually |
| U | CCWC7s | stealth.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 |
| U | CCWC7I | idxl.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean |
| U | CCWC7a | ac.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean |
| U | ccWasher | aolwasher.exe | Webroot Cache & Cookie Washer - cleaning browser tracks, including cache, cookies, history, mail trash, drop-down address bar, auto-complete forms and downloaded program files for IE, Netscape and AOL |
| X | ccUpdate | ccUpdate.exe | Added by the AGOBOT.YS WORM!
|
| Y | ccSetMgr | ccSetMgr.exe | Part of Norton AntiVirus 2004. What does it do? |
| Y | CcRegVfy | ccRegVfy.exe | Part of Norton AntiVirus 2003. "ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack" |
| X | ccreg | explorer.exe | Added by the ZCREW TROJAN! Note - the valid "explorer.exe" is located in C:Windows or C:Winnt whereas this one is located in a C:WindowsSystem or C:WinntSystem subdirectory |
| Y | CcPxySvc | CCPXYSVC.exe | Part of Norton's AntiVirus 2003, Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall |
| U | ccProxy | CCPROXY.EXE | Part of Norton Internet Security, proxy server that is used to support the parental controls. If you turn parental controls off at user level the process is not loaded. Reported to cause excessive CPU usage |
| X | ccpApps | lsass.exe | Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! |
| X | ccpApps | csrss.exe | Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! |
| Y | CcEvtMgr | ccEvtMgr.exe | Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via "ccApp" and was not required as a seperate entry but a recent update changed this |
| Y | ccenter | CCenter.exe | RAV AntiVirus
|
| Y | CCDoctorLogonTesting | ccdoctor.exe | Checks your system to make sure it's configured properly for running Rational ClearCase, a source code management tool. ClearCase is fairly sophisticated so there are a lot of system-related things that can cause it grief. If you run ClearCase you should not disable this as it provides a valuable service, but technically it isn't required to use the ClearCase product |
| N | Ccdecode | rundll32.exe streamci, StreamingDeviceSetup | Part of the closed caption decdoder/MS VBI codec. Should only run once |
| U | CCD Manager | DDS.EXE | Project Labs Century CD manager for their CD/DVD storage device |
| X | ccApps | winlogon.exe | Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! |
| X | ccApps | services.exe | Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | ccApp | WMADZ.EXE | Added by the RBOT-LJ WORM! |
| X | ccAppr | svcrhost.exe | Premium rate adult content dialler |
| X | ccApp | [random filename] | Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus |
| Y | ccApp | ccApp.exe | Part of Norton AntiVirus 2003. Auto-protect and E-mail check will not function without this |
| X | CC2KUI | comet.exe | Comet Cursor - displays different mouse pointers dependent upon the site your visiting. Malware because it automatically installs. See here for more information and for the uninstall procedure |
| U | CBWHost | CBWHost.exe | Required for Bitware to answer incoming faxes, can cause sleep mode problems |
| ? | CBWUser | CBWDial.exe | Associated with Bitware that integrates fax, voice, pager, and data communications on your desktop |
| X | CAZNOVAS | CAZNOVAS.exe | Added by the CAZNO TROJAN! |
| U | CBWAttn | CBWAttn.exe | Required for Bitware to answer incoming faxes, can cause sleep mode problems |
| Y | CAVS | CAVS.exe | Cheyenne (now eTrust) antivirus |
| X | CashToolbar | svchost.exe | CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! |
| X | CashToolbar | CD_Load.exe | CashToolbar Downloader-MY adware |
| N | Cashsurfers Cashbar Navigator | Cashbar.Exe | Cashsurfers CashBar Navigator - "The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals" |
| X | CashBack | cashback.exe | Part of eXact Advertising Software, consisting of "CashBack by BargainBuddy", BullsEye Network and NaviSearch |
| X | caseyvideo | caseyvideo[*].exe [* = digit] | Malware causing p0rn popups |
| U | CasAgnt | CasAgnt.exe | Program by Extended Systems which allows you to sync your Casio PDA with your PC |
| X | Casdvqwa | bmqnzkg.exe | Added by the RANDEX.BE WORM! |
| X | caseyvideo | CaseyVideo.exe | Malware causing p0rn popups |
| U | CARPservice | carpserv.exe | Associated with Zoltrix modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example |
| X | CARPserver | CARPserver.exe | Added by the BANKER-AN TROJAN! |
| X | Care20 | Care20.exe | TopMoxie adware |
| N | Card Monitor | REGCNT09.exe | For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs |
| Y | Capon | Capon.exe | Canon printer driver |
| N | Capture Express 2000 | capexp.exe | Capture Express - screen capture utility |
| N | Canon Printer Monitor BJCxxx | Cjstlst.exe | Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs |
| N | Capfax | capfax.exe | PhoneTools fax software |
| X | candynet | Taskmsg.exe | Added by the RBOT-NA WORM! |
| N | Canary | canary-std.exe | Canary monitoring program. Keylogger, monitors all computer activity |
| X | candy | command32.exe | Added by the RBOT-LV WORM! |
| N | Canada | Canada.exe | Known to be a dialler - but is it maliscous or clean? |
| ? | CamMonitor | hpqcmon.exe | From HP and related to digital imaging |
| N | Camio Viewer x | IXApplet.exe | Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version |
| N | Camera Detector | Camdetect.exe | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| N | Camera Detector | CAMDET~*.EXE | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| N | CamCheck | CamCheck.exe | NuCam camera software related |
| N | CallControl | ftctrl32.exe | FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows |
| ? | CallBumping | cbpopw.exe | ?? |
| N | Calendar 200X Reminder | calendar.exe | Calendar 200X - shows holidays, reminders of various anniversaries,tasks etc |
| N | Cal Reminder Shortcut | calrem.exe | Produces a pop-up reminder of events scheduled using the MS Office Calendar |
| Y | CAISafe | isafe.exe | Part of Computer Associates eTrus EZ Antivirus |
| N | CahootWebcard | CahootWebcard.exe | "The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details". Run manually when needed |
