[!NoLoad] Confirmed=U Filename=winrecon.exe Description=WinRecon - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [$EnterNet] Confirmed=U Filename=Enternet.exe Description=Connection manager for the EnterNet ISP. You can also use RASPPOE Source=Paul Collins Startup list [%cmpmixtitle%] Confirmed=? Filename=%cmpmixstr% Description=Possibly related to C-Media Mixer Control panel? Source=Paul Collins Startup list [] Confirmed=X Filename=Regsrv32.com Description=Added as a result of the SOUTHGHOST VIRUS! Source=Paul Collins Startup list [] Confirmed=X Filename=App.exe Description=Added as a result of the WAXPOW VIRUS! where <filename> is the executed filename Source=Paul Collins Startup list [] Confirmed=X Filename=Svchosts.exe Description=Added as a result of the SDBOT.N VIRUS! where <name> can be random Source=Paul Collins Startup list [] Confirmed=X Filename=wincpu.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [] Confirmed=X Filename=elf.exe Description=Elf is a hacker program, tied to a trojan server Source=Paul Collins Startup list [(*)API Machine] Confirmed=X Filename=winSOCKS.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(*)Run] Confirmed=X Filename=win32API.exe Description=Homepage hijacker, see here (* = any digit) Source=Paul Collins Startup list [(Default)] Confirmed=X Filename=media_driver.exe Description=Added as a result of the TUPEG VIRUS! Source=Paul Collins Startup list [(Default)] Confirmed=X Filename=Shania.vbs Description=Added as a result of the SHANIA VIRUS! Source=Paul Collins Startup list [(Default)] Confirmed=X Filename=NOTEPAD.exe Description=Added as the result of the RUSTY VIRUS! Note - not to be confused with the valid Windows "NOTEPAD" text editor Source=Paul Collins Startup list [*JanisRuckenbrodII] Confirmed=X Filename=janis.com Description=Added as a result of the POPS VIRUS! Source=Paul Collins Startup list [*StateMgr] Confirmed=Y Filename=statemgr.exe Description=Windows ME default for System Restore. Do NOT disable! Source=Paul Collins Startup list [,main drive Loader] Confirmed=X Filename=wininfo.exe Description=Suspected malware as it appears in 3 different registry locations - see here Source=Paul Collins Startup list [.NET config] Confirmed=? Filename=sysmon32.exe Description=?? Source=Paul Collins Startup list [/l:eng] Confirmed=N Filename=N/A Description=Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup Source=Paul Collins Startup list [000StTHK] Confirmed=U Filename=000StTHK.exe Description=Toshiba Hot key functionality for the function keys (Fn-Esc, Fn-F1 (lock), Fn-F2, Fn-F3, Fn-F4, Fn-F5 (switching between laptop and CRT display output), etc...) Source=Paul Collins Startup list [00THotkey] Confirmed=U Filename=00THotKey.exe Description=For Toshiba Satellite notebook series to use the front buttons, play, stop, next, prev. Source=Paul Collins Startup list [123456] Confirmed=X Filename=rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl Description=Added as a result of the KITRO.C (or DANDI.A) VIRUS! 123456 can be any random 3 to 6 digit number Source=Paul Collins Startup list [12Ghosts Popup-Killer] Confirmed=U Filename=12popup.exe Description=12Ghosts Popup-Killer Source=Paul Collins Startup list [17779Proj2002] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [1:] Confirmed=N Filename=hpdrv.exe Description=HP utility for monitoring when and how many recoveries have been done Source=Paul Collins Startup list [1A:MacVisionTrayMonitor] Confirmed=N Filename=TrayMonitor.exe Description=Comes with the MacVision program for monitoring tray icons (Note : program is by Stardock) Source=Paul Collins Startup list [1A:Stardock MCP] Confirmed=Y Filename=mcpserver.exe Description=Master Control Program for Stardock apps, in development. People should leave it running if they're using any of the Stardock applications, as it's important for the above two and likely to become important for others (like WindowBlinds) as time goes on Source=Paul Collins Startup list [1A:Stardock TrayMonitor] Confirmed=Y Filename=TrayServer.exe Description=For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX Source=Paul Collins Startup list [1CmailS] Confirmed=? Filename=NETMAIL.EXE Description=?? Source=Paul Collins Startup list [1Srv32] Confirmed=U Filename=SpyAgent4.exe Description=SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC." Source=Paul Collins Startup list [1Win32Cfg] Confirmed=U Filename=SpyBuddy.exe Description=SpyBuddy monitoring software Source=Paul Collins Startup list [1Win32Cfg] Confirmed=U Filename=Keyloggerpro.exe Description=KeyloggerPro - monitoring software Source=Paul Collins Startup list [2020Downloader] Confirmed=X Filename=mssvr.exe Description=2020Search Toolbar related. Reported to be auto-installed Source=Paul Collins Startup list [2wSysTray] Confirmed=U Filename=2portalmon.exe Description=2Wire Homeportal user interface Source=Paul Collins Startup list [39ELTFH25Z8SKF] Confirmed=? Filename=Ezg1q5.exe Description=Seems to be associated with software by Resplendence SP ? Source=Paul Collins Startup list [3c1807pd] Confirmed=Y Filename=3cmlink.exe 3cpipe-3c1807pd Description=3Com WinModem driver. See here for more WinModem information Source=Paul Collins Startup list [3capplnk] Confirmed=Y Filename=3capplnk.exe Description=US Robotics Modem driver Source=Paul Collins Startup list [3cdminic] Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3CM Link] Confirmed=? Filename=3cmcnkw.exe Description=?? Source=Paul Collins Startup list [3Cmlink] Confirmed=Y Filename=3CmlinkW.exe Description=For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information Source=Paul Collins Startup list [3ComDMIAgent] Confirmed=N Filename=3CDMINIC.EXE Description=3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards Source=Paul Collins Startup list [3cpipe-USRpdA] Confirmed=Y Filename=USRmlnkA.exe Description=Modem driver files from US Robotics Source=Paul Collins Startup list [3D Text] Confirmed=N Filename=3D Text.scr Description=Added as a result of the JERMY.A VIRUS! Source=Paul Collins Startup list [3Deep Control Panel] Confirmed=U Filename=3DeepCTL.EXE Description=From LightSurf Technologies (nee E-Color) - 3Deep corrects lighting, shading and color for all your 2D and 3D games Source=Paul Collins Startup list [3Dfx Acc] Confirmed=X Filename=GFXACC.EXE Description=Added as a result of the GIBE VIRUS! Source=Paul Collins Startup list [3dfx Task Manager] Confirmed=N Filename=3dfxMan.exe Description=System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs Source=Paul Collins Startup list [3dfx Tools] Confirmed=Y Filename=3dfxCmn.dll Description=Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards Source=Paul Collins Startup list [3dfxv2ps.dll] Confirmed=Y Filename=3dfxv2ps.dll Description=Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards Source=Paul Collins Startup list [3Dlabs Taskbar Display Manager] Confirmed=? Filename=3DLman.exe Description=3DLabs graphics driver related. System Tray access to display settings? Source=Paul Collins Startup list [3DLabsHelperDemon] Confirmed=U Filename=3dldemon.exe Description=Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore), so it should take zero CPU time and virtually zero memory, since it will all be paged out to the hard drive." In most cases it can be safely disabled Source=Paul Collins Startup list [3qdctl.exe] Confirmed=U Filename=3qdctl.exe Description=Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup, restoring volume and other audio settings to a pre-determined default. Similar to Creative Lab's AudioHQ Source=Paul Collins Startup list [3ware 3DM] Confirmed=Y Filename=3dm.exe Description=Monitors status of the disk array on 3ware IDE RAID controllers Source=Paul Collins Startup list [4wd!!!] Confirmed=X Filename=Natal!.pif Description=Added as a result of the OPASERV.AI VIRUS! Source=Paul Collins Startup list [5-1-61-96] Confirmed=X Filename=members-area.exe Description=Adult content dialler Source=Paul Collins Startup list [5-2-46-112] Confirmed=X Filename=5-2-46-112.exe Description=Adult content pop-up dialler. Removal instructions here Source=Paul Collins Startup list [666] Confirmed=X Filename=Ska.exe Description=Added as a result of the NETBUS VIRUS! Source=Paul Collins Startup list [;Rundll] Confirmed=X Filename= Description=Added as a result of the PWSLEGMIR.E VIRUS! Source=Paul Collins Startup list [@] Confirmed=X Filename=regedit -s ..\win.dll Description=Added as a result of the SEEKER.K VIRUS! Source=Paul Collins Startup list [@Hoc Toolbar] Confirmed=N Filename=AtHoc.exe Description=One-click activated browsing toolbar used by various web-sites. See here for more info Source=Paul Collins Startup list [@loha] Confirmed=N Filename=reminder.exe Description=Registration reminder for @loha@home E-mail utility Source=Paul Collins Startup list [@tour_ww] Confirmed=X Filename=@tour_ww[1].exe Description=Adult content dialler Source=Paul Collins Startup list [a-winpoet-service] Confirmed=Y Filename=winpppoverethernet.exe Description=WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking Source=Paul Collins Startup list [A1000 Settings Utility] Confirmed=U Filename=cpqa1000.exe Description=Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan, print, copy and fax. Only required if you use these features Source=Paul Collins Startup list [A4Proxy] Confirmed=U Filename=A4Proxy.exe Description=Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites Source=Paul Collins Startup list [AAACLEAN] Confirmed=? Filename=AAACLEAN.INF Description=?? Source=Paul Collins Startup list [AAAKeyboard] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [AAATraySaver] Confirmed=N Filename=TraySaver.exe Description=System Tray management utility from Mike Lin which allows you to hide, show, restore icons that are lost in an Explorer crash, remove dead tray icons, minimize any window to the System Tray Source=Paul Collins Startup list [AAK] Confirmed=U Filename=aak.exe Description=Advanced Anti-Keylogger - "Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere" Source=Paul Collins Startup list [ab EazyScheduler] Confirmed=? Filename=ezsched.exe Description=?? Source=Paul Collins Startup list [ABBYY Community Agent] Confirmed=N Filename=CAGENT.EXE Description=Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software Source=Paul Collins Startup list [ABC] Confirmed=X Filename=keylogger.exe Description=Monitors keystrokes so you can check if someone has typed anything while your away from your PC. Reported as spyware by SpyCop in their FAQ Source=Paul Collins Startup list [Absolute Shield] Confirmed=U Filename=dseraser.exe Description=Absolute Shield/Evidence Eliminator - iternet history eraser Source=Paul Collins Startup list [ABsr] Confirmed=X Filename=absr.exe Description=Added as a result of the AUTOUPDER VIRUS! Source=Paul Collins Startup list [absr] Confirmed=X Filename=mwsvm.exe Description=SeekSeek search hijacker related - as seen here Source=Paul Collins Startup list [abtu] Confirmed=X Filename=mp3serch.exelopsearch.exe Description=Loads the executable for Lop.com. mp3serch.exe is the final version whilst lopsearch.exe is the beta version Source=Paul Collins Startup list [AbyssWebServer] Confirmed=U Filename=abyssws.exe Description=Abyss web server Source=Paul Collins Startup list [AcBtnMgr_Xxx] Confirmed=Y Filename=AcBtnMgr_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [acc] Confirmed=U Filename=acc.exe Description=Advanced Call Center - "full-featured yet easy-to-use answering machine software for your voice modem" Source=Paul Collins Startup list [Accelerate] Confirmed=U Filename=accelerate.exe Description=Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection Source=Paul Collins Startup list [Access Ramp Monitor] Confirmed=N Filename=armon32.exe Description=Monitors your progress on the internet; hang-ups, connection speeds, internet congestion and traffic flow. It prevents some games from running also. To disable the Access Ramp Monitor (1) Open Windows Explorer (2) Open the Program Files folder (3) Open the MindSpring folder (4) Open the AccessRamp folder (5) Double-click on the ARMCfg32.exe file (6) Uncheck Enable Dialup Monitor and click OK (7) Restart the computer and try again Source=Paul Collins Startup list [AccessRamp Monitor01] Confirmed=N Filename=ARMon32a.exe Description=From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup, or go into Add/Remove programs uninstall IP Insight by hand if it's already installed. It really doesn't do a darn thing for you. It was intended to help DSL techs monitor QoS, but the backend part was never implemented (at least as of earlier this year). This will not affect the user's ability or inability to access their DSL service." Source=Paul Collins Startup list [AccessRampLAN01] Confirmed=N Filename=ARUpld32.exe Description=Version of the above for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file, you can execute it and remove all the monitoring activities it does. Removing all the checks in all the boxes (both tabs) still calls ARUpld32.exe to start when you start the dial up. You can block it from sending info if you have Zone Alarm installed. Renaming the extension of ARUCfg32.exe to ARUCfg32.exe1 works. The ARUpld32.exe is not loaded when launching the dial up client. Written by IP Insight and also included with Earthlink Total Access 2003 Source=Paul Collins Startup list [AcctMgr] Confirmed=U Filename=AcctMgr.exe Description=Norton� Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information, and retrieves the data needed for email logins, shopping orders, banking, and other online activities�all from the safety of your own PC Source=Paul Collins Startup list [AccuWeather.com� Desktop] Confirmed=N Filename=?? Description=Desktop weather from AccuWeather.com Source=Paul Collins Startup list [AcerNotebookManager] Confirmed=U Filename=almxptray.exe Description=System Tray access on some Acer Notebooks to give faster access to system settings Source=Paul Collins Startup list [AcerPowerkey] Confirmed=U Filename=Powerkey.exe Description=PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3 Source=Paul Collins Startup list [ACMonitor_Xxx] Confirmed=Y Filename=ACMonitor_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [acocash] Confirmed=X Filename=fastdown.exefastfown.exe Description=Adult content dialler Source=Paul Collins Startup list [Acombo3dmouse] Confirmed=U Filename=Acombo3d.exe Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Aconti] Confirmed=X Filename=aconti.exe Description=Adult content dialler Source=Paul Collins Startup list [acoustic] Confirmed=U Filename=acoustic.exe Description=Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained Source=Paul Collins Startup list [acpart] Confirmed=N Filename=agpart11.exe Description=Program for finding trucks on-line Source=Paul Collins Startup list [Acrobat Assistant] Confirmed=N Filename=ACROTRAY.EXE Description=If you want to create a PDF using Acrobat Distiller, you can execute this program manually just before doing so Source=Paul Collins Startup list [Acronis Scheduler2 Service] Confirmed=U Filename=schedhlp.exe Description=Part of Acronis True Image - backup software. Co-operates with the "schedul2.exe" servuce to perform backup/restore tasks correctly. Required if you want to use TrueImage to do some real backup/restore tasks - not if you only want to explore/mount images Source=Paul Collins Startup list [Acronis TrueImage Monitor] Confirmed=N Filename=TrueImageMonitor.exe Description=Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage Source=Paul Collins Startup list [Action Manager 32] Confirmed=N Filename=am32.exe Description=Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs Source=Paul Collins Startup list [ActionAgent] Confirmed=? Filename=actionagent.exe Description="A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client". Is it required? Source=Paul Collins Startup list [Activation] Confirmed=N Filename=Activation.exe Description=Part of Microsoft Money Source=Paul Collins Startup list [Activboard] Confirmed=U Filename=MMKeybd.exe Description=Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock, Caps Lock, Scroll Lock keys Source=Paul Collins Startup list [ActiveDesktop] Confirmed=X Filename=systray32.exe Description=Added as a result of the DABOOM VIRUS! Source=Paul Collins Startup list [ACTIVEDS] Confirmed=X Filename=ACTIVEDS.EXE Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [ActiveEyes] Confirmed=N Filename=ActiveEyes.exe Description=ActiveEyes from TFI Technology Source=Paul Collins Startup list [ActiveMenu] Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [ActivePlus] Confirmed=U Filename=activeplus.exe Description=Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on) Source=Paul Collins Startup list [ActiveShield] Confirmed=Y Filename=MCVSSHLD.EXE Description=McAfee VirusScan On-line. See also McAgentExe Source=Paul Collins Startup list [ActivSurf] Confirmed=N Filename=backweb*****.exe Description=Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [Ad Blocker] Confirmed=U Filename=blocker.exe Description=Ad Blocker - blocks popups, and also removes banners, image ads and flash ads Source=Paul Collins Startup list [Ad Online Guide] Confirmed=? Filename=adonlineguide.exe Description=?? Source=Paul Collins Startup list [Ad-aware] Confirmed=N Filename=Ad-aware.exe Description=Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs Source=Paul Collins Startup list [Ad-Muncher] Confirmed=U Filename=ADMUNCH.EXE Description=Ad Muncher removes adverts, pop-ups and general annoyances in your browser, file-sharing and messenger programs. Causes conflicts with Outlook, game sites and web-building applications Source=Paul Collins Startup list [Ad-watch] Confirmed=U Filename=Ad-watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [AD2KClient] Confirmed=U Filename=AD2KClient.exe Description=Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [AdaptecDirectCD] Confirmed=N Filename=Directcd.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [Adaware Bootup] Confirmed=N Filename=ad-aware.exe Description=Ad-aware from Lavasoft. Checks your PC for "Spyware" which reports back your internet activities to "base". Available via Start -> Programs Source=Paul Collins Startup list [Adaware lptt01orAdaware ml097e] Confirmed=X Filename=adaware.exe Description=Variant of the RapidBlaster parasite (in a "Adaware" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [AddClass] Confirmed=X Filename=AddClass.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [AdDelete] Confirmed=U Filename=AdDelete.exe Description=Banner advertisment blocker Source=Paul Collins Startup list [AdDestroyer] Confirmed=X Filename=AdDestroyer.exe Description=Like VirtualBouncer, malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the malware it claims to remove/prevent, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code Source=Paul Collins Startup list [ADG] Confirmed=? Filename=ADG.exe Description= SoundBlaster Audigy related? Source=Paul Collins Startup list [ADGJdet] Confirmed=N Filename=ADGJDet.exe Description=Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Source=Paul Collins Startup list [ADM Library Loader] Confirmed=X Filename=admlib32.exe Description=Added as a result of a variant of the SDBOT VIRUS! Source=Paul Collins Startup list [Adobe] Confirmed=X Filename=Adobe.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Adobe Gamma Loader] Confirmed=U Filename=Adobe Gamma Loader.exe Description=Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine Source=Paul Collins Startup list [AdobeA] Confirmed=X Filename=adobes.exe Description=Added as a result of the FLOOD.BA VIRUS! Source=Paul Collins Startup list [AdobeFonts] Confirmed=X Filename=fonts.hta Description=Browser hijacker - redirecting to Hugesearch.net Source=Paul Collins Startup list [adp] Confirmed=X Filename=adp.exe Description=Spyware installed by Net2Phone, Limewire, Cydoor, Grokster, KaZaa, etc Source=Paul Collins Startup list [ADQuickAccess] Confirmed=N Filename=Adtray.exe Description=After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95 Source=Paul Collins Startup list [AdRoarUpdate] Confirmed=X Filename=ARUpdate.exe Description=AdRoar adware updater Source=Paul Collins Startup list [ADService] Confirmed=U Filename=ADService.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [AdsGone] Confirmed=U Filename=Adsgone.exe Description=AdsGone - pop-up stopper Source=Paul Collins Startup list [ADSL Diagnostic Tools] Confirmed=N Filename=mapiicon.exe Description=System tray access to ADSL modem diagnostic tools. Available via Start -> Programs Source=Paul Collins Startup list [AdslTaskBar] Confirmed=Y Filename=rundll32.exe stmctrl.dll, TaskBar Description=ISP software, initializes DSL modem Source=Paul Collins Startup list [ADSS] Confirmed=Y Filename=ADSS.exe Description=ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied Source=Paul Collins Startup list [AdSubtract] Confirmed=U Filename=adsub.exe Description=AdSubtract blocks ads, cookies, pop-up windows, animations, music, and more. Can be disabled from within AdSubtract. Available via Start -> Programs Source=Paul Collins Startup list [AdultX] Confirmed=X Filename=AdultX.exe Description=Adult content dialler and hijacker Source=Paul Collins Startup list [Adult_Chat] Confirmed=X Filename=Adult_Chat.exe Description=Adult content dialler Source=Paul Collins Startup list [Adult_Chat1] Confirmed=X Filename=Adult_Chat1.exe Description=Adult content dialler Source=Paul Collins Startup list [ADUserMon] Confirmed=U Filename=ADUserMon.exe Description=Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk Source=Paul Collins Startup list [Advanced Tools CheckorADVCHK] Confirmed=N Filename=ADVCHK.EXE Description=Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget Source=Paul Collins Startup list [Advapi] Confirmed=X Filename=Advapi.exe Description=Added as a result of the NETDEVIL.12 (NetDevil 1.2) VIRUS! Source=Paul Collins Startup list [Advertising Killer] Confirmed=U Filename=Akiller.exe Description=AKiller - pop-up stopper Source=Paul Collins Startup list [Adware Agent] Confirmed=U Filename=adware agent.exe Description=Adware Agent popup blocker Source=Paul Collins Startup list [Aeiwlsta.exe] Confirmed=? Filename=Aeiwlsta.exe Description=IBM High Rate Wireless LAN Adapter driver. Is it required? Source=Paul Collins Startup list [AELaunch] Confirmed=N Filename=AELaunch.exe Description=Audio Applications Launcher for the Philips Acoustic Edge soundcard Source=Paul Collins Startup list [AeXSWDUsr] Confirmed=? Filename=AeXSWDUsr.exe Description=Altiris Express NS Client Manager software. Is it required? Source=Paul Collins Startup list [AEZBProc] Confirmed=U Filename=aptezbp.exe Description=IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation, volume control, and few quickstart buttons. Keyboard will work without it but you lose the special functions Source=Paul Collins Startup list [AFAFilter] Confirmed=U Filename=windefault.exe Description=AFAFilter - internet filter software Source=Paul Collins Startup list [Agent] Confirmed=N Filename=Agent.exe Description=Cyberlink Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs Source=Paul Collins Startup list [Agente] Confirmed=? Filename=Remupd.exe Description=Part of Panda Antivirus Titanium. Is this an update reminder (guess because of the name), virus definition update reminder or something similar? Source=Paul Collins Startup list [AgfaCLnk] Confirmed=U Filename=AgfaCLnk.exe Description=For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive Source=Paul Collins Startup list [AGRSMMSG] Confirmed=Y Filename=AGRSMMSG.exe Description=IBM AMR modem driver Source=Paul Collins Startup list [AGSatellite] Confirmed=N Filename=AGSatellite.exe Description=Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs Source=Paul Collins Startup list [ahfporahfprog] Confirmed=U Filename=ahfp.exe Description=Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view, delete or modify them either" Source=Paul Collins Startup list [AHNSD] Confirmed=U Filename=AhnSD.exe Description=AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis Source=Paul Collins Startup list [AHNUE] Confirmed=? Filename=AHNUE.exe Description=?? Source=Paul Collins Startup list [AHQInit] Confirmed=N Filename=ahqinit.exe Description=Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required Source=Paul Collins Startup list [Ahst] Confirmed=X Filename=iebs.exe Description=Downloader - identified by BOClean as MENDWARE trojan. Also identified as PurityScan/Clickspring adware Source=Paul Collins Startup list [aiepk] Confirmed=U Filename=aiepk2.exe Description=Another IE Popup Killer - pop-up stopper Source=Paul Collins Startup list [AIM] Confirmed=N Filename=aim.exe Description=AOL Instant Messenger. If connected to the internet, automatically runs up AIM. Convenience more than anything. Available via Start -> Programs Source=Paul Collins Startup list [AIM reminder] Confirmed=X Filename=AIM reminder.exe Description=Added as a result of the BUDDY VIRUS! Source=Paul Collins Startup list [aimaol lptt01oraimaol ml097e] Confirmed=X Filename=aimaol.exe Description=Variant of the RapidBlaster parasite (in a "Aimaol" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [AimingClick] Confirmed=N Filename=AimingClick.exe Description=AimingClick from AimingTech. Web searching tool. Available via Start -> Programs Source=Paul Collins Startup list [AIMster] Confirmed=N Filename=?? Description=Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs Source=Paul Collins Startup list [AIMWDInstall] Confirmed=N Filename=AIMWDInstall.exe Description=Wild Tangent on-line games installer as part of AOL Instant Messenger. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [Aiptek Graphics Tablet (USB)] Confirmed=Y Filename=atwtusb.exe Description=USB interface for Aiptek Graphics Tablet (USB) Source=Paul Collins Startup list [AKEYNAME] Confirmed=X Filename=WinServ.exe Description=Added as a result of the EVILBOT.C VIRUS! Source=Paul Collins Startup list [AKiller] Confirmed=U Filename=akiller.exe Description=BuyPin Advertising Killer - popup killer Source=Paul Collins Startup list [Alarm Manager] Confirmed=U Filename=Alarm.app.exe Description=Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop Source=Paul Collins Startup list [AlarmWatcher] Confirmed=? Filename=AlarmWatcher.exe Description=Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required? Source=Paul Collins Startup list [Album Fast Start] Confirmed=N Filename=ABMTSR.EXE Description=Scanner software, not required for scanner to work Source=Paul Collins Startup list [AlcoholorAlcohol Autorun] Confirmed=U Filename=Alcohol.exe Description=Alcohol 120% - CD/DVD emulation/writing/copying software Source=Paul Collins Startup list [Alcom PCL Capture] Confirmed=? Filename=FMW_PCAP.EXE Description=?? Source=Paul Collins Startup list [AlcxMonitor] Confirmed=? Filename=Alcxmntr.exe Description=Realtek AC97 Audio - Event Monitor. What does it do and is it required? Source=Paul Collins Startup list [Alevir] Confirmed=X Filename=Alevir.exe Description=Added as a result of the OPASERV.A VIRUS! Source=Paul Collins Startup list [Alevir] Confirmed=X Filename=Alevir.exe Description=Added as a result of the OPASERV.F or OPASERV.G VIRUSES! Source=Paul Collins Startup list [AlevirOld] Confirmed=X Filename= Description=Added as a result of the OPASERV.G VIRUS! Source=Paul Collins Startup list [Alexa] Confirmed=N Filename=Alexa.exe? Description=Alexa Toolbar "is a downloadable toolbar that helps you navigate the Internet as you surf, by instantly providing you with related information about the site you're viewing". Available via Start -> Programs Source=Paul Collins Startup list [ALFY Accellerator] Confirmed=? Filename=AlfyAC~1.exe Description=?? Source=Paul Collins Startup list [AlienAutopsy] Confirmed=N Filename=Test_BS.exe Description=Alienware computer technical support software Source=Paul Collins Startup list [ALiSndMgr] Confirmed=Y Filename=ALiSndMg.exe Description=ALi AC97 Sound driver Source=Paul Collins Startup list [AliUSBfix] Confirmed=? Filename=GREENMK.exe Description=May be realted to a USB 2.0 PCI card - the IOgear GIC220OU? Source=Paul Collins Startup list [All Aboard Status] Confirmed=U Filename=stswin.exe Description=All Aboard! Internet Connection Sharing status icon Source=Paul Collins Startup list [All Sea screen saver] Confirmed=X Filename=TaskTray.exe Description="Free screensaver", installs lots of foistware. See here. Get rid of it Source=Paul Collins Startup list [All Sea web link] Confirmed=X Filename=FWLink.exe Description="Free screensaver", installs lots of foistware. See here. Get rid of it Source=Paul Collins Startup list [allSnap] Confirmed=U Filename=allSnap.exe Description="allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop" Source=Paul Collins Startup list [Alogserv] Confirmed=U Filename=Alogserv.exe Description=From McAfee VirusScan for logging scanning activities. In some cases, if left running it can cause CPU % usage to go between 5-95% or go to and stay at 100%. Disabling it impacts on the reported last scan date. It is reported to cause jerky graphics response in many games. As of version 6, this is a critical component of McAfee and disabling it can cause a PC to lock up Source=Paul Collins Startup list [Alps Electric USB Server] Confirmed=Y Filename=Monserv.exe Description=Alps Electric USB Server - required according to this article Source=Paul Collins Startup list [AlpsPointorApoint] Confirmed=U Filename=Apoint.exe Description=Touchpad software for laptop PC's. For instance it is found on the Panasonic machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work Source=Paul Collins Startup list [ALServ] Confirmed=? Filename=ALServ.exe Description=Altec Lansing AMS speaker related. What does it do and is it required? Source=Paul Collins Startup list [AltnetorAltnetPointsManager] Confirmed=N Filename=points manager.exe Description=Altnet Points Manager - manages the new Kazaa Plus scheme for awarding you points if you share music files on your machine with others rather than simply getting files and not sharing their own. Start manually when required Source=Paul Collins Startup list [AltoMB_service] Confirmed=U Filename=AltoMBsrv.exe Description=Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management Source=Paul Collins Startup list [ALUAlert] Confirmed=U Filename=ALUNotify.exe Description=Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis Source=Paul Collins Startup list [AlwaysOnTopMaker] Confirmed=U Filename=AlwaysOnTopMaker.exe Description=Always On Top Maker - utilty to enable an application to always be displayed "on top" of others on the desktop Source=Paul Collins Startup list [America Online *.* Tray Icon] Confirmed=N Filename=aoltray.exe Description=Puts AOL icon in System Tray (*.* denotes version if present). Connect to AOL via the desktop shortcut or Start -> Programs Source=Paul Collins Startup list [AME_CSA] Confirmed=N Filename=rundll32 amecsa.cpl, RUN_DLL Description=Loads ADSL modem Control Panel applet Source=Paul Collins Startup list [Amon] Confirmed=Y Filename=AMON.EXE Description=Monitoring part of Eset's NOD32 virus-scanner Source=Paul Collins Startup list [Amonitor] Confirmed=Y Filename=amon.exe Description=Tiny Personal Firewall Source=Paul Collins Startup list [anbv32] Confirmed=X Filename=nabv32.exe Description=Added as a result of the TITOG.C VIRUS! Source=Paul Collins Startup list [AnnotateCheck] Confirmed=? Filename=AnnCheck.exe Description=Genius Wizard Pen Tablet driver related. Is it required? Source=Paul Collins Startup list [Announcements] Confirmed=N Filename=Annclist.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Anntext] Confirmed=N Filename=Anntext.exe Description=Caere Pagekeeper text annotation server Source=Paul Collins Startup list [Another Internet Explorer Popup Killer] Confirmed=U Filename=aiepk.exe Description=Another IE Popup Killer - pop-up stopper Source=Paul Collins Startup list [Anti-keylogger check] Confirmed=U Filename=antikey.exe Description=Anti-keylogger - protects against keylogger programs monitoring your keystrokes Source=Paul Collins Startup list [Anti-Trojan-Watch] Confirmed=U Filename=ATWatch.exe Description=Anti-Trojan Watch - trojan detector Source=Paul Collins Startup list [AntiPopUp] Confirmed=U Filename=AntiPopUp.exe Description=AntiPopUp for IE - pop-up stopper Source=Paul Collins Startup list [Antivirus] Confirmed=X Filename=av.exe Description=Added as a result of the SINKIN VIRUS! Resets IE start page to realphx.com Source=Paul Collins Startup list [AntiVirusProtection] Confirmed=? Filename=qumk.exe Description=?? Source=Paul Collins Startup list [AnVir] Confirmed=Y Filename=AnVir.exe Description=AnVir virus destroyer Source=Paul Collins Startup list [anvshell] Confirmed=U Filename=anvshell.exe Description=System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar Source=Paul Collins Startup list [anycom bluetooth] Confirmed=? Filename=ftflauncher.exe Description=Associated with an Anycom bluetooth wireless card. What does it do and is it required? Source=Paul Collins Startup list [AO TrayorAOTray] Confirmed=N Filename=AOTray.Exe Description=System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [AolAcsDaemon1] Confirmed=U Filename=Acsd.exe Description=AOL Connectivity Service - starts an automatic function that restores the connection should you lose it while online. Negates having to go through the procedure of signing back on manually Source=Paul Collins Startup list [AolCon] Confirmed=X Filename=config.com Description=Added as a result of the TAPLAK VIRUS! Source=Paul Collins Startup list [AolFix] Confirmed=N Filename=AolFix.exe Description=Run on Gateway Astra computers, and maybe a few others. Designed to repair a bad registry key in Gateway computers that would not allow AOL to run correctly. Not seen much any more and should only run once Source=Paul Collins Startup list [Aornum] Confirmed=X Filename=aornum.exe Description=Installed along with iWon Prize Machine. Based upon their privacy statement this can be regarded as spyware Source=Paul Collins Startup list [APC UPS Status] Confirmed=Y Filename=Display.exe Description=APC PowerChute Personal Edition status icon Source=Paul Collins Startup list [APC_SERVICE] Confirmed=U Filename=mainserv.exe Description=PowerChute� Personal Edition - "safe system shutdown software with sophisticated power management functions" Source=Paul Collins Startup list [apc_tray] Confirmed=Y Filename=apc_tray.exe Description=Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure Source=Paul Collins Startup list [Apmsrv9x] Confirmed=? Filename=APMSRV9X.EXE Description=Intel AnyPoint Wireless II Home Network related. What does it do and is it required? Source=Paul Collins Startup list [App.EXEName] Confirmed=X Filename=.exe Description=Added as a result of the BODIRU VIRUS! Source=Paul Collins Startup list [Appcon] Confirmed=U Filename=vAppCon.exe Description=Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established Source=Paul Collins Startup list [AppExtender] Confirmed=U Filename=AppExtCB.exe Description=Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received Source=Paul Collins Startup list [Application] Confirmed=Y Filename=mdmsetsp.exe Description=Aztech Labs modem driver Source=Paul Collins Startup list [AppPlus] Confirmed=U Filename=AppPlus.exe Description=AppPlus - "menu bar or tray launcher that docks to your desktop, floats or sits in your System Tray. Create graphic/text-based buttons that launch any number of programs, Websites, e-mail addresses or folders (which open in the AppPlus Menu System)" Source=Paul Collins Startup list [ApvxdorApvxdwin] Confirmed=Y Filename=APVXDWIN.EXE Description=Part of Panda Anti-Virus. Required to enable permanent virus protection Source=Paul Collins Startup list [Apwheel] Confirmed=Y Filename=Apwheel.exe Description=Wheel support for an Alps mouse Source=Paul Collins Startup list [ara-key] Confirmed=X Filename= Description=Added as a result of the ANTINNY VIRUS! where <random> is a random program name with random characters Source=Paul Collins Startup list [ARCSolo Recovery] Confirmed=N Filename=N/A Description=Backup software by Computer Associates - no longer supported Source=Paul Collins Startup list [Aritima] Confirmed=X Filename=aritima.exe Description=Added as a result of the ARITIMA VIRUS! Source=Paul Collins Startup list [ashMaiSv] Confirmed=Y Filename=ashmaisv.exe Description=Part of Avast! anti-virus software Source=Paul Collins Startup list [AsioReg] Confirmed=U Filename=regsvr32.exe ctasio.dll Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [asp4tray] Confirmed=N Filename=asp4tray.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [AspireTimeMachine] Confirmed=Y Filename=acertmb.exe Description=System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP, allowing you to restore a PC back to a working state with minimal re-entry Source=Paul Collins Startup list [AST] Confirmed=X Filename=AST Description=Added as a result of the TROJANDOWNLOADER.WIN32.VB.AH VIRUS! Source=Paul Collins Startup list [ASTART] Confirmed=U Filename=astart.exe Description=ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings Source=Paul Collins Startup list [AStart] Confirmed=X Filename=AStart Description=Added as a result of the TROJANDOWNLOADER.WIN32.VB.AH VIRUS! Source=Paul Collins Startup list [asTray] Confirmed=N Filename=Astray.exe Description=Voyetra Audio Station - part of Voyetra's Ultimate MP3 & CD Manager. MP3 and digital music jukebox/organizer Source=Paul Collins Startup list [Astro] Confirmed=N Filename=Astro.exe Description=Checks for updates to Quicken on a system reboot Source=Paul Collins Startup list [ASUS Probe] Confirmed=N Filename=AsusProb.exe Description=ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area Source=Paul Collins Startup list [ASUS SmartDoctor] Confirmed=U Filename=VGAProbe.exe Description=ASUS video card fan/thermal monitor Source=Paul Collins Startup list [ASUS TweakEnable] Confirmed=U Filename=astart.exe Description=Restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings Source=Paul Collins Startup list [ASUSKey] Confirmed=N Filename=V38SHELL.EXE Description=System tray Icon for quickly changing video modes Source=Paul Collins Startup list [ASWDP] Confirmed=N Filename=ASWDP.exe Description=MLS Pulse - real estate software. Keeps the home buyer/seller continually informed on the status of his/her local/regional real estate market Source=Paul Collins Startup list [ASWnk] Confirmed=X Filename=aswnk.exe Description=Adult content dialler Source=Paul Collins Startup list [AT-Watch] Confirmed=U Filename=ATWatch.exe Description=Anti-Trojan Watch - trojan detector Source=Paul Collins Startup list [ATI GART Set-up Utility] Confirmed=N Filename=Atigart.exe Description=Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one, once installed it shouldn't be needed Source=Paul Collins Startup list [ATI Launchpad] Confirmed=U Filename=launchpd.exe Description=Convenient way to start all your Multimedia Center applications (DVD, Video CD, CD Audio, File Player). You can right-click LaunchPad, and uncheck Load on Startup in the menu Source=Paul Collins Startup list [ATI Scheduler] Confirmed=N Filename=Atisched.exe Description=Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see Source=Paul Collins Startup list [ATI Task Application] Confirmed=N Filename=Atitkad.exe Description=System Tray access to common display functions on ATI video cards. As above Source=Paul Collins Startup list [ATI Task Application (Atikey)] Confirmed=N Filename=Atitask.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [Ati2cwxx] Confirmed=? Filename=Ati2cwxx.exe Description=For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it Source=Paul Collins Startup list [Ati2mdxx] Confirmed=N Filename=Ati2mdxx.exe Description=For ATI video cards. System Tray access to display mode changing Source=Paul Collins Startup list [AtiCwdorAtiCwd32] Confirmed=U Filename=AtiCwd.exeAtiCwd32.exeAti2cwad.exe Description=This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card Source=Paul Collins Startup list [AtiKey] Confirmed=N Filename=AtiKey32.exeatiptkad.exe Description=System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display Source=Paul Collins Startup list [ATIModeChange] Confirmed=U Filename=Ati2mdxx.exe Description=System Tray icon to access ATI graphics card settings and the Hydravision Desktop Manager Source=Paul Collins Startup list [ATIPOLABorATIPOLL] Confirmed=U Filename=ati2evxx.exe Description=ATI External Event Utility EXE Module. This task can comsume lots of CPU resournces on some computers, but it can help with graphics card problems. Leave enabled unless it consumes too many CPU resources Source=Paul Collins Startup list [AtiPTAorAtiPTAAAoratiptaxx] Confirmed=U Filename=Ati2ptxx.exeAtiptaxx.exe Description=Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings Source=Paul Collins Startup list [AtiQiPcl] Confirmed=U Filename=AtiQiPcl.exe Description=Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's Source=Paul Collins Startup list [ATISmart] Confirmed=U Filename=ati2s9ag.exe Description=ATI's "SMARTGART", which is included with the "Catalyst" drivers. When the system boots, it runs a couple of bus tests & tries to apply the most stable settings Source=Paul Collins Startup list [atisrc2] Confirmed=X Filename=windfind.exe Description=Adult content dialler - see here. This has to be cleared at the same time as MSStartOptimizer (WINUPD.EXE), mmxrun (msosa.exe) and RegCompres (REGCPM32.EXE), otherwise they return Source=Paul Collins Startup list [atitrayorAtiTrayTools] Confirmed=N Filename=atitray.exe Description=ATI Tray Tool - allows quick access to ATI graphics card settings Source=Paul Collins Startup list [ATIX10] Confirmed=U Filename=atix10.exe Description=ATI Remote Wonder - PC wireless remote control Source=Paul Collins Startup list [ATM Control] Confirmed=X Filename=adpn.exe Description=Added as a result of the MMS.A VIRUS! Source=Paul Collins Startup list [ATnotes] Confirmed=N Filename=atnotes.exe Description=Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs Source=Paul Collins Startup list [Atomica] Confirmed=N Filename=atomica.exe Description=Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key Source=Paul Collins Startup list [AtomicTime] Confirmed=U Filename=ATOMICTIME.EXE Description=AtomicTime - utility that synchronizes your PC clock to an atomic clock Source=Paul Collins Startup list [Atrack] Confirmed=U Filename=atrack.exe Description=New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker, an instant notification feature. The Alert Tracker displays information about events as they happen. This way, when a rule has been triggered or an access to the Internet made, you know about it immediately rather than finding out about it when you check your logs or notice that the NIS icon indicates a security alert Source=Paul Collins Startup list [Atray] Confirmed=U Filename=Atray.exe Description=Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons Source=Paul Collins Startup list [ATTBroadbandUpdate] Confirmed=U Filename=SAUpdate.exe Description=Big Brother from Quest Software. System and network monitor Source=Paul Collins Startup list [ATTRedUpdate] Confirmed=U Filename=AutoUpdate.exe Description=Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates Source=Paul Collins Startup list [AttuneClientEngine] Confirmed=X Filename=attune_ce.exe Description="Attune is a revolutionary service that provides you with targeted Intelligram messages to help you avoid common computer problems. Attune may also let you know when you need a specific product, service, or upgrade to optimise the use of your computer". Not required - treated as adware Source=Paul Collins Startup list [AttuneContentUpdater] Confirmed=X Filename=attune_cu.exe Description=Related to the above. All needed for the program to do its job properly Source=Paul Collins Startup list [AttuneDiscovery] Confirmed=X Filename=attune_di.exe Description=Related to the above. All needed for the program to do its job properly Source=Paul Collins Startup list [AttuneSystray] Confirmed=X Filename=attune_st.exe Description=Related to the above. All needed for the program to do its job properly Source=Paul Collins Startup list [aTuner] Confirmed=N Filename=atuner.exe Description=aTuner - tweak tool for GeForce based graphics cards Source=Paul Collins Startup list [atwtusb] Confirmed=Y Filename=atwtusb.exe Description=USB interface for Aiptek Graphics Tablet (USB) Source=Paul Collins Startup list [AU Agent] Confirmed=U Filename=AUagent.exe Description=Au Agent from Zilab Software. Win2K/NT enhancement tool. Allows you to run applications under any security context without closing the whole logon session to process a new logon Source=Paul Collins Startup list [au.exe] Confirmed=X Filename=au.exe Description=Added as the result of the BEAGLE.B VIRUS! Source=Paul Collins Startup list [AUCBPNP] Confirmed=Y Filename=aucbnpn.exe Description=Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot Source=Paul Collins Startup list [Aucompat] Confirmed=X Filename=Aucompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [AudCtrl] Confirmed=? Filename=RunDll32 AudCtrl.dll, RCMonitor Description=Audio control panel? Source=Paul Collins Startup list [AudioHQ] Confirmed=N Filename=Ahqtb.exe Description=For Creative Soundblaster Live! series soundcards. System tray application for SB Live! functions. Available via Start -> Programs Source=Paul Collins Startup list [Aureal A3D Interactive Audio] Confirmed=Y Filename=sa3dsrv.exe Description=For Aureal based 3D soundcards. A3D sound features won't work with this disabled Source=Paul Collins Startup list [Aureal A3D Interactive Audio Init] Confirmed=Y Filename=A3dInit.exe Description=For Aureal based 3D soundcards. A3D sound features won't work with this disabled Source=Paul Collins Startup list [ausvc] Confirmed=X Filename=ausvc.exe Description=Added as a result of the AUTOUPDER VIRUS! Source=Paul Collins Startup list [Auto T Barorautotbar] Confirmed=N Filename=autotbar.exe Description=If you disable the HP VIEW toolbar in IE and rarrange the toolbars on a reboot they will be back as they were before if this is left enabled Source=Paul Collins Startup list [Autobar] Confirmed=U Filename=autobar.exe Description=Connect buttons on the keyboard for internet direct access, etc. on HP computers Source=Paul Collins Startup list [AutoEA] Confirmed=N Filename=Ahqrun.exe Description=For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ Source=Paul Collins Startup list [Autoloaderaproposclient] Confirmed=X Filename=Apropos_Client_Loader.exe Description=AproposMedia adware Source=Paul Collins Startup list [AutoMate Task Service ] Confirmed=N Filename=automate.exe Description=Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start -> Programs Source=Paul Collins Startup list [Automatic Windows Updater] Confirmed=X Filename=Update.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Automatically launches the United Devices Agent when you start your computer] Confirmed=N Filename=UD.EXE Description=The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start -> Programs Source=Paul Collins Startup list [AUTOPROP] Confirmed=N Filename=REGPROP.EXEWMPADDIN.DLL Description=Both the files are in the MS Office/Bots/FP_WMP directory. Apparently, it registers the FrontPage WiMP extension Source=Paul Collins Startup list [AutoShutdown] Confirmed=? Filename=pssvc.exe Description=Utility to fix vCard Export in MS Outlook 2000 - although why are these together? Source=Paul Collins Startup list [AutoSizer] Confirmed=U Filename=AUTOSIZER.EXE Description=AutoSizer - utility that automatically maximizes windows when they're opened Source=Paul Collins Startup list [AutoSpell 5] Confirmed=N Filename=ASWATC32.EXE Description=AutoSpell - spell checker Source=Paul Collins Startup list [AutoTKit] Confirmed=N Filename=AUTOTKIT.EXE Description=On HP PC's. Unclear what purpose it serves - but there's a known issue with Internet Explorer Toolbar settings not being saved with it enabled Source=Paul Collins Startup list [autoupd] Confirmed=N Filename=autoupd.exe Description=Raxco Software Auto Update utility."Used to keep your software up-to-date" Source=Paul Collins Startup list [autoupd] Confirmed=X Filename=autoupd.exe Description=VIRUS! - found in a folder of the same name Source=Paul Collins Startup list [AutoUpdater] Confirmed=X Filename=aupdate.exe Description=Aupdate, Tinybar variant. Spyware Source=Paul Collins Startup list [AutoUpdater] Confirmed=X Filename=AutoUpdate.exe Description=PeopleonPage foistware Source=Paul Collins Startup list [AUXXTRAY] Confirmed=N Filename=au30setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Avast!] Confirmed=Y Filename=ashserv.exe Description=Avast! anti-virus software Source=Paul Collins Startup list [Avast32] Confirmed=Y Filename=Astart32.exe Description=Avast32 anti-virus - scanner Source=Paul Collins Startup list [AvconsoleEXE] Confirmed=U Filename=Avconsol.exe Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it Source=Paul Collins Startup list [AveoAttune] Confirmed=X Filename=atmdlusr.exe Description=Related to AttuneClientEngine above Source=Paul Collins Startup list [AVG7_CC] Confirmed=Y Filename=AVGCC.exe Description=AVG Anti-Virus 7.0 Control Center. Allows you to manage and control all AVG Anti-Virus components, settings and updates Source=Paul Collins Startup list [AVG7_Run] Confirmed=Y Filename=avgw.exe Description=Part of AVG Anti-Virus 7.0 Source=Paul Collins Startup list [avgamsvr.exe] Confirmed=Y Filename=Avgamsvr.exe Description=AVG antivirus related Source=Paul Collins Startup list [AVGCtrl] Confirmed=Y Filename=AVGCTRL.EXE Description=Background task of the AntiVir antivirus program which scans files transparently in the background Source=Paul Collins Startup list [avgmsvr.exe] Confirmed=Y Filename=avgmsvr.exe Description=Required for AVG Anti-Virus 7.0 to function Source=Paul Collins Startup list [Avgserv9.exe] Confirmed=Y Filename=Avgserv9.exe Description=Background monitoring program for AVG anti-virus Source=Paul Collins Startup list [AVG_CCoravgcc32] Confirmed=Y Filename=avgcc32.exe Description=AVG anti-virus control center. Also enables scheduled tests, Outlook E-mail plug-in and automatic updates Source=Paul Collins Startup list [AVG_EMC] Confirmed=Y Filename=AVGEMC.exe Description=AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses Source=Paul Collins Startup list [AVG_RegCleaner] Confirmed=Y Filename=AVGREGCL.exe Description=AVG Anti-Virus 7.0 Registry Cleaner - for checking the registry for virus additions and other security problems Source=Paul Collins Startup list [Avimgt] Confirmed=X Filename=Avimgt.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Avimgt32] Confirmed=X Filename=Avimgt32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [AvMaiSrv] Confirmed=Y Filename=Avmaisrv.exe Description=Avast32 anti-virus - E-mail scanner Source=Paul Collins Startup list [avpcc] Confirmed=Y Filename=avpcc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [avpm] Confirmed=Y Filename=avpm.exe Description=Kaspersky antivirus Source=Paul Collins Startup list [Avril Lavigne - Muse] Confirmed=X Filename= Description=Added as a result of the AVRIL-A VIRUS! Source=Paul Collins Startup list [AVSCHED32] Confirmed=Y Filename=AVSched32.exe Description=AntiVir anti-virus from H+BDEV Source=Paul Collins Startup list [Avtray] Confirmed=N Filename=Avtray.exe Description=Command Antivirus tray icon Source=Paul Collins Startup list [AVWUpd32] Confirmed=U Filename=AVWUPD32.EXE Description=AntiVir updater. Useful, but can be run manually Source=Paul Collins Startup list [avx communicator] Confirmed=Y Filename=xcommsur.exe Description=Anti-virus part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Avxlive] Confirmed=Y Filename=avxlive.exe Description=Bullguard or BitDefender antivirus Source=Paul Collins Startup list [avxlni] Confirmed=Y Filename=avxinit.exe Description=Anti-virus part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Avxnews] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [awhost32] Confirmed=N Filename=awhost32.exe Description=Part of Symantec's pcAnywhere remote PC management software. Provides an automatic startup of the client PC in host mode in conjuction with a host-definition file, so system administrators can access the machine. Can cause a 10% reduction in speed and not recommended Source=Paul Collins Startup list [AxFilter] Confirmed=? Filename=Rundll32 AXFILTER.DLL, Rundll32 Description=?? Source=Paul Collins Startup list [a�] Confirmed=Y Filename=a2guard.exe Description=a� antitrojan Source=Paul Collins Startup list [B'sCLiP] Confirmed=N Filename=BSCLIP.exe Description=CD recording utility that comes with a lot of CDR/CDRW drives and isn't required Source=Paul Collins Startup list [B.Reader] Confirmed=N Filename=remin.exe Description=Birthday Reminder 5.0 - as the name implies Source=Paul Collins Startup list [b3d] Confirmed=X Filename=BDEsecureinstall.exe Description=B3d Projector - installed along with the KaZaA file sharing utility. Causes a program called "ZUPDATE.EXE" to periodically try to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C:\\Windows\\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents Source=Paul Collins Startup list [b3dUpdate] Confirmed=X Filename=Zupdate.exe Description=Same as above but not installed via KaZaA Source=Paul Collins Startup list [b9] Confirmed=U Filename=B9.exe Description=FireTrust Benign - allows you to receive e-mail which is safe from viruses, worms, scripts, web bugs, privacy threats and other security risks, without affecting your e-mail. "Benign neutralizes or strips out the code that makes viruses, worms, scripts and other potentially harmful things run" Source=Paul Collins Startup list [b99] Confirmed=X Filename=msmm.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [babeie] Confirmed=X Filename=rundll32 cnbabe.dll, dllstartup Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [Babylon Translator] Confirmed=N Filename=Babylon.exe Description="Babylon-Pro is a powerful information tool that instantly provides relevant information, translations & conversions for any word or value you click on" Source=Paul Collins Startup list [BackgroundSwitcher] Confirmed=U Filename=bgswitch.exe Description=Background Switcher Powertoy. Included with the last beta version of the XP Powertoys. Whenever a user right clicked his desktop and chose properties he could see a new tab which allowed him to enable a "Desktop Slide Show." This would automatically change the Windows Desktop at an interval specified by the user. Available here Source=Paul Collins Startup list [Backpack UDF] Confirmed=N Filename=bpudfmon.exe Description=Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk Source=Paul Collins Startup list [BackupExecScheduler] Confirmed=U Filename=besch.exe Description=Veritas "Back Up My PC" software Source=Paul Collins Startup list [BackupNotify] Confirmed=? Filename=backupnotify.exe Description=HP Digital Imaging related. What does it do and is it required? Source=Paul Collins Startup list [BackWeb] Confirmed=N Filename=backweb.exe Description=Automatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Available via Start -> Programs Source=Paul Collins Startup list [Backwork] Confirmed=N Filename=Backwork.exe Description=Backwork trojan detector Source=Paul Collins Startup list [BACPI10] Confirmed=U Filename=bacpi10a.exe Description=Known as "PowerKey" - a minimalistic keyboard driver that allows power management keys on BTC keyboards to function properly in older OS's (i.e. Win95/98/NT4). Also adds an icon to the system tray Source=Paul Collins Startup list [BacsTray] Confirmed=N Filename=BacsTray.exe Description=Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems Source=Paul Collins Startup list [BADDATE] Confirmed=X Filename=BADDATE.EXE Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [bargains] Confirmed=X Filename=bargains.exebargainbuddy.exe Description=Bargain Buddy - advertising spyware installed with Net2Phone & LimeWire amongst others. Some further information here Source=Paul Collins Startup list [Bart Station] Confirmed=? Filename=station.sbrt Description=Related to PeoplePC ISP. May be a dialler for dial-up accounts? Source=Paul Collins Startup list [Batchreg1] Confirmed=N Filename=N/A Description=Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation, as that key should be deleted automatically. See here Source=Paul Collins Startup list [Battery Scope] Confirmed=U Filename=batmgr.exe Description=Monitors battery levels on a notebook/laptop PC Source=Paul Collins Startup list [BatteryBar] Confirmed=U Filename=batterybar.exe Description=BatteryBar - displays battery usage, and the current percentage of battery power left Source=Paul Collins Startup list [BatzBack] Confirmed=X Filename=BatzBack.scr Description=Added as a result of the BACKZAT VIRUS! Source=Paul Collins Startup list [BAUSB] Confirmed=U Filename=BAUSB.exe Description=Boston Acoustics Audio, USB driver Source=Paul Collins Startup list [BayMgr] Confirmed=U Filename=DockApp.exe Description=Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [Bayswap] Confirmed=U Filename=bayswap.exe Description=Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [Bayswap2] Confirmed=U Filename=TbUpdate.exe Description=Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices Source=Paul Collins Startup list [bbSysTray] Confirmed=N Filename=bbSysTray.exe Description=Philips CD-RW related - "the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions" Source=Paul Collins Startup list [bbui] Confirmed=U Filename=bbui.exe Description=AOL DSL status monitor displaying a red/green icon indicating if you have a connection Source=Paul Collins Startup list [bca] Confirmed=U Filename=bca.exe Description=BeClean Agent - registry, history, temp files, etc cleaner Source=Paul Collins Startup list [BCDetect] Confirmed=U Filename=bcdetect.exe Description=Bcdetect.exe searches the system to make sure Creative drivers are installed for the video card. It loads the BlasterControl when the drivers are detected. Your choice - try it and see Source=Paul Collins Startup list [BCMDMMSG] Confirmed=Y Filename=bcmdmmsg.exe Description=BCM voicemodem driver. Required for dial-up if you have one of these modems Source=Paul Collins Startup list [BCMHal] Confirmed=U Filename=rundll32.exe bcmhal9x.dll, bcinit Description=BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings Source=Paul Collins Startup list [BCMSMMSG] Confirmed=Y Filename=BCMSMMSG.exe Description=BCM voicemodem driver. Required for dial-up if you have one of these modems Source=Paul Collins Startup list [bcmwltry] Confirmed=? Filename=bcmwltry.exe Description=Broadcom Corporation Wireless Network Tray Applet. Is it required? Source=Paul Collins Startup list [BCNT] Confirmed=N Filename=bcnt.exe Description=AWS Weatherbug related. What does it do? Source=Paul Collins Startup list [BCTweak] Confirmed=U Filename=bctweak.exe Description=BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings Source=Paul Collins Startup list [BCWipeTM] Confirmed=N Filename=bcwipetm.exe Description=BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task, as well as special options for the task. Run manually when needed Source=Paul Collins Startup list [BDMCon] Confirmed=Y Filename=Bdmcon.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BearShare] Confirmed=N Filename=bearshare.exe Description=BearShare file sharing client. Versions known to include spyware - see here Source=Paul Collins Startup list [BEEI] Confirmed=? Filename=beei.exe Description=?? Source=Paul Collins Startup list [BEHL] Confirmed=? Filename=BEHL.exe Description=?? Source=Paul Collins Startup list [BEHLO] Confirmed=? Filename=BEHLO.exe Description=?? Source=Paul Collins Startup list [BELORVBI] Confirmed=? Filename=BELORVBI.exe Description=?? Source=Paul Collins Startup list [Belsta.exe] Confirmed=? Filename=Belsta.exe Description=Configuration tool for Belkin wireless network cards. Required to change the card�s configuration. Is it required for correct operation once the confuiguration is changed? Source=Paul Collins Startup list [Belt] Confirmed=X Filename=Belt.exe Description=Abetterinternet adware related Source=Paul Collins Startup list [Benadril Alert Tool] Confirmed=X Filename=benadrilalert.exe Description=Plug-in for WeatherBug advising when pollen count in your area is high - prompting you to buy Benadril Source=Paul Collins Startup list [bg] Confirmed=Y Filename=bullguard.exe Description=Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster Source=Paul Collins Startup list [bgsmsnd] Confirmed=N Filename=bgsmsnd.exe Description=Printer driver to generate PDF files from any program Source=Paul Collins Startup list [BHOCop] Confirmed=N Filename=BHOCop.exe Description=ZDNet's BHO Cop that lets you see what browser helper objects are installed. Useful for detecting spyware Source=Paul Collins Startup list [BIE] Confirmed=X Filename=Rundll32.exe BDSrHook.dll, Rundll32 Description=BDplugin parasite Source=Paul Collins Startup list [bigfix] Confirmed=N Filename=BIGFIX.EXE Description=BigFix can automatically download and read technical support information provided by computer and software manufacturers and other technical support experts (published in the form of Fixlet� Messages) and can automatically check your computer for bugs, configuration conflicts, and security holes. Should only be started manually as it's a resource hog Source=Paul Collins Startup list [BigPond Toolbar] Confirmed=U Filename=bpumTray.exe Description=Telstra BigPond Toolbar - "Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier" Source=Paul Collins Startup list [Billminder] Confirmed=N Filename=Billmind.exe Description=Can be setup in Quicken to remind user of due payments. Available via Start -> Programs Source=Paul Collins Startup list [bin32hpu] Confirmed=X Filename=ppstub.exe Description=PrecisionPop adware Source=Paul Collins Startup list [bingdian] Confirmed=X Filename=Bingdian.vbs Description=Added as a result of the BINGD VIRUS! Source=Paul Collins Startup list [Bingo Charm] Confirmed=? Filename=charms.exe Description=Some kind of screen icon kind of like desk flag, but it gives you a choice of icons? Source=Paul Collins Startup list [Bios] Confirmed=X Filename=Bios32.exe Description=Added as a result of an unidentified VIURS! Source=Paul Collins Startup list [BIOS1] Confirmed=X Filename=BIOS1.EXE Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [BIOVCIP] Confirmed=? Filename=BIOVCIP.exe Description=?? Source=Paul Collins Startup list [BitDefender Communicator] Confirmed=Y Filename=xcommsvr.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BitDefender for MSN Messenger] Confirmed=U Filename=msnmon.exe Description=Bitdefender anti-virus for MSN Messenger. Unless you have MSN Messenger running all the time start it manually Source=Paul Collins Startup list [BitDefender Live! Init] Confirmed=Y Filename=bdinit.exe Description=BitDefender antivirus Source=Paul Collins Startup list [BitDefender Scan Server] Confirmed=Y Filename=bdss.exe Description=BitDefender antivirus Source=Paul Collins Startup list [bitdefenderlive] Confirmed=Y Filename=avxlive.exe Description=Main program of BitDefender virus scanner/firewall Source=Paul Collins Startup list [BitDefender_P2P_Startup] Confirmed=U Filename=BitDefender_P2P_Startup.exe Description=Bitdefender anti-virus for file transfers via internet messaging clients such as ICQ and MSN Messenger. Unless you have these running all the time start it manually Source=Paul Collins Startup list [BitWare Print Monitor] Confirmed=N Filename=bwprnmon.exe Description=FaxServe network fax software Source=Paul Collins Startup list [BJ Printer Status Monitor] Confirmed=N Filename=Cjstsr.exe Description=Canon BJ printer status monitor Source=Paul Collins Startup list [BJ Status Monitor 5xx] Confirmed=N Filename=CJSTRxx.EXE Description=Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers Source=Paul Collins Startup list [bjcfd] Confirmed=N Filename=cdf.exe Description=BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs Source=Paul Collins Startup list [BlackICE PC ProtectionorBlackIce Utility] Confirmed=N Filename=blackice.exe Description=Loads the user interface for the BlackICE PC Protection (was Defender) firewall program. From the parent site - '(the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' See also LoadBlackD Source=Paul Collins Startup list [BlazeChanger] Confirmed=N Filename=FBZPaper.exe Description=Ember graphic file viewer, manager, and touch-up system Source=Paul Collins Startup list [BlockAdsorblads] Confirmed=U Filename=blads.exe Description=A Tweak-XP component, blocks advertisement banners in Internet Explorer. Can be enabled/disabled via Tweak-XP / Internet Tweaks Source=Paul Collins Startup list [BlockTracker] Confirmed=N Filename=BlockTracker.exe Description=If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file Source=Paul Collins Startup list [blss] Confirmed=X Filename=blss.exe Description=CBlaster trojan/dialer/downloader Source=Paul Collins Startup list [BLSTAPP] Confirmed=N Filename=blstapp.exe Description=Puts access to Creative's BlasterControl in the System Tray Source=Paul Collins Startup list [BlueToothAuthentication Agent] Confirmed=? Filename=RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Description=Used for a bluetooth adapter? Source=Paul Collins Startup list [BMail Installation] Confirmed=N Filename=FTP_back.exe Description=Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not Source=Paul Collins Startup list [BMMGAG] Confirmed=U Filename=Rundll32 PWRMONIT.DLL, StartPwrMonitor Description=Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery information window Source=Paul Collins Startup list [BMMLREF] Confirmed=U Filename=BMMLREF.EXE Description=Battery Manager for IBM ThinkPad laptops Source=Paul Collins Startup list [BMO MasterCard Wallet] Confirmed=U Filename=EWALLET.EXE Description=The wallet conveniently stores billing, shipping and payment information on your PC Source=Paul Collins Startup list [BMupdate] Confirmed=N Filename=BMupdate.exe Description=Related to BookmarkCentral below. Typically added after downloading drivers for Visioneer scanners for example, and you install the driver self-install Source=Paul Collins Startup list [Bndt32] Confirmed=X Filename=Bndt32.exe Description=Added as a result of the LACON VIRUS! Source=Paul Collins Startup list [Bnexe] Confirmed=X Filename= Description=Added as a result of the KITRO.D (or ARGEN.A) VIRUS! Source=Paul Collins Startup list [BOCleanautostart] Confirmed=Y Filename=Boclean.exe Description=NSClean's BOClean anti-trojan software Source=Paul Collins Startup list [bombshel] Confirmed=U Filename=BOMB32.EXE Description=Part of McAfee Nuts & Bolts. Protects your Windows system from application failure and crashes - similar to Norton Crashguard. Your choice - may cause problems Source=Paul Collins Startup list [Bonzi Buddy] Confirmed=X Filename=?? Description=Spyware - read here for information and here for removal instructions Source=Paul Collins Startup list [BookedSpace] Confirmed=X Filename=bs2.dll,DllRun Description=Adware, related to the Remanent parasite Source=Paul Collins Startup list [BookmarkCentral] Confirmed=N Filename=BMLauncher.exe Description=Bookmark Express - "offers a more flexible way to manage Web site bookmarks, regardless of which browser you use" Source=Paul Collins Startup list [Boost XP Service] Confirmed=U Filename=bxservice.exe Description=Boost XP from Systweak - WinXP tweaking utility Source=Paul Collins Startup list [boot] Confirmed=X Filename=boot.exe Description=Added as a result of the ELEM VIRUS! Source=Paul Collins Startup list [Boot Manager] Confirmed=X Filename=Njgal.exe Description=Added as a result of the KILO VIRUS! Source=Paul Collins Startup list [BootLoader] Confirmed=X Filename=BootLoader.exe.vbs Description=Added as a result of the WATERWORKS VIRUS! Source=Paul Collins Startup list [BootStatus] Confirmed=U Filename=BOOTST~1.EXE Description=Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it, it has no more effect on resources Source=Paul Collins Startup list [Bose Wave/PC Monitor] Confirmed=N Filename=wavepcmonitor.exe Description=System Tray access for this system (more info on the system here). Available via Start -> Programs Source=Paul Collins Startup list [bpcpost.exe] Confirmed=U Filename=bpcpost.exe Description=MS TV Viewer Post Setup Program. Part of MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [BPK] Confirmed=U Filename=bpk.exe Description=Blazing Tools Perfect Keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove Source=Paul Collins Startup list [BQTray.exe] Confirmed=U Filename=BQTray.exe Description=System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility, hence the U recommendation. Create your own desktop shortcut to start manually Source=Paul Collins Startup list [Brasil] Confirmed=X Filename=Brasil.exe Description=Added as a result of the OPASERV.E VIRUS! Source=Paul Collins Startup list [Brasil] Confirmed=X Filename=BRASIL.PIF Description=Added as a result of the OPASERV.E VIRUS! Source=Paul Collins Startup list [BrasilOld] Confirmed=X Filename= Description=Added as a result of the OPASERV.P VIRUS! Source=Paul Collins Startup list [Bridge] Confirmed=? Filename=rundll32.exe ...Bridge.dll Description=?? Source=Paul Collins Startup list [Brindys BriTray] Confirmed=Y Filename=BRITRAY.EXE Description=Main process for the following applications: GEDEX, SICARIO, BRINOTES, BRIRESPA, SICURE, TRASGO, UNDOCS, FRESH & BRIFAME (all of them from Brindys Software). Performs the following tasks [un]installation, web software autoupdate, notification windows, interprocess communication, tray bar icons & menus, alarms (brinotes), and common web launching from the mentioned applications. Can be stopped safely once run if so desired Source=Paul Collins Startup list [Broadband Wizard] Confirmed=N Filename=bbwiz.exe Description=Starts Broadband Wizard so it runs in the System Tray. This application tests and optimizes your Cable or DSL connection. Available via Start -> Programs Source=Paul Collins Startup list [BrowseProxy] Confirmed=N Filename=FindService.exe Description=Actual Names - "It is now possible to enter a particular word or keyword phrase that is associated with your business, and immediately be directed to YOUR WEBSITE! The Actual Names technology can do this for you" Source=Paul Collins Startup list [browser aid] Confirmed=X Filename=browseraid.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Browser Hijack Blaster] Confirmed=Y Filename=bhblaster.exe Description=Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings Source=Paul Collins Startup list [Browser Launcher] Confirmed=U Filename=Commandr.exe Description=Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys Source=Paul Collins Startup list [Browser Pal] Confirmed=X Filename=adblck.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [BrowserWebCheck] Confirmed=N Filename=loadwc.exe Description=Checks to make sure that IE is still your default browser Source=Paul Collins Startup list [Bsoft lppt01] Confirmed=X Filename=Bsoft.exe Description=New variant of the RapidBlaster parasite (in a "BelmontSoft" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Bsx3] Confirmed=X Filename=Rundll32.exe bs3.dll, DllRun Description=BookedSpace parasite variant Source=Paul Collins Startup list [btinst] Confirmed=? Filename=btinst.exe Description=Associated with an Anycom bluetooth wireless card. What does it do and is it required? Source=Paul Collins Startup list [bttray] Confirmed=U Filename=bttray.exe Description=System tray icon which shows the status of a BlueTooth wireless module. Most systems with such a module installed can enable/disable the module. The system tray icon changes from blue/white to blue/red when the module is turned off. Allows access to explore bluetooth places, setup wizard (ditto above), advanced configuration, quick connect and shutdown device Source=Paul Collins Startup list [BTUSRBDGF] Confirmed=Y Filename=BtUsrBdg.exe Description=Used with a Mitsumi USB Bluetooth adaptor Source=Paul Collins Startup list [Buddyizer] Confirmed=N Filename=Buddyizer.exe Description=Part of the AIMster Peer to Peer (P2P) file sharing application that runs over the AOL Instant Messenger network Source=Paul Collins Startup list [bugwatcher service] Confirmed=U Filename=bugwatcher.exe Description=Bugtoaster is a service that sends reports on system/program crashes (certain types) back to Bugtoaster. They relay information to program authors and provide, if available, any known solutions to the crashes. It doesn't take up any room in memory, just activates in the event of certain program failures Source=Paul Collins Startup list [BuildBUorbldbubg] Confirmed=? Filename=bldbubg.exe Description=Found on a Dell machine?? Source=Paul Collins Startup list [Bulldog Service] Confirmed=U Filename=upsd.exe Description=Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link Source=Paul Collins Startup list [BullGuard] Confirmed=Y Filename=mgui.exe Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullGuard Update] Confirmed=U Filename=avxlive.exe Description=Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions Source=Paul Collins Startup list [BullGuard XComm] Confirmed=Y Filename=XCOMMSVR.EXE Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullGuardInit] Confirmed=Y Filename=AVXINIT.EXE Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullguardoptIn] Confirmed=Y Filename=bulldownload.exe Description=Part of Bullguard antivirus Source=Paul Collins Startup list [BullsEye Tracker] Confirmed=? Filename=BeTrack.exe Description=Bullseye - intelligent research assistant Source=Paul Collins Startup list [Button Server] Confirmed=U Filename=bttnserv.exe Description=Found on a Compaq PC, for the extra buttons on the keyboard for the speaker volume, media player, sleep and internet buttons. If the buttons aren't used on the keyboard or your's doesn't have them, then it isn't required Source=Paul Collins Startup list [ButtonKey] Confirmed=N Filename=ButtonKey.exe Description=CyberView TWAIN driver for the Pacific Image range of 35mm film scanners. Enables the one touch scanning button and places an icon an the System Tray. Use your scanners software or run it manually by creating a shortcut Source=Paul Collins Startup list [Buzme] Confirmed=N Filename=Bmui.exe Description=Buzme by RingCentral, Inc - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem Source=Paul Collins Startup list [Buzof.exe] Confirmed=U Filename=buzof.exe Description=Buzof from Basta Computing "enables you to automatically answer, close or minimize virtually any recurring window including messages, prompts, and dialog boxes" Source=Paul Collins Startup list [bxsx5] Confirmed=X Filename=RunDLL32.EXE bsx5.dll Description=BookedSpace parasite variant Source=Paul Collins Startup list [bxxs5] Confirmed=X Filename=RunDLL32.EXE bxxs5.dll, dllrun Description=BookedSpace parasite Source=Paul Collins Startup list [Bymer.Scanner] Confirmed=X Filename=Wininit.exeMsinit.exe Description=Added as a result of the BYMER VIRUS! Source=Paul Collins Startup list [c] Confirmed=X Filename=c:archiv~1win.com Description=Added as a result of the CUYDOC VIRUS! Source=Paul Collins Startup list [C-Media Echo Control] Confirmed=U Filename=EchoCtrl.exe Description=C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer (below) Source=Paul Collins Startup list [C-Media Mixer] Confirmed=N Filename=Mixer.exe Description=C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs Source=Paul Collins Startup list [C2K] Confirmed=U Filename=CYB2K.EXE Description=CYBERsitter 2000 or 2001 - anti-porn filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser Source=Paul Collins Startup list [Cabchk] Confirmed=X Filename=Cabchk.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Cabchk32] Confirmed=X Filename=Cabchk32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [CABCInstall] Confirmed=X Filename=CABCInstall.exe Description=CABC content delivery software Source=Paul Collins Startup list [Cacheman] Confirmed=N Filename=Cacheman.exe Description=Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up Source=Paul Collins Startup list [CacheMgr] Confirmed=Y Filename=CacheMgr.exe Description=Sophos Antivirus Remote Update Source=Paul Collins Startup list [CACStarter] Confirmed=N Filename=cacstart.exe Description=Cash A Check - check writing software Source=Paul Collins Startup list [Caddais BackupOnDemand] Confirmed=U Filename=BODMon.exe Description=Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing, modified files are automatically backed up to an archive location" Source=Paul Collins Startup list [CADS] Confirmed=U Filename=cads.exe Description=Cyber Sentinel internet filtering software Source=Paul Collins Startup list [CAgent] Confirmed=N Filename=CAgent.exe Description=Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents Source=Paul Collins Startup list [cAgOu] Confirmed=X Filename=.hta Description=Added as a result of the KAKWORM VIRUS! Source=Paul Collins Startup list [CahootWebcard] Confirmed=N Filename=CahootWebcard.exe Description="The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details". Run manually when needed Source=Paul Collins Startup list [Cal Reminder Shortcut] Confirmed=N Filename=calrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Office Calendar Source=Paul Collins Startup list [CallBumping] Confirmed=? Filename=cbpopw.exe Description=?? Source=Paul Collins Startup list [CallControl] Confirmed=N Filename=ftctrl32.exe Description=FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed, the software automatically loads FaxTalk CallControl when you start Windows. When FaxTalk CallControl is running, any TAPI compliant application can request to use the modem from Windows Source=Paul Collins Startup list [CamCheck] Confirmed=N Filename=CamCheck.exe Description=NuCam camera software related Source=Paul Collins Startup list [Camio Viewer x] Confirmed=N Filename=IXApplet.exe Description=Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version Source=Paul Collins Startup list [CamMonitor] Confirmed=? Filename=hpqcmon.exe Description=From HP and related to digital imaging Source=Paul Collins Startup list [Canada] Confirmed=N Filename=Canada.exe Description=Known to be a dialler - but is it maliscous or clean? Source=Paul Collins Startup list [Canary] Confirmed=N Filename=canary-std.exe Description=Canary monitoring program. Keylogger, monitors all computer activity Source=Paul Collins Startup list [Canon Printer Monitor BJCxxx] Confirmed=N Filename=Cjstlst.exe Description=Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs Source=Paul Collins Startup list [Capfax] Confirmed=N Filename=capfax.exe Description=PhoneTools fax software Source=Paul Collins Startup list [Capon] Confirmed=Y Filename=Capon.exe Description=Canon printer driver Source=Paul Collins Startup list [Capture Express 2000] Confirmed=N Filename=capexp.exe Description=Capture Express - screen capture utility Source=Paul Collins Startup list [Card Monitor] Confirmed=N Filename=REGCNT09.exe Description=For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs Source=Paul Collins Startup list [CARPservice] Confirmed=U Filename=carpserv.exe Description=Associated with Zoltrix modems - enables the internal modem speaker, allowing you to listen to the dial-up sounds for example Source=Paul Collins Startup list [CasAgnt] Confirmed=? Filename=CasAgnt.exe Description=Related to a Casio PDA - but what does it do and is required? Source=Paul Collins Startup list [Casdvqwa] Confirmed=X Filename=bmqnzkg.exe Description=Added as a result of the RANDEX.BE VIRUS! Source=Paul Collins Startup list [Cashsurfers Cashbar Navigator] Confirmed=N Filename=Cashbar.Exe Description=Cashsurfers CashBar Navigator - "The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals" Source=Paul Collins Startup list [CBWAttn] Confirmed=U Filename=CBWAttn.exe Description=Required for Bitware to answer incoming faxes, can cause sleep mode problems Source=Paul Collins Startup list [CBWHost] Confirmed=U Filename=CBWHost.exe Description=Required for Bitware to answer incoming faxes, can cause sleep mode problems Source=Paul Collins Startup list [CBWUser] Confirmed=? Filename=CBWDial.exe Description=Associated with Bitware that integrates fax, voice, pager, and data communications on your desktop Source=Paul Collins Startup list [CC2KUI] Confirmed=X Filename=comet.exe Description=Comet Cursor - displays different mouse pointers dependent upon the site your visiting. Malware because it automatically installs. See here for more information and for the uninstall procedure Source=Paul Collins Startup list [ccApp] Confirmed=Y Filename=ccApp.exe Description=Part of Norton AntiVirus 2003. Auto-protect and E-mail check will not function without this Source=Paul Collins Startup list [ccApp] Confirmed=X Filename= Description=Added as a result of the OBSORB VIRUS! Note the random filename compared to the valid Norton AntiVirus entry above Source=Paul Collins Startup list [CCD Manager] Confirmed=U Filename=DDS.EXE Description=Project Labs Century CD manager for their CD/DVD storage device Source=Paul Collins Startup list [Ccdecode] Confirmed=N Filename=rundll32.exe streamci, StreamingDeviceSetup Description=Part of the closed caption decdoder/MS VBI codec. Should only run once Source=Paul Collins Startup list [CCDoctorLogonTesting] Confirmed=Y Filename=ccdoctor.exe Description=Checks your system to make sure it's configured properly for running Rational ClearCase, a source code management tool. ClearCase is fairly sophisticated so there are a lot of system-related things that can cause it grief. If you run ClearCase you should not disable this as it provides a valuable service, but technically it isn't required to use the ClearCase product Source=Paul Collins Startup list [CcEvtMgr] Confirmed=Y Filename=ccEvtMgr.exe Description=Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via "ccApp" and was not required as a seperate entry but a recent update changed this Source=Paul Collins Startup list [CcPxySvc] Confirmed=Y Filename=CCPXYSVC.exe Description=Part of Norton's AntiVirus 2003, Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall Source=Paul Collins Startup list [ccreg] Confirmed=X Filename=explorer.exe Description=Added as a result of the ZCREW VIRUS! Note - this is not the valid explorer.exe Source=Paul Collins Startup list [CcRegVfy] Confirmed=Y Filename=ccRegVfy.exe Description=Part of Norton AntiVirus 2003. "ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack" Source=Paul Collins Startup list [ccSetMgr] Confirmed=Y Filename=ccSetMgr.exe Description=Part of Norton AntiVirus 2004. What does it do? Source=Paul Collins Startup list [ccWasher] Confirmed=U Filename=aolwasher.exe Description=Webroot Cache & Cookie Washer - cleaning browser tracks, including cache, cookies, history, mail trash, drop-down address bar, auto-complete forms and downloaded program files for IE, Netscape and AOL Source=Paul Collins Startup list [CDANTSRV] Confirmed=N Filename=CDANTSRV.exe Description=C-Dilla License Management software. Used for any program that uses C-dilla Protection, example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually Source=Paul Collins Startup list [Cdcompat] Confirmed=X Filename=Cdcompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [CDInterceptor] Confirmed=N Filename=cdi.exe Description=CD indexer for measuring the speed of CD players Source=Paul Collins Startup list [CDTray] Confirmed=N Filename=CDTray.exe Description=On HP PCs, this is the small CD icon next to the time Source=Paul Collins Startup list [CeEKEY] Confirmed=? Filename=CeEKey.exe Description=Toshiba Satellite E-Key related. Is it required? Source=Paul Collins Startup list [CeEPOWER] Confirmed=? Filename=cepmtray.exe Description=Toshiba power management related. Is it required? Source=Paul Collins Startup list [Cekirge] Confirmed=X Filename= Description=Added as a result of the KERGEZ.A VIRUS! Source=Paul Collins Startup list [CEPA] Confirmed=? Filename=wsot.exe Description=?? Source=Paul Collins Startup list [cesmain.dll] Confirmed=X Filename=cmail.dll, Rundll32 Description=CnsMin "Chinese Keywords" hijacker related Source=Paul Collins Startup list [CFD] Confirmed=N Filename=CFD.exe Description=BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs Source=Paul Collins Startup list [CFDStart] Confirmed=X Filename=WinMuschi.exe Description=WINMUSCHI dialler Source=Paul Collins Startup list [cfgintpr] Confirmed=Y Filename=cfgintpr.exe Description=Configuration Interpreter - part of Tiny Personal Firewall V4 Source=Paul Collins Startup list [cfgwiz] Confirmed=N Filename=cfgwiz.exe Description=Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it Source=Paul Collins Startup list [cFosDNT] Confirmed=? Filename=cFosDNT.exe Description=cFos DSL Modem driver related. What does it do and is it required? Source=Paul Collins Startup list [cFosInst_Check] Confirmed=? Filename=cfosinst.exe Description=cFos DSL Modem driver related. What does it do and is it required? Source=Paul Collins Startup list [cftmon32] Confirmed=X Filename=taskmgr#.exe Description=Added as a result of the SOWSAT.C and SOWSAT.J VIRUSES! where # is a number greater than or equal to zero Source=Paul Collins Startup list [CGServer] Confirmed=U Filename=cgserver.