| X | cAgOu | [filename].hta | Added by the KAKWORM WORM! |
| N | CAgent | CAgent.exe | Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents |
| U | CADS | cads.exe | Cyber Sentinel internet filtering software |
| N | CACStarter | cacstart.exe | Cash A Check - check writing software |
| U | Caddais BackupOnDemand | BODMon.exe | Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" |
| N | Cacheman | Cacheman.exe | Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up |
| Y | CacheMgr | CacheMgr.exe | Sophos Antivirus Remote Update |
| U | CacheBoost | trayicon.exe | CacheBoost "optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers, resulting in a performance boost" |
| X | CABCInstall | CABCInstall.exe | CABC content delivery software |
| X | Cabchk32 | Cabchk32.exe | Added by the GEMA TROJAN! |
| X | Cabchk | Cabchk.exe | Added by the GEMA TROJAN! |
| U | C2K | CYB2K.EXE | CYBERsitter 2000 or 2001 - anti-porn filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser |
| N | C-Media Mixer | Mixer.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs |
| U | C-Media Echo Control | EchoCtrl.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
|
| X | c | c:archiv~1win.com | Added by the CUYDOC TROJAN! |
| X | c | c:archiv~1win.com | Added by the CUYDOC TROJAN! |
| U | C-Media Echo Control | EchoCtrl.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
|
| N | C-Media Mixer | Mixer.exe | C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs |
| U | C2K | CYB2K.EXE | CYBERsitter 2000 or 2001 - anti-porn filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser |
| X | Cabchk | Cabchk.exe | Added by the GEMA TROJAN! |
| X | Cabchk32 | Cabchk32.exe | Added by the GEMA TROJAN! |
| X | CABCInstall | CABCInstall.exe | CABC content delivery software |
| U | CacheBoost | trayicon.exe | CacheBoost "optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers, resulting in a performance boost" |
| N | Cacheman | Cacheman.exe | Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up |
| Y | CacheMgr | CacheMgr.exe | Sophos Antivirus Remote Update |
| N | CACStarter | cacstart.exe | Cash A Check - check writing software |
| U | Caddais BackupOnDemand | BODMon.exe | Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" |
| U | CADS | cads.exe | Cyber Sentinel internet filtering software |
| N | CAgent | CAgent.exe | Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents |
| X | cAgOu | [filename].hta | Added by the KAKWORM WORM! |
| N | CahootWebcard | CahootWebcard.exe | "The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details". Run manually when needed |
| Y | CAISafe | isafe.exe | Part of Computer Associates eTrus EZ Antivirus |
| N | Cal Reminder Shortcut | calrem.exe | Produces a pop-up reminder of events scheduled using the MS Office Calendar |
| N | Calendar 200X Reminder | calendar.exe | Calendar 200X - shows holidays, reminders of various anniversaries,tasks etc |
| ? | CallBumping | cbpopw.exe | ?? |
| N | CallControl | ftctrl32.exe | FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows |
| N | CamCheck | CamCheck.exe | NuCam camera software related |
| N | Camera Detector | CAMDET~*.EXE | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| N | Camera Detector | Camdetect.exe | ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically |
| N | Camio Viewer x | IXApplet.exe | Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version |
| ? | CamMonitor | hpqcmon.exe | From HP and related to digital imaging |
| N | Canada | Canada.exe | Known to be a dialler - but is it maliscous or clean? |
| N | Canary | canary-std.exe | Canary monitoring program. Keylogger, monitors all computer activity |
| X | candy | command32.exe | Added by the RBOT-LV WORM! |
| X | candynet | Taskmsg.exe | Added by the RBOT-NA WORM! |
| N | Canon Printer Monitor BJCxxx | Cjstlst.exe | Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs |
| N | Capfax | capfax.exe | PhoneTools fax software |
| Y | Capon | Capon.exe | Canon printer driver |
| N | Capture Express 2000 | capexp.exe | Capture Express - screen capture utility |
| N | Card Monitor | REGCNT09.exe | For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs |
| X | Care20 | Care20.exe | TopMoxie adware |
| X | CARPserver | CARPserver.exe | Added by the BANKER-AN TROJAN! |
| U | CARPservice | carpserv.exe | Associated with Zoltrix modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example |
| U | CasAgnt | CasAgnt.exe | Program by Extended Systems which allows you to sync your Casio PDA with your PC |
| X | Casdvqwa | bmqnzkg.exe | Added by the RANDEX.BE WORM! |
| X | caseyvideo | CaseyVideo.exe | Malware causing p0rn popups |
| X | caseyvideo | caseyvideo[*].exe [* = digit] | Malware causing p0rn popups |
| X | CashBack | cashback.exe | Part of eXact Advertising Software, consisting of "CashBack by BargainBuddy", BullsEye Network and NaviSearch |
| N | Cashsurfers Cashbar Navigator | Cashbar.Exe | Cashsurfers CashBar Navigator - "The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals" |
| X | CashToolbar | CD_Load.exe | CashToolbar Downloader-MY adware |
| X | CashToolbar | svchost.exe | CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup! |
| Y | CAVS | CAVS.exe | Cheyenne (now eTrust) antivirus |
| X | CAZNOVAS | CAZNOVAS.exe | Added by the CAZNO TROJAN! |
| U | CBWAttn | CBWAttn.exe | Required for Bitware to answer incoming faxes, can cause sleep mode problems |
| U | CBWHost | CBWHost.exe | Required for Bitware to answer incoming faxes, can cause sleep mode problems |
| ? | CBWUser | CBWDial.exe | Associated with Bitware that integrates fax, voice, pager, and data communications on your desktop |
| X | CC2KUI | comet.exe | Comet Cursor - displays different mouse pointers dependent upon the site your visiting. Malware because it automatically installs. See here for more information and for the uninstall procedure |
| Y | ccApp | ccApp.exe | Part of Norton AntiVirus 2003. Auto-protect and E-mail check will not function without this |
| X | ccApp | [random filename] | Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus |
| X | ccApp | WMADZ.EXE | Added by the RBOT-LJ WORM! |
| X | ccAppr | svcrhost.exe | Premium rate adult content dialler |
| X | ccApps | services.exe | Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
| X | ccApps | winlogon.exe | Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup! |
| U | CCD Manager | DDS.EXE | Project Labs Century CD manager for their CD/DVD storage device |
| N | Ccdecode | rundll32.exe streamci, StreamingDeviceSetup | Part of the closed caption decdoder/MS VBI codec. Should only run once |
| Y | CCDoctorLogonTesting | ccdoctor.exe | Checks your system to make sure it's configured properly for running Rational ClearCase, a source code management tool. ClearCase is fairly sophisticated so there are a lot of system-related things that can cause it grief. If you run ClearCase you should not disable this as it provides a valuable service, but technically it isn't required to use the ClearCase product |
| Y | ccenter | CCenter.exe | RAV AntiVirus
|
| Y | CcEvtMgr | ccEvtMgr.exe | Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via "ccApp" and was not required as a seperate entry but a recent update changed this |
| X | ccpApps | csrss.exe | Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! |
| X | ccpApps | lsass.exe | Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup! |
| U | ccProxy | CCPROXY.EXE | Part of Norton Internet Security, proxy server that is used to support the parental controls. If you turn parental controls off at user level the process is not loaded. Reported to cause excessive CPU usage |
| Y | CcPxySvc | CCPXYSVC.exe | Part of Norton's AntiVirus 2003, Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall |
| X | ccreg | explorer.exe | Added by the ZCREW TROJAN! Note - the valid "explorer.exe" is located in C:Windows or C:Winnt whereas this one is located in a C:WindowsSystem or C:WinntSystem subdirectory |
| Y | CcRegVfy | ccRegVfy.exe | Part of Norton AntiVirus 2003. "ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack" |
| Y | ccSetMgr | ccSetMgr.exe | Part of Norton AntiVirus 2004. What does it do? |
| X | ccUpdate | ccUpdate.exe | Added by the AGOBOT.YS WORM!
|
| U | ccWasher | aolwasher.exe | Webroot Cache & Cookie Washer - cleaning browser tracks, including cache, cookies, history, mail trash, drop-down address bar, auto-complete forms and downloaded program files for IE, Netscape and AOL |
| U | CCWC7a | ac.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean |
| U | CCWC7I | idxl.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 - auto clean |
| U | CCWC7s | stealth.exe | Moleculesoft Cache, Cookie & Windows Cleaner Ver. 7 |
| N | CDANTSRV | CDANTSRV.exe | C-Dilla License Management software. Used for any program that uses C-dilla Protection, example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually |
| X | Cdcompat | Cdcompat.exe | Added by the GEMA TROJAN! |
| X | cddrv32 | cddrv32.exe | Added by a variant of the CRYPTER.C TROJAN! |
| N | CDInterceptor | cdi.exe | CD indexer for measuring the speed of CD players |
| N | CDTray | CDTray.exe | On HP PCs, this is the small CD icon next to the time |
| ? | CeEKEY | CeEKey.exe | Toshiba Satellite E-Key related. Is it required? |
| U | CeEPOWER | cepmtray.exe | Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed, Monitor Shut Off, Hard Drive Shut-Off, Monitor Brightness, System Stand-by and System Hibernate times |
| ? | Ceic | Ceic.exe | ?? |
| X | Cekirge | [path to worm] | Added by the KERGEZ.A WORM! |
| X | center | [random name]32.exe | Added by the BOFRA.A WORM! |
| X | CentralProcessor | taskimgr.exe | Added by the BANCOS.J TROJAN! |
| ? | CEPA | wsot.exe | ?? |
| X | cesmain.dll | cmail.dll, Rundll32 | CnsMin "Chinese Keywords" hijacker related |
| N | CFD | CFD.exe | BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs |
| X | CFDStart | WinMuschi.exe | WINMUSCHI dialler |
| Y | cfgintpr | cfgintpr.exe | Configuration Interpreter - part of Tiny Personal Firewall V4 |
| N | cfgwiz | cfgwiz.exe | Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it |
| ? | cFosDNT | cFosDNT.exe | cFos DSL Modem driver related. What does it do and is it required? |
| ? | cFosInst_Check | cfosinst.exe | cFos DSL Modem driver related. What does it do and is it required? |
| X | cftmon32 | taskmgr*.exe [* = number] | Added by the SOWSAT.C and SOWSAT.J WORMS! |
| U | CGServer | cgserver.exe | Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs |
| X | Cgtask Services | cgtask.exe | Added by the LALA.B TROJAN! |
| U | ChamClock | ChamClock.exe | Chameleon Clock - system tray clock replacement |
| ? | ChangeLines | chngline.exe | ?? |
| N | Chatango | Chatango.exe | Chatango - "allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions, blogs, personal websites, Friendster profiles, and your visitors will be able to contact you instantly, without downloading anything, or registering. Alo use it to send email to your friends, allowing them to respond to you in real time!." The 'MessageCatcher' icon in the System Tray notifies you when you get a message. When you get a message, a little alert pops up, which you can click on and start chatting immediately |
| N | Chcenter | chcenter.exe | IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files" |
| X | Cheatle | GigaByte.exe | Added by the SHODI.B VIRUS! |
| N | Check for One Touch Update | wiseupdt.exe | Checks for updates for Visioneer OneTouch scanners |
| U | Check Messenger | cmesseng.exe | Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account |
| U | CheckIt | ToolBox.exe | CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parameters at intervals you specify |
| Y | CheckMsgPlus | MsgPlusH.dll, VerifyInstallation | Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. |
| ? | checktime | ct.exe | Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required? |
| U | CherryKeyMan | KeyMan.exe | Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys |
| U | ChineseStar | cstar.exe | Chinese language support software |
| N | CHKADMIN | CHKADMIN.EXE | Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" |
| X | chkdsk | c:autoexec.bat | Added by the ANPES WORM! |
| X | Choke | Choke.exe-blahh | Added by the CHOKE WORM! |
| X | chostsv | chostsv.exe | Added by the BANPAES.C TROJAN! |
| U | CHotKey | mhotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| U | CHotKey | MK9805.EXE | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features |