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs Source=Paul Collins Startup list [Cgtask Services] Confirmed=X Filename=cgtask.exe Description=Added as a result of the LALA.B VIRUS! Source=Paul Collins Startup list [ChamClock] Confirmed=U Filename=ChamClock.exe Description=Chameleon Clock - system tray clock replacement Source=Paul Collins Startup list [ChangeLines] Confirmed=? Filename=chngline.exe Description=?? Source=Paul Collins Startup list [Check for One Touch Update] Confirmed=N Filename=wiseupdt.exe Description=Checks for updates for Visioneer OneTouch scanners Source=Paul Collins Startup list [Check Messenger] Confirmed=U Filename=cmesseng.exe Description=Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account Source=Paul Collins Startup list [CheckIt] Confirmed=U Filename=ToolBox.exe Description=CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry), and performs a check on various system parameters at intervals you specify Source=Paul Collins Startup list [CheckMsgPlus] Confirmed=Y Filename=MsgPlusH.dll, VerifyInstallation Description=Added by MSN Messenger Plus, a third party extension to MSN Messenger. This is the auto-update feature - see here for more info. Source=Paul Collins Startup list [checktime] Confirmed=? Filename=ct.exe Description=Found in the \HPSelect\Frontend\ directory on a HP machine. What is it's purpose and is it required? Source=Paul Collins Startup list [CherryKeyMan] Confirmed=U Filename=KeyMan.exe Description=Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys Source=Paul Collins Startup list [ChineseStar] Confirmed=U Filename=cstar.exe Description=Chinese language support software Source=Paul Collins Startup list [CHKADMIN] Confirmed=N Filename=CHKADMIN.EXE Description=Compaq Network Management System. When running, it places an icon in the system tray titled "Intelligent Manageability" Source=Paul Collins Startup list [Choke] Confirmed=X Filename=Choke.exe-blahh Description=Added as a result of the CHOKE VIRUS! Source=Paul Collins Startup list [CHotKey] Confirmed=U Filename=mhotkey.exeMK9805.EXE Description=Enables special keys on Chicony keyboards. Special combinations include Internet, E-mail, vol+, vol-, mute, etc. Only required for extended features Source=Paul Collins Startup list [Christmas Music Player] Confirmed=N Filename=TTEST6.EXE Description="Christmas Music Player brings the music of the Christmas Holiday to your desktop" Source=Paul Collins Startup list [ChromeMark] Confirmed=? Filename=keysh.exe Description=Related to this. Don't know what keysh.exe does though and if it's required Source=Paul Collins Startup list [ChronitelInitTV] Confirmed=? Filename=CHTVINIT.EXE Description=?? Source=Paul Collins Startup list [CiaBackdoor] Confirmed=X Filename=msldr.com Description=Added by a VIRUS! Source=Paul Collins Startup list [CIJxP2PSERVER] Confirmed=N Filename=CIJxP2PS.EXE Description=Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model, ie, for IJ300 x=3, for IJ700 x=7 Source=Paul Collins Startup list [CISrvr Program] Confirmed=N Filename=CISRVR.EXE Description=Related to internet setup on Compaq PC's Source=Paul Collins Startup list [Cissi] Confirmed=X Filename=Cissi.exe Description=Added as a result of the CISSI.A VIRUS! Source=Paul Collins Startup list [CitiVAN] Confirmed=N Filename=CitiVAN.exe Description=Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again Source=Paul Collins Startup list [Cjstcom] Confirmed=Y Filename=Cjstcom.exe Description=Canon printer BJ status language monitor Source=Paul Collins Startup list [CLCLSet] Confirmed=U Filename=CLCL.exe Description=CLCL clipboard caching utility Source=Paul Collins Startup list [CleanEasyImg] Confirmed=? Filename=cleanall.exe Description=?? Source=Paul Collins Startup list [CleanSweep Smart Sweep- Internet Sweep] Confirmed=U Filename=Csinsm32.exe Description=Automatic logging of installs from Norton CleanSweep - available via Start -> Programs Source=Paul Collins Startup list [CleanSweep Useage Watch] Confirmed=N Filename=CSUSEM32.EXE Description=Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time Source=Paul Collins Startup list [CleanTemp] Confirmed=U Filename=CLEANT~1.EXEBCleanTemp.exe Description=CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory Source=Paul Collins Startup list [Cleanup] Confirmed=N Filename=ONICTASK.EXE Description=Internet Cleanup from Aladdin Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet Source=Paul Collins Startup list [CleanupProgram] Confirmed=? Filename=cleanup.exe Description=In a C:\\Sonysys folder - Sony Vaio related? Source=Paul Collins Startup list [Click Radio Tuner] Confirmed=N Filename=clickr~1.exe Description=ClickRadio - subscription service playing radio music via the internet Source=Paul Collins Startup list [Click Tray Calendar] Confirmed=N Filename=ClickT~1.EXE Description=ClickTray Calendar - shows holidays, reminders of various anniversaries,tasks etc Source=Paul Collins Startup list [Clickoff] Confirmed=U Filename=Clickoff.exe Description=Clickoff automatically dismisses annoying dialog boxes Source=Paul Collins Startup list [CLICKTHEBUTTON] Confirmed=X Filename=CTB.EXE Description=Price comparison based spyware Source=Paul Collins Startup list [CLICONFG] Confirmed=X Filename=CLICONFG.EXE Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [Client Access Check Version] Confirmed=N Filename=cwbckver.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources Source=Paul Collins Startup list [Client Access Express Welcome] Confirmed=? Filename=cwbwlwiz.exe Description=Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? Source=Paul Collins Startup list [Client Access Help Update] Confirmed=N Filename=cwbinhlp.exe Description=Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries Source=Paul Collins Startup list [Client Access Service] Confirmed=N Filename=CwbSvStr.Exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources Source=Paul Collins Startup list [Client agent for ARCserve] Confirmed=? Filename=W95AGENT.EXE Description=Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required? Source=Paul Collins Startup list [ClientMan1] Confirmed=X Filename=mscman.exe Description=Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" Source=Paul Collins Startup list [Clik Status Monitor] Confirmed=N Filename=toolsclickstat.exe Description=Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed Source=Paul Collins Startup list [Clipbook Service] Confirmed=N Filename=Clipsrv.exe Description=Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks Source=Paul Collins Startup list [ClipMate5x] Confirmed=N Filename=ClipMt5x.exe Description=Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs Source=Paul Collins Startup list [Clipmate6] Confirmed=N Filename=CLIPMT60.EXE Description=Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs Source=Paul Collins Startup list [Clipomatic] Confirmed=N Filename=Clipomatic.exe Description=Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied, and allows you to retrieve the old data Source=Paul Collins Startup list [Clipsrv] Confirmed=N Filename=Clipsrv.exe Description=Supports Windows XP ClipBook Viewer, which allows pages to be seen by remote ClipBooks Source=Paul Collins Startup list [ClipTrakker] Confirmed=N Filename=ClipTrakker.exe Description=Cliptrakker - clipboard extender Source=Paul Collins Startup list [CLMFrontPanel] Confirmed=U Filename=clmpanel.exe Description=System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled, connection status is lost Source=Paul Collins Startup list [clnwall] Confirmed=? Filename=rundll.exe setupx.dll, InstallHinfSection ..\delwall.inf Description=?? Source=Paul Collins Startup list [ClockSync] Confirmed=X Filename=Sync.exe Description=ClockSynck - synchronizes your system clock with an internet time server. It's by WhenU, the makers of the Save Now spyware, and they're usually seen in tandem, so it's advised to replace it with one of may spyware free alternatives available Source=Paul Collins Startup list [ClockWise] Confirmed=U Filename=CLOCKWISE.EXE Description=ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates, but you can choose it to run programs at any time. It also updates the time by connecting to an atomic clock server. This is a spyware-free alternative to ClockSync Source=Paul Collins Startup list [CloneCDorCloneCDTray] Confirmed=U Filename=CloneCDTray.exe Description=System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions Source=Paul Collins Startup list [CloneCDElbyCDFL] Confirmed=U Filename=ElbyCheck.exe Description=From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it Source=Paul Collins Startup list [Clotusorgreg0] Confirmed=? Filename=prtStart.exe Orgprt.exe Description=Lotus SmartSuite related. In a Lotus\OrgReg folder. Unclear what exactly it does? Source=Paul Collins Startup list [ClrSchLoader] Confirmed=X Filename=Loader.exe Description=Clearsearch variant of IGetNet Source=Paul Collins Startup list [cma] Confirmed=U Filename=cma.exe Description=DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" Source=Paul Collins Startup list [Cmaudio] Confirmed=N Filename=Rundll32 cmicnfg.cpl, CMICtrlWnd Description=System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Cmd] Confirmed=X Filename=cmd32.exe Description=Added as a result of the P2P.TANKED VIRUS! Source=Paul Collins Startup list [CME] Confirmed=X Filename=cme.exe Description=Part of Gator advertising spyware - see here for removal instructions Source=Paul Collins Startup list [CmeSYS] Confirmed=X Filename=CMEsys.exe Description=Part of Gator advertising spyware - see here for removal instructions Source=Paul Collins Startup list [CmeUPD] Confirmed=X Filename=CMEupd.exe Description=Part of Gator advertising spyware - see here for removal instructions Source=Paul Collins Startup list [CMGrdian] Confirmed=? Filename=CMGrdian.exe Description=One of the McAfee shared components. What does it do and is it required? Source=Paul Collins Startup list [CMPDPSRV] Confirmed=U Filename=CMPDPSRV.EXE Description=Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys, Inc.). "Printer Driver Plus seamlessly integrates all the necessary components of a printer driver, plus more." Installed with some Compaq and Lexmark printers Source=Paul Collins Startup list [Cn323] Confirmed=X Filename=cnfrm33.exe Description=Added as a result of the MIMAIL.D or MIMAIL.G VIRUSES! Source=Paul Collins Startup list [CNBABE] Confirmed=X Filename=CNBABE.EXE Description=Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing Source=Paul Collins Startup list [cnet] Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [Cnfrm32] Confirmed=X Filename=cnfrm.exe Description=Added as a result of the MIMAIL.D or MIMAIL.G VIRUSES! Source=Paul Collins Startup list [CnsMax] Confirmed=X Filename=Internat.exe Description=Added as a result of the POINTEX VIRUS! Note - the real internat.exe resides in %windir%\\system (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) whereas this version resides in %windir% Source=Paul Collins Startup list [CnsMin] Confirmed=X Filename=Rundll32.exe CNSMIN.DLL, Rundll32 Description=CnsMin "Chinese Keywords" hijacker related Source=Paul Collins Startup list [CnxDslTaskBar] Confirmed=N Filename=CnxDslTb.exe Description=Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems Source=Paul Collins Startup list [Codename Dashboard] Confirmed=U Filename=dashboard.exe Description=Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework, it is a host for interchangeable components through which C.D. allows you to have any information you want, on your desktop, all the time" Source=Paul Collins Startup list [Coldlife -icmp] Confirmed=X Filename=Systray.exe Description=Added as a result of the FSERVE VIRUS! Note - this is not the real SysTray.exe Source=Paul Collins Startup list [coloreal] Confirmed=U Filename=coloreal.exe Description=Makes colours sharper and brighter, but will only work with coloreal capable monitors Source=Paul Collins Startup list [Colorific Control Panel] Confirmed=N Filename=Hgcctl95.exe Description=From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor Source=Paul Collins Startup list [COM Service] Confirmed=X Filename=mscom32.com Description=Added as a result of the BEASTY.H VIRUS! Source=Paul Collins Startup list [COM Service] Confirmed=X Filename=msynvr.com Description=Added as a result of the BEASTY.G VIRUS! Source=Paul Collins Startup list [COM Service] Confirmed=X Filename=msjclh.com Description=Added as a result of the PLUX VIRUS! Source=Paul Collins Startup list [COM+ System Applications] Confirmed=X Filename=lsas.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [COM-IP] Confirmed=N Filename=COMIP.EXE Description=COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212) Source=Paul Collins Startup list [ComcastSUPPORT] Confirmed=X Filename=tgkill.exe Description=Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs Source=Paul Collins Startup list [COMCFG] Confirmed=X Filename=comcfg.exe Description=Added as a result of the TOADCOM.A VIRUS! Source=Paul Collins Startup list [COMDRV32] Confirmed=U Filename=svdhost.exe Description=Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Note - asks for permission to contact the IP address of http://www.protectcom.com/ Source=Paul Collins Startup list [Command] Confirmed=X Filename=system.exe Description=Added as a result of the GATECRASH.A or GATECRASH.B VIRUSES! Source=Paul Collins Startup list [Command] Confirmed=X Filename=Gotit.exe Description=Added as a result of the TITOG VIRUS! Source=Paul Collins Startup list [COMMAND] Confirmed=X Filename=command.exe Description=Added as a result of the QQPASS.E VIRUS! Source=Paul Collins Startup list [CommCtr] Confirmed=N Filename=commctr.exe Description="Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!". Available via Start -> Programs Source=Paul Collins Startup list [Compaq Alerter] Confirmed=U Filename=CPQAlert.exe Description=Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information Source=Paul Collins Startup list [Compaq Computer Corp SCCenter Module] Confirmed=N Filename=SCCENTER.EXE Description=For Compaq PC's. Part of Backweb Source=Paul Collins Startup list [Compaq Computer Security] Confirmed=? Filename=Rundll32.exe SECURE32.CPL, Service Description=?? Source=Paul Collins Startup list [Compaq DMI] Confirmed=N Filename=cpqdmi.exe Description=Compaq version of the Desktop Management Interface Source=Paul Collins Startup list [Compaq Internet Setup] Confirmed=N Filename=inetwizard.exe Description=For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list Source=Paul Collins Startup list [Compaq Knowledge Center] Confirmed=U Filename=silent.exe & matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file while silent.exe executes matcli.exe quietly in the background. Compaq Knowledge Center is required to run with the Help and Support program. If you uncheck Compaq Knowledge Center and and then run help and Support it will add another Compaq Knowledge Center in the startup menu. If you remove the Compaq Knowledge Center in the add/remove program some help menus in help and support will not be available like Fix my Presario, Preference, and Contact Technical Support". You decide Source=Paul Collins Startup list [Compaq Message Server] Confirmed=N Filename=COMPAQ-RBA.EXE Description=Applies to CPQBootPerfDB below as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans, but fairly harmless. They send information on the "Compaq Advisor/Compaq Message Screener" application that comes with every Compaq computer and provide feedback on how computer users use the Message Advisor. These messages appear occasionally and instruct and advise users on their computer and its use. They generally attempt to get you (these messages) to connect to Compaq's website. They may be safely disabled via (1) MSCONFIG or (2) Start -> Programs -> Compaq Advisor -> Advisor Settings under the "advanced" tab. Not required and can cause problems Source=Paul Collins Startup list [Compaq PK Daemon] Confirmed=U Filename=cpqkl.exe Description=For Compaq laptops for programming user configurable keys. Not required unless you use them Source=Paul Collins Startup list [Compaq Video CD Watcher] Confirmed=N Filename=?? Description=For Compaq PC's. MPEG viewer Source=Paul Collins Startup list [CompaqHW Comp Manager] Confirmed=? Filename=cpqhcm.exe Description=Running on a Compaq laptop - any ideas? Source=Paul Collins Startup list [CompaqPrinTray] Confirmed=N Filename=printray.exe Description=Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop Source=Paul Collins Startup list [CompaqSystray] Confirmed=N Filename=cpqpscp.exe Description=Compaq System Tray icon Source=Paul Collins Startup list [COMSMDEXE] Confirmed=N Filename=comsmd.exe Description=3Com tray icon Source=Paul Collins Startup list [ComTry Web Searcher] Confirmed=X Filename=wstray.exe Description=Comtry MP3 Downloader related - spyware Source=Paul Collins Startup list [Config] Confirmed=X Filename=service.exe Description=Added as a result of the ISRAZ.B VIRUS! Source=Paul Collins Startup list [Config Loadation] Confirmed=X Filename=iEEexplore.exe Description=Added as a result of the SDBOT.H VIRUS! Source=Paul Collins Startup list [Config Loadatiorin] Confirmed=X Filename=I3Explorer.exe Description=Added as a result of the SDBOT.H VIRUS! Source=Paul Collins Startup list [Config Loader] Confirmed=X Filename=svchosl.exe Description=Added as a result of the GAOBOT.P VIRUS! Source=Paul Collins Startup list [Config Loader] Confirmed=X Filename=sysldr32.exe Description=Added as a result of the GAOBOT VIRUS! Source=Paul Collins Startup list [Config Loader] Confirmed=X Filename=scvhost.exe Description=Added as a result of the GAOBOT.AE or GAOBOT.AO VIRUSES! Source=Paul Collins Startup list [Config Loader for Microsoft Windows] Confirmed=X Filename=mwincfg32.exe Description=Added as the result of the AGOBOT.BD VIRUS! Source=Paul Collins Startup list [Config Loader2] Confirmed=X Filename=explores.exe Description=Added as a result of the GAOBOT.BT VIRUS! Source=Paul Collins Startup list [ConfiggLoader] Confirmed=X Filename=cart322.exe Description=Added as a result of the GAOBOT.DJ VIRUS! Source=Paul Collins Startup list [ConfigSafe] Confirmed=U Filename=CFGSAFE.EXEAUTOCHK.EXE Description=ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions -- provides a restore function. Your choice Source=Paul Collins Startup list [ConfigServices] Confirmed=N Filename=Config.exe Description=Part of initial setup on a Compaq PC Source=Paul Collins Startup list [Configuration Loaded] Confirmed=X Filename=wupdated.exe Description=Added as a result of the MOEGA or MOEGA.AG VIRUSES! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=aim95.execmd32.exeIEXPL0RE.EXEiexplore.exeloadcfg32.exeMSTasks.exe Description=Added as a result of the LOADCFG or SDBOT. Note - "iexplore.exe" resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) whereas the valid "iexplore.exe" (IE) resides in C:\\Program Files Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=service5.exe Description=Added as a result of the GAOBOT.AF VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=? Filename=lfass.exe Description=?? Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=sycfg34.exe Description=Added as a result of the GAOBOT.AN VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=wincrt32.exe Description=Added as a result of the GAOBOT.BF VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=windex.exe Description=Added as a result of the GAOBOT.BM VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=windex.exe Description=Added as a result of the GAOBOT.BZ VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=dosrun32.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=Service.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=Servicess.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=sw32.exe Description=Added as a result of the AGOBOT.BQ VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=System.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=Winreg.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=sysinfo.exe Description=Added as a result of the GAOBOT.FQ VIRUS! Source=Paul Collins Startup list [Configuration Loader] Confirmed=X Filename=microsoft.exe Description=Added as a result of the GAOBOT.JB VIRUS! Source=Paul Collins Startup list [Configuration Loader ] Confirmed=X Filename=syscfg32.exe Description=Added as a result of the SDBOT.B VIRUS! Source=Paul Collins Startup list [Configuration Loading] Confirmed=X Filename=svchos1.exe Description=Added as a result of the GAOBOT.DK VIRUS! Source=Paul Collins Startup list [Configuration Manager] Confirmed=X Filename=CNFGLD32.EXECnfgldr.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [Configuration Utility] Confirmed=N Filename=CONFIG.EXE Description=Controls linksys wireless connection. Available from the Desktop Source=Paul Collins Startup list [Configuration Wizard] Confirmed=N Filename=Cfgwiz32.exe Description=Added as a result of a variation of the HACKTACK VIRUS! Not to be confused with the valid MS "ISDN Configuration Wizard" (Cfgwiz32.exe) in C:\\Windows\\System Source=Paul Collins Startup list [Conmgr] Confirmed=N Filename=conmgr.exe Description=Starts Winfax pro at startup Source=Paul Collins Startup list [ConMgr.exe] Confirmed=U Filename=conmgr.exe Description=Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut Source=Paul Collins Startup list [Connect2Party] Confirmed=X Filename=connect2party.exe Description=Adult content dialler Source=Paul Collins Startup list [Connection Manager] Confirmed=N Filename=CManager.exe Description=SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service Source=Paul Collins Startup list [Contacte] Confirmed=? Filename=contacte.exe Description=Some kind of driver? Source=Paul Collins Startup list [ContentDownload] Confirmed=X Filename=rundll32.exe MSA64CHK.dll, DllMostrar Description=123Messenger adware Source=Paul Collins Startup list [ContentService] Confirmed=X Filename=winservn.exe Description=Homepage hijacker Source=Paul Collins Startup list [ContinueInstall] Confirmed=X Filename=bpsinstall.exe Description=BrowserAid parasite Source=Paul Collins Startup list [Control] Confirmed=X Filename=rundll32.exe ctrlpan.dll, Restore ControlPanel Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [control panel] Confirmed=N Filename=smctrlw.exe Description=System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card Source=Paul Collins Startup list [Control Panel] Confirmed=X Filename=System.exe Description=Added as a result of the DANI VIRUS! Source=Paul Collins Startup list [ControlCentreTray] Confirmed=N Filename=XWCTray.exe Description=System Tray access for the Xerox ControlCentre 2.0 software for their range of printers, copiers, faxes, etc Source=Paul Collins Startup list [Controller] Confirmed=N Filename=WFXCTL32.EXE Description=From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [ControlPanel] Confirmed=X Filename=rundll32 internat.dll, LoadKeyboardProfile Description=CoolWebSearch parasite related Source=Paul Collins Startup list [Cookie Cop 2] Confirmed=U Filename=CookieCop.exe Description=Cookie Cop 2 from PC Magazine - cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [Cookie Pal] Confirmed=U Filename=CPBRWTCH.EXE Description=Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [CookieJar] Confirmed=U Filename=Cookiejar.exe Description=Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [CookiePatrol] Confirmed=U Filename=CookiePatrol.exe Description=CookiePatrol - PestPatrol's cookie interceptor stopping spyware cookies Source=Paul Collins Startup list [CookieWall] Confirmed=U Filename=cookie.exe Description=CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [Cool Desk] Confirmed=U Filename=cdesk.exe Description=Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you Source=Paul Collins Startup list [CoolSwitch] Confirmed=U Filename=taskswitch.exe Description=ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen Source=Paul Collins Startup list [coolwebprogram] Confirmed=X Filename=clrssn.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [CopernicPerUserTaskMgr] Confirmed=U Filename=CopernicPerUserTaskMgr.exe Description=Automatic tasking feature of Copernic Pro multi-search engine tool Source=Paul Collins Startup list [Copyright] Confirmed=N Filename=mwcpyrt.exe Description=Displays copyright information on IBM ThinkPads Source=Paul Collins Startup list [Corel Colleagues & Contacts Reminders] Confirmed=N Filename=cffrem.exe Description=Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings, maintaining addresses, etc. Part of Corel Print Office Source=Paul Collins Startup list [Corel Desktop Application Director] Confirmed=N Filename=dadx.exe Description=The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs Source=Paul Collins Startup list [Corel Family & Friends reminders] Confirmed=N Filename=CFFREM.EXE Description=Corel Family & Friends - all-in-one calender, address book and list manager. Part of Corel Print House Magic Source=Paul Collins Startup list [Corel RegistrationorCorel Registration Reminder] Confirmed=N Filename=Remind32.exe Description=If you don't want to register Corel products and be reminded about it every 2 weeks disable it Source=Paul Collins Startup list [Corel Reminder] Confirmed=N Filename=NAVBROWSER.EXE Description=If you don't want to register Corel products and be reminded about it every 2 weeks disable it Source=Paul Collins Startup list [CorelCENTRAL 10] Confirmed=N Filename=I_26dadCC.exe Description=CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs Source=Paul Collins Startup list [CorelMedia FoldersIndexer8] Confirmed=N Filename=MFindexer.exeMFINDE~1.EXE Description=Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office Source=Paul Collins Startup list [CoreSrv] Confirmed=X Filename=coresrv.exe Description=Some IRC trojans/worms use this - see here for more information Source=Paul Collins Startup list [CORESYS] Confirmed=? Filename=coresys.exe Description=?? Source=Paul Collins Startup list [CorrectConnect] Confirmed=N Filename=CConnect.exe Description=Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available Source=Paul Collins Startup list [CountrySelectionorCountry Select] Confirmed=N Filename=pctptt.exe Description=Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required Source=Paul Collins Startup list [Coupon Offers] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [couponica] Confirmed=X Filename=couponica.exe Description=Adware - see here Source=Paul Collins Startup list [CP32NOT] Confirmed=U Filename=CP32BTN.EXE Description=For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons Source=Paul Collins Startup list [CPA9P2PSERVER] Confirmed=? Filename=CPA9P2PS.exe Description=Found on a Compaq Presario but what is it? Source=Paul Collins Startup list [CPATR10] Confirmed=U Filename=CPATR10.EXE Description=Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba, Compaq) to translate special hotkeys such as Play/Pause and Constrast Source=Paul Collins Startup list [CPBrWtch] Confirmed=U Filename=CPBrWtch.exe Description=Kookaburra Softwares Cookie Pal cookie manager. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return Source=Paul Collins Startup list [CPD_EXE] Confirmed=Y Filename=CPD.EXE Description=Firewall bundled with McAfee VirusScan 6.* Source=Paul Collins Startup list [cpntmgc] Confirmed=X Filename=wincomp.exewinmgts.exe Description=Remote-control trojan from Electronic Group - see here Source=Paul Collins Startup list [cpntmgc] Confirmed=X Filename=simcss.exenavpmc.exe Description=MagicControl downloader trojan variant Source=Paul Collins Startup list [CPortPatch] Confirmed=? Filename=cppatch.exe Description=CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though? Source=Paul Collins Startup list [CPQAcDc] Confirmed=Y Filename=CPQAcDc.exe Description=Compaq PowerCon power management software for laptops Source=Paul Collins Startup list [CPQAlert] Confirmed=U Filename=CPQAlert.exe Description=Compaq's Insight Manager Agent - a tool that allows for "fault, performance, and configuration management". Recommended for corporate users only. It's best removed if installed but not wanted, rather than disabled at startup. See here for more information Source=Paul Collins Startup list [CPQBootPerfDB] Confirmed=N Filename=CPQBootPerfDB.EXE Description=See Compaq Message Server above Source=Paul Collins Startup list [CPQCalib] Confirmed=Y Filename=CPQCalib.exe Description=Compaq PowerCon power management software for laptops Source=Paul Collins Startup list [CPQDFWAG] Confirmed=N Filename=CpqDfwAg.exe Description=For Compaq PC's. Runs Compaq diagnostics on every boot Source=Paul Collins Startup list [CPQEASYACC] Confirmed=U Filename=cpqeadm.exe Description=For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [cpqeaui] Confirmed=U Filename=cpqeaui.exe Description=For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [cpqek] Confirmed=U Filename=kcpqek.exe Description=For Compaq PC's. Easy Access button support for the keyboard Source=Paul Collins Startup list [CPQInet Runtime Service] Confirmed=U Filename=CpqInet.exe Description=For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers Source=Paul Collins Startup list [CPQINKAGENT] Confirmed=N Filename=cpqinkag.exe Description=That is the Compaq Ink Agent for some inkjet printers, it lets users know when their ink cartridges are getting close to empty (by how many pages they have printed) Source=Paul Collins Startup list [cpqns] Confirmed=U Filename=cpqnpcss.exe Description=Related to Compaq.Net - not required if you don't use that Source=Paul Collins Startup list [Cpqset] Confirmed=N Filename=Cpqset.exe Description=Default settings software in Hewlett Packard notebook Source=Paul Collins Startup list [CPQSTUTFIX] Confirmed=Y Filename=stutfix.exe Description=For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton Source=Paul Collins Startup list [cpr] Confirmed=X Filename=cpr Description=Adroar.com adware downloader Source=Paul Collins Startup list [CPU Manager] Confirmed=X Filename=cpumgr.exe Description=Added as a result of the PANDEM.B VIRUS! Source=Paul Collins Startup list [CPUcool] Confirmed=U Filename=Cpucool.exe Description=Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Cpusave] Confirmed=X Filename=Cpusave.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Cpusave32] Confirmed=X Filename=Cpusave32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [cqlyg] Confirmed=X Filename=world_cup_.bat Description=Added as a result of the WCUP VIRUS! Source=Paul Collins Startup list [CQSCP2P SERVER] Confirmed=? Filename=?? Description="Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed Source=Paul Collins Startup list [CQSCP2PS] Confirmed=? Filename=?? Description="Compaq printer utility which is required in the startup menu in order to make the printer work correctly". Personally I doubt whether it is actually needed Source=Paul Collins Startup list [cracked_windows1] Confirmed=U Filename=cracked_windows1.exe Description=Cracked Windows popup killer Source=Paul Collins Startup list [CrazyTalk Serve] Confirmed=N Filename=rundll32.exe CrazyTalk.dll, DIIServeMediaFile Description=CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS Source=Paul Collins Startup list [CreateCD] Confirmed=N Filename=Createcd.exe Description=Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs Source=Paul Collins Startup list [CreateCD50] Confirmed=N Filename=Createcd50.exe Description=Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs Source=Paul Collins Startup list [Creative AGP Wizard] Confirmed=N Filename=agpwiz.exe Description=Part of Creative's BlasterControl Source=Paul Collins Startup list [Creative Launcher] Confirmed=N Filename=CTLauncher.exe Description=For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs Source=Paul Collins Startup list [Creative MediaSource Go] Confirmed=N Filename=CTCMSGo.exe Description="Creative MediaSource playbacks music in DVD-Audio, MP3, WMA, WAV and other media formats" Source=Paul Collins Startup list [Creative PCI Audio Configuration Utility] Confirmed=N Filename=starter.exe Description=System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer Source=Paul Collins Startup list [Creative Service for CDROM Access] Confirmed=N Filename=Ctsvccda.exe Description=Resident program for Creative's PlayCenter included with Soundblaster Audigy sound cards - speeds up detection of some media CDs if the system doesn't natively support them. Available via Start -> Programs Source=Paul Collins Startup list [Creative.exe] Confirmed=X Filename=Creative.exe Description=Added as a result of the PROLIN VIRUS! Source=Paul Collins Startup list [CreativeDiscNotifier] Confirmed=N Filename=CTNOTIFY.EXE Description=For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM, DVD-ROM, etc. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [CreativeMixer] Confirmed=U Filename=CTMIX32.EXE Description=Creative soundcard System Tray access to, for example, volume slider controls as normally provided by the "speaker" icon. Not required unless you adjust any settings otherwise available via the standard icon Source=Paul Collins Startup list [CriticalUpdate] Confirmed=N Filename=Wucrtupd.exe Description=MS Windows Critical Update Notification. If you want to keep Windows up-to-date, check the Windows Update site Source=Paul Collins Startup list [cronos] Confirmed=X Filename=MARCO!.SCR Description=Added as a result of the OPASERV.G VIRUS! Source=Paul Collins Startup list [Crusty] Confirmed=X Filename=dmcpl.exe Description=Added as the result of the RUSTY VIRUS! Source=Paul Collins Startup list [Crystal 3D Audio Control] Confirmed=? Filename=CWD3DSND.EXE Description=Crystal 3D Audio sound driver. Is it required? Source=Paul Collins Startup list [csaRem] Confirmed=N Filename=spqmdmui.exe Description=Compaq modem country selection Source=Paul Collins Startup list [CSAV_CheckViruses] Confirmed=Y Filename=vchk.exe.exe Description=Part of Command AntiVirus Source=Paul Collins Startup list [csc] Confirmed=? Filename=csc.exe Description=?? Source=Paul Collins Startup list [CSINJECT.EXE] Confirmed=U Filename=CSINJECT.EXE Description=Part of Quarterdeck/Norton CleanSweep. For a full description see here. An excerpt - "Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes." Source=Paul Collins Startup list [csrsc] Confirmed=X Filename=csrsc.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [CSRSS] Confirmed=X Filename=CSRSS.EXE Description=Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling Source=Paul Collins Startup list [CSRSWIN] Confirmed=X Filename= Description=Added as a result of the WINSHELL.50 VIRUS! Source=Paul Collins Startup list [CSRSX] Confirmed=X Filename= Description=Added as a result of the WINSHELL.50.B VIRUS! Source=Paul Collins Startup list [CSScheduleCheck] Confirmed=Y Filename=SCHWIZEX.EXE Description=Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot Source=Paul Collins Startup list [csss] Confirmed=X Filename=Csss.exe Description=Added as a result of the BALICK VIRUS! Source=Paul Collins Startup list [CSS_Central] Confirmed=U Filename=CSS_1631.EXE Description=CSS Communication Agent (95 Host) from Command Software Systems "CSS Central� provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console." Source=Paul Collins Startup list [ct] Confirmed=Y Filename=ct.exe Description=ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it Source=Paul Collins Startup list [CTAVTray] Confirmed=N Filename=CTAvTray.exe Description=For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ Source=Paul Collins Startup list [CTDVDDet] Confirmed=N Filename=CTDVDDet.exeCTDetect.exe Description=Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again Source=Paul Collins Startup list [ctfmon] Confirmed=U Filename=ctfmon.exe Description=CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. CTFMON can be disabled from Control Panel, Text & Speech Services Source=Paul Collins Startup list [ctfmon] Confirmed=X Filename=taskmgr32#.exe Description=Added as a result of the SOWSAT.B VIRUS! where # is a number from 0 to 9 Source=Paul Collins Startup list [Ctfmon.exe] Confirmed=X Filename=ctfmon32.exe Description=CoolWebSearch parasite related - hijacking to Slawsearch.com Source=Paul Collins Startup list [CTHELPER] Confirmed=N Filename=CTHELPER.EXE Description=CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative�s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task.Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled Source=Paul Collins Startup list [CTime] Confirmed=X Filename= Description=Added as a result of the HTTPDOS VIRUS! Source=Paul Collins Startup list [CTPDPSRV] Confirmed=? Filename=CTPDPSRV.EXE Description=Printer driver (in the WINDOWS\\System32\\spool\\DRIVERS\\W32X86 folder). Is it required? Source=Paul Collins Startup list [CTRegRun] Confirmed=N Filename=CTRegRun.exe Description=For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative Source=Paul Collins Startup list [CTStartup] Confirmed=N Filename=CTEaxSpl.exe Description=Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard Source=Paul Collins Startup list [CTsysVol] Confirmed=U Filename=CTSYSVOL.exe Description=Creative sound card volume controls Source=Paul Collins Startup list [cttdpsrv] Confirmed=? Filename=cttdpsrv.exe Description=?? Source=Paul Collins Startup list [cuagentExe] Confirmed=Y Filename=Cuagent.exe Description=Command Antivirus related Source=Paul Collins Startup list [cuo] Confirmed=X Filename=cuo.exe Description=Added as a result of the BUGBEAR VIRUS! Source=Paul Collins Startup list [CursorXP] Confirmed=N Filename=CursorXP.exe Description=CursorXP from Stardock - tool for creating mouse cursors Source=Paul Collins Startup list [Customizer2000] Confirmed=U Filename=logon.exe Description=Automatic logon feature of Customizer 2000 - "a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows, and make changes" Source=Paul Collins Startup list [CuteMX] Confirmed=N Filename=CuteMX.EXE Description=File sharing utility Source=Paul Collins Startup list [CVPND] Confirmed=Y Filename=cvpnd.exe Description=Sub-system used by Cisco VPN client for making a connection to a remote IPSec server Source=Paul Collins Startup list [CWatch] Confirmed=U Filename=cw.exe Description=ChatWatch - chat monitoring tool Source=Paul Collins Startup list [cwbckver] Confirmed=N Filename=cwbckver.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Checks the software version on your PC to that of the iSeries it is connected to. Not required - and can be turned off in the Client Access properties. It's a waste of resources Source=Paul Collins Startup list [cwbinhlp] Confirmed=N Filename=cwbinhlp.exe Description=Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. It only updates the help files on your PC to match the level of the attached iSeries Source=Paul Collins Startup list [cwbsvstr] Confirmed=N Filename=cwbsvstr.exe Description=Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. Useful if you are going to access the iSeries through Windows Explorer to move files back and forth between Windows folders and iSeries folders. This is a tool that is only used by Client Access administrators (usually) so it is not required - a waste of resources Source=Paul Collins Startup list [cwbwlwiz] Confirmed=? Filename=cwbwlwiz.exe Description=Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop, browser and wireless access to iSeries servers. What does it do and is it required? Source=Paul Collins Startup list [Cwcdschk.exe] Confirmed=? Filename=Cwcdschk.exe Description=IBM Thinkpad related? Source=Paul Collins Startup list [CXMon] Confirmed=N Filename=Hpi_Monitor.exe Description=Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs Source=Paul Collins Startup list [Cyber] Confirmed=N Filename=cyberchk.exe Description=Part of Belkins "Multimedia Cleaning Kit" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after "x" amount of time has passed Source=Paul Collins Startup list [Cyber Trio] Confirmed=U Filename=showmode.exe Description=From G-Tek Technologies. Allows you to set the PC in one of three modes, Standard, Enhanced and Kiddo. Standard is full function, Enhanced prevents accidental damage and Kiddo is a play environment for kids. Pre-installed on some Packard Bell PCs Source=Paul Collins Startup list [Cyber-Defender 2003] Confirmed=U Filename=uwcdsvr.exe Description=Cyber Defender 2003 Source=Paul Collins Startup list [CyberLat Ram Cleaner] Confirmed=U Filename=CLRamCleaner.exe Description=CyberLat RAM Cleaner is a program that Frees, Optimizes and Defrags your system's wasted memory (RAM). Some users swear by programs such as this but I suggest you read this article and make up your own mind Source=Paul Collins Startup list [CyberMedia Agent] Confirmed=N Filename=CMAGENT.EXE Description=Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge, CyberMedia Agent may attach itself to TextBridge and cause TextBridge to crash everything if this is disabled Source=Paul Collins Startup list [CyberWolf] Confirmed=X Filename=CyberWolf.exe Description=Added as a result of the KICKIN.A (or CYDOG.C) VIRUS! Source=Paul Collins Startup list [CyDoororCydoorUpdate] Confirmed=X Filename=CD_Load.exe Description=Adware. Check here for information about Cy-Door and here for a program that can remove it Source=Paul Collins Startup list [CyphTray] Confirmed=N Filename=CyphTray.exe Description=Cypherus - encryption software Source=Paul Collins Startup list [D-Link AirPlus DWL-650+ Utility] Confirmed=N Filename=WLANMON.exe Description=D-Link Air Plus Wireless PC modem connection monitor Source=Paul Collins Startup list [D066UUtility] Confirmed=N Filename=D066UUTY.EXE Description=TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software Source=Paul Collins Startup list [d3dupdate.exe] Confirmed=X Filename=bbeagle.exe Description=Added as a result of the BEAGLE.A VIRUS! Source=Paul Collins Startup list [D4] Confirmed=U Filename=D4.exe Description=Dimension 4 - network time synchronization software Source=Paul Collins Startup list [DACONFIGEXE] Confirmed=N Filename=daconfig.exe Description=3Com NIC Diagnostics. Available via Start -> Programs Source=Paul Collins Startup list [DadApp] Confirmed=Y Filename=dadapp.exe Description="DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required, but should be left in because it can create a hassle and doesn't always restore functionality to those buttons once unchecked and rechecked" - direct from Dell Source=Paul Collins Startup list [Daemon] Confirmed=N Filename=DAEMON32.EXE Description=Pre-loads game profiles for MS Sidewinder game controllers prior to release 2.0 of the software. Recommend upgrade. Available via Start -> Programs Source=Paul Collins Startup list [DaemonorDAEMON Tools-1033] Confirmed=U Filename=Daemon.exe Description=Daemon Tools - used to map an image-file (.iso, .bin etc) to a virtual CD/DVD-drive Source=Paul Collins Startup list [Daily Planner] Confirmed=N Filename=dayplan.exe Description=Daily Planner - discontinued, and now part of KMCS Deluxe System Suite. Tool to plan your days, and check activities off as you complete them Source=Paul Collins Startup list [Dap] Confirmed=N Filename=DAP.exe Description=Download Accelerator Plus from SpeedBit - download manager/accelerator Source=Paul Collins Startup list [DarkDevil.Grasiele.BR] Confirmed=X Filename=Grasiele.VBS Description=Added as a result of the LEMBRA VIRUS! Source=Paul Collins Startup list [DashIE] Confirmed=? Filename=N/A Description=Could be related to "Dash Power Shopping" tool bar in IE? Source=Paul Collins Startup list [Data] Confirmed=X Filename=System.dat.vbs Description=Added as a result of the BISCUIT.A VIRUS! Source=Paul Collins Startup list [Data LifeGuard] Confirmed=N Filename=BACKWE~1.EXE Description=Data LifeGuard diagnostic tools for Western Digital's series of hard drives Source=Paul Collins Startup list [Data LifeGuard LifeLine Lite installer] Confirmed=N Filename=DLGLI.EXE Description=Backweb installer - see here Source=Paul Collins Startup list [Data789] Confirmed=X Filename=Regedit.exe ....data789.tmp Description=Homepage hijacker Source=Paul Collins Startup list [DataCaching] Confirmed=N Filename=FlashKsk.exe Description=SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon Source=Paul Collins Startup list [DataLayer] Confirmed=? Filename=DataLayer.exe Description=Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." What does it do and is it required? Source=Paul Collins Startup list [DataViz Messenger] Confirmed=N Filename=DvzMsgr.exe Description=DataViz Documents to Go - "allows you to use your Word, Excel and PowerPoint files on your handheld anywhere, anytime. In addition, it now synchronizes e-mail with attachments, PDF files, pictures and Excel-like charts" Source=Paul Collins Startup list [Datcheck] Confirmed=X Filename=datcheck.exe Description=Added as a result of the KEYPANIC VIRUS! Source=Paul Collins Startup list [Date Manager] Confirmed=X Filename=datemanager.exe Description=Date Manager - calender program. Spyware/adware based provided by The Gator Corporation Source=Paul Collins Startup list [Datechecker] Confirmed=? Filename=N/A Description=Could be related to this? Source=Paul Collins Startup list [DateMakerIntl] Confirmed=X Filename=DateMakerIntl.exe Description=Premium rate dialler also referred to as the PORNSPA.F VIRUS! Source=Paul Collins Startup list [DAupdate] Confirmed=N Filename=DAupdate.exe Description=DoubleAgent content manager Source=Paul Collins Startup list [DAW9532.exe] Confirmed=? Filename=DAW9532.EXE Description=Loaded during installation of some 3Com network cards. Enables their DynamicAccess desktop management software. Is it required? Source=Paul Collins Startup list [DayToday] Confirmed=U Filename=DAYTODAY.EXE Description=DayToday from RoboMagic Software Corp. Displays the date on the taskbar Source=Paul Collins Startup list [DAZEL Delivery Agent] Confirmed=U Filename=DcDaemon.exe Description=Control and send documents, etc, to any destination - see here Source=Paul Collins Startup list [dbserv] Confirmed=N Filename=dbserv.exe Description=Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled Source=Paul Collins Startup list [DCfssvcordcfssve] Confirmed=U Filename=dcfssvc.exe Description=Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup, your camera will not cause your computer to open a pop-up window when you connect it. Leave enabled if you can't load pictures from your camera/dock - Kodak's dock is an example Source=Paul Collins Startup list [DDCActiveMenu] Confirmed=X Filename=DDCActiveMenu.exe Description=Digital Distribution Channel from Wild Tangent - adware Source=Paul Collins Startup list [DDCMorDDCMan] Confirmed=X Filename=DDCMan.exe Description=Digital Distribution Channel from Wild Tangent - adware Source=Paul Collins Startup list [ddeproc] Confirmed=X Filename=ddeproc.exe Description=Associated with Webcelerator - spyware. Read eAcceleration's privacy statement here Source=Paul Collins Startup list [DDialler] Confirmed=X Filename=DDialler.exe Description=Adult content dialler Source=Paul Collins Startup list [DDT] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [DeadAIM] Confirmed=N Filename=rundll32.exe DeadAIM.ocm, ExportedCheckODLs Description=DeadAIM - feature enhancing product for AOL's Instant Messenger program Source=Paul Collins Startup list [Debug] Confirmed=X Filename=DebugW32.exe Description=Added as a result of the GUBED VIRUS! Source=Paul Collins Startup list [Default web browser] Confirmed=X Filename=IexpIore.exe Description=Added as a result of the OBLIVION.B VIRUS! Note - don not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer), the first has a captial "i" in place of lower case "L" Source=Paul Collins Startup list [defragm_check] Confirmed=X Filename=defragment.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [defwatch] Confirmed=U Filename=defwatch.exe Description=Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis Source=Paul Collins Startup list [DelayorDelayrun] Confirmed=U Filename=delayrun.exe Description=On HP PCs this program is used to help prevent conflicts or timing issues on fast computers Source=Paul Collins Startup list [Delete Me] Confirmed=X Filename=worm.exe Description=Added as the result of the DOOMHUNTER VIRUS! Source=Paul Collins Startup list [Dell Alert] Confirmed=N Filename=DAMon.exe Description="Dell Alert" utility, that's supposed to make interaction with Support easier Source=Paul Collins Startup list [DellDMI] Confirmed=? Filename=delldmi.exe Description=Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards? Source=Paul Collins Startup list [DELLMMKBorDellTouch] Confirmed=U Filename=DELLMMKB.EXE Description=Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys Source=Paul Collins Startup list [DellSC] Confirmed=N Filename=dellsc.exe Description=Dell Solution Center - web-based troubleshooting tools and educational offerings Source=Paul Collins Startup list [delmsbb] Confirmed=X Filename=delmsbb.exe Description=nCase adware Source=Paul Collins Startup list [delsubmit] Confirmed=X Filename=rundll32.exe advpack.dll, DelNodeRunDLL32 submit.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [DelTmp] Confirmed=? Filename=DelTemp.exe Description=Added to the startup list after installing a Creative SoundBlaster Audigy soundcard. Deletes temporary files once an installation is complete? Source=Paul Collins Startup list [DeltTray] Confirmed=N Filename=deltray.exe Description=System Tray access to the control panel for the M-Audio Delta 44 PCI Analog Recording Interface. Available via a desktop shortcut, Start -> Programs or Start -> Settings -> Control Panel Source=Paul Collins Startup list [demon] Confirmed=? Filename=demon.exe Description=Part of the French Wanadoo ADSL extense pack. What does it do and is it required? Source=Paul Collins Startup list [DepFrez] Confirmed=U Filename=frzstate.exe Description=Deep Freeze from Hyper Technologies. "Freezes" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators, for example Source=Paul Collins Startup list [Description of Shortcuts] Confirmed=? Filename=*.exe Description=* seems to be a sequence of alphanumerics that can be different, i.e., 1960F8A9, 4EBD23F5, etc. Each of these files would appear to be a shortcut, i.e., 4EBD23F5 is actually Works Calender Reminder (found via a registry search) Source=Paul Collins Startup list [Desire] Confirmed=X Filename=desires.exe Description=Adult content dialler Source=Paul Collins Startup list [desk-top-service] Confirmed=? Filename=desk-top-service.exe Description=?? Source=Paul Collins Startup list [DeskColor] Confirmed=N Filename=DESKCOLOR.EXE Description=Provides transparent icon text backgrounds and coloured icon text Source=Paul Collins Startup list [Deskflag] Confirmed=N Filename=Deskflag.exe Description=DeskFlag - animated USA flag on the desktop Source=Paul Collins Startup list [Desksite CMA] Confirmed=U Filename=cma.exe Description=DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center" Source=Paul Collins Startup list [Desktop] Confirmed=X Filename=rundll32.exe msconfd.dll, Restore ControlPanel Description=Added as a result of the BOOKMARKER VIRUS! Source=Paul Collins Startup list [Desktop Architect] Confirmed=N Filename=DATRAY.EXE Description=Desktop theme manager available here - for managing the desktop appearance, fonts, sounds, etc Source=Paul Collins Startup list [Desktop Plant] Confirmed=N Filename=AZARE10S.PLT Description=Vritual plant from here - this version is an Azalea, there are others so the filename may be different Source=Paul Collins Startup list [Desktop Weather] Confirmed=N Filename=THE WEATHER CHANNEL.exe Description=Desktop Weather by The Weather Channel - provides current temperature, conditions, alerts, etc Source=Paul Collins Startup list [desktopmgr] Confirmed=N Filename=desktopmgr.exe Description=Synchronisation manager for the cradles for the Research In Motion range of wireless handhelds, including the "Blackberry" Source=Paul Collins Startup list [DesktopX] Confirmed=U Filename=DESKTOPX.EXE Description=A program that replaces the regular Desktop and Taskbar, and can be changed to the user's liking Source=Paul Collins Startup list [deskup] Confirmed=N Filename=deskup.exe Description=Adds Iomega Zip drive icons to the desktop Source=Paul Collins Startup list [detect] Confirmed=U Filename=idetect.exe Description=iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled Source=Paul Collins Startup list [detect] Confirmed=? Filename=turbodetect.exe Description=?? Source=Paul Collins Startup list [Detector] Confirmed=N Filename=detector.exe Description=USB port detector for LG scanners. Sits in the System Tray, and when it detects the scanner through the USB port, you can run the scanner software from the tray. It is not required at all, since you can use the scan software from almost any photo editing software Source=Paul Collins Startup list [DEventAgent] Confirmed=U Filename=eventagt.exe Description=DEvent Agent Module client - part of Dell OpenManage and used for server management. Only required if you use this Source=Paul Collins Startup list [Device Detector] Confirmed=U Filename=DevDetect.exe Description=Watches for external digital imaging products being connected from ACD Systems Source=Paul Collins Startup list [DeviceDiscovery] Confirmed=U Filename=hpotdd01.exe Description=Detection of new imaging, printing and other peripherals on HP machines such as USB printers, cameras and Bluetooth products Source=Paul Collins Startup list [DevicePath] Confirmed=X Filename=Proyecto1.exeRoot.exe Description=Added as a result of the GRUEL VIRUS! Source=Paul Collins Startup list [Devices] Confirmed=U Filename=olesvr.exe Description=Salfeld Child Control 2003 - parental control software Source=Paul Collins Startup list [devldr16] Confirmed=U Filename=devldr16.exe Description=Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices Source=Paul Collins Startup list [Devlog] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [DGJM] Confirmed=? Filename=DGJM.exe Description=?? Source=Paul Collins Startup list [dhcpagnt] Confirmed=Y Filename=dhcpagnt.exe Description=Intel DSL modem driver - leave enabled or you'll have to re-install the drivers Source=Paul Collins Startup list [DHNUXB] Confirmed=? Filename=DHNUXB.exe Description=?? Source=Paul Collins Startup list [diagent] Confirmed=N Filename=diagent.exe Description=System Tray access for Creative Diagnostics for the Creative SoundBlaster series soundcards. Available via Start -> Programs Source=Paul Collins Startup list [Dial22orDial33] Confirmed=X Filename=dlm.exe Description=Adult content dialler Source=Paul Collins Startup list [Dialer] Confirmed=X Filename=rundll32.exe msa32chk.dll Description=Unidentfied malware Source=Paul Collins Startup list [Dialgo SDK] Confirmed=U Filename=PhoneAnswer.exe Description=Dialgo Wave Modem ActiveX - "Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID, Wave Playback, Wave Recording, Digit Monitoring, POP3 e-mail Manipulation, Speech Recognition and Synthesis" Source=Paul Collins Startup list [DialNet] Confirmed=X Filename=mxt32.exe Description=Adult content dialler Source=Paul Collins Startup list [Dialog Box Assistant] Confirmed=N Filename=OSDEx.exe Description=Dialog Box Assistant from Duality Software. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders Source=Paul Collins Startup list [Dialog Helper] Confirmed=N Filename=PDDLGHLP.EXE Description=Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs Source=Paul Collins Startup list [DigiGuide] Confirmed=N Filename=CLIENT.EXEclient01.exe Description=TV guide and reminder Source=Paul Collins Startup list [Digital Dashboard] Confirmed=N Filename=devgulp.exe Description=For Compaq PC's. Loads Digital Dashboard options Source=Paul Collins Startup list [Digital Line Detect] Confirmed=N Filename=DLG.exe Description=Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems Source=Paul Collins Startup list [Digital River eBot] Confirmed=N Filename=downlo~1.exe Description=Digital River Systems EBOT for downloading software from their site. In some cases, if you purchase software online for a download from a software manufacturer, you will be sent to this online company's site for the download after the purchase is complete. Read more here Source=Paul Collins Startup list [DigitalWizard] Confirmed=N Filename=ISWizard.exe Description=InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content Source=Paul Collins Startup list [DigitalWizard Monitor] Confirmed=N Filename=dwMon.exe Description=InstallShield's DigitalWizard - free, complete Digital Content Management Solution that makes it easy to experience digital content Source=Paul Collins Startup list [DIGStream] Confirmed=N Filename=digstream.exe Description=DIGStream Cache Manager - part of ESPN Motion and Disney Motion that periodically check for new videos and indication they're available in the System Tray. Starting ESPN Motion/Disney Motion starts digstream automatically Source=Paul Collins Startup list [Dimension4] Confirmed=U Filename=d4.exe Description=Atomic clock synchronisation freeware - starts-up, adjusts the system clock, then shuts down Source=Paul Collins Startup list [Dino3] Confirmed=X Filename=dino3.exe Description=Related to Jurassic Park III and enables a dinosaur to walk across the screen. Also generates adverts and classified as adware as a result Source=Paul Collins Startup list [Dir1] Confirmed=X Filename=caKe Description=Added as a result of the CAKE VIRUS! Source=Paul Collins Startup list [Direct Update] Confirmed=U Filename=DUControl.exe Description=DirectUpdate dynamic DNS updater Source=Paul Collins Startup list [DirectCD] Confirmed=N Filename=DirectCD.exe Description=DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later Source=Paul Collins Startup list [DIRECTVDSL] Confirmed=U Filename=Directvdsl.exe Description=Starts DirectTV DSL modem at boot up. Can also be started manually Source=Paul Collins Startup list [DirectX] Confirmed=X Filename=ddhelp32.exe Description=Added as a result of the BIONET.318 VIRUS! Note - not the DirectX helper which is ddhelp.exe Source=Paul Collins Startup list [directx] Confirmed=X Filename=Directx.exeSqlexploit.exeNTCmd.exePipeCmd.exe Description=Added as a result of the SDBOT.D VIRUS! Source=Paul Collins Startup list [DirectX] Confirmed=X Filename=DirectX.exe Description=Added as a result of the BLAXE or LOGPOLE VIRUSES! Source=Paul Collins Startup list [DirectX For Microsoft Windows] Confirmed=X Filename=dtxservice.exe Description=Added as a result of the PROGENT VIRUS! Source=Paul Collins Startup list [DirectX64] Confirmed=X Filename=DirectXset.exe Description=Added as a result of the BROWNEY.A VIRUS! Source=Paul Collins Startup list [Dirkey] Confirmed=U Filename=Dirkey.exe Description=Dirkey - small utility that allows you to bookmark up to 9 folders by using the Ctrl+Alt+1..9 shortcut keys in an Open/Save File dialog or in Windows Explorer. After this the Ctrl+1..9 shortcut keys can be used in the same or another window to go to any of the 9 bookmarked folders Source=Paul Collins Startup list [Disable EHCI] Confirmed=? Filename=nousb20.exe Description=?? Source=Paul Collins Startup list [Disc Detector] Confirmed=N Filename=CtNotify.exe Description=For Creative sound cards. Detects when you insert a CD, DVD, etc Source=Paul Collins Startup list [disc detector] Confirmed=? Filename=qnetquestnotifty.exe Description=?? Source=Paul Collins Startup list [discoveg] Confirmed=? Filename=discoveg.exe Description=?? Source=Paul Collins Startup list [DiscoverDeskshop] Confirmed=N Filename=Deskshop.exe Description=Discover Deskshop - single use "virtual" credit card Source=Paul Collins Startup list [Disk Master] Confirmed=X Filename= Description=Added as a result of the DISTER VIRUS! - a spam relayer Source=Paul Collins Startup list [DISKMON.EXE] Confirmed=? Filename=DISKMON.EXE Description=?? Source=Paul Collins Startup list [Disknag] Confirmed=N Filename=disknag.exe Description=Dell program that reminds you to make your backup diskettes Source=Paul Collins Startup list [Diskstart] Confirmed=X Filename=Code.exehit.exeSnt.exe Description=Adult content dialler Source=Paul Collins Startup list [Diskstart] Confirmed=X Filename=cat.exe Description=MS-Connect dialler Source=Paul Collins Startup list [Disk_Monitor] Confirmed=U Filename=Disk_Monitor.exe Description=Multi-media, Smartmedia, Compact Flash card reader for reading digital camera cards. Device is recognised as internal USB disk drive. Necessary if camera cards are to be recognised as soon as they are inserted into the reader Source=Paul Collins Startup list [Display Drivers] Confirmed=X Filename=cssrs.exe Description=Added as a result of the WORM_AGOBOT.FX VIRUS! Source=Paul Collins Startup list [DisplayTrayIcon] Confirmed=N Filename=TrayIcon.exe Description=System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution, etc regularily use Control Panel -> Display Source=Paul Collins Startup list [Distiller Assistant 3.01] Confirmed=N Filename=DISTASST.EXE Description=From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs Source=Paul Collins Startup list [distributed.net client] Confirmed=U Filename=DNETC.EXE Description=Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses Source=Paul Collins Startup list [Dit] Confirmed=Y Filename=dit.exe Description="Drive Icon and Label Utility" - assigns drive icons and names to flash memory cards. Required, otherwise the drives aren't found Source=Paul Collins Startup list [DiTask.exe] Confirmed=N Filename=DiTask.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. System Tray icon which shows you the status of your lines (free, occupied with incoming or outgoing call). Available via Start -> Programs Source=Paul Collins Startup list [DivX MediaPlayer 7.0] Confirmed=X Filename=Dr.DivX.exe Description=Added as a result of the ALADINZ.G VIRUS! Source=Paul Collins Startup list [DivX Updater] Confirmed=X Filename=DivX.Exe Description=Added as a result of the NALDEM or MASTAK VIRUSES! Source=Paul Collins Startup list [Divx4 codec] Confirmed=X Filename=devldr32.exe Description=Added as a result of an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file Source=Paul Collins Startup list [DJREGFIX] Confirmed=N Filename=regedit /s c:\\hpdjregfix.reg Description=DJRegFix showed up first in WinME as a "clever" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This "utility" adds the functionality and compatibility HP forgot to add in its WinME drivers Source=Paul Collins Startup list [DkService] Confirmed=U Filename=DkService.exe Description=From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. Used to schedule defragmenting on a regular basis and not required if you do so manually. In Diskeeper Lite (v7 freeware version), DkService also pops up a 'reminder' after Diskeeper has not been used for two days. Removing the DkService startup will end this and have no further impact as scheduled defragmenting is not available in the Lite version. Note - when Diskeeper (Lite) is started manually, DkService will load into memory too and NOT unload after Diskeeper has been closed Source=Paul Collins Startup list [Dkware lptt01orDkware ml097e] Confirmed=X Filename=dkware.exe Description=Variant of the RapidBlaster parasite (in a "DonkeySoft" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [dkzzixm] Confirmed=? Filename=dkzzixm.exe Description=?? Source=Paul Collins Startup list [dla] Confirmed=Y Filename=tfswctrl.exe Description=Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones" Source=Paul Collins Startup list [DlaTray] Confirmed=N Filename=Dlatray.exe Description=On HP PCs, tray icon for dla above Source=Paul Collins Startup list [dlder] Confirmed=X Filename=dlder.exe Description=Advertising spyware. Considered to be one oft the worst - even creating a fake "explorer.exe" file. Can be installed via versions of "Grokster", "Lime Wire" and "KaZaA" amongst other file-sharing utilities (see here). Reported in the past as a virus Source=Paul Collins Startup list [DlDir1] Confirmed=X Filename=caKe Description=Added as a result of the CAKE VIRUS! Source=Paul Collins Startup list [DLForcerExe] Confirmed=? Filename=DLForcerEXE.exe Description=?? Source=Paul Collins Startup list [DLF_00000B00] Confirmed=N Filename=Vcdlf.exe Description=Known to cause problems with "Out of memory" errors (see here). Otherwise, it's purpose is unknown Source=Paul Collins Startup list [DLG] Confirmed=N Filename=DLGCHBW.exe Description=Backweb part of Data LifeGuard - diagnostic tools for Western Digital's series of hard drives. Automatically detects an internet connection and downloads any available updates Source=Paul Collins Startup list [DLHelperEXE] Confirmed=N Filename=WATCH.exe Description=Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished Source=Paul Collins Startup list [DLHelperEXE.exe] Confirmed=X Filename=N/A Description=Downloader for Microgaming/Casino software - stealth installed Source=Paul Collins Startup list [DLL Service Manager] Confirmed=X Filename= Description=Added as a result of the RPCBOT.F VIRUS! Source=Paul Collins Startup list [DLL32] Confirmed=X Filename=dllmem32.exe Description=Added as a result of the KWBOT.E VIRUS! Source=Paul Collins Startup list [DLT] Confirmed=? Filename=dlt.exe Description=?? Source=Paul Collins Startup list [dluca] Confirmed=X Filename=dluca.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [dluca] Confirmed=X Filename=dluca.exe Description=Added as a result of the DLUCA.C VIRUS! Source=Paul Collins Startup list [Dluxjp] Confirmed=X Filename=cnfrm.exe Description=Added as a result of the DLUCA.D VIRUS! Source=Paul Collins Startup list [DM mgr] Confirmed=X Filename=dm_mgr.exe Description=Added as a result of the JITTAR VIRUS! Source=Paul Collins Startup list [DMILDR] Confirmed=N Filename=dmildr.exe Description=Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. Available via Start -> Programs Source=Paul Collins Startup list [DMISL] Confirmed=N Filename=DMISL.EXE Description=DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information Source=Paul Collins Startup list [DMISLAPP] Confirmed=N Filename=DMISLAPP.exe Description=DMI similar to above Source=Paul Collins Startup list [DM_server] Confirmed=X Filename=dmserver.exe Description=Comet Cursor adware Source=Paul Collins Startup list [Dnar] Confirmed=X Filename=Dnar.exe Description=Unknown, except that it is not necessary. Tends to phone home a lot. DMI related - see here Source=Paul Collins Startup list [DNE Binding Watchdog] Confirmed=Y Filename=rundll dnes.dll, DnDneCheckBindings Description=Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work Source=Paul Collins Startup list [DNE DUN Watchdog] Confirmed=Y Filename=rundll dnes.dll, DnDneCheckDUN13 Description=Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work Source=Paul Collins Startup list [DNS2GoClient] Confirmed=? Filename=dns2goclient.exe Description=DNS2Go is a Domain Name System that will make your computer accessible anytime, anywhere by associating a domain name of your choice to your currently assigned IP address. Is it required? Source=Paul Collins Startup list [DNXVC] Confirmed=? Filename=dnxvc.exe Description=?? Source=Paul Collins Startup list [DocTor] Confirmed=X Filename=Doctor.exe Description=Added as a result of the DOTOR VIRUS! Source=Paul Collins Startup list [DocuMagix Init] Confirmed=N Filename=PWATCH.EXE Description=PaperMaster is an application for the PC designed to automate the process of organizing, archiving, and retrieving digital versions of files. Start manually if needed Source=Paul Collins Startup list [DOGStart] Confirmed=X Filename=GSDOGST.EXE Description=Added as a result of an unidentified VIRUS! A possibility is a trojan known as PENIS Source=Paul Collins Startup list [Doing] Confirmed=? Filename=doing.exe Description=?? Source=Paul Collins Startup list [Don't Panic] Confirmed=U Filename=dontpanicdemodp.exe Description=30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite." Source=Paul Collins Startup list [Don't Panic Pop-Up Stopper] Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [Dosbat] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [DoUWantIt] Confirmed=N Filename=duwi.exe Description=DoUWantIt - online shopping assistant. Start it manually Source=Paul Collins Startup list [Download Accelerator Plus 5.0] Confirmed=N Filename=DAP.exe Description=Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is "adware" based Source=Paul Collins Startup list [Download Plus] Confirmed=X Filename=DownloadPlus.exe Description=DownloadPlus parasite - opens pop-up adverts Source=Paul Collins Startup list [Download Wonder] Confirmed=N Filename=DownloadWonder.exe Description=Download Wonder from Forty Software. Download manager for resuming downloads, amongst other features Source=Paul Collins Startup list [DownloadWare] Confirmed=X Filename=dw.exe Description=DownloadWare - executes arbitrary code from advertisers and not considered to be adware but is a security risk (see here). If a network connection is available it will connect to its servers, which can direct it to download and install software from advertisers. Installed along with programs such as MovieNetworks, Medialoads and PAgent Source=Paul Collins Startup list [DownloadWare Engine] Confirmed=X Filename=Dwe.exe Description=DownloadWare - executes arbitrary code from advertisers and not considered to be adware but is a security risk (see here). If a network connection is available it will connect to its servers, which can direct it to download and install software from advertisers. Installed along with programs such as MovieNetworks, Medialoads and PAgent Source=Paul Collins Startup list [DPAgnt] Confirmed=N Filename=DPAgnt.exe Description=digitalPersona fingerprint scanner Source=Paul Collins Startup list [Dpcnav] Confirmed=Y Filename=dpcnav.exe Description=DirecWay from DirectTV satellite based high-speed internet access Source=Paul Collins Startup list [DPCProxyLoadOnStartup] Confirmed=Y Filename=dpcstart.exe Description=DirecWay from DirectTV satellite based high-speed internet access Source=Paul Collins Startup list [Dpcstart] Confirmed=Y Filename=dpcstart.exe Description=DirecWay from DirectTV satellite based high-speed internet access. Proxy software Source=Paul Collins Startup list [dpi] Confirmed=X Filename=dpi.exe Description=Adware based media viewer by The Delfin Project Source=Paul Collins Startup list [dpps2] Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [Drag'n'Drop_Autolaunch] Confirmed=N Filename=Autolaunch.exe Description=Iomega HotBurn - CD-RW burning software Source=Paul Collins Startup list [DragDrop] Confirmed=? Filename=DragDrop.exe Description=?? Source=Paul Collins Startup list [dregfix] Confirmed=? Filename=ph_finder.exe Description=?? Source=Paul Collins Startup list [dried.exe] Confirmed=? Filename=dried.exe Description=?? Source=Paul Collins Startup list [DriveLED] Confirmed=N Filename=OODLed.exe Description=O&O DriveLED - displays your HDD LED on your monitor. Start manually Source=Paul Collins Startup list [Driver] Confirmed=X Filename=gbot.exe Description=Added as a result of the JUNTADOR.K VIRUS! Source=Paul Collins Startup list [Driver32] Confirmed=X Filename=Scam32.exe Description=Added as a result of the SIRCAM VIRUS! Source=Paul Collins Startup list [DriveSelect] Confirmed=N Filename=driveselect.exe Description=DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs Source=Paul Collins Startup list [dRMON SmartAgent] Confirmed=U Filename=SmartAgt.exe Description=Part of the network monitoring program group for 3Com NIC cards. See here for more info Source=Paul Collins Startup list [drmu] Confirmed=X Filename=W95Mm.exe Description=Homepage hijacker installing a toolbar: http://tdko.com/. Lop.com in disguise. See this thread Source=Paul Collins Startup list [drocher] Confirmed=X Filename=d.exe Description=Adult content dialler Source=Paul Collins Startup list [DrvListnr] Confirmed=? Filename=DrvListnr.exe Description=Analog Devices SoundMAX soundcard related. What does it do and is it required? Source=Paul Collins Startup list [drvlsnr] Confirmed=N Filename=drvlsnr.exe Description=Compaq/ADI SoundMAX integrated digital audio controller related Source=Paul Collins Startup list [drvr32h] Confirmed=X Filename=drvr32h.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [drvrmanager] Confirmed=X Filename=drvrquery32.exe Description=Added as a result of the BOOHOO VIRUS! Source=Paul Collins Startup list [drvupd] Confirmed=X Filename=rundll32 ..drvupd.inf Description=Hijacker - drvupd.inf file installs a "searchforge.com" hijack Source=Paul Collins Startup list [Drwebscheduler] Confirmed=Y Filename=Drwebscd.exe Description=Dr. Web antivirus related - scheduler that allows you to manage an automatic launch of applications, in particular the antivirus scanner or the update subsystem Source=Paul Collins Startup list [DS Clock] Confirmed=U Filename=dsclock.exe Description=Digital desktop clock including synchronization with atomic servers - see here Source=Paul Collins Startup list [dsa] Confirmed=X Filename=dsa.exe Description=Homepage hijacker - redirecting to downseek.com Source=Paul Collins Startup list [DSentry] Confirmed=N Filename=DSentry.exe Description=Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement an anti-spyware service. Run manually before installation starts Source=Paul Collins Startup list [Dsi] Confirmed=X Filename=dp-******.exe Description=Added as a result of unidentified adware where ****** are random characters Source=Paul Collins Startup list [Dskcompat] Confirmed=X Filename=Dskcompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [DSL Monitor] Confirmed=N Filename=spdstrm.exe Description=Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray Source=Paul Collins Startup list [DSLagentexe] Confirmed=Y Filename=DSLagent.exe Description=Used in conjunction with USB connected ADSL modems from Eicon Networks (as used by BT for its Broadband internet service for example). Required for a permanent ADSL connection Source=Paul Collins Startup list [DSS] Confirmed=X Filename=dssagent.exe Description=DSSAgent by Br�derbund - spyware. Sends encrypted emails about the system back to the originators of the program. Also a resource hog. See here for more info Source=Paul Collins Startup list [DSSSGENS] Confirmed=? Filename=dssagens.exe Description=?? Source=Paul Collins Startup list [DU Meter] Confirmed=N Filename=DUMETER.EXE Description=Hagel Technologies internet bandwidth monitor Source=Paul Collins Startup list [dumprep 0 -kordumprep 0 -u] Confirmed=N Filename=dumprep 0 -kdumprep 0 -u Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [DVDBitSet] Confirmed=U Filename=DVDBitSet.exe Description=DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used Source=Paul Collins Startup list [Dvdcompat] Confirmed=X Filename=Dvdcompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [DVDSentry] Confirmed=N Filename=DSentry.exe Description=Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching, they decided to implement an anti-spyware service. Run manually before installation starts Source=Paul Collins Startup list [DVDUpgrade] Confirmed=? Filename=DVDUpgrd.exe Description=?? Source=Paul Collins Startup list [Dvp95] Confirmed=Y Filename=Dvp95.exe Description=Scan engine for F-Secure and Command antivirus software based on the F-Prot AntiVirus engine Source=Paul Collins Startup list [dvpapi9x] Confirmed=Y Filename=DVPAPI9X.exe Description=Command AntiVirus for Windows 95/98/Me Source=Paul Collins Startup list [DvpInitExe] Confirmed=Y Filename=Dvpinit.exe Description=Command Antivirus related Source=Paul Collins Startup list [dvprpt] Confirmed=Y Filename=Dvprpt.exe Description=Command Antivirus real time protection Source=Paul Collins Startup list [DVSync] Confirmed=U Filename=dvsync.exe Description=DVSync is the program that allows you to synchronize your daVinci�s PDA's data with your Personal Information Manager on the PC Source=Paul Collins Startup list [dw] Confirmed=X Filename=dw.exe Description=DownloadWare - executes arbitrary code from advertisers and not considered to be adware but is a security risk (see here). If a network connection is available it will connect to its servers, which can direct it to download and install software from advertisers. Installed along with programs such as MovieNetworks, Medialoads and PAgent Source=Paul Collins Startup list [DwlClient] Confirmed=N Filename=support.exe Description=Download manager for Dell support alerts Source=Paul Collins Startup list [Dx] Confirmed=X Filename=sys#.exe Description=Added as a result of the DEXTER.A VIRUS! where # is a random number Source=Paul Collins Startup list [Dx8compat] Confirmed=X Filename=Dx8compat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [DXDllRegExe] Confirmed=N Filename=dxdllreg.exe Description=Created when you select "Yes" to check the "WHQL Digital signatures" in the DirectX9 files at the first time you open it Source=Paul Collins Startup list [DxLoad] Confirmed=X Filename=DX3DRndr.exe Description=Added as a result of the GIBE.B VIRUS! Source=Paul Collins Startup list [DXM6Patch_981116] Confirmed=N Filename=p_981116.exe Description=Win32 cabinet self extractor. More info here Source=Paul Collins Startup list [Dxsty] Confirmed=X Filename=Dxsty.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Dxupdate.exe] Confirmed=X Filename=Dxupdate.exe Description=Added as a result of the MAFEG VIRUS! Source=Paul Collins Startup list [DyFuCA] Confirmed=X Filename=optimize.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [DyFuCA Active Alert] Confirmed=X Filename=actalert.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [DZKillMe] Confirmed=? Filename=DZSAVEME.EXE Description=?? Source=Paul Collins Startup list [E-Card] Confirmed=X Filename=ecard.exe Description=Added as a result of the YODI VIRUS! Source=Paul Collins Startup list [E-color] Confirmed=U Filename=IconMgr.Exe Description=Sets the colour of your monitor when running games that regognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program Source=Paul Collins Startup list [E6TaskPanel] Confirmed=N Filename=TaskPanl.exe Description=Earthlink Task Panel - part of Earthlink TotalAccess 2003 internet access software. Quick access to internet, E-mail and web-space Source=Paul Collins Startup list [eabconfg.cpl] Confirmed=U Filename=EabServr.exe Description=Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys Source=Paul Collins Startup list [Eac Download] Confirmed=X Filename=download.exe Description=Associated with Webcelerator - spyware. Read eAcceleration's privacy statement here Source=Paul Collins Startup list [EACLEAN] Confirmed=U Filename=eaclean.exe Description=For Compaq PC's. Easy Access button support for the keyboard Source=Paul Collins Startup list [Eac_Cnry] Confirmed=X Filename=canary.exe Description=Added as a result of the CANARY VIRUS! Source=Paul Collins Startup list [Eac_rnvdl] Confirmed=? Filename=ANTIVIRUS_INSTALL.EXE Description=?? Source=Paul Collins Startup list [EanthologyApp] Confirmed=X Filename=EANTHO~1.EXE Description=Stop-Sign from eAccelerration. Detects spyware, malware, viruses and keyloggers and stops popups. Spyware itself - read their privacy statement here Source=Paul Collins Startup list [Eapcisetup] Confirmed=N Filename=sbsetup.exe Description=Rockwell RipTide soundcard application software. Sound works without it Source=Paul Collins Startup list [EAPCISETUP] Confirmed=N Filename=wizard.exe Description=Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation Source=Paul Collins Startup list [EarthLink ToolBar 5.0] Confirmed=N Filename=etoolbar.exe Description=EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar, but you can delete these or add more buttons any time Source=Paul Collins Startup list [Easy Start Button] Confirmed=N Filename=esb.exe Description=Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys Source=Paul Collins Startup list [EasyDates_nl] Confirmed=X Filename=EasyDates_nl.exe Description=Adult content dialler Source=Paul Collins Startup list [EasyKeyorEasy Key] Confirmed=U Filename=easykey.exe Description=For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used Source=Paul Collins Startup list [easyServ] Confirmed=X Filename=Server.exe Description=Added as a result of the EASYSERV VIRUS! Source=Paul Collins Startup list [EasySync Pro] Confirmed=U Filename=XCPCMenu.exe Description=EasySync Pro is a Lotus program for synchronizing a PDA with Lotus Notes Source=Paul Collins Startup list [EasyTuneIII] Confirmed=U Filename=EasyTune.exe Description=Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Source=Paul Collins Startup list [EasyTuneIV] Confirmed=U Filename=ET4Tray.exe Description=Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available Source=Paul Collins Startup list [easywww] Confirmed=X Filename=easywww2.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [EbatesMoeMoneyMaker] Confirmed=N Filename=wjview ...Code Description=Ebates is a website that provides discounts from purchases from many websites. Discounts are automatic if on the Ebates listing. Discounts are paid in cash quarterly Source=Paul Collins Startup list [eBay Toolbar] Confirmed=X Filename=EBAYTBAR.EXE Description=eBay Toolbar - reportes as spyware as it "phones home" Source=Paul Collins Startup list [eBoardoreMachines eBoard] Confirmed=U Filename=Eboard.exe Description=eMachines multimedia keyboard manager. Required if you use the extra keys Source=Paul Collins Startup list [eBot] Confirmed=N Filename=DownloadWizard.exe Description=eBot from Digital River - "helps ensure your computer always has the latest technology, fixes, add-ons, upgrades and 'cool stuff'." Can optionally be installed with software such as Net Nanny internet filtering software. Available via Start -> Programs Source=Paul Collins Startup list [ecpe] Confirmed=? Filename=ECPE.EXE Description=?? Source=Paul Collins Startup list [edexter] Confirmed=? Filename=edexter.exe Description=?? Source=Paul Collins Startup list [editpad] Confirmed=X Filename=editpad.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [editpad] Confirmed=X Filename=editpad.exe Description=CoolWebSearch parasite variant. Note! - this is not related to any utility that might bear the same name and resides in the C:\\Winnt or C:\\Windows directory Source=Paul Collins Startup list [EDLoader] Confirmed=N Filename=DTLoader.exe Description=Effective Desktop from MiniStars Software - desktop management software no longer being supported Source=Paul Collins Startup list [EDRestore] Confirmed=U Filename=?? Description=Set Point from Easy Desk Software - "small utility that automatically sets System Restore points for WinME/XP" Source=Paul Collins Startup list [Edwizard] Confirmed=U Filename=Edwizard.