| U | CHotKey | zHotkey.exe | Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol , vol-, mute, etc. Only required for extended features |
| N | Christmas Music Player | TTEST6.EXE | "Christmas Music Player brings the music of the Christmas Holiday to your desktop" |
| ? | ChromeMark | keysh.exe | Related to this. Don't know what keysh.exe does though and if it's required |
| ? | ChronitelInitTV | CHTVINIT.EXE | ?? |
| X | CiaBackdoor | msldr.com | Added by a VIRUS! |
| X | cihost.exe | cihost.exe | Added by the LINST TROJAN! |
| N | CIJxP2PSERVER | CIJxP2PS.EXE | Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 |
| N | CISrvr Program | CISRVR.EXE | Related to internet setup on Compaq PC's |
| X | Cissi | Cissi.exe | Added by the CISSI.A WORM! |
| N | CitiVAN | CitiVAN.exe | Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again |
| Y | Cjstcom | Cjstcom.exe | Canon printer BJ status language monitor |
| X | Classes | int1.exe | "Switch" adult content dialler |
| X | Classes | intl.exe | "Switch" adult content dialler |
| X | Classes | run_21.exe | "Switch" adult content dialler |
| X | Classes | srv.exe | "Switch" adult content dialler |
| X | Classes | srv2.exe | "Switch" adult content dialler |
| X | Classes | MSTAR2.EXE | "Switch" adult content dialler
|
| X | Classes | mstart.exe | "Switch" adult content dialler
|
| U | CLCLSet | CLCL.exe | CLCL clipboard caching utility |
| ? | CleanEasyImg | cleanall.exe | ?? |
| U | CleanSweep Smart Sweep- Internet Sweep | Csinsm32.exe | Automatic logging of installs from Norton CleanSweep - available via Start -> Programs |
| N | CleanSweep Useage Watch | CSUSEM32.EXE | Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time |
| U | CleanTemp | CLEANT~1.EXEB | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| U | CleanTemp | CleanTemp.exe | CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory |
| N | Cleanup | ONICTASK.EXE | Internet Cleanup from Aladdin Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet |
| ? | CleanupProgram | cleanup.exe | In a C:Sonysys folder - Sony Vaio related? |
| N | Click Radio Tuner | clickr~1.exe | ClickRadio - subscription service playing radio music via the internet |
| N | Click Tray Calendar | ClickT~1.EXE | ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc |
| U | Clickoff | Clickoff.exe | Clickoff automatically dismisses annoying dialog boxes |
| X | ClickTheButton | CTB.EXE | ClickTheButton Downloader-MY adware |
| X | ClickTheButton | csrss.exe | ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup! |
| X | ClickTheButton | MSCStat.exe | ClickTheButton Downloader-MY adware |
| X | CLICONFG | CLICONFG.EXE | Added by the OPASERV.T WORM! |
| N | Client Access Check Version | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| ? | Client Access Express Welcome | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| N | Client Access Help Update | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| N | Client Access Service | CwbSvStr.Exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| ? | Client agent for ARCserve | W95AGENT.EXE | Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? |
| X | Client Server Runtime Process | csrsss.exe | Added by the SDBOT-LD WORM! |
| X | ClientMan1 | mscman.exe | Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" |
| N | Clik Status Monitor | toolsclickstat.exe | Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed |
| N | Clipbook Service | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | ClipMate5x | ClipMt5x.exe | Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clipmate6 | CLIPMT60.EXE | Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs |
| N | Clipomatic | Clipomatic.exe | Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data |
| N | Clipsrv | Clipsrv.exe | Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks |
| N | ClipTrak | ClipTrak.exe | ClipTrak - clipboard extender |
| N | ClipTrakker | ClipTrakker.exe | Cliptrakker - clipboard extender |
| U | CLMFrontPanel | clmpanel.exe | System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost |
| ? | clnwall | rundll.exe setupx.dll, InstallHinfSection ..delwall.inf | ?? |
| X | ClockSync | Sync.exe | ClockSynck - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available |
| U | ClockWise | CLOCKWISE.EXE | ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync |
| U | CloneCD | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| U | CloneCDElbyCDFL | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | CloneCDTray | CloneCDTray.exe | System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions |
| ? | Clotusorgreg0 | prtStart.exe Orgprt.exe | Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does? |
| X | ClrSchLoader | Loader.exe | Clearsearch variant of IGetNet |
| X | CLSID | com.exe | Adult content dialler |
| X | CLSID | dll.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Adult content dialler |
| X | CLSID | plugin.exe | Adult content dialler |
| X | CLSID | sed.exe | Adult content dialler |
| X | CLSID | msgplus.exe | Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
|
| ? | CM-SmWizard | SmWizard.exe | SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required? |
| U | cma | cma.exe | DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" |
| N | Cmaudio | Rundll32 cmicnfg.cpl, CMICtrlWnd | System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel |
| X | Cmd | cmd32.exe | Added by the TANKED WORM! |
| X | cmdcon | cmdcon.exe | Added by the CRYPTER.A TROJAN! |
| X | CME | cme.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CmeSYS | CMEsys.exe | Part of Gator advertising spyware - see here for removal instructions |
| X | CmeUPD | CMEupd.exe | Part of Gator advertising spyware - see here for removal instructions |
| ? | CMGrdian | CMGrdian.exe | One of the McAfee shared components. What does it do and is it required? |
| U | CMPDPSRV | CMPDPSRV.EXE | Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more." Installed with some Compaq and Lexmark printers |
| X | cmsound | vcpdll.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmsound | vcsystem.exe | Added by the TCXMEDI-D downloader TROJAN! |
| X | cmssSystemProcess | csmss.exe | Added by the AGENT-CO TROJAN!