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [eFax.com Tray Menu] Confirmed=N Filename=HotTray.exe Description=eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Source=Paul Collins Startup list [efaxs lptt01orefaxs ml097e] Confirmed=X Filename=efaxs.exe Description=Variant of the RapidBlaster parasite (in an "efaxs" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Efpap.exe] Confirmed=U Filename=Efpap.exe Description=Easy File & Folder Protector. Deny access to certain files and folders, or to hide them securely from viewing and searching Source=Paul Collins Startup list [ehTray] Confirmed=? Filename=ehtray.exe Description=eHome Media Center PC related - what does it do and is it required? Source=Paul Collins Startup list [Eicon NetworksLAN_DAEMONorEicon TechnologyLAN_DAEMON] Confirmed=U Filename=watch.exe Description=Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually Source=Paul Collins Startup list [eixfi] Confirmed=X Filename=china.bat Description=Added as a result of the WCUP VIRUS! Source=Paul Collins Startup list [Elbycheck] Confirmed=U Filename=ElbyCheck.exe Description=From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it Source=Paul Collins Startup list [Element] Confirmed=X Filename=Element.txt Description=Added as a result of the ELEM VIRUS! Source=Paul Collins Startup list [elm] Confirmed=N Filename=Elmenv.exe Description=ViaTech eLicense for securing, distributing and selling music online Source=Paul Collins Startup list [ELSA WINman Suite] Confirmed=U Filename=Winmsuit.exe Description=Allows you to totally customize your ELSA graphics card settings, including overclocking the GPU Source=Paul Collins Startup list [ElsaCapiCtl] Confirmed=Y Filename=Rcapi.exe Description=Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there you can not bring up the dialog box which is sometimes needed to reset the modem Source=Paul Collins Startup list [ELSAChipGuard] Confirmed=U Filename=elsavect.exe Description=ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed, and will halt the system if either are at dangerous levels and restore the default clock speeds upon reboot. Leave enabled if overclocking Source=Paul Collins Startup list [EMA.exe] Confirmed=N Filename=EMA.EXE Description=Time management system which helps you to manage your time and appointments Source=Paul Collins Startup list [eMailEncryption] Confirmed=X Filename=VELOZSYS.EXE Description=eAcceleration Stop-Sign related - foistware. Read their privacy statement here Source=Paul Collins Startup list [emsw.exe] Confirmed=X Filename=emsw.exe Description=Believed to be spyware - made by a company called Alset. Also known as "HelpExpress". Will install itself if you have previously had Attune by Aveo installed as they're by the same company. Uninstall via Add/Remove programs Source=Paul Collins Startup list [EM_EXEC] Confirmed=U Filename=EM_EXEC.EXE Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [EN4060C Taskbar] Confirmed=N Filename=en4060ct.exe Description=Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray Source=Paul Collins Startup list [encapsulated command tool] Confirmed=? Filename=wintr.com Description=?? Source=Paul Collins Startup list [Encarta Dictionary Quickshelf] Confirmed=N Filename=QSHLFED.EXE Description=Provides quick access to Encarta's Dictionary features? Source=Paul Collins Startup list [ENCMONITOR] Confirmed=N Filename=monitor.exe Description=The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it Source=Paul Collins Startup list [Encoder Agent] Confirmed=N Filename=WMENCAGT.EXE Description=MS Windows Media Encoder, which already has a shortcut in the Start Menu if installed Source=Paul Collins Startup list [Encompass_ENCMONTR] Confirmed=U Filename=ENCMONTR.EXE Description=Optional simple browser from Yahoo (Encompass) Source=Paul Collins Startup list [ENCSurf] Confirmed=? Filename=surfboard.exe Description=?? Source=Paul Collins Startup list [EngUtil] Confirmed=Y Filename=EngUtil.exe Description=Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking Source=Paul Collins Startup list [ENSApServer2_0] Confirmed=? Filename=APSERVER.EXE Description=Intel AnyPoint Wireless II Home Network related. What does it do and is it required? Source=Paul Collins Startup list [ENSMIX32.EXE] Confirmed=? Filename=ENSMIX32.EXE Description=Sound card driver. Is it required? Source=Paul Collins Startup list [EnsoniqMixer] Confirmed=U Filename=starter.exe Description=Puts the Ensoniq mixer in system tray. From Ensoniq Technologies "Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility Source=Paul Collins Startup list [Enumerate Service] Confirmed=X Filename=wsys.exe Description=Added as a result of the MANIFEST VIRUS! Source=Paul Collins Startup list [eonemng] Confirmed=U Filename=eOneMng.exe Description=eOne Manager, provides access to the buttons on the keyboard and on the front of the console for the eMachines eOne PC Source=Paul Collins Startup list [ePrompter] Confirmed=U Filename=ePrompter.exe Description=ePrompter - E-mail notification software Source=Paul Collins Startup list [EPSON Background Monitor] Confirmed=N Filename=STMS.EXE Description=Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not Source=Paul Collins Startup list [EPSON CardMonitor] Confirmed=U Filename=EPSON CardMonitor1.0.exe Description=Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint Source=Paul Collins Startup list [EPSON Status Monitor 3 Environment CheckorEPSON Status Monitor 3 Environment Check 2] Confirmed=N Filename=e_srcv03.exee_srcv02.exe Description=According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check Source=Paul Collins Startup list [Epson Stylus C62 Series] Confirmed=U Filename=E-S0BIC1.EXE Description=Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Source=Paul Collins Startup list [Epson Stylus C82 Series] Confirmed=U Filename=e_s0hic1.EXE Description=Required for an interface to some versions of MS Word to ensure that some fonts are printed correctly. Start it manually if required Source=Paul Collins Startup list [EpsonPhotoStarter] Confirmed=U Filename=EPSON_PhotoStarter.exe Description=Only needed if you want to make full use of the capabilities of an Epson printer that included this Source=Paul Collins Startup list [Equipmen] Confirmed=? Filename=Equipmen.exe Description=?? Source=Paul Collins Startup list [EReg] Confirmed=N Filename=reg32.exe Description=EReg is a software registration tool incorporated on products such as those by Br�derbund, Connectix, Hewlett-Packard, The Learning Company, and Sierra. Needless to say you don't need it Source=Paul Collins Startup list [erm] Confirmed=? Filename=erm.exe Description=?? Source=Paul Collins Startup list [eros.exe] Confirmed=X Filename=eros.exe Description=Adult content dailler Source=Paul Collins Startup list [eSafe Protect] Confirmed=Y Filename=ESPWatch.exe Description=eSafe from Aladdin - internet security for gateway and E-mail servers Source=Paul Collins Startup list [ESB] Confirmed=U Filename=esb.exe Description=Easy Start Button - provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys Source=Paul Collins Startup list [eScan Monitor] Confirmed=Y Filename=AVKWCTL9X.EXE Description=eScan antivirus Source=Paul Collins Startup list [eScan Scheduler] Confirmed=U Filename=avkserv.exe Description=eScan antivirus scheduler Source=Paul Collins Startup list [eScan Updater] Confirmed=U Filename=Trayicos.exe Description=eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads Source=Paul Collins Startup list [EScorcher] Confirmed=X Filename=escorcher.exe Description=Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead Source=Paul Collins Startup list [ESFTP] Confirmed=N Filename=esftp.exe Description=ESftp - FTP client for transfering files between a local PC and another remote computer Source=Paul Collins Startup list [ESS Daemon] Confirmed=? Filename=Essd.exe Description=Related to an ESS based soundacard. Is it required? Source=Paul Collins Startup list [essapm] Confirmed=? Filename=essapm.exe Description=ESS Solo soundcard driver. Is it required? Source=Paul Collins Startup list [Essdc] Confirmed=Y Filename=essdc.exe Description=Related to an ESS Solo soundcard. Seems as though it's required Source=Paul Collins Startup list [ESSNDSYS] Confirmed=? Filename=ESSNDSYS.EXE Description=Related to an ESS based soundacard. Is it required? Source=Paul Collins Startup list [ESSOLO] Confirmed=Y Filename=ESSOLO.exe Description=Sound card driver that re-instates itself every time it's removed Source=Paul Collins Startup list [esspk] Confirmed=Y Filename=esspk.exe Description=ESS Technology modem speaker driver file. Required to get on-line with this modem Source=Paul Collins Startup list [EssSpkPhone] Confirmed=U Filename=essspk.exe Description=ESS Technologies Call waiting, which gets installed by the drivers for V92 modems based on ESS Technologies chipsets Source=Paul Collins Startup list [Ethernet] Confirmed=N Filename=tcaudiag.exe Description=3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs Source=Paul Collins Startup list [Etraffic] Confirmed=X Filename=JavaRun.exe Description=Marketing software from TopMoxie Source=Paul Collins Startup list [eTrust EZ Firewall] Confirmed=Y Filename=efpeadm.exe Description=eTrust EZ Firewall Source=Paul Collins Startup list [eTrustCIPE] Confirmed=Y Filename=ezdsmain.exe Description=eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior Source=Paul Collins Startup list [EuroGlot] Confirmed=U Filename=EuroGlot.exe Description=Euroglot - "multilanguage translating system, available in the languages Dutch, English, French, German, Spanish and Italian" Source=Paul Collins Startup list [Event Log] Confirmed=? Filename=eventlog.exe Description=?? Source=Paul Collins Startup list [Event Planner Reminders] Confirmed=N Filename=PLNRnote.exe Description=Sierra Event Planner tray icon Source=Paul Collins Startup list [Event Reminder] Confirmed=N Filename=pmremind.exe Description=A calendar/alarm program that installs with Br�derbund Printmaster Source=Paul Collins Startup list [EVENTLISTENER] Confirmed=U Filename=EvLstnr.exe Description=Used with a Nikon digital camera to recognize when the camera is plugged in Source=Paul Collins Startup list [eventmgr] Confirmed=N Filename=eventmgr.exe Description=Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs Source=Paul Collins Startup list [Evidence Eliminator] Confirmed=N Filename=ee.exe Description=Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis Source=Paul Collins Startup list [evntsvc] Confirmed=N Filename=evntsc.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. Not required - see here for more information, including how to disable it Source=Paul Collins Startup list [EW Message Server] Confirmed=U Filename=msg32.exe Description=Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices Source=Paul Collins Startup list [eWare Startup] Confirmed=N Filename=iWareStart.exe Description=eWare iWare task bar. Not required Source=Paul Collins Startup list [Excite Platform] Confirmed=N Filename=Exlaunch.exe Description=Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer Source=Paul Collins Startup list [Excite Private Messenger Pipe] Confirmed=? Filename=x8impipe.exe Description=?? Source=Paul Collins Startup list [ExciteAssistantEXE] Confirmed=N Filename=ASSISTANT.EXE Description=With Excite Assistant, you can access a wide variety of online information, including email, news, and stock quotes without having to have a browser window open Source=Paul Collins Startup list [exe lptt01orexe ml097e] Confirmed=X Filename=exe.exe Description=Variant of the RapidBlaster parasite (in an "Exe" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [execfg4] Confirmed=X Filename=execfg4.exe Description=Added as a result of the ELECTRON VIRUS! Source=Paul Collins Startup list [Execute] Confirmed=? Filename=delfolders.exe Description=?? Source=Paul Collins Startup list [ExeName32] Confirmed=X Filename=Warm.scr Description=Added as a result of the SCOLD VIRUS! Source=Paul Collins Startup list [Exif Launcher] Confirmed=U Filename=Exiflaquickdcr.exeQuickDCF.exe Description=USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly Source=Paul Collins Startup list [ExitKiller] Confirmed=U Filename=Ekiller.exe Description=Exit Killer - automatically closes pop-up windows in your browser Source=Paul Collins Startup list [exmon] Confirmed=? Filename=hpimoniter.exe Description=Some kind of hp digital camera maybe or a photo smart connection probe? Source=Paul Collins Startup list [Explkw] Confirmed=X Filename=expup.exe Description=Keywords hijacker Source=Paul Collins Startup list [explore] Confirmed=X Filename=explore.exe Description=Added as a result of the NETBUS, HAWAWI and other VIRUSES! Source=Paul Collins Startup list [Explore] Confirmed=X Filename=Explorer.exe Description=Added as a result of the IRC.FLOOD.G VIRUS! Note - this is not the valid Windows "explorer.exe" Source=Paul Collins Startup list [Explore] Confirmed=X Filename=explore.exe Description=Adult content dialler Source=Paul Collins Startup list [explore.exe] Confirmed=X Filename=Explore.exe Description=Added as a result of the GRAYBIRD.G VIRUS! Source=Paul Collins Startup list [explorer] Confirmed=U Filename=explorer.exe Description=Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL Source=Paul Collins Startup list [explorer] Confirmed=X Filename=wscript.exe Description=Sneaky way to start any VBS script. Many viruses use VBS files Source=Paul Collins Startup list [Explorer] Confirmed=X Filename=shellexpl.exe Description=Added as a result of the GPIX and SHELDOR VIRUSES! Source=Paul Collins Startup list [explorer] Confirmed=X Filename=expl32.exe Description=Added as a result of the RATSOU VIRUS! Source=Paul Collins Startup list [Explorer] Confirmed=X Filename= Description=Added as a result of the AUTEX VIRUS! Source=Paul Collins Startup list [Explorer lptt01orExplorer ml097e] Confirmed=X Filename=explorer.exe Description=Variant of the RapidBlaster parasite (in an "explorer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Windows Explorer which has the same executable name Source=Paul Collins Startup list [Explorer32] Confirmed=X Filename=Expl32.exe Description=Added as a result of the HACKTACK VIRUS! Source=Paul Collins Startup list [Exshow95] Confirmed=U Filename=EXSHOW95.exe Description=Support software for some of the Kensington mice. Provides access to extra features like those available with enhanced Logitech and MS devices Source=Paul Collins Startup list [ExtraDNS] Confirmed=U Filename=ExtraDNS.exe Description=ExtraDNS - DNS configuration tool Source=Paul Collins Startup list [Extranet AutoDial] Confirmed=? Filename=AutoExt.exe Description=Nortel Networks Contivity Extranet Switching Software Source=Paul Collins Startup list [Eye Tide Launcher] Confirmed=N Filename=oneeyetideone.exe Description=Nascar wallpaper Source=Paul Collins Startup list [ezagent] Confirmed=N Filename=ezagent.exe Description=EzVCR recording software for the ASUS TV FM card. Available via Start -> Programs Source=Paul Collins Startup list [EZDesk] Confirmed=N Filename=EZDESK.EXE Description=Utility that remembers icon locations for each user and resolution. Available here Source=Paul Collins Startup list [EzEjMnAp] Confirmed=N Filename=EzEjMnAp.exe Description=For IBM Thinkpad Notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually". Available via Start -> Programs Source=Paul Collins Startup list [eZmmod] Confirmed=X Filename=mmod.exe Description=Ezula - regarded as spyware/theftware and bundled with the popular iMesh and KaZaA file-sharing programs. Read here for more information Source=Paul Collins Startup list [EZNORUN] Confirmed=? Filename=EZNORUN.EXE Description=Easy Internet related? Source=Paul Collins Startup list [ezShieldProtector for PxorezPS_Px] Confirmed=Y Filename=ezSP_Px.exeezSP_PxEngine.exe Description=Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings Source=Paul Collins Startup list [EZSMART App] Confirmed=U Filename=ezsmart.exe Description=EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported Source=Paul Collins Startup list [ezula] Confirmed=X Filename=eZmmod.exe Description=Regarded as spyware/theftware and bundled with the popular iMesh and KaZaA file-sharing programs. Read here for more information Source=Paul Collins Startup list [eZulaMain] Confirmed=X Filename=eZulaMain.exe Description=Ezula - regarded as spyware/theftware and bundled with the popular iMesh and KaZaA file-sharing programs. Read here for more information Source=Paul Collins Startup list [eZuluMain] Confirmed=X Filename=eZuluMain.exe Description=Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work Source=Paul Collins Startup list [E_S10IC2] Confirmed=U Filename=E_S10IC2.exe Description=Epson Stylus printer monitor - for checking ink levels, etc. Source=Paul Collins Startup list [E_S23] Confirmed=U Filename=E_SICN03.exe Description=Epson printer status monitor - for checking ink levels, etc. Source=Paul Collins Startup list [E_SOEIC1] Confirmed=U Filename=E_SOEIC1.exe Description=Epson Stylus printer monitor - for checking ink levels, etc. Source=Paul Collins Startup list [F-Secure Management Agent] Confirmed=U Filename=FSMA32.EXE Description=F-Secure Antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products Source=Paul Collins Startup list [F-Secure Manager] Confirmed=Y Filename=FSM32.EXE Description=F-Secure Antivirus - carry out scheduled virus scans automatically Source=Paul Collins Startup list [F-StopW] Confirmed=Y Filename=F-StopW.exe Description=F-Prot anti-virus background scanner by F-Risk Software Source=Paul Collins Startup list [f607] Confirmed=X Filename=f607.exe Description=Added as a result of the URAT.B VIRUS! Source=Paul Collins Startup list [FamilyKeyLogger] Confirmed=U Filename=cisvc.exe Description="Family Keylogger - is your best choice, if you want to know what other users on your machine are typing". Note! - this is not the cisvc.exe service. Source=Paul Collins Startup list [fapmon] Confirmed=? Filename=fapmon.exe Description=Fair Access Policy monitor for DirecPC/DirecWay internet access Source=Paul Collins Startup list [FastCache] Confirmed=U Filename=fc.exe Description=FastCache from AnalogX - speeds up browsing by resolving DNS requests locally Source=Paul Collins Startup list [FastTrack Accelerator] Confirmed=N Filename=SPEED UP.EXE Description=FastTrack Accelerator - "speedup" utility for programs that use the FastTrack network such as KaZaA Media Desktop, Grokster and Morpheus Source=Paul Collins Startup list [FastUsrorfast] Confirmed=N Filename=fast.exe Description=Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys Source=Paul Collins Startup list [FatPipe] Confirmed=U Filename=DHCP Description=Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users Source=Paul Collins Startup list [Fatpipe Dialer] Confirmed=U Filename=fpdialer.exe Description=See above Source=Paul Collins Startup list [FBDirect] Confirmed=U Filename=FBDirect.exe Description=Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs Source=Paul Collins Startup list [FBI] Confirmed=? Filename=FBISM.exe Description=Compaq related but what does it do? Source=Paul Collins Startup list [fc] Confirmed=X Filename=runfc.exe Description=Added as a result of the CAMPURF VIRUS! Source=Paul Collins Startup list [FD_SAP] Confirmed=? Filename=FD.exe Description=Genicom SAP Printer driver. Is it required? Source=Paul Collins Startup list [FEELitDeviceManager] Confirmed=U Filename=feelitdm.exe Description=Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals) Source=Paul Collins Startup list [fegoze] Confirmed=X Filename=SVCH0ST.EXE Description=Added as a result of the GRAYBIRD.D VIRUS! Source=Paul Collins Startup list [Fellowes Proxy] Confirmed=U Filename=R3proxy.exe Description=Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice Source=Paul Collins Startup list [FG1_00] Confirmed=U Filename=frntgate.exe Description=FrontGate MX - e-mail spam blocker Source=Paul Collins Startup list [Fhtisxk] Confirmed=U Filename=fhtisxk.exe Description=XtraKeys - keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove via Spybot S&D (for example) Source=Paul Collins Startup list [file indexing service] Confirmed=? Filename=msfindfile.exe Description=New version of MS FindFast and still a resource hog? Source=Paul Collins Startup list [FileFreedom_Plugin] Confirmed=N Filename=wtm.exe Description=FileFreedom peer-to-peer sharing program Source=Paul Collins Startup list [FileManager32] Confirmed=X Filename=Wscript.exe ..ChkMgr32.vbs Description=Added as a result of the NOTUP.A VIRUS! Source=Paul Collins Startup list [FileSoft] Confirmed=X Filename=Wscript.exe UpdataFiles.vbs Description=Added as a result of the SST.B VIRUS! Source=Paul Collins Startup list [FilterGate] Confirmed=U Filename=filtergate.exe Description=Filtergate internet filtering software - filters sounds, popup ads, background sound and other unnecessary website items Source=Paul Collins Startup list [Filterguard] Confirmed=U Filename=Filtrgrd.exe Description=An icon located in the lower left of the screen and looks like a lifesaver. This icon is a �short-cut� to access the basic features of SOS-Guardian, SOS-KidProof Lite, SOS Best Defense and SOS Pro such as Internet filtering utility. You can access this menu by �right-clicking� on the icon Source=Paul Collins Startup list [Find Fast] Confirmed=X Filename=Findfast.exe Description=Complete utter waste of space! Part of MS Office - searches disk drives for Office file types to make opening them easier Source=Paul Collins Startup list [Find Virus Launch Program] Confirmed=Y Filename=fvlaunch.exe Description=Part of Dr. Solomon's Antivirus Source=Paul Collins Startup list [FinePrint Dispatcher vx] Confirmed=N Filename=FPDISPxA.EXE Description=FinePrint - virtual printer for use with any printer. Search for "dispatcher" here for more information. If removed, it will re-install when program is run - hence the Y recommendation Source=Paul Collins Startup list [Fix-it] Confirmed=Y Filename=mxtask.exe Description=Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard, intellicluster, anti-virus, or autoupdater. Otherwise not required Source=Paul Collins Startup list [Fix-it AV] Confirmed=Y Filename=memcheck.exe Description=Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources Source=Paul Collins Startup list [FLASH32] Confirmed=? Filename=-flash32.exe Description=?? Source=Paul Collins Startup list [FlashPath StatusorFlashPath Monitor] Confirmed=N Filename=SDSTAT.EXEFLSHSTAT.EXE Description=System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs Source=Paul Collins Startup list [Flexicd] Confirmed=U Filename=Flexicd.exe Description=CD player - part of the Win95 Power Toys Source=Paul Collins Startup list [FLMTRUSTKB] Confirmed=? Filename=KbdAp32A.exe Description=Keyboard utility for a Trust brand keyboard. What does it do and is it required? Source=Paul Collins Startup list [FLMTRUSTMOUSE] Confirmed=? Filename=mouse32a.exe Description=Mouse utility for a Trust brand mouse. What does it do and is it required? Source=Paul Collins Startup list [FLooDNeT] Confirmed=X Filename=FLooDeR.exe Description=Added as a result of the FLOODNET VIRUS! Source=Paul Collins Startup list [Flow Go TV] Confirmed=? Filename=flogotv.exe Description=?? Source=Paul Collins Startup list [flps] Confirmed=X Filename=flps.vbs Description=Added as a result of the BYRON VIRUS! Source=Paul Collins Startup list [FLSVCI] Confirmed=? Filename=FLSVCI.exe Description=?? Source=Paul Collins Startup list [FltProcess] Confirmed=Y Filename=msinet.exe Description=Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done Source=Paul Collins Startup list [FlyswatDesktop] Confirmed=X Filename=flydesk.exe Description=Advertising spyware Source=Paul Collins Startup list [FmctrlTray] Confirmed=U Filename=Fmctrl.EXE Description=Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used) Source=Paul Collins Startup list [fmnwebassist] Confirmed=X Filename=fmnwebassist.exe Description=Adware popup generator Source=Paul Collins Startup list [FMStart] Confirmed=U Filename=Fmstart.exe Description=GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks, allows all users to send and receive faxes right from their desktop Source=Paul Collins Startup list [Focus] Confirmed=? Filename=Focus.exe Description=ISDN configuration wizard? Source=Paul Collins Startup list [Folder Service] Confirmed=X Filename=wssdtu.exe Description=Added as a result of the MANIFEST VIRUS! Source=Paul Collins Startup list [Folding@home] Confirmed=N Filename=WINFAH.EXE Description=Folding@Home is a distributed computing project which studies protein folding, misfolding, aggregation, and related diseases - must be running in order to access the internet to upload to the servers. Available via Start -> Programs Source=Paul Collins Startup list [FoneSyncSystemTray] Confirmed=N Filename=FoneSyncSystemTray.exe Description=System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required Source=Paul Collins Startup list [FontFix] Confirmed=X Filename=fontfix.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [FONTVIEW] Confirmed=X Filename=FONTVIEW.EXE Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [foobin lptt01orfoobin ml097e] Confirmed=X Filename=adaware.exe Description=Variant of the RapidBlaster parasite (in a "foo1" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [FoolProof] Confirmed=Y Filename=fpwinldr.exe Description=FoolProof Security PC security software from SmartStuff Source=Paul Collins Startup list [FoolProofSweep] Confirmed=Y Filename=?? Description=Part of FoolProof Security PC security software from SmartStuff Source=Paul Collins Startup list [Forbes] Confirmed=N Filename=ForbesAlerts.exe Description=Forbes Business News Alerts - displays business news headlines in a little window on the screen Source=Paul Collins Startup list [ForceShow] Confirmed=X Filename=rundll32.exe QaBar.dll, ForceShowBar Description=AdultLinks/QAbar parasite related Source=Paul Collins Startup list [Forget Me Not] Confirmed=N Filename=AGRemind.exe Description=Calendar reminder part of American Greetings� CreataCard� Source=Paul Collins Startup list [FotoStation Easy AutoLaunch] Confirmed=N Filename=FotoStation Easy AutoLaunch.exe Description=Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either Source=Paul Collins Startup list [FourthDay] Confirmed=U Filename=FourthDay.exe Description=The Fourth Day - "astronomical clock and almanac for your system tray" Source=Paul Collins Startup list [FP Loader] Confirmed=Y Filename=loadfp.exe Description=FoolProof Security - PC security software from SmartStuff Source=Paul Collins Startup list [FPWGMWZD] Confirmed=? Filename=FPWGMWZD.exe Description=?? Source=Paul Collins Startup list [Fpx] Confirmed=N Filename=mnmsrvc.exe Description=Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations Source=Paul Collins Startup list [France] Confirmed=X Filename=svchost.exe Description=Added as a result of the MIMAIL.L VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [Free Downloads Monitor] Confirmed=? Filename=fdcmon.exe Description=?? Source=Paul Collins Startup list [Freedom] Confirmed=Y Filename=Freedom.exe Description=Zero Knowledge Freedom - Anti-Virus, Personal Firewall and Parental Control, it also blocks ads, safeguards your personal information, encrypts your passwords, and much more Source=Paul Collins Startup list [FreeMem Pro] Confirmed=U Filename=FMEMPRO.EXE Description=Some users swear by memory management utilities such as FreeMem Pro but others say you don't need them - especially if you have Win98 or WinME. See this article and make up your own mind Source=Paul Collins Startup list [FreeMemVn2] Confirmed=U Filename=FreeMem.exe Description=Some users swear by memory management utilities such as FreeMem but others say you don't need them - especially if you have Win98 or WinME. See this article and make up your own mind Source=Paul Collins Startup list [FreeMP3download] Confirmed=X Filename=rundll32.exe MSA64CHK.DLL, DllMostrar Description=Mostrar adult content dialler Source=Paul Collins Startup list [FreeRAM XP] Confirmed=U Filename=FreeRAM XP Pro x.exe Description=Some users swear by memory management utilities such as FreeRAM XP Pro but others say you don't need them - especially if you have Win98 or WinME. See this article and make up your own mind. "x" indicates the version number Source=Paul Collins Startup list [freesurfer] Confirmed=U Filename=fs20.exe Description=EMS Free Surfer mk II - pop-up stopper Source=Paul Collins Startup list [frguk] Confirmed=? Filename=shdrkmck.exe Description=?? Source=Paul Collins Startup list [FridaysInHellInstaller] Confirmed=? Filename=FridaysInHellInstaller.exe Description=?? Source=Paul Collins Startup list [FriendlyWebQuick-Launch] Confirmed=N Filename=SELFCERT.EXE Description=selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well Source=Paul Collins Startup list [FRISK FP-Scheduler] Confirmed=U Filename=F-Sched.exe Description=Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis Source=Paul Collins Startup list [Fromine WinPopup] Confirmed=N Filename=winpopup.exe Description=Instant Messenger program Source=Paul Collins Startup list [Frsk] Confirmed=X Filename=frsk.exe Description=Unidentified adware downloader trojan Source=Paul Collins Startup list [FRW_EXE] Confirmed=Y Filename=FRW.EXE Description=ConSeal Signal9 firewall - now McAfee Personal firewall Source=Paul Collins Startup list [frxmxins] Confirmed=Y Filename=frxmxins.exe Description=ATI 3D Studio MAX/VIZ driver Source=Paul Collins Startup list [FSDPSRV] Confirmed=? Filename=FSDPSRV.exe Description=?? Source=Paul Collins Startup list [fsg_4104.exe] Confirmed=? Filename=fsg_4104.exe Description=Installed with Kazaa and believed to be Gator adware? Source=Paul Collins Startup list [fsp] Confirmed=U Filename=fsp.exe Description=Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents Source=Paul Collins Startup list [fspr] Confirmed=Y Filename=FolderShield.exe Description=Folder Shield - hide personal files and folders Source=Paul Collins Startup list [FSScrCtl] Confirmed=N Filename=FSScrCtl.exe Description=Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver" Source=Paul Collins Startup list [fsserv] Confirmed=U Filename=fserv.exe Description=Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time Source=Paul Collins Startup list [FSW] Confirmed=X Filename=FSW.exe Description=FreeScratchAndWin parasite Source=Paul Collins Startup list [Ftpqueue] Confirmed=U Filename=Ftpsched.exe Description=Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers Source=Paul Collins Startup list [fwenc.exe] Confirmed=Y Filename=fwenc.exe Description=Check Point SecuRemote VPN client - "dynamic and fixed IP addressing for all ISP services - dial-up, cable modem, or DSL - the ideal solution for telecommuters and mobile workers" Source=Paul Collins Startup list [fwrastrc] Confirmed=N Filename=fwrastrc.exe Description=Dial-up software for Friendly Technologies/1NationOnLine free ISP Source=Paul Collins Startup list [fxredir] Confirmed=U Filename=fxredir.exe Description=Canon MultiPASS fax redirector Source=Paul Collins Startup list [f~a] Confirmed=X Filename=ra32.exe Description=Password stealer trojan Source=Paul Collins Startup list [G00123] Confirmed=X Filename= Description=Added as a result of the BUGBROS VIRUS! Source=Paul Collins Startup list [g3dctl] Confirmed=? Filename=g3dctl.exe Description=?? Source=Paul Collins Startup list [Gadu-Gadu] Confirmed=N Filename=gg.exe Description=Polish language Instant Messaging client Source=Paul Collins Startup list [Gadwin PrintScreen] Confirmed=N Filename=PrintScreen.exe Description=Gadwin PrintScreen - utility to capture, print or save the current window Source=Paul Collins Startup list [Gainward] Confirmed=U Filename=TBPanel.exe Description=Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Game Device] Confirmed=N Filename=JOYUPDRV.EXE Description=Genius game controller profile activator Source=Paul Collins Startup list [GameSpot] Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [gameutil.exe] Confirmed=U Filename=gameutil.exe Description=Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot Source=Paul Collins Startup list [GammaHotKeys] Confirmed=U Filename=setgamma.exe Description=Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop Source=Paul Collins Startup list [Gator] Confirmed=X Filename=gator.exe Description=Spyware - see here for removal instructions Source=Paul Collins Startup list [Gator eWallet] Confirmed=X Filename=gator.exe Description=Gator eWallet from The Gator Corporation. Spyware - see here for removal instructions Source=Paul Collins Startup list [GazelDisplay] Confirmed=U Filename=gsyno.exe Description=BT Digital Access USB - Gazel ISDN installation System Tray icon Source=Paul Collins Startup list [GBTrayorGoBack] Confirmed=U Filename=GBTray.exe Description=System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GCC Reminder] Confirmed=? Filename=gccrem.exe Description=Associated with AcraMax Greeting Card Creator. Is it a registration reminder? Source=Paul Collins Startup list [GCS] Confirmed=N Filename=GrabClipSave.exe Description=GrabClipSave screen capture tool Source=Paul Collins Startup list [GDrive] Confirmed=N Filename=GDriver.exe Description=Found on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager Source=Paul Collins Startup list [Gearbox] Confirmed=N Filename=confsvr.exe Description=NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here Source=Paul Collins Startup list [GEARsec] Confirmed=N Filename=gearsec.exe Description=Installed by Apple Quicktime package - iPod/iTunes CDRW support. Can be disabled if you only require Quicktime player Source=Paul Collins Startup list [GEDZAC] Confirmed=X Filename=GEDZAC.exe Description=Added as a result of the GEMEL VIRUS! Source=Paul Collins Startup list [GemStRmW] Confirmed=N Filename=GemStRmW.exe Description=For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card, start it manually Source=Paul Collins Startup list [general lptt01orgeneral ml097e] Confirmed=X Filename=general.exe Description=Variant of the RapidBlaster parasite (in a "General" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Generic host proccess for windows] Confirmed=X Filename=SVCHOSTS.EXE Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Generic Host Process for Win32 Services] Confirmed=X Filename=ntspcv.exe Description=Added as a result of the SDBOT.S VIRUS! Source=Paul Collins Startup list [Genie USB Monitor] Confirmed=Y Filename=USBmonitor.exe Description=Port monitor for an external USB hard drive. Required to enable access to the drive Source=Paul Collins Startup list [Get Smile] Confirmed=N Filename=getsmile.exe Description=Puts smilie faces in your E-mail. Run manually when required Source=Paul Collins Startup list [GetRight Tray Icon] Confirmed=N Filename=GETRIGHT.EXE Description=GetRight from Headlight Software - download manager for resuming downloads and choosing multiple download locations. The freeware version is/was spyware. The registered version isn't if you don't install the Aureate/Radiate software. Available via Start -> Programs Source=Paul Collins Startup list [GhostStartService] Confirmed=N Filename=GhostStartService.exe Description=Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard Source=Paul Collins Startup list [GhostStartTrayApp] Confirmed=N Filename=GhostStartTrayApp.exe Description=System Tray access to Norton Ghost - added from the 2003 version Source=Paul Collins Startup list [Gilat SOM Enumerator] Confirmed=Y Filename=dllhost.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [GilatFTC] Confirmed=Y Filename=ftc.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [GisdnLog] Confirmed=? Filename=gisdnlog.exe Description=BT Digital Access USB Source=Paul Collins Startup list [Glass2k] Confirmed=U Filename=Glass2k.exe Description="Glass2k is a small little program that allows Win2K/XP users to make any window transparent" Source=Paul Collins Startup list [Glide] Confirmed=Y Filename=Glidew32.exe Description=Cirque touchpad driver Source=Paul Collins Startup list [GLSetIT32] Confirmed=X Filename=msiexec16.exe Description=Added as a result of the OPTIX PRO series of VIRUSES! Source=Paul Collins Startup list [GLSetIT32] Confirmed=X Filename=isass.exe Description=Added as a result of a variant of the OPTIX PRO series of VIRUSES! Source=Paul Collins Startup list [gluon] Confirmed=? Filename=gluon.exe Description=In a gluon/bin sub-directory Source=Paul Collins Startup list [Gmouse] Confirmed=Y Filename=Gmouse.exe Description=Amouse mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Gnetmous] Confirmed=U Filename=gnetmous.exe Description=Genius NetScroll+ mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [gnub] Confirmed=? Filename=gnub.exe Description=?? Source=Paul Collins Startup list [Go!Zilla] Confirmed=X Filename=gozilla.exe Description=A variant for the Go!Zilla download manager, see above Source=Paul Collins Startup list [Go!Zilla Monster Downloads] Confirmed=X Filename=Go.exe Description=Download manager for resuming downloads and choosing multiple download locations. Advertising spyware Source=Paul Collins Startup list [GoBack] Confirmed=U Filename=GBMenu.exe Description=Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GoBack Polling Service] Confirmed=U Filename=GBPoll.exe Description=Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users, recommended for Win9x/NT/2K users Source=Paul Collins Startup list [GoBack Tray Icon] Confirmed=U Filename=GBTray.exe Description=System Tray icon access to GoBack (above) Source=Paul Collins Startup list [Goldensoft_MndlSvr] Confirmed=U Filename=MndlSvr.exe Description=Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200X for true multitasking Source=Paul Collins Startup list [GoogleDCClient] Confirmed=N Filename=GoogleDCC.exe Description=Google Compute Client - only present if you installed the Google Toolbar with "Google Compute" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser, click on the little double-helix on the Google Toolbar, and click "Stop Computing" Source=Paul Collins Startup list [GoToMyPC] Confirmed=U Filename=g2svc.exe Description=ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser Source=Paul Collins Startup list [GRA] Confirmed=N Filename=gra.exe Description=Looks at system resources at startup and warns you if they have dropped. Contains links to the Disk Clean Up, Defrag and Start Up Menu. It does have a link to a startup configuration utility. Similar to msconfig but can keep a list of disabled apps. Not really necessary. Only appears if you load the Gateway Startup Utility Source=Paul Collins Startup list [Gravis Appawareloader] Confirmed=U Filename=dbserver.exe Description=Looks like it's associated with Gravis game controllers and the Keyset Manager, allowing the user to program the buttons for games that don't support them Source=Paul Collins Startup list [Gravis Xperience Driver Support] Confirmed=U Filename=Grxp4exe.exe Description=Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used Source=Paul Collins Startup list [GrdSys32] Confirmed=? Filename=GrdSys32.exe Description=X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand? Source=Paul Collins Startup list [Greetings Workshop] Confirmed=N Filename=GWREMIND.EXE Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [gremier] Confirmed=X Filename=wscript.exe gpremier.vbs Description=Added as a result of the GPREMIER VIRUS! Source=Paul Collins Startup list [Gremlin] Confirmed=X Filename=intrenat.exe Description=Added as a result of the DOOMJUICE VIRUS! Source=Paul Collins Startup list [GrpConv] Confirmed=N Filename=grpconv.exe Description=To facilitate the upgrade from Windows 3.1 to Win95/98, an executable file named GRPCONV.EXE is included with Win95/98. This file provides the translation of groups and group items to folders and links unless you need to access Win 3.1 Group files Source=Paul Collins Startup list [Gscbc] Confirmed=? Filename=Gscbc.exe Description=?? Source=Paul Collins Startup list [gshp] Confirmed=X Filename=zzgshp.vbs Description=Homepage hi-jacker Source=Paul Collins Startup list [Gsiconexe] Confirmed=N Filename=Gsicon.exe Description=ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities Source=Paul Collins Startup list [GSOrganizer] Confirmed=N Filename=GSOrganizer.exe Description=GoldenSection Organizer - personal information manager Source=Paul Collins Startup list [gssomatic] Confirmed=X Filename=gssomatic.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [GStartup] Confirmed=X Filename=GMT.exe Description=Gator spyware variant. See Gator Source=Paul Collins Startup list [Gtwatch] Confirmed=N Filename=gtwatch.exe Description=Associated with a Mustec scanner and not required Source=Paul Collins Startup list [Guardian] Confirmed=N Filename=CMGrdian.exe Description=McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System Mechanic Source=Paul Collins Startup list [GustavVED] Confirmed=X Filename= Description=Added as a result of the OPASERV.H VIRUS! Source=Paul Collins Startup list [gvagfxj] Confirmed=X Filename=rundll32 ...gvagfxj.dll Description=Unidentified adware, spyware or virus Source=Paul Collins Startup list [gw port controller] Confirmed=Y Filename=PORTCT95.EXE Description=From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties, the file is known as "Smart Thru Fax Drive Spy" and is supplied by Samsung Source=Paul Collins Startup list [GWInkMonitor] Confirmed=N Filename=GWInkMonitor.exe Description=Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink, do you want to buy some! Source=Paul Collins Startup list [GWMDMMSG] Confirmed=N Filename=GWMDMMSG.exe Description=Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly Source=Paul Collins Startup list [GWMDMpi] Confirmed=U Filename=GWMDMpi.exe Description=Used with internal modems on Gateway PCs such as the 450SX Notebook. Required for audio settings to be maintained and does not remain in memory once run. See here for more information Source=Paul Collins Startup list [gwum] Confirmed=U Filename=gwum.exe Description=Gigabyte utility manager. Loads if you have a Gigabyte motherboard and got a full bundle of utilities installed. Monitors CPU, fans, BIOS etc. Only used by system "tweakers" Source=Paul Collins Startup list [gyy] Confirmed=? Filename=gyy.exe Description=Possibly Gator (and therefore spyware) related? Source=Paul Collins Startup list [H/PC Connection Agent] Confirmed=U Filename=WCESCOMM.EXE Description=Active sync for use with Windows CE based palm PC Source=Paul Collins Startup list [HalifaxHowardCluster] Confirmed=N Filename=skinkers.exe Description=Howard the Weatherman desktop client from Halifax by Skinkers - marketing/messaging tool Source=Paul Collins Startup list [HaMFrontPanel] Confirmed=U Filename=hampanel.exe Description=Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget, but otherwise pointless Source=Paul Collins Startup list [Handy Backup 3.9] Confirmed=U Filename=hbagent.exe Description=Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers Source=Paul Collins Startup list [Hardware Sensors Monitor] Confirmed=U Filename=hmonitor.exe Description=Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems Source=Paul Collins Startup list [Hare] Confirmed=U Filename=hare.exe Description=Hare - improve and optimize performance of desktop/laptop PCs Source=Paul Collins Startup list [HawkEye] Confirmed=U Filename=HAWK_95.EXE Description=Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs Source=Paul Collins Startup list [HawkEye IV Control Panel] Confirmed=U Filename=HAWK_32.EXE Description=Control Panel application for the old Number Nine graphics cards to change resolution, colour depth, etc. Available via Start -> Programs Source=Paul Collins Startup list [Hbinst] Confirmed=X Filename=Hbinst.exe Description=Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here Source=Paul Collins Startup list [HC Reminder] Confirmed=N Filename=hc.exe Description=For Compaq PC's. Help Compiler, crunches help database, will run without being in startup when needed Source=Paul Collins Startup list [HCDetect] Confirmed=N Filename=HCDetect.exe Description=MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification, detection, and Internet Connection Sharing (ICS) taskbar icon. Not required - network can be set-up manually, also has a known memory leak problem Source=Paul Collins Startup list [Hcontrol] Confirmed=U Filename=hcontrol.exe Description=Hotkeys on an ASUS Notebook. Only required if you use the additional keys Source=Paul Collins Startup list [HDhelp] Confirmed=? Filename=tbhdhelp.exe Description=Associated with Philips Edge series soundcards. Is it required? Source=Paul Collins Startup list [HDtray] Confirmed=N Filename=HDtray.exe Description=Philips Edge Series Control Panel Tray Utility - system tray icon for a Philips Edge series soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [hellodolly] Confirmed=X Filename=shost.exe Description=Added as a result of the YODO VIRUS! Source=Paul Collins Startup list [Help] Confirmed=? Filename=helpext.exe Description=?? Source=Paul Collins Startup list [helpctl.exe] Confirmed=X Filename=helpctl.exe Description=Added as a result of the GASLIDE VIRUS! Source=Paul Collins Startup list [helper.dll] Confirmed=X Filename=helper.dll, Rundll32 Description=CnsMin "Chinese Keywords" hijacker related Source=Paul Collins Startup list [HelpExp.exe] Confirmed=X Filename=HelpExp.exe Description=Attune HelpExpress. Disable - see here Source=Paul Collins Startup list [helpmanager] Confirmed=X Filename=spoler.exe Description=Added as a result of the RANDEX.J VIRUS! Source=Paul Collins Startup list [Hermes Messenger] Confirmed=U Filename=DGDRHE~1.EXE Description=A LAN messenger alternative to WinPopUp - Digital Dreams Software Source=Paul Collins Startup list [Hewlett Packard Recorder] Confirmed=N Filename=Remind32.exe Description=HP multifunction registration Source=Paul Collins Startup list [Hf] Confirmed=U Filename=Hf.exe Description=Hide Folders - hide your folders so only you can view them Source=Paul Collins Startup list [hfxp] Confirmed=U Filename=hfxp.exe Description=Hide Folders XP - Win2K/XP version of the above Source=Paul Collins Startup list [HGTXPEI] Confirmed=N Filename=FirstReboot.exe Description=Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [HiberMonitor] Confirmed=? Filename=HCount.exe Description=?? Source=Paul Collins Startup list [Hibernation] Confirmed=U Filename=hib32.exe Description=Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate, etc. Required if you run of battery regularly Source=Paul Collins Startup list [Hid.exe] Confirmed=X Filename=hid.exe Description=Added as a result of the RATSOU.B VIRUS! Source=Paul Collins Startup list [HideRun.exe] Confirmed=X Filename=Hiderun.exe and svhost.exe and pro.gif Description=Added as a result of the BOOHOO VIRUS! Source=Paul Collins Startup list [hidserv] Confirmed=U Filename=hidserv.exe Description=This is the Human Interface Device Server for Win98SE/2000/Me/XP, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case then re-enable it. Equivalent to MMHid in Win98. On HP Computers, HIDSERV is the controller for the keyboard sound controls on the USB and PS/2 keyboards Source=Paul Collins Startup list [HistoryKill] Confirmed=N Filename=histkill.exe Description=HistoryKill removes your web surfing path by removing the URL drop-list history, detailed history file, cache, and cookies in both IE and Netscape Navigator browsers. Available via Start -> Programs Source=Paul Collins Startup list [hkcmd] Confirmed=U Filename=hkcmd.exe Description=Installed by the Intel 810 and 815 chipset graphic drivers. If you want the Ctrl+Alt+F12 or similar keypresses to access Intel's customised graphics properties, you need it, otherwise not. Can be disabled via the Display Properties in Control Panel Source=Paul Collins Startup list [hkserv] Confirmed=U Filename=HKserv.exe Description=Keyboard manager program required to use programmable power and function keys on some laptops such as the Sony PCG R505TS Source=Paul Collins Startup list [hkss] Confirmed=U Filename=hkss.exe Description=Compaq HotKey Support - multimedia keyboard support Source=Paul Collins Startup list [Hmonitor] Confirmed=U Filename=Hmonitor.exe Description=Hardware sensor monitoring program. Only required if you overclock your system and want to check on the status Source=Paul Collins Startup list [Holiday Lights] Confirmed=N Filename=Holiday Lights.exe Description=Holiday Lights from Tiger Technologies. Festive desktop enhancement that adds lights. Available via Start -> Programs Source=Paul Collins Startup list [HomeAlarm] Confirmed=U Filename=HomeAlarm.exe Description=Chameleon Clock - system tray clock replacement Source=Paul Collins Startup list [HomeCentre WakeUp] Confirmed=? Filename=LGWAKEUP.EXE Description=Associated with the no longer supported Xerox HomeCentre printer/scanner Source=Paul Collins Startup list [Honor] Confirmed=? Filename=honor.exe Description=?? Source=Paul Collins Startup list [Hook99startup] Confirmed=U Filename=hk2re.exe Description="Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons, bitmaps and can extract icons from executables and libraries. Hook99 can also make the background of desktop icons captions transparent" Source=Paul Collins Startup list [HookSys] Confirmed=U Filename=HookSys.exe Description=SurfinGuard Pro - protects against all malicious code delivered through executables, scripting files, ActiveX and Java Source=Paul Collins Startup list [Hot Corners] Confirmed=U Filename=Hotc.exe Description=Hot Corners - "lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen" Source=Paul Collins Startup list [Hot Key Kbd 2690 Daemon] Confirmed=U Filename=SK9910DM.exe Description=Multimedia keyboard manager - required if you use any special keys Source=Paul Collins Startup list [Hot Key Keybd 9910 Daemon] Confirmed=U Filename=SK9910DM.exe Description=Multimedia keyboard manager - required if you use any special keys Source=Paul Collins Startup list [Hot Party 22] Confirmed=? Filename=hotpart22.exe Description=?? Source=Paul Collins Startup list [Hotbar] Confirmed=X Filename=Hbinst.exe Description=Hotbar enhances the surfing experience offering a variety of innovative and fresh skins to the browser while providing users worldwide with access to various services of added value and fun. Also regarded as adware/spyware due to it's adds and browsing habits information gathering - see here Source=Paul Collins Startup list [HotIDE] Confirmed=U Filename=hotide.exe Description=HotIDE allows Acer TravelMate owners to hot-swap external drives without switching of their notebooks Source=Paul Collins Startup list [HotkeyApp] Confirmed=U Filename=HotkeyApp.exe Description=Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Source=Paul Collins Startup list [HotKeysCmds] Confirmed=U Filename=hkcmd.exe Description=Installed by the Intel 810 and 815 chipset graphic drivers. If you want the Ctrl+Alt+F12 or similar keypresses to access Intel's customised graphics properties, you need it, otherwise not. Can be disabled via Control Panel -> Display Properties Source=Paul Collins Startup list [HotPix] Confirmed=X Filename=hotpix.exe Description=Adult content dialler Source=Paul Collins Startup list [HotSync Manager] Confirmed=N Filename=hotsync.exe Description=Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start -> Programs Source=Paul Collins Startup list [hotwetlove] Confirmed=X Filename=hotwetlove.exe Description=Adult content dialler. Will not uninstall - components have to be manually deleted Source=Paul Collins Startup list [HoverDesk] Confirmed=U Filename=HoverDesk.exe Description=HoverDesk - desktop replacement software Source=Paul Collins Startup list [hp 1000 firmware] Confirmed=? Filename=fwdl.exe Description=HP LaserJet 1000 related. Is it a driver or automatic firmware update (based upon the filename)? Source=Paul Collins Startup list [HP AutoIndexer] Confirmed=? Filename=hppautoindexer.exe Description=?? Source=Paul Collins Startup list [HP CD-DVDorHP CD Writer] Confirmed=N Filename=hpcdtray.exe Description=System Tray access to a HP CD-Writer's functions. Available via Start -> Programs Source=Paul Collins Startup list [hp center] Confirmed=X Filename=BACKWEB-137903.exe Description=Based upon HP's own description from here - "With the My HP Center, consumers have access directly from the desktop to Internet sites featuring special offers for HP customers ranging from personal finance and shopping to digital imaging and music" I have classified this as adware. The number may change - if yours is different let me know Source=Paul Collins Startup list [hp center UI] Confirmed=X Filename=ShadowBar.exe Description=User Interface for HP Center Source=Paul Collins Startup list [HP Component Manager] Confirmed=? Filename=hpcmpmgr.exe Description=?? Source=Paul Collins Startup list [HP Display Settings] Confirmed=N Filename=hpdisply.exe Description=Sets default display settings. Unchecking this item has been reported to cure a "Problem sending command to keyboard" error message Source=Paul Collins Startup list [HP IDScheduler] Confirmed=? Filename=HPIDSCHD.exe Description=HP Instant Delivery Scheduler Source=Paul Collins Startup list [HP Info Express] Confirmed=N Filename=?? Description=On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb Source=Paul Collins Startup list [HP Instant Support] Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". HP Instant Support is required to run with the Help and Support program. If you uncheck HP Instant Support and and then run Help and Support it will add another HP Instant Support in the startup menu. If you remove the HP Instant Support in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [HP Internet Center] Confirmed=N Filename=SURFBRD.EXE Description=Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them Source=Paul Collins Startup list [HP JetDiscovery] Confirmed=N Filename=HPJETDSC.EXE Description=HP JetAdmin software which monitors printing jobs on a network environment Source=Paul Collins Startup list [HP JetSpeed Autostart] Confirmed=N Filename=AUTOSTART.EXE Description=Autostart executable for the old multiplayer game HP Jetspeed Source=Paul Collins Startup list [HP Network Registry Agent] Confirmed=? Filename=hpnra.exe Description=?? Source=Paul Collins Startup list [HP OfficeJet Series xxx Startup] Confirmed=? Filename=HPOSTR03.EXEHPOstr05.exe Description=xxx represents the series number - such as 700. What does it do and it it required? Source=Paul Collins Startup list [HP Parallel Port Test] Confirmed=N Filename=hppt.exe Description=Associated with a HP ScanJet scanner Source=Paul Collins Startup list [HP Port Resolver] Confirmed=? Filename=hpbpro.exe Description=?? Source=Paul Collins Startup list [HP Precision Scan] Confirmed=N Filename=hpmdlbwx.exe Description=Same as HP ScanPicture below Source=Paul Collins Startup list [HP Presentation Ready] Confirmed=N Filename=PresRdy.exe Description=HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device" Source=Paul Collins Startup list [hp psc 2000 Series] Confirmed=U Filename=hpobnz08.exe Description=System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start Source=Paul Collins Startup list [HP RecordNow] Confirmed=U Filename=?? Description=From HP "Software for the CD writer. Do not prevent from starting unless the CD writer is never going to be used." Source=Paul Collins Startup list [HP ScanPatch] Confirmed=U Filename=HPScanFix.exe Description=Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used, then it is safe to remove or prevent from starting Source=Paul Collins Startup list [HP ScanPicture] Confirmed=N Filename=hpsplmwa.exe Description=HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required Source=Paul Collins Startup list [HP SchedIndexer] Confirmed=? Filename=hppschedindexer.exe Description=HP laserjet related Source=Paul Collins Startup list [hp Silent Service] Confirmed=? Filename=HpSrvUI.exe Description=HP related Source=Paul Collins Startup list [HP Simple Trax] Confirmed=N Filename=Hpcron.exe Description=Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon Source=Paul Collins Startup list [HP software update] Confirmed=N Filename=HPWuSchd2.exe Description=HP software updates. If a shortcut doesn't exist create your own and run it manually Source=Paul Collins Startup list [HP Status Server] Confirmed=? Filename=hpboid.exe Description=?? Source=Paul Collins Startup list [HP Updates] Confirmed=N Filename=?? Description=On HP PCs, allows the computer to automatically receive notifications from HP over the Internet. Associated with BackWeb Source=Paul Collins Startup list [HP Visualize Init] Confirmed=? Filename=HpVisIni.exe Description=HP Visualize software related. What does it do and is it required? Source=Paul Collins Startup list [HP-Aio Flight] Confirmed=N Filename=Remind32.exe Description=HP multifunction registration Source=Paul Collins Startup list [hpaiodevice] Confirmed=N Filename=hpodev07.exe Description=Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner Source=Paul Collins Startup list [HPAiODevice(hp psc 900 series) -1] Confirmed=N Filename=hpobrt07.exe Description=Installed with a Hewlett Packard 900 series colour printer, scanner, fax, photo card slot printer, copier. Assumed to perform an identical function to hpaiodevice above Source=Paul Collins Startup list [HPAIO_PrintFolderMgr] Confirmed=N Filename=hpoopm07.exe Description=Directly from HP: "This process has one purpose - detects if the device moves to a different port, and notifies other processes to look on the new port." For various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled, and the HP icon installed on the desktop that points to "hpodir07.exe" works just fine if you need to use the scanner Source=Paul Collins Startup list [hpcmpmgr] Confirmed=? Filename=hpcmpmgr.exe Description=?? Source=Paul Collins Startup list [HPDJ Taskbar Utility] Confirmed=U Filename=hpztsbol.exehpztsd02.exehpztsb04.exehpztsb05.exe Description=(1) Ghostscript device driver for printers understanding Hewlett-Packard's Printer Command Language - see here for more info
or
(2) Creates 1 or all 3 icons on taskbar. The 1st one has a yellow border around it warning that ink is low on the printer. The 2nd one is HP Device Detection Software and the 3rd one is about a card being inserted into the Hp printer Source=Paul Collins Startup list [hpfsched] Confirmed=N Filename=hpfsched.exe Description=HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature Source=Paul Collins Startup list [HPGamesActiveMenu] Confirmed=U Filename=ActiveMenu.exe Description=Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [hpgs2wnd] Confirmed=N Filename=hpgs2wnd.exe Description="HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites." Available via Start -> Programs Source=Paul Collins Startup list [HPHAxMON] Confirmed=U Filename=HPHAxMON.EXE Description=Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature and known to cause system crashes in some cases. "x" can be 1, 2 or 3 and depends upon driver version. Replaced by HPHmon** (where ** is the version number) from version 4 onwards Source=Paul Collins Startup list [HPHmon**] Confirmed=U Filename=HPHMON**.EXE Description=Monitors the status of the memory card reader slot on a HP printers and displays a tray icon if a memory card isn't inserted. Also creates a virtual drive and assigns it the first available drive letter - which can lead to problems with drive management. ** represents the version number. Disable if you don't use the reader Source=Paul Collins Startup list [HPHmon04] Confirmed=U Filename=hphmon04.exe Description=Media card reader for some HP series printers allowing them to read digital camera memory cards directly. Only needed if you use this feature Source=Paul Collins Startup list [Hphome] Confirmed=X Filename=hphome.js Description=Homepage hijacker Source=Paul Collins Startup list [HPHUPD**] Confirmed=N Filename=hphupd**.exe Description=HP software update checker and wizard launcher. ** represents the version number. Available via Start -> Programs Source=Paul Collins Startup list [hpjsiroute] Confirmed=? Filename=hpjsira.exe Description=Related to HP laserjet printers and IP addresses. An IP address is appended to the name field - ie "hpjsiroute192.168.1.2" Source=Paul Collins Startup list [HpLamp] Confirmed=Y Filename=HPLAMP.EXE Description=HP Scanner Utility that controls your scanner�s light bulb. Needed if it's switched on. Also refer here for troubleshooting Source=Paul Collins Startup list [HPLogiFinder] Confirmed=U Filename=hp_finder.exe Description=HP LogiFinder helps detect and allows the use of the centre button for the Logitech mouse. Can be disabled if not used Source=Paul Collins Startup list [HpMmKbd] Confirmed=U Filename=HpMmKbd.exe Description=HP�s multimedia keyboard driver which enables the end-user to use the automation features of the HP multimedia keyboard Source=Paul Collins Startup list [hpodblia] Confirmed=N Filename=hpodblia.exe Description=HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Source=Paul Collins Startup list [hpoddt01.exe] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [hpodlb08] Confirmed=N Filename=hpodlb08.exe Description=HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually Source=Paul Collins Startup list [hpppta] Confirmed=Y Filename=HPPPTA.exe Description=HP parallel port driver for certain hardware Source=Paul Collins Startup list [HPPROPTY] Confirmed=N Filename=HPPROPTY.EXE Description=HP LaserJet Toolbox Source=Paul Collins Startup list [HPPWRSAV] Confirmed=U Filename=HPPWRSAV.EXE Description=Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com, pick your OS option under the SUPPORT tab, follow the instructions and you will find an updated lamp control patch Source=Paul Collins Startup list [hpqcmon] Confirmed=? Filename=hpqcmon.exe Description=From HP and related to digital imaging Source=Paul Collins Startup list [HPSCANMonitor] Confirmed=U Filename=hpsjvxd.exe Description=HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner Source=Paul Collins Startup list [hpScannerFirstBoot] Confirmed=? Filename=scannerfb.exe Description=HP scanner related Source=Paul Collins Startup list [hpsjbmgr] Confirmed=N Filename=hpsjbmgr.exe Description=HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup, unless the scanner is used every day, such as in a business environment Source=Paul Collins Startup list [HPStart] Confirmed=N Filename=hpstart.wsf Description=This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot Source=Paul Collins Startup list [hpsysdrv] Confirmed=U Filename=hpsysdrv.exe Description=This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP, if it can't tell that it is an HP it will not run. If unchecked, it can prevent the running of the Application Recovery CDs, the use of the multimedia keys, and the HP Instant Support. Also seen that without it running, the Riptide Sound card that was installed on some older HP computers stops working Source=Paul Collins Startup list [HPU] Confirmed=N Filename=ProvenTactics.exe Description=Proven Internet Marketing software Source=Paul Collins Startup list [HPZTS04] Confirmed=N Filename=hpzts04.exe Description=Hewlett Packard printer toolbox shortcut that resides in the system tray Source=Paul Collins Startup list [HP_dla] Confirmed=N Filename=dlatray.exe Description=On HP PCs, tray icon for dla - which provides drive letter access to HP's and Veritas' version of DirectCD Source=Paul Collins Startup list [HREF.OCX] Confirmed=Y Filename=regsvr32.exe ....\HREF.OCX Description=HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller Source=Paul Collins Startup list [Hti] Confirmed=U Filename=npdor.exe Description=Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required Source=Paul Collins Startup list [HTpatch] Confirmed=U Filename=htpatch.exe Description=HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6% Source=Paul Collins Startup list [https-ssl] Confirmed=X Filename=https.exe Description=Added as a result of the MOEGA.D VIRUS! Source=Paul Collins Startup list [huhdir] Confirmed=? Filename=huhdir.exe Description=?? Source=Paul Collins Startup list [huigezi] Confirmed=X Filename=HgzServer.exe Description=Added as a result of the GRAYBIRD.C VIRUS! Source=Paul Collins Startup list [Hvid] Confirmed=X Filename=Hvid.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [HWINFO*] Confirmed=X Filename=HWINFO* Description=Added as a result of the PUROL VIRUS! where * is a random character Source=Paul Collins Startup list [HWinst] Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [HXDL.EXEorHXIUL.EXE] Confirmed=X Filename=HXDL.EXEHXIUL.EXE Description=Believed to be spyware - made by a company called Alset. Also known as "HelpExpress". Will install itself if you have previously had Attune by Aveo installed as they're by the same company. Uninstall via Add/Remove programs Source=Paul Collins Startup list [HydraVisionDesktopManager] Confirmed=U Filename=desk98.exe Description=ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup Source=Paul Collins Startup list [HydraVisionViewport] Confirmed=U Filename=viewport.exe Description=ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup Source=Paul Collins Startup list [I-Worm.GiGu] Confirmed=X Filename=uGiG.eXe Description=Added as a result of the GINK VIRUS! Source=Paul Collins Startup list [I386] Confirmed=X Filename=I386.exe Description=Added as a result of the MYPOWER VIRUS! Source=Paul Collins Startup list [I81SHELL] Confirmed=? Filename=I81SHELL.exe Description=Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard Source=Paul Collins Startup list [i8kfangui] Confirmed=U Filename=i8kfangui.exe Description=Graphical interface for fan speed control Source=Paul Collins Startup list [IAAnotif] Confirmed=U Filename=iaanotif.exe Description=IAA Event Monitor User Notification Tool - part of Intel� Application Accelerator - "a performance software package for desktop PCs using select Intel� chipsets" that "replaces the ATA drivers that come with Windows with drivers optimized for desktop and mobile PCs." If you use the RAID version it's required to notify you if a RAID 1 disk has failed Source=Paul Collins Startup list [iamapp] Confirmed=Y Filename=iamapp.exe Description=AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago, it's now the Norton Personal Firewall executable as well Source=Paul Collins Startup list [Iamnacho On Irc.MusIrc.com Is a Homosexual!] Confirmed=X Filename=XBox64.exe Description=Added as a result of the RANDEX.Y VIRUS! Source=Paul Collins Startup list [Iap] Confirmed=? Filename=iap.exe Description=Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely? Source=Paul Collins Startup list [IASHLPR] Confirmed=X Filename=IASHLPR.EXE Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [ibmmessages] Confirmed=N Filename=ibmmessages.exe Description=Allows IBM to push messages onto users' computers. Quote: "The Access IBM Message Center can display messages to inform you about software and solutions available from IBM as well as messages from IBM eSupport" Source=Paul Collins Startup list [Ibmmon.exe] Confirmed=? Filename=Ibmmon.exe Description=?? Source=Paul Collins Startup list [Ibmpmsvc] Confirmed=U Filename=ibmpmsvc.exe Description=Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn, F3, F4 & F12 - which have specific functions to control the standby and hibernate buttons. Not required if you don't plan to go into standy or hibernate modes Source=Paul Collins Startup list [IBMUltraBayHotSwapCPLLoader] Confirmed=U Filename=IBMBAY2N.EXE Description=Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops Source=Paul Collins Startup list [IBMUltraBayHotSwapSound] Confirmed=? Filename=IBMBAYSN.EXE Description=Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound? Related to the item below Source=Paul Collins Startup list [ICH Synth] Confirmed=N Filename=eusexe.exe Description=Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices Source=Paul Collins Startup list [iClean] Confirmed=U Filename=iClean.exe Description=IEClean - "advanced, comprehensive package of tools which perform a number of functions to allow you to control your online privacy" Source=Paul Collins Startup list [iCn] Confirmed=N Filename=NAG.EXE Description=iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy, if they exist Source=Paul Collins Startup list [ICO] Confirmed=N Filename=ICO.EXE Description=Found on a Sony Vaio laptop and seems to be related to Mouse Suite 98 Daemon according to the properties. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Source=Paul Collins Startup list [Icon Animation] Confirmed=N Filename=HDE.EXE Description=Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons Source=Paul Collins Startup list [Icon Hearit 95] Confirmed=N Filename=hearit95.exe Description=Audio desktop customization utility from Moon Valley Software. Resource hog Source=Paul Collins Startup list [Icon Hearit 98] Confirmed=N Filename=hearit98.exe Description=Audio desktop customization utility from Moon Valley Software. Resource hog Source=Paul Collins Startup list [Icon lptt01orIcon ml097e] Confirmed=X Filename=icon.exe Description=Variant of the RapidBlaster parasite (in an "Icon" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [ICONCLNT] Confirmed=Y Filename=iconclnt.exe Description=APC PowerChute Tray Icon. Associated with the UPS listing Source=Paul Collins Startup list [ICONDESK] Confirmed=U Filename=ICONDESK.EXE Description=Small utility which will allow you the option of hiding or showing your desktop icons Source=Paul Collins Startup list [Iconfig.exe] Confirmed=N Filename=Iconfig.exe Description=Icon for LS-120 "Superdisk" Source=Paul Collins Startup list [iConfigLoader] Confirmed=X Filename=DIIhost.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Iconoid] Confirmed=N Filename=Iconoid.exe Description=Iconoid is a desktop icon manager Source=Paul Collins Startup list [Iconsaver] Confirmed=N Filename=Iconsaver.exe Description=IconSaver is a desktop icon manager Source=Paul Collins Startup list [ICQ Hacking Pro] Confirmed=X Filename=ICQpro.exe Description=Added as a result of a version of the NETSPY VIRUS! Source=Paul Collins Startup list [ICQ Lite] Confirmed=N Filename=ICQLite.exe Description=ICQ Lite - compact version of the popular messaging program Source=Paul Collins Startup list [ICQ Net] Confirmed=X Filename=winlogon.exe Description=Added as a result of the NETSKY.C VIRUS! - file is located in C:\\Windows or C:\\Winnt, and not in it's System or System32 subdirectory, as is the case with the legitimate winlogon.exe file Source=Paul Collins Startup list [ICQ Plus] Confirmed=N Filename=vplus.exe Description=ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs Source=Paul Collins Startup list [ICSDCLT] Confirmed=U Filename=rundll32.exe Icsdclt.dll, ICSClient Description=Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines Source=Paul Collins Startup list [ICServer] Confirmed=N Filename=Icserver.exe Description=Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations Source=Paul Collins Startup list [ICSMGR] Confirmed=Y Filename=ICSMGR.EXE Description=Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you�re sharing the internet on various computers Source=Paul Collins Startup list [IC_KEY_3] Confirmed=N Filename=spvic.exe Description=Instant Chess related Source=Paul Collins Startup list [ID Commander] Confirmed=N Filename=IDCom.exe Description=Caller ID utility for identifying incoming telephone numbers Source=Paul Collins Startup list [ID8525] Confirmed=X Filename=ID8525.exeid85255.exe Description=ID8525 VIRUS and homepage hijacker! Source=Paul Collins Startup list [IDA] Confirmed=? Filename=IDA.EXE Description=HP related - in a Program Files\\Hewlett-Packard\\PC COE folder Source=Paul Collins Startup list [IDE] Confirmed=X Filename=ide.exe Description=Added as a result of the ASSASIN.F VIRUS! Source=Paul Collins Startup list [IDE Loader] Confirmed=X Filename=IDElibr32.exe Description=Added as a result of the XILON VIRUS!. Related to the game "Diablo II" Source=Paul Collins Startup list [iDesktop] Confirmed=U Filename=idesktop.exe Description=Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse Source=Paul Collins Startup list [IDMan] Confirmed=N Filename=IDMan.exe Description=Internet Download Manager - download files faster, schedule and resume Source=Paul Collins Startup list [IDW Logging Tool] Confirmed=N Filename=idwlog.exe Description=Added with WinXP SP1. Usually only found in internal builds only to indicate the current build being used. Can cause slow network logon problems Source=Paul Collins Startup list [IE Doctor] Confirmed=U Filename=IEDoctor.exe Description=IE Doctor Toolbar - "IE Doctor can help you to Repair IE easily, protect IE and OE from all malicious changes. It can Repair the HomePage, context menu, IE toolbar button, startup items, Favorites, typed URLs and the entire Internet Options" Source=Paul Collins Startup list [IECleanAux] Confirmed=U Filename=Ieboot6.exe Description=IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc. Performs cleaning tasks at startup Source=Paul Collins Startup list [iedll] Confirmed=X Filename=iedll.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com Source=Paul Collins Startup list [IEDriver] Confirmed=X Filename=IEDriver.exexplore.exe Description=Installed as part of adware (Cydoor) based peer-to-peer file sharing software called URLBlaze Source=Paul Collins Startup list [IEFeatures] Confirmed=X Filename=IEFeatures.exeInternetfeatures.exe Description=Added as a result of the POPMON.A VIRUS! - also known as PopMonster adware Source=Paul Collins Startup list [Iehelper] Confirmed=X Filename=syslaunch.exe Description=Outwar adware downloader Source=Paul Collins Startup list [IELoader32] Confirmed=X Filename=iexplore32.exe Description=Added as a result of the SPEX or SPEX.B VIRUSES! Source=Paul Collins Startup list [Iesar] Confirmed=X Filename=Iesar.exe Description=Browser hijacker - redirecting to an adult web page Source=Paul Collins Startup list [ietsr] Confirmed=N Filename=ietsr.exe Description=IEClean by Kevin McAleavy - cookie manager, cache cleaner, history cleaner, etc Source=Paul Collins Startup list [ieupdate] Confirmed=X Filename=MCP****.exe Description=Added as a result of the ASOXY VIRUS! where **** are random characters Source=Paul Collins Startup list [Iexplore] Confirmed=X Filename=iexplore.exe Description=Added as a result of the BOXER VIRUS!. This iexplore.exe file is located eleswhere rather than in the default Program Files\\Internet Explorer folder Source=Paul Collins Startup list [IEXPLORE] Confirmed=X Filename=iexplore.exe Description=Added as a result of the APHEXDOOR VIRUS! Note - "iexplore.exe" resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) wheras the valid "iexplore.exe" (IE) resides in C:\\Program Files Source=Paul Collins Startup list [Iexplore Services] Confirmed=X Filename=iexplore.exe Description=Added as a result of an unidentified VIRUS!. This iexplore.exe file is located eleswhere rather than in the default Program Files\\Internet Explorer folder Source=Paul Collins Startup list [iexplorer lptt01oriexplorer ml097e] Confirmed=X Filename=iexplorer.exe Description=Variant of the RapidBlaster parasite (in an "iexplorer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Windows Explorer which has the same executable name Source=Paul Collins Startup list [IFSplash.exe] Confirmed=U Filename=IFSplash.exe Description=I-FORCE driver for force feedback steering wheel Source=Paul Collins Startup list [igfxtray] Confirmed=N Filename=igfxtray.exe Description=Quick access to the control panel via a System Tray icon for graphics based upon the Intel chipsets (ie, i810). These chipsets are often included on motherboards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [iilc] Confirmed=X Filename=IILC.EXE Description=Homepage hijacker Source=Paul Collins Startup list [iIWiper] Confirmed=N Filename=Systemwiper.exe Description=System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis Source=Paul Collins Startup list [IJ75P2PSERVER] Confirmed=Y Filename=IJ75P2PS.EXE Description=Printer utility which is required in order to make the printer work correctly Source=Paul Collins Startup list [IKE Service 95] Confirmed=Y Filename=IKEService.exe Description=Associated with PGP. The PGP Tray can be disabled, but without IKESERVICE you won't be able to de- or encrypt anything Source=Paul Collins Startup list [iKeyWorks] Confirmed=U Filename=IKEYMAIN.EXE Description=A4Tech wireless keyboard driver and utility Source=Paul Collins Startup list [iLLeGaLoriLLeGaL.exe] Confirmed=X Filename=Mplayer.exe Description=Added as a result of the HOLAR.C (or GALIL@MM) VIRUS! Note - this should not be comfused with Windows Media Player which has the same filename Source=Paul Collins Startup list [ILO_Office_Manager] Confirmed=? Filename=IntEdReg.exe /OFFMAN Description=Intense Educational Ltd - Language Office Software. Is it required? Source=Paul Collins Startup list [iM Start Center] Confirmed=N Filename=iM_Tray.exe Description=Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner Source=Paul Collins Startup list [Image] Confirmed=X Filename=rundll32 image.dll, Install Description=CoolWebSearch parasite related Source=Paul Collins Startup list [Image & Restore] Confirmed=Y Filename=IMAGE32.exe Description=Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased, if Image was recently run Source=Paul Collins Startup list [Imagefox] Confirmed=U Filename=imagefox.exe Description=ImageFox 2.0 is an "add-on" graphics previewer for most Windows Open/Save As dialog boxes Source=Paul Collins Startup list [Imagemgt32] Confirmed=X Filename=Imagemgt32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [imekrig] Confirmed=N Filename=imekrig.exe Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) Source=Paul Collins Startup list [IMEKRMIG6.1] Confirmed=N Filename=IMEKRMIG.EXE Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean) Source=Paul Collins Startup list [Imesh] Confirmed=N Filename=?? Description=Imesh is a file sharing system Source=Paul Collins Startup list [Imesh Auto Update] Confirmed=N Filename=?? Description=Update check for above. Turn the update off under "options" Source=Paul Collins Startup list [ImgIcon] Confirmed=U Filename=ImgIcon.exe Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [ImgStart] Confirmed=N Filename=ImgStart.exe Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [imjpmigorImjpmig8.1] Confirmed=N Filename=IMJPMIG.EXE Description=Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Korean and this one is Japanese) Source=Paul Collins Startup list [immcheck.exe] Confirmed=? Filename=immcheck.exe Description=Related to I-FORCE driver for force feedback steering wheel? Source=Paul Collins Startup list [Imonitor] Confirmed=N Filename=Plguni.exe Description=McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Source=Paul Collins Startup list [InCD] Confirmed=N Filename=incd.exe Description=Ahead InCD packet writing software. Similar to DirectCD. On my system there isn't an entry, on another visitor's there is. Run manually before insert an appropriately formatted CD-RW disk Source=Paul Collins Startup list [IncMail] Confirmed=N Filename=IncMail.exe Description="IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality" Source=Paul Collins Startup list [InControl Desktop Manager] Confirmed=N Filename=DMHKEY.EXE Description=For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs Source=Paul Collins Startup list [Incredimail] Confirmed=N Filename=incredimail.exe Description="IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality" Source=Paul Collins Startup list [IndexSearch] Confirmed=N Filename=IndexSearch.exe Description=Associated with PaperPort scanner software from ScanSoft Source=Paul Collins Startup list [Inet Delivery] Confirmed=X Filename=Intdel.exeintdel_2.exe Description=Spyware Source=Paul Collins Startup list [Inetapi] Confirmed=X Filename=Netapi.exe Description=Added as a result of the NETDEVIL.14 (NetDevil 1.4) VIRUS! Source=Paul Collins Startup list [inetcntrl] Confirmed=U Filename=inetcntrl.exe Description=Bsafe Online - internet filter Source=Paul Collins Startup list [InetConf] Confirmed=? Filename=inetconf.exe Description=?? Source=Paul Collins Startup list [Inetd] Confirmed=U Filename=INETD32.EXE Description=Windows Inet Daemon from Hummingbird Communications. "Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons". Provides PCs with the full functionality of a UNIX workstation Source=Paul Collins Startup list [inetinfo.exe] Confirmed=U Filename=inetinfo.exe Description=Executable used by MS Internet Information Server (IIS). If it's running, then so is IIS. Useful in knowing whether you require the patch for the Code Red worm. Comes with PWS (Personal Web Server) or NT4 and handles ASP-, PHP code (+ more) Source=Paul Collins Startup list [InetMSN] Confirmed=X Filename=msnet.exe Description=Added as a result of a variant of the SDBOT VIRUS! Source=Paul Collins Startup list [Info Select] Confirmed=U Filename=is.exe Description=Info Select from Micro Logic - personal information manager Source=Paul Collins Startup list [Info32x] Confirmed=X Filename=Info32x.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Infoplay.exe] Confirmed=? Filename=Infoplay.exe Description=Written by New Media Properties, LLC and you're asked if you want to download and install it if you visit one of their search engine websites (which I chose not to). What does it do and is it needed? Source=Paul Collins Startup list [Infra-red Monitor] Confirmed=U Filename=IRMON.EXE Description=System Tray access to infra-red devices. Not required unless you use infra-red devices Source=Paul Collins Startup list [infus] Confirmed=X Filename=infus.exe Description=Adult content dialler Source=Paul Collins Startup list [Infuzer] Confirmed=U Filename=Infuzer.exe Description=Infuzer - "is a service that copies dates from the web or an email straight to your electronic calendar". Beware of the following adware trait - "Infuzer provides web site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them, as well as increasing return visits and brand awareness, and providing new e-commerce opportunities" Source=Paul Collins Startup list [infwin] Confirmed=X Filename=infwin.exe Description=Msview parasite variant Source=Paul Collins Startup list [Initialize8x8] Confirmed=Y Filename=8x8_init.exe Description=Tool that initializes a Pinnacle PCTV card - maybe in capture or in showing overlay Source=Paul Collins Startup list [Ink Monitor] Confirmed=N Filename=InkMonitor.exe Description=Associated with Epson (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line Source=Paul Collins Startup list [InkWatch] Confirmed=N Filename=InkWatch.exe Description=Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line Source=Paul Collins Startup list [InoRPC] Confirmed=Y Filename=InoRpc.exe Description=Associated with eTrust Antivirus/InoculateIT Source=Paul Collins Startup list [InoRT] Confirmed=Y Filename=InoRT9x.exe Description=Associated with the Realtime Monitor of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. For NT/2K/XP users you may need a patch if seeing high CPU useage - see here Source=Paul Collins Startup list [InoTask] Confirmed=U Filename=InoTask.exe Description=Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates - see here Source=Paul Collins Startup list [insCOA5] Confirmed=? Filename=insCOA5.exe Description=?? Source=Paul Collins Startup list [Install Pending Files] Confirmed=? Filename=sifxinst.exe Description=Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required? Source=Paul Collins Startup list [InstallAurealDemos] Confirmed=N Filename=InstallAurealDemos.js Description=Used to initialize the Aureal A3D demos InstallShield wizard Source=Paul Collins Startup list [InstallBuddy] Confirmed=U Filename=Ibtna.exe Description=InstallBuddy - automatically translates and installs your desktop documents, such as Adobe PDF, HTML, Microsoft Word, Excel and PowerPoint files, to your Palm organizer when you HotSync Source=Paul Collins Startup list [InstallNAIProduct] Confirmed=? Filename=SETUP.EXE Description=Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error? Source=Paul Collins Startup list [Instant Access] Confirmed=X Filename=rundll32.exe EGDHTML_1023.dll, InstantAccess Description=Adult content dialler related Source=Paul Collins Startup list [Instant Update Center] Confirmed=N Filename=reminder.exe Description=From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it keeps re-checking itself when using MSCONFIG. PrintMaster 11 uses filename PMremind.exe - it has to be unchecked in startup in the same manner Source=Paul Collins Startup list [Instant Wireless Configuration Utility] Confirmed=U Filename=WUSB11cfg.exe Description=Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Source=Paul Collins Startup list [InstantAccess] Confirmed=N Filename=INSTAN~1.EXE Description=From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs Source=Paul Collins Startup list [InstantDrive] Confirmed=U Filename=InstantDrive.exe Description=Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer�s hard drive. Part of InstantCD/DVD burning software Source=Paul Collins Startup list [InstantPleasure] Confirmed=X Filename=instantpleasure.exe Description=Adult content dialler Source=Paul Collins Startup list [InstantPleasureXXX] Confirmed=X Filename=instantpleasurexxx.exe Description=Adult content dialler Source=Paul Collins Startup list [instit] Confirmed=X Filename=instit.bat Description=Added as a result of the OPASERV.H VIRUS! Source=Paul Collins Startup list [instit] Confirmed=X Filename=INSTIT.BAT Description=Added as a result of the OPASERV.K VIRUS! Source=Paul Collins Startup list [InstUtlR.exe] Confirmed=? Filename=InstUtlR.exe Description=?? Source=Paul Collins Startup list [Intel Active Monitor] Confirmed=U Filename=imontray.exe Description=System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you change PCMCIA cards Source=Paul Collins Startup list [Intel File Transfer] Confirmed=U Filename=xfr.exe Description=Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Source=Paul Collins Startup list [Intel PDS] Confirmed=U Filename=pds.exe Description=Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start the dial-up if installed and enabled Source=Paul Collins Startup list [Intel Product Number Utility] Confirmed=U Filename=IntelProcNumUtility.exe Description=Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here Source=Paul Collins Startup list [Intel PROSet Tray Icon] Confirmed=N Filename=promon.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [InteliSys] Confirmed=X Filename=smss.exe Description=Advertisingvision adware - file is located in C:\\Windows or C:\\Winnt, and not in it's System32 subdirectory, as is the case with the legitimate Smss.exe system file which would normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [Intellitype] Confirmed=U Filename=type32.exe Description=For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings unless you have changed them Source=Paul Collins Startup list [IntelProcNumUtility] Confirmed=U Filename=cpunumber.exe Description=Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here Source=Paul Collins Startup list [Intense Registry Service] Confirmed=? Filename=IntEdReg.exe /CHECK Description=Intense Educational Ltd - Language Office Software. Is it required? Source=Paul Collins Startup list [InterCheck Monitor] Confirmed=Y Filename=Icmon.exe Description=Part of Sophos ant-virus sofware Source=Paul Collins Startup list [Interdll] Confirmed=X Filename=Interdll.exe Description=Added as a result of the DELF family of VIRUSES! Source=Paul Collins Startup list [Internal] Confirmed=X Filename= Description=Added as a result of the SMOTHER & TRANSLAT VIRUSES! Source=Paul Collins Startup list [Internal] Confirmed=X Filename=regedit.exe /s %windir%c:\\ Description=Added as a result of the FORTNIGHT.D VIRUS! Source=Paul Collins Startup list [InternalSystray] Confirmed=X Filename=Kazza.exe Description=Added as a result of the OPTIXPRO.12.C VIRUS! Note - unlike the valid KaZaA executable, this is located in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) Source=Paul Collins Startup list [Internat Conf] Confirmed=X Filename=bootconf.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com; see for example here Source=Paul Collins Startup list [internat.exe] Confirmed=N Filename=internat.exe Description=Language selection icon in system tray Source=Paul Collins Startup list [Internat.exe] Confirmed=X Filename=internat.exe Description=Added as a result of the NETSNAKE VIRUS! Note - the real internat.exe resides in %windir%\\system (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) and has a "?" icon wheras this version resides in %windir% and has a ZIP icon Source=Paul Collins Startup list [internct] Confirmed=X Filename=WinSocks5.exe Description=Added as a result of the GRAYBIRD.F VIRUS! Source=Paul Collins Startup list [Internet Answering Machine] Confirmed=U Filename=IAMNET~1.EXE Description=From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access Source=Paul Collins Startup list [Internet Config] Confirmed=X Filename=svchosts.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [Internet Explorer] Confirmed=X Filename=iexplorer.exe Description=Added as a result of the LORSIS VIRUS! Note - the valid Internet Explorer would not normally run at startup unless added manually by the user and would not run from the registry "RunServices" key as this does Source=Paul Collins Startup list [Internet Explorer Updater] Confirmed=X Filename=lexbac.exe Description=Added as a result of the DOWNLOAD VIRUS! Source=Paul Collins Startup list [Internet History Eraser] Confirmed=U Filename=HERASER.exe Description=Internet History Eraser - deletes your browsing tracks Source=Paul Collins Startup list [Internet Loader1] Confirmed=X Filename=MSInstall61.exe Description=Added as a result of the KWBOT.B VIRUS! Source=Paul Collins Startup list [Internet Optimizer] Confirmed=U Filename=optimize.exe Description=Internet connection optimizer. Leave this enabled if you find it improves your connection Source=Paul Collins Startup list [INTERNET SERVISES] Confirmed=X Filename=winz32.exe Description=Added as a result of the KWBOT.Z VIRUS! Source=Paul Collins Startup list [Internet Sharing Server] Confirmed=Y Filename=iss_srvr.exe Description=Intel AnyPoint internet sharing software Source=Paul Collins Startup list [Internet Sweeper] Confirmed=N Filename=Sweeper.exe Description=Internet Sweeper - removes unnecessart left over files after browsing the internet Source=Paul Collins Startup list [Internet Timer] Confirmed=U Filename=ITIMER.exe Description=Shareware dial-up connection call cost calculator from Ratsoft Source=Paul Collins Startup list [Internet.exe] Confirmed=X Filename=Internet.exe Description=Added as a result of the MAGICCALL VIRUS! Source=Paul Collins Startup list [InternetWasherProorInternet Washer Pro] Confirmed=X Filename=iw.exe Description=Internet Washer manages temporary browser files, cookies, etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003 Source=Paul Collins Startup list [INTERNET_SERVISES] Confirmed=X Filename=winz32.exe Description=Added as a result of the SDBOT.Q VIRUS! Source=Paul Collins Startup list [Internt] Confirmed=X Filename=Internt.exe Description=Added as a result of the PEEPER VIRUS! Source=Paul Collins Startup list [InterTrust Quick Start] Confirmed=N Filename=it_cpq~1.exe Description=InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business Source=Paul Collins Startup list [InterU] Confirmed=X Filename=WINDRV.EXE Description=Added as a result of the IRCINTER.A VIRUS! Source=Paul Collins Startup list [Intervideo Win Cinema ManagerorIntervideo WinCinema Manager] Confirmed=N Filename=WinCinemaMgr.exeWINCIN~1.EXE Description=WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs Source=Paul Collins Startup list [Intervideo WinScheduler] Confirmed=N Filename=WinScheduler.exeSchSvr.exe Description=WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [InterWARN] Confirmed=U Filename=interwarn.exe Description=InterWARN by Storm Alert Inc. Provides customized, automated access to critical weather and civil emergency information from the US National Weather Service. Required if audio and screen crawler alerts are desired. Also available via Start -> Programs Source=Paul Collins Startup list [Intmgr] Confirmed=X Filename=Intmgr.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Intrenat] Confirmed=X Filename=Intrenat.exe Description=Added as a result of the LEMIR.E VIRUS! Source=Paul Collins Startup list [Introducing Media Manager] Confirmed=N Filename=SPLASHA.EXE Description=MS Media Manager tour. Not required Source=Paul Collins Startup list [Introduction-Registration] Confirmed=N Filename=?? Description=For Compaq PC's. Should only run first time, PC Introduction & Compaq registration Source=Paul Collins Startup list [IntruderAlert] Confirmed=X Filename=ia99.exe Description=Intruder Alert '99 from Bonzi - spyware Source=Paul Collins Startup list [Ioadqm] Confirmed=X Filename=Media Player.exe Description=Added as a result of the HAWAWI VIRUS! Source=Paul Collins Startup list [iolo Task Agent] Confirmed=U Filename=Task_Agent.exe Description=iOlo System Mechanic Task Agent. Scheduled maintenance Source=Paul Collins Startup list [Iomega Automatic BackuporIomega Automatic Backup 1.0.1] Confirmed=U Filename=ibackup.exe Description=Iomega Automatic Backup - automatic backups for use with Iomega portable HDD Source=Paul Collins Startup list [Iomega Backup Scheduler] Confirmed=N Filename=dtiom98.exe Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomega Disk IconsorIomega Drive Icons] Confirmed=U Filename=IMGICON.EXE Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [Iomega QuickSync] Confirmed=? Filename=Quicksync.exe Description=?? Source=Paul Collins Startup list [Iomega Startup Options] Confirmed=N Filename=IMGSTART.EXE Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomega Watch] Confirmed=N Filename=IOWATCH.EXE Description=Used by Iomega drives. Available via Start -> Programs Source=Paul Collins Startup list [IomegaWare] Confirmed=N Filename=COMMANDER.EXE Description=Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs Source=Paul Collins Startup list [Iomon98.exe] Confirmed=U Filename=Iomon98.exe Description=PC-Cillin 98 real time virus check. Can cause floppy disk accesses to hang Source=Paul Collins Startup list [IP Stack] Confirmed=X Filename=ipstack.exe Description=Added as the result of the AGOBOT.CW VIRUS! Source=Paul Collins Startup list [iPalm] Confirmed=N Filename=mon.exe Description=Installed with a Panasonic iPalm digital camera. Used to uploaded photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded Source=Paul Collins Startup list [IPInSightLAN 01] Confirmed=X Filename=ipclient.exe Description=Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly "phones home" and wastes resource - hence the "X" status Source=Paul Collins Startup list [IPInSightMonitor 01] Confirmed=N Filename=ipmon32.exe Description=Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information Source=Paul Collins Startup list [IPinst] Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [ipmon.exe] Confirmed=X Filename=ipmon.exe Description=Added as a result of the RECERV VIRUS! Source=Paul Collins Startup list [iPodManager] Confirmed=U Filename=iPodManager.exe Description=Apple iPod Management software for the iPod MP3 player. Allows updating, formating, restoring and other functions associated with iPods Source=Paul Collins Startup list [iPodWatcher] Confirmed=? Filename=iPodWatcher.exe Description=Associated with Apple's iPod MP3 player. Detects when the iPod is connected? Source=Paul Collins Startup list [iProtectYou] Confirmed=U Filename=ip.exe Description=iProtectYou - internet filtering/parental control and network monitoring software Source=Paul Collins Startup list [IPSecMon] Confirmed=Y Filename=IPSecMon.exe Description=Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Source=Paul Collins Startup list [IPW] Confirmed=? Filename=IPW.exe Description=?? Source=Paul Collins Startup list [IREIKE] Confirmed=Y Filename=IreIKE.exe Description=Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet Source=Paul Collins Startup list [iRis Active Monitor] Confirmed=N Filename=winmon32.exe Description=Iris Antivirus - discontinued, replace with good alternative Source=Paul Collins Startup list [iRiS AntiVirus Active Monitor] Confirmed=N Filename=WIMMUN32.exe Description=Iris Antivirus - discontinued, replace with good alternative Source=Paul Collins Startup list [IrMon] Confirmed=U Filename=IRMON.EXE Description=System Tray access to infra-red devices. Not required unless you use infra-red devices Source=Paul Collins Startup list [IRPMonitor] Confirmed=? Filename=itcnmon.exe Description=?? Source=Paul Collins Startup list [IS CfgWiz] Confirmed=N Filename=cfgwiz.exe Description=Norton Internet Security configuration wizard Source=Paul Collins Startup list [isdbdc] Confirmed=N Filename=isdbdc.exe Description=For Compaq PC's. May install properties in dial-up networking when you register with an ISP Source=Paul Collins Startup list [ISDN Monitor] Confirmed=N Filename=Linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [ISDNwatch] Confirmed=U Filename=IWatch.exe Description=FRITZ!X ISDNWatch - "dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks" Source=Paul Collins Startup list [ISLP2STA] Confirmed=N Filename=ISLP2STA.EXE Description=Possibly a left over from Windows Update for wireless NIC (maybe Linksys) drivers? Not required though Source=Paul Collins Startup list [iSpyNOW] Confirmed=U Filename=ispynow.exe Description=iSpyNOW - remote monitoring and surveillance software Source=Paul Collins Startup list [ISStart] Confirmed=U Filename=ISStart.exe Description=LogitechGalleryRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 - hence the "U" rather than "Y" recommendation Source=Paul Collins Startup list [IST Service] Confirmed=X Filename=istsvc.exe Description=ISTBar foistware Source=Paul Collins Startup list [Itk] Confirmed=U Filename=Itk.exe Description=In The Know - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [iTouch] Confirmed=U Filename=iTouch.exe Description=iTouch loads the iTouch configuration program for Logitech keyboards. It�s needed if your keyboard has shortcut buttons and if you use them. It�s also needed if your keyboard does not have the num lock, caps lock, and scroll lock lights on it and you use the on-screen displays for num lock, caps lock, and scroll lock Source=Paul Collins Startup list [ItsDeductiblePopUp] Confirmed=N Filename=ItsDeductible.exe Description=ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip Source=Paul Collins Startup list [iTunes Helper] Confirmed=Y Filename=iTunesHelper.exe Description=Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation Source=Paul Collins Startup list [Iusage] Confirmed=N Filename=netdet.exe Description=Internet Usage Monitor - utility to calculate the cost and time on the internet via dial-up Source=Paul Collins Startup list [IW ControlCenter] Confirmed=N Filename=iwctrl.exe Description=Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis Source=Paul Collins Startup list [iwctrl] Confirmed=U Filename=iwctrl.exe Description=Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis Source=Paul Collins Startup list [IZE] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [j2 Tray Menu] Confirmed=N Filename=HotTray.exe Description=eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here Source=Paul Collins Startup list [Jammer] Confirmed=U Filename=jammer.exe Description=Jammer by Agnitum - "Jammer is the last word in Internet security. It combines a user-friendly interface with very sophisticated and powerful security measures that protect your Windows system while you are surfing the web" Source=Paul Collins Startup list [Java Runtimes] Confirmed=X Filename=iexplore.exe Description=Added as a result of the KILLAV.B VIRUS! Note - this is not the valid IE (iexplore.exe) file as it's located in C:\\Winnt\\Java\\Java rather than C:\\Program Files\\Internet Explorer Source=Paul Collins Startup list [JB] Confirmed=N Filename=Jiffybar.exe Description="Get Paid As You surf" application Source=Paul Collins Startup list [Jet Detection] Confirmed=N Filename=ADGJDet.exe Description=Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection Source=Paul Collins Startup list [JetAdmin Discovery Indicator] Confirmed=Y Filename=HPJETDSC.EXE Description=HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the registry, and remains active to control the Discovery Indicator Source=Paul Collins Startup list [JobHisInit] Confirmed=U Filename=JobHisInit.exe Description=Used by Ricoh network printers to enable network printing from the client Source=Paul Collins Startup list [JogServ2orJog Serve] Confirmed=U Filename=JogServ2.exe Description="Jog Dial" on a Sony Vaio laptop. The dial can select various functions such as control audio. Needed if you use its features Source=Paul Collins Startup list [jotl] Confirmed=? Filename=millenzje.exe Description=?? Source=Paul Collins Startup list [jusched] Confirmed=N Filename=jusched.exe Description=Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel Source=Paul Collins Startup list [jv16 PT TempFileTool] Confirmed=U Filename=TempTool.exe Description=jv16 PowerTools' temporary file remover Source=Paul Collins Startup list [Jv16pt Network Resident] Confirmed=U Filename=jv16pt_network.exe Description=jv16 PowerTools' network resident program. Only needed if you are using the program's network features Source=Paul Collins Startup list [K2ps_full.task] Confirmed=X Filename=K2ps_full.exe Description=Added as a result of the JUNTADOR.K VIRUS! Source=Paul Collins Startup list [K6CPU.EXE] Confirmed=N Filename=K6CPU.EXE Description=Authenticates CPU as K6 in system properties Source=Paul Collins Startup list [kak] Confirmed=X Filename=kak.hta Description=Added as a result of the KAKWORM VIRUS! Source=Paul Collins Startup list [Kalibump] Confirmed=U Filename=Kalibump.exe Description=Used with the now unsupported Kali software for on-line gaming. This is used to automatically bump up the priority of WinProxy to GREATLY improve game speed when using a SOCKS proxy Source=Paul Collins Startup list [Kana Reminder] Confirmed=N Filename=Reminder.exe Description=Kana Reminder is a program which can be used to set a reminder to be triggered at a specified time Source=Paul Collins Startup list [KasperskyAv] Confirmed=X Filename=kaspersky.exe Description=Added as a result of the MIMAIL.T VIRUS! Note - this has nothing to do with the real Kaspersky AntiVirus Source=Paul Collins Startup list [KavRuns] Confirmed=X Filename=Windll.exe Description=Added as a result of the TRYNOMA VIRUS! Source=Paul Collins Startup list [KAVutil] Confirmed=X Filename= Description=Added as a result of the WINTOO.B VIRUS! Source=Paul Collins Startup list [KAZAA] Confirmed=N Filename=kazaa.exe Description=KAZAA is a file-sharing program which unfortunately being ad-based includes "Cy-door" adware. Check here for information about "Cy-door" and here for a program that can remove it Source=Paul Collins Startup list [Kazaa lptt01orKazaa ml097e] Confirmed=X Filename=kazaa.exe Description=Variant of the RapidBlaster parasite (in a "kazaa" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid KaZaA file sharing program which has the same executable name Source=Paul Collins Startup list [KAZAACuf] Confirmed=X Filename=9 Description=Added as a result of the KITRO.D (or ARGEN.A) VIRUS! Source=Paul Collins Startup list [kazaalite] Confirmed=N Filename=kazaalite.exe Description=Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original, this one does not contain any advertising or tracking mechanisms Source=Paul Collins Startup list [KaZooM] Confirmed=N Filename=KaZooM.Exe Description=KaZoom from Blue Haven Media - "add-on application that automatically speeds up the download process and finds the files you want with far more power than regular KaZaA searches" Source=Paul Collins Startup list [KBD] Confirmed=U Filename=KBD.EXE Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [KBD MediaCenter] Confirmed=U Filename=MEDIACTR.EXE Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [kdx] Confirmed=N Filename=KHost.exe Description=KonTiki Secure Delivery Plug In related. "The Kontiki Delivery Management System (DMS) is a secure delivery network for distribution of video, software, audio, documents, and other digital media. The Kontiki DMS enables enterprises to efficiently publish, secure, deliver and track digital media to employees, partners, and customers" Source=Paul Collins Startup list [KE9801] Confirmed=U Filename=DriBat32.exe Description=KE-9801 multimedia keyboard - required if you use the multimedia keys Source=Paul Collins Startup list [Keenvalue] Confirmed=X Filename=Keenvalue.exe Description=Keenvalue spyware - see here Source=Paul Collins Startup list [KEMailKb] Confirmed=U Filename=KEMailKb.EXE Description=Controls the buttons at the top of the Micro Innovations 650i Internet Access Keyboard. If you disable it you cannot use the buttons - like volume control or shut down Source=Paul Collins Startup list [Kemet] Confirmed=? Filename=kemet.exe Description=?? Source=Paul Collins Startup list [Kernel] Confirmed=X Filename=bboy.exe Description=Added as a result of the MUMU.B VIRUS! Source=Paul Collins Startup list [Kernel Loader] Confirmed=X Filename=ntkrnl.exe Description=Added as a result of the CERVIVEC.A VIRUS! Source=Paul Collins Startup list [kernel system daemon] Confirmed=X Filename=ACTIVAT0R.exe Description=Added as a result of the RANDEX.AW VIRUS! Source=Paul Collins Startup list [kernel32] Confirmed=X Filename=kern32.exe Description=Added as a result of the BADTRANS.A VIRUS! Source=Paul Collins Startup list [Kernel32] Confirmed=X Filename=Kernel32.exe Description=Added as a result of a number of VIRUSES - such as BABYLONIA, KERNEL and HOOKER Source=Paul Collins Startup list [kernel32] Confirmed=X Filename=kernel.dli Description=Added as a result of the NETDEVIL.B VIRUS! Source=Paul Collins Startup list [Kernel32] Confirmed=X Filename=Kernel.dll Description=Added as a result of the REDLOF.M VIRUS! Source=Paul Collins Startup list [kernel32] Confirmed=X Filename=kernel32.dlI Description=Added as a result of the NETDEVIL.15 VIRUS! Source=Paul Collins Startup list [Kernel32] Confirmed=X Filename=krnl32.exe Description=Added as a result of the EPON VIRUS! Source=Paul Collins Startup list [kernelfaultcheck] Confirmed=N Filename=dumprep 0 -kdumprep 0 -u Description=Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out Source=Paul Collins Startup list [KernelFaultChk] Confirmed=X Filename=sms.exe Description=Added as a result of the DEADHAT VIRUS! Do not confuse with the valid "kernelfaultcheck" which runs "dumprep 0 -k" or "dumprep 0 -u" Source=Paul Collins Startup list [Kernell32] Confirmed=X Filename=Kernell.dll Description=Added as a result of the DESTINY VIRUS! Source=Paul Collins Startup list [Kernelw] Confirmed=X Filename=Kernelw32.exe Description=Added as a result of the INDOR.E VIRUS! Source=Paul Collins Startup list [Key Text] Confirmed=N Filename=KeyText.exe Description=Key Text 2000 from MJMSoft Design - utility to automate repetitive keyboard tasks. Available via Start -> Programs Source=Paul Collins Startup list [Key1] Confirmed=X Filename=Rlid.exe Description=Added as a result of the LIXY VIRUS! Source=Paul Collins Startup list [Key2] Confirmed=? Filename=serve.exe Description=?? Source=Paul Collins Startup list [KeyAccess] Confirmed=Y Filename=keyacc32.exe Description=KeyServer KeyAccess client software - "when the KeyServer program is launched, the KeyServer process becomes active so license requests from client computers can be serviced. Without KeyAccess, a keyed program cannot run, so license control is very secure" Source=Paul Collins Startup list [Keyboard Manager] Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys. Can also be listed as MULTIMEDIA KEYBOARD Source=Paul Collins Startup list [Keyboard Preload Check] Confirmed=Y Filename=Preload.exe Description=Millenium Multi-Function Keyboard driver Source=Paul Collins Startup list [KeyMaestro] Confirmed=U Filename=kmaestro.exe Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [keymap] Confirmed=U Filename=keymap.exe Description=System Tray utility and background task used by games produced by Kesmai (published by Interactive Magic) and which enables you to program keys to do specific actions during the game Source=Paul Collins Startup list [keymgrldr] Confirmed=X Filename=rundll32 setupapi, InstallHinfSection... keymgr3.inf Description=CoolWebSearch parasite related Source=Paul Collins Startup list [KeyPatrol] Confirmed=U Filename=KeyPatrol.exe Description=KeyPatrol - detects Key Loggers ("keyboard loggers" or "keyloggers") using both behavioral and pattern-matching algorithms Source=Paul Collins Startup list [KeyWallet] Confirmed=U Filename=KWallet.exe Description="KeyWallet is a useful and convenient desktop utility that spares you the trouble of filling in your logins, passwords and other personal data manually" Source=Paul Collins Startup list [kfienq] Confirmed=X Filename=masbl.bat Description=Added as a result of the KIFER VIRUS! Source=Paul Collins Startup list [khooker] Confirmed=N Filename=khooker.exe Description=SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required Source=Paul Collins Startup list [KICKMON.EXE] Confirmed=U Filename=KICKMON.EXE Description=KeepItClean - utility that deletes safe to remove files, cookies, browsing history, etc. This is the scheduler - if you don't schedule clean-ups it isn't required Source=Paul Collins Startup list [Kinberlink] Confirmed=N Filename=Kinberlink.exe Description=Kinberlink network messaging. Available via Start -> Programs Source=Paul Collins Startup list [KK Loader] Confirmed=U Filename=loadkk.exe Description=KeyKey XP Professional from KeyKey.com. "Monitor Instant Messages, Chats, Emails, Web Site URLs, Passwords, Computer Programs, Start Up and Shut Down time and much more completely undetected to the user." Source=Paul Collins Startup list [klp] Confirmed=U Filename=run32dll.exe Description=PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online Source=Paul Collins Startup list [KM9801U] Confirmed=U Filename=MMHotKey.exe Description=Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen Source=Paul Collins Startup list [kmw_run.exe] Confirmed=U Filename=kmw_run.exe Description=Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features Source=Paul Collins Startup list [kmw_show.exe] Confirmed=U Filename=kmw_show.exe Description=Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features Source=Paul Collins Startup list [Kodak Batch Transfer] Confirmed=N Filename=pezdow1.exe Description=Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC Source=Paul Collins Startup list [Kodak Picture Transfer Software] Confirmed=N Filename=pts.exe Description=Looks for Kodak camera connection and media insertion. Available via Start -> Programs Source=Paul Collins Startup list [Kodak Software Updater] Confirmed=N Filename=backweb*****.exe Description=Software updater for Kodak Easyshare digital cameras Source=Paul Collins Startup list [KodakCCS] Confirmed=Y Filename=KodakCCS.exe Description=Kodak DC File System Driver Source=Paul Collins Startup list [Konni Symbol Autostart] Confirmed=N Filename=KonniSymbol.exe Description=Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5 Source=Paul Collins Startup list [kontiki] Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [KREC32] Confirmed=U Filename=krec32.exe Description=StarrCommander Pro Keystroke logging software Source=Paul Collins Startup list [Krnlmod] Confirmed=U Filename=Krnlmod.exe Description=Keylogger - see here. Given a "U" recommendation because it depends if you intentionally installed it. If you didn't, treat it as "X" and uninstall or remove via Spybot S&D (for example) Source=Paul Collins Startup list [kv3000] Confirmed=X Filename=lover.vbe Description=Added as a result of the ZSYANG.B VIRUS! Source=Paul Collins Startup list [LanSpeed2] Confirmed=U Filename=LanSpeed2.exe Description=Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card) Source=Paul Collins Startup list [LapLink scheduler] Confirmed=U Filename=Llsched.exe Description=Utility that automatically performs file transfers as unattended background operations Source=Paul Collins Startup list [Lar] Confirmed=X Filename=Llass.exe Description=Added as a result of the INOR-A VIRUS! Source=Paul Collins Startup list [lar] Confirmed=X Filename= Description=Added as a result of the ROXY.C VIRUS! Source=Paul Collins Startup list [Lasb] Confirmed=? Filename=ewat.exe Description=?? Source=Paul Collins Startup list [LAsIAf32] Confirmed=X Filename=RePEAtLD.exe Description=Added as a result of the REPEATLD VIRUS! Source=Paul Collins Startup list [LASTinst] Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Later] Confirmed=? Filename=later.exe Description=?? Source=Paul Collins Startup list [Launcg] Confirmed=? Filename=launcg.exe Description=?? Source=Paul Collins Startup list [Launch YahooPOPs! at Windows startup] Confirmed=N Filename=YAHOOPOPS.EXE Description=YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs Source=Paul Collins Startup list [LaunchAp] Confirmed=U Filename=LaunchAp.exe Description=Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Source=Paul Collins Startup list [Launchboard] Confirmed=U Filename=lnchbrd.exe Description="LaunchBoard software from Darwin turns your keyboard into a remote control for the Internet and your computer! With LaunchBoard 2.0, you can customize up to 38 keys on your PC keyboard to instantly launch Web Sites, start applications, perform custom macros, handle Windows shortcuts, store passwords, and perform loads of other customizable functions" Source=Paul Collins Startup list [Launcher] Confirmed=X Filename=launcher.exe Description=Spyware component related to DownloadWare and found in Program FilesKFH Source=Paul Collins Startup list [Launcher] Confirmed=N Filename=relaunch.exe Description=Audio Applications Launcher for the Philips Rythmiic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtray). Available via Start -> Programs Source=Paul Collins Startup list [Lavasoft Adwatch] Confirmed=U Filename=Ad-watch.exe Description=Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system Source=Paul Collins Startup list [laxmsp32.exe] Confirmed=Y Filename=laxmsp32.exe Description=Lexmark Scan and Copy Control Program for the X63 (and maybe others) printer/scanner. Required for the scanner to work Source=Paul Collins Startup list [LCDC] Confirmed=U Filename=LCDC.exe Description=LCDC is an application that displays various information on your LCD or VFD screen. The number of things that LCDC can do is expandable by Plugins Source=Paul Collins Startup list [lcfep] Confirmed=N Filename=lcfep.exe Description=Tivoli �TME� System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally" Source=Paul Collins Startup list [ld] Confirmed=X Filename=ld.exe Description=CoolWebSearch parasite related - redirects to fastwebfinder.com Source=Paul Collins Startup list [LDM] Confirmed=N Filename=backweb-8876480.exeldmconf.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech. Also listed under Logitech Desktop Messenger Source=Paul Collins Startup list [LED TRAY] Confirmed=U Filename=LEDTRAY.EXE Description=Installs a USB compact flash card reader or drive on start-up. The device is distributed by Microtech and is made by a company called SnapShot. Required if you want the reader to work Source=Paul Collins Startup list [LeechGet] Confirmed=N Filename=LeechGet.exe Description=LeechGet download manager Source=Paul Collins Startup list [LetsSearch] Confirmed=X Filename=LetsSearch.exe Description=BrowserAid/BrowserPal foistware variant Source=Paul Collins Startup list [Lexmark X5100 Series] Confirmed=U Filename=lxbabmgr.exe Description=System Tray application that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark X74-X75] Confirmed=U Filename=lxbabmgr.exe Description=System Tray application that enables scan or fax functions to run directly from the printer via the buttons. Can be launched from a desktop shortcut Source=Paul Collins Startup list [Lexmark Xxx Button Manager] Confirmed=Y Filename=AcBtnMgr_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [Lexmark Xxx Button Monitor] Confirmed=Y Filename=ACMonitor_Xxx.exe Description=Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation Source=Paul Collins Startup list [LexmarkPrinTray] Confirmed=N Filename=printray.exe Description=Lexmark Printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. Can also be listed as PrinTray Source=Paul Collins Startup list [lexpps] Confirmed=N Filename=lexpps.exe Description=For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC, the file is not used, (or should not be used) at all". It is known that firewalls can however alert you to "lexpps.exe" requesting server privileges Source=Paul Collins Startup list [LexStart] Confirmed=U Filename=lexstart.exe Description=Lexmark printer software may add Lexstart.exe in the startup folder to handle print commands that you send to the printer. Sometimes required for the printer to work correctly - not in the case of a Lexmark Z42 for instance Source=Paul Collins Startup list [Lfsndmng] Confirmed=U Filename=lfsndmng.exe Description=LightningFAX Enterprise Fax Server - "puts faxing at the fingertips of networked enterprise users. It enables rapid, secure sending and Direct-To-Desktop Delivery of mission-critical documents" Source=Paul Collins Startup list [lhttseng] Confirmed=N Filename=rundll32.exe ..lhttseng.inf, RemoveCabinet Description=Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine Source=Paul Collins Startup list [li-multi****] Confirmed=X Filename=li-multi****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-speed****] Confirmed=X Filename=dlres.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-thund****] Confirmed=X Filename=li-thund****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [li-vita****] Confirmed=X Filename=li-vita****.exe Description=Adult web-dialler - **** is random Source=Paul Collins Startup list [LicCrtl] Confirmed=N Filename=runservice.exe Description=eLicense, licensing system incorporated with some software and games Source=Paul Collins Startup list [LifeScape Media Detector] Confirmed=N Filename=PicasaMediaDetector.exe Description=Media detector for Picasa's automatic photo organizer Source=Paul Collins Startup list [Line Speed Meter V3.0] Confirmed=N Filename=LineSpeedMeter.exe Description=LineSpeedMeter - detect the download and upload speed of your internet connection Source=Paul Collins Startup list [Linksts] Confirmed=N Filename=linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [Linksts] Confirmed=X Filename=linksts.exe Description=Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon Source=Paul Collins Startup list [LiquidView] Confirmed=U Filename=lviewj.exe Description="Liquid View lets you increase the legibility of the Microsoft Windows interface regardless of your display's native resolution. The software lets you increase the size of items that are hard to read on your monitor" Source=Paul Collins Startup list [LIU] Confirmed=N Filename=LIU.exeRubicon.exe Description=Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway Source=Paul Collins Startup list [Live Menu] Confirmed=N Filename=Dllcmd32.exe Description=eFax Send button for eFax Messenger Plus. Available via Start -> Programs Disabling instructions available here Source=Paul Collins Startup list [LiveMonitor] Confirmed=N Filename=LMonitor.exe Description=MSI Live Update2 - auto-detects and suggests the latest BIOS/Driver/Utilities information Source=Paul Collins Startup list [LiveNote] Confirmed=N Filename=Livenote.exe Description=Asus graphics card driver live update feature Source=Paul Collins Startup list [LLMODCL2] Confirmed=? Filename=rundll.exe setupx.dll, InstallHinfSection ..LLMODCL2.INF Description=?? Source=Paul Collins Startup list [LManager] Confirmed=U Filename=QtZgAcer.EXE Description=Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio Source=Paul Collins Startup list [lmpdpsrv] Confirmed=? Filename=lmpdpsrv.exe Description=Related to a Lexmark printer/scanner. Printer sharing server? Is it required? Source=Paul Collins Startup list [LMSTATUS] Confirmed=N Filename=LMSTATUS.EXE Description=Lexmark Status Monitor. Checks the current status of Lexmark printers (and other devices?) Source=Paul Collins Startup list [lnternet Explorer] Confirmed=X Filename=AMSNDMGR.EXE Description=Added as a result of the KWBOT.R VIRUS! Note that the "l" is a lower case "L" and not an upper case "I" Source=Paul Collins Startup list [LOAD WB] Confirmed=U Filename=LOADWB.EXE Description=Part of Stardock's WindowBlinds custom desktop program. "WindowBlinds is the first utility of its kind. It extends Win98/NT/2K/XP to have a fully skinnable user interface. You can change the style of title bars, buttons, toolbars and much more". If you use it - keep it if not then uninstall it Source=Paul Collins Startup list [LOAD32] Confirmed=X Filename=Lorena.exe Description=Added as a result of the MAPSON.C VIRUS! Source=Paul Collins Startup list [load32] Confirmed=X Filename=load32.exe Description=Added as a result of the NIBU, BAMBO and DUMARU VIRUSES! Source=Paul Collins Startup list [load32] Confirmed=X Filename=l32x.exe Description=Added as a result of the DUMARU.Z or DUMARU.Y or DUMARU.AD VIRUSES! Source=Paul Collins Startup list [load32] Confirmed=X Filename=1111a.exe Description=Added as a result of the DUMARU.AH VIRUS! Source=Paul Collins Startup list [load=] Confirmed=N Filename=adw30.exe Description=After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95 Source=Paul Collins Startup list [load=] Confirmed=U Filename=asistat.exe Description=Status monitor for an NEC SuperScript printer Source=Paul Collins Startup list [load=] Confirmed=? Filename=cfgsys32.exe Description=?? Source=Paul Collins Startup list [load=] Confirmed=U Filename=esspk.exe Description=Speakerphone capability through a soundcard for an ESS modem Source=Paul Collins Startup list [load=] Confirmed=Y Filename=hotkey.exe Description=Solo 5300 display driver for Win2K on some Gateway laptops Source=Paul Collins Startup list [load=] Confirmed=N Filename=HPWHRC.EXE Description=Loads the Status Window software for the HP Laserjet printers Source=Paul Collins Startup list [load=] Confirmed=? Filename=WPSLOAD.EXE Description=Related to a Canon BJ C series printer? Source=Paul Collins Startup list [load=] Confirmed=N Filename=vi_grm.exe Description=Monitor drivers for Trio2x/3x based video cards - displays control panel for quick access to display settings Source=Paul Collins Startup list [load=] Confirmed=? Filename=WINOSCFG.EXE Description=Could it be something to do with configuring Windows on a new PC from an OEM supplier? Source=Paul Collins Startup list [load=] Confirmed=Y Filename=wpshrc.exe Description=Required to prevent configuration errors on a Compaq LBP-660 parallel port laser printer (and maybe others) Source=Paul Collins Startup list [load=] Confirmed=Y Filename=Bfrecv.exe Description=Bitware modem driver Source=Paul Collins Startup list [load=] Confirmed=X Filename=msater.exe Description=Added as a result of the RETSAM VIRUS! Source=Paul Collins Startup list [load=] Confirmed=X Filename=shambl3r.exe Description=Added as a result of the REMABL VIRUS! Source=Paul Collins Startup list [load=] Confirmed=X Filename=Spoolsv.exe Description=Added as a result of the CIADOOR.B VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [Load=] Confirmed=? Filename=wtfeat.exe Description=?? Source=Paul Collins Startup list [load=] Confirmed=Y Filename=AICLIENT.EXE Description=Asset Insight from Tangram - asset managing software. Required if an organisation is running a centrally administered asset management system Source=Paul Collins Startup list [LoadBlackD] Confirmed=Y Filename=blackd.exe Description=This is the "intrusion detection system" of the BlackICE PC Protection (was Defender) firewall which loads independently of the "user interface" (BlackICE Utility) Source=Paul Collins Startup list [LoadBtnHnd] Confirmed=? Filename=BtnHnd.exe Description=Fujitsu LifeBook related Source=Paul Collins Startup list [LoadDBackUp] Confirmed=X Filename=BcTool.exe Description=Added as a result of the GIBE VIRUS! Source=Paul Collins Startup list [LoadDvpApi9x] Confirmed=? Filename=DVPAPI9X.exe Description=Part of Command AntiVirus for Windows 95/98/Me. Is it needed? Source=Paul Collins Startup list [loader] Confirmed=X Filename=loader.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com. Downloader for iedll.exe Source=Paul Collins Startup list [loader] Confirmed=X Filename=WMPLAYER.EXE Description=Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup Source=Paul Collins Startup list [LoadFonts] Confirmed=X Filename=LoadFonts.vbsTahoma.vbs Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [LoadHTML] Confirmed=X Filename=rundll32.exe mshtmpre.dll, MShtmpre Description=Browser hijacker Source=Paul Collins Startup list [LoadingAgent] Confirmed=X Filename=ZipLoader32.exemsload32.exe Description=Added as a result of the OBLIVION VIRUS! The two executables shown are the most common but there are more Source=Paul Collins Startup list [LoadManager] Confirmed=X Filename=msload.exe Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [LoadMSvcmm] Confirmed=N Filename=msvcmm32.exe Description=Auto-update for Movielink - internet movie rental System Tray access Source=Paul Collins Startup list [LoadOrderVerification] Confirmed=X Filename=*.exe Description=Added as a result of the TRON VIRUS! * is a random file name, possibly Pthymvfr.exe Source=Paul Collins Startup list [Loadout Manager] Confirmed=U Filename=nost_LM.exe Description=Manager for the Belkin Nostromo n50 SpeedPad game controller - see here Source=Paul Collins Startup list [LoadPowerProfile] Confirmed=X Filename=ASDAPI.EXE Description=Added as a result of the CABRO VIRUS! Not to be confused with the valid entry below Source=Paul Collins Startup list [LoadPowerProfile] Confirmed=U Filename=Rundll32.exe powrprof.dll Description=Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your selected power scheme. May not be required - depends upon whether you modify the default Control Panel -> Power Options settings Source=Paul Collins Startup list [LoadPowerProfile] Confirmed=X Filename=Rundll.exe powerprof.dll Description=Added as a result of the LOXOSCAM VIRUS! Note - do not confuse with the valid LoadPowerProfile entry above! Notice that the infected version uses "Rundll.exe" whereas the uninfected version uses "Rundll32.exe" Source=Paul Collins Startup list [LoadPowerProfile] Confirmed=X Filename=rundl.exe Description=Added as a result of the TOFAZZOL VIRUS! Note - do not confuse with the valid LoadPowerProfile entry above! Source=Paul Collins Startup list [LoadPowerProfile] Confirmed=X Filename=Rundll32.exe Description=Added as a result of the MIROOT VIRUS! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line Source=Paul Collins Startup list [LoadQM] Confirmed=U Filename=loadqm.exe Description=Installed with MSN Explorer and loads the MSN Queue Manager. Required to enable the WU AutoUpdate feature. Note that disabling this can sometimes prevent internet sharing working on Win2K Pro SP2. Reports also suggest that removing it will re-enable internet access - hence the "users choice" recommendation. If you have problems leave it, otherwise I recommend you disable it Source=Paul Collins Startup list [LoadWatcher] Confirmed=? Filename=Test.exe Description=Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct? Source=Paul Collins Startup list [LoadWindowsFile] Confirmed=X Filename= Description=Added as a result of the DELF.B VIRUS! where <filename> is the infected file Source=Paul Collins Startup list [Login] Confirmed=U Filename=winlog.exe Description=Salfeld Child Control 2003 - parental control software Source=Paul Collins Startup list [Login Service] Confirmed=X Filename= Description=Added as a result of the MIGMAF VIRUS! Source=Paul Collins Startup list [LoginPassport] Confirmed=X Filename=Lgnpsp32.exe Description=Added as a result of the REDIST.C VIRUS! Source=Paul Collins Startup list [Logitech Desktop Messenger] Confirmed=N Filename=backweb-8876480.exeldmconf.exe Description=Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech Source=Paul Collins Startup list [Logitech Utility] Confirmed=U Filename=Logi_MwX.exe Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [Logitech Wakeup] Confirmed=N Filename=lgwakeup.exe Description=Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images Source=Paul Collins Startup list [LogitechGalleryRepair] Confirmed=U Filename=ISStart.exe Description=Part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 - hence the "U" rather than "Y" recommendation Source=Paul Collins Startup list [LogitechImageStudioTray] Confirmed=N Filename=LogiTray.exe Description=Logitech Image Studio - installed with Logitech QuickCams Source=Paul Collins Startup list [LogiTray] Confirmed=N Filename=LogiTray.exe Description=Logitech Image Studio - installed with Logitech QuickCams Source=Paul Collins Startup list [Logi_Mwx] Confirmed=U Filename=Logi_MwX.exe Description=Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled Source=Paul Collins Startup list [Logon.exe] Confirmed=X Filename=logon.exe Description=Homepage hijacker Source=Paul Collins Startup list [LogonStudio] Confirmed=U Filename=logonstudio.exe Description=WinCustomize LogonStudio - "Allows Windows XP users to edit, change, and apply new logon screens. LogonStudio comes built with a visual editor to make it easy to create your own logons which can then be uploaded to websites to be used by others users" Source=Paul Collins Startup list [LogWatch] Confirmed=U Filename=logwat95.exe Description=Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll - see here. Not required if you already have a newer version or the patch has been applied Source=Paul Collins Startup list [Look 'n' Stop] Confirmed=Y Filename=looknstop.exe Description=Look 'n' Stop personal firewall Source=Paul Collins Startup list [Lookup_Sys] Confirmed=X Filename=lookupsys.exe Description=P04n trojan Source=Paul Collins Startup list [Lotus Organizer EasyClip] Confirmed=N Filename=easyclip.exe Description="The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address, appointment, task or Notepad page." Available via Start -> Programs Source=Paul Collins Startup list [Lotus QuickStart] Confirmed=N Filename=smartctr.exe Description=Lotus central application, called SmartCenter, which runs on the Windows desktop. SmartCenter toolbar stretches across the top or, optionally, the bottom of the screen. Uses a lot of resources. Available via Start -> Programs Source=Paul Collins Startup list [Lotus SuiteStart] Confirmed=U Filename=suitest.exe Description=Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs Source=Paul Collins Startup list [LowVersionSupport] Confirmed=X Filename= Description=Added as a result of the LASTRAS VIRUS! where <filename> is the name of the file dropped by the virus Source=Paul Collins Startup list [LPS] Confirmed=U Filename=Lps.exe Description=Local Port Scanner - "With LPS you're able to check your computer for open or listening ports" Source=Paul Collins Startup list [LS120 Superdisk] Confirmed=N Filename=?? Description=Supposed to accelerate transfer rate on LS-120, contributes to system lockups Source=Paul Collins Startup list [lsass] Confirmed=X Filename=lsass.exe Description=Added as a result of the RATSU.B VIRUS! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [lsass] Confirmed=X Filename=start.bat Description=Added as a result of the ZCREW VIRUS! Source=Paul Collins Startup list [lsass] Confirmed=X Filename= Description=Added as a result of the ALADINZ.F VIRUS! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [LSPFixorLSPmonitor] Confirmed=X Filename=LSPmonitor.exe Description=eAcceleration Stop-Sign related - foistware. Read their privacy statement here Source=Paul Collins Startup list [LSvr] Confirmed=X Filename=LSvr.exe Description=PowerStrip foistware Source=Paul Collins Startup list [LT DAEMON] Confirmed=Y Filename=ltdaemon.exe Description=Acts as a data spooler for the DSL modem (similar to a cache). Do not uncheck if the DSL modem is being used Source=Paul Collins Startup list [LTDMgr] Confirmed=X Filename=LTDMgr.exe Description=PowerStrip foistware Source=Paul Collins Startup list [LTM2] Confirmed=X Filename=MSGSRV32.EXEMPGSRV32.EXEMSGSRV320.EXEwinupdate.exebible.exe Description=All added by variants of the LITMUS VIRUS!. See here for MSGSRV32.EXE (Note: MSGSRV32.EXE in this case is in a Litmus sub-directory and is not to be confused with the valid version in C:\\Windows\\System), here for MPGSRV32.EXE, here for MSGSRV320.EXE and here for winupdate.exe and bible.exe Source=Paul Collins Startup list [LtMoh] Confirmed=U Filename=Ltmoh.exe Description=Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet Source=Paul Collins Startup list [LTSMMSG] Confirmed=N Filename=LTSMMSG.exe Description=Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook, Acer and Sony Vaio notebooks, maybe others too Source=Paul Collins Startup list [LTSMSG] Confirmed=X Filename=Shell32.exe Description=Added as a result of the LEMIR.B VIRUS! Source=Paul Collins Startup list [LTWinModem1] Confirmed=Y Filename=ltmsg.exe Description=One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [LVComs] Confirmed=N Filename=lvcoms.exe Description=Lvcomm server. Related to Logitech Quick Cam - works fine without it Source=Paul Collins Startup list [LWBMOUSE] Confirmed=U Filename=lwbwheel.exeMOUSE32A.EXE Description=Mouse driver - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Lwinst Run Profiler] Confirmed=N Filename=lwtest.exe Description=Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs Source=Paul Collins Startup list [lxamsp32] Confirmed=? Filename=lxamsp32.exe Description=Associated with a Lexmark Printer - is it required? Source=Paul Collins Startup list [LXbbmgr] Confirmed=? Filename=LXbbmgr.exe Description=Lexmark printer button manager? Is it required? Source=Paul Collins Startup list [LXSUPMON] Confirmed=N Filename=LXSUPMON.EXE Description=Lexmark Printer. The printer should work fine without it Source=Paul Collins Startup list [M Player Post Installer] Confirmed=? Filename=postinstallm.exe Description=?? Source=Paul Collins Startup list [M3Tray] Confirmed=N Filename=m3tray.exe Description=Movielink - internet movie rental System Tray access Source=Paul Collins Startup list [Machine Debug Manager] Confirmed=U Filename=mdm.exe Description=Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as MDM7. See here to disable Source=Paul Collins Startup list [MacLic] Confirmed=N Filename=MacLic.exe Description=Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks Source=Paul Collins Startup list [MacName] Confirmed=N Filename=MacName.exe Description=Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks Source=Paul Collins Startup list [MAD.EXE] Confirmed=Y Filename=MAD.EXE Description=MAD.exe is the MS Exchange 5.5 System Attendant and can also consume a large amount of resources - resolved by the latest Exchange 5.5 Service Pack. Also part of Exchange 2000 Server but does it have the same problems?. Apparently you need to leave this running but is it needed at start-up? Source=Paul Collins Startup list [MadExe] Confirmed=N Filename=LaunchRA.exe Description=Dell Resolution Assistant Source=Paul Collins Startup list [MagicDsk] Confirmed=U Filename=MAGICDSK.EXE Description=Magic DeskTop is a small and novel utility which will allow you the option of hiding or showing your desktop icons Source=Paul Collins Startup list [Magitime] Confirmed=N Filename=Magitime.exe Description=Magitime - connection tracking utility which monitors online time, expense, data transfer Source=Paul Collins Startup list [Mail.com] Confirmed=? Filename=mcalert.exe Description=Mail.com - free web-mail service. Does mcalert.exe notify you when new mail has arrived? Source=Paul Collins Startup list [MailBell] Confirmed=U Filename=mailbell.exe Description=MailBell e-mail notification tool that will notify you about new messages arrived to your mailbox. Works with both POP3 mailboxes and web-mail based systems. You should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) Source=Paul Collins Startup list [Mailbox Verifier] Confirmed=U Filename=mboxvrfy.exe Description=Mailbox Verifier (MV) is free software that will notify you about new messages arrived to your mailbox. Only works with POP3 mailboxes (not web-mail based systems). You should be able to set your mail system to check all accounts at regular intervals anyway if you prefer (in Outlook for instance) Source=Paul Collins Startup list [MailScan Dispatcher] Confirmed=Y Filename=Launch.exe Description=MailScan Dispatcher splits each e-mail message into various components such as the header, body and attachment. Compressed formats (ZIP, ARJ, etc.) are scanned for viruses and cleaned Source=Paul Collins Startup list [Mail_Check] Confirmed=X Filename=Mail_Check.exe Description=Added as a result of the PANOIL.C VIRUS! Source=Paul Collins Startup list [MAIN] Confirmed=U Filename=main.exe Description=SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Source=Paul Collins Startup list [Main Executable (HP)] Confirmed=? Filename=HP05T0R5.exe Description=HP (Hewlett-Packard) related. Maybe related to printers. Now - what does it do? Source=Paul Collins Startup list [Mania Win Restore] Confirmed=N Filename=RESWIN.EXE Description=Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs Source=Paul Collins Startup list [Mantis] Confirmed=X Filename= Description=Added as a result of the MANTIBE VIRUS! where <filename> is the filename Source=Paul Collins Startup list [mapisvc32] Confirmed=X Filename=mapisvc32.exe Description=Added as a result of the KX VIRUS and also recognised by Symantec as FPAI adware Source=Paul Collins Startup list [Mass storage check registry] Confirmed=N Filename=rundll32.exe MSDServ.dll, check registry Description=Used with a USB based smartmedia card reader Source=Paul Collins Startup list [Master Volume Spy] Confirmed=U Filename=MASTERVOLUMESPY.EXE Description=Volume control for the Gateway Destination "DestiVu" media interface Source=Paul Collins Startup list [Matador] Confirmed=U Filename=mlfbuddy.exe Description=MailFrontier - anti-spam application Source=Paul Collins Startup list [MatrixScreenSaver] Confirmed=X Filename=mss.exe Description=Malware, see here Source=Paul Collins Startup list [Matrox Color Control] Confirmed=N Filename=hgcctl95.exe Description=For Matrox video cards. Quick access to changing colors Source=Paul Collins Startup list [Matrox Control Center] Confirmed=N Filename=mgactrl.exe Description=For Matrox video cards. Quick access to settings Source=Paul Collins Startup list [Matrox Diagnostic] Confirmed=N Filename=mgadiag.exe Description=For Matrox video cards. Quick access to diagnostics Source=Paul Collins Startup list [Matrox Powerdesk] Confirmed=N Filename=PDesk.exe Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [Matrox QuickDesk] Confirmed=N Filename=mgaqdesk.exe Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [MaxAlerts] Confirmed=X Filename=max.exe Description=Bonzi MaxALERT - spyware Source=Paul Collins Startup list [MaxtorCombo] Confirmed=Y Filename=ComboButton.exe Description=Required to be able to use the Maxtor OneTouch button on your external Maxtor harddrive. It is used to start up backup software (Retrospect) Source=Paul Collins Startup list [MaxtorReg] Confirmed=U Filename=AUTOREG.EXE Description=Part of SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of Source=Paul Collins Startup list [MBM 4] Confirmed=U Filename=MBM4.exe Description=Motherboard Monitor 4 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs Source=Paul Collins Startup list [MBM 5] Confirmed=U Filename=MBM5.exe Description=Motherboard Monitor 5 - as above but for version 5 Source=Paul Collins Startup list [MBProbe] Confirmed=U Filename=mbrpobe.exe Description=MBProbe - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs Source=Paul Collins Startup list [MC] Confirmed=X Filename=wintrims.exe Description=Added as a result of the WINTRIM VIRUS! Source=Paul Collins Startup list [McAfee Firewall] Confirmed=Y Filename=CPD.EXE Description=Firewall bundled with McAfee VirusScan 6.*. Can also be listed as CPD_EXE Source=Paul Collins Startup list [McAfee Guardian] Confirmed=N Filename=CMGRDIAN.EXE Description=McAfee's QuickClean, an offline version of the one in their online Clinic. Normally run offline and not needed. Incidentally, incorporates more cleanup programs than the likes of WinOptimizer and System Mechanic Source=Paul Collins Startup list [McAfee Winguage] Confirmed=N Filename=?? Description=Part of McAfee Nuts & Bolts. "WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [McAfee.InstantUpdate.Monitor] Confirmed=U Filename=RuLaunch.exe Description=Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Source=Paul Collins Startup list [McAfeeUpdaterUI] Confirmed=? Filename=UpdaterUI.exe Description=Associated with McAfee Enterprise 7.0.0. Updater for McAfee anti-virus and security programs? Source=Paul Collins Startup list [McAfeeVirusScanService] Confirmed=Y Filename=Avsynmgr.exe Description=From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe), WebScanX (Webscanx.exe), VirusScan System Scan (Vshwin32.exe) and VirusScan Console (Avconsol.exe) under one application Source=Paul Collins Startup list [McAfeeWebscanX] Confirmed=Y Filename=WebScanX.exe Description=From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [McAgentExe] Confirmed=U Filename=mcagent.exe Description=From McAfee VirusScan On-line. The Agent is a red M icon that appears in the Windows system tray or Notification Area (if you're running Windows XP). If you don't see the agent icon, VirusScan Online may not be installed Source=Paul Collins Startup list [Mcappins.exe] Confirmed=? Filename=mcappins.exe Description=McAfee Application Installer. What does it do and is it required? Source=Paul Collins Startup list [MChanger] Confirmed=N Filename=MChanger.exe Description=Media Changer - utility that allows you to change wallpapers, sounds, themes, etc Source=Paul Collins Startup list [McRegWiz] Confirmed=? Filename=mcregwiz.exe Description=McAfee antivirus related. What does it do and is it required? Source=Paul Collins Startup list [McUpdateExe] Confirmed=U Filename=mcupdate.exe Description=From McAfee VirusScan On-line. Automatically updates your virus definitions. Leave enabled unless you regularly update these definitions Source=Paul Collins Startup list [McVsRte] Confirmed=Y Filename=mcusrt.exe Description=Part of McAfee's SecurityCenter. Must remain checked but one user reports Windows glitches with no response from McAfee as to why Source=Paul Collins Startup list [mcvsshld] Confirmed=Y Filename=mcvsshld.exe Description=McAfee VirusScan On-line. See also McAgentExe above Source=Paul Collins Startup list [MD IE Plugin] Confirmed=X Filename=md.exe Description=Adult content dialler Source=Paul Collins Startup list [MD IE Plugin] Confirmed=X Filename=winy.exe Description=Adware Source=Paul Collins Startup list [mdac_runonce] Confirmed=N Filename=runonce.exe Description=Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe". Source=Paul Collins Startup list [Mdm] Confirmed=X Filename=Mdm.vbs Description=Added as a result of the WHITEHO or TRAPPY VIRUSES! Source=Paul Collins Startup list [MDM7] Confirmed=U Filename=mdm.exe Description=Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to "hang" if you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as Machine Debug Manager. See here to disable Source=Paul Collins Startup list [MECA] Confirmed=N Filename=Meca.exe Description=Meca instant messenging client Source=Paul Collins Startup list [Media Manager Indexer] Confirmed=U Filename=AIRSVCU.EXE Description=Part of MS Visual InterDev, Media Manager is an easy media file management system that works in conjunction with Windows Explorer. The Media Manager Indexer is a program that indexes all the information about your media files and puts it into a database. For more information see here Source=Paul Collins Startup list [Media Plug x.1.2] Confirmed=X Filename=msdm.exe Description=Added as a result of the MULDROP.352 VIRUS! Source=Paul Collins Startup list [MediaFace Integration] Confirmed=N Filename=Sethook.exe Description=Fellowes Neato� cd label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" Source=Paul Collins Startup list [Mediafour Mac Volume Notifications] Confirmed=U Filename=Macvntfy.exe Description=Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod Source=Paul Collins Startup list [Mediafour XPlay Tray Notification Icon] Confirmed=U Filename=Xptryicn.exe Description=See above Source=Paul Collins Startup list [MediaKey] Confirmed=U Filename=MediaKey.exe Description=Multimedia keyboard manager. Required if you use the multimedia keys Source=Paul Collins Startup list [MediaLoadsorMediaLoads Installer] Confirmed=X Filename=dw.exe Description=Medialoads is advertising software - running DownloadWare as its executable. Installed as a bundle with Kazaa Media Desktop. See here for more information Source=Paul Collins Startup list [MediaMonitor] Confirmed=N Filename=Mediam~1.exe Description=Installed by Smartdisk MVP CD burning software. Software will work fine without it Source=Paul Collins Startup list [MediaPath] Confirmed=X Filename=Proyecto1.exeRoot.exe Description=Added as a result of the GRUEL VIRUS! Source=Paul Collins Startup list [MediaRing Talk] Confirmed=N Filename=mrtalk.exe Description=Media Ring Talk, voice recognition software, Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [media_manager] Confirmed=X Filename=mediaman.exe Description=Mini-Player, IMESH related foistware, see here Source=Paul Collins Startup list [media_stub] Confirmed=X Filename=stub.exe Description=Mini-Player, IMESH related foistware, see here Source=Paul Collins Startup list [MemConfig] Confirmed=X Filename=SetupIE.com Description=Added as a result of the TAPLAK VIRUS! Source=Paul Collins Startup list [MemoKit] Confirmed=U Filename=MK.EXE Description=Memory optimizer. It loads from startup group and it goes off as soon as the program (memokit.exe) is loaded in the System Tray. Mk.exe does not run while the memokit.exe is running. Probably loads a flash screen at startup and shutdown that stays on screen less than 5 seconds and gives you a button to push to purchase the full version. MS professionals recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [Memory Check] Confirmed=X Filename=memore.exe Description=Added as a result of the KILLAV.C VIRUS! Source=Paul Collins Startup list [Memory Stick Monitor] Confirmed=N Filename=MSTAT.exe Description=Used with the Sony floppy disk adapter for memory sticks, showing if there is a stick in the computer Source=Paul Collins Startup list [Memory Stick Monitor] Confirmed=U Filename=MSstat.exe Description=Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive Source=Paul Collins Startup list [Memory+] Confirmed=U Filename=tfimemsr.exe Description=Memory optimizer. MS professionals recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [MemoryMeter] Confirmed=X Filename=MemoryMeter.exe Description=Autoinstalling spyware by Total Velocity Source=Paul Collins Startup list [MemTurbo] Confirmed=U Filename=memturbo.exe Description=MemTurbo memory optimizer. MS professionals recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind Source=Paul Collins Startup list [MenuSnap] Confirmed=N Filename=MenuSnap.exe Description=MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe Source=Paul Collins Startup list [Message Queuing] Confirmed=X Filename=msmqs.exe Description=Added as a result of the FREEFORS VIRUS! Source=Paul Collins Startup list [MessagerStarter Freeserve] Confirmed=N Filename=StartMessager.exe Description=Freeserve Messenger Source=Paul Collins Startup list [Message_Blocker] Confirmed=U Filename=messageblock.exe Description=Message Blocker - "prevents Outlook Express from loading images or other content from the internet without confirmation, as well as executing scripts when displaying a formatted email message" Source=Paul Collins Startup list [Messenger] Confirmed=X Filename=messenger.exe Description=Added as a result of the KUTEX VIRUS! Source=Paul Collins Startup list [Messenger Block] Confirmed=X Filename=msngrblock.exe Description=Added as a result of the PATOO VIRUS! Source=Paul Collins Startup list [Messenger start-up] Confirmed=X Filename=Msgran.exe Description=Added as a result of the GRAMOS VIRUS! Source=Paul Collins Startup list [MessengerPlusorMessengerPlus2] Confirmed=N Filename=MsgPlus.exe Description=Third party MSN Messenger extension that hides banner ads and adds archiving and other useful features. Appears not to work unless checked, but may be activated after startup. Not recommended as it includes Lop.com - see here Source=Paul Collins Startup list [messnger] Confirmed=X Filename= Description=Added as a result of the DELODER VIRUS! where <filename> is the worm name Source=Paul Collins Startup list [mfgboot] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [mfin32] Confirmed=X Filename=mfin32.exe Description=MyFreeInternetUpdate - adware downloader Source=Paul Collins Startup list [MGA Hook] Confirmed=? Filename=Mgahook.exe Description=MATROX Graphics card related. What does it do and is it required? Source=Paul Collins Startup list [MGA Quickdesk] Confirmed=N Filename=MGAQDESK.EXE Description=For Matrox video cards. Quick access to tweak your card to your liking Source=Paul Collins Startup list [Mgabg] Confirmed=? Filename=Mgabg.exe Description=Matrox BIOS Guard. What does it do and is it required? Source=Paul Collins Startup list [mgavctrlormgavrtclexe] Confirmed=Y Filename=mgavrtcl.exemgavrte.exe Description=McAfee's Virus Scan Online Source=Paul Collins Startup list [MGA_CD_Install] Confirmed=N Filename=mgasetup.exe Description=Matrox Millennium video driver. Not required once drivers installed Source=Paul Collins Startup list [MHDOGStart] Confirmed=X Filename=mhdogst.EXE Description=Added as a result of an unidentified VIRUS! A possibility is a trojan known as PENIS Source=Paul Collins Startup list [MHINIT] Confirmed=N Filename=MHINIT.EXE Description=Part of the Cybermedia Clean Sweep package Source=Paul Collins Startup list [Microangelo Desktop] Confirmed=U Filename=Muamgr.exe Description=Quick access to MicroAngelo 5.0. It can make the background of the icon text transparent and also change the color of the shortcut's text to a color you want. Very useful, if you have a wallpaper. Available via Start -> Programs Source=Paul Collins Startup list [microAttuneDownload] Confirmed=N Filename=atmdlusr.exe Description=USR (US Robotics) modem auto updater. May be a sub-set of Attune Source=Paul Collins Startup list [MicroDialler] Confirmed=U Filename=atdialler1.exe Description=Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered Source=Paul Collins Startup list [Microfinder lptt01orMicrofinder ml097e] Confirmed=X Filename=mcf.exe Description=Variant of the RapidBlaster parasite (in a "mcf" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [MicroLoad] Confirmed=X Filename= Description=Added as a result of the DARBY VIRUS! Source=Paul Collins Startup list [microsoft] Confirmed=X Filename=svchost.exe Description=Added as a result of the ASTEF or RESPAN VIRUSES! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [Microsoft .NET Confingurator] Confirmed=X Filename=msnconf.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Microsoft Announcement Listener] Confirmed=N Filename=Annclist.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Microsoft auto update] Confirmed=X Filename=winupdate.exe Description=Added as a result of the BMBOT VIRUS! Source=Paul Collins Startup list [Microsoft Conf Ldr] Confirmed=X Filename=sysconf.exe Description=Added as a result of a variant of the SDBOT VIRUS! Source=Paul Collins Startup list [Microsoft Corporation] Confirmed=X Filename= Description=Added as a result of various VIRUSES such as VISAGES, BABYBEAR and TOFACED Source=Paul Collins Startup list [Microsoft Cvrt] Confirmed=X Filename=mscvrt32.exe Description=Added as a result of a unidentified VIRUS!. Named almost, but not exactly like the legitimate msvcrt or msvcrt20.dll Source=Paul Collins Startup list [Microsoft Database Handler] Confirmed=X Filename=mssql32.exe Description=Added as a result of the RANDEX.AX VIRUS! Source=Paul Collins Startup list [Microsoft Diagnostic] Confirmed=X Filename=.exe Description=Added as a result of the ACEBOT VIRUS! The <filename>.exe will be random and must be deleted after the virus has been removed. Not to be confused with the DOS based MSD.EXE Source=Paul Collins Startup list [Microsoft DirectX] Confirmed=X Filename=Spoolserv.exe Description=Added as a result of the DINFOR VIRUS! Source=Paul Collins Startup list [Microsoft Find Fast] Confirmed=X Filename=Findfast.exe Description=Complete utter waste of space! Part of MS Office - searches disk drives for Office file types and creates an index to make opening them easier Source=Paul Collins Startup list [MICROSOFT FIREWALL CLIENT] Confirmed=Y Filename=ISATRAY.EXE Description=MS Internet Security and Acceleration Server 2000 Source=Paul Collins Startup list [Microsoft Greetings Workshop Reminder] Confirmed=N Filename=Gwremind.exe Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [Microsoft Greetings Reminder] Confirmed=N Filename=MHPRMINF.EXE Description=You really want to be reminded about somebody's birthday at the expense of resources? Source=Paul Collins Startup list [Microsoft IIS] Confirmed=X Filename=syshost.exe Description=Added as a result of the FRANCETTE VIRUS! Source=Paul Collins Startup list [Microsoft Inet Xp..] Confirmed=X Filename=teekids.exe Description=Added as a result of the BLASTER.C VIRUS! Source=Paul Collins Startup list [Microsoft Intellitype Pro] Confirmed=U Filename=speedkey.exe Description=Additional keyboard shortcuts on MS programmable keyboard Source=Paul Collins Startup list [Microsoft Internet Explorer] Confirmed=X Filename=iexplore.exe Description=Downloader trojan. Note! - this is not the valid iexplore.exe as the file is loacted in Program Files\\MSIE and not Program Files\\Internet Explorer Source=Paul Collins Startup list [Microsoft Internet Firewall Manager] Confirmed=X Filename=GMT16.exe Description=Added as a result of the RANDEX.AT VIRUS! Source=Paul Collins Startup list [Microsoft IPC] Confirmed=X Filename=system.exe Description=Added as a result of the NULLBOT VIRUS! Source=Paul Collins Startup list [Microsoft IPC] Confirmed=X Filename=svshost.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Microsoft Movie Maker] Confirmed=X Filename=Mmaker.exe Description=Added as a result of the IRCBOT.C VIRUS! Note that this is not a valid Microsoft program Source=Paul Collins Startup list [Microsoft MSUPDATE] Confirmed=X Filename=SpoolSvc.exe Description=Added as a result of the SXTB-A VIRUS! Source=Paul Collins Startup list [Microsoft Netview] Confirmed=X Filename=gesfm32.exe Description=Added as a result of the RANDEX.C VIRUS! Source=Paul Collins Startup list [Microsoft Netview] Confirmed=X Filename=mssvc32.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Microsoft Netview Component v5.1] Confirmed=X Filename=msnv32.exe Description=Added as a result of the RANDEX.F VIRUS! Source=Paul Collins Startup list [Microsoft Network Daemon for Win32] Confirmed=X Filename=Netd32.exe Description=Added as a result of the SDBOT.R VIRUS! Source=Paul Collins Startup list [Microsoft Office] Confirmed=X Filename=MSMSGR.exe Description=Added as a result of the GAOBOT.BB VIRUS! Source=Paul Collins Startup list [Microsoft Office Fast Cache] Confirmed=N Filename=Fastboot.exe Description=Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast above and can be disabled Source=Paul Collins Startup list [Microsoft Office Start] Confirmed=X Filename=winupdates.exe Description=Added as a result of the GAOBOT.BC VIRUS! Source=Paul Collins Startup list [Microsoft OfficeorMicrosoft Office Shortcut Bar] Confirmed=N Filename=Msoffice.exe Description=Alternative shortcuts to the Start -> Programs way of running applications installed as part of MS Office. Some people prefer it but a better way is to create Desktop Shortcuts if you want access these programs quickly Source=Paul Collins Startup list [Microsoft OfficeorMicrosoft Office Startup] Confirmed=N Filename=Osa.exeOsa9.exe Description=Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required anyway. Different filenames used for different variants Source=Paul Collins Startup list [Microsoft RDLL] Confirmed=X Filename=sysconf32.exe Description=Added as a result of a variant of the SDBOT VIRUS! Source=Paul Collins Startup list [Microsoft Runtime] Confirmed=X Filename=CfgDll32.exe Description=Added as a result of the RANDEX.BD VIRUS! Source=Paul Collins Startup list [Microsoft Scanreg] Confirmed=X Filename=microsoftscanreg.exe Description=Added as a result of the FRANRIV.A VIRUS! Source=Paul Collins Startup list [Microsoft Sidewinder Game Controller Software] Confirmed=N Filename=SWTRAY.EXE Description=MS SideWinder game controller system tray icon. Available via Start -> Programs Source=Paul Collins Startup list [Microsoft Sound Volume Tool] Confirmed=N Filename=mssvol.exe Description=This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Microsoft Spool Server for Win32] Confirmed=X Filename=spoolsrv.exe Description=Added as a result of the RANDEX.H VIRUS! Source=Paul Collins Startup list [Microsoft System Checkup] Confirmed=X Filename=Cool.exe Description=Added as a result of the DONK.B VIRUS! Source=Paul Collins Startup list [Microsoft System Checkup] Confirmed=X Filename=Wnetlib.exe Description=Added as a result of the DONK.C VIRUS! Source=Paul Collins Startup list [Microsoft System Restore Configuration] Confirmed=X Filename=CBRSS.EXE Description=Added as a result of a variant of the SPYBOT VIRUS! Source=Paul Collins Startup list [Microsoft Tray] Confirmed=X Filename= Description=Added as a result of the DELF.BZ VIRUS! Source=Paul Collins Startup list [Microsoft UPDATER32] Confirmed=X Filename=lsass.exe Description=Added as a result of the RANDEX.AR VIRUS! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [Microsoft Utility Startup] Confirmed=X Filename=OSA9.exe Description=Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required anyway. Different filenames used for different variants Source=Paul Collins Startup list [Microsoft Webserver] Confirmed=U Filename=svctrl.exe Description=Personal web server program which enables you to create and host a web server from your computer. Not required for most people Source=Paul Collins Startup list [Microsoft Windows 2000] Confirmed=X Filename=Winupdsdgm.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Microsoft Windows Kernel Services] Confirmed=X Filename=winkrnl386.exe Description=Added as a result of the ZEBROXY VIRUS! Source=Paul Collins Startup list [Microsoft Windows Update] Confirmed=X Filename=rundlls.exe Description=Added as a result of the HABRACK VIRUS! Source=Paul Collins Startup list [Microsoft Windows Update Service] Confirmed=X Filename=wupdmgr32.exe Description=Added as a result of the DOS.AUTOCAT VIRUS! Source=Paul Collins Startup list [Microsoft Windows Updater] Confirmed=X Filename=winupdgm.exe Description=Added as a result of the GAOBOT.BI VIRUS! Source=Paul Collins Startup list [Microsoft Works Calendar Reminders] Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [Microsoft Works Portfolio] Confirmed=N Filename=WksSb.exe Description=The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program.Can be prevented from starting from a setting within Portfolio Source=Paul Collins Startup list [Microsoft Works Update Detection ] Confirmed=N Filename=wkdetect.exe Description=Checks for updates to MS Works Source=Paul Collins Startup list [microsoft xdaemon 2.0] Confirmed=X Filename=xdaemon.exe Description=Added as a result of the DELF.D VIRUS! Source=Paul Collins Startup list [microsoft420] Confirmed=X Filename=microsoft420.exe Description=Added as a result of the MENACE.B (or W32.SOFUNNY) VIRUS! Source=Paul Collins Startup list [MicrosoftMultimediaTask] Confirmed=X Filename=Mmtask.exe Description=Adware downloader - not the valid MusicMatch Jukebox which shares the same filename Source=Paul Collins Startup list [MicrosoftNetwork Daemon for Win32] Confirmed=X Filename=NETD32.EXE Description=Added as a result of the RANDEX.F VIRUS! Source=Paul Collins Startup list [MicrosoftServiceManager] Confirmed=X Filename=mstask32.exe Description=Added as a result of the YAHA.P VIRUS! Source=Paul Collins Startup list [MicrosoftServiceManager] Confirmed=X Filename=Wintsk32.exe Description=Added as a result of the YAHA.U VIRUS! Source=Paul Collins Startup list [MicrosoftServiceManager] Confirmed=X Filename=EXPLORERE.EXE Description=Added as a result of the YAHA.AB VIRUS! Source=Paul Collins Startup list [MicrosoftServiceManager] Confirmed=X Filename=msupdat.exe Description=Added as a result of the YAHA.AA VIRUS! Source=Paul Collins Startup list [MicrosoftValue] Confirmed=X Filename=syscnfg.exe Description=Added as the result of an unidentified VIRUS!. "syscnfg.exe" is found in the C:\\windows\\fonts (or C:\\winnt\\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [MicrosoftWindows] Confirmed=X Filename= Description=MagicSearch - a CoolWebSearch parasite variant Source=Paul Collins Startup list [Microsoft� PID Lex] Confirmed=X Filename=PIDLex.exe Description=Added as a result of the NIOVADOOR VIRUS! Source=Paul Collins Startup list [Microsoft� System Mapper] Confirmed=X Filename=SysMap.exe Description=Added as a result of the MAPSY VIRUS! Source=Paul Collins Startup list [MightyFAX Controller] Confirmed=N Filename=MFNTCTL.EXE Description=Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software" Source=Paul Collins Startup list [MigrationVendorSetupCaller] Confirmed=? Filename=rundll32.exe migrate.dll, CallVendorSetupDlls Description=?? Source=Paul Collins Startup list [MINIBUG] Confirmed=X Filename=MINIBUG.EXE Description=Displays ads inside Weatherbug - see here Source=Paul Collins Startup list [MINIFERT.EXE] Confirmed=N Filename=MINIFERT.EXE Description=Part of Backweb Source=Paul Collins Startup list [minilog] Confirmed=U Filename=MINILOG.EXE Description=If you don't have ZoneAlarm or ZoneAlarm Pro running you don't need this. This must be enabled if programs such as VisualZone Report utility or ZoneLog Analyzer are in use Source=Paul Collins Startup list [MiniNote] Confirmed=N Filename=MININOTE.EXE Description=Mini NoteTab was the first in the family of "NoteTab" text and HTML editors from Fookes Software Source=Paul Collins Startup list [MinMaxExtender] Confirmed=U Filename=Mmext.exe Description=MinMaxExtender - window handling tool Source=Paul Collins Startup list [Mirabilis ICQ] Confirmed=N Filename=NDetect.exeicq.exeICQNet.exe Description=If connected to the internet, automatically runs up ICQ. Convenience more than anything. ICQ can be started from Start -> Programs Source=Paul Collins Startup list [Miramar Systems, Inc.] Confirmed=U Filename=atmsg.exe Description=Miramar PC/Mac networking software Source=Paul Collins Startup list [miroVIDEO Tray Tool] Confirmed=N Filename=misitray.exe Description=Tool for quickly changing options for miro/Pinnacle capture cards during capture/playback/output. When this program is closed, another program (mv-ctrl) is also closed, but mv-ctrl does not have its own EXE file. Only needed when using the capture card, e.g. for the above actions Source=Paul Collins Startup list [misiCTRL] Confirmed=? Filename=misiCTRL.exe Description=Miro video driver related. Is it required? Source=Paul Collins Startup list [misiTRAY] Confirmed=? Filename=misiTRAY.exe Description=Miro video driver related. Is it required? Source=Paul Collins Startup list [Mixer] Confirmed=N Filename=Mixer.exe Description=C-Media Mixer - C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs Source=Paul Collins Startup list [Mixghost] Confirmed=N Filename=mixghost.exe Description=Management software for Altec Lansing speakers. If a change is needed, the user can launch it from the Start menu Source=Paul Collins Startup list [mload] Confirmed=X Filename=lxmstart.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [MM Install] Confirmed=? Filename=setup.exe Description=Possibly Money Manager from Moneysoft? Source=Paul Collins Startup list [MMhid] Confirmed=U Filename=mmhid.dll Description=This is the Human Interface Device Server for Win98, it is required only if you are using USB Audio Devices you can disable via Msconfig. See here. Typical examples are USB multimedia keyboards with volume control and web-ready keyboards. For example - loaded by default with MS DSS80 Speakers because they have Volume, Mute and Bass controls on the speaker. Some users may experience problems disabling this - if this is the case then re-enable it. Equivalent to Hidserv in Win98SE/2000/Me/XP Source=Paul Collins Startup list [MMHK] Confirmed=? Filename=mmhk.exe Description=A driver found on a Compaq Presario 800T notebook. Possibly something to do with multimedia hot keys? Source=Paul Collins Startup list [MMHotKey] Confirmed=N Filename=MMHotKey.exe Description=Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen Source=Paul Collins Startup list [MMKeybd] Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys Source=Paul Collins Startup list [mmod] Confirmed=X Filename=mmod.exe Description=Ezula - regarded as spyware/theftware and bundled with the popular iMesh and KaZaA file-sharing programs. Read here for more information Source=Paul Collins Startup list [mmpti] Confirmed=N Filename=m1mmpti.exe Description=Mpact Mediaware Properties Taskbar Icon - multimedia software icon for Chromatic Research Mpact video cards Source=Paul Collins Startup list [MMRun] Confirmed=? Filename=mmrun.exe Description=?? Source=Paul Collins Startup list [MMTASK] Confirmed=Y Filename=mmtask.tsk Description=A check on the file's properties reveals "Multimedia background task support module". MMTASK is a very simple 16-bit program used by certain multimedia drivers (which are still 16-bit on Win9x) to perform background processing. Some soundcards need this to support MIDI, etc Source=Paul Collins Startup list [mmtask] Confirmed=N Filename=mmtask.exe Description=Part of MusicMatch Jukebox - digital music player / CD burner and ripper / music organizer / playlist creator Source=Paul Collins Startup list [MMtask Service] Confirmed=X Filename=mmtask.exe Description=Added as a result of the BACKGAT.A VIRUS! Not the valid MusicMatch Jukebox which has the same filename Source=Paul Collins Startup list [MMTray] Confirmed=N Filename=mm_tray.exe Description=MusicMatch Jukebox icon in the task tray - digital music player / CD burner and ripper / music organizer / playlist creator Source=Paul Collins Startup list [MMTray] Confirmed=N Filename=MMTray.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [MMTray2K] Confirmed=N Filename=MMTray2K.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [MMTrayLSI] Confirmed=N Filename=MMTrayLSI.exe Description=Part of Morgan Multimedia Codecs. Only required when the codecs are used Source=Paul Collins Startup list [mmusrstp] Confirmed=? Filename=procrun.exe Description=?? Source=Paul Collins Startup list [mmxrun] Confirmed=X Filename=msosa.exe Description=Adult content dialler - see here. This has to be cleared at the same time as MSStartOptimizer (WINUPD.EXE), atisrc2 (windfind.exe) and RegCompres (REGCPM32.EXE), otherwise they return Source=Paul Collins Startup list [mnsvc] Confirmed=X Filename=mnsvc.exe Description=Added as a result of the AUTOUPDER VIRUS! Source=Paul Collins Startup list [mnsvcsp] Confirmed=X Filename=mnsvcsp.exe Description=VIRUS! Source=Paul Collins Startup list [mobsync] Confirmed=N Filename=mobsync.exe Description=MS Syncrhonization Manager - updates the network copy of materials that were edited offline, such as documents, calendars, and e-mail messages Source=Paul Collins Startup list [MOBSYNC32.EXE] Confirmed=X Filename=mobsync32.exe Description=Added as a result of the FINERO VIRUS! Source=Paul Collins Startup list [MOD] Confirmed=N Filename=muamger.exe Description=MicroAngelo On Display from Impact Software lets you customize Windows icons. With a few exceptions, you can customize icons by right-clicking on them Source=Paul Collins Startup list [MODEMBTR] Confirmed=U Filename=MODEMBTR.EXE Description=Modem Booster from inKline Global to improve ISP connections Source=Paul Collins Startup list [ModemOnHold] Confirmed=U Filename=MOH.EXE Description=NetWaiting Modem-on-Hold Application Source=Paul Collins Startup list [ModemUtility] Confirmed=N Filename=mdmsetpe.exe Description=System Tray configuration icon for Aztech modems Source=Paul Collins Startup list [ModularConfig] Confirmed=X Filename=syscnfg.exe Description=Added as the result of an unidentified VIRUS!. "syscnfg.exe" is found in the C:\\windows\\fonts (or C:\\winnt\\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Module Call initialize] Confirmed=X Filename=RUNDLL32.EXE reg.dll, ondll_reg Description=Added as a result of the LOVGATE VIRUS! Source=Paul Collins Startup list [Money Express] Confirmed=N Filename=moneyexpress.exe Description=Part of MS Money. Available via Start -> Programs Source=Paul Collins Startup list [MoneyAgent] Confirmed=N Filename=money express.exe Description=Part of MS Money. Available via Start -> Programs Source=Paul Collins Startup list [MoneyStartUp10.0] Confirmed=N Filename=Activation.exe Description=Part of MS Money 2002. Available via Start -> Programs Source=Paul Collins Startup list [Monitor Apache Servers] Confirmed=U Filename=ApacheMonitor.exe Description=Part of the Apache Web Server package. Useful only if you're running such a server on your PC. Available via Start -> Programs Source=Paul Collins Startup list [Monitormgt] Confirmed=X Filename=Monitormgt.