|
| X | cmt101 | cmt101.exe | Added by a variant of the CRYPTER.C TROJAN! |
| X | cmx32 | cmx32.exe | Added by the GEMA.D TROJAN! |
| X | Cn323 | cnfrm33.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| X | CNBABE | CNBABE.EXE | Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing |
| N | cnet | kontiki.exe | Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops |
| X | Cnfrm32 | cnfrm.exe | Added by the MIMAIL.D or MIMAIL.G WORMS! |
| X | CnsMax | Internat.exe | Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir% |
| X | CnsMin | Rundll32.exe CNSMIN.DLL, Rundll32 | CnsMin "Chinese Keywords" hijacker related |
| N | CnxDslTaskBar | CnxDslTb.exe | Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems |
| U | Codename Dashboard | dashboard.exe | Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have any information you want, on your desktop, all the time" |
| X | Coldlife -icmp | Systray.exe | Added by the FLOOD.AV TROJAN! Note - this is not the legitimate SysTray.exe |
| U | coloreal | coloreal.exe | Makes colours sharper and brighter, but will only work with coloreal capable monitors |
| N | Colorific Control Panel | Hgcctl95.exe | From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor |
| X | COM Service | mscom32.com | Added by the BEASTY.H TROJAN! |
| X | COM Service | msynvr.com | Added by the BEASTY.G TROJAN! |
| X | COM Service | msjclh.com | Added by the PLUX TROJAN! |
| X | COM Service | msdrce.com | Added by the BEASTY.I TROJAN! |
| X | COM+ Event System | DRWTSN16.EXE | Added by a variant of the LOVGATE WORM! |
| X | Com+ Sys | csrs.exe | Added by the FORBOT-BT WORM!
|
| X | COM+ System Applications | lsas.exe | Added by the AGOBOT.SE WORM! |
| X | COM++ System | exploier.exe | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | suchost.exe | Added by a variant of the LOVGATE WORM! |
| X | COM++ System | svchost.exe... | Added by a variant of the LOVGATE WORM! |
| N | COM-IP | COMIP.EXE | COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) |
| U | ComAgent | ComAgent.exe | ComAgent - MDaemon's instant messaging client |
| X | ComcastSUPPORT | tgkill.exe | Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs |
| X | COMCFG | comcfg.exe | Added by the TOADCOM.A TROJAN! |
| U | COMDRV32 | svdhost.exe | Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Note - asks for permission to contact the IP address of http://www.protectcom.com/ |
| U | Comm Driver | commh32.exe | G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! |
| X | Command | system.exe | Added by the GATECRASH.A or GATECRASH.B TROJANS!
|
| X | Command | Gotit.exe | Added by the TITOG WORM! |
| X | COMMAND | command.exe | Added by the QQPASS.E TROJAN! |
| N | CommCtr | commctr.exe | "Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!". Available via Start -> Programs |
| U | Compaq Alerter | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| N | Compaq Computer Corp SCCenter Module | SCCENTER.EXE | For Compaq PC's. Part of Backweb |
| ? | Compaq Computer Security | Rundll32.exe SECURE32.CPL, Service | ?? |
| N | Compaq DMI | cpqdmi.exe | Compaq version of the Desktop Management Interface |
| N | Compaq Internet Setup | inetwizard.exe | For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list |
| U | Compaq Knowledge Center | silent.exe & matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support". You decide |
| N | Compaq Message Server | COMPAQ-RBA.EXE | Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not required and can cause problems |
| U | Compaq PK Daemon | cpqkl.exe | For Compaq laptops for programming user configurable keys. Not required unless you use them |
| N | Compaq Video CD Watcher | ?? | For Compaq PC's. MPEG viewer |
| ? | CompaqHW Comp Manager | cpqhcm.exe | Running on a Compaq laptop - any ideas? |
| N | CompaqPrinTray | printray.exe | Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop |
| N | CompaqSystray | cpqpscp.exe | Compaq System Tray icon |
| X | Compatibility Service Process | regsvs.exe | Added by the GAOBOT.YN WORM! |
| N | COMSMDEXE | comsmd.exe | 3Com tray icon |
| X | ComTry Web Searcher | wstray.exe | Comtry MP3 Downloader related - spyware |
| X | comxt | comxt.exe | Added by the COMXT TROJAN! |
| X | Config | service.exe | Added by the ISRAZ.B WORM! |
| X | Config Loadation | iEEexplore.exe | Added by the SDBOT.H TROJAN! |
| X | Config Loadatiorin | I3Explorer.exe | Added by the SDBOT.H TROJAN! |
| X | Config Loader | svchosl.exe | Added by the GAOBOT.P WORM! |
| X | Config Loader | sysldr32.exe | Added by the GAOBOT WORM! |
| X | Config Loader | scvhost.exe | Added by the GAOBOT.AE or GAOBOT.AO WORMS! |
| X | Config Loader for Microsoft Windows | mwincfg32.exe | Added by the AGOBOT.BD WORM! |
| X | Config Loader2 | explores.exe | Added by the GAOBOT.BT WORM! |
| X | Config33.exe | Config33.exe | Added by the SDBOT.T TROJAN!
|
| X | ConfiggLoader | cart322.exe | Added by the GAOBOT.DJ WORM! |
| U | ConfigSafe | CFGSAFE.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| U | ConfigSafe | AUTOCHK.EXE | ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice |
| N | ConfigServices | Config.exe | Part of initial setup on a Compaq PC |
| X | Configuration | [filename] | Added by the SDBOT-ML WORM!
|
| X | Configuration Default | Wuxat.exe | Added by the SPYBOT-CA WORM!
|
| X | Configuration File | Winset32.exe | Added by the FLUX.101 TROJAN!
|
| X | Configuration Loaded | wupdated.exe | Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS! |
| X | Configuration Loader | aim95.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | cmd32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | service5.exe | Added by the GAOBOT.AF WORM! |
| ? | Configuration Loader | lfass.exe | ?? |
| X | Configuration Loader | sycfg34.exe | Added by the GAOBOT.AN WORM! |
| X | Configuration Loader | wincrt32.exe | Added by the GAOBOT.BF WORM! |
| X | Configuration Loader | windex.exe | Added by the GAOBOT.BZ WORM! |
| X | Configuration Loader | dosrun32.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | Service.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | Servicess.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | sw32.exe | Added by the AGOBOT.BQ WORM! |
| X | Configuration Loader | System.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | Winreg.exe | Added by the GAOBOT.AO WORM! |
| X | Configuration Loader | sysinfo.exe | Added by the GAOBOT.FQ WORM!
|
| X | Configuration Loader | microsoft.exe | Added by the GAOBOT.JB WORM! |
| X | Configuration Loader | confgldr.exe | Added by the POLYBOT WORM! |
| X | configuration loader | winicfg32.exe | Added by the GAOBOT.GEN!POLY WORM! |
| X | Configuration Loader | svhst.exe | Added by the GAOBOT.YC WORM! |
| X | Configuration Loader | msgfix.exe | Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS! |
| X | Configuration Loader | msnss.exe | Added by the GAOBOT.AUS WORM! |
| X | Configuration Loader | IEXPL0RE.EXE | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | loadcfg32.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | MSTasks.exe | Added by the LOADCFG or SDBOT TROJANS! |
| X | Configuration Loader | systemry.exe | Added by a variant of the AGOBOT/GAOBOT WORM! |
| X | Configuration Loader | syscfg32.exe | Added by the SDBOT.B TROJAN! |
| X | Configuration Loading | svchos1.exe | Added by the GAOBOT.DK WORM!
|
| X | Configuration Loading | configldr.exe | Added by the AGOBOT-EC WORM! |
| X | Configuration Manager | CNFGLD32.EXE | Added by the SDBOT TROJAN! |
| X | Configuration Manager | Cnfgldr.exe | Added by the SDBOT TROJAN! |
| X | Configuration Service | suchost.exe | Added by the TREB TROJAN! |
| N | Configuration Utility | CONFIG.EXE | Controls linksys wireless connection. Available from the Desktop |
| U | Configuration Utility | wlanutil.exe | NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards) |
| X | Configuration Wizard | Cfgwiz32.exe | Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS "ISDN Configuration Wizard" (Cfgwiz32.exe) |
| N | Conmgr | conmgr.exe | Starts Winfax pro at startup |
| U | ConMgr.exe | conmgr.exe | Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut |
| X | Connect2Party | connect2party.exe | Adult content dialler |
| N | Connection Manager | CManager.exe | SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service |
| X | Cons | consol32.exe | Hijacker - redirects to a p0rn portal, where foistware like ISTBar gets stealth installed |
| X | conscorr | conscorr.exe | Added by the STUBBY.C TROJAN! |
| ? | Contacte | contacte.exe | Some kind of driver? |
| X | ContentDownload | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| X | ContentService | winservn.exe | Homepage hijacker |
| X | ContinueInstall | bpsinstall.exe | BrowserAid parasite |
| X | Control | rundll32.exe ctrlpan.dll, Restore ControlPanel | CoolWebSearch parasite variant |
| X | Control handler | ***********.exe [* = random char] | CoolWebSearch parasite variant
|
| N | control panel | smctrlw.exe | System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card |
| X | Control Panel | System.exe | Added by the DANI TROJAN! |
| N | ControlCenter2.0 | brctrcen.exe | Brother scanner 'Control Center' application - can be started manually
|
| N | ControlCentreTray | XWCTray.exe | System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc |
| X | Controlled Resource System Service | crss.exe | Added by the AGOBOT.GH WORM! |
| N | Controller | WFXCTL32.EXE | From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs |
| X | ControlPanel | rundll32 internat.dll, LoadKeyboardProfile | CoolWebSearch parasite variant |
| X | ControlPanel | host32.exe internat.dll, LoadKeyboardProfile | Added by a vairant of the DELF.DW TROJAN! |
| U | Cookie Cop 2 | CookieCop.exe | Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cookie Pal | CPBRWTCH.EXE | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CookieJar | Cookiejar.exe | Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | CookiePatrol | CookiePatrol.exe | CookiePatrol - PestPatrol's cookie interceptor stopping spyware cookies |
| U | CookieWall | cookie.exe | CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| U | Cool Desk | cdesk.exe | Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you |