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Monstersoundtray] Confirmed=N Filename=Freectrl.exe Description=Diamond Multimedia sound card control panel Source=Paul Collins Startup list [moon phase] Confirmed=N Filename=moon.exe Description=Moon Phase - tray icon that indicates the phases of the moon Source=Paul Collins Startup list [Morpheus] Confirmed=N Filename=morpheus.exe Description=MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free, and a visitor quotes "I have seen no instance of any since using it" Source=Paul Collins Startup list [mosearch] Confirmed=X Filename=mosearch.exe Description=Fast Search in Office XP - similar to the new revision of the Find Fast feature in Office 2000. Fast Search uses the Indexing Services in Office XP to create a catalog of Office files on your computer's hard disk. As with Find Fast - a waste of resources. If it can't be disabled via MSCONFIG try here Source=Paul Collins Startup list [Motive SmartBridge] Confirmed=N Filename=mpbtn.exe Description=System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [MotiveMonitor] Confirmed=U Filename=motmon.exe Description=On HP systems. MotiveMonitor allows you to use HP Instant Support, and allows the agent on the other side to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. For most users it's not required Source=Paul Collins Startup list [MotiveSB] Confirmed=N Filename=MotiveSB.exe Description=The same as Motive SmartBridge below Source=Paul Collins Startup list [MotMon] Confirmed=U Filename=motmon.exe Description=On HP systems. MotiveMonitor allows you to use HP Instant Support, and allows the agent on the other side to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. For most users it's not required Source=Paul Collins Startup list [Mount Safe & Sound] Confirmed=U Filename=Fbmount.exe Description=From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start Source=Paul Collins Startup list [Mouse 32A] Confirmed=N Filename=Mouse32A.exe Description=Mouse driver to control mouse functions from Azona. Available via Start -> Programs Source=Paul Collins Startup list [Mouse Suite 98 Daemon] Confirmed=N Filename=pelmiced.exe Description=Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games Source=Paul Collins Startup list [MouseCount] Confirmed=N Filename=MC.exe Description=MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required Source=Paul Collins Startup list [mouseElf] Confirmed=U Filename=MC.exe Description=System Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features Source=Paul Collins Startup list [MouseImp] Confirmed=U Filename=MImpHost.exe Description=MouseImp Pro - "A reliable assistant that turns your mouse into a simple, native but powerful controlling device" Source=Paul Collins Startup list [Mousinfo] Confirmed=U Filename=mousinfo.exe Description=MS mouse information tool - for troubleshooting mouse problems Source=Paul Collins Startup list [MovieNetworks] Confirmed=X Filename=MovieNetworks.exe Description=MovieNetworks will connect you by DOMESTIC PREMIUM RATE TELEPHONE NUMBER 900-xxx-xxxx. So you get xxx rated pictures and junk. And it will allow you to stay on the internet on their line and $$$ and remove the C:\\Program Files\\MovieNetworks directory Source=Paul Collins Startup list [Movieplace] Confirmed=X Filename=Movieplace.exe Description=MoviePlace malware Source=Paul Collins Startup list [Mozilla Quick Launch] Confirmed=N Filename=Netscp6.exeMozilla.exe Description=Netscape 6 and Mozilla browsers Source=Paul Collins Startup list [MPEO] Confirmed=U Filename=Csinsm32.exe Description=Automatic logging of installs from Norton CleanSweep - available via Start -> Programs Source=Paul Collins Startup list [MPFExe] Confirmed=Y Filename=mpf.exeMpfTray.exe Description=McAfee Personal Firewall Source=Paul Collins Startup list [MplSetup] Confirmed=U Filename=MplSetup.exe Description=Used by Ricoh network printers to enable network printing from the client Source=Paul Collins Startup list [MPower] Confirmed=U Filename=MPower.exe Description=MPower from MindBeat. "Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your CPU load". Some users swear by programs such as this but I suggest you read this article and make up your own mind Source=Paul Collins Startup list [MPREXE] Confirmed=X Filename=MPREXE.EXE Description=Added as a result of the OPASERV.T VIRUS! Note - this is not the legitimate Mprexe.exe system file Source=Paul Collins Startup list [MPREXE.exe] Confirmed=Y Filename=mprexe.exe Description=WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here and here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus Source=Paul Collins Startup list [MprHTML] Confirmed=X Filename=MprHTML.exe Description=Added as a result of a variant of the VAGRNOCKER VIRUS! Source=Paul Collins Startup list [MPSExe] Confirmed=U Filename=mscifapp.exe Description=McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering" Source=Paul Collins Startup list [MPT] Confirmed=? Filename=MPT.exe Description=?? Source=Paul Collins Startup list [MPtask Services] Confirmed=X Filename=mptask.exe Description=Added as a result of the LALA or DOWNLOADER-BN.B or AOT VIRUSES! Source=Paul Collins Startup list [MPTBox] Confirmed=N Filename=MPTBOX.EXE Description=Cannon Multi-Pass toolbox - a button bar Source=Paul Collins Startup list [MPXTray] Confirmed=N Filename=mpxptray.exe Description=Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause, next,previous) etc Source=Paul Collins Startup list [MP_STATUS_MONITOR] Confirmed=? Filename=monitr32.exe Description=Related to Cannon Multi-Pass Source=Paul Collins Startup list [mqbkup] Confirmed=X Filename=mqbkup.exe Description=Added as a result of the OPASERV.K VIRUS! Source=Paul Collins Startup list [mrtMngr] Confirmed=N Filename=mrtMngr.exe Description=Maintenance Release Task Manager for Intuit�s QuickBooks or Quicken Source=Paul Collins Startup list [MRU-Blaster Scheduler] Confirmed=U Filename=scheduler.exe Description=MRU-Blaster scheduler - detects and cleans MRU (most recently used) lists on your computer Source=Paul Collins Startup list [MRU-Blaster Silent Clean] Confirmed=N Filename=mrublaster.exe Description=MRU-Blaster - performs silent cleaning of MRU lists at boot Source=Paul Collins Startup list [MS Config Loader] Confirmed=X Filename=svchos1.exe Description=Added as a result of the AGOBOT.R VIRUS! Source=Paul Collins Startup list [MS Config Loader] Confirmed=X Filename=MSWin32bck.exe Description=Added as a result of the GAOBOT.AA VIRUS! Source=Paul Collins Startup list [MS Explorer] Confirmed=X Filename=mexplore.exe Description=Added as a result of the YAHA.AE VIRUS! Source=Paul Collins Startup list [MS HTML] Confirmed=X Filename=msHtml.exe Description=Added as a result of the PESTDOOR.31 VIRUS! Source=Paul Collins Startup list [MS HTML] Confirmed=X Filename=mslat.exe Description=Added as a result of the LATINUS.SVR VIRUS! Source=Paul Collins Startup list [MS management console] Confirmed=? Filename=mms.exe Description=Suspicious as the Microsoft Management Console is "mmc.exe" and doesn't normally run at startup Source=Paul Collins Startup list [MS Network Control] Confirmed=X Filename=mswin.exe Description=Added as a result of the DUMBA VIRUS! Source=Paul Collins Startup list [MS Security Hotfix] Confirmed=X Filename=service5.exe Description=Added as a result of the GAOBOT.AG VIRUS! Source=Paul Collins Startup list [Ms Spool32] Confirmed=X Filename=MS SPOOL32.EXE Description=Added as a result of the ASASSIN VIRUS! Source=Paul Collins Startup list [MS Updates] Confirmed=X Filename=mscache.exeaupd.exe Description=Spyware web downloader Source=Paul Collins Startup list [MS-Connect] Confirmed=X Filename=arr.execdm.exegame.exemsite18.exeweb.exe Description=Adult content dialler - see here Source=Paul Collins Startup list [MS-HTML] Confirmed=X Filename= Description=Added as a result of the LATINUS.15 VIRUS! Source=Paul Collins Startup list [MS-RunKey] Confirmed=X Filename=arr.exe Description=MS-Connect dialler/hijacker Source=Paul Collins Startup list [MS7531] Confirmed=X Filename=ms7531.exe Description=Homepage hijacker Source=Paul Collins Startup list [MSAdmin] Confirmed=X Filename=jdbgmrg.exe Description=Added as a result of the DASMIN.A VIRUS! Note - this is not the valid JDBGMGR.EXE file - see here Source=Paul Collins Startup list [MSBB] Confirmed=X Filename=msbb.exe Description=Advertising spyware Source=Paul Collins Startup list [msci] Confirmed=? Filename=mcinfo.exe Description=McAfee Internet Security related. What does it do and is it required? Source=Paul Collins Startup list [mscman] Confirmed=X Filename=mscman.exe Description=Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" Source=Paul Collins Startup list [mscn] Confirmed=U Filename=mscn.exe Description=Part of the SafeChildNet internet filtering program - required if you use it Source=Paul Collins Startup list [Mscnt] Confirmed=X Filename=mscnt.exe Description=Adult content dialler Source=Paul Collins Startup list [MSConfig] Confirmed=N Filename=MSCONFIG32.EXE Description=Unidentified adware, spyware or virus. Not to be confused with the valid entry above which has the command "msconfig.exe" Source=Paul Collins Startup list [msconfig] Confirmed=X Filename=msconfig.exe Description=CoolWebSearch parasite related. Note - this is not the valid "msconfig" entry which can be left over if you don't uncheck the box after re-booting when running in "Selective Startup" mode Source=Paul Collins Startup list [Msconfig lptt01orMsconfig ml097e] Confirmed=X Filename=msconfig.exe Description=Variant of the RapidBlaster parasite (in a "msconfig" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Windows Msconfig which has the same executable name Source=Paul Collins Startup list [MSConfig45] Confirmed=X Filename=MSConfig45.exe Description=Added as a result of the SDBOT.OJ VIRUS! Source=Paul Collins Startup list [MSConfigorMSConfigReminder] Confirmed=N Filename=msconfig.exe Description=This is an entry that appears when you uncheck an item in the Startup group, and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode Source=Paul Collins Startup list [MSConfigr] Confirmed=X Filename=jdbgmrg.exe Description=Added as a result of the DASMIN.C VIRUS! Note - this is not the valid JDBGMGR.EXE file - see here Source=Paul Collins Startup list [MSCORE] Confirmed=X Filename=syscnfg.exe Description=Added as the result of an unidentified VIRUS!. "syscnfg.exe" is found in the C:\\windows\\fonts (or C:\\winnt\\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Mscsgs] Confirmed=X Filename=MSCSGS.EXE Description=Added as a result of the ZEZER VIRUS! Source=Paul Collins Startup list [Mscsgs32] Confirmed=X Filename=MSCSGS32.EXE Description=Added as a result of the ZEZER VIRUS! Source=Paul Collins Startup list [Msctrl32] Confirmed=X Filename=Msctrl32.scr Description=Added as a result of the REDIST VIRUS! Source=Paul Collins Startup list [MSCVT] Confirmed=X Filename=MSCVT.exe Description=Added as a result of the SLIDESHOW VIRUS! Source=Paul Collins Startup list [MSDLL] Confirmed=X Filename=syscnfg.exe Description=Added as the result of an unidentified VIRUS!. "syscnfg.exe" is found in the C:\\windows\\fonts (or C:\\winnt\\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Msdmxm] Confirmed=X Filename=msdmxm.exe Description=Adult premium rate dialler Source=Paul Collins Startup list [Msdos32] Confirmed=X Filename=Msdos32.pif Description=Added as a result of the RECORY VIRUS! Source=Paul Collins Startup list [msdos423] Confirmed=X Filename=msdos423.exe Description=Added as a result of the MENACE.A (or W95.SOFUNNY.WORM@M) VIRUS! Source=Paul Collins Startup list [MSDTC] Confirmed=N Filename=msdtc.exe Description=MS Distributed Transaction Coordinator - handles transactions across multiple servers and is installed by MS Personal Web Server and MS SQL Server Source=Paul Collins Startup list [Msemu32] Confirmed=X Filename=Msemu32.exe Description=Unidentified spyware/adware/hijacker Source=Paul Collins Startup list [Msfind] Confirmed=X Filename=Msfind.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [MSFind32] Confirmed=X Filename=msfind32.exe Description=Added as a result of the CAYAM VIRUS! Source=Paul Collins Startup list [msfindosa.exe] Confirmed=X Filename=msfindosa.exe Description=Added as a result of the DOWNLOADER-BS VIRUS! Source=Paul Collins Startup list [Msgmgr] Confirmed=X Filename= Description=Added as a result of the BABYBEAR VIRUS! Source=Paul Collins Startup list [Msgsrv16] Confirmed=X Filename=Msgsrv16.exe Description=Added as a result of the DELF family of VIRUSES! Source=Paul Collins Startup list [MSGSRV32.exe] Confirmed=Y Filename=msgsrv32.exe Description=Windows 32-bit VxD Message Server. For more information on its function and why it's needed, see here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background Source=Paul Collins Startup list [msgsvr32] Confirmed=X Filename=msgsvr32.exe Description=Added as the result of the DEADHAT.B VIRUS! Note - not to be confused with the valid "msgsrv32.exe" file which resides in the same directory (C:\\Windows\\System) on a Win9x/Me machine Source=Paul Collins Startup list [Msgtray] Confirmed=X Filename=sys16.exe Description=Added as a result of an unknown VIRUS! Source=Paul Collins Startup list [MSHT@] Confirmed=X Filename=MSHT@.EXE Description=Added as a result of the MAGISTR.A VIRUS! Source=Paul Collins Startup list [MSIN] Confirmed=? Filename=MSin.exe Description=?? Source=Paul Collins Startup list [MSInfo] Confirmed=X Filename=msinfo.exe Description=Added as a result of the ALADINZ.M VIRUS! Source=Paul Collins Startup list [MSKCES32] Confirmed=X Filename= Description=Added as a result of the CLONER VIRUS! Source=Paul Collins Startup list [MSKernel32] Confirmed=X Filename=MSKernel32.vbs Description=Added as a result of the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [MSkernel32] Confirmed=X Filename=System.exe 4820 Description=Added as a result of the TUXDER VIRUS! Source=Paul Collins Startup list [MSKExe] Confirmed=U Filename=spamkiller.exe Description=McAfee SpamKiller Source=Paul Collins Startup list [MSLIB32] Confirmed=? Filename=mswatch32.exe Description=?? Source=Paul Collins Startup list [Mslogon lptt01orMslogon ml097e] Confirmed=X Filename=mslogon.exe Description=Variant of the RapidBlaster parasite (in a "Mslogon" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [MsManager] Confirmed=X Filename=msmgr32.exe Description=Added as a result of the YAHA.AF VIRUS! Source=Paul Collins Startup list [msmanager32] Confirmed=X Filename=msmngr32.exe Description=Added as a result of the RANDON-R (or WOMANIZ.A) VIRUS! Source=Paul Collins Startup list [msmc] Confirmed=X Filename=mscpbo.exemsgdmf.exemsongn.exemsmc.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [MSMcAfeeh] Confirmed=X Filename=Avsynmgr32h.exe Description=Added as a result of the FRANGO VIRUS! Source=Paul Collins Startup list [MSMcAfeeS] Confirmed=X Filename=Avsynmgr32S.exe Description=Added as a result of the VOLAC or VOLAC.DR VIRUSES! Source=Paul Collins Startup list [msmgr] Confirmed=? Filename=msmgr.exe Description=?? Source=Paul Collins Startup list [Msmgt] Confirmed=X Filename=msmgt.exe Description=Total Velocity adware/hijacker Source=Paul Collins Startup list [MsmqIntCert] Confirmed=? Filename=regsvr32 /s mqrt.dll Description=Microsoft Message Queue Server - Internal Certificate - see here for more info and here for a potential problem. Is it required? Source=Paul Collins Startup list [MSMSGS] Confirmed=U Filename=msmsgs.exe Description=Windows Messenger utility. If you don't use Windows Messenger, this can be annoying. Available via Start -> Programs. Go to Windows Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts" Source=Paul Collins Startup list [msn] Confirmed=X Filename=system32.exe Description=Added as a result of the KITRO.A VIRUS! Source=Paul Collins Startup list [MSN Internet Access] Confirmed=N Filename=trayclnt.exe Description=Quick way to connect to MSN internet service - replaces "MSN Quick View" from V5.6 onwards Source=Paul Collins Startup list [MSN messenger] Confirmed=X Filename=messenger.exe Description=Unidentified trojan VIRUS!. Note - this is not the real MSN Messenger, see this thread Source=Paul Collins Startup list [MSN messenger service] Confirmed=X Filename=mssgs.exe Description=Unidentified trojan VIRUS!. Note - this is not the real MSN Messenger, see this thread Source=Paul Collins Startup list [MSN Quick View] Confirmed=N Filename=Msndc.exe Description=Quick way to connect to MSN internet service Source=Paul Collins Startup list [Msnarrator] Confirmed=X Filename=msnarrator.exe Description=Added as a result of the NARAT.A VIRUS! - also identified as MPGCOM Toolbar adware Source=Paul Collins Startup list [MSNET] Confirmed=X Filename=msnet.exe Description=Added as a result of the BOA VIRUS! Source=Paul Collins Startup list [MsnFixer] Confirmed=? Filename=msnfixjs.js Description=Located in the HP\bin\msnfix directory of a HP PC Source=Paul Collins Startup list [MSNIA] Confirmed=N Filename=MSNIASVC.EXE Description=Added with MSN version 9. Resets certain internet settings upon bootup and can't be disabled via MSCONFIG Source=Paul Collins Startup list [msnmsgr] Confirmed=N Filename=msnmsgr.exe Description=MSN Messenger utility. If you don't use MSN Messenger, this can be annoying. Available via Start -> Programs. Go to MS Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts" Source=Paul Collins Startup list [MSNService] Confirmed=X Filename=MSNService.exe Description=Added as a result of the CARPET.C VIRUS! Source=Paul Collins Startup list [MSNSysRestore] Confirmed=X Filename=pc32.exe Description=Added as a result of a variant of the MASTAK VIRUS! Source=Paul Collins Startup list [MSObject32] Confirmed=X Filename=MSObject32.js Description=Added as a result of the PUN VIRUS! Source=Paul Collins Startup list [Msoffice] Confirmed=X Filename=msoffice.hta Description=Hijacker - redirecting to Searchdot.net Source=Paul Collins Startup list [MSOOBD] Confirmed=X Filename=MSOOBD.EXE Description=Added as a result of the MAGISTR.A VIRUS! Source=Paul Collins Startup list [Mspatch69] Confirmed=X Filename= Description=Added as a result of the MPROX VIRUS! Source=Paul Collins Startup list [Mspatch89] Confirmed=X Filename=cnqmax.exe Description=Added as a result of the RANDEX.P VIRUS! Source=Paul Collins Startup list [MSPQFile] Confirmed=X Filename=MSA****.TMP Description=Homepage hijacker. See here for more information. **** can be anything Source=Paul Collins Startup list [MSprotect.exe] Confirmed=X Filename=MSprotect.exe Description=Added as a result of the DABYREV VIRUS! Source=Paul Collins Startup list [mspwr] Confirmed=U Filename=pupstman.exe Description="Transparent icon background" feature of Ashampoo's PowerUp XP (WinNT/2K/XP) and PowerUp Deluxe (Win98/Me) Source=Paul Collins Startup list [MSPY2002] Confirmed=N Filename=ImScInst.exe Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [Msrc] Confirmed=X Filename=Msrc.exe Description=Added as a result of the KRYPTONIC GHOST VIRUS! Source=Paul Collins Startup list [msreg.exe] Confirmed=X Filename=msrege.exe Description=Added as a result of the ZINX VIRUS! Source=Paul Collins Startup list [MSREGIT] Confirmed=X Filename=Msgp.exe Description=Added as a result of the KRYPGHOS (Kryptonic Ghost) VIRUS! Source=Paul Collins Startup list [MSRegSvc] Confirmed=X Filename=regsvc32.exe Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [msrunocx32] Confirmed=X Filename=msrunocx32.exe Description=Added as a result of the SKUS VIRUS! Source=Paul Collins Startup list [msservice] Confirmed=X Filename=msserv.exe Description=Added as a result of the HYD VIRUS! Source=Paul Collins Startup list [MSSHVC] Confirmed=X Filename=MSSHVC.exe Description=Added as a result of the NUFFY.A VIRUS! Source=Paul Collins Startup list [MSSQL] Confirmed=X Filename=Mssql.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [Msstart] Confirmed=X Filename=msstart.exe Description=Added as a result of the LIVUP.C VIRUS! Source=Paul Collins Startup list [MSStartOptimizer] Confirmed=X Filename=Iexpres.exe Description=Added as a result of the POLDO.B VIRUS! Source=Paul Collins Startup list [MSStartOptimizer] Confirmed=X Filename=WINUPD.EXE Description=Adult content dialler - see here. This has to be cleared at the same time as RegCompres (REGCPM32.EXE), atisrc2 (windfind.exe) and mmxrun (msosa.exe), otherwise they return Source=Paul Collins Startup list [mssurfer lptt01ormssurfer ml097e] Confirmed=X Filename=mssurfer.exe Description=Variant of the RapidBlaster parasite (in a "surfer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the valid Lavasoft Adaware Source=Paul Collins Startup list [mssvc] Confirmed=X Filename= Description=Added as a result of the PSK VIRUS! Source=Paul Collins Startup list [MSSVC.EXE] Confirmed=Y Filename=MSSVC.EXE Description=Stealthdisk - hides folders, files and applications. Will also encrypt them for better protection Source=Paul Collins Startup list [mssys] Confirmed=X Filename=mssys.exe Description=Added as a result of the MYSS.B VIRUS! Source=Paul Collins Startup list [mssysint] Confirmed=X Filename=Iexplore .exe Description=Added as a result of the PWSTEAL.ABCHLP and PSPIDER.310.B VIRUSES! Note - this is not the valid Internet Explorer (iexplore.exe) Source=Paul Collins Startup list [mssyslanhelper] Confirmed=X Filename=msmsgri32.exe Description=Added as a result of the RANDEX.D VIRUS! Source=Paul Collins Startup list [MsSystem] Confirmed=X Filename=msdos.exe Description=Adult content downloader - see here Source=Paul Collins Startup list [MsSystem] Confirmed=X Filename=mssys.exe Description=Added as a result of the VANTA.A VIRUS! Source=Paul Collins Startup list [Mstapi] Confirmed=X Filename=Mstapi.exe Description=Keylogger trojan Source=Paul Collins Startup list [Mstask] Confirmed=X Filename=mstask.exe Description=Added as a result of the OPASERV.N VIRUS! Note - this is not the "Scheduling Agent" and the executable resides in C:\\Windows or C:\\WINNT Source=Paul Collins Startup list [Mstcgww] Confirmed=? Filename=MSTCGWW.EXE Description=?? Source=Paul Collins Startup list [Mstng32] Confirmed=X Filename=MSTng32.exe Description=Added as a result of the TANG VIRUS! Source=Paul Collins Startup list [MSUpdate] Confirmed=X Filename=wupd.exe Description=Added as a result of the ALADINZ.M VIRUS! Source=Paul Collins Startup list [MSupdate.exe] Confirmed=X Filename=N/A Description=CoolWebSearch parasite related - resets home page to an adult content site Source=Paul Collins Startup list [MSupdater.exe] Confirmed=X Filename=N/A Description=CoolWebSearch parasite related. Installs the Winshow.dll browser plugin Source=Paul Collins Startup list [msuser32.exe] Confirmed=X Filename=msuser32.exe Description=Added as a result of the ANDROV VIRUS! Source=Paul Collins Startup list [msvc32] Confirmed=X Filename=msvc32.exe Description=ClientMan parasite variant Source=Paul Collins Startup list [msvcc] Confirmed=X Filename=msvchost.exe Description=Added as a result of the XOMBE VIRUS! Source=Paul Collins Startup list [MSVersion] Confirmed=X Filename=INTERNETFEATURES.execlrschp038.exe Description=Added as a result of the POPMON.A VIRUS! - also known as PopMonster adware Source=Paul Collins Startup list [MSVXD] Confirmed=X Filename=MSVXD.EXE Description=Added as a result of the DATOM.A VIRUS! Source=Paul Collins Startup list [MSwheel] Confirmed=U Filename=mswheel.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Mswincfg] Confirmed=X Filename=Mswincfg32.exe Description=Added as a result of the CYBERSPY VIRUS! Source=Paul Collins Startup list [msys lptt01] Confirmed=X Filename=msys.exe Description=New variant of the RapidBlaster parasite (in a "Msyss" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Msys32] Confirmed=X Filename=morfitwebentrance.exe Description=Morfit ADjectPager - "uses home page rental technology for generating revenues". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage Source=Paul Collins Startup list [MS_NETD_WIN32] Confirmed=X Filename=netd32.EXE Description=Added as a result of the RANDEX.F VIRUS! Source=Paul Collins Startup list [MS_SETUP.EXE] Confirmed=X Filename=N/A Description=Added as a result of the CHARGE VIRUS! Source=Paul Collins Startup list [Mtr2] Confirmed=X Filename=mtr2.exe Description=Added as a result of the KRYPTONIC GHOST VIRUS! Source=Paul Collins Startup list [MUAL] Confirmed=U Filename=mual.exe Description=Millesky video mail updater and launcher Source=Paul Collins Startup list [muamgr] Confirmed=U Filename=muamgr.exe Description=Quick access to MicroAngelo 5.0. It can make the background of the icon text transparent and also change the color of the shortcut's text to a color you want. Very useful, if you have a wallpaper. Available via Start -> Programs Source=Paul Collins Startup list [Mufix] Confirmed=? Filename=mufix.exe Description=?? Source=Paul Collins Startup list [Multi-function keyboard] Confirmed=U Filename=GWHotkey.exe Description=Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail, browser, volume and CD/DVD controls, etc) Source=Paul Collins Startup list [MultiCAM Initializer] Confirmed=U Filename=MCamBoot.exe Description=The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled Source=Paul Collins Startup list [Multimedia KBDorMULTIMEDIA KEYBOARD] Confirmed=U Filename=MMKeybd.exe Description=Multimedia keyboard manager. Required if you use the additional keys. Can also be listed as Keyboard Manager Source=Paul Collins Startup list [MultiRes] Confirmed=U Filename=MultiRes.exe Description=MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP Source=Paul Collins Startup list [MUPS] Confirmed=U Filename=MUPS.exe Description=Lauches the Belkin Bulldog Plus Service - required if you want to access the UPS advanced functions Source=Paul Collins Startup list [murphy shield] Confirmed=Y Filename=lmgui.exe Description=Firewall part of BitDefender virus scanner/firewall Source=Paul Collins Startup list [Music01 Server] Confirmed=N Filename=Music01 Server.exe Description=J River Media Jukebox Source=Paul Collins Startup list [MusIRC (irc.music.com) client] Confirmed=X Filename=musirc4.71.exe Description=Added as a result of the RANDEX.Q VIRUS! Source=Paul Collins Startup list [MutexServiceEx] Confirmed=X Filename=Sys32Smm.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [MWProEng] Confirmed=N Filename=MWProEng.exe Description=Logitech Mouseware Pro software - only required when using special functions Source=Paul Collins Startup list [MWSnap] Confirmed=N Filename=MWSnap.exe Description=MWSnap - screen capture utility. Start manually when required Source=Paul Collins Startup list [mwsoemon] Confirmed=X Filename=mwsoemon.exe Description="My Web Search" malware Source=Paul Collins Startup list [Mwsvm] Confirmed=X Filename=mwsvm.exe Description=SeekSeek search hijacker related - as seen here Source=Paul Collins Startup list [MxHLp32] Confirmed=X Filename=MxHLp32.exe Description=Added as a result of a variant of the VAGRNOCKER VIRUS! Source=Paul Collins Startup list [MXO Auto Loader] Confirmed=U Filename=MXOaldr.exe Description=Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions Source=Paul Collins Startup list [MxRunner] Confirmed=U Filename=MxRunner.exe Description=EasyUninstall from Aladdin Systems (formerly by Ontrack) Source=Paul Collins Startup list [My Agent] Confirmed=X Filename=msagent.exe Description=Added as a result of the NEGASMS.A VIRUS! Source=Paul Collins Startup list [My App] Confirmed=X Filename=SMSSvc.exe Description=Added as a result of the NEGASMS.A VIRUS! Source=Paul Collins Startup list [My Search Bar Eq] Confirmed=X Filename=S4BAREQ.EXE Description=MySearch bar parasite Source=Paul Collins Startup list [MyAgtTry] Confirmed=U Filename=MyAgtTry.exe Description=System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications Source=Paul Collins Startup list [Myapp] Confirmed=X Filename= Description=Added as a result of the FATEE.B VIRUS! Source=Paul Collins Startup list [Myapp] Confirmed=X Filename=service.exe Description=Homepage hijacker Source=Paul Collins Startup list [MyCIO Agent Service] Confirmed=Y Filename=myagtsvc.exe Description=McAfee VirusScan ASaP Agent service Source=Paul Collins Startup list [myCIO.com ASaP] Confirmed=U Filename=MyAgtTry.exe Description=System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications Source=Paul Collins Startup list [myCIO.com Splash] Confirmed=N Filename=Splash.exe Description=Splash screen for McAfee VirusScan ASaP on-line scanner Source=Paul Collins Startup list [MyCometCursor] Confirmed=X Filename=MYCOME~1.EXE Description=Comet Cursor adware Source=Paul Collins Startup list [MyFastAccess] Confirmed=N Filename=myfastupdate.exe Description=My-Fast-Access toolbar updater Source=Paul Collins Startup list [MyLife] Confirmed=X Filename=CmdServ.exe Description=Added as a result of the HOLAR.A VIRUS! Source=Paul Collins Startup list [myNetWatchman] Confirmed=U Filename=nwclient.exe Description=Sends your firewall alerts to a website, which then filters them and forwards details of suspicious activities to the host ISP they originated from. Only needs to be running when your firewall is running Source=Paul Collins Startup list [MyPointsPointAlert] Confirmed=X Filename=wjview ...MyPointsPointAlertrun.exe Description="With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles". Dubious privacy policy Source=Paul Collins Startup list [myprint mileage] Confirmed=U Filename=mpm.exe Description=Reports battery status on a portable printer Source=Paul Collins Startup list [MySoftware NewsFlash] Confirmed=? Filename=Newsflsh.exe Description=?? Source=Paul Collins Startup list [MytekSystrayExePath] Confirmed=U Filename=MyTekSystray.exe Description=MyTek system tray - web site providing computer tech support in Australia Source=Paul Collins Startup list [MyVitalAgent] Confirmed=U Filename=VtlAgent.exe Description=MyVitalAgent from Lucent Technologies. Replacement for Net.Medic, monitoring all popular internet transactions and alerting the user of the loaction of connection problems. Available via Start -> Programs Source=Paul Collins Startup list [MyWebSearch Email Plugin] Confirmed=X Filename=mwsoemon.exe Description="My Web Search" malware Source=Paul Collins Startup list [N2PTray] Confirmed=U Filename=Net2fone.exe Description=An Internet telephony application. Needed only if you have an account at Net2Phone, Inc Source=Paul Collins Startup list [NADaemon] Confirmed=N Filename=NADAEMON.EXE Description=Program by NetActive which appears to be piggybacked onto some Nvidia graphics cards software. They seem to look after "digital rights management". One user reports disabling it has no detrimental affect - not required Source=Paul Collins Startup list [Naggerrunkey] Confirmed=N Filename=nagger.exe Description=Packard Bell Free Internet Signup screen Source=Paul Collins Startup list [Naimagent_service] Confirmed=Y Filename=EPOAgentnaimas32.exe Description=Networked version of McAfee VirusScan. Installs, configures and updates the software and DAT (virus definition) files on local computers from a network server. A resource hog but required for DAT updates and if disabled can also cause random freezes and error messages Source=Paul Collins Startup list [Naimagent_UI] Confirmed=Y Filename=EPOAgentnaimag32.exenaimag32.exe Description=Workstation background program for Network Associates� McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan Source=Paul Collins Startup list [Name] Confirmed=X Filename=Iexplorer0.exe Description=Added as a result of the THREADSYS VIRUS! Source=Paul Collins Startup list [Natal] Confirmed=X Filename=Natal.scr Description=Added as a result of the OPASERV.AE VIRUS! Source=Paul Collins Startup list [NAV] Confirmed=X Filename=RuxDLL32.exe Description=Added as a result of the MAPSON.D VIRUS! Source=Paul Collins Startup list [nAv AGENT] Confirmed=X Filename=N/A Description=Added as a result of the RIOSYS VIRUS! Note the lower-case "n" and "v" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes Source=Paul Collins Startup list [NAV Agentornavapw32] Confirmed=Y Filename=navapw32.exe Description=Introduced with Norton Anti-Virus 2002 to replace Norton Auto-Protect and Norton eMail Protect. Leaving "Auto-Protect", "E-mail Scanning" and "Script Blocking" enabled doesn't seem to slow the system down. Source=Paul Collins Startup list [NAV Auto Update] Confirmed=X Filename=Navautoupdate.exe Description=Added as a result of the SPYBOT VIRUS! Source=Paul Collins Startup list [NAV CfgWizorNAV Configuration Wizard] Confirmed=N Filename=cfgwiz.exe Description=Introduced with Norton Anti-Virus 2002, this is a real resource hog. Many NAV users will find they can live without loading it Source=Paul Collins Startup list [NAV DefAlert] Confirmed=U Filename=DefAlert.exe Description=Norton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis Source=Paul Collins Startup list [NAV Live Update] Confirmed=X Filename= Description=Added as a result of the DEBORMS.C VIRUS! <filename> represents the path to the worm. Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec Source=Paul Collins Startup list [NavAgent32] Confirmed=X Filename=lasvr32.exe Description=Added as a result of the FEMOT.D VIRUS! Source=Paul Collins Startup list [NavAgent32] Confirmed=X Filename=SCardSvr32.Exe Description=Added as a result of the MOFEI.B VIRUS! Source=Paul Collins Startup list [Naviscope] Confirmed=U Filename=naviscope.exe Description=Naviscope is a multipurpose browser enhancement that can speed up Web searches, lock out cookies, examine HTML send/receive headers, provide single-click network diagnostics, and much more Source=Paul Collins Startup list [navman_20] Confirmed=X Filename=sysnav32.exe Description=Hijacker, possibly a CoolWebSearch variant Source=Paul Collins Startup list [NavPass] Confirmed=X Filename=NavPass.exe Description=Free system for gaining access to and downloading from adult content web-sites Source=Paul Collins Startup list [NavScan] Confirmed=X Filename= Description=Added as a result of the OBSORB VIRUS! Source=Paul Collins Startup list [NAVUpd] Confirmed=X Filename=rundll32.exe navupd.dll, Startup Description=Added as a result of the NAVU VIRUS! Source=Paul Collins Startup list [NB Common Dialog Enhancements] Confirmed=N Filename=COMDLGEX.EXE Description=Part of McAfee Nuts & Bolts. With Common Dialog Enhancements, you can add MRU list box to open dialogs Source=Paul Collins Startup list [NB Start Menu] Confirmed=N Filename=STARTM.EXE Description=Part of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B Source=Paul Collins Startup list [NB Windows Patterns] Confirmed=N Filename=WINDBKGND.EXE Description=Part of McAfee Nuts & Bolts. With Background Patterns, you can change background patterns of wizard and dialog windows Source=Paul Collins Startup list [NBJ] Confirmed=U Filename=NBJ.exe Description=Ahead Nero BackItUp backup program. Only required for if you have scheduled back-ups Source=Paul Collins Startup list [NbkCtrl] Confirmed=U Filename=NbkCtrl.exe Description=Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here Source=Paul Collins Startup list [NCClient] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [NCD] Confirmed=N Filename=ncd.exe Description=Norton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path Source=Paul Collins Startup list [NCLAUNCH] Confirmed=? Filename=NCLAUNCH.Exe Description=Part of SWF Studio from Northcode Inc - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP. Is it required? Source=Paul Collins Startup list [NCS_SS] Confirmed=N Filename=Csinsm32.exe Description=Same as CleanSweep Smart Sweep-Internet Sweep Source=Paul Collins Startup list [NDDEAGNT] Confirmed=? Filename=NDDEAGNT.EXE Description=WinNT default process. Network Dynamic Data Exchange (DDE) Agent, handles requests for network DDE services Source=Paul Collins Startup list [NDplDeamon] Confirmed=X Filename=nstask32.exewinlogin.exe Description=Added as a result of the RANDEX.E VIRUS! Source=Paul Collins Startup list [NDPS] Confirmed=U Filename=DPMW32.EXE Description=Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature Source=Paul Collins Startup list [NDSTray] Confirmed=? Filename=NDSTray.exe Description=ConfigFree� Tray on a Toshiba laptop. What does it do and is it required? Source=Paul Collins Startup list [Necbar] Confirmed=N Filename=Necbar.exe Description=Nec Assistant; Ark's Navigator, a graphical interface for NEC computers Source=Paul Collins Startup list [NECMFK] Confirmed=Y Filename=necmfk.exe Description=NEC wireless keyboard driver Source=Paul Collins Startup list [Necutray] Confirmed=U Filename=Necutray.exe Description=Driver for external USB storage devices (hard drives, flsh disks, etc) Source=Paul Collins Startup list [neqprvfy.exe] Confirmed=? Filename=neqprvfy.exe Description=Appears to be related to the downloading of some application - possibly verifying updates? Source=Paul Collins Startup list [Nero.ma] Confirmed=X Filename=.exe Description=Added as a result of the JONBARR.D VIRUS! where <digits> is 2 or 3 random digits Source=Paul Collins Startup list [NeroCheck] Confirmed=U Filename=nerocheck.exe Description=Associated with "Nero Burning Rom" CD writing software. Used to install/control Nero driver nerocd2k.sys. Required only if you use Win2K/XP and login without admin privileges Source=Paul Collins Startup list [NeroCheck] Confirmed=X Filename=regedit.exe Description=Added as a result of the DOOMJUICE.B VIRUS! Note - this is not the valid Ahead Nero CD burning program. Also it is not the valid Windows registry editor which resides in C:\\Windows or C:\\Winnt wheras this version resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K) or C:\\Windows\\System32 (WinXP) Source=Paul Collins Startup list [Net] Confirmed=X Filename=WINREG.EXE Description=Added as a result of the ASSASIN.D VIRUS! Source=Paul Collins Startup list [Net Activity Diagram] Confirmed=U Filename=nad.exe Description=Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs Source=Paul Collins Startup list [Net-It Launcher] Confirmed=N Filename=NILaunch.exe Description=Net-It - web publishing software Source=Paul Collins Startup list [NetAccelerator] Confirmed=U Filename=NetAccel.exe Description=NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster, browse faster, surf faster!. Only required if you find it helps improve your performance Source=Paul Collins Startup list [Netapi] Confirmed=X Filename=Netapi.exe Description=Added as a result of the NETDEVIL.14 (NetDevil 1.4) VIRUS! Source=Paul Collins Startup list [NetApp] Confirmed=X Filename=winserv.exe Description=Added as a result of the SHADOWTHIEF VIRUS! Source=Paul Collins Startup list [netconfig] Confirmed=X Filename=netconfig.exe Description=Added as a result of the NETCONF VIRUS! Source=Paul Collins Startup list [NetCruiser Dialer] Confirmed=U Filename=NCDialer.exe Description=NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected, dial and hangup at predefined times and automatic redialing of dropped connections" Source=Paul Collins Startup list [netfxupdateorNetFxUpdate_v1.0.3705] Confirmed=? Filename=netfxupdate.exe Description=Would appear to be a valid Microsoft .NET file (see here) but this suggest's it's a trojan? Source=Paul Collins Startup list [Netlimiter] Confirmed=U Filename=Netlimiter.exe Description=Netlimiter - "An internet traffic control tool to monitor applications which access the internet and actively control their internet traffic. Use it o set (download/upload) speed limits for applications or even single connection. NetLimiter also allows you to share your internet connection bandwidth among all applications running on your PC." Source=Paul Collins Startup list [Netline User] Confirmed=N Filename=netchk.exe Description=Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game, for example Source=Paul Collins Startup list [NetManagerService] Confirmed=X Filename=ntss.exe Description=Added as a result of the BESTPICS.A VIRUS! Source=Paul Collins Startup list [NetMon] Confirmed=X Filename=netmon.exe Description=Added as a result of the MIMAIL.M VIRUS! Source=Paul Collins Startup list [NetPatrol] Confirmed=U Filename=winclient.exe Description=NetPatrol network monitoring software Source=Paul Collins Startup list [NetPerSec] Confirmed=N Filename=NetPerSec.exe Description=NetPerSec - measures the real-time speed of your Internet connection Source=Paul Collins Startup list [NetPumper] Confirmed=N Filename=NetPumperIEProxy.exe Description=NetPumper - download manager Source=Paul Collins Startup list [NetReach] Confirmed=X Filename=nrcheck.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Netropa Internet Receiver] Confirmed=X Filename=Netropa.exe Description=Netropa Internet Receiver. Shows a scrolling bar with the news. Major resource hog and flagged as spyware Source=Paul Collins Startup list [NetRun] Confirmed=U Filename=NetRun.exe Description=NetRun - will 'RUN' a 'List' of programs only when a internet connection is detected, and close/kill the same 'List' when the connection is lost Source=Paul Collins Startup list [Netscape Messenger] Confirmed=N Filename=NETSCAPE.EXE Description=In Netscape 6 (I know for sure with 6.2.1, maybe with 6.0) Netscape.exe is the main executable file for Netscape Navigator, Netscape Mail and News, and Netscape Messenger (the new name for the embedded AIM, no doubt to make it sound like Windows Messenger, the XP version of MSN Messenger). Basically, netscape.exe can be more than just Netscape Messenger, and Messenger can be more then just AIM in disguise, depending on the version of Netscape installed Source=Paul Collins Startup list [Netscp6] Confirmed=N Filename=Netscp6.exe Description=Netscape 6 Source=Paul Collins Startup list [NetShow Powerpoint Helper] Confirmed=U Filename=NSPPTHLP.EXE Description=If disabled, user created fonts can no longer be seen by other programs Source=Paul Collins Startup list [NetStat Live] Confirmed=N Filename=Nsl.exe Description=AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data Source=Paul Collins Startup list [NetTime] Confirmed=U Filename=NETTIME.EXE Description=From a visitor - "This is the executable for NetTime. It is started from the registry when you check the box to start at startup. NetTime allows you to synchronize your computers' clock with a server on your local net or the internet using any of several protocols, e.g. NTP." Source=Paul Collins Startup list [NetTurbo] Confirmed=U Filename=netturbo.exe Description=NetTurbo from SharewareOnline.com. "Accelerate Your Internet Connections by up to 600%". If you find it helps your connectivity leave it enabled Source=Paul Collins Startup list [NetWatch32] Confirmed=X Filename=netwatch.exe Description=Added as a result of the MIMAIL.C VIRUS! Source=Paul Collins Startup list [Netword Agent] Confirmed=N Filename=nwant33.exe Description=An interesting browser utility that allows you to navigate by typing a single word or phrase (a "NetWord") related to what you're looking for into your browser's location field. It also puts an icon in the system tray icon that is a circle with the letter N in the center to access the menu faster. Available via Start -> Programs Source=Paul Collins Startup list [Network Administration] Confirmed=X Filename=NAS.exe Description=Added as a result of the ANTILAM.20.Q VIRUS! Source=Paul Collins Startup list [Network Associates Error Reporting Service] Confirmed=U Filename=TBMon.exe Description=Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software Source=Paul Collins Startup list [NetWork Device Switch] Confirmed=U Filename=NetDevSW.exe Description=Toshiba laptops with built-in Wi-Fi. Allows switching between Wi-Fi and internal ethernet. Only necessary if you have regular need to switch back and forward between these network interfaces. Located in Startup folder so make own shortcut to it and disable if not really necessary Source=Paul Collins Startup list [Network Host Controller] Confirmed=X Filename= Description=Added as a result of the WHISPER VIRUS! Source=Paul Collins Startup list [NetworkClient] Confirmed=X Filename=NetworkClient.exe Description=Added as a result of the LEMUR VIRUS! Source=Paul Collins Startup list [NetworkSetup] Confirmed=N Filename=dlink.exe Description=D-Link System Tray icon Source=Paul Collins Startup list [Netzip Smart Downloader] Confirmed=X Filename=npnzdad.exe Description=Advertising spyware Source=Paul Collins Startup list [NetZIPFolders] Confirmed=N Filename=nzfprop.exe Description=Netzip Classic zip file manager Source=Paul Collins Startup list [NeuroMedia(IESpeaker)] Confirmed=X Filename=NeuroMedia.exe Description=Part of an older freeware version of IESpeaker - a program that allows you to listen to web pages. NeuroMedia.exe only downloads advertisments. Not included in the paid-for version currently available Source=Paul Collins Startup list [NeuroSpeech OESpeaker] Confirmed=N Filename=OEMonitor.exe Description=Part of OESpeaker - a program that allows you to listen to long E-mails instead of reading them in Outlook Express. OEMonitor.exe checks whether OE is open or not Source=Paul Collins Startup list [New.netorNEWDOT~1] Confirmed=X Filename=rundll32.exe NewDotNetStartup Newdot~2.exe Description=Advertising spyware, see here for details on how to remove as disabling in MSCONFIG reportedly doesn't work. Installed as part of the Kazaa Media Desktop bundle for example Source=Paul Collins Startup list [Newsalrt] Confirmed=N Filename=NEWSALRT.EXE Description=MSNBC News system tray utility to alert you to new news Source=Paul Collins Startup list [Newsgroup lptt01orNewsgroup ml097e] Confirmed=X Filename=newsgroup.exe Description=Variant of the RapidBlaster parasite (in a "newsgroup" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [NewsUpd] Confirmed=N Filename=newsupd.exe Description=For Creative Soundblaster Live! series soundcards. System tray application for News updates. Available via Start -> Programs. Also spyware - see here. Source=Paul Collins Startup list [NewtonKnowsUpd] Confirmed=X Filename=NewtKnow.exe ...NewtnUpd.dll, runkey Description=NewtonKnow hijacker Source=Paul Collins Startup list [NFM Service] Confirmed=U Filename=NPDOR9x.exe Description=Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required Source=Paul Collins Startup list [nForce Tray Options] Confirmed=N Filename=sstray.exe Description=nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys Source=Paul Collins Startup list [NGClient] Confirmed=U Filename=ngctw32.exe Description=Symantec Ghost Server software - needed for a "a Ghost multicast" (transfer images to multiple machines). Can be launched manually Source=Paul Collins Startup list [NGServer] Confirmed=N Filename=ngserver.exe Description=Symantec/Norton Ghost Console service Source=Paul Collins Startup list [Nielsen NetRatings] Confirmed=N Filename=insight.exe Description=Nielsen NetRatings - "Provides real-time research and analysis about Internet users, delivering the timely, actionable data you need to make critical business decisions on your competition, your Web site�s audience and your customers". Is it required? Source=Paul Collins Startup list [nikLaus] Confirmed=X Filename=nikLaus.exe Description=Added as a result of the NIKLAS VIRUS! Source=Paul Collins Startup list [NInit] Confirmed=N Filename=NInit.exe Description=Norton Uninstall Deluxe. Monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging - not required Source=Paul Collins Startup list [nisserv] Confirmed=Y Filename=NISSERV.EXE Description=Norton Personal Firewall Source=Paul Collins Startup list [Nisum] Confirmed=Y Filename=NISUM.EXE Description=Norton Personal Firewall Source=Paul Collins Startup list [NJG40] Confirmed=X Filename=NJG40.EXE Description=Added as a result of the BANCOS.D VIRUS! Source=Paul Collins Startup list [NkvMon.exe] Confirmed=N Filename=NkvMon.exe Description=Nikon View 5 - for transferring pictures from Nikon digital cameras Source=Paul Collins Startup list [NkVwMon.exe] Confirmed=N Filename=NkVwMon.exe Description=Nikon View - for transferring pictures from Nikon digital cameras Source=Paul Collins Startup list [NMSSvc] Confirmed=? Filename=NMSSVC.EXE Description=NIC Management Service - diagnostics program for Intel Pro family network cards Source=Paul Collins Startup list [NMSVC] Confirmed=Y Filename=nmSvc.exe Description=Covenant Eyes - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it. Disabling it means loss of internet connection until renabled - therefore required if you use it Source=Paul Collins Startup list [NNSvc] Confirmed=U Filename=nnsvc.exe Description=NetNanny internet filter Source=Paul Collins Startup list [No Credit Card] Confirmed=X Filename=plugin-.exe Description=Adult content pop-up dialler Source=Paul Collins Startup list [No-IP DUC] Confirmed=U Filename=DUC20.exe Description=Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available Source=Paul Collins Startup list [NoAds] Confirmed=U Filename=NoAds.exe Description=Blocks advertisement banners in Internet Explorer Source=Paul Collins Startup list [Nod32CC] Confirmed=U Filename=nod32cc.exe Description=Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button Source=Paul Collins Startup list [NOD32kernel] Confirmed=Y Filename=Nod32krn.exe Description=Nod32 Antivirus Version 2 Source=Paul Collins Startup list [nod32kui] Confirmed=Y Filename=nod32kui.exe Description=Nod32 Antivirus Version 2 Source=Paul Collins Startup list [NOD32POP3] Confirmed=Y Filename=Pop3scan.exe Description=POP3 E-mail part of Eset's NOD32 virus-scanner Source=Paul Collins Startup list [NodeMnger] Confirmed=? Filename=Nodemngr.exe Description=Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon? Source=Paul Collins Startup list [nodriver] Confirmed=X Filename=AUEKXRZ.EXE Description=Added as a result of a variant of the SPYBOT VIRUS! Source=Paul Collins Startup list [Nokia Connection Monitor] Confirmed=N Filename=NclConf.exe Description=Monitors the infrared port, the serial ports and the Bluetooth for a Nokia phone connection. It is installed by the Nokia PC Suite (and Nokia PC Connectivity SDK), and the tray icon shows if a phone has been connected. If you have a conflict with another program, such as TV tuner card remote control monitor, you can disable it, and run only when needed. Available via a desktop shortcut or Start -> Programs - not required Source=Paul Collins Startup list [NOMAD Detector] Confirmed=U Filename=ctmnrun.exe Description=Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected Source=Paul Collins Startup list [NomdCheck] Confirmed=N Filename=nomdchek.exe Description=Part of Intel's Native Audio Source=Paul Collins Startup list [Norman ZANDA] Confirmed=U Filename=ZLH.EXE Description=System Tray icon for Norman Antivirus Source=Paul Collins Startup list [Norton Auto-Protect] Confirmed=Y Filename=navapw32.exe Description=Norton Anti-Virus's background scanning process. Can be inconvenient because it scans files when Run/Opened or Downloaded/Created and you can scan files manually via right-click after downloading/copying. However, in light of some of the viruses around these days it's probably best to put up with the inconvenience Source=Paul Collins Startup list [Norton AV Preload] Confirmed=? Filename=Premend.exe Description=Norton Antivirus related. What does it do and is it required Source=Paul Collins Startup list [Norton Crashguard Monitor] Confirmed=N Filename=cgmenu.exe Description=Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001 Source=Paul Collins Startup list [Norton Disk Doctor] Confirmed=N Filename=Ndd32.exe Description=Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, checking for disk errors. Better than ScanDisk but can be started manually via Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup folder as well Source=Paul Collins Startup list [Norton eMail Protect] Confirmed=Y Filename=POPROXY.EXE Description=Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it Source=Paul Collins Startup list [Norton Live Updater] Confirmed=X Filename=Cavapsvc.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Norton Live Updater] Confirmed=X Filename=Sochost.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Norton Navigator Loader] Confirmed=N Filename=nnloader.exe Description=An older Norton utility for file management under Windows 95. More information here Source=Paul Collins Startup list [Norton Program Scheduler] Confirmed=U Filename=nsched32.exeNPSsvc.exe Description=Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95, WinNT(?), Win2K(?)) to schedule automatic tasks such as Norton Anti-Virus scans Source=Paul Collins Startup list [Norton Program Scheduler Event Checker] Confirmed=? Filename=npscheck.exe Description=Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker Source=Paul Collins Startup list [Norton System Doctor] Confirmed=N Filename=Sysdoc32.exe Description=Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, major resource hog and best started manually form Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup folder as well Source=Paul Collins Startup list [NotebookManager] Confirmed=? Filename=nbm.exe Description=Associated with Acer notebook PCs. What does it do and is it required? Source=Paul Collins Startup list [Notepad lptt01orNotepad ml097e] Confirmed=X Filename=notepad.exe Description=Variant of the RapidBlaster parasite (in a "nvd32" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not Windows Notepad which has the same executable name Source=Paul Collins Startup list [NovaPortal Single User Service] Confirmed=? Filename=NPSU.exe Description=?? Source=Paul Collins Startup list [NovastorSchedulerd] Confirmed=U Filename=SCHENGD.EXE Description=NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it Source=Paul Collins Startup list [NPROTECT] Confirmed=U Filename=nprotect.exe Description=Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid - see here Source=Paul Collins Startup list [NPS Event Checker] Confirmed=? Filename=npscheck.exe Description=Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker Source=Paul Collins Startup list [NSCheck] Confirmed=X Filename=NSCHECK.EXE Description=Nettsetter - a "market research" program intended to track your Internet usage and buying habits. To remove click on Start -> Run and enter "%WinDir%\\SYSTEM\\NSCheck.exe /uninstall" (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) followed by enter - this removes all registry entries and a box appears saying "uninstall successful. Find and delete the files nscheck.exe, ossproxy.exe.rvt & ossproxy.exe Source=Paul Collins Startup list [nscntrl] Confirmed=X Filename=nscntrl.exe Description=Adult content dialler Source=Paul Collins Startup list [nsdlua] Confirmed=X Filename=nsdlua.exe Description=All-In-One Telcom - adult content dialler Source=Paul Collins Startup list [nsdriver] Confirmed=X Filename=nssys32.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Nsengine] Confirmed=U Filename=Nsengine.exe Description=Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here Source=Paul Collins Startup list [NSHelper] Confirmed=U Filename=aexnsinstallhelper.exe Description=Altiris Express Notification Server Install helper - monitors integrity of the installation Source=Paul Collins Startup list [NSupdate] Confirmed=X Filename=NSupdate.exe Description=Adult content dialer Source=Paul Collins Startup list [Nsvdr] Confirmed=X Filename=nsvdr.exe Description=Adult content dialler Source=Paul Collins Startup list [NSystemMonitor] Confirmed=N Filename=Symmon.exe Description=Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging Source=Paul Collins Startup list [NT Kernel Patch] Confirmed=N Filename=ntkrnlpt.exe Description=FaxServe network fax software Source=Paul Collins Startup list [NT Logging Service] Confirmed=X Filename=Syslog32.exe Description=Added as a result of the DONK.B or DONK.C VIRUSES! Source=Paul Collins Startup list [ntdll] Confirmed=X Filename=ntdll.exe Description=Added as a result of the BIONET.404 VIRUS! Source=Paul Collins Startup list [NTDLM] Confirmed=X Filename=csrss.exe Description=Added as a result of the HALE VIRUS! Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling as this resides in c:\\winnt\\system32\\qossrv Source=Paul Collins Startup list [NTFSCLUP] Confirmed=Y Filename=NTFSCLUP.EXE Description=Part of ConfigSafe- "checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiting" Source=Paul Collins Startup list [ntlfreedom] Confirmed=N Filename=RyDial.dll, QuickStart Description=NTL Freedom ISP software - reportedly not required Source=Paul Collins Startup list [NTrtc] Confirmed=N Filename=ntrtc.exe Description=Dell year 2000 tool to deal with non-standard applications. Only required on older Dell PCs that may need this support - see here Source=Paul Collins Startup list [NTsocket] Confirmed=X Filename=NoeWinnt.exe Description=Added as a result of the ATAKA-E VIRUS! Source=Paul Collins Startup list [NTVDM] Confirmed=U Filename=NTVDM.EXE Description=Windows NT Virtual DOS Machine (NTVDM) for running 16-bit tasks on the 32-bit OS's (Windows NT, 2K and XP). Required if hardware on a machine with these OS's needs 16-bit DOS drivers. You can find a bit more about NTVDM here Source=Paul Collins Startup list [ntvdscm] Confirmed=X Filename=ntvdscm.exe Description=Added as a result of the TR/SCKEYLOG.SPY.20 VIRUS! Source=Paul Collins Startup list [NuTCSetupEnviron] Confirmed=Y Filename=ncoeenv.exe Description=Used by the MKS Toolkit for Enterprise Developers product. NuTCracker is a Unix runtime environment for Windows, so disabling this would be unwise if you are using NuTCracker or any 3rd party package that is using it. Since you might not know what is actually using it it's probably best left alone Source=Paul Collins Startup list [NVCLOCK] Confirmed=? Filename=rundll32 nvclock.dll, fnNvclock Description=Overclocking utility for nVidia based graphics cards? Source=Paul Collins Startup list [NvColorInit] Confirmed=? Filename=rundll32.exe NvQtwk.dll, NvColorInit Description=Associated with Nvidia based graphics cards Source=Paul Collins Startup list [NvCplorNvCplDaemon] Confirmed=U Filename=rundll32.exe NvCpl.dll, NvStartup Description=Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card Source=Paul Collins Startup list [NvCplDaemon] Confirmed=U Filename=rundll32.exe NvQtwk.dll, NvCplDaemon Description=Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card Source=Paul Collins Startup list [NvCplDmn] Confirmed=X Filename=NAVSVC.EXE Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [nvd32 lptt01ornvd32 ml097e] Confirmed=X Filename=nvd32.exe Description=Variant of the RapidBlaster parasite (in a "nvd32" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Nvid] Confirmed=X Filename=<8 random charachters> Description=Unidentified adware Source=Paul Collins Startup list [Nvid32] Confirmed=X Filename=Nvid32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Nvidex32] Confirmed=X Filename=Nvidex32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Nvidia32] Confirmed=X Filename=nvidia32.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [NvidiaQuickTweakorNVQuickTweak] Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvTaskbarInit Description=System Tray icon used to change display settings for nVidia based graphics cards. Unnecessary since you can easily configure these settings the way you want them in the Display Properties Source=Paul Collins Startup list [NVIEW] Confirmed=U Filename=rundll32.exe nview.dll, nViewLoadHook Description=This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers Source=Paul Collins Startup list [NvInitialize] Confirmed=N Filename=rundll32.exe NvQtwk.dll, NvXTInit Description=Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled Source=Paul Collins Startup list [NVmax] Confirmed=Y Filename=NVmax.exe Description=NVmax is a old tweaking utility for NVidia graphics cards. In the startup list if the user chooses to overclock their card Source=Paul Collins Startup list [NvMediaCenter] Confirmed=U Filename=RunDLL32.exe NvMCTray.dll, NvTaskbarInit Description=System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties Source=Paul Collins Startup list [NVRT] Confirmed=N Filename=nvrt.exe Description=NVRefreshTool is a utility that will automatically detect the maximum refresh rate at each resolution that your monitor supports Source=Paul Collins Startup list [NvSvc] Confirmed=N Filename=nvsvc.exe Description=NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active, but no adverse side effects with it disabled. NOTE: If using drivers other than nVidia's, such as Asus, this service may have been renamed to reflect that Source=Paul Collins Startup list [NvXplDeamon] Confirmed=X Filename=xstyles.exe Description=Added as a result of the SMALL.AJ VIRUS! Source=Paul Collins Startup list [NWEReboot] Confirmed=? Filename=dummy.exe Description=?? Source=Paul Collins Startup list [nwiz] Confirmed=N Filename=nwiz.exe Description=Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the operation of your system Source=Paul Collins Startup list [Nwpopup] Confirmed=Y Filename=Nwpopup.exe Description=Broadcast message handler part of Novell Netware that displays server, printer and other messages. Older version of nwrecmsg below Source=Paul Collins Startup list [nwrecmsg] Confirmed=U Filename=nwrecmsg.exe Description=Broadcast message handler part of Novell Netware that displays server, printer and other messages. Newer version of Nwpopup above and can cause crashes Source=Paul Collins Startup list [NWTRAY] Confirmed=Y Filename=nwtray.exe Description=Novell Netware. Displays the red "N" tray icon which can be disabled (by right-click on the icon) but is also needed by the client Source=Paul Collins Startup list [oahstifr] Confirmed=Y Filename=oahstifr.exe Description=Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." Source=Paul Collins Startup list [OAKSTART] Confirmed=U Filename=OAKSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. Source=Paul Collins Startup list [OAKTASK] Confirmed=N Filename=OAKTASK.EXE Description=Taskbar utility for a "control panel" for a CD-RW Source=Paul Collins Startup list [Object Store Server] Confirmed=Y Filename=osserver.exe Description=Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." Source=Paul Collins Startup list [objtjprx] Confirmed=? Filename=objtjprx.exe Description=?? Source=Paul Collins Startup list [OCAudioIni] Confirmed=N Filename=OCAudioIni.exe Description=One-click Audio Converter - allows you to convert files of multiple audio formats right from Windows Explorer Source=Paul Collins Startup list [ocraware] Confirmed=N Filename=ocraware.exe Description=Optical Character Recognition software as part of OmniPage Limited Edition - supplied with some scanners. Scan directly into most word processor applications, such as Word, WordPerfect, etc. Available via Start -> Programs Source=Paul Collins Startup list [ocx32] Confirmed=X Filename=ocx32.exe Description=Added as a result of the ASTEF or RESPAN VIRUSES! Source=Paul Collins Startup list [OD] Confirmed=X Filename=SYSCNTR.EXE Description=HotVideo dialler Source=Paul Collins Startup list [od-matrxx] Confirmed=X Filename=od-matrxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [od-stndxx] Confirmed=X Filename=od-stndxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [od-teenxx] Confirmed=X Filename=od-teenxx.exe Description=Adult dialler - xx can be any number Source=Paul Collins Startup list [Oeloader] Confirmed=X Filename=Oeloader.exe Description=Xupiter OrbitExplorer toolbar related, drive-by foistware Source=Paul Collins Startup list [OEMCLEANUPorOEMRESET] Confirmed=N Filename=oemreset.exe Description=Resets OEM installation settings at bootup. Not required unless you're new to PC's Source=Paul Collins Startup list [OEPowerPlugs] Confirmed=? Filename=winoeinit.exe Description=?? Source=Paul Collins Startup list [OEXCheck] Confirmed=N Filename=EA2Check.exe Description=Express Assist from AJSystems.com. Utility for use with Outlook Express to backup, restore, synchronize amongst others Source=Paul Collins Startup list [Offer CompanionorOffers] Confirmed=X Filename=offers.exe Description=Advertising spyware Source=Paul Collins Startup list [Office Startup] Confirmed=X Filename=Osa.exeOsa9.exe Description=Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required anyway. Different filenames used for different variants Source=Paul Collins Startup list [Office Startup] Confirmed=X Filename=Exploer.exe Description=Added as a result of the GAOBOT.BV VIRUS! Note the different filename to the valid MS Office entry above Source=Paul Collins Startup list [OfficeGuard RegChecker] Confirmed=Y Filename=ogrc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [officejet 6100] Confirmed=? Filename=hposol08.exe Description=Associated with a HP PSC2110 (and maybe others) all-in-one machine Source=Paul Collins Startup list [OfficeScanNT Monitor] Confirmed=Y Filename=pccntmon.exe Description=Trend Micro OfficeScan Antivirus real-time scan monitor Source=Paul Collins Startup list [OfotoNow USB Detection] Confirmed=N Filename=Rundll32.exe OFUSBS.DLL, WatchForConnection OfotoNow Description=Autodetects when a digital camera is attached to a USB port and launches OfotoNow image software. Available via Start -> Programs Source=Paul Collins Startup list [ogrc] Confirmed=Y Filename=ogrc.exe Description=Kaspersky Labs anti-virus Source=Paul Collins Startup list [Oil Change] Confirmed=N Filename=OCTray32.exe Description=From CyberMedia/Network Associates. Checks for updates to software installed on your PC. Available via Start -> Programs Source=Paul Collins Startup list [OIM] Confirmed=? Filename=oim.exe Description=Related to the O2 (was "genie") mobile phone service. What does it do and is it required? Source=Paul Collins Startup list [OLE] Confirmed=X Filename= Description=Added as a result of the STAWIN VIRUS! Source=Paul Collins Startup list [Olehelp] Confirmed=X Filename=Olehelp.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [olehelp] Confirmed=X Filename=olehelp.exe Description=Added as a result of the BOOKMARKER.D hijacker/virus Source=Paul Collins Startup list [Omf4] Confirmed=X Filename=OMF4.EXE Description=Added as a result of the FREEMEGA VIRUS! Source=Paul Collins Startup list [OmgStartup] Confirmed=N Filename=omgstartup.exe Description=Sony program called OpenMG Jukebox - player and music organizer Source=Paul Collins Startup list [OmniHTTPd] Confirmed=U Filename=ohttpd.exe Description=OmniHTTPd web server from Omnicron Source=Paul Collins Startup list [OmniPage] Confirmed=N Filename=Opware32.exe Description=Part of OmniPage Pro from Scansoft (was Caere) - "the fastest, easiest way to turn paper documents into digital files you can edit." Opware32.exe links Word, via OLE, with OmniPage. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs Source=Paul Collins Startup list [OmniPass] Confirmed=U Filename=scureapp.exe Description=OmniPass from Softex Inc. - secure password management software Source=Paul Collins Startup list [On Screen Display] Confirmed=N Filename=OSD.EXE Description=By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume, etc. Nice but not required if you don't adjust things regularly - can also freeze Source=Paul Collins Startup list [OneTouchMonitororOne Touch MonitororONETOU~2] Confirmed=N Filename=OneTouchMonitor.exe1tou~2.exeONETOU~2.EXE Description=For Visioneer OneTouch scanners. System tray access to the control panel for the scanner Source=Paul Collins Startup list [Onflow] Confirmed=X Filename=onflow.exe Description=Onflow is a internet company that offers an online advertising program. Not required - uninstall Source=Paul Collins Startup list [Online Service] Confirmed=X Filename=svchost.exe Description=Added as a result of the HOSTIDEL.B VIRUS! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [Online Service] Confirmed=X Filename=svchost.exe Description=Added as a result of the HOSTIDEL.C VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [OnlinePCfix SmoothSurfer] Confirmed=U Filename=SS.exe Description=Smooth-Surfer - blocks banners, ads, popups, and cleans MRU and Recent file lists Source=Paul Collins Startup list [OnlineTime] Confirmed=N Filename=onlinetime.exe Description=OnlineTimer - monitors your Windows dial-up network and logs the time you spend online as well as the resulting costs Source=Paul Collins Startup list [online_party] Confirmed=X Filename=online_party.exe Description=Adult content dialler Source=Paul Collins Startup list [OnSrvr] Confirmed=X Filename=OnSrvr.exe Description=OnWebMedia adware Source=Paul Collins Startup list [oo4] Confirmed=X Filename=RunDLL32.EXE oo4.dll, DllRun Description=BookedSpace parasite variant Source=Paul Collins Startup list [OP12 Reminder] Confirmed=N Filename=Ereg.exe Description=Registration reminder for OmniPage Pro 12 from ScanSoft Source=Paul Collins Startup list [Open Site] Confirmed=X Filename=opnste.exe Description=Adware - see here Source=Paul Collins Startup list [OpenOffice.org x] Confirmed=N Filename=QUICKS~1.EXE Description=Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number Source=Paul Collins Startup list [Operator] Confirmed=N Filename=?? Description=Media Pilot operator, in Win.ini. Locks port open Source=Paul Collins Startup list [Operator] Confirmed=U Filename=xtmop.exe Description=Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported Source=Paul Collins Startup list [OpiStat] Confirmed=N Filename=OPISTAT.EXE Description=OpiStat is a European Research Institute whose goal is to understand consumer needs and opinions better Source=Paul Collins Startup list [OPQFile] Confirmed=X Filename=regedit.exe /s ...rad03FA6.tmp Description=Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit Source=Paul Collins Startup list [Optimum Online] Confirmed=N Filename=Netsurf.exe Description=Optimum Online ISP software. Not required, just window dressing & advertising from Optimum Source=Paul Collins Startup list [Opware12] Confirmed=N Filename=Opware12.exe Description=OmniPage Pro 12 from ScanSoft Source=Paul Collins Startup list [OrbitUpdate] Confirmed=X Filename=update.exe Description=Xupiter OrbitExplorer toolbar, drive-by foistware Source=Paul Collins Startup list [OrbitView] Confirmed=X Filename=view.exe Description=Xupiter OrbitExplorer toolbar, drive-by foistware Source=Paul Collins Startup list [org5.exe] Confirmed=? Filename=org5.exe Description=Lotus Organizer 5 application file, Lotus Organizer software. What does it do and is it required? Source=Paul Collins Startup list [OrgyCam] Confirmed=X Filename=OrgyCam.exe Description=Adult content dialler Source=Paul Collins Startup list [OrigRage128Tweaker] Confirmed=U Filename=RAGE128TWEAK.EXE Description=Third party tweaker for ATI Rage 128 Video cards from http://www.rageunderground.com Source=Paul Collins Startup list [ORiNOCO] Confirmed=U Filename=Cmluc.exe Description=Client Manager software for an ORiNOCO wireless LAN card Source=Paul Collins Startup list [Osa32] Confirmed=X Filename=NTOSA32.exe Description=Added as a result of the ANIG VIRUS! Source=Paul Collins Startup list [OSSProxy] Confirmed=X Filename=OSSPROXY.EXE Description=Part of Nettsetter - a "market research" program intended to track your Internet usage and buying habits. To remove click on Start -> Run and enter "%WinDir%\\SYSTEM\\NSCheck.exe /uninstall" (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) followed by enter - this removes all registry entries and a box appears saying "uninstall successful. Find and delete the files nscheck.exe, ossproxy.exe.rvt & ossproxy.exe Source=Paul Collins Startup list [OStivityInvAgt] Confirmed=U Filename=ostivity.exe Description=OStivity - "a desktop and server hardware and software asset/inventory solution for small to enterprise sized organizations that need to quickly gain knowledge of 'what's installed' without having to manually touch every computer in the company. The next time the computer logs into the network, a complete inventory (software and hardware) is taken of the system" Source=Paul Collins Startup list [Outpost Firewall] Confirmed=Y Filename=outpost.exe Description=Outpost personal firewall Source=Paul Collins Startup list [Outwar] Confirmed=X Filename=syslaunch.exe Description=Outwar adware downloader Source=Paul Collins Startup list [OVCJ] Confirmed=? Filename=ovcj.exe Description=?? Source=Paul Collins Startup list [Overnet] Confirmed=N Filename=Overnet.exe Description=Overnet peer-to-peer (P2P) file sharing program Source=Paul Collins Startup list [OWCCardbusTray] Confirmed=U Filename=ocbtray.exe Description=Icon in the system tray for safely removing PCMCIA cards. Only required if you have a laptop or desktop which includes a PCMCIA card interface Source=Paul Collins Startup list [OWCWebCamDV] Confirmed=U Filename=wcdvtray.exe Description=WebCamDV from Orange Micro, Inc - enables the user to use a DV camera connected via Firewire as a Webcam Source=Paul Collins Startup list [OWMngr] Confirmed=X Filename=OWMngr.exe Description=OnWebMedia advertising foistware - see here for exactly what to look for Source=Paul Collins Startup list [P2P NETWORKING] Confirmed=N Filename=P2P Networking.exep2pautostart.exe Description=Peer to Peer (P2P) sharing of files on the internet Source=Paul Collins Startup list [P3p4chk] Confirmed=X Filename=P3p4chk.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pagekeeper JobsorPagekeeper Lite] Confirmed=U Filename=pkjobs.exe Description=PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bundled with scanners such has HP, Microtek, etc Source=Paul Collins Startup list [PAgent] Confirmed=X Filename=PAgent.exe Description=Scans your hard drive for the popular P2P file-sharing applications BearShare, Grokster, Kazaa, Limewire and Morpheus. After searching the entire local filesystem for any files with those names it connects to the DownloadWare servers and tells it what, if anything, is found. See here for more info Source=Paul Collins Startup list [Pagis Scheduler] Confirmed=N Filename=Monitor.exe Description=Scheduler for the Pagis scanning suite from Scansoft. Source=Paul Collins Startup list [pagmstart] Confirmed=? Filename=client.exe Description=Possibly related to this? Source=Paul Collins Startup list [Pagoo] Confirmed=N Filename=PAGOO.EXE Description=Pagoo - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem Source=Paul Collins Startup list [Palm MultiUser Config] Confirmed=? Filename=Configtool.exe Description=MultiUser configuration for a Palm PDA device?. Is it required? Source=Paul Collins Startup list [Palm.exe] Confirmed=N Filename=Palm.exe Description=Palm Desktop Software for use with Palm handheld devices. Available via Start -> Programs Source=Paul Collins Startup list [PaltalkNetaware.exe] Confirmed=N Filename=PALNETAW~1.EXE Description=Voice chat program. This program stores all buddy list info apparently on the server itself so you never lose your buddy list should you need to reinstall the program due for whatever reason or even reformat. Available via Start -> Programs. Delete the shortcut in Start -> Programs -> StartUp as well otherwise it will be reinstated Source=Paul Collins Startup list [Panda Scheduler] Confirmed=U Filename=pavsched.exe Description=Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you tend to forget then leave it Source=Paul Collins Startup list [Paperport] Confirmed=N Filename=runppdrv.exe Description=Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here Source=Paul Collins Startup list [PaperPort PTD] Confirmed=N Filename=pptd40nt.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [PaperQuote System Tray Icon] Confirmed=N Filename=PQTRAY.EXE Description=PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation Source=Paul Collins Startup list [PasteLister] Confirmed=N Filename=plister.exe Description=PasteLister - clipboard extender. Start manually when required Source=Paul Collins Startup list [Patch] Confirmed=X Filename=patch.exe Description=Added as a result of the NETBUS VIRUS! Source=Paul Collins Startup list [Path] Confirmed=? Filename=lide.exe Description=?? Source=Paul Collins Startup list [PAV.EXE] Confirmed=X Filename=%Number% Description=Added as a result of the KITRO.D (or ARGEN.A) VIRUS!. %Number% can be any number Source=Paul Collins Startup list [PAV.EXE] Confirmed=Y Filename=PAV.EXE Description=PER Antivirus Source=Paul Collins Startup list [PAVFIRES] Confirmed=Y Filename=PavFires.exe Description=Panda Antivirus Source=Paul Collins Startup list [PC Alert III] Confirmed=U Filename=alert.exe Description=MSI PC Alert III - allows you to view your system and cpu temperature, fan rpm and more. Only required if you overclock Source=Paul Collins Startup list [PC Booster] Confirmed=U Filename=pcbooster.exe Description=PC Booster from inKline Global - "easy-to-use computer system optimizer that gives your system the extra speed and stability you want while ensuring that your computer is kept clean and in tip-top condition" Source=Paul Collins Startup list [PC-Config32] Confirmed=X Filename=corona.exe Description=Added as a result of the CORONEX.A VIRUS! Source=Paul Collins Startup list [PCBODYGUARDorPCBG] Confirmed=Y Filename=PCBODYGUARD.EXE Description=PC Bodyguard from Calluna - protects system files and settings from being deleted, modified, etc Source=Paul Collins Startup list [PCCClient.exe] Confirmed=Y Filename=PCCClient.exe Description=PC-Cillin 2002 antivirus software Source=Paul Collins Startup list [pccguide.exe] Confirmed=Y Filename=pccguide.exe Description=PC-Cillin 2002 antivirus software Source=Paul Collins Startup list [PCCIOMON.EXE] Confirmed=Y Filename=PCCIOMON.EXE Description=PC-Cillin 2000 antivirus software. This is the actual virus-scanner Source=Paul Collins Startup list [PccPfw] Confirmed=Y Filename=PccPfw.exe Description=PC Cillin 2003 personal firewall Source=Paul Collins Startup list [PCHbutton] Confirmed=N Filename=PCHbutton.exe Description=Used by HP Instant Support Source=Paul Collins Startup list [PCHealth] Confirmed=N Filename=pchschd.exe Description=This is a "scheduler" and does not turn off PC Health. For more information refer here Source=Paul Collins Startup list [PCHEasySearch] Confirmed=X Filename=STUpdate.exe Description=PCH EasySearch bar Source=Paul Collins Startup list [PCIMODEM] Confirmed=? Filename=pcimodem.exe Description=Associated with Lucent based Aztech MDP7800-U PCI modems. Is it required? Source=Paul Collins Startup list [PCLEPCI] Confirmed=U Filename=ppe.exe Description=Pinnacle Systems PCI Performance Enhancer. "This tool helps to increase the PCI Busmaster performance of all Pinnacle PCI boards." Source=Paul Collins Startup list [PCMService] Confirmed=? Filename=PCMService.exe Description=In a Dell\\Media Experience sub-directory Source=Paul Collins Startup list [PCRecSA] Confirmed=? Filename=PCRecSA.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [PCStart] Confirmed=N Filename=Pcm25.exe Description=Runs as part of PCMonitor which is a program for monitoring your activity on your system. It makes screen dumps and key logging. It can hang-up your system because the screen dump page gets VERY big Source=Paul Collins Startup list [Pcsv] Confirmed=N Filename=pcsvc.exe Description=Delfin Promulgate - adware based media viewer by The Delfin Project Source=Paul Collins Startup list [PcSync] Confirmed=N Filename=PcSync.exe Description=If a Nokia phone has been connected, synchronises the phone with MS Outlook or other organiser software. It is installed by the Nokia PC Suite, and the tray icon shows if a phone has been connected. Available via a desktop shortcut or Start -> Programs Source=Paul Collins Startup list [pctspk] Confirmed=U Filename=pctspk.exe Description=Used for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use any of those functions Source=Paul Collins Startup list [PCTVOICE] Confirmed=U Filename=pctvoice.exe Description=The program PCTVoice is used by the modem to interface with your computer and also used for some V.80 functions for Video Conferencing. if you uncheck it, it comes back. It�s better to leave it Source=Paul Collins Startup list [PDEngine] Confirmed=U Filename=PDEngine.exe Description=PerfectDisk from Raxco - disk defragmenter. Only required if you schedule disk defragmenting at re-boot Source=Paul Collins Startup list [pdexplo] Confirmed=N Filename=PDEXPLO.EXE Description=PowerDesk Pro by Ontrack. Enhanced desktop and file manager. Available via Start -> Programs Source=Paul Collins Startup list [pdfFactory Pro Dispatcher v1] Confirmed=N Filename=fppdis1.exe Description="With pdfFactory you can create PDF documents from any program printing to the virtual PDF printer". Available via a desktop shortcut or Start -> Programs Source=Paul Collins Startup list [PDirect] Confirmed=N Filename=PDirect.exe Description=IBM Presentation Director software Source=Paul Collins Startup list [pdp Server] Confirmed=U Filename=ctpdpsrvr.exe Description=Included and setup with the drivers for my Compaq A3000 all-in-one printer/scanner - maybe for networking. Works fine without it - but may be needed when used over a network Source=Paul Collins Startup list [Pe2ckfnt SE] Confirmed=N Filename=chkfont.exe Description=Used to check whether the fonts are installed properly on your computer or not for a scanner. If you don't want to execute it, you can uncheck it in the startup menu Source=Paul Collins Startup list [Pent@VALUE 3.2] Confirmed=U Filename=Pent@VALUE.exe Description=Pent@VALUE Digital Satellite Internet PC Receiver Source=Paul Collins Startup list [PER Email Protection] Confirmed=Y Filename=pavmail.exe Description=PER Antivirus Source=Paul Collins Startup list [PerfectPrint] Confirmed=N Filename=pfppop70.exe Description=Print engine used by Corel WordPerfect 7 and Presentations 7 Source=Paul Collins Startup list [PersFw] Confirmed=Y Filename=PersFw.exe Description=Kerio or Tiny Personal Firewall Source=Paul Collins Startup list [Pervasive.SQL Workgroup Engine] Confirmed=U Filename=W3dbsmgr.exe Description=Database Service Manager for Pervasive SQL 2000 Workgroup edition. Required if you use Pervasive SQL but it's recommended you start it manually before using it as it has a tendancy to crash/freeze if loaded with other applications at startup Source=Paul Collins Startup list [PestPatrol Control Center] Confirmed=U Filename=PPControl.exe Description=PestPatrol Control Terminal - launches PestPatrol features such as PPMemCheck and CookiePatrol Source=Paul Collins Startup list [PestPatrolCL] Confirmed=? Filename=PestPatrolCL.exe Description=Associated with PestPatrol anti-malware software. What does this part do and is it required? Source=Paul Collins Startup list [PFW_CfgEngine] Confirmed=? Filename=PFWCFG~1.EXE Description=Personal Firewall related? Source=Paul Collins Startup list [PFW_PullSrv] Confirmed=? Filename=PULL.EXE Description=Personal Firewall related? Source=Paul Collins Startup list [PgMonitr] Confirmed=X Filename=PgMonitr.exe Description=Adware based media viewer by The Delfin Project Source=Paul Collins Startup list [PGPSDKSVC] Confirmed=Y Filename=pgpsdkserv.exe Description=PGPsdkServ.exe is the new SDK service which is responsible for performing all PGP key management and cryptographic functions. This functionality was moved into a service to allow multiple modules simultaneous read/write access to the keyrings, among other things. As you can imagine, it is necessary for PGPsdkServ to be running in order to perform practically any PGP functionality Source=Paul Collins Startup list [PGPSERVICE] Confirmed=U Filename=pgpservice.exe Description=PGPservice.exe has two main purposes: (1) it handles a large part of the PGPnet functionality (along with the PGPnet driver) and (2) it allows efficient access to the PGP preferences database. The individual PGP modules normally access the preferences through PGPservice, but they are capable of a "fall-back" mode where they can handle such access on their own. Thus, if you are not running PGPnet, you may not immediately notice much of a difference if you disable PGPservice. If you are running PGPnet, you will notice a big difference Source=Paul Collins Startup list [PGPtray] Confirmed=N Filename=pgptray.exe Description=PGP 7.x. Provides icon tray shortcuts to PGP programs from Network Associates. Available via Start -> Programs Source=Paul Collins Startup list [PGStub.exe] Confirmed=X Filename= Description=Unidentified adware Source=Paul Collins Startup list [Phime2002aorPHIME2002ASync] Confirmed=N Filename=TINTSETP.EXE Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [PhoneFree version 6.2] Confirmed=U Filename=PHONEF??.EXE Description=An Internet telephony application. Complicated registration and ad banners tailored to your profile - see here Source=Paul Collins Startup list [Photo Express Calendar Checker SE] Confirmed=N Filename=CALCHECK.EXE Description=If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper, Photo Express will replace the wallpaper automatically. Photo Express 2.0 has a calendar checker which checks the date on your system and updates your wallpaper accordingly Source=Paul Collins Startup list [Photo Loader supervisory] Confirmed=N Filename=Plauto.exe Description=Casio's Photo Loader software. Hook up your camera to the USB port, and it pops up and asks you if you want to load your pictures Source=Paul Collins Startup list [PhotoWise QuickLink] Confirmed=N Filename=quicklnk.exe Description=Agfa PhotoWise - "PhotoWise QuickLinkTM lets you drag and drop photos right from the camera into your document (applications must be OLE-compliant). Use PhotoWise to print contact sheets and photographic prints. Create slide shows, screen savers, wallpaper and more." Source=Paul Collins Startup list [Picasa Media Detector] Confirmed=N Filename=PicasaMediaDetector.exe Description=Media detector for Picasa's automatic photo organizer Source=Paul Collins Startup list [Pickatag] Confirmed=N Filename=pickatag.exe Description=Pick-a-tag - "Freeware utility for random selection of your taglines. This utility randomly picks a tagline out of a list of taglines. It will create a signature file which your mailer can use to place under your messages" Source=Paul Collins Startup list [PICPRTR] Confirmed=N Filename=PICPRTR.EXE Description=Program for viewing and measuring a variety of 3D CAD data formats Source=Paul Collins Startup list [pictureBUZZTray] Confirmed=N Filename=swtray.exe Description=System Tray access to PictureBUZZ on-line printing software from Streetwise Software. If you use the software set the page you use as a favourite in your browser and run it manually Source=Paul Collins Startup list [PiDunHK] Confirmed=U Filename=PIDUNHK.EXE Description=Part of the Prodigy Internet software - part of the dialer/DUN. Presumably needed for users of that service otherwise you may not be able to connect, although you may try creating your own shortcut and see what happens Source=Paul Collins Startup list [piiserviceOE] Confirmed=U Filename=N/A Description=Spam Inspector (nee Postal Inspector) from The Giant Company or iHateSpam from Sunbelt Software - spam filter add-ons for OE Source=Paul Collins Startup list [Pinger] Confirmed=N Filename=pinger.exe Description=Pinger is the resident program for Toshiba updates. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification Source=Paul Collins Startup list [PinnacleDriverCheck] Confirmed=Y Filename=PSDrvCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [Piolet] Confirmed=N Filename=piolet.exe Description=Piolet - peer-to-peer file sharing client Source=Paul Collins Startup list [PivotSoftware] Confirmed=N Filename=wpctrl.exe Description=PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [Pixel32] Confirmed=X Filename=Pixel32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pixelpwr32] Confirmed=X Filename=Pixelpwr32.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pixelsvr] Confirmed=X Filename=Pixelsvr.