| X | CoolDownloads | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| X | CoolMP3 | rundll32.exe MSA64CHK.dll, DllMostrar | MatrixDialer related |
| U | CoolSwitch | taskswitch.exe | ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen |
| N | Coolwallpaper | cwm_tray.exe | Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers |
| X | coolwebprogram | clrssn.exe | CoolWebSearch parasite variant |
| U | CopernicPerUserTaskMgr | CopernicPerUserTaskMgr.exe | Automatic tasking feature of Copernic Pro multi-search engine tool |
| N | Copyright | mwcpyrt.exe | Displays copyright information on IBM ThinkPads |
| U | CoreCenter | CoreCenter.exe | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| U | CoreCenter | CORECE~1.EXE | MSI Core Center - motherboard utility for monitoring CPU speed, voltages, temperatures and fans speeds as well as overclocking |
| N | Corel Colleagues & Contacts Reminders | cffrem.exe | Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of Corel Print Office |
| N | Corel Desktop Application Director | dadx.exe | The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs |
| N | Corel Family & Friends reminders | CFFREM.EXE | Corel Family & Friends - all-in-one calender, address book and list manager. Part of Corel Print House Magic |
| N | Corel Registration | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Registration Reminder | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | Corel Reminder | NAVBROWSER.EXE | If you don't want to register Corel products and be reminded about it every 2 weeks disable it |
| N | CorelCENTRAL 10 | I_26dadCC.exe | CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs |
| N | CorelMedia FoldersIndexer8 | MFindexer.exe | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| N | CorelMedia FoldersIndexer8 | MFINDE~1.EXE | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office |
| X | CoreSrv | coresrv.exe | Some IRC trojans/worms use this - see here for more information |
| ? | CORESYS | coresys.exe | ?? |
| N | CorrectConnect | CConnect.exe | Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available |
| U | CostAware | niIPCApp.exe | NetInternals CostAware - download quota measuring tool |
| N | Country Select | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| N | CountrySelection | pctptt.exe | Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required |
| ? | Coupon Offers | ?? | ?? |
| X | couponica | couponica.exe | Adware - see here |
| U | CP32NOT | CP32BTN.EXE | For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons |
| ? | CPA9P2PSERVER | CPA9P2PS.exe | Found on a Compaq Presario but what is it? |
| U | CPATR10 | CPATR10.EXE | Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast |
| U | CPBrWtch | CPBrWtch.exe | Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return |
| Y | CPD_EXE | CPD.EXE | Firewall bundled with McAfee VirusScan 6.* |
| X | cpntmgc | wincomp.exe | MagicControl downloader trojan variant |
| X | cpntmgc | simcss.exe | MagicControl downloader trojan variant |
| X | cpntmgc | navpmc.exe | MagicControl downloader trojan variant |
| X | cpntmgc | winmgts.exe | MagicControl downloader trojan variant |
| ? | CPortPatch | cppatch.exe | CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? |
| Y | CPQAcDc | CPQAcDc.exe | Compaq PowerCon power management software for laptops |
| U | CPQAlert | CPQAlert.exe | Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information |
| N | CPQBootPerfDB | CPQBootPerfDB.EXE | See the entry for Compaq Message Server |
| Y | CPQCalib | CPQCalib.exe | Compaq PowerCon power management software for laptops |
| N | CPQDFWAG | CpqDfwAg.exe | For Compaq PC's. Runs Compaq diagnostics on every boot |
| U | CPQEASYACC | cpqeadm.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| U | cpqeaui | cpqeaui.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys |
| U | cpqek | kcpqek.exe | For Compaq PC's. Easy Access button support for the keyboard |
| U | CPQInet Runtime Service | CpqInet.exe | For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers |
| N | CPQINKAGENT | cpqinkag.exe | That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) |
| U | cpqns | cpqnpcss.exe | Related to Compaq.Net - not required if you don't use that |
| N | Cpqset | Cpqset.exe | Default settings software in Hewlett Packard notebook |
| Y | CPQSTUTFIX | stutfix.exe | For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton |
| X | cpr | cpr | Adroar.com adware downloader |
| X | CPU Manager | cpumgr.exe | Added by the PANDEM.B WORM! |
| U | CPUcool | Cpucool.exe | Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel |
| X | Cpusave | Cpusave.exe | Added by the GEMA TROJAN! |
| X | Cpusave32 | Cpusave32.exe | Added by the GEMA TROJAN! |
| X | cqlyg | world_cup_.bat | Added by the WCUP.A WORM! |
| ? | CQSCP2P SERVER | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| ? | CQSCP2PS | ?? | "Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed |
| U | cracked_windows1 | cracked_windows1.exe | Cracked Windows popup killer |
| N | CrazyTalk Serve | rundll32.exe CrazyTalk.dll, DIIServeMediaFile | CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS |
| X | CRC Value Verifier | crsss32.exe | Added by a variant of the RBOT WORM! |
| X | CRC Value Verifier | Crsss64.exe | Added by the RBOT-NY WORM!
|
| U | Creata Mail | JMSrvr.exe | Creata_Mail. Smileys, stationary and more for you email. Required if you want to access the program from Outlook or Outlook Express
|
| X | Create A Monster | createAMonster.exe | Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related
|
| N | CreateCD | Createcd.exe | Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs |
| N | CreateCD50 | Createcd50.exe | Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs |
| N | Creative AGP Wizard | agpwiz.exe | Part of Creative's BlasterControl |
| N | Creative Launcher | CTLauncher.exe | For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs |
| N | Creative MediaSource Go | CTCMSGo.exe | "Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats" |
| N | Creative PCI Audio Configuration Utility | starter.exe | System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer |
| N | Creative Service for CDROM Access | Ctsvccda.exe | Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs |
| N | Creative WebCam Tray | Camtray.exe | Creative WebCam tray control - can be started manually
|
| X | Creative.exe | Creative.exe | Added by the PROLIN WORM! |
| N | CreativeDiscNotifier | CTNOTIFY.EXE | For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel |
| U | CreativeMixer | CTMIX32.EXE | Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon |
| N | CriticalUpdate | Wucrtupd.exe | MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site |
| X | cronos | MARCO!.SCR | Added by the OPASERV.G WORM! |
| X | Crusty | dmcpl.exe | Added by the RUSTY WORM! |
| X | Cryptographic Service | ******.exe [* = random char] | Added by the KORGO.W or KORGO.X or KORGO.AB WORMS! |
| ? | Crystal 3D Audio Control | CWD3DSND.EXE | Crystal 3D Audio sound driver. Is it required? |
| N | csaRem | spqmdmui.exe | Compaq modem country selection |
| Y | CSAV_CheckViruses | vchk.exe.exe | Part of Command AntiVirus |
| ? | csc | csc.exe | ?? |
| U | CSINJECT.EXE | CSINJECT.EXE | Part of Quarterdeck/Norton CleanSweep. For a full description see here. An excerpt - "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes." |
| X | csrsc | csrsc.exe | Added by an unidentified VIRUS, WORM or TROJAN! |
| X | CSRSS | CSRSS.EXE | Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling |
| X | CSRSS Loader | csrsss.exe | Added by the AGOBOT.TX WORM! |
| X | CSRSWIN | [trojan filename] | Added by the WINSHELL.50 TROJAN! |
| X | CSRSX | [trojan filename] | Added by the WINSHELL.50.B TROJAN! |
| Y | CSScheduleCheck | SCHWIZEX.EXE | Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot |
| X | csss | Csss.exe | Added by the BALICK TROJAN! |
| U | CSS_Central | CSS_1631.EXE | CSS Communication Agent (95 Host) from Command Software Systems "CSS Central? provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console." |
| X | CSV7P70 | CSV7P070.exe | ClearSearch adware related |
| X | CSV7P91 | CSV7P91.exe | ClearSearch adware related
|
| Y | ct | ct.exe | ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it |
| N | CTAVTray | CTAvTray.exe | For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ |
| N | CTDVDDet | CTDVDDet.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| N | CTDVDDet | CTDetect.exe | Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again |
| U | ctfmon | ctfmon.exe | CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here |
| X | ctfmon | taskmgr32*.exe [* = number] | Added by the SOWSAT.B WORM! |
| X | Ctfmon.exe | ctfmon32.exe | CoolWebSearch parasite related - hijacking to Slawsearch.com |
| U | CTHELPER | CTHELPER.EXE | CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative?s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it |
| X | CTime | [path to trojan] | Added by the HTTPDOS TROJAN! |
| X | CTin10 | CTin10.exe | Added by the BANCOS.E TROJAN! |
| ? | CTPDPSRV | CTPDPSRV.EXE | Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required? |
| N | CTRegRun | CTRegRun.exe | For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative |
| U | CtrlVol | CtrlVol.exe | Acer's on screen volume control using the Fn key |
| N | CTStartup | CTEaxSpl.exe | Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard |
| U | CTsysVol | CTSYSVOL.exe | Creative sound card volume controls |
| ? | cttdpsrv | cttdpsrv.exe | ?? |
| Y | cuagentExe | Cuagent.exe | Command Antivirus related |
| X | cuo | cuo.exe | Added by the BUGBEAR.A WORM! |
| N | cursor | Screendragon_VS_Taskbar.exe | ScreenDragon video player |
| N | CursorXP | CursorXP.exe | CursorXP from Stardock - tool for creating mouse cursors |
| U | Customizer2000 | logon.exe | Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" |
| N | CuteMX | CuteMX.EXE | File sharing utility |
| X | cvmonitor.exe | cvmonitor.exe | Added by the SDBOT.BV WORM! |
| Y | CVPND | cvpnd.exe | Sub-system used by Cisco VPN client for making a connection to a remote IPSec server |
| U | CWatch | cw.exe | ChatWatch - chat monitoring tool |
| N | cwbckver | cwbckver.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources |
| N | cwbinhlp | cwbinhlp.exe | Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries |
| N | cwbsvstr | cwbsvstr.exe | Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources |
| ? | cwbwlwiz | cwbwlwiz.exe | Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? |
| ? | Cwcdschk.exe | Cwcdschk.exe | IBM Thinkpad related? |
| N | CXMon | Hpi_Monitor.exe | Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs |
| N | Cyber | cyberchk.exe | Part of Belkins "Multimedia Cleaning Kit" and is
automatically installed when you run their optical disk drive cleaning utility - to remind
you to clean your drive after "x" amount of time has passed |
| U | Cyber Trio | showmode.exe | From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs |
| U | Cyber-Defender 2003 | uwcdsvr.exe | Cyber Defender 2003 |
| X | cyberfree.exe | ****.dat [* = random char] | Unidentified adware |
| U | CyberLat Ram Cleaner | CLRamCleaner.exe | CyberLat RAM Cleaner is a program that Frees, Optimizes and Defrags your system's wasted memory (RAM). Some users swear by programs such as this but I suggest you read this article and make up your own mind |
| N | CyberMedia Agent | CMAGENT.EXE | Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled |
| X | CyberWolf | CyberWolf.exe | Added by the KICKIN.A (or CYDOG.C) WORM! |
| X | CyDoor | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| X | CydoorUpdate | CD_Load.exe | Adware. Check here for information about Cy-Door and here for a program that can remove it |
| N | CyphTray | CyphTray.exe | Cypherus - encryption software |