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [pjWebCam] Confirmed=U Filename=pjWebCam.exe Description=Webcam automation software that saves regular photos from webcam and can also act as HTTP server Source=Paul Collins Startup list [PLEAPCPUCPL] Confirmed=U Filename=pleapu.exe Description=CPU Control Panel for the Powerleap CPU upgrade Source=Paul Collins Startup list [Plguni] Confirmed=N Filename=Plguni.exe Description=McAfee QuickClean 3.0 - removes internet clutter and unwanted programs Source=Paul Collins Startup list [plmg.exe] Confirmed=U Filename=plmg.exe Description=Paragon Last Minute Bidder - auction assistant software Source=Paul Collins Startup list [PLoader] Confirmed=? Filename=umsd.exe Description=USB Mass Storage Disk related tray icon. Is it required? Source=Paul Collins Startup list [Plob] Confirmed=X Filename=kernel.com Description=Added as a result of the OPTIXPRO.12 VIRUS! Source=Paul Collins Startup list [PLXSTART] Confirmed=U Filename=PLXSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays the "Plextor Manager 2000" splash screen for Plextor CD-RW. Source=Paul Collins Startup list [PLXTASK] Confirmed=N Filename=PLXTASK.EXE Description=Taskbar utility for a "control panel" for a Plextor CD-RW. Has MVP 2000 (audio CD player), DiscDupe 2000 (self explanatory CD copying program) and AudioCapture 2000 (rips audio CDs into MP3 or WAV files) Source=Paul Collins Startup list [pm32info] Confirmed=? Filename=pm32info.exe Description=?? Source=Paul Collins Startup list [pmc] Confirmed=X Filename=764.exe Description=Adult content dialler Source=Paul Collins Startup list [PMedia] Confirmed=X Filename=winsrvc.exe Description=Internet marketing sofware from PMedia as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B VIRUS! Source=Paul Collins Startup list [PmProxy] Confirmed=? Filename=PmProxy.exe Description=Associated with Analog Devices "SoundMAX" audio chipset - often built-in to motherboards. What does it do and is it required? Source=Paul Collins Startup list [PMTSHOOT] Confirmed=N Filename=pmtshoot.exe Description=MS tool for troubleshooting power management problems Source=Paul Collins Startup list [PMXInit] Confirmed=U Filename=pmxinit.exe Description=Restores user display preferences Kyro2 based graphics cards. Not required unless you change the default settings - such as gamma Source=Paul Collins Startup list [PNAgent] Confirmed=N Filename=PNAgent.exe Description=PhatNoise Music Manager - manages WMA, MP3, WAV, etc music files Source=Paul Collins Startup list [Pnpchk] Confirmed=U Filename=Pnpchk.exe Description=Aztech Labs Sound 3 PnP driver Source=Paul Collins Startup list [PNSetup] Confirmed=U Filename=PNSetup.exe Description=PopNot - pop-up killer Source=Paul Collins Startup list [PNtask Services] Confirmed=X Filename=pntask.exe Description=Added as a result of the LALA.C VIRUS! Source=Paul Collins Startup list [Pocket Sheet Sync] Confirmed=U Filename=PSXLTRAY.EXE Description=Casio Pocket Sheet synchronization software Source=Paul Collins Startup list [Pofatch] Confirmed=X Filename=nstrue.exe Description=Added as a result of the RANDEX.Z VIRUS! Source=Paul Collins Startup list [point32orPOINTER] Confirmed=U Filename=point32.exe Description=Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features Source=Paul Collins Startup list [Points Manager] Confirmed=N Filename=points manager.exe Description=Altnet Points Manager - manages the new Kazaa Plus scheme for awarding you points if you share music files on your machine with others rather than simply getting files and not sharing their own. Start manually when required Source=Paul Collins Startup list [POP] Confirmed=X Filename=PopSrv***.exe Description=PeopleonPage foistware, bundled with Grokster where *** are random digits Source=Paul Collins Startup list [Pop-Up Smasher] Confirmed=U Filename=PopupSmasher.exe Description=Pop-Up Smasher - pop-up killer Source=Paul Collins Startup list [Pop-Up Stopper] Confirmed=U Filename=dpps2.exe Description=Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [Pop-Up_Blocker] Confirmed=U Filename=Popup.exe Description=A Tweak-XP component, blocks advertisement pop-up windows in Internet Explorer. Can be enabled/disabled via Tweak-XP -> Internet Tweaks Source=Paul Collins Startup list [pop3trap.exe] Confirmed=Y Filename=pop3trap.exe Description=PC-Cillin 2000 antivirus software -> E-mail scanner Source=Paul Collins Startup list [PopNot] Confirmed=U Filename=PopNot.exe Description=PopNot - pop-up killer Source=Paul Collins Startup list [PopOops] Confirmed=U Filename=PopOops.exe Description=PopOops - pop-up killer Source=Paul Collins Startup list [Popopen] Confirmed=U Filename=popopen.exe Description=PopOpen makes your windows spring open with animation effects Source=Paul Collins Startup list [Poproxy] Confirmed=Y Filename=POPROXY.EXE Description=Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed, leave it enabled to automatically check for suspect attachments in E-mails that may contain viruses. It downloads the E-mail into poproxy, which serves as a proxy server on the local machine, before scanning it Source=Paul Collins Startup list [popsrv146] Confirmed=X Filename=popsrv146.exe Description=PeopleOnPage online dating browser enhancement - also adware and privacy issues, see here. For removal instructions see here Source=Paul Collins Startup list [PopSubtract] Confirmed=U Filename=PopSub.exe Description=PopSubtract - pop-up killer Source=Paul Collins Startup list [Popup Ad Filter] Confirmed=U Filename=PopFilter.exe Description=Popup Ad Filter - pop-up killer Source=Paul Collins Startup list [Popup Defender] Confirmed=U Filename=PD.exe Description=Popup Defender - pop-up killer Source=Paul Collins Startup list [Popup Terminator] Confirmed=U Filename=GLADManager.exe Description=Popup Terminator - pop-up killer Source=Paul Collins Startup list [PopupEliminator] Confirmed=U Filename=Popup Eliminator.exe Description=Popup Eliminator - pop-up killer Source=Paul Collins Startup list [PopUpKiller] Confirmed=U Filename=PopUpKiller.exe Description=PopUpKiller - pop-up killer Source=Paul Collins Startup list [PopUpStopperFreeEdition] Confirmed=U Filename=PSFREE.EXE Description=Pnaicware's Pop-Up Stopper - free limited features version Source=Paul Collins Startup list [PopUpWatch] Confirmed=U Filename=PopUpWatch.exe Description=Part of BPS Trace Remover - made by the folks who "developed" BPS Spyware Remover which reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! Source=Paul Collins Startup list [POS-Partnerbatchprocessor] Confirmed=? Filename=BATCH.EXE Description=VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut? Source=Paul Collins Startup list [Post-It(r) Software] Confirmed=N Filename=Psnotes.exe Description=Pop-up "yellow" notes on screen. Available via Start -> Programs Source=Paul Collins Startup list [POW!] Confirmed=U Filename=pow.exe Description=Pop-up killer Source=Paul Collins Startup list [Power Scan] Confirmed=X Filename=powerscan.exe Description=Foistware by Integrated Search Technologies - the people behind the ISTbar parasite Source=Paul Collins Startup list [PowerChute] Confirmed=Y Filename=Pwrchute.exe Description="During a power outage, if you're not available to save your files & close down Windows....PowerChute will do that for you. PowerChute will save your application files, close your applications and shut down your computer just like you would...otherwise, the APC UPS (Uninterruptible Power Supply) unit would go to battery until it wore down, then your computer would shutoff" Source=Paul Collins Startup list [PowerDOCSAPIHost] Confirmed=U Filename=papihost.exe Description=Hummingbird PowerDOCS - "delivers powerful enterprise document management functionality via a tightly integrated Microsoft WinNT/98/2K environment" Source=Paul Collins Startup list [PowerDVD] Confirmed=N Filename=PowerDVD.exe Description=Launches Cyberlink's PowerDVD software and creates a system tray icon. If enabled, PowerDVD will open automatically when a DVD movie is inserted. Launch manually Source=Paul Collins Startup list [PowerKey] Confirmed=U Filename=PowerKey.exe Description=Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610 Source=Paul Collins Startup list [PowerManagement] Confirmed=X Filename=Rundlll.exe Description=Added as a result of the SURDUX VIRUS! Source=Paul Collins Startup list [PowerManager] Confirmed=X Filename=Svchost.exe Description=Added as a result of the JEEFO VIRUS! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [PowerPanel] Confirmed=Y Filename=POWPANEL.EXE Description=Power management utility on notebooks/laptops - automatically switches modes when running on battery Source=Paul Collins Startup list [PowerPrifile] Confirmed=X Filename=rundl132 kenel.dll, PowerProfileEnable Description=Added as a result of the INMOTA VIRUS! Source=Paul Collins Startup list [PowerPro] Confirmed=U Filename=powerpro.exe Description=Part of the power professional program that loads the floating menu bar. Can be accessed from Start -> Programs, but I'd leave it alone if you use this program Source=Paul Collins Startup list [PowerQuest Startup Utility] Confirmed=N Filename=PQINIT.EXE Description=From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set up, it does nothing (except waste bytes and cycles). I disabled it using msconfig.exe with no problems" Source=Paul Collins Startup list [PowerReg Scheduler] Confirmed=N Filename=PowerReg Scheduler.exe Description=PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others Source=Paul Collins Startup list [PowerReg SchedulerV2] Confirmed=N Filename=PowerReg SchedulerV2.exe Description=PowerREGISTER from Leadertech. Registration reminder as used by Iomega, Hasbro & Microprose - amongst others Source=Paul Collins Startup list [POWERR~1] Confirmed=? Filename=POWERR~1.exe Description=Power monitoring? Source=Paul Collins Startup list [PowerS] Confirmed=? Filename=PowerS.exe Description=ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required? Source=Paul Collins Startup list [PowerSet] Confirmed=? Filename=Regedit.exe /s ...PowerSet_8100_CU.REG Description=Appears to be Toshiba power management related Source=Paul Collins Startup list [PowerStrip] Confirmed=N Filename=powerstrip.exePSTRIP.EXE Description=PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings Source=Paul Collins Startup list [PowerTools Tray Icon] Confirmed=U Filename=pttray.exe Description=PowerTools - add-on for AOL Source=Paul Collins Startup list [Powertweak] Confirmed=U Filename=PT2.EXE Description="Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the system) can be configured." This item is added to startup if 'Use predefined settings' is enabled in the programs options Source=Paul Collins Startup list [Powertweak] Confirmed=U Filename=PTCTRL.EXE Description="Powertweak is designed to configure your system in the best way. A processor, the core of the system, or a chipset (a set of components that manage the data flows between the different parts of the system) can be configured." This item is added to startup if 'Configure system at logon' is enabled in the programs options Source=Paul Collins Startup list [PP****usb] Confirmed=N Filename=FBDirect.exe Description=Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop!. The **** represents the model, 5300, 7600, etc. Available via Start -> Programs Source=Paul Collins Startup list [PP2000 Instaupdate] Confirmed=U Filename=PPInupdt.exe Description=Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually Source=Paul Collins Startup list [PP2000 Real Time Scan] Confirmed=Y Filename=PPVstop.exe Description=Protector Plus anti-virus software - real time scanner Source=Paul Collins Startup list [PP2000 Taskbar Control] Confirmed=Y Filename=PPTbc.exe Description=Protector Plus anti-virus software - system tray access Source=Paul Collins Startup list [PP3100b] Confirmed=N Filename=flatbed.exe Description=Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan, fax, copy, print, and easily communicate by simply dragging and dropping scans on your PaperPort Desktop Source=Paul Collins Startup list [ppass] Confirmed=U Filename=Antispy.exe Description=AntiSpy firewall - "program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide" Source=Paul Collins Startup list [PPControl] Confirmed=U Filename=PPControl.exe Description=PestPatrol Control Terminal - launches PestPatrol features such as PPMemCheck and CookiePatrol Source=Paul Collins Startup list [PPK Setup(Server)] Confirmed=U Filename=SEServe.exe Description=Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button, collect your e-mail automatically with one key stroke. You can also program your PPK to turn on your SuperSlim Notebook at a predetermined time and perform simple tasks - completely unattended" Source=Paul Collins Startup list [PPMemCheck] Confirmed=U Filename=ppmemcheck.exe Description=PPMemCheck - "extends PestPatrol's power so that the most dangerous Pests -- those that are about to execute -- are found, terminated, and cleaned from a user's system" Source=Paul Collins Startup list [PProTray] Confirmed=N Filename=pprotray.exe Description=Part of the power professional program. Loads the System Tray control Source=Paul Collins Startup list [pptd40nt] Confirmed=N Filename=pptd40nt.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [PPUpdate] Confirmed=U Filename=ppupdater.exe Description=PPUpdater - "is the update program that ships with PestPatrol. It is able to update licensed and evaluation versions, and presents a visual display of what it is doing". Run manually unless you think you'll forget to check for updates on a regular basis Source=Paul Collins Startup list [PPWWebCap] Confirmed=N Filename=PPWebCap.exe Description="PaperPort" software associated with scanners Source=Paul Collins Startup list [pqhelper] Confirmed=X Filename=pqhelper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [PractiSearch] Confirmed=U Filename=PSearch.exe Description=PractiSearch web search software Source=Paul Collins Startup list [Praize Messenger] Confirmed=U Filename=itLoad.exe Description=Praize IM Christian chat instant messenger Source=Paul Collins Startup list [Prayer] Confirmed=U Filename=PTW.EXE Description=Islamic Adhan program (call fpr daily prayers) Source=Paul Collins Startup list [PreAnnotate] Confirmed=? Filename=PreAnntt.exe Description=Genius Wizard Pen Tablet driver related. Is it required? Source=Paul Collins Startup list [Precision Time Clock Checker] Confirmed=N Filename=PrecisionTime.exe Description=Precision Time 2.0. Checks your computer clock time against the Naval Observatory or some other source to assure accurate time Source=Paul Collins Startup list [precpop2] Confirmed=X Filename=starter.exe Description=PrecisionPop adware Source=Paul Collins Startup list [Preload] Confirmed=Y Filename=Preload.exe Description=Millenium Multi-Function Keyboard driver Source=Paul Collins Startup list [PreloadApp] Confirmed=? Filename=hphprld.exe Description=HP Printer driver related? Source=Paul Collins Startup list [Premeter] Confirmed=X Filename=nrpr.exeprmt.exe Description=NetRatings software by Opistat. "OpiStat measures Internet usage anonymously and surveys participants according to their profiles and online habits". This software has been reported to get downloaded and installed automatically after a Grokster install. It anonymously collects your use of the Internet protocols (sites visited, Web pages, advertisements seen, electronic commerce, streaming). To be avoided! Source=Paul Collins Startup list [Price Patrol] Confirmed=N Filename=neo.exe Description=Price Patrol by Half.com - internet shopping companion for finding the best on-line prices Source=Paul Collins Startup list [PrimaLauncher] Confirmed=? Filename=Launcher.exe Description=Associated with PrimaScan scanners. Is it required? Source=Paul Collins Startup list [Primax 3D Mouse] Confirmed=U Filename=3dmoused.exe Description=Enables the scroll button on the Primax 3-D Scroll mouse Source=Paul Collins Startup list [Primsta] Confirmed=? Filename=Primsta.exe Description=Linksys Wireless CompactFlash Card driver related. Is it required? Source=Paul Collins Startup list [Print Master Event Reminder] Confirmed=N Filename=PMremind.exe Description=Print Master Gold - calander feature that pops up reminders, such as birthdays Source=Paul Collins Startup list [Print Screen Deluxe] Confirmed=N Filename=psdeluxe.exe Description=Utility allows "Print Scrn" or "Print Screen" key to capture, print or save the current window Source=Paul Collins Startup list [print sharing] Confirmed=X Filename=start.bat Description=Added as a result of the ZCREW VIRUS! Source=Paul Collins Startup list [print sharing] Confirmed=X Filename=hidden32.exe (path) explorer.exe Description=Added as a result of the ZCREW.B VIRUS! Note - this is not the valid Windows Explorer (explorer.exe) Source=Paul Collins Startup list [Print Spooler] Confirmed=X Filename=Spoolsv.exe Description=Added as a result of the CIADOOR.B VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [Print Spooler] Confirmed=X Filename=spoolsvc32.exe Description=Added as a result of the SDBOT.BB VIRUS! Source=Paul Collins Startup list [Printer] Confirmed=X Filename=Spyassault.exe Description=Dubious "spyware killer" - see here. To be avoided Source=Paul Collins Startup list [Printer Update] Confirmed=? Filename=CFGREG.EXE Description=Maybe a registration reminder or automatically updates drivers or application software for a printer? Source=Paul Collins Startup list [PrinterSpool] Confirmed=X Filename=...\\RESTORE.EXE ...\\SPOOL.EXE Description=Added as a result of the ALADINZ.K VIRUS! Source=Paul Collins Startup list [Printkey2000] Confirmed=N Filename=printkey2000.exe Description=Screen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required Source=Paul Collins Startup list [printnow] Confirmed=N Filename=printnow.exe Description=PrintNow - a utility that primarily allows "Print Srceen" or "Alt+Print Screen" screenshots to be sent directly to a printer Source=Paul Collins Startup list [PrinTray] Confirmed=N Filename=Printray.exe Description=Lexmark/Compaq printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. See also LexmarkPrintray and CompaqPrinTray Source=Paul Collins Startup list [PrintScreen] Confirmed=N Filename=UNWISE.EXE Description=Gadwin PrintScreen - utility to capture, print or save the current window Source=Paul Collins Startup list [Printscreen 95] Confirmed=N Filename=PRT95MIN.EXE Description=Printscreen 95 - utility to capture, print or save the current window Source=Paul Collins Startup list [PRISMSTA.EXE] Confirmed=? Filename=PRISMSTA.EXE Description=?? Source=Paul Collins Startup list [Privacy Eraser Pro] Confirmed=N Filename=PrivacyEraser.exe Description=Privacy Eraser Pro - protects your Internet privacy by cleaning up all Internet history tracks and past computer activities Source=Paul Collins Startup list [Privoxy] Confirmed=U Filename=privoxy.exe Description=Privoxy - web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk Source=Paul Collins Startup list [PrizeSurfer] Confirmed=X Filename=prizesurfer.exe Description="PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware Source=Paul Collins Startup list [prmt] Confirmed=X Filename=prmt.exe Description=NetRatings software by Opistat. "OpiStat measures Internet usage anonymously and surveys participants according to their profiles and online habits". This software has been reported to get downloaded and installed automatically after a Grokster install. It anonymously collects your use of the Internet protocols (sites visited, Web pages, advertisements seen, electronic commerce, streaming). To be avoided! Source=Paul Collins Startup list [Pro PCL Status Monitor] Confirmed=U Filename=PENGSS.EXE Description=Xerox printer/fax/copier status monitor (PCL = printer control language) Source=Paul Collins Startup list [ProArt] Confirmed=? Filename=ProArt.exe Description=?? Source=Paul Collins Startup list [procmon] Confirmed=X Filename=procmon.exe Description=Added as a result of the BIONET.40A VIRUS! Source=Paul Collins Startup list [ProDsl] Confirmed=N Filename=ProDsl.exe Description=Intel Pro/DSL 2100 modem connection manager. Available via Start -> Programs Source=Paul Collins Startup list [Profile] Confirmed=X Filename=Profile.vbs Description=Added as a result of the WHITEHO or TRAPPY VIRUSES! Source=Paul Collins Startup list [Profiler] Confirmed=N Filename=Profiler.exe Description=Enables the "Profiler" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs Source=Paul Collins Startup list [Program File] Confirmed=X Filename=Progmon.exe Description=Added as a result of the PEEPER VIRUS! Source=Paul Collins Startup list [Program In Windows] Confirmed=X Filename=IEXPLORE.EXE Description=Added as a result of the LOVGATE.F VIRUS! Note - "iexplore.exe" resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) wheras the valid "iexplore.exe" (IE) resides in C:\\Program Files Source=Paul Collins Startup list [Promon.exe] Confirmed=N Filename=promon.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [PromulGate] Confirmed=X Filename=PgMonitr.exe Description=Adware based media viewer by The Delfin Project Source=Paul Collins Startup list [PRONoMgr.exe] Confirmed=N Filename=PRONoMgr.exe Description=System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features Source=Paul Collins Startup list [Propel Accelerator] Confirmed=U Filename=PropelAC.exe Description=Propel Internet Accelerator Source=Paul Collins Startup list [ProPort Startup] Confirmed=U Filename=ProPort.exe Description=Proport is a port monitor/protector. Monitors an infinite amount of ports for trojans and nukes. Some additional features are auto connection-kill, and IP resolving Source=Paul Collins Startup list [PRPCMonitor] Confirmed=U Filename=PRPCUI.exe Description=Intel� SpeedStep� interface. This automatically detects whether a mobile PC is using battery or AC power. When using battery power, SpeedStep scales the processor clock frequency and voltage to reduce the power it needs by 40% Source=Paul Collins Startup list [PS2] Confirmed=U Filename=ps2.exe Description=Multimedia Keyboard companion on HP computers. If this is prevented from starting, then some keyboard functionality will be lost. Source=Paul Collins Startup list [PSD Tools Channel] Confirmed=X Filename=ChannelUp.exe Description=BuddyLinks adware Source=Paul Collins Startup list [PSDrvCheck] Confirmed=Y Filename=PSDrvCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [PSFree] Confirmed=U Filename=PSFree.exe Description=Pop-Up Stopper Free from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group Source=Paul Collins Startup list [PSIWin2.3 Connection Server] Confirmed=N Filename=Psconsv.exe Description=Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs Source=Paul Collins Startup list [PsMFCard] Confirmed=U Filename=PsMFCard.exe Description=Component of the Toshiba Controls. Provides power-saving functions for the PCMCIA slots. Through the Power Save Mode Properties dialogue, the user can select from 3 PCMCIA power options - On, Auto1 and Auto2. Disabling this item has no adverse effects, except disabling the ability to reduce power consumption by powering-down the PCMCIA slots when not in use Source=Paul Collins Startup list [PSNotify] Confirmed=Y Filename=psnotify.exe Description=Pharos SignUp Vx - "PC reservation and management application that addresses the PC scheduling needs of public libraries and higher education labs and libraries" Source=Paul Collins Startup list [PsPCCard] Confirmed=? Filename=PsPCCard.EXE Description=Found on a Toshiba laptop?. Any ideas? Source=Paul Collins Startup list [PspContr] Confirmed=U Filename=pspcontr.exe Description=Driver/controller for the Philips SpeechMike 6174. As the Philips FreeSpeech application is no longer supported it can be disabled but the Mike can still be used for certain functions using this driver Source=Paul Collins Startup list [PsSound] Confirmed=U Filename=PsSound.exe Description=On a Toshiba laptop. Operates your sound in one of 4 modes, off, on , on only with powerr, same as #3 but longer delay Source=Paul Collins Startup list [PSTORES] Confirmed=? Filename=PSTORES.EXE Description=Part of Windows Services Protected Storage? Source=Paul Collins Startup list [ptfb] Confirmed=N Filename=ptfb.exe Description=Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" Source=Paul Collins Startup list [Ptsnoop] Confirmed=N Filename=Ptsnoop.exe Description=These descriptions I've come across - all valid as far as I can see :-
(1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it
(2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see here for more info
(3) Apparently the people who put it out claim it's a driver for a Voice modems (don't know who they are though - Ed)
Note: If using AOL and you disable this you may lose your connection or lock up
(4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'\PTSNOOP and the System.ini tab under drivers='path'\ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists
(5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems
(6) Karen Kenworthy's Snooper - "logs the start and stop time of all programs run under Windows" Source=Paul Collins Startup list [pttrun] Confirmed=U Filename=pttrun.exe Description=Transmeta Crusoe processor related. Reduces application launch times and makes the computer "more responsive" Source=Paul Collins Startup list [PtUDFApp] Confirmed=N Filename=PtUDFApp.exe Description=Sony abCD program, included on the CD Xtreme install CD, used to format CD-RWs for packet writing (similar to DirectCD). Available via Start -> Programs. Note that you must add a /T switch to the command line to get it to load to the taskbar Source=Paul Collins Startup list [Purgative] Confirmed=U Filename=PURGATIVE100.EXE Description=AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack Source=Paul Collins Startup list [Push Client] Confirmed=N Filename=pull.exe Description=Client software from Interwise that MS use for their webcasts Source=Paul Collins Startup list [Push The Freakin' Button] Confirmed=N Filename=ptfb.exe Description=Push the Freakin' Button - "When a dialog causes irritation, you simply tell PTFB which button should be pressed, and it will handle the dialog in future" Source=Paul Collins Startup list [PUSH6599] Confirmed=N Filename=PUSH6599.EXE Description=Scan button monitor for Relysis Episode MF6599 USB scanner as you can start scanning manually via the scanning software Source=Paul Collins Startup list [PutA!!] Confirmed=X Filename=PutA!!.exe Description=Added as a result of the OPASERV.L VIRUS! Source=Paul Collins Startup list [PutAS!] Confirmed=X Filename=PutA!!.com Description=Added as a result of the OPASERV.Z VIRUS! Source=Paul Collins Startup list [putil] Confirmed=X Filename= Description=Added as a result of the LDPINCH VIRUS! Source=Paul Collins Startup list [PVR] Confirmed=N Filename=PVR.exe Description=Pocket Voice Recorder - freeware sound recorder that records from microphone and any other input line available with your sound card Source=Paul Collins Startup list [Pwr32ctr] Confirmed=X Filename=Pwr32ctr.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pwr32ctrl] Confirmed=X Filename=Pwr32ctrl.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pwr32mgt] Confirmed=X Filename=Pwr32mgt.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pwrmonit] Confirmed=Y Filename=Rundll32 PwrMonit.dll Description=IBM's proprietary 'battery maximiser' and power monitoring software for laptops Source=Paul Collins Startup list [Pwroff] Confirmed=X Filename=Pwroff.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Pwrsave] Confirmed=U Filename=Pwrsave.exe Description=Toshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power Source=Paul Collins Startup list [Pwruplogin] Confirmed=? Filename=pulogin.exe Description=?? Source=Paul Collins Startup list [PwrupTweakMe] Confirmed=U Filename=PUPXPTWK.EXE Description="Ashampoo PowerUp XP is a convenient tool for fine-tuning your Windows� NT4, 2000 and XP configuration to suit your precise needs and wishes. It gives you direct access to many frequently-required settings and parameters, enabling you to make your operating system behave the way you want." Boot-up options won't work if disabled Source=Paul Collins Startup list [PWS Tray] Confirmed=U Filename=PwsTray.exe Description=Microsoft's Personal Web Server, an application which allows PCs to behave as web servers (allows you to test your .asp pages on your own PC without having to load them onto the internet). Available via Start -> Programs Source=Paul Collins Startup list [p_981116] Confirmed=N Filename=p_981116.exe Description=Win32 cabinet self extractor. More info here Source=Paul Collins Startup list [Q152404] Confirmed=N Filename=wsript.exe Q152404.VBS Description=Appears to run Scandisk at bootup on NEC PCs Source=Paul Collins Startup list [QAGENT] Confirmed=N Filename=qagent.exe Description=Quicken program is controlled by a separate utility program called the Quicken Download Manager (also known as Qagent). When Quicken Download Manager option is enabled, background downloading takes advantage of unused bandwidth to download current financial information anytime your computer is connected to the Internet Source=Paul Collins Startup list [QBCD autorun] Confirmed=N Filename=autorun.exe Description=Quick Books CD Source=Paul Collins Startup list [qbkupdbs] Confirmed=X Filename=mqbkup.exe Description=Added as a result of the OPASERV.K VIRUS! Source=Paul Collins Startup list [qbotd] Confirmed=X Filename= Description=Added as a result of the BOTTEN VIRUS! Source=Paul Collins Startup list [qBrowse] Confirmed=? Filename=qbrowse.exe Description=?? Source=Paul Collins Startup list [QCTRAY] Confirmed=U Filename=Qctray.exe Description=System Tray icon providing access to the "IBM Access Connections" wizard on ThinkPad laptops and also allows to change the network environment. Not the same as QCWLIcon, which is pertinent only to the Wireless LAN Source=Paul Collins Startup list [QCWLICON] Confirmed=U Filename=Qcwlicon.exe Description=Used by IBM Thinkpad laptops with built-in wireless card (802.11). System Tray icon that provides a shortcut to "Wireless Connection Status" and allows to turn WL on and off Source=Paul Collins Startup list [QD FastAndSafe] Confirmed=N Filename=QDCSFS.exe Description=Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually Source=Paul Collins Startup list [QDMorQDMStart] Confirmed=U Filename=QdmStart.exe Description=QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU, temperatures, BIOS information, etc. Only required if you overclock system components and need to monitor temperatures, etc Source=Paul Collins Startup list [Qdsafe] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Qexplo] Confirmed=? Filename=Qexplo.exe Description=?? Source=Paul Collins Startup list [QMusic] Confirmed=? Filename=QMAgent.exe Description=?? Source=Paul Collins Startup list [QNPlus] Confirmed=N Filename=QNPlus.exe Description=Quick Notes Plus by Conceptworld - sticky notes tool Source=Paul Collins Startup list [Qoeloader] Confirmed=U Filename=Qoeloader.exe Description=Qurb 2.0 anti-spam tool for Outlook/Outlook Express. Required when supporting OE but not for Outlook. Shortcut available via Start -> Programs Source=Paul Collins Startup list [QQ] Confirmed=X Filename=sendmess.exe Description=Added as a result of the SEMES VIRUS! Source=Paul Collins Startup list [QSort2000] Confirmed=N Filename=QSORT.EXE Description=Utility that sorts your Start menu and Favourites in alphanumerical order. Not required - at any time you can right-click on these lists and choose "Sort by Name" Source=Paul Collins Startup list [QT4HPOT] Confirmed=U Filename=OneTouch.exe Description=Hewlett Packard One Touch keyboard driver. Required if you use the additional keys Source=Paul Collins Startup list [QTaskStartup] Confirmed=U Filename=qtask.exe Description=Feature of Quicken.com Brokerage to customize and display Desktop Alerts and icon. It is not required for the Quicken Program to run correctly, it is only required for the Desktop Alerts feature Source=Paul Collins Startup list [QTSTUB.EXE] Confirmed=N Filename=Qtstub.exe Description=Part of an old version of the Quick Tax application. It enables Quick Tax Calendar Popup to show tax calendar reminders Source=Paul Collins Startup list [qttask] Confirmed=N Filename=Qttask.exe Description=System Tray access to Apple's "Quick Time" viewer from version 5 onwards Source=Paul Collins Startup list [QUBCity] Confirmed=? Filename=qtp.exe Description=?? Source=Paul Collins Startup list [Queensla] Confirmed=? Filename=Queensla.exe Description=?? Source=Paul Collins Startup list [Quick Controls] Confirmed=U Filename=Astrotoolbar.exe Description=Gateway Astro Screen and Sound Controls tray icon Source=Paul Collins Startup list [Quick Heal On-Line Protection] Confirmed=Y Filename=Cateye.exe Description=Quick Heal - virus scanner Source=Paul Collins Startup list [Quick Heal Startup Scan] Confirmed=Y Filename=QHSTRT32.EXE Description=Quick Heal - virus scanner Source=Paul Collins Startup list [Quick Shelf xx] Confirmed=N Filename=qushelfxx.exe Description=Places an icon in the system tray for launching MS Bookshelf. Available via Start -> Programs"xx" represents the version number - ie, 98, 99 Source=Paul Collins Startup list [Quick Startup] Confirmed=Y Filename=Fquick32.exe Description=For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone Source=Paul Collins Startup list [Quick View Plus] Confirmed=N Filename=QVP32.EXE Description=Quick View Plus from Inso Corporation. Multiple file type viewer. Available via Start -> Programs Source=Paul Collins Startup list [QuickBooks Delivery Agent] Confirmed=N Filename=QBDAGENT.EXE Description=As far QAGENT but for QuickBooks. Can also have the version number in the name Source=Paul Collins Startup list [Quickbooks Update Agent] Confirmed=N Filename=qbupdate.exe Description=Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not Source=Paul Collins Startup list [QuickCamPro] Confirmed=U Filename=QuickCamPro.exe Description=System Tray for Picture Capture utility that can run unattended. Pictures every 30 seconds for example, auto FTP Upload, etc Source=Paul Collins Startup list [quicken] Confirmed=X Filename=quicken.exeWaol.exeWinrar.exe Description=CoolWebSearch parasite variant. Note! - this is not the file zipping utility also known as WinRAR Source=Paul Collins Startup list [Quicken Scheduled Updates] Confirmed=N Filename=bagent.exe Description=Quicken background downloading module Source=Paul Collins Startup list [Quicken Startup] Confirmed=N Filename=QWDLLS.EXE Description=Quicken option to load DLLs at startup Source=Paul Collins Startup list [QuickenSEMessage] Confirmed=N Filename=Qsemsg.exe Description=Quicken option Source=Paul Collins Startup list [QuickFinder Scheduler] Confirmed=N Filename=QFSCHD100.exeQFSched.exe Description=Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products) Source=Paul Collins Startup list [QuickLaunchEr] Confirmed=Y Filename=QuickLaunchEr.Exe Description=QuickLaunchEr - allows you to quickly launch programs from an icon in the system tray Source=Paul Collins Startup list [Quicklink III] Confirmed=N Filename=QL.EXE Description=HP fax program and only needs to be in the start-up group if you allow your phone to automatically answer your phone in fax mode, that is, to receive faxes after a certain number of rings. Available via Start -> Programs Source=Paul Collins Startup list [Quicknote] Confirmed=N Filename=quicknote.exe Description=JC&MB Quicknote Virtual Scrapbook Source=Paul Collins Startup list [QuickPassword] Confirmed=U Filename=agquickp.exe Description=Smart card-based authentication and digital signature client software Source=Paul Collins Startup list [QuickRes] Confirmed=N Filename=QUICKRES.EXE Description=Utility to quickly change desktop resolution - left over from Win95 Power Toys. In Win98 and above incorporated via Control Panel -> Display. Not required unless you have to change resolutions on a regular basis Source=Paul Collins Startup list [quickset] Confirmed=N Filename=quickset.exe Description=Dell taskbar icon allowing you to quickly change settings Source=Paul Collins Startup list [Quicktime Pro 3.0] Confirmed=X Filename=winuodps.exe Description=Added as a result of the GAOBOT.BH VIRUS! Source=Paul Collins Startup list [QuickTime Task] Confirmed=N Filename=Qttask.exe Description=System Tray access to Apple's "Quick Time" viewer from version 5 onwards Source=Paul Collins Startup list [QuickTime Task] Confirmed=X Filename=qttasks.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [QuickTime Update Completion x] Confirmed=N Filename=quicktimeupdatehelper.exe Description=Different numbers caused by number of launches. So if 3 updates are made separately, 3 would appear (in theory) Source=Paul Collins Startup list [Quicktlme] Confirmed=X Filename=ru.exe Description=Adult content dialler Source=Paul Collins Startup list [QuickTV] Confirmed=U Filename=QuickTV.exe Description=Infra-red remote control driver for the AVerTV Studio TV tuner/personal video recoder from AVerMedia. Required if you use the remote control Source=Paul Collins Startup list [QuikShield] Confirmed=N Filename=qkshield.exe Description=QuikShield popup blocker - reportedly stealth installed, see here Source=Paul Collins Startup list [QuikSync] Confirmed=N Filename=QUIKSYNC.EXE Description=Used by Iomega drives. Available via Start -> Programs Source=Paul Collins Startup list [QWS3270 Sessions] Confirmed=U Filename=sessions.exe Description=QWS3270 Secure terminal emulation software Source=Paul Collins Startup list [RA Server] Confirmed=X Filename=Slave.exe Description=Added as a result of the RA VIRUS! Source=Paul Collins Startup list [RabbitWannaHome] Confirmed=X Filename=rabbit.exe Description=Added as a result of the MIMAIL.S VIRUS! Source=Paul Collins Startup list [RadBoot] Confirmed=U Filename=RadBoot.exe Description=RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings Source=Paul Collins Startup list [RAMASST] Confirmed=U Filename=RAMASST.exe Description=Optionally installed with some DVD drives (LG, Panasonic, etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. It does not affect your ability to burn CDs. If you do not have this program running, you may have some compatibility issues with burnt DVDs Source=Paul Collins Startup list [RAMDef] Confirmed=U Filename=ramdef.exe Description=Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. Some users swear by programs such as this but I suggest you read this article and make up your own mind Source=Paul Collins Startup list [RamIdle] Confirmed=U Filename=ramidle.exe Description=RAM Idle - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other applications. In addition, RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows." Some users swear by programs such as this but I suggest you read this article and make up your own mind Source=Paul Collins Startup list [RAMpage] Confirmed=U Filename=RAMpage.exe Description=Small Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray icon, or by setting a threshold that activates the program automatically, or by having it run automatically when an application exits. RAMpage is free, and open source Source=Paul Collins Startup list [RapApp] Confirmed=Y Filename=RAPAPP.EXE Description=Application protection component of BlackICE PC Protection (was Defender) firewall, informing you of any modifications to programs, files or folders and detecting unknown programs trying to launch Source=Paul Collins Startup list [RapidBlaster] Confirmed=X Filename=rb32.exe Description=Homepage hijacker (adult content) - see this newsgroup thread Source=Paul Collins Startup list [Raptor Mobile] Confirmed=Y Filename=vpnservices.exe Description=Symantec VPN Client used to connect to corporate networks. If unchecked, must be uninstalled using Add/Remove Programs as it tightly integrates into networking Source=Paul Collins Startup list [RAV8Tray] Confirmed=Y Filename=ravtray8.exe Description=RAV anti-virus related Source=Paul Collins Startup list [RAVEN_VLZS.EXE] Confirmed=X Filename=RAVEN_VLZS.EXE Description=Another eAcceleration program - spyware. Read their privacy statement here Source=Paul Collins Startup list [RavTime] Confirmed=X Filename=Mstray.exe Description=Added as a result of the WUKILL.A VIRUS! Source=Paul Collins Startup list [RavTimeXP] Confirmed=X Filename= Description=Added as a result of the WULLIK.B VIRUS! Source=Paul Collins Startup list [RavTimXP] Confirmed=X Filename= Description=Added as a result of the WULLIK.B VIRUS! Source=Paul Collins Startup list [rav_temp.exe] Confirmed=? Filename=rav_temp.exe Description=?? Source=Paul Collins Startup list [Ray Process Killer] Confirmed=N Filename=Prkill.exe Description=Ray Process Killer - clicking right mouse button produces popup menu with current active tasks. You can choose any task and click "Ok" to terminate it. Use CTRL+ALT+DEL instead Source=Paul Collins Startup list [rb32 lptt01orrb32 ml097e] Confirmed=X Filename=rb32.exe Description=Variant of the RapidBlaster parasite (in a "RapidBlaster" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [rbenh ml***e] Confirmed=X Filename=rbenh.exe Description=Variant of the RapidBlaster parasite (in a "RBEnhance" folder in Program Files) where *** represents random digits. It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [RCSync] Confirmed=X Filename=RCSync.exe Description=PrizeSurfer related. "PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware Source=Paul Collins Startup list [RDLL] Confirmed=X Filename=RunDll16.exe Description=Added as a result of the SDBOT.F VIRUS! Source=Paul Collins Startup list [rdvs] Confirmed=X Filename= Description=Added as a result of the ULTIMAX VIRUS! <filename.exe> is the worm filename created Source=Paul Collins Startup list [Real player updater] Confirmed=X Filename=realupd.exe Description=Added as a result of the PARLAY VIRUS! Source=Paul Collins Startup list [Real-Tens] Confirmed=X Filename=Real-Tens.exe Description=DownloadWare based advetising spyware Source=Paul Collins Startup list [RealDownload] Confirmed=N Filename=RealPlay.exe Description=Download manager. Available via Start -> Programs Source=Paul Collins Startup list [RealDownload Express] Confirmed=X Filename=npnzdad.exe Description=Advertising spyware Source=Paul Collins Startup list [Reality Fusion GameCam SE] Confirmed=N Filename=RFTRay.exe Description=System Tray access for Logitech's Reality Fusion GameCam. For more details see here. Available via Start -> Programs Source=Paul Collins Startup list [RealJukeboxSystray] Confirmed=N Filename=tsystray.exe Description=System Tray icon for RealJukebox Source=Paul Collins Startup list [realplay lptt01orrealplay ml097e] Confirmed=X Filename=realplay.exe Description=Variant of the RapidBlaster parasite (in a "RealPlay" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not RealPlayer which can have the same executable name Source=Paul Collins Startup list [Realpopup] Confirmed=? Filename=Realpopup.exe Description=RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor" Source=Paul Collins Startup list [Realsched] Confirmed=N Filename=realsched.exe Description=Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry Source=Paul Collins Startup list [Realtime Audio Engine] Confirmed=? Filename=mmrtkrnl.exe Description=?? Source=Paul Collins Startup list [Realtime Monitor] Confirmed=Y Filename=realmon.exe Description=Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates Source=Paul Collins Startup list [RealTimeUpdate] Confirmed=? Filename=RealTimeUpdate.exe Description=Product description in properties is "InternetExplorerCommunicationAgent Module" ? Source=Paul Collins Startup list [RealTray] Confirmed=N Filename=RealPlay.exe Description=System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling SmartCenter via Preferences Source=Paul Collins Startup list [RealUpdater] Confirmed=X Filename=realupd.exe Description=Added as a result of the PARLAY VIRUS! Source=Paul Collins Startup list [Reboot] Confirmed=N Filename=Reboot.exe Description=MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards Source=Paul Collins Startup list [Recguard] Confirmed=Y Filename=recguard.exe Description=On HP computers, Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled, it is possible to knock that completely out and force the customer to send the PC back to HP for a re-image, possibly at the customer's expense Source=Paul Collins Startup list [Reclip] Confirmed=N Filename=reclip.exe Description=Reclip Popup Clipboard manager Source=Paul Collins Startup list [Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B}] Confirmed=X Filename=RH.DLL Description=SmartPops adware Source=Paul Collins Startup list [Recover] Confirmed=N Filename=N/A Description=Added during the installation of Comcast High Speed Internet software. During installation the system reboots and if the disk is removed a screen appears asking for the disk to be re-inserted to complete installation. Not required once installion is complete Source=Paul Collins Startup list [RecShe] Confirmed=N Filename=RecSche.exe Description=Recording scheduler for WatchTV Capture Card (TV Tuner card) Source=Paul Collins Startup list [Red Flag] Confirmed=N Filename=redflag.exe Description=PMS prediction program with modes for guys and girls - no longer available Source=Paul Collins Startup list [Red Swoosh EDN Client] Confirmed=X Filename=RSEDNClient.exe Description=Red Swoosh - mechanism used by web sites to allow you to download files from those sites quicker and more efficiently. Note from the license agreement they automatically update the software and share non-personally identifiable information with others in the network Source=Paul Collins Startup list [redirect] Confirmed=X Filename=redirect*.exe Description=Dotcomtoolbar/Linksummary hijacker installer - where * is a random digit Source=Paul Collins Startup list [Redline Taskbar] Confirmed=N Filename=taskbar.exe Description=Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards Source=Paul Collins Startup list [Referee] Confirmed=U Filename=referee.exe Description=MediaComm's monitor for file association changes. Stop rogue programs from screwing your settings either on installation or whenever they run Source=Paul Collins Startup list [Refresh] Confirmed=N Filename=Refresh.exe Description=(Iomega) Refresh - loads the Iomega desktop icons at startup Source=Paul Collins Startup list [Reg] Confirmed=X Filename=Reg.hta Description=Homepage hi-jacker. Removal instructions here Source=Paul Collins Startup list [Reg32] Confirmed=X Filename=Reg32.exe Description=Hijacker - redirecting to only-virgins.com Source=Paul Collins Startup list [Regcheck] Confirmed=X Filename=~CAB001.EXE Description=Added as a result of the CYBERSPY VIRUS! Source=Paul Collins Startup list [RegCleaner] Confirmed=X Filename=SYSio32.exe Description=Added as a result of an unidentified virus VIRUS!. Note - do not confuse this with the popular RegCleaner registry cleaner freeware Source=Paul Collins Startup list [RegCompres] Confirmed=X Filename=Regcpm32.exe Description=Added as a result of the POLDO.B VIRUS! Source=Paul Collins Startup list [RegCompres] Confirmed=X Filename=REGCPM32.EXE Description=Adult content dialler - see here. This has to be cleared at the same time as MSStartOptimizer (WINUPD.EXE), atisrc2 (windfind.exe) and mmxrun (msosa.exe), otherwise they return Source=Paul Collins Startup list [regedit] Confirmed=X Filename=regedit.exe Description=Added as a result of the BRID.A VIRUS! Note - resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP). The valid "regedit.exe" resides in C:\\Windows (Win9x/Me/XP) or C:\\Winnt (WinNT/2K) Source=Paul Collins Startup list [REGEDIT] Confirmed=X Filename=Regsrv32.com Description=Added as a result of the SOUTHGHOST VIRUS! Source=Paul Collins Startup list [reginfo32] Confirmed=? Filename=reginfo32.exe Description=?? Source=Paul Collins Startup list [Register MediaRing Talk] Confirmed=N Filename=register.exe Description=If you don't want to register MediaRing and be reminded about it every bootup disable it Source=Paul Collins Startup list [RegisterDropHandler] Confirmed=U Filename=REGIST~1.EXE Description=Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation Source=Paul Collins Startup list [Registration-Studio 8] Confirmed=N Filename=RegTool.exe Description=Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems Source=Paul Collins Startup list [Registry] Confirmed=X Filename=wscript.exe Description=Added as a result of the VBSWG VIRUS! Source=Paul Collins Startup list [Registry Loader] Confirmed=X Filename=regloadr.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Registry Loader] Confirmed=X Filename=winhlpp32.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Registry Scanner] Confirmed=X Filename=regscanr.exe Description=Added as a result of the OPTIX LITE FIREWALL BYPASS VIRUS! Source=Paul Collins Startup list [Registry Services] Confirmed=X Filename=Registry.exe Description=Added as a result of the DOWNLOADER.CILE VIRUS! Source=Paul Collins Startup list [RegistryChk] Confirmed=X Filename=winbackup.exe Description=Added as a result of the MERTIAN VIRUS! Source=Paul Collins Startup list [RegProt] Confirmed=Y Filename=Regprot.exe Description=RegistryProt from Diamond Computer Systems - protects the system registry against changes Source=Paul Collins Startup list [Regrun2] Confirmed=Y Filename=WatchDog.exe Description=Greatis Software's RegRun 3 Security Suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's, viruses, etc Source=Paul Collins Startup list [RegShave] Confirmed=N Filename=regshave.exe Description=Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BEFORE attempting to uninstall the Fuji software or the uninstall may not work correctly Source=Paul Collins Startup list [regsrv] Confirmed=X Filename=regsrv.exe Description=Added as a result of the OPTIXPRO.11 VIRUS! Source=Paul Collins Startup list [regsvc32] Confirmed=X Filename=regsvc32.exe Description=Homepage hijacker that changes your homepage to an adult content site Source=Paul Collins Startup list [REGSVR32] Confirmed=U Filename=regsvr32.exe ctasio.dll Description=ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality Source=Paul Collins Startup list [regtmlp] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [RegTweak] Confirmed=U Filename=RegTwk.exe Description=Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options, custom display modes, refresh rates and overclocking all through an easy to use interface Source=Paul Collins Startup list [RegVer] Confirmed=X Filename=REGVER.EXE Description=Added as a result of the LATINUS.16 VIRUS! Source=Paul Collins Startup list [RegWrite] Confirmed=X Filename=csrss.exe Description=Added as a result of the SOKACAPS VIRUS! Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling Source=Paul Collins Startup list [Regx10EXE] Confirmed=U Filename=atix10.exe Description=ATI Remote Wonder - PC wireless remote control Source=Paul Collins Startup list [Reg_WFT] Confirmed=X Filename=Regsysw.com Description=Added as a result of the WILSEF VIRUS! Source=Paul Collins Startup list [ReleaseRAM] Confirmed=U Filename=RRAM.exe Description="Release RAM allows your computer to run faster and uses your computer's RAM more efficiently". Some users swear by programs such as this but I suggest you read this article and make up your own mind Source=Paul Collins Startup list [RemHelp] Confirmed=N Filename=Remhelp.exe Description=BT Voyager ADSL Modem Help related Source=Paul Collins Startup list [Reminder] Confirmed=N Filename=reminder.exe Description=From MS Money. Reminds you of your bills Source=Paul Collins Startup list [Reminder] Confirmed=? Filename=Remind_XP.exe Description=Probably a registration reminder - but what for? Found in a C:\\Windows\\Creator directory Source=Paul Collins Startup list [Reminder-cpqXXXXX] Confirmed=N Filename=remind32.exe Description=Compaq printer Registration Source=Paul Collins Startup list [Reminder-hpcXXXXX] Confirmed=N Filename=remind32.exe Description=HP CD-Writer Registration Source=Paul Collins Startup list [Reminder-ranXXXXX] Confirmed=N Filename=remind32.exe Description=Registration reminder widget for Rand Mcnally maps Source=Paul Collins Startup list [reminder-ScanSoft Product Registration] Confirmed=N Filename=remind32.exe Description=Registration reminder for ScanSoft products such as PaperPort Source=Paul Collins Startup list [RemindMe] Confirmed=U Filename=RemindMe.exe Description=Remind-Me - calendar software Source=Paul Collins Startup list [Remind_XP] Confirmed=? Filename=Remind_XP.exe Description=Probably a registration reminder - but what for? Found in a C:\\Windows\\Creator directory Source=Paul Collins Startup list [Remote Access] Confirmed=U Filename=rnaapp.exe Description=Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie, analogue 56K modem) and terminates after the connection is closed Source=Paul Collins Startup list [Remote Access Slave] Confirmed=X Filename=Synchost.exe Description=Added as a result of the RIPJAC VIRUS! Source=Paul Collins Startup list [Remote Control] Confirmed=N Filename=Rc.exe Description=Hinet Hi-Five ISP software Source=Paul Collins Startup list [Remote Desktop Computing] Confirmed=U Filename=marspc.exe Description=Marspc Remote Desktop Computing Source=Paul Collins Startup list [Remote Management Agent] Confirmed=U Filename=zenrc32.exe Description=Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation Source=Paul Collins Startup list [remote master] Confirmed=U Filename=remote master.exe Description=Required if you want your ASUS Remote control to work at all. Available via Start -> Programs Source=Paul Collins Startup list [Remote Procedure Call Locator] Confirmed=X Filename=RUNDLL32.EXE reg678.dll ondll_reg Description=Added as a result of the LOVGATE.F VIRUS! Source=Paul Collins Startup list [RemoteCenter] Confirmed=U Filename=RcMan.exe Description=Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats Source=Paul Collins Startup list [RemoteControl] Confirmed=U Filename=rmctrl.exe Description=Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [Remote_Agent] Confirmed=N Filename=RemoteAgent.exe Description=Cyberlink Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings, you will need this, otherwise can be disabled. Available via Start -> Programs Source=Paul Collins Startup list [Removecpl] Confirmed=N Filename=Removecpl.exe Description=Related to a Belkin 54Mbps Wireless Utility Control Panel applet Source=Paul Collins Startup list [Removed.exe] Confirmed=X Filename=Removed.exe Description=GatorCheat - adware downloader Source=Paul Collins Startup list [RemStart] Confirmed=? Filename=remstart.exe Description=Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required? Source=Paul Collins Startup list [RenolB] Confirmed=? Filename=ib.exe Description=?? Source=Paul Collins Startup list [RepliGo Assistant] Confirmed=U Filename=RepliGoMon.exe Description=Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device" Source=Paul Collins Startup list [Resolution Assistant] Confirmed=N Filename=matcli.exe Description=Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [Resource Meter] Confirmed=N Filename=rsrcmtr.exe Description=Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes Source=Paul Collins Startup list [Restart Watch] Confirmed=? Filename=Watch.exe Description=Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required? Source=Paul Collins Startup list [Restart_VS] Confirmed=? Filename=Viewsonic.exe Description=Could be a left-over from the installation of a Viewsonic flat panel display Source=Paul Collins Startup list [RestoreIT!] Confirmed=Y Filename=VBPTASK.EXE Description=RestoreIT! from FarStone "allows you to recover instantly your files, system configuration, and even your operating system, to any point in time prior to the data loss or system failure." Source=Paul Collins Startup list [restory] Confirmed=X Filename=restory.exe Description=Added as a result of the RETSAM VIRUS! Source=Paul Collins Startup list [Resume Copy] Confirmed=U Filename=copyfstq.exe Description=Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function Source=Paul Collins Startup list [ResumeFixClocks] Confirmed=U Filename=resumefix.exe Description=Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards Source=Paul Collins Startup list [RetrieverScheduler] Confirmed=U Filename=retrieverscheduler.exe Description=80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network file systems, giving users one point of fast, accurate search for all personal information". Real-time scheduler - shortcut available Source=Paul Collins Startup list [RexSyMon] Confirmed=N Filename=rexsymon.exe Description=Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC Source=Paul Collins Startup list [RFTray] Confirmed=X Filename=RFTRay.exe Description=Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs Source=Paul Collins Startup list [rfwydg] Confirmed=? Filename=rfwydg.exe Description=?? Source=Paul Collins Startup list [RFX_auto_upgrade] Confirmed=N Filename=rundll32.exe npvpg005.dll Description=A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade Source=Paul Collins Startup list [RH] Confirmed=U Filename=rh32.exe Description=EuroFonts - adds Euro symbols to pre-Euro computers Source=Paul Collins Startup list [RhinoBlocker] Confirmed=U Filename=RhinoBlocker.exe Description=RhinoBlocker - pop-up stopper Source=Paul Collins Startup list [RHSI SHS] Confirmed=N Filename=SHS.exe Description=Rogers Hi-Speed Internet software. "Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail, the Self-Healing Software (SHS.exe) will automatically repair your settings to get you up and running in a flash" Source=Paul Collins Startup list [Ring Central Fax] Confirmed=U Filename=rcenterrll.exe Description=Only needed if you want a PC to answer faxes automatically Source=Paul Collins Startup list [rIOphosIs] Confirmed=X Filename=rIOPHosIs.vBS Description=Added as a result of the RIOSYS VIRUS! Source=Paul Collins Startup list [RivaTunerorRivaTunerStartupDaemon] Confirmed=U Filename=RivaTuner.exe Description=RivaTuner for tweaking nVidia graphics cards. Required if you make any changes Source=Paul Collins Startup list [RjLyraInstaller] Confirmed=? Filename=setup.exe Description=?? Source=Paul Collins Startup list [rmctrl] Confirmed=U Filename=rmctrl.exe Description=Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one Source=Paul Collins Startup list [rmmon] Confirmed=N Filename=mprmmon.exe Description=Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card Source=Paul Collins Startup list [RMremote] Confirmed=? Filename=RmRemote.exe Description=Remote control driver for REALmagic Xcard. Is it required? Source=Paul Collins Startup list [RNBOStart] Confirmed=U Filename=sentstrt.exe Description=Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools Source=Paul Collins Startup list [rndll2] Confirmed=? Filename=rndll2.exe Description=May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within? Source=Paul Collins Startup list [rngmf] Confirmed=X Filename= Description=Added as a result of the RANKY.C VIRUS! Source=Paul Collins Startup list [RoboForm] Confirmed=N Filename=RoboTaskBarIcon.exe Description=Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin Source=Paul Collins Startup list [RoboFormWatcher] Confirmed=N Filename=RoboFormWatcher.exe Description=AI Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs Source=Paul Collins Startup list [Rocket.Time] Confirmed=U Filename=RocketTime.exe Description=Time synchronization software from Rocket Software Source=Paul Collins Startup list [roketpipe] Confirmed=? Filename=rpclient.exe Description=?? Source=Paul Collins Startup list [ROUTD] Confirmed=? Filename=ROUTD.exe Description=?? Source=Paul Collins Startup list [Roxio Engine] Confirmed=? Filename=MSMNGR32.EXE Description=Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A VIRUS! Source=Paul Collins Startup list [RoxioAudioCentral] Confirmed=N Filename=RxMon.exe Description=Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound editor - integrated in a single application". Not required for Roxio to work properly. Source=Paul Collins Startup list [RoxioDragToDisc] Confirmed=N Filename=DrgToDsc.exe Description=Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly Source=Paul Collins Startup list [RoxioEngineUtility] Confirmed=Y Filename=EngUtil.exe Description=Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking Source=Paul Collins Startup list [RP32] Confirmed=U Filename=rp32.exe Description=ControlIT (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems. Source=Paul Collins Startup list [RPC Patcher] Confirmed=X Filename= Description=Added as a result of the BOLGI VIRUS! Source=Paul Collins Startup list [RPCSS.exe] Confirmed=Y Filename=rpcss.exe Description=Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se, a program may need it to communicate with other components of itself. You could delete the program but if any abnormalities occur soon after then reinstall. Under NT, deleting this critical system component will disable the OS. For a more detailed explanation see here Source=Paul Collins Startup list [RRMedic] Confirmed=X Filename=rrmedic.exe Description=Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there internet connection Source=Paul Collins Startup list [rscmpt] Confirmed=U Filename=rscmpt.exe Description=Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status Source=Paul Collins Startup list [rsMenu] Confirmed=U Filename=rsMenu.exe Description=Synchronizes a Casio PDA with MS Outlook Source=Paul Collins Startup list [RSRCMTZ] Confirmed=? Filename=RSRCMTZ.exe Description=?? Source=Paul Collins Startup list [RSS] Confirmed=X Filename=rundll32 RSSToolbar.dll, DllRunMain Description="Related Sites" toolbar - SearchAndClick hijacker variant Source=Paul Collins Startup list [RtlMon.exe] Confirmed=N Filename=RtlMon.exe Description=Monitor for RealTek network card Source=Paul Collins Startup list [rtos] Confirmed=X Filename=rtos.exe Description=IRC trojan Source=Paul Collins Startup list [RTStartMute] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [rtvscn95] Confirmed=Y Filename=RTVSCN95.EXE Description=Real-time virus scanner component of Norton Anti-Virus Corporate Edition Source=Paul Collins Startup list [RuLaunch] Confirmed=U Filename=RuLaunch.exe Description=Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis Source=Paul Collins Startup list [Run MSupdt32] Confirmed=X Filename=wscript MSupdt32.vbs Description=Added as a result of the CASER VIRUS! Source=Paul Collins Startup list [Run POPFile in background] Confirmed=U Filename=perl.exewperl.exe Description=POPFile - E-mail spam blocker Source=Paul Collins Startup list [Run StartupMonitor] Confirmed=U Filename=StartupMonitor.exe Description=Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu Source=Paul Collins Startup list [run32dll] Confirmed=X Filename=WINClock.exe Description=Unidentified mIRC VIRUS! Source=Paul Collins Startup list [run32dll] Confirmed=X Filename=task32.exe Description=Unidentified mIRC VIRUS! Source=Paul Collins Startup list [Run32dll] Confirmed=X Filename=ocxdll.exe Description=Unidentified mIRC VIRUS! Source=Paul Collins Startup list [run=] Confirmed=N Filename=cmmpu.exe Description=MIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI) Source=Paul Collins Startup list [run=] Confirmed=N Filename=hpfsched Description=HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature Source=Paul Collins Startup list [run=] Confirmed=N Filename=lxdboxcp.exe Description=Lexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS Source=Paul Collins Startup list [run=] Confirmed=N Filename=pcfix2k.exe Description=pcfix2k splash screen Source=Paul Collins Startup list [run=] Confirmed=X Filename=ptlseq.cpl Description=PhoenixNet BIOS adware. See here Source=Paul Collins Startup list [run=] Confirmed=U Filename=ramsys.exe Description=Advanced Startup Manager from Rays Lab Source=Paul Collins Startup list [run=] Confirmed=? Filename=wallflip.exe Description=Desktop wallpaper changer? Source=Paul Collins Startup list [run=] Confirmed=X Filename=svcinit.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [run=] Confirmed=X Filename=fntldr.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [run=] Confirmed=Y Filename=smsrun16.exe Description=Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1, Windows for Workgroups, Win95, or OS/2 to create program groups on the client and then launch SMS client programs Source=Paul Collins Startup list [RunAlert] Confirmed=U Filename=AService.exe Description=MSI MOtherboard PC Alert III - MSI motherboard monitoring software. Only required if you "overclock" your system Source=Paul Collins Startup list [runAP] Confirmed=N Filename=runAP.exe Description=Not required but what is it? Source=Paul Collins Startup list [Runapp32] Confirmed=X Filename=Runapp32.exe Description=Added as a result of the NEODURK VIRUS! Source=Paul Collins Startup list [Rund1l32] Confirmed=X Filename=Winfi1e32.exe Description=Added as a result of the MERTIAN VIRUS! Source=Paul Collins Startup list [rundl332] Confirmed=X Filename=math.exe ...pluged.exe Description=Added as a result of the DOOMJUICE VIRUS! Source=Paul Collins Startup list [rundli32] Confirmed=X Filename=rundli32.exe Description=Added as a result of the LADE VIRUS! Source=Paul Collins Startup list [RunDLL] Confirmed=X Filename=rundll32.exe bridge.dll, Load Description=Flingstone.com browser hijacker Source=Paul Collins Startup list [rundll###] Confirmed=X Filename=die.exe and either ttg.exe or secure.exe or mdll.exe or secure.bat Description=Added as a result of the SUMTAX VIRUS! where ### is 134, 569, 777 or 946 Source=Paul Collins Startup list [Rundll16] Confirmed=X Filename=Rundll16.exe Description=Added as a result of any number of VIRUSES! Source=Paul Collins Startup list [Rundll32] Confirmed=X Filename=Rundll32.exe Description=Added as a result of the DVLDR VIRUS! Note - this is not the valid "Rundll32.exe" as it's in the Windows\\Fonts directory Source=Paul Collins Startup list [RUNDLL32] Confirmed=N Filename=RUNDLL32.EXE NvQtwk, NvCplDaemon Description=This loads the System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again Source=Paul Collins Startup list [RunDLL32] Confirmed=N Filename=RunDLL32.exe NvMCTray.dll, NvTaskbarInit Description=System Tray icon used to change display settings for nVidia based graphics cards. Unnecessary since you can easily configure these settings the way you want them in the Display Properties Source=Paul Collins Startup list [rundll32] Confirmed=U Filename=Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings Description=Loads default settings for Leadtek Winfast graphics cards Source=Paul Collins Startup list [RunDLL32] Confirmed=X Filename=winupdate.exe Description=Unidentified VIRUS! - possibly a BMBOT variant Source=Paul Collins Startup list [Rundll32] Confirmed=X Filename=Windows.exe Description=Added as a result of the QQPASS.E VIRUS! Source=Paul Collins Startup list [Rundll32] Confirmed=X Filename=Rundll32.exe ptipbm.dll, SetWriteBack Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. If used is it required? Source=Paul Collins Startup list [rundll32] Confirmed=X Filename= Description=Added as a result of the AUTEX VIRUS! Source=Paul Collins Startup list [rundll32] Confirmed=? Filename=rundll32.exe ptipbmf.dll, SetWriteCacheMode Description=Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller Source=Paul Collins Startup list [rundll32] Confirmed=X Filename=rundll32.exe Description=Added as a result of the SANKER VIRUS! Note that the valid "rundll32.exe" resides in C:\\Windows\\System32 wheras this version resides in C:\\Windows Source=Paul Collins Startup list [rundll32] Confirmed=X Filename=csrss.exe Description=Added as a result of the GUTTA VIRUS! Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling Source=Paul Collins Startup list [rundll32] Confirmed=? Filename=RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Description=Used for a bluetooth adapter? Source=Paul Collins Startup list [Rundll32 cmicnfg] Confirmed=N Filename=Rundll32 cmicnfg.cpl, CMICtrlWnd Description=System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [Rundll32.exe] Confirmed=X Filename=Proyecto1.exeRoot.exe Description=Added as a result of the GRUEL VIRUS! Source=Paul Collins Startup list [Rundll32_7] Confirmed=X Filename=rundll32.exe MSIEFR40.DLL, DllRunServer Description=BrowserAid "Featured Results" hijacker variant Source=Paul Collins Startup list [Rundll32_8] Confirmed=X Filename=rundll32.exe inetp60.dll, DllRunServer Description=BrowserAid parasite variant Source=Paul Collins Startup list [rundll64] Confirmed=X Filename= Description=Added as a result of the AUTEX VIRUS! Source=Paul Collins Startup list [Rundllsystem32] Confirmed=X Filename=Rundllsystem32.exe Description=Added as a result of the NETDEVIL.B VIRUS! Source=Paul Collins Startup list [RunOnce] Confirmed=U Filename=RUNONCE.EXE Description=Part of MS Data Access Components - only required if you use these Source=Paul Collins Startup list [RunProg] Confirmed=X Filename=Server.exe Description=Added as a result of the OPTIX.04.A VIRUS! Source=Paul Collins Startup list [RunProg] Confirmed=X Filename=wini.exe Description=Added as a result of the OPTIX.04.D VIRUS! Source=Paul Collins Startup list [RunSysd32] Confirmed=U Filename=RunSysd32.exe Description=DesktopShield2000 by St�phane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within Source=Paul Collins Startup list [RunWindowsUpdate] Confirmed=X Filename=uptodate.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [Run[0]] Confirmed=X Filename=syscnfg.exe Description=Added as the result of an unidentified VIRUS!. "syscnfg.exe" is found in the C:\\windows\\fonts (or C:\\winnt\\fonts) directory where no *.exe files should reside Source=Paul Collins Startup list [Run_cd] Confirmed=X Filename=Run_cd.exe Description=Added as a result of the GHOST.23 VIRUS! Source=Paul Collins Startup list [RUSBHOLoader] Confirmed=? Filename=rundll32.exe RUSBHOLoader.dll, AutoRegister Description=?? Source=Paul Collins Startup list [rvde] Confirmed=X Filename=N/A Description=Related to li-speed**** Source=Paul Collins Startup list [RVP] Confirmed=X Filename=bpc.exe Description=Spyware included with the latest version of Grokster. Also see here Source=Paul Collins Startup list [RxMon] Confirmed=N Filename=rxmon9x.exe Description=Dell Resolution Assistant Source=Paul Collins Startup list [r_server] Confirmed=Y Filename=r_server.exe Description=Radmin - remote admistrator server Source=Paul Collins Startup list [S24EvMon] Confirmed=? Filename=S24EvMon.exe Description=Event Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required? Source=Paul Collins Startup list [S3apphk] Confirmed=? Filename=S3apphk.exe Description=S3 graphics related? Source=Paul Collins Startup list [S3Mon] Confirmed=? Filename=S3Mon.exe Description=S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required? Source=Paul Collins Startup list [S3TRAY] Confirmed=N Filename=S3Tray.exe Description=S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display Source=Paul Collins Startup list [s3tray2] Confirmed=? Filename=s3tray2.exe Description=Same as above? Source=Paul Collins Startup list [S4F] Confirmed=U Filename=S4F.exe Description=S4F internet filtering software Source=Paul Collins Startup list [s4helper] Confirmed=X Filename=s4helper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [SA] Confirmed=? Filename=Sa3.exe Description=Logitech QuickCam driver. Is it required? Source=Paul Collins Startup list [SA Service] Confirmed=? Filename=SAservice.exe Description=Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required? Source=Paul Collins Startup list [Sa3dsrv] Confirmed=N Filename=Sa3dsrv.exe Description=3D sound extension for Windows Source=Paul Collins Startup list [Sabreserver] Confirmed=N Filename=SABSERV.EXE Description=Airline reservation software from Sabre. Available via Start -> Programs Source=Paul Collins Startup list [SAClient] Confirmed=N Filename=RegCon.exe Description=AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected, you're immediately notified by e-mail, pager, or text messaging Source=Paul Collins Startup list [SafeInstall.exe] Confirmed=N Filename=SAFEIN~1.EXE Description=Monitors a download and ensures an newer version of a file isn't replaced by an older one Source=Paul Collins Startup list [SafeOFF] Confirmed=N Filename=SafeOff.exe Description=Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation Source=Paul Collins Startup list [SafeSearch] Confirmed=X Filename=safesearch.exe Description=AutoSearch parasite variant Source=Paul Collins Startup list [SafeSurfingUpdate] Confirmed=X Filename=SSUpdate.exe Description=DyFuCa/MoneyTree parasite variant Source=Paul Collins Startup list [Safeworld] Confirmed=U Filename=Freedom.exe Description=SafeWorld Internet Security Source=Paul Collins Startup list [SAgent2ExePath] Confirmed=N Filename=SAgent2.exe Description=Seiko Epson printer status agent. Disable if printer is not used often Source=Paul Collins Startup list [sagnt] Confirmed=X Filename=sagnt.exe Description=Adware web downloader Source=Paul Collins Startup list [SAHagent] Confirmed=X Filename=Sahagent.exe Description=ShopAtHomeSelect parasite Source=Paul Collins Startup list [SAHBundle] Confirmed=X Filename=bundle.exe Description=ShopAtHomeSelect parasite related Source=Paul Collins Startup list [SAIMON] Confirmed=U Filename=SaiMon.exe Description=Saitek joystick driver Source=Paul Collins Startup list [SaiSmart] Confirmed=? Filename=SaiSmart.exe Description="Smart Button Special Sauce" - included with the latest software for Saitek game controllers. Related to the "S", "Shift" or "Smart" button. What does it do and is it required? Source=Paul Collins Startup list [SaitekAutoConfigure] Confirmed=U Filename=saicnfig.exe Description=Configuration for Saitek game controllers Source=Paul Collins Startup list [SAMcal] Confirmed=U Filename=SAMcal.exe Description=SamCal - calendar/reminder program Source=Paul Collins Startup list [SandIcon] Confirmed=N Filename=SandIcon.exe Description=SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds, but once the software sees there's no reader, you get back the resources Source=Paul Collins Startup list [SAUpdate] Confirmed=U Filename=SAUpdate.exe Description=Big Brother from Quest Software. System and network monitor Source=Paul Collins Startup list [SAVAgent] Confirmed=Y Filename=SAVAgent.exe Description=Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly, e.g. automatically updating PCs used by dial-in home or out-of-office users Source=Paul Collins Startup list [Save] Confirmed=X Filename=Save.exe Description=Rebranded version of SaveNow advertising spyware Source=Paul Collins Startup list [SaveDate] Confirmed=X Filename=SaveStartDate.Exe Description=Unidentified adware Source=Paul Collins Startup list [Savenow] Confirmed=X Filename=SaveNow.exe Description=Advertising spyware. Installed as part of the Kazaa Media Desktop bundle for example Source=Paul Collins Startup list [Savenow] Confirmed=X Filename=savenow.exe Description=Added as a result of the SPREDA.B VIRUS! Source=Paul Collins Startup list [Say The Time 5.0] Confirmed=U Filename=SAYTIME.EXE Description=This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularly Source=Paul Collins Startup list [SB Audigy 2 Startup Menu] Confirmed=N Filename=/l:eng Description=Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup Source=Paul Collins Startup list [SB Watchdog] Confirmed=X Filename=SBWatchdog.exe Description=Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank. See here for more information Source=Paul Collins Startup list [SBDrvDet] Confirmed=U Filename=SBDrv.exe Description=Detects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one Source=Paul Collins Startup list [SBHC] Confirmed=X Filename=sbhc.exe Description=SuperBar parasite - uninstall available here Source=Paul Collins Startup list [SBMX] Confirmed=N Filename=sbmx.exe Description=SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only) Source=Paul Collins Startup list [sc] Confirmed=N Filename=scrubxp.exe Description=ScrubXP - utility that deletes safe to remove files, cookies, browsing history, etc Source=Paul Collins Startup list [sc] Confirmed=U Filename=sc.exe Description=Watchdog 2.0 Software - monitoring program Source=Paul Collins Startup list [sc23exec] Confirmed=? Filename=sc23exec.exe Description=Possibly related to a digital camera Source=Paul Collins Startup list [scan] Confirmed=X Filename=mscman.exe Description=Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK, "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!" Source=Paul Collins Startup list [Scan Detector] Confirmed=? Filename=Pmxdetect.exe Description=Associated with PrimaScan scanners. Is it required? Source=Paul Collins Startup list [Scan Wizard] Confirmed=? Filename=button.exe Description=Associated with ScanWizard as supplied with Microtek scanners - see also Scanner Detector or SDetect. What does it do and is it required? Source=Paul Collins Startup list [ScanDisk] Confirmed=X Filename=ScanDisk.exe Description=Added as a result of the GANDA.A VIRUS! Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checker Source=Paul Collins Startup list [ScanFile] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [ScanInicio] Confirmed=? Filename=Inicio.exe Description=Part of Panda Anti-Virus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active Source=Paul Collins Startup list [Scanner Detector] Confirmed=N Filename=SDetect.exe Description=ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button Source=Paul Collins Startup list [Scanreg] Confirmed=X Filename= Description=Added as a result of the QQPASS.E VIRUS! Source=Paul Collins Startup list [ScanRegistry] Confirmed=X Filename=nsrvnt.exe Description=Added as a result of the NERTE VIRUS!. Not to be confused with the real ScanRegistry below - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe Source=Paul Collins Startup list [ScanRegistry] Confirmed=X Filename=scanregv.exe Description=Added as a result of the MASTERLOCK VIRUS!. Not to be confused with the real ScanRegistry below - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe Source=Paul Collins Startup list [ScanRegistry] Confirmed=Y Filename=Scanregw.exe Description=Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) Source=Paul Collins Startup list [ScanRegistry] Confirmed=X Filename=Scanregw.exe Description=Added as a result of the STATOR VIRUS!. Not to be confused with the real ScanRegistry above - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%\\System (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt). Runs from the registry RunServices key as opposed to the Run key Source=Paul Collins Startup list [ScanRegistry] Confirmed=X Filename=Scanregw.exe Description=Added as a result of the GWGHOST VIRUS!. Not to be confused with the real ScanRegistry above - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%\\System (where %windir% is the Windows directory - C:\\Windows or C:\\Winnt) Source=Paul Collins Startup list [SCardSvr] Confirmed=N Filename=scardsvr.exe Description=Related to SmartCard readers and sometimes uses lots of system resources Source=Paul Collins Startup list [SCardSvr] Confirmed=X Filename=SCardSvr32.Exe Description=Added as a result of the MOFEI.B VIRUS! Source=Paul Collins Startup list [scheck] Confirmed=X Filename=scheck**.exe Description=Added as a result of the KETCH VIRUS! where ** represents a number Source=Paul Collins Startup list [Scheduled Maintenance] Confirmed=N Filename=Scheduled_Maintenance.exe Description=Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs Source=Paul Collins Startup list [Scheduling Agent] Confirmed=X Filename=Scheduler.exe Description=Added as a result of the SUBWOOFER VIRUS! Note - this is not the real MS Scheduling agent as the executable is incorrect Source=Paul Collins Startup list [SchedulingAgant] Confirmed=X Filename=MMTASK.EXE Description=Added as a result of the YAB.A VIRUS! Not the valid MusicMatch Jukebox which has the same filename Source=Paul Collins Startup list [SchedulingAgent] Confirmed=U Filename=mstask.exemstinit.exe Description=MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans Source=Paul Collins Startup list [Schmaili] Confirmed=U Filename=Schmaili.exe Description=Schmaili - insert animated smilies into your e-mail Source=Paul Collins Startup list [SCHWIZEX] Confirmed=Y Filename=SCHWIZEX.EXE Description=Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot Source=Paul Collins Startup list [Scotia OnLine RecoveryorScotia OnLine Security v*.* Recovery] Confirmed=N Filename=etdirrcv.exe Description=Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process Source=Paul Collins Startup list [Scr] Confirmed=X Filename=scr.scr Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [ScrapPad] Confirmed=N Filename=Scrappad.exe Description=ScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper Source=Paul Collins Startup list [Screen Guard] Confirmed=U Filename=launch.exe Description=Part of Access Denied security and privacy software Source=Paul Collins Startup list [Screen Guard Message Scan] Confirmed=U Filename=sgms.exe Description=Part of Access Denied security and privacy software Source=Paul Collins Startup list [Screen Saver Control] Confirmed=N Filename=FSScrCtl.exe Description=Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon Source=Paul Collins Startup list [screxe] Confirmed=? Filename=scruser2k.exe Description=?? Source=Paul Collins Startup list [script] Confirmed=? Filename=script.bat Description=Maybe associated with DOS on a Win9x machine Source=Paul Collins Startup list [ScriptBlocking] Confirmed=Y Filename=SBServ.exe Description=Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information Source=Paul Collins Startup list [ScriptSentry] Confirmed=Y Filename=Scriptsentry.exe Description=Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly Source=Paul Collins Startup list [Scroll-In-Mouse V2.0] Confirmed=U Filename=SCROLL.EXE Description=Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features Source=Paul Collins Startup list [ScrSvr] Confirmed=X Filename=ScrSvr.exe Description=Added as a result of the OPASOFT.A VIRUS! Source=Paul Collins Startup list [ScrSvr] Confirmed=X Filename=ScrSvr.exe Description=Added as a result of the OPASERV VIRUS! Source=Paul Collins Startup list [ScrSvrOld] Confirmed=X Filename= Description=Added as a result of the OPASERV VIRUS! Source=Paul Collins Startup list [Scsi] Confirmed=Y Filename=Scsi.exe Description=SCSI Miniport driver Source=Paul Collins Startup list [SDaemon] Confirmed=U Filename=sdaemon.exe Description=PC Security from Tropical Software. 'PC Security� 5.1 is the ultimate in computer security, offering multiple locking systems for the Windows environment and internet. Lock files, monitor programs' activities, even detect intruders! PC Security offers flexible and complete password protection, "Drag and Drop" support, plus many other handy features' Source=Paul Collins Startup list [SDetect] Confirmed=N Filename=SDetect.exe Description=ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button Source=Paul Collins Startup list [Search Hook] Confirmed=? Filename=srchhook.exe Description=?? Source=Paul Collins Startup list [Search-Exe] Confirmed=X Filename=SE.exe Description=Hijacker - redirecting to Search-exe.com Source=Paul Collins Startup list [Search.vbs] Confirmed=X Filename= Description=Hijacker Source=Paul Collins Startup list [SearchEnhancement] Confirmed=X Filename=scbar.exe Description=IE search hijacker Source=Paul Collins Startup list [SearchSquire33] Confirmed=X Filename=SearchUpdate33.exe Description=SearchSquire parasite Source=Paul Collins Startup list [SecondChance] Confirmed=U Filename=sctray.exe Description=Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash Source=Paul Collins Startup list [Secret-Crush] Confirmed=X Filename=start.exe Description=Hijacker that may reset your browser's home page and/or search settings to point to undesired sites Source=Paul Collins Startup list [Secsys] Confirmed=U Filename=Secsys.exe Description=Key Interceptor - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [SecureCleanIEClean] Confirmed=N Filename=SCIEClean.exe Description=SecureClean - scans your system for hidden temporary files, deleted email messages, Internet histories and caches Source=Paul Collins Startup list [SecureItPro] Confirmed=U Filename=Secureitpro470p.exe Description=SecureIt Pro - lock your computer when you're not there, to stop malicious users from accessing your desktop Source=Paul Collins Startup list [SecureLogin] Confirmed=X Filename=Mslg32.exe Description=Added as a result of the REDZED VIRUS! Source=Paul Collins Startup list [SECWIZ98] Confirmed=Y Filename=SECWIZ98.EXE Description=Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here Source=Paul Collins Startup list [SelfHostUtil] Confirmed=? Filename=slefhost.exe Description=?? Source=Paul Collins Startup list [SeMS] Confirmed=U Filename=SeMS.exe Description=

PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone Source=Paul Collins Startup list [SENTRY] Confirmed=X Filename=SENTRY.exe Description=From IP Insight. Allows website owners "to instantly determine the precise geographic location, connection speed and detailed demographics of every visitor to your website". Will be detected by most firewalls and the majority of home users should disable it Source=Paul Collins Startup list [Serials] Confirmed=X Filename=serials.exe Description=Any one of a variety of worms and trojans Source=Paul Collins Startup list [serrdctl.exe] Confirmed=Y Filename=serrdctl.exe Description="Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems Source=Paul Collins Startup list [Serv-U] Confirmed=N Filename=serv-u32.exe Description=FTP server Source=Paul Collins Startup list [Serv-U] Confirmed=X Filename=wssdsu.exe Description=Added as a result of the MANIFEST VIRUS! Source=Paul Collins Startup list [server] Confirmed=X Filename=server.exe Description=Added as a result of the DELTAD.A VIRUS! Source=Paul Collins Startup list [SERVER.EXE] Confirmed=X Filename=SERVER.EXE Description=Added as a result of the BUSHTRO122 or SMOKODOOR VIRUSES! Source=Paul Collins Startup list [serverex] Confirmed=X Filename=Server.txt.vbs Description=Added as a result of the DELTAD.A VIRUS! Source=Paul Collins Startup list [Service] Confirmed=U Filename=service.exe Description=Added as a result of the ALADINZ.H VIRUS! Source=Paul Collins Startup list [Service] Confirmed=X Filename=services.exe Description=Added as the result of the NETSKY or NETSKY.B VIRUSES! Note - not to be confused with the valid Windows "services.exe" which resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K) or C:\\Windows\\System32 (WinXP) as this resides in C:\\Windows or C:\\Winnt Source=Paul Collins Startup list [Service] Confirmed=X Filename= Description=Added as a result of the KAITEX.E VIRUS! Source=Paul Collins Startup list [Service Connection] Confirmed=N Filename=sccenter.exebwtray.exe Description=For Compaq PC's. Part of Backweb Source=Paul Collins Startup list [Service Controller] Confirmed=X Filename=Csrrs.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Service Host] Confirmed=X Filename=.exe Description=Added as a result of the TORVEL.B VIRUS! Source=Paul Collins Startup list [Service Host ] Confirmed=X Filename=spoolos.exe Description=Added as a result of the TORVEL VIRUS! Source=Paul Collins Startup list [Service Manager] Confirmed=N Filename=sqlmangr.exe Description=SQL Server Service Manager - provides tray access to SQL server, the server agent and MSDTC. Available via Start -> Programs Source=Paul Collins Startup list [Service Process] Confirmed=X Filename=SVCHOST.EXE Description=Added as a result of the DARKER VIRUS! Note - not the valid svchost.exe as described here. Located in %Windir% not %Sysdir% Source=Paul Collins Startup list [Service.exe] Confirmed=X Filename=Service.exe Description="servedby.advertising" popup generator Source=Paul Collins Startup list [ServiceConfig] Confirmed=U Filename=ispbeg.exe Description=Comcast Transition Wizard. On June 30th, 2003 it will migrate E-mail and web pages from AT&T Broadband Internet to Comcast High-Speed Internet. Until then it will run at startup and then terminate - hence the U recommendation Source=Paul Collins Startup list [services] Confirmed=X Filename=start.bat Description=Added as a result of the ZCREW VIRUS! Source=Paul Collins Startup list [Services] Confirmed=X Filename= Description=Added as a result of the RANCK or RANCK.B or METEORSHELL VIRUSES! Source=Paul Collins Startup list [Services] Confirmed=X Filename=back32.exe ...service.exe Description=Added as a result of an unidentified VIRUS! Back32.exe is the baddie whose purpose is to HIDE the MIRC32 server in service.exe Source=Paul Collins Startup list [Services Controller] Confirmed=X Filename=lsassa.exe Description=Added as a result of the CIADOOR.122 VIRUS! Source=Paul Collins Startup list [Services Host] Confirmed=X Filename=Scchost.exe Description=Added as a result of the DONK VIRUS! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [Services.EXE] Confirmed=X Filename=services.exe Description=Added as a result of the KAZPING VIRUS! Note - this is not the valid Windows Service Controller (services.exe) process Source=Paul Collins Startup list [Services004] Confirmed=X Filename= Description=Added as a result of the BUGBROS VIRUS! Source=Paul Collins Startup list [ServUTrayIcon] Confirmed=? Filename=ServUTray.exe Description=System Tray icon for Serv-U FTP server. Is it required? Source=Paul Collins Startup list [SetDefaultMIDI] Confirmed=? Filename=MIDIDef.exe Description=Related to a Soundblaster Audigy soundcards. What does it do and is it required? Source=Paul Collins Startup list [setdefprt] Confirmed=? Filename=setdefprt.exe Description=Related to a Brother printer? Source=Paul Collins Startup list [SetecCertUtil] Confirmed=U Filename=Certutil.exe Description=Setec Web and Email Security. Setec PKI smart card software. The PKI technology enables secure and reliable user identification in services offered through Internet, mobile handsets and digital TV Source=Paul Collins Startup list [setFTPBack] Confirmed=X Filename=createsw.exe Description=Added as a result of the FTP_BMAIL VIRUS! Source=Paul Collins Startup list [SetHook] Confirmed=N Filename=SetHook.exe Description=Fellowes Neato CD label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar" Source=Paul Collins Startup list [seticlientorSETI@home] Confirmed=N Filename=SETI@home.exe Description=SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data Source=Paul Collins Startup list [SetIcon] Confirmed=N Filename=SetIcon.exe Description=Installed by a 6-in-1 (4 Media Card slots, a floppy drive and a USB connection) device. Constantly updates the icons for the four Media Card slots that it has and is a resource hog Source=Paul Collins Startup list [SetiQueue] Confirmed=N Filename=Setiqu~1.exe Description=Provides work unit buffering for Seti@Home clients - see here for more details Source=Paul Collins Startup list [SetiSpy] Confirmed=N Filename=SetiSpy.exe Description=From the site - 'SETI Spy is a little program I wrote to "spy" on the progress and performance of the SETI@home client. I call it a "spy" because I tried to make it as unobtrusive as possible' Source=Paul Collins Startup list [Setting] Confirmed=X Filename=sysweb.exe Description=Added as a result of the SDBOT.GEN VIRUS! Source=Paul Collins Startup list [setup] Confirmed=N Filename=hphprld.exe ....setup.exe Description=HP DeskJet Setup - printers function normally without it Source=Paul Collins Startup list [SetupICWDesktop] Confirmed=N Filename=icwconn1.exe Description=Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway Source=Paul Collins Startup list [setuzp] Confirmed=? Filename=setuzp.exe Description=?? Source=Paul Collins Startup list [SetVrc] Confirmed=X Filename=setvrc.exe Description=Added as a result of the HUNTOCX VIRUS! Source=Paul Collins Startup list [Sex Teris] Confirmed=X Filename=st01b.exe Description=Added as a result of the REPAD VIRUS! Source=Paul Collins Startup list [SFtrb Service] Confirmed=X Filename=cftrb32.exe Description=Added as a result of the SOBIG.D VIRUS! Source=Paul Collins Startup list [SfWinStartInfo] Confirmed=U Filename=sfWinStartupInfo.exe Description=

SFIRM32 Online Banking software Source=Paul Collins Startup list [Sgecrypt] Confirmed=U Filename=Sgecrypt.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [Sgeecview] Confirmed=U Filename=Ecview.exe Description=SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks" Source=Paul Collins Startup list [SGTBox] Confirmed=? Filename=SGTBox.exe Description=Canon scanner driver. Is it required? Source=Paul Collins Startup list [sgtray] Confirmed=U Filename=sgtray.exe Description=StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups Source=Paul Collins Startup list [shambl3r] Confirmed=X Filename=cnf.bat Description=Added as a result of the REMABL VIRUS! Source=Paul Collins Startup list [shambl3r*] Confirmed=X Filename=shambl3r.exe Description=Added as a result of the REMABL VIRUS! where * is 2 to 11 Source=Paul Collins Startup list [Share-to-Web Namespace Daemon] Confirmed=N Filename=hpgs2wnd.exe Description="HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites." In other words an application that allows users to upload scanned images to their personal webpages if desired. Available via Start -> Programs Source=Paul Collins Startup list [sharedprem] Confirmed=X Filename=sharedprem.exe Description=Added as a result of the MAKECALL VIRUS! Source=Paul Collins Startup list [Sharing and Mapping Software] Confirmed=Y Filename=DShmap.exe Description=Intel AnyPoint internet sharing software Source=Paul Collins Startup list [SharkEject] Confirmed=N Filename=AEJCT32.exe Description=Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded, there is a desktop icon so this isn't required Source=Paul Collins Startup list [Shell] Confirmed=X Filename=Shell32.exe Description=Added as a result of the BADSECTOR VIRUS! Source=Paul Collins Startup list [Shell] Confirmed=X Filename=ray.exeTray.exe Description=Homepage hijacker re-directing browsers to adult content websites Source=Paul Collins Startup list [ShellApi] Confirmed=X Filename=SHELLMSN.EXE Description=Added as a result of the NETDEV.B VIRUS! Source=Paul Collins Startup list [Shellapi32] Confirmed=X Filename=Shellapi32.exe Description=Added as a result of the NETDEVIL (or NERTE) VIRUS! Source=Paul Collins Startup list [ShellEx] Confirmed=X Filename=ShellEx.exe Description=Added as a result of the ANAKHA VIRUS! Source=Paul Collins Startup list [shicoxp] Confirmed=N Filename=shicoxp.exe Description=Driver for a MultiCard slot ImageMate 6-in-1 Combo cardreader Source=Paul Collins Startup list [Shine] Confirmed=X Filename=Shine.exe Description=Added as a result of the HAPPYLOW (or NISHE-A) VIRUS! Source=Paul Collins Startup list [Shmgrate.exe] Confirmed=X Filename=ibot4.exe Description=Added as a result of the GASTER VIRUS! Source=Paul Collins Startup list [shockmachine reminder] Confirmed=N Filename=SmReminder.exe Description=Shockmachine is an entertainment playback device that lets you save your favorite Shockwave.com titles and play them back in full-screen mode, off-line, anytime. Could be a registration reminder for the trial version Source=Paul Collins Startup list [Shockwave Init] Confirmed=N Filename=SWINIT.EXE Description=Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs Source=Paul Collins Startup list [ShortKeys 99] Confirmed=N Filename=SHORTKEY.EXE Description=ShortKeys from Insight Software Solutions - allows you to program keys with text strings Source=Paul Collins Startup list [Showbehind] Confirmed=X Filename=SHOWBEHIND.EXE Description=Advertisement display which can be stopped here Source=Paul Collins Startup list [ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051] Confirmed=? Filename=shwicon.exe Description=Card reader for memory cards from digital cameras. Is it required? Source=Paul Collins Startup list [SHPC32] Confirmed=U Filename=SHPC32.exe Description=Port monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabled Source=Paul Collins Startup list [ShStatEXE] Confirmed=Y Filename=SHSTAT.EXE Description=From McAfee VirusScan NT 4.x. Handles program communication among VShield components, displays VShield icon. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [Shutdownaware] Confirmed=U Filename=shutdownaware.exe Description=Loaded by the SWEEX 6-in-1 Media Card Reader to properly manage the reader while it is connected to your system Source=Paul Collins Startup list [ShutDownPro] Confirmed=U Filename=ShutDownPro.exe Description=ShutDownPro - shutdown, reboot, logoff your System with one mouse click Source=Paul Collins Startup list [Si Meter] Confirmed=? Filename=SIMETER.EXE Description=?? Source=Paul Collins Startup list [Sicom] Confirmed=X Filename=Sicom.exe Description=Added as a result of the NETLIP VIRUS! Source=Paul Collins Startup list [SideACT] Confirmed=U Filename=SideACT.exe Description=SideACT organizer software Source=Paul Collins Startup list [Sidebar] Confirmed=X Filename=Sidebar.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [SideWinderTrayV4orSWTrayV4] Confirmed=N Filename=SWTrayV4.exe Description=MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs Source=Paul Collins Startup list [SimpLite-MSN] Confirmed=U Filename=SimpLite-MSN.exe Description=Required if you use the SimpLite add-on to MSN Messenger (SimpLite adds encryption to the instant messaging service) Source=Paul Collins Startup list [Singapore] Confirmed=X Filename=singapore.exe Description=Adds a blue crescent to the taskbar and when double-clicked displays an adult-content web-site. Also known to drop your internet connection and dial an international telephone number. See here for more information. Must be disabled in MSCONFIG before un-installing or it re-instates itself Source=Paul Collins Startup list [SiS KHooker] Confirmed=N Filename=khooker.exe Description=SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required Source=Paul Collins Startup list [SiS Trayorsistray] Confirmed=U Filename=sistray.exe Description=System Tray icon for SiS based graphics. Note - this resides in C:\\Windows\\System Source=Paul Collins Startup list [SISAM10M] Confirmed=? Filename=SISAM10M.exe Description=?? Source=Paul Collins Startup list [SiSAudio] Confirmed=N Filename=MP_S3.exe Description=WinME patch for an older SiS 961 chipset FERR bug. Enable if you have audio problems Source=Paul Collins Startup list [siscolor] Confirmed=U Filename=color.exe Description=Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable the on-board Source=Paul Collins Startup list [siService.exe] Confirmed=U Filename=siService.exe Description=Spam Inspector - anti email spam software Source=Paul Collins Startup list [SiSSetCDfmt] Confirmed=? Filename=SiSSetCDfmt.exe Description=Related to a Silicon Integrated Systems Corp (SiS) product? Source=Paul Collins Startup list [SISSoundman] Confirmed=? Filename=Soundman.exe Description=Related to a Silicon Integrated Systems Corp (SiS) product? Source=Paul Collins Startup list [SiSSWLED] Confirmed=U Filename=sisswled.exe Description=System Tray utility for SiS 900 network cards Source=Paul Collins Startup list [sistrai.exe] Confirmed=X Filename=sistrai.exe Description=Added as a result of the PROVA VIRUS! Source=Paul Collins Startup list [sistray] Confirmed=X Filename=sistray.exe Description=Added as a result of the PROVA VIRUS! Note - this resides in C:\\Windows\\Command Source=Paul Collins Startup list [sistry] Confirmed=X Filename=sistry.exe Description=Added as a result of the CEBE VIRUS! Source=Paul Collins Startup list [SiSUSBRG] Confirmed=? Filename=SiSUSBrg.exe Description=SiS USB Registry Patch File - fixes the undetectable problem with SiS USB controller on Windows XP. Why is it in the startups though? Source=Paul Collins Startup list [SK9910DM] Confirmed=U Filename=SK9910DM.EXE Description=Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [SKDAEMON] Confirmed=U Filename=SKDAEMON.EXE Description=Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys Source=Paul Collins Startup list [skinkers] Confirmed=N Filename=skinkers.exe Description=Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's "Desktop Ozzy" and Arsenal's "Desktop Wenger" - see here Source=Paul Collins Startup list [SkyBlaster Scheduler] Confirmed=Y Filename=SSFSch.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [Skype] Confirmed=N Filename=Skype.exe Description="Skype is free and simple software that will enable you to make free calls anywhere in the world in minutes" Source=Paul Collins Startup list [SkySurfer Management Service] Confirmed=Y Filename=SmaServ.exe Description=For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system Source=Paul Collins Startup list [SleepManager] Confirmed=N Filename=SleepMgr.exe Description=This program locates free contiguous disk spaces and allocates them for storing BASE MEMORY, EXTENDED MEMORY, VIDEO MEMORY, and SM RAM. It helps the computer come out of hibernate mode Source=Paul Collins Startup list [SlickRun] Confirmed=U Filename=sr.exe Description="SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords), so C:\\Program Files\\Outlook Express\\msimn.exe becomes MAIL" Source=Paul Collins Startup list [slide] Confirmed=X Filename=Iexplore.exe Description=Added as a result of the GASLIDE VIRUS! Note - this is not the valid Internet Explorer file "iexplore.exe" Source=Paul Collins Startup list [slimp3] Confirmed=N Filename=SliMP3 Server.exe Description=Slimp3 Server - "presents an entirely new way of accessing and enjoying your music collection. Instead of storing your music on CDs or memory cards, the SliMP3 uses your home network to access the music stored on your PC" Source=Paul Collins Startup list [Slingshot] Confirmed=N Filename=SLINGS~1.EXE Description=Atomica Slingshot - "reference tool with access to dictionary and encyclopedia terms, bios, technical terms, history, geography, and much more" Source=Paul Collins Startup list [slmss] Confirmed=X Filename=slmss.exe Description=SeekSeek search hijacker related - as seen here Source=Paul Collins Startup list [SM1BG] Confirmed=? Filename=SM1BG.EXE Description=USB driver for downloading from within Napster to portable MP3 players. Is it required to run at startup or can it be run manually? Source=Paul Collins Startup list [Sm56acl] Confirmed=N Filename=sm56hlpr.exe Description=Helper utility for Motorola based SM56 software modems - resides in the System Tray Source=Paul Collins Startup list [Smapp] Confirmed=N Filename=smtray.exe Description=System Tray access for the Compaq/ADI SoundMAX integrated digital audio controller Source=Paul Collins Startup list [Smart Card Service] Confirmed=N Filename=ScardSvr.exe Description=For Smart Card readers. Known to cause problems, especially for Windows 2000 users - see here. Probably not required unless you use such a device regularly Source=Paul Collins Startup list [Smart Connect Monitor] Confirmed=U Filename=SCMon.exe Description=Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio Source=Paul Collins Startup list [Smart Connect Setup] Confirmed=U Filename=SCSetup.exe Description=Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio Source=Paul Collins Startup list [Smart Label O Server] Confirmed=N Filename=ssloserv.exe Description=Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Source=Paul Collins Startup list [Smart Label RFViewer] Confirmed=N Filename=SSLFVIEW.EXE Description=Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely Source=Paul Collins Startup list [Smart Type Assistant] Confirmed=N Filename=sta.exe Description=Smart Type Assistant - a complex typing automation tool, intended to make your work faster and safer Source=Paul Collins Startup list [Smartalec] Confirmed=U Filename=pcaccel.exe Description=Smartalec PC Accelerator - system optimization utility Source=Paul Collins Startup list [sMaRTcaPs] Confirmed=N Filename=SMARTC~1.EXE Description=sMaRTcaPs from Phoebus LLC - enables you to configure the time needed to depress Caps Lock, Num Lock & Insert keys Source=Paul Collins Startup list [Smarthruengine] Confirmed=? Filename=QS.exe Description=Unknown but disabled without problems Source=Paul Collins Startup list [SmartPCXL] Confirmed=U Filename=pcaccel.exe Description=Smartalec PC Accelerator - system optimization utility Source=Paul Collins Startup list [SMax4] Confirmed=N Filename=SMax4.exe Description=System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel Source=Paul Collins Startup list [SMax4PNP] Confirmed=U Filename=SMax4PNP.exe Description=SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments Source=Paul Collins Startup list [smbdpmi] Confirmed=? Filename=smbdpmi.exe Description=IBM Netfinity Director and Universal Management Services related. What does it do and is it required? Source=Paul Collins Startup list [smcorSMC ServiceorSmcServices] Confirmed=Y Filename=smc.exespfsmc.exe Description=Sygate Firewall Source=Paul Collins Startup list [Smcsta.exe] Confirmed=? Filename=Smcsta.exe Description=SMC Networks wireless PCI card driver. Is it required? Source=Paul Collins Startup list [Smith Micro try] Confirmed=N Filename=smiptray.exe Description=Smith Micro shared files. Comes with D-Link web cam Source=Paul Collins Startup list [SMS Application Launcher] Confirmed=U Filename=LAUNCH32.EXE Description=Microsoft Systems Management Server - used to manage computers on a network remotely Source=Paul Collins Startup list [SMS Client Service] Confirmed=U Filename=clisvc95.exe Description=When the SMS Client service starts on a domain controller, the Client service modifies the SMSCliToknAcct & user account group membership, user rights, and account comment. The Client service then waits for the synchronization of the comment to verify that the account and user rights are properly set for this account. This account is used to obtain a token to start the SMS Client processes, such as the Software Inventory and Software Distribution agents (MS Systems Management Server) Source=Paul Collins Startup list [SMS Win9x Message Agent] Confirmed=U Filename=?? Description=This program assigns a user to a Systems Management Server site Source=Paul Collins Startup list [Smserial] Confirmed=Y Filename=sm56hlpr.exe Description=Motorola based modem driver Source=Paul Collins Startup list [SMSI Loader] Confirmed=N Filename=SMLoader.exe Description=Smith Micro HotFax - fax software Source=Paul Collins Startup list [SMSS] Confirmed=X Filename=smss.exe Description=Added as a result of the FLOOD.F VIRUS! Note - this is not the legitimate Smss.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [smss] Confirmed=X Filename= Description=Added as a result of the ALADINZ.F VIRUS! Note - this is not the legitimate Smss.exe system file should normally NOT figure in Msconfig/Startup! Source=Paul Collins Startup list [smsys] Confirmed=X Filename=Explorer.exe Description=Added as a result of the CLICKER-C VIRUS! Note - the valid "explorer.exe" is located in C:\\Windows or C:\\Winnt whereas this one is located in a C:\\Windows\\Template or C:\\Winnt\\Template subdirectory Source=Paul Collins Startup list [smsys] Confirmed=X Filename=vi.exe Description=Adult content dialler Source=Paul Collins Startup list [SMToolbar] Confirmed=N Filename=SMToolbar.exe Description=StartMake.com toolbar Source=Paul Collins Startup list [SmWizard] Confirmed=? Filename=SmWizard.exe Description=SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherbaords. What does it do and is it required? Source=Paul Collins Startup list [snbr] Confirmed=? Filename=snbr.exe Description=?? Source=Paul Collins Startup list [sncntr] Confirmed=X Filename=sncntr.exe Description=Adult content dialler Source=Paul Collins Startup list [Sndcompat] Confirmed=X Filename=Sndcompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Sndsaver] Confirmed=X Filename=Sndsaver.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Snsicon] Confirmed=N Filename=Snsicon.exe Description=Launches a screensaver program from Second Nature Source=Paul Collins Startup list [SO5 Integrator Pass One] Confirmed=? Filename=sointgr.exe Description=StarOffice 5. See here for more details Source=Paul Collins Startup list [SO5 Integrator Pass Two] Confirmed=? Filename=sointgr.exe Description=StarOffice 5. See here for more details Source=Paul Collins Startup list [Soar] Confirmed=X Filename=Rwon.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [Sock32] Confirmed=X Filename=sock32.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [SoDA Startup] Confirmed=Y Filename=SodaStartup.exe Description=Used by the Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software Source=Paul Collins Startup list [soffice] Confirmed=N Filename=SOFFICE.EXE Description=Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory). Source=Paul Collins Startup list [SOFTinst] Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Solo Sentry] Confirmed=Y Filename=Solosent.exe Description=Solo Antivirus Source=Paul Collins Startup list [SoloSchedule] Confirmed=U Filename=Solocfg.exe Description=Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis Source=Paul Collins Startup list [somatic] Confirmed=X Filename=somatic.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [Sonic A3D Control] Confirmed=N Filename=vrtxctrl.exe Description=Sound related options Source=Paul Collins Startup list [SoniqueQuickStart] Confirmed=N Filename=sqstart.exe Description=Quickstart for Sonique audio player. Available via Start -> Programs Source=Paul Collins Startup list [SonnReg] Confirmed=? Filename=SonnReg.exe Description=Part of E-Color 3Deep for color calibration. Possibly a registration reminder? Source=Paul Collins Startup list [Soot] Confirmed=? Filename=rcea.exe Description=?? Source=Paul Collins Startup list [sophagnt] Confirmed=? Filename=sophagnt.exe Description=Possibly related to Sophocles Screenwriting Software? Source=Paul Collins Startup list [SoSyncMonitor] Confirmed=? Filename=SoSyncMonitor.exe Description=SuperOffice related. What does it do and is it required? Source=Paul Collins Startup list [SoundFusion] Confirmed=? Filename=rundll32 cwcprops.cpl Description=Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? Source=Paul Collins Startup list [SoundFusion] Confirmed=? Filename=rundll32 hercplgs.cpl, BootEntryPoint Description=Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time? Source=Paul Collins Startup list [soundman] Confirmed=N Filename=soundman.exe Description=System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel Source=Paul Collins Startup list [Soundmx] Confirmed=X Filename=Soundmx.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [SourcePath] Confirmed=N Filename=gwreg.exe Description=Used to update Gateway registry settings for System Restoration Kit and Web update programs Source=Paul Collins Startup list [sp] Confirmed=X Filename=sp.reg Description=IE search hijacker - changes the default search to http://www.gocybersearch.com/ Source=Paul Collins Startup list [sp] Confirmed=X Filename=regedit-s .... sp.dll Description=Malicious javascript annoyance that changes the default search engine in IE to one of many including "topsearcher". See here for more and a fix Source=Paul Collins Startup list [SP00LSV] Confirmed=X Filename=Sp00lsv.exe Description=Added as a result of the GRAYBIRD.E VIRUS! Source=Paul Collins Startup list [SpamPal] Confirmed=U Filename=spampal.exe Description=SpamPal - anti-spam tool Source=Paul Collins Startup list [Spdstart] Confirmed=N Filename=Spdstart.exe Description=Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications, such as Word and Excel." Source=Paul Collins Startup list [Speaking Clock Deluxe] Confirmed=U Filename=SpClDlx.exe Description=Speaking Clock Deluxe - turns your computer into a speaking clock with several languages. It can also keep track of up to 50 alarms that can be set to a time and a date, and be repeated daily, weekly, monthly and yearly Source=Paul Collins Startup list [Speed racer] Confirmed=N Filename=CTSRReg.exe Description=Software for a Creative sound card Source=Paul Collins Startup list [Speed Tec] Confirmed=U Filename=speedtec.exe Description=Accel SpeedTec from Montana Software speeds up your modem. SpeedTec modifies the Internet Protocol settings in the Windows registry to speed downloads on all modems. If you find this improves your connectivity and download speeds leave this enabled Source=Paul Collins Startup list [SpeedBoss] Confirmed=X Filename= Description=Added as a result of the OPASERV.AD VIRUS! Source=Paul Collins Startup list [Speedkey] Confirmed=U Filename=SPEEDKEY.EXE Description=Additional keyboard shortcuts on MS programmable keyboard Source=Paul Collins Startup list [SpeedMeter] Confirmed=U Filename=SpeedMeter.exe Description=Application measuring upload and download speed Source=Paul Collins Startup list [Speedtouch USB Diagnostics] Confirmed=U Filename=Dragdiag.exe Description=For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line) Source=Paul Collins Startup list [Spees1] Confirmed=X Filename=speedy.scr Description=Added as a result of the OPASERV.Y VIRUS! Source=Paul Collins Startup list [Spees2] Confirmed=X Filename=Speedy.bat Description=Added as a result of the OPASERV.AD VIRUS! Source=Paul Collins Startup list [Spees3] Confirmed=X Filename=SPEEDY.PIF Description=Added as a result of the OPASERV.AD VIRUS! Source=Paul Collins Startup list [Spellex Anywhere] Confirmed=N Filename=sa.exe Description=Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used Source=Paul Collins Startup list [SpIDerMail] Confirmed=Y Filename=spiderml.exe Description=DrWeb antivirus Spider Mail e-mail scanner Source=Paul Collins Startup list [Spinner Plus] Confirmed=N Filename=spinner.exe Description="Spinner Plus lets you listen to over 100 channels of music broadcast from Spinner.com. Spinner Plus uses RealNetwork's G2 technology to provide high-quality online audio. The technology adjusts the audio streaming to match your Internet connection speed, which helps eliminate sound distortion or choppiness". Available via Start -> Programs Source=Paul Collins Startup list [Spool lptt01orSpool ml097e] Confirmed=X Filename=spool.exe Description=Variant of the RapidBlaster parasite (in a "spool" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Spooler Service] Confirmed=X Filename=Spoolsrv.exe Description=Added as a result of the JOINER.C1 VIRUS! Source=Paul Collins Startup list [Spooler Sub System Process] Confirmed=X Filename=SPOOL32.EXE Description=Added as a result of the YAB.A VIRUS! Source=Paul Collins Startup list [Spooler Subsytem App] Confirmed=X Filename=spoolsvc.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [SpoolerSubSystemProcess] Confirmed=X Filename=SpooI32.exe Description=Added as a result of the SPY.EHKS.21 VIRUS! Note - the "I" between "o" and "3" is a captial "i" not a lower case "L" Source=Paul Collins Startup list [Spoolsv] Confirmed=X Filename=Spoolsv.exe Description=Added as a result of the CIADOOR.121 VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file Source=Paul Collins Startup list [spoolsvv] Confirmed=X Filename=spoolsvv.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [SPP] Confirmed=? Filename=run.exe Description=?? Source=Paul Collins Startup list [spp] Confirmed=X Filename=regedit -s spp.reg Description=IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/ Source=Paul Collins Startup list [sppbridge] Confirmed=? Filename=sppbridge.exe Description=Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? Source=Paul Collins Startup list [SprintPort] Confirmed=? Filename=SprintPortA.exe Description=Novatel wireless modem related. What does it do and is it required? Source=Paul Collins Startup list [SPSTEALT] Confirmed=U Filename=SmartProtectorPro.exe Description=Smart Protector Pro - internet privacy tool that erases tracks, MRU lists, etc Source=Paul Collins Startup list [Spy Blocker] Confirmed=U Filename=spyblocker.exe Description=SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all Source=Paul Collins Startup list [SpyBlast] Confirmed=X Filename=SpyBlast.exe Description=Spyware killer that is in effect autoinstalled foistware, targeted by SpyBot, among others Source=Paul Collins Startup list [SpyBotSnD] Confirmed=U Filename=Spybotsd.exe Description=Spybot - Search & Destroy - free multi-spyware removal tool from Patrick Kolla Source=Paul Collins Startup list [Spybott lptt01orSpybott ml097e] Confirmed=X Filename=spybott.exe Description=Variant of the RapidBlaster parasite (in a "Spybott" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [SpyCop ScanCheck] Confirmed=U Filename=MAIN.EXE Description=SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan Source=Paul Collins Startup list [SpyHunter] Confirmed=U Filename=SpyHunter.exe Description=SpyHunter - spyware detection and removal Source=Paul Collins Startup list [Spykiller] Confirmed=U Filename=Spykiller.exe Description=Shareware "Spyware remover" of questionable quality and repute. There are better alternatives that are freeware to boot Source=Paul Collins Startup list [SpyNuker] Confirmed=X Filename=Spynuker.exe Description=A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-mail marketers �TrekData� and �Blue Haven Media�, who distribute spyware through ActiveX drive-by-download on web pages Source=Paul Collins Startup list [SpyStopper] Confirmed=U Filename=spystopper.exe Description=SpyStopper - blocks intrusive spyware, Web bugs, worms, scripts, advertisements, and cookies. Protects you from being profiled and tracked Source=Paul Collins Startup list [SpySweeper] Confirmed=U Filename=SpySweeper.exe Description=Spy Sweeper - detects and removes spyware Source=Paul Collins Startup list [Spyware] Confirmed=X Filename=Spyware.exe Description=

BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! Source=Paul Collins Startup list [Spyware Guard Control Panel] Confirmed=U Filename=spywar~1.exe Description=

"SpywareGuard provides a real-time protection solution against spyware" Source=Paul Collins Startup list [Spyware Nuker Installer] Confirmed=X Filename=SpywareNukerInstaller.exe Description=

A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-mail marketers �TrekData� and �Blue Haven Media�, who distribute spyware through ActiveX drive-by-download on web pages Source=Paul Collins Startup list [Spyware Scanner] Confirmed=U Filename=AseScanner.exe Description=

Spyware Eliminator - Aluria Software's multi-spyware removal tool Source=Paul Collins Startup list [SpywareGuard] Confirmed=U Filename=sgmain.exe Description=

"SpywareGuard provides a real-time protection solution against spyware" Source=Paul Collins Startup list [Spywareguard lptt01orSpywareguard ml097e] Confirmed=X Filename=Spywareguard.exe Description=Variant of the RapidBlaster parasite (in a "Spyguard" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [SPYWATCH] Confirmed=U Filename=SpyWatch.exe Description=

BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys! Source=Paul Collins Startup list [SQConfigChecker] Confirmed=X Filename=cc.exe Description=Xupiter SQWire variant - adware and homepage hijacker. Note - cannot be removed via the Xupiter website in the same way as other Xupiter variants Source=Paul Collins Startup list [SQInstaller] Confirmed=X Filename=SQInstaller.exe Description=Xupiter hijacker Source=Paul Collins Startup list [SQL Server] Confirmed=N Filename=scm.exe Description=SQL Server Service Control Manager. Available via Start -> Programs Source=Paul Collins Startup list [SQUpdatesChecker] Confirmed=X Filename=uc.exe Description=Xupiter SQWire variant - adware and homepage hijacker. Note - cannot be removed via the Xupiter website in the same way as other Xupiter variants Source=Paul Collins Startup list [sr1exe] Confirmed=? Filename=updtSup3.exe Description=Found on a Dell computer, in a Documents and Settings\All Users\Application Data\Dell\Alert2 subfolder Source=Paul Collins Startup list [Srmclean] Confirmed=U Filename=srmclean.exe Description=Srmclean helps in the installation and execution of the SoundMax SoftPaq for Compaq/ADI SoundMax Integrated Digital Audio. According to Compaq - "If you disable the entry from loading into startup, then you will not be able to use the features of the sound card" Source=Paul Collins Startup list [SRNG] Confirmed=X Filename=srng.exe Description=Search hijacker - see here Source=Paul Collins Startup list [SRP Startup] Confirmed=U Filename=srrpro.exe Description=System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium "features." This is enabled if you tick the "Remove unnecessary System Restore information on startup" box. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [SRS Applet] Confirmed=Y Filename=SrsTray.Exe Description=S3 Sonic Vibes sound card drivers - if disabled you loose sound Source=Paul Collins Startup list [Srv32] Confirmed=X Filename=Srv32.exe Description=Added as a result of the OPASERV.J VIRUS! Source=Paul Collins Startup list [Srv32] Confirmed=X Filename=Srv32.exe Description=Added as a result of the OPASERV.S VIRUS! Source=Paul Collins Startup list [Srv32Old] Confirmed=X Filename=.PIF Description=Added as a result of the OPASERV.J VIRUS! where <filename> is the original worm name Source=Paul Collins Startup list [Srv32Win] Confirmed=U Filename=SpyAgent4.exe Description=SpyAgent - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [Srv32Win] Confirmed=U Filename=Svchost.exe Description=Realtime-Spy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove Source=Paul Collins Startup list [Ssd] Confirmed=Y Filename=Std.exe Description=Stealthdisk - file and folder hiding/locking utility Source=Paul Collins Startup list [ssdiag] Confirmed=? Filename=ssdiag.exe Description=Equinox "Configuration and DOS Diagnostic for DOS and Windows platforms" Source=Paul Collins Startup list [SSDPSRV] Confirmed=N Filename=ssdpsrv.exe Description=Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program, open Add/Remove Programs, select either Communications (Me) or Networking Services (XP), and remove the checkmark next to Universal Plug and Play Source=Paul Collins Startup list [ssgrate.exe] Confirmed=X Filename=system.exe Description=Added as a result of the MITGLIEDER.C VIRUS! Source=Paul Collins Startup list [SSK Service] Confirmed=X Filename=winssk32.exe Description=Added as a result of the SOBIG.E VIRUS! Source=Paul Collins Startup list [SSL] Confirmed=X Filename=svchost.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [ssmmgr] Confirmed=U Filename=ssmmgr.exe Description=Samsung printer monitor - for checking ink levels, etc. Source=Paul Collins Startup list [sstray] Confirmed=N Filename=sstray.exe Description=nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys Source=Paul Collins Startup list [SSUpdate] Confirmed=X Filename=SSUpdate.exe Description=DyFuCa/MoneyTree parasite variant Source=Paul Collins Startup list [ssvchost] Confirmed=X Filename=ssvchost.exe Description=Added as a result of the HELIOS.B VIRUS! Source=Paul Collins Startup list [Start] Confirmed=Y Filename=Quick95.exe Description=For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone Source=Paul Collins Startup list [Start] Confirmed=X Filename=windows.vbs Description=Homepage hijacker Source=Paul Collins Startup list [start] Confirmed=? Filename=start.exe Description=?? Source=Paul Collins Startup list [Start Getright] Confirmed=N Filename=getright.exe Description=See Getright Tray Icon Source=Paul Collins Startup list [Start Up Cop] Confirmed=U Filename=startcop.exe Description=StartUp Cop - startup manager Source=Paul Collins Startup list [Start Wingman Profiler] Confirmed=N Filename=lwtest.exelwemon.exe Description=Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer, it's best to leave it unchecked Source=Paul Collins Startup list [Startacc] Confirmed=U Filename=startacc.exe Description=Launches Webroot's Accelerate 2000 software that "speeds up your Internet connection by up to 300%". Leave enabled if you find it improves internet connection Source=Paul Collins Startup list [StartEAK] Confirmed=Y Filename=StartEAK.exe Description=Easy Access Button Support for Compaq PCs. Required if you use these Source=Paul Collins Startup list [startl.exe] Confirmed=N Filename=startl.exe Description=Lingocom LingoWare - translates any application into your language Source=Paul Collins Startup list [startpage] Confirmed=X Filename=startpage.exe Description=Browser hijacker - redirecting to pages2start.com Source=Paul Collins Startup list [StartStop] Confirmed=U Filename=STARTSTOP.EXE Description=StartStop from TFI Technology - startup manager Source=Paul Collins Startup list [StartSurfing] Confirmed=U Filename=STARTS.exe Description=Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Windows, Mouse Traps, Window Resizing, and scripts that attempt to record your personal information. Available via Start -> Programs Source=Paul Collins Startup list [Startup] Confirmed=N Filename=?? Description=Related to an Iomega drive Source=Paul Collins Startup list [Startup Launcher GUI] Confirmed=? Filename=GUI.exe Description=Startup manager? Source=Paul Collins Startup list [Startup Update] Confirmed=X Filename=Cvshost.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [StartupMonitor] Confirmed=U Filename=StartupMonitor.exe Description=Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu Source=Paul Collins Startup list [startwindowskeyuser] Confirmed=X Filename=rundle2.exe Description=Added as a result of the JAVAKILLER VIRUS! Source=Paul Collins Startup list [Stat 'n' Perf] Confirmed=N Filename=StatnPerf.exe Description=Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes Source=Paul Collins Startup list [StatBar] Confirmed=X Filename=STATBAR.exe Description=StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory, CPU, uptime, and much more). Due to the sheer number of resources (over 60%) consumed by this program, it is unsuitable for Windows 95/98/SE/Me Source=Paul Collins Startup list [Status Monitor XE] Confirmed=N Filename=ENGSS.EXE Description=The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs Source=Paul Collins Startup list [Stay Connected!] Confirmed=N Filename=StayCon.exe Description=More than just a pinger, actually simulates online activity. Supports AOL, NetZero, MSN, ATT WorldNet, CompuServe and many other ISPs as well. Available via Start -> Programs Source=Paul Collins Startup list [StayAlive] Confirmed=U Filename=sa.exe Description=StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work." Source=Paul Collins Startup list [STBVision] Confirmed=? Filename=STBVisn.exe Description=Related to the STB Velocity graphics card. What does it do and is it required? Source=Paul Collins Startup list [STBWEBTV] Confirmed=N Filename=STBWEBTV.EXE Description=Used to display TV on your PC Source=Paul Collins Startup list [stcloaderorSTCLOA~1] Confirmed=X Filename=stcloader.exeSTCLOA~1.exe Description=Popup adware by 2ndThought software Source=Paul Collins Startup list [STCPO] Confirmed=Y Filename=STCPO.exe Description=Sophos Sweep antivirus software Source=Paul Collins Startup list [Stealth Anonymizer 2.5] Confirmed=U Filename=stealth25.exe Description=Now named Stealther - proxy server agent that lets you travel the Internet with maximum possible privacy Source=Paul Collins Startup list [Steam] Confirmed=N Filename=Steam.exe Description=Program used for the game Half-Life. Valve (Half-Life creator) made it to test update and patches of the game as well as other games. Can be started manually Source=Paul Collins Startup list [Stickies] Confirmed=N Filename=STICKIES.EXE Description=Stickies - utility that allows you to put yellow "Post-It" type messages on your desktop and can be used to set reminders. Available via Start -> Programs Source=Paul Collins Startup list [StickyNote] Confirmed=N Filename=StickyNote.exe Description=Utility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs Source=Paul Collins Startup list [StillImageMonitor] Confirmed=U Filename=Stimon.exe Description=Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners Source=Paul Collins Startup list [stlbdist] Confirmed=X Filename=rundll32exe stlbdist.DLL, DllRunMain Description=Hijacker pointing to www.searchandclick.com Source=Paul Collins Startup list [stlbupdt] Confirmed=X Filename=rundll32.exe stlbupdt.DLL, DllRunMain Description=BrowserAid/Startium parasite Source=Paul Collins Startup list [StorageGuard] Confirmed=U Filename=sgtray.exe Description=StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups Source=Paul Collins Startup list [STPMGR] Confirmed=? Filename=STPMGR.EXE Description=Part of SafeTP which is transparent FTP security software. Does it need to be running permanently or can it be started manually via Start -> Programs Source=Paul Collins Startup list [Strng32] Confirmed=X Filename=strngbox.exe Description=Added as a result of the STRANO VIRUS! Source=Paul Collins Startup list [StyleXP] Confirmed=U Filename=StyleXP.exe Description=StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot, therefore uninstall it if you don't want it Source=Paul Collins Startup list [Subtract the Ads] Confirmed=N Filename=AdSub.exe Description=Removes adverts from web pages. Although useful - not required Source=Paul Collins Startup list [SULFNBJ.EXE] Confirmed=X Filename=SULFNBJ.EXE Description=Left as the result of being infected by the PE_MAGISTR.DAM virus. This virus infects system files and renames them (changing one letter) before adding them to the Run keys in the registry. Once the virus is removed via anti-virus software, delete the infected file and remove the key from the registry Source=Paul Collins Startup list [SunJavaUpdateSched] Confirmed=N Filename=jusched.exe Description=Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel Source=Paul Collins Startup list [Sunkist] Confirmed=U Filename=shwicon98.exe Description=Card reader for memory cards from digital cameras, etc Source=Paul Collins Startup list [Sunkist2k] Confirmed=U Filename=shwicon2k.exe Description=Card reader for memory cards from digital cameras, etc Source=Paul Collins Startup list [Supastatus] Confirmed=N Filename=status.exe Description=Supanet ISP software Source=Paul Collins Startup list [Supercleaner] Confirmed=U Filename=Supercleaner.exe Description=Supercleaner - all in one disk cleaner for your computer Source=Paul Collins Startup list [SuperCool Compress Backup] Confirmed=U Filename=Main.exe Description="SuperCool Zip Backup software is a data backup,restore and file synchronization program" Source=Paul Collins Startup list [Supernova] Confirmed=X Filename=.exe Description=Added as a result of the SURNOVA (or SUPOVA) VIRUS! <filename>.exe is the chosen name Source=Paul Collins Startup list [superslut] Confirmed=X Filename=msslut32.exe Description=Added as a result of the SLUTER-A VIRUS! Source=Paul Collins Startup list [supporter5] Confirmed=X Filename=supporter5.exe Description=Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the web-site is dead Source=Paul Collins Startup list [Sureshotpopupkiller] Confirmed=U Filename=Stopthepop.exe Description=Stop-the-Pop-Up popup blocker Source=Paul Collins Startup list [SurfChoice] Confirmed=U Filename=SCMan.exe Description=SCMan is a utility that can control services on WinNT from the command line. This utility can create, start, pause, stop, delete services. Furthermore it can retrieve a service's current state, get the displayname for a service and vice versa Source=Paul Collins Startup list [Surfer lptt01orSurfer ml097e] Confirmed=X Filename=surfer.exe Description=Variant of the RapidBlaster parasite (in a "mssurfer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [SurfSecret] Confirmed=U Filename=ss2-full.exe Description="House-cleaning utility that enables you to keep your computer usage to yourself. Runs quietly from the system tray, eliminating tell-tale files at a regular interval of your choosing. You can set it to clear your Internet cache files, cookies, history, temp folder, etc. It can also clear the history of your Run and Find menus, in addition to the AOL cache" Source=Paul Collins Startup list [Susp] Confirmed=X Filename=Susp.exe Description=Transponder based malware by abetterinternet.com Source=Paul Collins Startup list [Sustem] Confirmed=X Filename=explorer.exe Description=Undentified VIRUS! Source=Paul Collins Startup list [SustemUpdate] Confirmed=X Filename=explorer.exe Description=Undentified VIRUS! Source=Paul Collins Startup list [SVA Player] Confirmed=X Filename=SVAplayer.exe Description=QuickFlicks Streaming Player - regarded as spyware. See here for details of how to disable or uninstall it Source=Paul Collins Startup list [Svc] Confirmed=X Filename=svc.exe Description=Hijacker, Clientman parasite variant, redirecting to madfinder.com. Detected by Symantec as the MADFIND VIRUS! Source=Paul Collins Startup list [SVC Service] Confirmed=X Filename=svcinit.exe Description=Added as a result of the SINIT VIRUS! Source=Paul Collins Startup list [SVC Service] Confirmed=X Filename=svcinit.exesvcpack.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [SVC Socks] Confirmed=X Filename=mstaskm.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [Svced] Confirmed=X Filename=Svced.exe Description=Added as a result of the DELF.F VIRUS! Source=Paul Collins Startup list [svchost] Confirmed=X Filename=Svch0st.exe Description=Added as a result of the GAYBIRD.B VIRUS!. Note - there is a number "0" in the executable filename, not a lower/upper case O. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [SVCHOST] Confirmed=X Filename=svchost.exe Description=System1060 homepage hi-jacker. Found in a WindowsSystem1060 directory. Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [svchost] Confirmed=X Filename=svchost.exe Description=Added as a result of the MORB or TARNO VIRUSES!. This is not the valid svchost.exe as described here. Located in the Windows directory, and not in Windows\\System32 Source=Paul Collins Startup list [SVCHOST] Confirmed=X Filename=mrowyekdc.exe Description=Added as a result of the GOTORM VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [svchost] Confirmed=X Filename=Svch0st.exe Description=Added as a result of the GRAYBIRD VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [svchost] Confirmed=X Filename= Description=Added as a result of the HAZZER VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [svchost] Confirmed=X Filename=ADMAGIC.EXE Description=Added as a result of the SMIBAG VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [Svchost] Confirmed=X Filename=winhost.exe Description=Added as a result of the LOLAWEB.A VIRUS!. This is not the valid svchost.exe as described here Source=Paul Collins Startup list [svchost.exe] Confirmed=X Filename=svchost32.exe Description=CoolWebSearch parasite related. Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [SvcHost32] Confirmed=X Filename=svchost32.exe Description=Added as a result of the MIMAIL.I or MIMAIL.J VIRUSES! Source=Paul Collins Startup list [svcwinprocess32] Confirmed=X Filename= Description=Added as a result of the UPERING VIRUS! Source=Paul Collins Startup list [SVM Pop] Confirmed=? Filename=svmpop.exe Description=?? Source=Paul Collins Startup list [svshost] Confirmed=X Filename=svshost.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Swap Nut] Confirmed=N Filename=javaw.exe Description=SwapNut is a peer-to-peer file sharing and searching utility developed and marketed by File Metrics, Inc. Users can search for and find almost any type of digital file (audio, video, photos etc.) through a secure peer-to-peer network Source=Paul Collins Startup list [SWCaller] Confirmed=X Filename=SWcaller.exeSwcaller2.exe Description=Homepage hijacker - see here Source=Paul Collins Startup list [SWd] Confirmed=N Filename=winwd.exe Description=PC Security from Tropical Software - lock files, password protect, etc Source=Paul Collins Startup list [Sweep95] Confirmed=Y Filename=ICLOAD95.EXE Description=Part of Sophos ant-virus sofware Source=Paul Collins Startup list [Swf32] Confirmed=X Filename=AVupdate.exe Description=Added as a result of the MERKUR VIRUS! Source=Paul Collins Startup list [Swf32] Confirmed=X Filename=_backup.exe Description=Added as a result of the SYMTEN VIRUS! Source=Paul Collins Startup list [SwimSuitNetwork] Confirmed=X Filename=SwimSuitNetwork.exe Description=Advertising spyware Source=Paul Collins Startup list [Switch Off] Confirmed=U Filename=swoff.exe Description=Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer, disconnect your current dialup connection, lock workstation, etc Source=Paul Collins Startup list [Switchboard.com Toolbar] Confirmed=N Filename=AtHoc.exe Description=Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com Source=Paul Collins Startup list [sws.exe] Confirmed=X Filename=.exe Description=Haldex type adult content dialler Source=Paul Collins Startup list [SwTray] Confirmed=N Filename=SWTRAY.EXE Description=MS SideWinder game controller system tray icon. Available via Start -> Programs. May have the version number after it Source=Paul Collins Startup list [SXGDSENU] Confirmed=? Filename=sxgdsenu.exe Description=Yamaha SXG soundcard driver Source=Paul Collins Startup list [SxgTkBar] Confirmed=? Filename=sxgtkbar.exe Description=Yamaha SXG soundcard driver Source=Paul Collins Startup list [SYDNEY] Confirmed=X Filename= Description=Added as a result of the SYNEY VIRUS! Source=Paul Collins Startup list [SyGateService] Confirmed=U Filename=sgserv95.exe Description=SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs Source=Paul Collins Startup list [Symantec Configuration Loader] Confirmed=X Filename=ccApp32.exe Description=Added as a result of a variant of the GAOBOT.GEN VIRUS! Source=Paul Collins Startup list [Symantec Core LC] Confirmed=Y Filename=symlcsvc.exe Description=Part of Norton AntiVirus 2004. What does it do? Source=Paul Collins Startup list [Symantec Fax Starter Edition Port] Confirmed=N Filename=OLFSNT40.EXE Description=Offers a virtual printer as a fax machine. Can be run via a desktop shortcut Source=Paul Collins Startup list [SymKeepAlive] Confirmed=U Filename=CKA.exe Description=Part of Norton SystemWorks 2003 - keeps a dial-up modem connection alive Source=Paul Collins Startup list [SymTray - Norton SystemWorks] Confirmed=N Filename=SYMTRAY.EXE Description=Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus, Norton Utilities and Norton CleanSweep - mentioned elsewhere here. Personally I only have Norton eMail Protect running which doesn't need SymTray Source=Paul Collins Startup list [Sync Data] Confirmed=U Filename=Hndsync.exe Description=Pocket Real Estate - mobile synchronization manager Source=Paul Collins Startup list [Sync-It] Confirmed=U Filename=Syncit.exe Description=Sync-It - synchronizes the system clock with time servers on the internet Source=Paul Collins Startup list [SyncAgent] Confirmed=U Filename=syncagent.exe Description=Ghost Keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove Source=Paul Collins Startup list [Synchronization Manager] Confirmed=N Filename=mobsync.exe Description=Find more information about its use here Source=Paul Collins Startup list [SynSetup] Confirmed=? Filename=SynTP.tmp \RunOnce.exe Description=Probably associated Synaptics touchpads on laptops as for SynTPEnh and SynTPLpr below but what does it do and is it required? Source=Paul Collins Startup list [SynTPEnh] Confirmed=U Filename=syntpenh.exe Description=Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll Source=Paul Collins Startup list [SynTPLpr] Confirmed=Y Filename=syntplpr.exe Description=Synaptics touchpad driver helper. Required for touchpad features to work Source=Paul Collins Startup list [sys] Confirmed=X Filename=regedit /s sys.reg Description=Hijacker Source=Paul Collins Startup list [SysAgent] Confirmed=U Filename=SysAgent.exe Description=SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of Source=Paul Collins Startup list [Sysbot] Confirmed=U Filename=sysbot.exe Description=Spector - spying (or monitoring) software to record internet activity Source=Paul Collins Startup list [syscfg] Confirmed=X Filename=syscfg32.exe Description=Added as a result of the KWBOT.S VIRUS! Source=Paul Collins Startup list [syscfg34.exe] Confirmed=X Filename=syscfg34.exe Description=Added as a result of the ELECTRON VIRUS! Source=Paul Collins Startup list [syscm] Confirmed=X Filename=Syscm.exe Description=Vanish adware Source=Paul Collins Startup list [SysComp] Confirmed=? Filename=mssdnl.com Description=Unknown but suspect as *.com are not usually run at start up and the name isn't recognized Source=Paul Collins Startup list [syscon lptt01orsyscon ml097e] Confirmed=X Filename=syscon.exe Description=Variant of the RapidBlaster parasite (in a "Syscon" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [sysconfig] Confirmed=X Filename=iexplorer.exe Description=Added as a result of the CULT.C VIRUS!. Note - iexplorer.exe is not to be confused with Interrnet Explorer (iexplore.exe) Source=Paul Collins Startup list [SysConfig] Confirmed=X Filename=syscfg35.exe Description=Added as a result of the KAZMOR.C VIRUS! Source=Paul Collins Startup list [sysconfig] Confirmed=X Filename=iexplorer.exe Description=Added as a result of the CULT.H VIRUS! Note - the valid "iexplorer.exe" resides in C:\\Program Files whereas this version resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) Source=Paul Collins Startup list [Syscpy] Confirmed=X Filename=Syscpy.exe Description=Firewall-bypassing, proxied spam relayer. Detected by Symantec as the HOGLE VIRUS! Source=Paul Collins Startup list [SysCtl] Confirmed=X Filename=sysctl.exe Description=Added as a result of the AOK VIRUS! Source=Paul Collins Startup list [Sysctrls] Confirmed=X Filename=procdll.exe Description=Added as a result of the WEEDBOTZ.14 VIRUS! Source=Paul Collins Startup list [sysdir] Confirmed=X Filename=winrun.exe Description=Added as a result of the WINBUR.B VIRUS! Source=Paul Collins Startup list [sysfiler] Confirmed=X Filename=sysfiler.exe Description=Added as a result of the RETSAM VIRUS! Source=Paul Collins Startup list [syshelp] Confirmed=X Filename=syshelp.exe Description=Added as a result of the LOVGATE VIRUS! Source=Paul Collins Startup list [sysinfo] Confirmed=X Filename=sysinfo.exe Description=Added as a result of the BEDRILL VIRUS! Source=Paul Collins Startup list [SysInit] Confirmed=X Filename=wininit32.exe Description=Added as a result of the XABOT VIRUS! Source=Paul Collins Startup list [Syslib] Confirmed=X Filename=Syslib.exe Description=Adult content related downloader trojan Source=Paul Collins Startup list [Syslog lptt01orSyslog ml097e] Confirmed=X Filename=Syslog.exe Description=Variant of the RapidBlaster parasite (in a "Syslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [SysMetrix] Confirmed=U Filename=SysMetrix.exe Description=SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics Source=Paul Collins Startup list [sysmon] Confirmed=X Filename=sysmon.exe Description=Added as a result of the BIZEX VIRUS! Source=Paul Collins Startup list [SysOps] Confirmed=X Filename=SysOps Description=Added as a result of the MSNCORRUPT VIRUS! Source=Paul Collins Startup list [syspath] Confirmed=X Filename=drv.exe Description=Added as a result of the SOBER VIRUS! Source=Paul Collins Startup list [sysPnP] Confirmed=X Filename=bootconf.exe Description=Homepage hijacker, redirecting to coolwwwsearch.com; see for example here Source=Paul Collins Startup list [SysPnP] Confirmed=X Filename=rundll32 setupapi, InstallHinfSection.... oemsyspnp.inf Description=Search hijacker - see here Source=Paul Collins Startup list [SysPool] Confirmed=Y Filename=Mssvc.exe Description=StealthDisk - hides folders, files and applications. Will also encrypt them for better protection Source=Paul Collins Startup list [SysProtect] Confirmed=X Filename=System.exe Description=Added as a result of the NETSPY VIRUS! Source=Paul Collins Startup list [SysR] Confirmed=X Filename=sysmd.exe Description=Adult content based "foistware" (adds hidden components to your system) Source=Paul Collins Startup list [SysReg] Confirmed=X Filename=SysReg.exe Description=Added as a result of the CCINVADER2 VIRUS! Source=Paul Collins Startup list [SysReg] Confirmed=X Filename=SysReg.exe Description=SearchSeekFind textual marketing foistware Source=Paul Collins Startup list [Sysres] Confirmed=X Filename=Sysres.exe Description=Added as a result of the LOGMOD VIRUS! Source=Paul Collins Startup list [SysScan] Confirmed=X Filename=bvt.exe Description=Added as a result of the AUTOUPDER VIRUS! Source=Paul Collins Startup list [SysService] Confirmed=X Filename=SysService.exe Description=Added as a result of the DELF family of VIRUSES! Source=Paul Collins Startup list [SysService32] Confirmed=X Filename=SysService32.exeln32k.dll Description=Added as a result of the KINDAL VIRUS! Source=Paul Collins Startup list [SysService32l] Confirmed=X Filename=systask32l.exe Description=Added as a result of the THEUG VIRUS! Source=Paul Collins Startup list [SYSsfitb] Confirmed=X Filename=SYSsfitb.exe Description=Searchforit browser hijacker Source=Paul Collins Startup list [System] Confirmed=X Filename=run322.exe Description=Added as a result of the LANFILT VIRUS! Source=Paul Collins Startup list [System] Confirmed=X Filename=system.exe Description=Added as a result of a number of VIRUSES, including CHILI, NULLBOT, FULAMER.25, NETCONTROLL, NETCONTROLL, GATECRASH.A, GATECRASH.B, NTCONTROL.A, BUSHTRO122 & VIVAEL Source=Paul Collins Startup list [system] Confirmed=X Filename=regedit -s system.dll Description=Homepage hijacker Source=Paul Collins Startup list [system] Confirmed=X Filename=systemsearch.hta Description=Jetseeker.com hijacker Source=Paul Collins Startup list [System] Confirmed=X Filename=dcomx.exe Description=Added as a result of the CIREBOT VIRUS! Source=Paul Collins Startup list [system] Confirmed=X Filename=Explorer.exe Description=Added as a result of the GRAYBIRD VIRUS! Note - this is located in this is located in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP) rather than the valid Windows Explorer which is located in C:\\Windows or C:\\Winnt Source=Paul Collins Startup list [System] Confirmed=X Filename=YPager.exe Description=Added as a result of the JUNTADOR.K VIRUS! Note! - this is not Yahoo! Messenger Source=Paul Collins Startup list [system] Confirmed=X Filename=outlook.exe Description=Added as a result of the MIMAIL.Q VIRUS! Note that Microsoft's outlook.exe resides in the Program Files sub-directory wheras this resides in C:\\Windows or C:\\Winnt Source=Paul Collins Startup list [System 64 Driver for Games] Confirmed=X Filename=sys64dvr.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [System Check] Confirmed=U Filename=Rundll32.exe SysDll32.dll, SystemCheck Description=XPCSpy Pro keylogger, surveillance and monitoring software Source=Paul Collins Startup list [System Configuration] Confirmed=X Filename=iexplore.exe Description=Added as a result of the RANDEX.AD VIRUS! Note that the real "iexplore.exe" is located in Program Files\\Internet Explorer Source=Paul Collins Startup list [System Diagnostics] Confirmed=X Filename=sysdiag32.exe Description=Added as a result of the SDBOT.GEN VIRUS! Source=Paul Collins Startup list [System DLF] Confirmed=N Filename=cpqdiaga.exe Description=Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs Source=Paul Collins Startup list [System Efficiency Monitor] Confirmed=X Filename=mscedit32.exe Description=Added as a result of the SDBOT.P VIRUS! Source=Paul Collins Startup list [System Efficiency Monitor] Confirmed=X Filename=mscommand.exe Description=Added as a result of the KWBOT.P VIRUS! Source=Paul Collins Startup list [System Executable DLL Library] Confirmed=X Filename=EXECDLL32.exe Description=Added as a result of the RANDEX.AZ VIRUS! Source=Paul Collins Startup list [System Initialization] Confirmed=X Filename=msmsgri32.exepayload.dat Description=Added as a result of the RANDEX.D or ROXY or ROXY.B VIRUSES! Source=Paul Collins Startup list [System LifeGuard Scheduler] Confirmed=U Filename=Slsched.exe Description=System LifeGuard scheduler Source=Paul Collins Startup list [System Monitor] Confirmed=U Filename=SYSMON.EXE Description=Comes with some Aopen motherboards. Monitors CPU temp, voltage and fan speed. Warns if any become abnormal Source=Paul Collins Startup list [System Monitor] Confirmed=X Filename=Sysmon16.exe Description=Added as a result of the SDBOT VIRUS! Source=Paul Collins Startup list [System MScvb] Confirmed=X Filename=mscvb32.exe Description=Added as a result of the SOBIG.C VIRUS! Source=Paul Collins Startup list [System Profile] Confirmed=X Filename=Regsrv.exe Description=Added as a result of the BDS/OPTIXPRO.12 VIRUS! Source=Paul Collins Startup list [System Service] Confirmed=X Filename=MSREXE.EXE Description=Added as a result of the AML VIRUS! Source=Paul Collins Startup list [system service] Confirmed=X Filename=spoolcrv.cpl Description=Added as a result of the INSPIR.11 VIRUS! Source=Paul Collins Startup list [System Soap Pro] Confirmed=X Filename=soap.exe Description=System Soap Pro internet cleaning software. Bundles foistware like HTTPER and Zipclix - best avoided Source=Paul Collins Startup list [System startup] Confirmed=U Filename=charmapx.exe Description=Only required if using an oriental language Source=Paul Collins Startup list [System time updator] Confirmed=X Filename=CSysTime.exe Description=Added as a result of the RANDEX.S VIRUS! Source=Paul Collins Startup list [System Toolkit] Confirmed=X Filename=Systools.exe Description=Added as a result of the RONOPER-G VIRUS! Source=Paul Collins Startup list [System Tray] Confirmed=X Filename=msccn32.exe Description=Added as a result of the PALYH.A VIRUS! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com. Note - do not confuse with the valid SystemTray above Source=Paul Collins Startup list [System Tray32] Confirmed=X Filename=SysTray32.exe Description=Added as a result of the REPAD VIRUS! Source=Paul Collins Startup list [System-Service] Confirmed=X Filename=EXPLORER.SCR Description=Added as a result of the BENJAMIN VIRUS! KaZaA file-sharing users beware! Source=Paul Collins Startup list [system.] Confirmed=X Filename=system..exe Description=Added as a result of the OPTIXPRO.13.C VIRUS! Source=Paul Collins Startup list [system...] Confirmed=X Filename=system...exe Description=Added as a result of the OPTIXPRO.13.C VIRUS! Source=Paul Collins Startup list [System32] Confirmed=X Filename=system.exe Description=Added as a result of the BUSHTRO122 VIRUS! Source=Paul Collins Startup list [System32] Confirmed=X Filename=System32.exe Description=Added as a result of the MARI, SYSXXX and other VIRUSES! Source=Paul Collins Startup list [System33] Confirmed=X Filename=FB_PNU.EXE Description=Added as a result of the NICHELLO-A VIRUS! Source=Paul Collins Startup list [SystemAdministration] Confirmed=X Filename=Wincmp32.exe Description=Added as a result of the ASYLUM VIRUS! Source=Paul Collins Startup list [SystemAgent] Confirmed=U Filename=Sage.exe Description="Microsoft Plus! System Agent automatically tunes your system, performing tasks such as disk optimization and error correction. It can also run any application at prescheduled times" Source=Paul Collins Startup list [SystemBackup] Confirmed=X Filename=mtx.exe Description=Added as a result of the MTX VIRUS! Source=Paul Collins Startup list [SystemBackup] Confirmed=X Filename=MicroLog.exe Description=Added as a result of the MICROLOG.A VIRUS! Source=Paul Collins Startup list [SystemBoot] Confirmed=? Filename=ladies.htm Description=Unknown but sounds very suspicious?? Source=Paul Collins Startup list [SystemBoot] Confirmed=X Filename=Mshta.exe ...filename.hta Description=Adult content dialler Source=Paul Collins Startup list [SystemCheck] Confirmed=X Filename=Systemcheck.exe Description=Added as a result of the LAVITS VIRUS! Source=Paul Collins Startup list [SystemChecker] Confirmed=X Filename=Syschk.exe Description=Added as a result of the GAIL.F VIRUS! Source=Paul Collins Startup list [SystemCONF98i] Confirmed=X Filename=SystemCONF98i.exe Description=Added as a result of the FROZEN BOT VIRUS! Source=Paul Collins Startup list [SystemDebug] Confirmed=X Filename=Sysdeb32.exe Description=Added as a result of the SYSBUG VIRUS! Source=Paul Collins Startup list [SystemDll] Confirmed=X Filename=SystemDll.exe Description=Added as a result of the LOXOSCAM VIRUS! Source=Paul Collins Startup list [systemdrv] Confirmed=X Filename=ms32sys.exe Description=VIRUS related - most likely GAOBOT Source=Paul Collins Startup list [SystemEmergency] Confirmed=X Filename= Description=SmartSearch a CoolWebSearch parasite variant Source=Paul Collins Startup list [SystemExplorer] Confirmed=X Filename=explore.exe Description=Homepage hijacker - file located in the "Services" folder in Common Files Source=Paul Collins Startup list [SystemFTP] Confirmed=X Filename=VSENMB.exe Description=Malware (ie, malicious software). Also changes the system.ini Shell line to read Shell=Explorer.exe VSENMB.exe, and it hacks the Winstart.bat as well Source=Paul Collins Startup list [SystemInit] Confirmed=X Filename=iservc.exe Description=Added as a result of the FIZZER VIRUS! Source=Paul Collins Startup list [SystemLoad32] Confirmed=X Filename=sysload32.exe Description=Added as a result of the MIMAIL.E VIRUS! Source=Paul Collins Startup list [SystemManager] Confirmed=X Filename=Sysman32.exe Description=Added as a result of the DOWNLOADER-BW.B VIRUS! Source=Paul Collins Startup list [SystemMap32] Confirmed=X Filename=Netisp32.vbs Description=Added as a result of the REDIST.C VIRUS! Source=Paul Collins Startup list [SystemMD] Confirmed=X Filename=md.exe Description=Homepage hijacker Source=Paul Collins Startup list [SystemNetwork] Confirmed=X Filename=NETSERV.EXE Description=Added as a result of the NETCONTROL VIRUS! Source=Paul Collins Startup list [SystemReg] Confirmed=? Filename=PROCES.EXE Description=?? Source=Paul Collins Startup list [SystemReg] Confirmed=X Filename=svchost.exe Description=Added as a result of the DEWIN.E VIRUS! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [SystemReg] Confirmed=X Filename=WINREG.EXE Description=Added as a result of the DEWIN.A VIRUS! Source=Paul Collins Startup list [Systems.exe] Confirmed=U Filename=Systems.exe Description=Keyboard Spectator - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [SystemSafe] Confirmed=U Filename=Syssafe.exe Description=System Safety Monitor - system monitoring tool with additional application firewalling Source=Paul Collins Startup list [SYSTEMSars32] Confirmed=X Filename=csrss.exe Description=Added as a result of the AHLEM.A VIRUS! Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling Source=Paul Collins Startup list [SystemSAS] Confirmed=X Filename=System32.exe Description=Added as a result of the KWBOT.C VIRUS! Source=Paul Collins Startup list [SystemSearch] Confirmed=X Filename=regedit.exe -s c:\\ie.reg Description=Installs a Seachxl.com browser page hijack Source=Paul Collins Startup list [SystemSuite Task Manager] Confirmed=U Filename=MXTASK.EXE Description=vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro Source=Paul Collins Startup list [SystemTasks] Confirmed=X Filename=filez.exesexypicz.exeloaded.exe Description=Adult content dialler Source=Paul Collins Startup list [SystemTray] Confirmed=X Filename=SystemTray.exe Description=Added as a result of the BIGFOOT VIRUS! Note - this is not the valid SystemTray above Source=Paul Collins Startup list [SystemTrayorSysTray] Confirmed=U Filename=SysTray.Exe Description=SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [SystemUpd] Confirmed=N Filename=SystemUpd.exe Description=Updater for Swapoo.com, a kind of Napster for games Source=Paul Collins Startup list [SystemWizard Sniffer] Confirmed=U Filename=Sniffer.exe Description=SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC Source=Paul Collins Startup list [System_Messages] Confirmed=U Filename=pprsen.exe Description=TerminatorX - "offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA, messenger programs, chat rooms and the like" Source=Paul Collins Startup list [Systest] Confirmed=N Filename=Systest.exe Description=Clean Space temp files cleaner Source=Paul Collins Startup list [systhread] Confirmed=X Filename=winkernal.exe Description=Added as a result of the LIAMED VIRUS! Source=Paul Collins Startup list [Systoan32] Confirmed=X Filename=systoan.exe Description=Added as the result of an unidentified VIRUS! Source=Paul Collins Startup list [systr32] Confirmed=? Filename=systr32.exe Description=?? Source=Paul Collins Startup list [systrax] Confirmed=? Filename=systrax.exe Description=?? Source=Paul Collins Startup list [Systray] Confirmed=X Filename=Systray_.Exe Description=Added as a result of the KERGEZ.A VIRUS! Source=Paul Collins Startup list [Systry] Confirmed=X Filename= Description=Added as a result of the AUTEX VIRUS! Source=Paul Collins Startup list [Systryt] Confirmed=X Filename= Description=Added as a result of the AUTEX VIRUS! Source=Paul Collins Startup list [sysu] Confirmed=X Filename=sysu.exe Description=Dynamic Desktop Media adware - see here Source=Paul Collins Startup list [SysW8] Confirmed=U Filename=csta.exe Description=Clean Space - privacy and perfomance enhancer Source=Paul Collins Startup list [SYSWB6] Confirmed=U Filename=SYSWB6.exe Description=We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content, while filtering out sites that contain adult content Source=Paul Collins Startup list [Syswindow] Confirmed=X Filename=Syswindow.exe Description=Added as a result of the COW VIRUS! Source=Paul Collins Startup list [SYS_CLEAN] Confirmed=X Filename=Service.exe Description=Added as a result of the FLOPCOPY VIRUS! Source=Paul Collins Startup list [SZMsgSvc.exe] Confirmed=U Filename=SZMsgSvc.exe Description=StopZilla! - pop-up killer Source=Paul Collins Startup list [Taba] Confirmed=X Filename=stte.exe Description=Clickspring spyware Source=Paul Collins Startup list [Tablet] Confirmed=N Filename=Tablet.exe Description=Loads the tablet drivers for the Wacom Graphics Tablet. This can be unchecked in msconfig without problems if you don't need the tablet functional all the time. Create your own shortcut if you need to run it ad hoc. If you forget to run it before running Paint Shop Pro & Adobe Photo Shop) you may find the following: (1) Paint Shop Pro (version 7.04) - (a) Browse function will NOT work (program freezes) (b) On program exit, PSP does not terminate (you have to CTRL+ALT+DEL to close it) (2) Photo Shop (version 6.01) - (a) Program functions slowdown (d) On program exit it takes noticeably longer to shut down (like 30-45 seconds) Source=Paul Collins Startup list [TabUserW] Confirmed=Y Filename=TabUserW.exe Description=Wacom pen tablet driver Source=Paul Collins Startup list [Tad] Confirmed=N Filename=tad.exe Description=From Turtle Beach's Santa Cruz on a Dell WinME system. Not required - works fine without it including keyboard hot controls for volume and mute Source=Paul Collins Startup list [TAG] Confirmed=? Filename=tag.exe Description=?? Source=Paul Collins Startup list [Tahni Deskmate] Confirmed=N Filename=Tahni.exe Description=Tahni Deskmate - "Interactive cartoon character that lives on your Windows desktop" Source=Paul Collins Startup list [TalkingReminder] Confirmed=N Filename=TALKINGREMINDER.EXE Description=Talking Reminder from Software River Solutions - talking calendar reminder Source=Paul Collins Startup list [talknow] Confirmed=? Filename=talknow.exe Description=Could it be related to this or something similar? Source=Paul Collins Startup list [Tango] Confirmed=? Filename=Setup.exe Description=Tango Broadband access software. Is it required? Source=Paul Collins Startup list [TangoManager] Confirmed=? Filename=TangoManager.exe Description=Tango Broadband access software. Is it required? Source=Paul Collins Startup list [Tapicfg] Confirmed=X Filename=Tapicfg.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [TapiTNA] Confirmed=U Filename=TapiTNA.exe Description=Telephony Location Selector allowing mobile users to change dialling locations - part of the Win95 Power Toys Source=Paul Collins Startup list [Tardis] Confirmed=U Filename=Tardis.exe Description=Tardis - time synchronization software Source=Paul Collins Startup list [Task Bar] Confirmed=X Filename=TASKBAR.EXE Description=Added as a result of the FRETHEM.J VIRUS! Source=Paul Collins Startup list [Task BarClient] Confirmed=? Filename=TaskBarClient.exe Description=Responsible for creating the System Tray icon and associated display system for the Starband satellite always on internet service Source=Paul Collins Startup list [Task BarSvr] Confirmed=? Filename=TaskBarSvr.exe Description=Part of the Starband satellite always on internet service. Not included on the current system. What does it do and is it needed? Source=Paul Collins Startup list [Taskbar] Confirmed=N Filename=Taskbar.exe Description=Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards Source=Paul Collins Startup list [Taskbar Display Controls] Confirmed=N Filename=RunDLL deskcp16.dll, QUICKRES_RUNDLLENTRY Description=Only appears in MSCONFIG if you have a Display Settings icon in the System Tray allowing resolution changes on the fly. Can also be disabled under Control Panel -> Display -> Settings -> Advanced -> General. Also appears if you have Win95 with the QuickRes "Powertoy" installed Source=Paul Collins Startup list [TaskMan] Confirmed=X Filename=rundll32.exe Description=Added as a result of the DVLDR VIRUS! Note - this is not the valid "rundll32.exe" as it's in the Windows\\Fonts directory Source=Paul Collins Startup list [taskmanager] Confirmed=X Filename=taskmgr.com Description=Added as a result of the BEREB VIRUS! Source=Paul Collins Startup list [Taskmgr] Confirmed=X Filename=Taskmgr.exe Description=System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory Source=Paul Collins Startup list [Taskmgr] Confirmed=X Filename=tskmgr32.exe Description=Homepage hi-jacker Source=Paul Collins Startup list [taskmgr.exe] Confirmed=N Filename=taskmgr.exe Description=Windows Task Manager in Windows XP. If run from the Startup folder, the tray icon will be put to the system tray after boot. Useful to check if XP has finished running the delayed services after boot. Available via a desktop shortcut Source=Paul Collins Startup list [taskmngr lptt01ortaskmngr ml097e] Confirmed=X Filename=taskmngr.exe Description=Variant of the RapidBlaster parasite (in a "Taskmngr" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [TaskMon] Confirmed=X Filename=taskmon.exe Description=Added as a result of the MYDOOM.A VIRUS! Note - this is not the valid Win98/Me file of the same name which resides in C:\\Windows as this version resides in C:\\Windows\\System (Win9x/Me), C:\\Winnt\\System32 (WinNT/2K), or C:\\Windows\\System32 (WinXP). It is not normally on a WinXP system Source=Paul Collins Startup list [TaskMonitor] Confirmed=U Filename=taskmon.exe Description=The Task Monitor checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase) Source=Paul Collins Startup list [TaskPlus] Confirmed=N Filename=TASKPLUS0.EXETASKPL~1.EXE Description=Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN Source=Paul Collins Startup list [TaskReg] Confirmed=X Filename= Description=Added as a result of the CBLAD VIRUS! <filename.exe> is the full path and name of the infected file Source=Paul Collins Startup list [Taskschd] Confirmed=X Filename=TRAYWND.EXE Description=Added as a result of the LITMUS.002 VIRUS! Source=Paul Collins Startup list [taskswitch] Confirmed=N Filename=taskswitch.exe Description=ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen Source=Paul Collins Startup list [tasksys] Confirmed=X Filename=tasksys.vbs Description=Added as a result of the BYRON VIRUS! Source=Paul Collins Startup list [Tasktray] Confirmed=N Filename=CTLTray.exe Description=Installed with the Sound Blaster Audigy range of soundcards. Allows you to set EAX effects or equalizer settings for the Sound Blaster Audigy from a systray icon. Also allows you to launch the Taskbar via right-click -> Show Taskbar. The tasktray can be accessed via Start -> Programs -> Creative -> Sound Blaster Audigy -> Taskbar Source=Paul Collins Startup list [tat] Confirmed=X Filename=tatss.exe Description=Adware based media viewer by The Delfin Project Source=Paul Collins Startup list [Tau monitor] Confirmed=Y Filename=Taumon.exe Description="Tauscan is a powerful Trojan Horse detection and removal engine capable of catching every known type of backdoor that can threaten your system." Source=Paul Collins Startup list [TBC Pro] Confirmed=U Filename=tbcpro.exe Description=TitleBarClock Pro - displays Day, Time, Date, Month, Year, FreeMem, and FreeDriveSpace on the right side of the title bar in any main window that has the mouse or keyboard focus Source=Paul Collins Startup list [tbctray] Confirmed=N Filename=tbctray.exe Description=Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TBLFUNC] Confirmed=Y Filename=tblmouse.exe Description=Aiptek HyperPen driver Source=Paul Collins Startup list [TBPanel] Confirmed=U Filename=TBPanel.exe Description=Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TBTray] Confirmed=N Filename=tbtray.exe Description=VLSI/QSound ThunderBird PCI Control Panel. System Tray access to the settings for this and related soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TB_setup] Confirmed=? Filename=TB_ANI~1.EXE Description=?? Source=Paul Collins Startup list [TB_setup] Confirmed=X Filename=tb_setup.exe Description=HuntBar parasite toolbar installer Source=Paul Collins Startup list [tcactive] Confirmed=Y Filename=tca.exe Description=Part of The Cleaner from MooSoft - stops virus trojans before they can do any damage Source=Paul Collins Startup list [TCAUDIAG -offorTCASUTIEXE] Confirmed=N Filename=tcaudiag.exe Description=Associated with the 3COM diagnostic module (3COM NIC Doctor). No further information is available Source=Paul Collins Startup list [TCDPbtn] Confirmed=? Filename=TCDPbtn.exe Description=Found on a Toshiba laptop Source=Paul Collins Startup list [TCDPlay] Confirmed=? Filename=TCDPlay.drv Description=Found on a Toshiba laptop - sounds like the driver for the CD-ROM but why doesn't it use the standard Windows drivers - any comments? Source=Paul Collins Startup list [TClock] Confirmed=U Filename=TCLOCK.EXE Description=Kazubon TClock. Utility that amongst other things synchronizes your system clock with Internet time servers. Available via Start -> Programs Source=Paul Collins Startup list [TClockEx] Confirmed=U Filename=TCLOCKEX.EXE Description=Puts a configurable time/date display in the tray (and other features). Freeware by Dale Nurden and is popular on cover disks Source=Paul Collins Startup list [tcmonitor] Confirmed=U Filename=tcm.exe Description=Part of The Cleaner from MooSoft - warns of changes to the registry Source=Paul Collins Startup list [TDispVol] Confirmed=? Filename=TDispVol.exe Description=?? Source=Paul Collins Startup list [TDKSTART] Confirmed=U Filename=TDKSTART.EXE Description=Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. Source=Paul Collins Startup list [TDKTASK] Confirmed=N Filename=TDKTASK.EXE Description=Taskbar utility for a "control panel" for a CD-RW Source=Paul Collins Startup list [TDockNUndock] Confirmed=? Filename=N/A Description=Found on a Toshiba laptop - for use with a docking station? Source=Paul Collins Startup list [TDspOff] Confirmed=? Filename=Tdspoff.exe Description=Found on a Toshiba laptop Source=Paul Collins Startup list [Teach In Box] Confirmed=N Filename=teachbox.exe Description=Tutoring program that comes with a SystemAX Computer Source=Paul Collins Startup list [Tech-In-A-Box] Confirmed=Y Filename=techbox.exe Description=Tech-in-a-Box "provides easy-to-use tools for various system maintenance tasks. From backup and restore to diagnostics and repairs, Tech-in-a-Box is your tool to stay up and running" Source=Paul Collins Startup list [Telemeter 3.0] Confirmed=N Filename=telemeter3.exe Description=Internet connection bandwidth meter from a user ISP Source=Paul Collins Startup list [Telepath] Confirmed=Y Filename=telepath.exe Description=Drivers for the WinModem versions of the US Robotics "Telepath" series - as supplied to Gateway for instance. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [Tencent QQ] Confirmed=X Filename=Rund1132.exe qq.dll, Rundll32 Description=Added as the result of the QQPASS.F VIRUS! Source=Paul Collins Startup list [Terminate Popup] Confirmed=X Filename=FPUK.exeZPU.exe Description=Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here Source=Paul Collins Startup list [TEscKey] Confirmed=U Filename=TEscKey.exe Description=Toshiba Escape Key handler. Enables you to program and use the <FN><Esc> key combination to perform a specific function Source=Paul Collins Startup list [Tesla] Confirmed=? Filename=TESLA.EXE Description=?? Source=Paul Collins Startup list [TExBUtil Registry] Confirmed=? Filename=TExBUtil.exe Description=?? Source=Paul Collins Startup list [TextAloud] Confirmed=N Filename=TextAloudMP3.exe Description=TextAloud MP3 - convert text into spoken words and MP3s Source=Paul Collins Startup list [Textbridge Instant Access OCR] Confirmed=N Filename=telepath.exe Description=TextBridge from Scansoft. OCR (optical character recognition) software for scanning documents into popular editing applications. Available via Start -> Programs Source=Paul Collins Startup list [TFncKy] Confirmed=U Filename=TFncky.exe Description=Deals with the <Fn> - <Function> key combinations on a Toshiba laptop Source=Paul Collins Startup list [TFNF5] Confirmed=U Filename=TFNF5.exe Description=Toshiba Hotkey Utility for Display Devices. By pressing <FN> + <F5>, a window appears showing the displays that can be chosen � LCD, LCD + CRT, CRT, TV Source=Paul Collins Startup list [tfswctrl] Confirmed=Y Filename=tfswctrl.exe Description=Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones" Source=Paul Collins Startup list [TFTP###] Confirmed=X Filename=tftp### Description=Added as a result of the SPYBOT VIRUS! where # can be any number Source=Paul Collins Startup list [TFunckey] Confirmed=U Filename=TFuncKey.exe Description=Deals with the <Fn> - <Function> key combinations on a Toshiba laptop Source=Paul Collins Startup list [TgAddServer] Confirmed=N Filename=tgfix.exe Description=Software from SupportSoft (aka Support.com) provided to manufacturers (such as Sony (Vaio Support Agent) and Toshiba (Virtual Tech)) and ISPs (such as Comcast, Cox and Charter (Pipeline Support Agent)) that allows them to offer on-line support - to update drivers, fix faults, etc. Can cause a deterioration in a PC's peformance (see here). This part does the protection and "self-healing". Uninstallation is recommended by most people - especially for System Restore users (WinME/XP). If not available via Add/Remove, Charter offer some uninstallation instructions involving a registry patch that you may be able to modify for your proivder or try here Source=Paul Collins Startup list [Tgcmdortgcmdprovidersbc] Confirmed=U Filename=tgcmd.exe Description=See above. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox. Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. "tgcmdprovidersbc" is for SBC Yahoo DSL. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [TGCMG] Confirmed=N Filename=?? Description=Related to Rogers@Home, causes errors in WinSock32.dll. Not required for connection to work Source=Paul Collins Startup list [TGDC IE Plugin] Confirmed=X Filename=tgdc.exe Description=ShopForGood spyware - see here Source=Paul Collins Startup list [tgkill] Confirmed=X Filename=tgkill.exe Description=Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs Source=Paul Collins Startup list [Tgsetsite] Confirmed=U Filename=tgfix.exe Description=See TgAddserver and Tgcmd above. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the "U" recommendation Source=Paul Collins Startup list [Thdetrf] Confirmed=N Filename=thdetr32.exe Description=Appears to be related to Lycos advertising Source=Paul Collins Startup list [The Easy Bee's Hive] Confirmed=U Filename=ATCEgSvr.exe Description=The Easy Bee is a software that allows you to record Internet navigation sequences, which can include form filling and button clicking and to attach a replay schedule to each sequence Source=Paul Collins Startup list [TheMainStart] Confirmed=? Filename=N/A Description=?? Source=Paul Collins Startup list [THGuard] Confirmed=U Filename=TH_Guard.exe Description=Resident memory scanning for TrojanHunter Source=Paul Collins Startup list [This is a virus, please delete it] Confirmed=X Filename=bigbadvirus.exe Description=Added as a result of the RANDEX.F VIRUS! Source=Paul Collins Startup list [THOTKEY] Confirmed=U Filename=THotkey.exe Description=Associated with the Fn+ keys on Toshiba laptops. When disabled some keys still worked, like the one that regulates the volume of the system beep, but others didn't, like the one that immediately blackens your screen Source=Paul Collins Startup list [ThrustTSR] Confirmed=U Filename=TMTMTSR.exe Description=Thrustmaster Thrustmapper. "The Thrustmapper - t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly" Source=Paul Collins Startup list [TiADSL] Confirmed=U Filename=tidslmon.exe Description=Actiontec DSL modem. Associated with High Speed AOL DSL. Used to get line sync with the Actiontec DSL USB Modem. Available via Start -> Programs Source=Paul Collins Startup list [Tiger] Confirmed=X Filename=Shine.exe Description=Added as a result of the HAPPYLOW (or NISHE-A) VIRUS! Source=Paul Collins Startup list [Time Zone Synchronization] Confirmed=X Filename=wscript zshell.js Description=Added as a result of the NETDEX-A VIRUS! Source=Paul Collins Startup list [TimeCalendar] Confirmed=N Filename=tc.exe Description=TimeCalender - calendar reminder Source=Paul Collins Startup list [Timed Backups Manager Startup] Confirmed=N Filename=BACKTIME.EXE Description=Backup Plus - backup software Source=Paul Collins Startup list [Timemanager.exe] Confirmed=N Filename=Timemanager.exe Description=Easy to use program for recording how you spend your time, designed to help you in billing multiple clients Source=Paul Collins Startup list [TimeOnline] Confirmed=N Filename=TIMEONLINE.EXE Description=Lightman Groups's TimeOnline monitor. For dial-up users to monitor time spent on the net. Available via Start -> Programs Source=Paul Collins Startup list [TimeSink Add Client] Confirmed=X Filename=TSADBOT.EXE Description=Advertising spyware Source=Paul Collins Startup list [TimeUp] Confirmed=N Filename=Timeup.exe Description=TimeUp - internet online timer Source=Paul Collins Startup list [TINTSETP] Confirmed=N Filename=TINTSETP.EXE Description=Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word Source=Paul Collins Startup list [Tiny Personal Firewall] Confirmed=Y Filename=persfw.exe Description=Tiny Personal Firewall Source=Paul Collins Startup list [tinySpell] Confirmed=U Filename=tinyspell.exe Description=Tinyspell - "allows you to easily and quickly check the spelling of words in any Windows application. Monitors your typing on the fly, alerts you whenever it detects a misspelled word, and checks the spelling of every word you copy to the clipboard" Source=Paul Collins Startup list [TiomanExe] Confirmed=U Filename=Tioman.Exe Description=Agate Tioman - warm and hot swap removable bay device manager for IBM laptops Source=Paul Collins Startup list [Tips] Confirmed=N Filename=mousetips.exe Description=Suggests tips on using your mouse Source=Paul Collins Startup list [TiTleBarClock] Confirmed=U Filename=TiTleBarClock.exe Description=TitleBarClock displays the day/month/time and free physical RAM on the right hand side of an open window, replacing the system tray clock at startup Source=Paul Collins Startup list [Tivoli] Confirmed=N Filename=LCFEP.EXE Description=Tivoli �TME� System Tray icon - "'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally" Source=Paul Collins Startup list [TkBellExeorTkBell.Exe] Confirmed=N Filename=evntsvc.exerealsched.exetkbell.exe Description=Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched. Note that eventsvc.exe no longer appears to be in a newer version. To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK Source=Paul Collins Startup list [tkonnect] Confirmed=N Filename=TKONNECT.EXE Description=Dialer for the Tiscali internet service provider. Available as a desktop shortcut Source=Paul Collins Startup list [tlc] Confirmed=X Filename=update911.js Description=Hijacker installer Source=Paul Collins Startup list [TlcR] Confirmed=? Filename=avp.exe Description=?? Source=Paul Collins Startup list [TM Outbreak Agent] Confirmed=U Filename=TMOAgent.exe Description=Trend Micro Internet Security anti-virus software virus outbreak warnings. Notifies users of virus outbreaks and offers to update the scanner Source=Paul Collins Startup list [TMA distribution] Confirmed=U Filename=cfinst.exe Description=Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients Source=Paul Collins Startup list [tmax] Confirmed=X Filename=pupdate.exe Description=Adware pop-up generator Source=Paul Collins Startup list [tmchook] Confirmed=X Filename=tmchook.exe Description=Detected by Kaspersky as the TrojanDownloader.Win32.VB.aa VIRUS! Source=Paul Collins Startup list [TMEEJME] Confirmed=? Filename=TMEEJME.EXE Description=Found in a Toshiba\TME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMERzCtl] Confirmed=? Filename=TMERzCtl.EXE Description=Found in a Toshiba\TME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMESBS] Confirmed=U Filename=TMESBS21.exe Description=Toshiba Mobile Extension Selectable Bay Service for WinXP - support for docking stations. Not required if you don't use a docking station Source=Paul Collins Startup list [TMESBS32] Confirmed=? Filename=TMESBS32.EXE Description=Found in a Toshiba\TME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMESRV31] Confirmed=? Filename=TMESRV31.EXE Description=Found in a Toshiba\TME3 directory. Toshiba Mobile Extension related? Source=Paul Collins Startup list [TMExLogon] Confirmed=U Filename=TMESRV.EXE Description=Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station Source=Paul Collins Startup list [Tmmkb] Confirmed=? Filename=Tmmkysvr.exe Description=Toshiba multi-media keyboard software - possibly including creating keyboard shortcuts? Source=Paul Collins Startup list [TMOUSE] Confirmed=U Filename=tmouse.exe Description=Component of the Toshiba Mouse Control that allows users with an AccuPoint mouse to scroll MS-scroll-compatible documents by holding CTRL + ALT and moving the AccuPoint up or down. It also allows zooming by holding CTRL + SHIFT and moving the AccuPoint up or down. Disabling this item has no adverse effects, except disabling the scroll/zoom features of the AccuPoint Source=Paul Collins Startup list [tmproxy] Confirmed=Y Filename=tmproxy.exe Description=Trend Micro PC-cillin 2003 antivirus software Source=Paul Collins Startup list [TMTMTSR] Confirmed=N Filename=TMTMTST.exe Description=Installed with Thrustmaster game controllers. It launches the Thrustmapper utility. Not required if you install the "driver only" from Thrustmaster website Source=Paul Collins Startup list [TNTClk] Confirmed=U Filename=TNTCLK.exe Description=Overclocking program for TNT, TNT2, and other graphics cards. This program can overclock the graphics card manually after startup when needed, especially before starting a gaming session. However, for simplicity, it can be left checked to let it run once at startup to automatically overclock the graphics card. In this case, it doesn't even run in the background after doing its job Source=Paul Collins Startup list [ToADiMon.exe] Confirmed=U Filename=ToADiMon.exe Description=T-Online ISP software connection assistant Source=Paul Collins Startup list [Tommorrow] Confirmed=? Filename=tomorrow.exe Description=?? Source=Paul Collins Startup list [ToPassSrv] Confirmed=? Filename=Pktopass.exe Description=Related to Caere Pagekeeper scanning software (now taken over by Scansoft), Disabling is known to cause problems Source=Paul Collins Startup list [ToPicks Starter] Confirmed=X Filename=Idhost.exe Description=ToPicks parasite related Source=Paul Collins Startup list [topmoxie] Confirmed=X Filename=JavaRun.exe Description=Marketing software from TopMoxie Source=Paul Collins Startup list [Toshiba Fan] Confirmed=Y Filename=fan.exe Description=Toshiba untilty to keep the fan on a laptop running if they fail to detect there is too much heat Source=Paul Collins Startup list [Toshiba Key State] Confirmed=U Filename=KEYSTATE.EXE Description=Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g., Toshiba) laptops which do not have a Caps Lock indicator light. Available via Start -> Programs Source=Paul Collins Startup list [ToshibaPinger] Confirmed=N Filename=pinger.exe Description=Pinger is the resident program for Toshiba Upgrades. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any, it posts a notification. Disabling instructions here Source=Paul Collins Startup list [TOSHIBSU] Confirmed=U Filename=Toshibsu.exe Description=Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor clock rate, etc. Required if you run off battery regularly Source=Paul Collins Startup list [TosHKCW] Confirmed=U Filename=TosHKCW.exe Description=Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed) Source=Paul Collins Startup list [TosMem] Confirmed=Y Filename=tosmem.exe Description=Toshiba laptop related. Win98/Me ACPI system can not hibernate or go on standby if all of the physical memory lower than 640KB is locked. This utility allocates and locks three pages on boot and then releases them on standby/hibernation for ACPI.SYS in order to solve the above problem Source=Paul Collins Startup list [TotRecSched] Confirmed=U Filename=TotRecSched.exe Description=Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm Source=Paul Collins Startup list [Touch Manager] Confirmed=U Filename=WinLED.exe Description=Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality Source=Paul Collins Startup list [TouchED] Confirmed=U Filename=TouchED.exe Description=TouchPad On/Off Utility on a Toshiba laptop Source=Paul Collins Startup list [tour] Confirmed=N Filename=regedit ..tour.reg Description=Edits registry values to keep the WinMe tour in Task Scheduler Source=Paul Collins Startup list [Tour] Confirmed=N Filename=wincool.exe Description=Component of WinME that's annoying as hell. Pop's up a prompt to play the C:\\WINDOWS\\Application Data\\Microsoft\\INTROCONTENT.HTA that plays a full screen version of the WinME product preview Windows Media video file that cannot be stopped to my knowledge until it finishes. That prompt will keep popping up after an install/reinstall of WinME until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 minutes, and don't bother deleting that entry, Windows puts it right back. Not only should you disable it from running, you should delete the thing altogether, as it, somehow can re-enable itself. Apparently you can try setting the file to read only Source=Paul Collins Startup list [TP4EX] Confirmed=U Filename=tp4ex.exe Description=Adds accessibility options for an IBM TrackPoint Source=Paul Collins Startup list [tp4mon] Confirmed=? Filename=tp4mon.exe Description=May be IBM Thinkpad mouse/trackpoint related, if so is it required? Source=Paul Collins Startup list [tp4serv] Confirmed=U Filename=tp4serv.exe Description=Supports the "pointer stick" on Thinkpads in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [TP98TRAYorTPTRAY] Confirmed=? Filename=TP98TRAY.EXE Description=IBM Thinkpad related utility. What does it do and is it required? Source=Paul Collins Startup list [TP98UTIL] Confirmed=N Filename=TP98.EXE Description=IBM Thinkpad feature setup & configuration utility Source=Paul Collins Startup list [TpHotKey] Confirmed=U Filename=TPHKMGR.EXE Description=Activates "ThinkPad Help" when the "Thinkpad key" is pressed on an IBM ThinkPad laptop. Also activates the audio buttons (volume up/down, mute) on models such as the Thinkpad T30 Source=Paul Collins Startup list [TpKmapMn] Confirmed=U Filename=TpKmapMn.exe Description=Create Keyboard combinations for special Thinkpad buttons when using an external keyboard, e.g. "Ctrl-arrow up" for "volume up". Only required when using an external keyboard. Available via Start -> Programs Source=Paul Collins Startup list [TPP Auto Loader] Confirmed=U Filename=Tppaldr.exe Description=Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD, CD-ROM and CD-RW drives. System tray icon allowing the user to disconnect the external drive without an error message being displayed Source=Paul Collins Startup list [Tprtray] Confirmed=U Filename=Tprtray.exe Description=Displays the Power icon in the System Tray on a Toshiba laptop Source=Paul Collins Startup list [TPTray] Confirmed=N Filename=TPTray.exe Description=Touchpad configuration tray icon for Toshiba laptops. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TPwrMgr] Confirmed=? Filename=TPwrMgr.exe Description=Found on a Toshiba laptop. Related to power management? Source=Paul Collins Startup list [TPWRTRAY] Confirmed=Y Filename=Tpwrtray.exe Description=Toshiba laptop's own Advanced Power Management system which disables Windows APM (greyed-out in Control Panel). You can't choose which of the 2 systems to use Source=Paul Collins Startup list [tqrecv] Confirmed=U Filename=tqrecv.exe Description=Tellique satellite broadcast reception software Source=Paul Collins Startup list [Traceless] Confirmed=N Filename=launch.exe Description=Traceless 2003 - clear your cookies, temp directories and browser history with a click of a button. It also clears the recent documents and the IE drop down auto complete box Source=Paul Collins Startup list [Tracker] Confirmed=? Filename=Tracker.exe Description=Possibly associated with My Deluxe Invoices program Source=Paul Collins Startup list [TrackpointSrv] Confirmed=U Filename=daemon.exetp4serv.exe Description=Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work Source=Paul Collins Startup list [Tracks EraserorTracks Eraser Pro] Confirmed=U Filename=te.exe Description=Tracks Eraser Pro from Acesoft - "Erases all tracks of your internet activity" Source=Paul Collins Startup list [Transparent] Confirmed=U Filename=TransparentW.exeTransparentD.exeTransparentB.exe Description=Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop, W=white, B=black. Available from here Source=Paul Collins Startup list [TransparentIconsortranicon] Confirmed=U Filename=tranicon.exe Description=A Tweak-XP component (only in the registered version), makes Desktop icons transparent. Can be enabled/disabled via Tweak-XP -> System + File Tweaks -> Windows Tweaks -> Desktop Tweaks -> Make Desktop Icons Transparent Source=Paul Collins Startup list [Trashgrd] Confirmed=U Filename=TRASHGRD.EXE Description=Part of McAfee Nuts & Bolts. Protects all the files you delete, even files deleted in DOS or in 16-bit Windows applications, by sending them to the Recycle Bin Source=Paul Collins Startup list [Tray Temperature] Confirmed=N Filename=Weatherbug.exe Description=Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Source=Paul Collins Startup list [traydate.exe] Confirmed=U Filename=TRAYDATE.EXE Description=Displays the date as well as the time in the System Tray. Available from TUCOWS Source=Paul Collins Startup list [TrayManager] Confirmed=U Filename=Trayman.exe Description=TrayManager hides system tray icons (FreeCell won't work when TrayMan is loaded) Source=Paul Collins Startup list [Traymon] Confirmed=U Filename=traymon.exe Description=Netropa Internet Receiver traymonitor. Will only launch the bar if you are connected to the internet and there's new news Source=Paul Collins Startup list [TraySantaCruz] Confirmed=N Filename=tbctray.exe Description=Provides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel Source=Paul Collins Startup list [TrayServer] Confirmed=N Filename=TrayServer.exe Description=For monitoring tray icons Source=Paul Collins Startup list [TrayX] Confirmed=X Filename=winppr32.exe Description=Added as a result of the SOBIG.F VIRUS! Source=Paul Collins Startup list [tray_helper] Confirmed=N Filename=tray_helper.exe Description=Tray Helper is an Email checker with additional tools, including a popup window killer, pinger module to monitor hosts and an event reminder Source=Paul Collins Startup list [TrendMicro Antivirus] Confirmed=Y Filename=Aveagent.exe Description=Virus scanner Source=Paul Collins Startup list [TrendMicro OfficeScan NT] Confirmed=Y Filename=TMLISTEN.EXE Description=Virus scanner Source=Paul Collins Startup list [Trickler] Confirmed=X Filename=fsg.exefsg-ag_3102.exegain_trickler_3202.exe Description=Advertising spyware Source=Paul Collins Startup list [trickler_bic_GatorDM_4010] Confirmed=X Filename=trickler_bic_GatorDM_4010.exe Description=Advertising spyware Source=Paul Collins Startup list [TridTray] Confirmed=? Filename=TridTray.exe Description=System Tray access to Trident 4DWave soundcards? Source=Paul Collins Startup list [TridTray] Confirmed=? Filename=TridTray.exe Description=System Tray access to Trident 4DWave soundcards? Source=Paul Collins Startup list [TrojanScanner] Confirmed=U Filename=Trjscan.exe Description=Trojan Remover from Simply Super Software. Scans for an removes trojan viruses where anti-virus software may have not detected or removed Source=Paul Collins Startup list [True Internet Color Icon] Confirmed=U Filename=internetcolor.exe Description=Part of Colorific & 3Deep from LightSurf Technologies (nee E-Color). "With True Internet Color PCs can display the best color possible over the web. Enabled web sites will know how connected monitors display color and will send them color corrected images" Source=Paul Collins Startup list [TrueFonts] Confirmed=X Filename=fonts.hta Description=Browser hijacker - redirecting to Hugesearch.net Source=Paul Collins Startup list [TrueSync Launcher] Confirmed=N Filename=tstool.exe Description=Starfish TrueSync - for synchronization between Windows platforms and popular devices, applications and services Source=Paul Collins Startup list [TrueVector] Confirmed=Y Filename=VSMON.EXE Description=Even if you don't have ZoneAlarm or ZoneAlarm Pro run at start-up you do need this Source=Paul Collins Startup list [TsAdbot] Confirmed=X Filename=TSADBOT.EXE Description=TimeSink Add Client - advertising spyware Source=Paul Collins Startup list [TSBxLogon] Confirmed=? Filename=TMESBS2.EXE Description=Found on a Toshiba laptop. May be related to TMESBS? Source=Paul Collins Startup list [tskdbg] Confirmed=X Filename=tskdbg.exe Description=Added as a result of the FLOOD.E VIRUS! Source=Paul Collins Startup list [TSMsger] Confirmed=N Filename=TSMsger.exe Description=Epson scannner software - required for "one-touch" operation. Can be launched manually Source=Paul Collins Startup list [TSPower] Confirmed=? Filename=spower.drv Description=Found on a Toshiba laptop. Related to power management? Source=Paul Collins Startup list [TSService] Confirmed=? Filename=NSSERVICE.EXE Description=?? Source=Paul Collins Startup list [tsyssmon] Confirmed=? Filename=tsyssmon.exe Description=Found in a Toshiba\sysstability directory Source=Paul Collins Startup list [ttasq] Confirmed=? Filename=ttasq.exe Description=?? Source=Paul Collins Startup list [Tukati] Confirmed=? Filename=TukatiRedistributor.exe Description=Tukati Digital Content Distribution. Is it required? Source=Paul Collins Startup list [TuneUp MemOptimizer] Confirmed=U Filename=memoptimizer.exe Description=Part of "TuneUp Utilities", specifically 2003 version. "Monitors and optimizes free memory in the background." Basically, it cleans RAM and also allows you to clear the clipboard Source=Paul Collins Startup list [TurboExplorer] Confirmed=U Filename=TE.exe Description=Web accelerator - "TurboExplorer� 2.x is a real-time web surfing accelerator specifically designed for Internet Explorer� 4/5 to achieve a faster and more effective approach to the internet". Only needed if you find it improves web browsing Source=Paul Collins Startup list [TurboMemoryCharger] Confirmed=U Filename=turbomemorycharger.exe Description=Some users swear by memory management utilities such as Turbo Memory Charger but others say you don't need them - especially if you have Win98 or WinME. See this article and make up your own mind Source=Paul Collins Startup list [TurboNote] Confirmed=N Filename=tbnote.exe Description=Post-It's on your desktop. Available via Start -> Programs Source=Paul Collins Startup list [TurboTop] Confirmed=U Filename=TurboTop.exe Description=TurboTop - make any window "Always on top" Source=Paul Collins Startup list [TV Media] Confirmed=X Filename=Tvm.exe Description=CleverIEHooker hijacker variant Source=Paul Collins Startup list [TVMD] Confirmed=X Filename=tvmd.exe Description=Total Velocity - "Secure commerce company that enables the �checkout� process for our customers in order to safely and securely purchase our award winning software". Autointsalling spyware Source=Paul Collins Startup list [TVTMD] Confirmed=X Filename=TVTMD.EXE Description=Total Velocity variant - autoinstalling spyware Source=Paul Collins Startup list [TVWakeup] Confirmed=N Filename=tvwakeup.exe Description=MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [Tvwatch] Confirmed=? Filename=tvwatch.exe Description=Associated with the TV-oOut option on Asus AGP or Intel graphics cards. Is it required? Source=Paul Collins Startup list [TWarmBay] Confirmed=? Filename=N/A Description=Found on a Toshiba laptop. Related to hotswap bay management? Source=Paul Collins Startup list [TWarnMsg] Confirmed=U Filename=twarnmsg.exe Description=Toshiba System Warning Function for Windows 98, Me, 2000 - provides notification dialog when the cooling fan stops Source=Paul Collins Startup list [TWBbtn] Confirmed=? Filename=N/A Description=Found on a Toshiba laptop Source=Paul Collins Startup list [TWBrowse] Confirmed=? Filename=TWBrowse.drv Description=Found on a Toshiba laptop. Possibly related to TWAIN drivers (ie, scanners, etc) - see this? Source=Paul Collins Startup list [Tweak Manager] Confirmed=? Filename=WinManager.Exe Description=WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed? Source=Paul Collins Startup list [Tweak UI] Confirmed=U Filename=rundll32.exe tweakui.cpl, tweakmeup Description=Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed Source=Paul Collins Startup list [Tweak UI] Confirmed=U Filename=rundll32.exe tweakui.cpl, tweaklogon Description=Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed Source=Paul Collins Startup list [Tweak UI] Confirmed=U Filename=RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup Description=Added as a result of the SUBWOOFER VIRUS! Note - the real Tweak UI entry for this is "rundll32.exe tweakui.cpl, tweakmeup" Source=Paul Collins Startup list [Tweak-Me] Confirmed=U Filename=TWEAK-ME.exe Description=3rd party version of Miscrosoft'sTweak UI "powertoy" with many more options and controls (plus full support), designed specifically to take advantage of features in WinMe/2K and above, available from here Source=Paul Collins Startup list [Tweak-xp] Confirmed=U Filename=Tweak-xp.exe Description=Main program for Tweak-XP - a WinXP tweaking utility Source=Paul Collins Startup list [TweakDUN] Confirmed=U Filename=tweakdun.exe Description=Utility to optimize your Internet Browser Software. TweakDUN promotes faster Internet data transfer rates and faster downloads by eliminating fragmentation of data packets Source=Paul Collins Startup list [tweakico] Confirmed=? Filename=tweakico.exe Description=May be a HP program to control their icons? Source=Paul Collins Startup list [TwkSCardSrv] Confirmed=N Filename=SCardS32.Exe Description=Used with Towitoko SmartCard Readers for card recognition Source=Paul Collins Startup list [Twunk_64] Confirmed=X Filename=twunk_64.exe Description=System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a Windows\System\1060 directory Source=Paul Collins Startup list [type32] Confirmed=N Filename=type32.exe Description=For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings. Not required unless you have changed them Source=Paul Collins Startup list [TypingSatellite] Confirmed=N Filename=KBOOST.exe Description=Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs Source=Paul Collins Startup list [UBSShell] Confirmed=U Filename=UBSShell.exe Description=UBS (United Bank of Switzerland) banking software Source=Paul Collins Startup list [UC_SMB] Confirmed=N Filename=ucstart.exe Description=Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed Source=Paul Collins Startup list [uc_start] Confirmed=N Filename=ucstartup.exe Description=Auto updater feature for IBM machines that tries to connect to IBM to see if there are any new drivers, patches and etc Source=Paul Collins Startup list [UD Agent] Confirmed=U Filename=UD.EXE Description=The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start -> Programs Source=Paul Collins Startup list [Ueproc32] Confirmed=U Filename=UEPROC32.exe Description=Part of Norton Utilities - most likely associated with the Unerase Wizard in older versions Source=Paul Collins Startup list [ugon] Confirmed=? Filename=aockstrs.exe Description=?? Source=Paul Collins Startup list [Uidler] Confirmed=N Filename=Uidler.exe Description=Uniloc Titlewave Browser used with some shareware Source=Paul Collins Startup list [UIWatcher] Confirmed=N Filename=UIWatcher.exe Description=Ashampoo Uninstaller Suite - installation watcher. Available via Start -> Programs Source=Paul Collins Startup list [UKVideo2] Confirmed=X Filename=ukvideo2.exe Description=Adult content dialler Source=Paul Collins Startup list [Ulead Photo Express x.0 Calendar] Confirmed=N Filename=calcheck.exe Description=Ulead Calendar Checker - part of Ulead Photo Express, where "x" represents the version number. Automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually. See here for disabling instructions Source=Paul Collins Startup list [UltimateZip Quick Start] Confirmed=N Filename=uzqkst.exe Description=UltimateZip - file compression utility Source=Paul Collins Startup list [Ultra Hal Assistant 4.5 Startup] Confirmed=N Filename=HalAsst.exe Description=Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion Source=Paul Collins Startup list [Ulubione] Confirmed=X Filename=sys****.exe Description=Search Hijacker, redirecting to maxxxhosters.com - where **** are random characters Source=Paul Collins Startup list [UMAX VistaAccess] Confirmed=N Filename=vsaccess.exe Description=VistaAccess gives you quick and easy access to scanning functions right from your desktop Source=Paul Collins Startup list [UMonit] Confirmed=U Filename=umonit.exe Description=Alerts when USB device is plugged in Source=Paul Collins Startup list [umxagent] Confirmed=Y Filename=umxagent.exe Description=Tiny Personal Firewall V4 - main engine Source=Paul Collins Startup list [umxldra] Confirmed=Y Filename=umxldra.exe Description=User mode executive module DLL loader - part of Tiny Personal Firewall V4 Source=Paul Collins Startup list [UMXLDRW] Confirmed=Y Filename=UMXLDRW.exe Description=Tiny Personal Firewall (pre V4) Source=Paul Collins Startup list [Uninstall####] Confirmed=X Filename=upd.exe Description=Adult content based screen saver where #### can be any number Source=Paul Collins Startup list [UninstallAbility] Confirmed=N Filename=uability.exe Description=UninstallAbility uninstaller Source=Paul Collins Startup list [UniSc] Confirmed=U Filename=Unisc.exe Description=McAfee UnInstaller Source=Paul Collins Startup list [uniucu] Confirmed=? Filename=uniucu.exe Description=?? Source=Paul Collins Startup list [untray] Confirmed=Y Filename=untray.exe Description=Part of Command AntiVirus Source=Paul Collins Startup list [uoltray] Confirmed=N Filename=exec.exe Description=Netzero free ISP software - not required Source=Paul Collins Startup list [Update] Confirmed=X Filename= Description=Added as a result of the LYNDEGG VIRUS! Source=Paul Collins Startup list [Update] Confirmed=X Filename=CDUpdater.exe Description="Carpe Diem" adult premium rate dialler related Source=Paul Collins Startup list [Update for Works] Confirmed=? Filename=MSWkstz.exe Description=Maybe related to later versions of MS Works? Source=Paul Collins Startup list [Update Grokster] Confirmed=N Filename=WiseUpdt.exe Description=Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program, for instance, Grokster contains CyDoor Source=Paul Collins Startup list [Update Install] Confirmed=X Filename=Schost.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Update local] Confirmed=? Filename=SetCPQLC.exe Description=Running on a Compaq desktop. Any ideas? Source=Paul Collins Startup list [Update Service] Confirmed=Y Filename=Update.exe Description=Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall Source=Paul Collins Startup list [Update TUT] Confirmed=? Filename=WiseUpdt.exe Description=?? Source=Paul Collins Startup list [UpdateComponent] Confirmed=X Filename=CNF UPD.EXE Description=Added as a result of the SPYBOT.GEN VIRUS! Source=Paul Collins Startup list [UpdateFW] Confirmed=? Filename=fwdload.exe Description=Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module? Source=Paul Collins Startup list [UPDATEHOOK] Confirmed=? Filename=Rundll32.exe Description=?? Source=Paul Collins Startup list [UpdateMedia] Confirmed=X Filename=UpdateMedia.exe Description=MediaUpdate foistware Source=Paul Collins Startup list [updatemgr.exeorUPDATE~1] Confirmed=N Filename=updatemgr.exeUPDATE~1.EXE Description=Once a month, your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software, Update Manager will inform you and, with your permission, download and install the update. Can go to http://www.earthlink.net and download the updates manually Source=Paul Collins Startup list [updater] Confirmed=X Filename=wupdater.exe Description=eUniverse KeenValue parasite related Source=Paul Collins Startup list [updater] Confirmed=? Filename=updater.exe Description=?? Source=Paul Collins Startup list [updater32] Confirmed=X Filename=winload32.exe Description=Added as the result of the CULT.M VIRUS! Note - not to be confused with the valid Windows "NOTEPAD" text editor Source=Paul Collins Startup list [Updates] Confirmed=X Filename=msupdate.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [Updates from HP] Confirmed=N Filename=backweb*****.exe Description=Automatically detects an internet connection and downloads any available updates - * is random digit Source=Paul Collins Startup list [Updatestats] Confirmed=N Filename=Updatestats.exe Description=Statblaster - "Get officially liscensed MLB pitch-by-pitch real time updates from every stadium around the league. StatBlaster provides live streaming statistics for each fantasy matchup you want tracked either in one league or across all your leagues" Source=Paul Collins Startup list [Updatewiz] Confirmed=? Filename=updatewiz.exe Description=?? Source=Paul Collins Startup list [Updmgr] Confirmed=X Filename=updmgr.exe Description=eUniverse/KeenValue adware variant Source=Paul Collins Startup list [UpdReg] Confirmed=N Filename=Updreg.exe Description=Reminder to register Creative Labs SoundBlaster Live! cards Source=Paul Collins Startup list [UpdSys] Confirmed=N Filename= Description=Added as a result of the BJ VIRUS! Source=Paul Collins Startup list [UPS] Confirmed=Y Filename=ups.exe Description=PowerChute v5.02 - UPS Monitoring Module (which loads iconclnt - the tray icon) Source=Paul Collins Startup list [UPSentry 2000orUPSlim] Confirmed=Y Filename=upsd.exe Description=Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss Source=Paul Collins Startup list [UPSUtl] Confirmed=X Filename=web.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Uptimer4] Confirmed=U Filename=Uptimer4.exe Description=Uptimer4 is an appbar which displays time, date, uptime, free ram, free pagefile, cpu usage, disk free space, battery power, IP addresses, TCP throughput, list of running processes, netstat and several more things Source=Paul Collins Startup list [UpToDate] Confirmed=X Filename=uptodate.exe Description=BrowserAid/BrowserPal foistware Source=Paul Collins Startup list [URLLSTCK.exe] Confirmed=? Filename=UrlLstCk.exe Description=Norton Internet Security 2004 related. What does it do and is it required? Source=Paul Collins Startup list [URLMAP] Confirmed=N Filename=Urlmap.exe Description=Installed by MS Money, and runs whenever you start IE. All it does is bring up an annoying sidebar (kind of like the search window) with 'financial links' when the web page supports it Source=Paul Collins Startup list [UrtSvcExe] Confirmed=Y Filename=Urt95Svc.exe Description="Cisco Secure URT is a virtual LAN (VLAN) assignment service that enhances LAN security by actively identifying and authenticating users and then associating them only to their specific network services and resources" Source=Paul Collins Startup list [Usb] Confirmed=? Filename=Usb.exe Description=HP related - not sure whether it's required Source=Paul Collins Startup list [USB Hub Keyboard Patch] Confirmed=? Filename=SKBPATCH.EXE Description=USB HUB Update Source=Paul Collins Startup list [USBDetector] Confirmed=U Filename=USBDetector.exe Description=USBDetector sets up an icon in the System Tray for a USB card which is intended to be used to eject or unplug hardware Source=Paul Collins Startup list [USBMMKBD] Confirmed=U Filename=usbmmkbd.exe Description=USB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version (available here) no longer pings a server when on-line wheras the older version did but did not transmit any user information Source=Paul Collins Startup list [USBTA] Confirmed=N Filename=usbtapnp.exe Description=System Tray access for the BeWAN Gazel 128 USB ISDN adapter Source=Paul Collins Startup list [User23.exe] Confirmed=X Filename=DIAL.exe Description=This is a trojan trying to disguise itself as User32.dll Source=Paul Collins Startup list [User32] Confirmed=X Filename= Description=Added as a result of the NETTRASH VIRUS! Source=Paul Collins Startup list [ushli] Confirmed=X Filename=sscbltqu.exe Description=Obtained from an MP3 search list site. Also generates random processes on reboot Source=Paul Collins Startup list [Usrobotics Online Registration] Confirmed=N Filename=?? Description=Pop-up reminding customers to register their products online at US Robotics Source=Paul Collins Startup list [USRSTA] Confirmed=? Filename=USRSTA.exe Description=Wireless Card controller. What does it do and is it required? Source=Paul Collins Startup list [USSShReg] Confirmed=N Filename=USSSHREG.EXE Description=Registration reminder for Ulead SmartSaver Pro - compacts large graphics for web designers Source=Paul Collins Startup list [Utility Ping] Confirmed=? Filename=UTILIT~1.EXE Description=?? Source=Paul Collins Startup list [UtilityPro] Confirmed=N Filename=UtilityPro.exe Description=IE search toolbars as supplied by people such as Yellow Internet and SearchBoss and written by Rawhide Search Solutions Source=Paul Collins Startup list [UTILsInst] Confirmed=Y Filename=N/A Description=For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out Source=Paul Collins Startup list [Utopia Angel] Confirmed=N Filename=Angel.exe Description=Calculator for the online Utopia game Source=Paul Collins Startup list [V.92 Modem On Hold] Confirmed=U Filename=Ltmoh.exe Description=Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet Source=Paul Collins Startup list [V128IID] Confirmed=Y Filename=Rundll32.exe v128iitw.dll, STB_InitTweak Description=Loads drivers for some STB graphics cards such as the STB nVIDIA TNT 16MB. Required if you don't want to experience lock-ups or error messages Source=Paul Collins Startup list [V128IITV] Confirmed=? Filename=?? Description=Loads drivers for some STB graphics cards. May be related to such a card with a TV out option? Source=Paul Collins Startup list [V66SHELL] Confirmed=? Filename=V66SHELL.EXE Description=It looks to be part of the display driver set for ASUS V3800, V6600 and V6800 display adapters. Probably a system tray quick access control? Source=Paul Collins Startup list [va10key] Confirmed=U Filename=va10key.exe Description=Only required if you use the 10 kay bay unit with a Sony Vaio laptop Source=Paul Collins Startup list [VAGCtrl] Confirmed=Y Filename=VAGCTRL.EXE Description=Vexira Antivirus - virus scanner from Central Command Source=Paul Collins Startup list [VAGuard] Confirmed=Y Filename=VAGNT.exe Description=Vexira Antivirus - virus scanner from Central Command Source=Paul Collins Startup list [VAIO Action Setup (Server)] Confirmed=U Filename=VAServ.exe Description=Sony Vaio utility that auto-launches selected applications when you plug in a digital video camera, digital still camera, etc. via iLink (FireWire) or USB Source=Paul Collins Startup list [VAIO Recovery] Confirmed=? Filename=PartSeal.exe Description=Associated with Sony VAIO PCs. What does it do and is it required? Source=Paul Collins Startup list [VbouncerDL] Confirmed=X Filename=VBouncerInnerxxxx.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here and here. "xxxx" represents 4 random numbers Source=Paul Collins Startup list [VB_run] Confirmed=X Filename=comctl_32.exe Description=Dubious downloader from densmail.com Source=Paul Collins Startup list [VC5Play] Confirmed=N Filename=VC5Play.exe Description=Virtual CD drive emulator - version 5. Available via Start -> Programs Source=Paul Collins Startup list [VCatch] Confirmed=X Filename=Vcatch.exe Description=CommonSearch Vcatch - "antivirus" software which actually bundles spy/adware itself! Source=Paul Collins Startup list [VCatch Premium] Confirmed=X Filename=VCatchpre.exe Description=VCatch antivirus. Considered spyware itself - see here Source=Paul Collins Startup list [VCDPlayer] Confirmed=N Filename=VCDPlayer.exe Description=Virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [vcdplayx] Confirmed=N Filename=vcdplayx.exe Description=CD emulation part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically Source=Paul Collins Startup list [VCDTower] Confirmed=U Filename=VCDTower.exe Description=Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive, users can simultaneously access as many as 23 virtual CD-ROM drives at a speed of 200X for true multitasking Source=Paul Collins Startup list [VCDWATCH] Confirmed=? Filename=VCDWATCH.EXE Description=Confirmed as Voyetra CD Watcher as it was found in a Compaq/Voyetra/AS2 directory but what does it do? Source=Paul Collins Startup list [VCSPlayer] Confirmed=N Filename=vcsplay.exe Description=Virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [VDI Manager (HP)] Confirmed=? Filename=HPO0VDX05.exe Description=HP (Hewlett-Packard) related. Now - what does it do? Source=Paul Collins Startup list [vdtask] Confirmed=N Filename=vdtask.exe Description=Program part of GameDrive & VirtualDrive from Farstone. Not required as starting these programs load this automatically Source=Paul Collins Startup list [Vegas Palms - Launcher] Confirmed=N Filename=Launcher.exe Description=Vegas Palms on-line cassino Source=Paul Collins Startup list [Verizon Control Pad] Confirmed=N Filename=cpad.exe Description=Control Pad - installed with Verizon DSL accounts. Tool designed to streamline the online experience Source=Paul Collins Startup list [Verizon Online Support Center] Confirmed=U Filename=matcli.exe Description="matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Verizon Online Support Center is required to run with the Help and Support program. If you uncheck Verizon Online Support Center and and then run help and Support it will add another Verizon Online Support Center in the startup menu. If you remove the Verizon Online Support Center in the add/remove program some help menus in help and support will not be available. You decide Source=Paul Collins Startup list [versato] Confirmed=U Filename=versato.exe Description="Hot" button (such as volume and browser control) management and a CD player as supplied with QTronix (as possibly Micro Innovations) keyboards Source=Paul Collins Startup list [Version] Confirmed=X Filename=Version.exemanage.exe Description=JRAUN adware variant Source=Paul Collins Startup list [Vet Alert] Confirmed=Y Filename=vetmsg9x.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software Source=Paul Collins Startup list [Vet Start Up] Confirmed=Y Filename=vet98.exevet32.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system, if set too aggressively. There is no need to scan every file when opened, closed, etc. Check in InoculateIT PE options Source=Paul Collins Startup list [VetTray] Confirmed=U Filename=vettray.exe Description=Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. System Tray quicklaunch access, not really necessary but only occupies 36k resources Source=Paul Collins Startup list [Vidcompat] Confirmed=X Filename=Vidcompat.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Video Manager] Confirmed=X Filename=videomgr.exe Description=Added as a result of the PANDEM.C VIRUS! Source=Paul Collins Startup list [VideoDriver] Confirmed=X Filename= Description=Added as a result of the GSPOT20.A VIRUS! Source=Paul Collins Startup list [VideoDriver] Confirmed=X Filename=videodrv.exe Description=Added as a result of the MIMAIL.A VIRUS! Source=Paul Collins Startup list [VideoDriver] Confirmed=X Filename=gspotbot.exe Description=Added as a result of the SPIGOT.C VIRUS! Source=Paul Collins Startup list [VidSvr] Confirmed=N Filename=vidsvr.exe Description=MS WebTV for Windows Channel Guide. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it Source=Paul Collins Startup list [vietato.exe] Confirmed=X Filename=vietato.exe Description=Adult content dialler Source=Paul Collins Startup list [Vinny] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [Virtual Access Scheduler] Confirmed=U Filename=VASCHD32.EXE Description=The scheduler for mail and usenet tool Source=Paul Collins Startup list [Virtual Bouncer] Confirmed=X Filename=VirtualBouncer.exe Description=Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove, so definitely qualifies as unsolicited commercial software in itself. It also has an update feature that can download and execute arbitrary code. Warning - choose "custom" uninstall as "automatic" may remove other programs - see here and here Source=Paul Collins Startup list [VirtualDrive] Confirmed=N Filename=VDTask.exe Description=VirtualDrive from Farstone - virtual CD drive emulator. Available via Start -> Programs Source=Paul Collins Startup list [Virus Scan] Confirmed=X Filename=virscana.exe Description=Added as a result of a VIRUS! Source=Paul Collins Startup list [VirusCheckII] Confirmed=X Filename=AVIRCHK.EXE Description=Added as a result of the DASMIN VIRUS! Source=Paul Collins Startup list [VirusScan Online] Confirmed=Y Filename=mcvsshld.exe Description=McAfee VirusScan On-line. See also McAgentExe Source=Paul Collins Startup list [VirusScanMSC] Confirmed=? Filename=VsStat.exe Description=Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe), McAfee SecurityCenter integration or something else? Is it required? Source=Paul Collins Startup list [Virus_Scanner] Confirmed=X Filename=Virus_Cleaner.exe Description=Added as a result of the PANOL VIRUS! Source=Paul Collins Startup list [visionGS] Confirmed=N Filename=VISIONGS.EXE Description=visionGS webcam software Source=Paul Collins Startup list [Vistascan] Confirmed=N Filename=vistascan.exe Description=Included in VistaScan are VistaAccess and VistaShuttle. VistaAccess gives you quick and easy access to scanning functions right from your desktop. For Windows users, you'll see a scanner icon in the Windows Tray of the Taskbar. Click this icon and a menu opens Source=Paul Collins Startup list [VividGalut] Confirmed=X Filename=VividGalut.exe Description=Adult content related web downloader Source=Paul Collins Startup list [VMDFW] Confirmed=Y Filename=vmdfw.exe Description=VirusMD Personal Firewall Source=Paul Collins Startup list [VnCplUpdate] Confirmed=X Filename=msdm.exe Description=Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in this advisory Source=Paul Collins Startup list [VOBID] Confirmed=U Filename=InstantDrive.exe Description=Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer�s hard drive. Part of InstantCD/DVD burning software Source=Paul Collins Startup list [VOBRegCheck] Confirmed=Y Filename=VOBRegCheck.exe Description=Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled Source=Paul Collins Startup list [VoodooBanshee] Confirmed=U Filename=rundll32.exe 3DBBps.dll, BansheeLoadSettings Description=Loads the configuration settings for a 3dfx Voodoo Banshee chipset based graphics card. If you change some of the settings from default you probably need this - otherwise maybe not Source=Paul Collins Startup list [voowsmcr] Confirmed=? Filename=huhdir.exe Description=?? Source=Paul Collins Startup list [Vortex Tray] Confirmed=N Filename=asp4setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VortexTray] Confirmed=N Filename=au30setp.exeasp4tray.exeasp4setp.exe Description=System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel Source=Paul Collins Startup list [VoyetraTray] Confirmed=N Filename=vtray.exe Description=This provides an abbreviated Control Group for the Turtle Beach Montego II sound functions/associated with AudioStation 3 and 32 Source=Paul Collins Startup list [Vpop3 Mail Server] Confirmed=U Filename=vpop3.exe Description=Mail server from Paul Smith Computer Services. Runs in system tray to collect mail. Can be run from a shortcut and if it isn't running then it won't get your email! Source=Paul Collins Startup list [vptray] Confirmed=U Filename=vptray.exe Description=System Tray icon for Norton Anti-Virus Corporate Edition. Gives access to the options available and may not be required. Some users may have problems - refer here Source=Paul Collins Startup list [VS.VSN] Confirmed=Y Filename= Description=Part of eSafe antivirus "SmartScan" - alerts the user if files have been changed/added Source=Paul Collins Startup list [vscanner] Confirmed=X Filename=spooll32.exe Description=Added as a result of the OPTIXPRO VIRUS! Source=Paul Collins Startup list [VsEcomrEXE] Confirmed=N Filename=VSECOMR.EXE Description=From McAfee VirusScan up to version 4.x. This executable is responsible for the periodic "update" prompts Source=Paul Collins Startup list [Vshwin32EXE] Confirmed=Y Filename=VSHWIN32.EXE Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [VSOCheckTask] Confirmed=Y Filename=MCMNHDLR.EXE Description=Part of McAfee's SecurityCenter and Virusscan Online. Must be enabled for scanning to work Source=Paul Collins Startup list [vspdfprsrv.exe] Confirmed=N Filename=vspdfprsrv.exe Description=Visage PDF Printer Source=Paul Collins Startup list [VsStatEXE] Confirmed=Y Filename=VSSTAT.EXE Description=From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs Source=Paul Collins Startup list [vTPass] Confirmed=N Filename=vtpassld.exe Description=Part of vTrails - a live media delivery solution. vTPass is the driver enabling the system to work. If unavailable via Start -> Programs, create your own shortcut for the "vtpass.exe" file Source=Paul Collins Startup list [vTunerStartUp] Confirmed=N Filename=vTuner.exe Description=vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet" Source=Paul Collins Startup list [w32alanis] Confirmed=X Filename=mope.scr Description=Added as a result of the SINALA VIRUS! Source=Paul Collins Startup list [W32Load] Confirmed=X Filename=.scr Description=Added as a result of the CASPID VIRUS! Source=Paul Collins Startup list [w32sup] Confirmed=X Filename=w32sup.exe Description=Adult content dialler Source=Paul Collins Startup list [W32Tc] Confirmed=X Filename=WTC32.scr Description=Added as a result of the VOTE.D or VOTE.K VIRUSES! Source=Paul Collins Startup list [W3KNetwork] Confirmed=X Filename=rundll32.exe w3knet.dll, dllinitrun Description=Advertising spyware. Check here for more info on this particular one Source=Paul Collins Startup list [W75P2PSERVER] Confirmed=Y Filename=W75P2PS.EXE Description=Printer utility which is required in order to make the printer work correctly Source=Paul Collins Startup list [WanMPSvc] Confirmed=Y Filename=WanMPSvc.exe Description=An AOL component, the Wan miniport (ATW) service. If you delete this and logon, AOL reports a problem with your internet connection, and reinstalling AOL doesn�t help Source=Paul Collins Startup list [war-ftpd.exe] Confirmed=N Filename=WAR-FTPD.EXE Description=War FTP Daemon from JGAA's Internet - FTP client Source=Paul Collins Startup list [Wardo] Confirmed=X Filename=syslaunch.exe Description=Added as a result of the ADLCICKER.G VIRUS! Source=Paul Collins Startup list [Warner] Confirmed=U Filename=warner.exe Description=Also known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files Source=Paul Collins Startup list [Warnet] Confirmed=U Filename=warnet.exe Description=Warnet - system cleanup software Source=Paul Collins Startup list [Warning: do not remove it!] Confirmed=U Filename=fpplock.exe Description=Part of Folder Password Expert by ZQS Software Team - "a software program to restrict access to the folders that contain your sensitive data" Source=Paul Collins Startup list [WARSVR] Confirmed=N Filename=war-ftpd.exe Description="War FTP Daemon - the original free FTP server for windows" Source=Paul Collins Startup list [WashAndGo - Cleanup of old Backupfiles] Confirmed=U Filename=checker.exe Description=WashAndGo - temp file cleaner Source=Paul Collins Startup list [Washer] Confirmed=N Filename=washer.exe Description=Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [Washerie.exe] Confirmed=N Filename=washerie.exe Description=Cookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer, specific for cleaning the IE cache and cookies. Available via Start -> Programs Source=Paul Collins Startup list [washindex] Confirmed=N Filename=washidx.exe Description=Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG Source=Paul Collins Startup list [Watch] Confirmed=N Filename=watch.exe Description=Found to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted Source=Paul Collins Startup list [Watch] Confirmed=? Filename=1200UBWATCH.EXE Description=?? Source=Paul Collins Startup list [Watch Dog Program] Confirmed=N Filename=watchdog.exe Description=For Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do Source=Paul Collins Startup list [Watchdog] Confirmed=N Filename=Watchdog.exe Description=Definitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others), launches from the Startup folder in the Start Menu, but not required as they give instructions on removing it on their webpage Source=Paul Collins Startup list [WaveTop Launcher] Confirmed=N Filename=WaveTop.exe Description=WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98 Source=Paul Collins Startup list [WaveTop Receiver 1] Confirmed=N Filename=N/A Description=See above Source=Paul Collins Startup list [WaveTop Receiver 2] Confirmed=N Filename=N/A Description=See above Source=Paul Collins Startup list [WaveTop Upload Manager] Confirmed=N Filename=N/A Description=See above Source=Paul Collins Startup list [Wbiff] Confirmed=N Filename=Wbiff.exe Description=Wbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received Source=Paul Collins Startup list [WCESCOMM] Confirmed=N Filename=WCESCOMM.EXE Description=Active sync for use with Windows CE based palm PC Source=Paul Collins Startup list [wcmdmgr.exe] Confirmed=N Filename=wcmdmgr.exe Description=It will periodically contact Wild Tangent servers to see if an update is available for your system and allows us to make the product exceptionally reliable. You can control its behavior, or disable it completely, inside your Windows Control Panel. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [wcmdmgrl] Confirmed=U Filename=wcmdmgrl.exe Description=Checks for periodic updates of Wild Tangent Web Driver over the web. A multimedia extension/plug-in. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [WCOLOREAL] Confirmed=U Filename=coloreal.exe Description=Makes colours sharper and brighter, but will only work with coloreal capable monitors Source=Paul Collins Startup list [WDInfo] Confirmed=X Filename=wdinfo.exe Description=Adult content dialler Source=Paul Collins Startup list [wdwctrl] Confirmed=X Filename=wdwctrl.exe Description=Added as a result of the DLUCA.R VIRUS! Source=Paul Collins Startup list [WEATHER] Confirmed=N Filename=WEATHER.EXE Description=Weatherbug provides current outdoor temperature in the System Tray, also weather alerts. Available via Start -> Programs Source=Paul Collins Startup list [WeatherCast] Confirmed=N Filename=Weather.exe Description=Weather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight Source=Paul Collins Startup list [WeatherWatcher] Confirmed=N Filename=ww.exe Description=WeatherWatcher - weather reporting in the System Tray Source=Paul Collins Startup list [Web Search] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [web3trap] Confirmed=Y Filename=web3trap.exe Description=PC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [webalize] Confirmed=X Filename=webalize.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [webassist] Confirmed=X Filename=webassist.exe Description=Adware popup generator Source=Paul Collins Startup list [Webcam Go Sti Service Application] Confirmed=? Filename=wbcgosvc.exe Description=Control software for the portable Creative Video Blaster Webcam Go digital camera/PC web cam. What does it do and is it required? Source=Paul Collins Startup list [WebcamRT.exe] Confirmed=N Filename=WEBCAMRT.exe Description=For Logitech Web Cams. Not required - camera works fine without it Source=Paul Collins Startup list [Webcelerator] Confirmed=X Filename=webcel.exe Description=Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Spyware and troublesome - see here Source=Paul Collins Startup list [Webdav.exe] Confirmed=X Filename=webdav.exe Description=IRC DDoS bot which gives the hacker full control over your system Source=Paul Collins Startup list [WebHancer Agent] Confirmed=X Filename=whagent.exe Description=System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here Source=Paul Collins Startup list [webHancer Survey Companion] Confirmed=X Filename=whSurvey.exe Description=WebHancer foistware - traffic measurement service that uses a client agent that is stealth installed on user machines, gathering detailed data about sites visited, their performance and, most important, what the user actually does while there Source=Paul Collins Startup list [WebInstall] Confirmed=? Filename=WebInstall.exe Description=?? Source=Paul Collins Startup list [WebInstall2] Confirmed=X Filename=INS????.TMP Description=Left over from a failed install of Movie Networks, ie, if it is already installed Source=Paul Collins Startup list [WebKey] Confirmed=N Filename=WebKey.exe Description=WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet Source=Paul Collins Startup list [WebOutfitterTray] Confirmed=N Filename=sttray.exe Description=Intel WebOutfitter service System Tray icon Source=Paul Collins Startup list [Webposition Gold 2] Confirmed=N Filename=wpsche~1.exe Description=Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines Source=Paul Collins Startup list [websaverlive] Confirmed=U Filename=websaverlive.exe Description=WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle Source=Paul Collins Startup list [WebScan] Confirmed=X Filename=DEFSCANGUI.EXE Description=Stop-Sign from eAccelerration. Detects spyware, malware, viruses and keyloggers and stops popups. Spyware in itself - see their privacy statement here Source=Paul Collins Startup list [WebScanX] Confirmed=Y Filename=WebScanX.exe Description=From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs, etc Source=Paul Collins Startup list [websearch] Confirmed=X Filename=wjview ...websearch.exe Description="Web Savings" From Ebates Software, a shopping tool that opens pop-up windows Source=Paul Collins Startup list [WebServer] Confirmed=? Filename=VBI_SE~1.EXE Description=Related to a Pinnacle sound card. What does it do and is it needed? Source=Paul Collins Startup list [Webshots] Confirmed=N Filename=Webshots Tray.exewebsho~1.exe Description=Screensaver program that automatically downloads from the webshots web site Source=Paul Collins Startup list [Webtrap] Confirmed=Y Filename=webtrap.exe Description=Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating Source=Paul Collins Startup list [WebWasher] Confirmed=U Filename=wwasher.exe Description=Free Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs Source=Paul Collins Startup list [Welcome] Confirmed=N Filename=Welcome.exe Description=Launches the Welcome to Windows tutorial on boot up Source=Paul Collins Startup list [WEPstat] Confirmed=? Filename=Wepstat.exe Description=Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be "U". Can anybody confirm this? Source=Paul Collins Startup list [WetSock] Confirmed=N Filename=wetsock.exe Description=RoboMagic Wetsock - weather reporting in the System Tray Source=Paul Collins Startup list [WFGStartup] Confirmed=N Filename=WFGStartup.exe Description=World Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones" Source=Paul Collins Startup list [wfips] Confirmed=U Filename=iphider.exe Description=ICQ (messaging/chat program) anti-bomb software. "WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed." For more information about ICQ bombs see here Source=Paul Collins Startup list [WFXCTL32.EXE] Confirmed=N Filename=WFXCTL32.EXE Description=From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [wfxsnt40] Confirmed=Y Filename=wfxsnt40.exe Description=WinFax 10.0 and maybe earlier versions. The program that opens the port for WinFax and not normally in the start menu. Needed if you want to run WinFax Source=Paul Collins Startup list [WFXSwtch] Confirmed=? Filename=WFXSWTCH.exe Description=Related to WinFax. What does it do and is it required? Source=Paul Collins Startup list [WGWLocalManager] Confirmed=U Filename=WGWLocalManager.exe Description=Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution, which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creating a shortcut, running it only when connecting to the internet. If internet is used often, it's recommended to leave it in startup so it starts with the system Source=Paul Collins Startup list [whagent] Confirmed=X Filename=whagent.exe Description=System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here Source=Paul Collins Startup list [WheelMouse] Confirmed=U Filename=4DMAIN.EXE Description=Mouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide Source=Paul Collins Startup list [WheelMouse] Confirmed=U Filename=AMOUMAIN.EXE Description=A4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features Source=Paul Collins Startup list [WhenUSave] Confirmed=X Filename=Save.exe Description=Rebranded version of SaveNow advertising spyware Source=Paul Collins Startup list [WhenUSearch] Confirmed=X Filename=Search.exe Description=WhenUSearch adware Source=Paul Collins Startup list [Whvlxd] Confirmed=X Filename=Whvlxd.exe Description=Added as a result of the W32.LXD.Mirc VIRUS! Source=Paul Collins Startup list [WIAWizardMenu] Confirmed=N Filename=RUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenu Description=Still Image Class Installer - installed with a webcam Source=Paul Collins Startup list [WildTangent Web Driver updater] Confirmed=U Filename=wcmdmgrl.exe Description=Checks for periodic updates of Wild Tangent Web Driver over the web. A multimedia extension/plug-in. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [Wildwire Monitor] Confirmed=N Filename=WWMon.exe Description=This places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem Source=Paul Collins Startup list [Willow Road] Confirmed=N Filename=WillowRoad.exe Description=Willow Road Screen Saver Source=Paul Collins Startup list [win] Confirmed=X Filename=regedit -s ..\win.dll Description=Added as a result of the SEEKER.K VIRUS! Source=Paul Collins Startup list [Win Chimes] Confirmed=U Filename=winchi~1.exe Description=WinChimes - enhancement software for the system clock that runs in the system tray Source=Paul Collins Startup list [WIN HOST PROCESS] Confirmed=X Filename=WIN HOST PROCESS.EXE Description=Added as a result of the KEYLOGGER.CLONE VIRUS! Source=Paul Collins Startup list [win name] Confirmed=? Filename=stat.exe Description=?? Source=Paul Collins Startup list [Win Server] Confirmed=X Filename=winserv.exe Description=Added as a result of the IMISERV VIRUS! Source=Paul Collins Startup list [Win Server Updt] Confirmed=X Filename=wupdt.exe Description=Added as a result of the IMISERV VIRUS! Source=Paul Collins Startup list [WIN-BUGSFIX] Confirmed=X Filename=WIN-BUGSFIX.EXE Description=Added as a result of the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [Win2Drv] Confirmed=X Filename= Description=Added as a result of the WINTOO VIRUS! Source=Paul Collins Startup list [WIN32] Confirmed=X Filename=WIN32.EXE Description=Added as a result of the RATEGA VIRUS! Source=Paul Collins Startup list [win32] Confirmed=X Filename=Shakira_1997_Part_1_.Mpeg_.scr Description=Added as a result of the MYLIFE.N VIRUS! Source=Paul Collins Startup list [win32] Confirmed=X Filename=Setup_32.exeWinSetup.exe Description=Added as a result of the EVILBOT.B VIRUS! Source=Paul Collins Startup list [Win32] Confirmed=X Filename=Win32.exe Description=Added as a result of the ISRAZ.A VIRUS! Source=Paul Collins Startup list [win32] Confirmed=X Filename=winsrv32.exe Description=Added as a result of the ADUENT VIRUS! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites Source=Paul Collins Startup list [Win32 Kernel core component] Confirmed=X Filename=Kernel32.pif Description=Added as a result of the MOKS VIRUS! Source=Paul Collins Startup list [Win32 Rundll Loader] Confirmed=X Filename=Rundll32.exe Description=Added as a result of the SDBOT.A VIRUS! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:\\Windows directory. The version created by this virus is saved in the C:\\Windows\\System directory Source=Paul Collins Startup list [win32app] Confirmed=X Filename=winpup32.exe Description=Added as a result of the ADCLICKER VIRUS! Source=Paul Collins Startup list [Win32BaseServiceMOD] Confirmed=X Filename=Wintask.exe Description=Added as a result of the NAVIDAD VIRUS! Source=Paul Collins Startup list [win32clf] Confirmed=X Filename=win32clf.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Win32DLL] Confirmed=X Filename=Win32DLL.vbs Description=Added as a result of the LOVELETTER (I LOVE YOU) VIRUS! Source=Paul Collins Startup list [Win32dll] Confirmed=X Filename=Win32dll.exe Description=Added as a result of the BANPAES VIRUS! Source=Paul Collins Startup list [Win32G] Confirmed=X Filename=Kernel32.comScandisk.com Description=Added as a result of the ESTRELLA VIRUS! Source=Paul Collins Startup list [win32gb] Confirmed=X Filename=win32gb.exe Description=All-In-One-Telcom (adult content dialler) variant Source=Paul Collins Startup list [win32ini] Confirmed=X Filename=systroy.exe Description=Added as a result of the IRC.ALADINZ.C VIRUS! Source=Paul Collins Startup list [Win32R] Confirmed=X Filename=Server.com Description=Added as a result of the ESTRELLA VIRUS! Source=Paul Collins Startup list [WIN32SL] Confirmed=Y Filename=Win32sl.exe Description=Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely. Uses the DMI and/or common information model (CIM) protocols, which are systems management protocols defined by industry standards. The specific function of this is to load MIF's in order for Dell OpenManage Client to work Source=Paul Collins Startup list [Win32system] Confirmed=X Filename= Description=Added as a result of the DDV.B VIRUS! Source=Paul Collins Startup list [win32us] Confirmed=X Filename=win32us.exe Description=All-In-One-Telcom (adult content dialler) variant Source=Paul Collins Startup list [win32_i lptt01orwin32_i ml097e] Confirmed=X Filename=win32_i.exe Description=Variant of the RapidBlaster parasite (in a "win32_i" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [Win386] Confirmed=X Filename=Win386.exe Description=Added as a result of the GOSUSUB VIRUS! Source=Paul Collins Startup list [Win386] Confirmed=X Filename=sp32.dll Description=Homepage hijacker. Not a dll but a regfile in disguise Source=Paul Collins Startup list [Win64 Compatibility Check] Confirmed=X Filename=load win64.drv Description=CoolWebSearch parasite related Source=Paul Collins Startup list [winactive] Confirmed=X Filename=WINACTIVE.EXE Description=Active variant of LOP.com hijacker - see here Source=Paul Collins Startup list [WinActiveJ] Confirmed=X Filename=WinActiveJ.exe Description=Added as a result of the ROTARRAN VIRUS! Source=Paul Collins Startup list [Winahlp.exe] Confirmed=X Filename=Winahlp.exe Description=Added as a result of a variant of the VAGRNOCKER VIRUS! Source=Paul Collins Startup list [winallap] Confirmed=X Filename=winallap.exe Description=Added as a result of the DELF.E VIRUS! Source=Paul Collins Startup list [winallapu] Confirmed=X Filename=winallapu.exe Description=Added as a result of the DELF.E VIRUS! Source=Paul Collins Startup list [Winamp] Confirmed=X Filename=winamp.hta Description=Hijacker - re-directing to adult content sites. Note - this isn't the real Winamp below Source=Paul Collins Startup list [WinampAgentorWinampa] Confirmed=U Filename=WINAMPa.exe Description=Loads the System Tray icon for the WinAmp media player. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs Source=Paul Collins Startup list [Winapp] Confirmed=X Filename=winpup32.exe Description=Produces popup ads to adult content sites Source=Paul Collins Startup list [WinApp32] Confirmed=X Filename=msapp.exe Description=Added as a result of the RSBOT VIRUS! Source=Paul Collins Startup list [WinAuth] Confirmed=X Filename=winlogon.exe Description=Added as a result of an unidentified VIRUS!. This is not the valid winlogon.exe as described here Source=Paul Collins Startup list [WinBackup Scheduler] Confirmed=U Filename=Wbsched.exe Description=LIUtilities WinBackup scheduler - backup software Source=Paul Collins Startup list [WinBar] Confirmed=U Filename=WinBar.exe Description="WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls" Source=Paul Collins Startup list [Winbed] Confirmed=X Filename=winbed.exe Description=Hijacker Source=Paul Collins Startup list [WinCheck] Confirmed=X Filename=WinCheck.exe Description=Added as a result of the PWS-CY VIRUS! Source=Paul Collins Startup list [WinDates] Confirmed=N Filename=windates.exe Description=WinDates is a calendar, date organizer and event reminder program from Rockin' Software Source=Paul Collins Startup list [Winde] Confirmed=X Filename=winde.exe Description=Added as a result of the DLUCA VIRUS! Source=Paul Collins Startup list [windir] Confirmed=X Filename=winrun.exe Description=Added as a result of the WINBUR.B VIRUS! Source=Paul Collins Startup list [Windll] Confirmed=X Filename=Windll.exe Description=Added as a result of the TRYNOMA VIRUS! Source=Paul Collins Startup list [WINDLL] Confirmed=U Filename=WSYS.EXE Description=STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes, all passwords transacted even if they weren't keyed in, all web sites visited, every program launched including the path to that program, and more" Source=Paul Collins Startup list [windll] Confirmed=X Filename=windll32.exe Description=Added as a result of the ASTEF or RESPAN VIRUSES! Source=Paul Collins Startup list [Windll.exe] Confirmed=X Filename=Windll.exe Description=Added as a result of the STEALER VIRUS! Source=Paul Collins Startup list [Windll32] Confirmed=X Filename=Windll32.exe Description=Added as a result of the MSNPWS VIRUS! Source=Paul Collins Startup list [Windoes Kernel] Confirmed=X Filename=kernel32.exe Description=Added as a result of the KICKIN.A (or CYDOG.C) VIRUS! Source=Paul Collins Startup list [Window Loader] Confirmed=X Filename=Dos32.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Window Washer] Confirmed=U Filename=wwDisp.exe Description=Webroot Window Washer - "Wash away online and offline traces of PC and Internet activity to protect your privacy and improve PC performance" Source=Paul Collins Startup list [WindowBlinds] Confirmed=U Filename=wbload.exe Description=WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins Source=Paul Collins Startup list [WindowEnhancer] Confirmed=X Filename=Winex.exe Description=SCbar foistware variant Source=Paul Collins Startup list [WindowFX] Confirmed=U Filename=wfxload.exe Description=Stardock WindowFX - "Allows you to add an unprecedented number of special effects to windows" Source=Paul Collins Startup list [Windows] Confirmed=X Filename=Kernel32.exe Description=Added as a result of the TENDOOLF VIRUS! Source=Paul Collins Startup list [Windows] Confirmed=X Filename=msdos98.exe Description=Added as a result of the PWSTEAL VIRUS! Source=Paul Collins Startup list [Windows] Confirmed=X Filename=Windows.exe Description=Added as a result of the KAZMOR, BOBBINS & ALADINZ.D VIRUSES! Source=Paul Collins Startup list [Windows] Confirmed=X Filename=explorer.exe Description=Added as a result of an unidentified VIRUS! Note - this is not the valid Windows Explorer (explorer.exe). It was found in the C:\\Windows directory on a WinNT machine and the wheras the valid explorer.exe would be found in C:\\Winnt Source=Paul Collins Startup list [Windows Accelerators] Confirmed=U Filename=setup.exe Description=KeySpy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove Source=Paul Collins Startup list [windows auto update] Confirmed=X Filename=penis32.exe Description=Added as a result of the BLASTER (or MSBLAST.A) VIRUS! Source=Paul Collins Startup list [windows auto update ] Confirmed=X Filename=msblast.exe Description=Added as a result of the BLASTER.B VIRUS! Source=Paul Collins Startup list [windows automation] Confirmed=X Filename=mslaugh.exe Description=Added as a result of the BLASTER.E VIRUS! Source=Paul Collins Startup list [Windows Backup Configuration] Confirmed=X Filename=IEXPLORER.exe Description=Added as a result of the GAOBOT.AZ VIRUS!. Note - this is not the valid Windows Explorer which has the same executable name Source=Paul Collins Startup list [Windows Ba�lang�� Dosyas�] Confirmed=X Filename=sistem.exe Description=Added as a result of the MUZK VIRUS! Source=Paul Collins Startup list [Windows Config Loader] Confirmed=X Filename=Wincfg32.exe Description=Added as a result of the SILVERFTP VIRUS! Source=Paul Collins Startup list [Windows Configuration] Confirmed=X Filename=wsys32.exe Description=Added as a result of the GAOBOT.FB VIRUS! Source=Paul Collins Startup list [Windows Control] Confirmed=X Filename=Control.exe Description=Browser hijacker. NOTE - On Win9x systems it will overwrite the Windows file of the same name in the Windows directory, so therefore it will be necessary to extract a fresh copy of the file from the Windows setup cabs! Source=Paul Collins Startup list [Windows DLL Loader] Confirmed=X Filename=RUNDLL16.EXE Description=Added as a result of the DOMWIS VIRUS! Source=Paul Collins Startup list [Windows Explorer] Confirmed=X Filename=.exe Description=Added as a result of the SDBOT VIRUS! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually Source=Paul Collins Startup list [Windows Explorer] Confirmed=X Filename=Lsas.exe Description=Added as a result of the GAOBOT.AO VIRUS! Note - this is not the valid Windows Explorer (explorer.exe) which would only be in startups if you added it manually Source=Paul Collins Startup list [Windows Explorer Shell] Confirmed=X Filename=Winexec32.exe Description=Added as a result of the REDIST.B VIRUS! Source=Paul Collins Startup list [Windows Explorer Update Build 1142] Confirmed=X Filename=EXPLORER32.EXE Description=Added as a result of the KaZaA based KWBOT or KWBOT.Y VIRUSES! Source=Paul Collins Startup list [Windows Eyes] Confirmed=N Filename=?? Description=For blind people, gives a voice description of items on the screen. Windows application which gives you total control over what you hear, when you hear it, and how you hear it. Available via Start -> Programs Source=Paul Collins Startup list [Windows Guardian] Confirmed=U Filename=thehel1iawgrd32.exeFawgrd32.exe Description=Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes Source=Paul Collins Startup list [Windows Help System] Confirmed=? Filename=Help.pif Description=?? Source=Paul Collins Startup list [Windows Internet Protocol] Confirmed=X Filename=winproc32.exe Description=CoolWebSearch parasite related Source=Paul Collins Startup list [Windows Load] Confirmed=? Filename=windows.com Description=?? Source=Paul Collins Startup list [Windows Loader] Confirmed=X Filename=wstart32.exe Description=Added as a result of the GAOBOT.CA VIRUS! Source=Paul Collins Startup list [Windows Management Instrumentation] Confirmed=X Filename=mwd.exe Description=Added as a result of the GRAPS VIRUS! Source=Paul Collins Startup list [Windows Manager] Confirmed=X Filename=winmants.exe Description=Added as a result of the MANTAS VIRUS! Source=Paul Collins Startup list [Windows mangement] Confirmed=X Filename=winlogonn.exe Description=Added as a result of the RANDEX.FC VIRUS! Source=Paul Collins Startup list [Windows Media Powerpoint Helper] Confirmed=N Filename=NSPPTHLP.EXE Description=German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs Source=Paul Collins Startup list [Windows Media SP.2.37] Confirmed=X Filename= Description=Added as a result of the LEMIR.C VIRUS! Source=Paul Collins Startup list [Windows MeTaLRoCk service] Confirmed=X Filename=metalrock.exe Description=Added as a result of the TASTYRED VIRUS! Source=Paul Collins Startup list [Windows Networking] Confirmed=X Filename=winsys32.exe Description=Added as a result of the GAOBOT.FL VIRUS! Source=Paul Collins Startup list [Windows Print Spooler] Confirmed=? Filename=SCVHOSTS.EXE Description=Suspicious due to the similarity to the valid "svchost.exe" file Source=Paul Collins Startup list [Windows Print Spooler] Confirmed=X Filename=NavAgent32.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Windows Print Spooler] Confirmed=X Filename=SVEHOST.EXE Description=Added as a result of the SPYBOT.H VIRUS! Source=Paul Collins Startup list [Windows Runtime Help] Confirmed=X Filename=win32hlp.exeWinRunHelp.wrh Description=Added as a result of a variant of the AIMVISION VIRUS! Source=Paul Collins Startup list [Windows Security Assistant] Confirmed=X Filename=rundll32.vbe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Windows Security Assistant] Confirmed=X Filename=winsec.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [Windows Service Host] Confirmed=X Filename=scvhost.exe Description=Added as a result of the SDBOT.N VIRUS! Source=Paul Collins Startup list [Windows Services] Confirmed=X Filename=service.exe Description=Added as a result of the RANDEX.R VIRUS! Source=Paul Collins Startup list [Windows Services Host] Confirmed=X Filename=svchost.exe Description=Added as a result of the CONE VIRUS!. This is not the valid svchost.exe as described here. Located in the Windows directory, and not in Windows\\System32 Source=Paul Collins Startup list [Windows shell] Confirmed=? Filename=win70.exe Description=?? Source=Paul Collins Startup list [Windows Shell Library Loader] Confirmed=X Filename=load shell.dll /c /set Description=CoolWebSearch parasite related Source=Paul Collins Startup list [windows shellext.32] Confirmed=X Filename=mschost.exe Description=Added as a result of the BLASTER.K VIRUS! Source=Paul Collins Startup list [Windows Spooler] Confirmed=X Filename=SPOOLSRV.EXE Description=Added as a result of the SPYBOT.P VIRUS! Source=Paul Collins Startup list [Windows Startup] Confirmed=X Filename=winsta~1.exewinstartup.exe Description=Added by browser enhancement some people find annoying called "Go Hip". See here for details of what "Go Hip" is and the page also includes a link for removing it. Source=Paul Collins Startup list [Windows Startup] Confirmed=X Filename=Wdrun32.exe Description=Added as a result of the GAOBOT.AO VIRUS! Source=Paul Collins Startup list [Windows System Restorer] Confirmed=X Filename=SystemRestorer.exe Description=Added as a result of the DULOAD.C VIRUS! Source=Paul Collins Startup list [Windows System Tray] Confirmed=U Filename=msni.exe Description=Iambigbrother monitoring software Source=Paul Collins Startup list [Windows Task Manager] Confirmed=X Filename=ACCOUNT_DETAILS.DOC.exe Description=Added as a result of the QUATERS.A VIRUS! Source=Paul Collins Startup list [Windows Update] Confirmed=X Filename= Description=Added as a result of the NORIO VIRUS! Acts as a hi-jacker redirecting to adult content sites Source=Paul Collins Startup list [Windows Update] Confirmed=X Filename=iexplorere.exe Description=Added as a result of the GAOBOT.AP VIRUS! Source=Paul Collins Startup list [windows update] Confirmed=X Filename=uddater.exe Description=Added as a result of the LEOX VIRUS! Source=Paul Collins Startup list [Windows Update] Confirmed=X Filename=wudate.exe Description=Added as a resuklt of the AGOBOT.3.GEN VIRUS! Source=Paul Collins Startup list [Windows Update] Confirmed=X Filename=wupdate.exe Description=Wengs adware Source=Paul Collins Startup list [Windows Update Files] Confirmed=X Filename=dnetc.exe Description=Unidentified VIRUS! Note - wupdmgr.exe is the real Windows Update Source=Paul Collins Startup list [Windows Update.exe] Confirmed=X Filename=N/A Description=Homepage hijacker, see here Source=Paul Collins Startup list [Windows Updater] Confirmed=X Filename=wupdmgr32.exe Description=Added as a result of a variant of the DOS.AUTOCAT VIRUS! Source=Paul Collins Startup list [Windows Version Check] Confirmed=N Filename=ver_chk.exe Description=Version checker for CyberAudioLibrary ("A new way to exchange information through the Internet") Source=Paul Collins Startup list [Windows-System] Confirmed=X Filename=System32.exe Description=Added as a result of the LOGPOLE.C VIRUS! Source=Paul Collins Startup list [WindowsAgent] Confirmed=X Filename=WindowsAgent.exe Description=Added as a result of the GOP.G VIRUS! Source=Paul Collins Startup list [WindowsAPI.DLL] Confirmed=X Filename=Server5.exe Description=Added as a result of the "Fear and Hope" trojan Source=Paul Collins Startup list [WindowsCriticalUpdate] Confirmed=X Filename=windows_critical_update.exe Description=Added as a result of the ASTEF or RESPAN VIRUSES! Source=Paul Collins Startup list [WindowsMGM] Confirmed=X Filename=Winmgm32.exe Description=Added as a result of the SOBIG and LALA.C VIRUSES! Source=Paul Collins Startup list [WindowsSetup] Confirmed=X Filename= Description=Added as a result of the EZBOT VIRUS! Source=Paul Collins Startup list [WindowsUpd] Confirmed=X Filename=WindowsUpd4.exe Description=VirtuMonde adware Source=Paul Collins Startup list [WindowsUpdate] Confirmed=X Filename=windows_update.exe Description=Added as a result of the LOHACK.B VIRUS! Source=Paul Collins Startup list [WindowsUpdate] Confirmed=X Filename=svchost.exe Description=Added as a result of the ASTEF or RESPAN VIRUSES! Note - this is not the valid svchost.exe as described here Source=Paul Collins Startup list [windowsupdate] Confirmed=X Filename=RPCX1sQ3.exe Description=Added as a result of the IRCBOT.B VIRUS! Source=Paul Collins Startup list [Windows_VXD] Confirmed=X Filename=user32.exe Description=Added as a result of the PWSTEAL.PPORT VIRUS! Source=Paul Collins Startup list [Windowz Update V2.0] Confirmed=X Filename=Explorer.exe Description=Added as a result of the YODO VIRUS! Note - the valid "explorer.exe" is located in C:\\Windows or C:\\Winnt whereas this one is located in the System32 sub-directory Source=Paul Collins Startup list [windrv] Confirmed=X Filename=windrv32.exe Description=Unidentified VIRUS - possibly a strain of OBLIVION or BIONET Source=Paul Collins Startup list [WinDSL_MTU] Confirmed=? Filename=WinDSL_MTU.exe Description=May be realted to Tiscali broadband, if so is it required? Source=Paul Collins Startup list [WinDSNX] Confirmed=X Filename=Win????.exe Description=Added as a result of the DNSX VIRUS! Source=Paul Collins Startup list [WINDVDpatch] Confirmed=N Filename=CTHELPER.EXE Description=CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative�s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task.Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled Source=Paul Collins Startup list [WinDVR SchSvr] Confirmed=N Filename=SchSvr.exe Description=WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs Source=Paul Collins Startup list [WinDVRCtrl] Confirmed=N Filename=WinDVRCtrl.exe Description=Control center software for an AOpen VA1000 TV tuner card Source=Paul Collins Startup list [Windws Configuration Loader] Confirmed=X Filename=LEXPLORE.exe Description=Added as a result of the SODABOT VIRUS! Source=Paul Collins Startup list [WinEssential] Confirmed=X Filename=Keyhost.exe Description=Hijacker - hailing from jraun.com Source=Paul Collins Startup list [WinEssential] Confirmed=X Filename=keyword.exe Description=Jraun.com hijacker Source=Paul Collins Startup list [WinExec32] Confirmed=X Filename=WinExec32.exe Description=Added as a result of the KAZWIN VIRUS! Source=Paul Collins Startup list [WinFast Schedule] Confirmed=U Filename=Wfwiz.exe Description=Leadtek WinFast TV tuner scheduler Source=Paul Collins Startup list [Winfast2KLoadDefault] Confirmed=U Filename=Rundll32.exe Wf2kcpl.dll, DllLoadDefaultSettings Description=Loads default settings for Leadtek Winfast graphics cards Source=Paul Collins Startup list [Winfast_2K] Confirmed=U Filename=WF2k.exe Description=System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card Source=Paul Collins Startup list [WinFast_Gamma] Confirmed=U Filename=Rundll32.exe wfcpl.dll, DllLoadGammaRampSettings Description=Loads if you change the gamma settings on Leadtek WinFast graphics cards Source=Paul Collins Startup list [WinFavorites] Confirmed=X Filename=WinFavorites.exe1 Description=Loudmarketing.com adware downloader Source=Paul Collins Startup list [WinFax PRO Controller] Confirmed=N Filename=WFXCTL32.EXE Description=From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs Source=Paul Collins Startup list [WinFaxAppPortStarter] Confirmed=Y Filename=wfxsnt40.exe Description=WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application. Source=Paul Collins Startup list [WinFoxV2] Confirmed=U Filename=WF2k.exe Description=System Tray application that starts up the Winfox utility for a Leadtek Winfast grpahics card to restore settings. Can be started manually from Start -> Settings -> Control Panel Display. Only needed if you wish to run things like the hardware monitor or overclock your card Source=Paul Collins Startup list [WinFX] Confirmed=X Filename=cssrs.exe Description=Added as a result of the WORM_AGOBOT.FX VIRUS! Source=Paul Collins Startup list [WinGate] Confirmed=X Filename=WinGate.exe Description=Added as a result of the LOVGATE.G VIRUS! Source=Paul Collins Startup list [WinGate initialize] Confirmed=X Filename=WinGate.exe Description=Added as a result of the LOVGATE VIRUS! Source=Paul Collins Startup list [WinGuage Pro] Confirmed=N Filename=WGPRO32.EXE Description=Part of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications, to alert you to potential problems before they become serious". Resource hog. Available via Start -> Programs Source=Paul Collins Startup list [Winguard] Confirmed=Y Filename=WGFE95.EXE Description=Dr Solomon's Virex antivirus Source=Paul Collins Startup list [WinHacker] Confirmed=N Filename=rundll32.exe wh95.dll, HackMe Description=Tweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free Source=Paul Collins Startup list [Winhelp] Confirmed=X Filename=winhelp.exe Description=Added as a result of the LOVGATE.G VIRUS! Source=Paul Collins Startup list [Winhelp] Confirmed=X Filename=winhe1p.exe Description=Added as a result of the QQPASS.E VIRUS! Source=Paul Collins Startup list [Winhlp32] Confirmed=X Filename=Wscript.exe ..Msexec32.vbs Description=Added as a result of the GANT.B VIRUS! Source=Paul Collins Startup list [Winhost] Confirmed=X Filename=wintt.exe Description=Added as a result of the LOLAWEB.B VIRUS! Source=Paul Collins Startup list [wininetd] Confirmed=X Filename=wininetd.exe Description=Added as a result of the WINET VIRUS! Source=Paul Collins Startup list [wininit] Confirmed=X Filename=wininit.exe Description=Added as a result of the WOLLF.16 VIRUS! Source=Paul Collins Startup list [Wink*.exe] Confirmed=X Filename=Wink*.exe Description=Added as a result of a version of the KLEZ VIRUS! * represents any random characters Source=Paul Collins Startup list [Winkb6] Confirmed=U Filename=winkb6.exe Description=Part of We-Blocker, works in tandem with syswb6. Both files are needed to run WeBlocker. Required if We-Blocker is installed Source=Paul Collins Startup list [WinKernel] Confirmed=X Filename=WinKer.exe Description=Added as a result of the MIRAB or SERVIDOR VIRUSES! Source=Paul Collins Startup list [WinKernel] Confirmed=X Filename= Description=Added as a result of the PLEA.A VIRUS! Source=Paul Collins Startup list [winkernel32] Confirmed=X Filename=wWin32.com Description=Added as the result of the BANSAP VIRUS! Source=Paul Collins Startup list [WinKey] Confirmed=U Filename=winkey.exe Description=Loads Copernic's WinKey. Used to map out Windows key hotkey combinations. Not required for the system, but is necessary for this to be running if you use these hotkey combos Source=Paul Collins Startup list [WinLibUpdate] Confirmed=X Filename=libupdate.exe Description=Added as a result of the BIONET series of VIRUSES such as BIONET.31 or BIONET.310 Source=Paul Collins Startup list [WinLibUpdate32] Confirmed=X Filename=libupdate32.exe Description=Added as a result of the BIONET.405 VIRUS! Source=Paul Collins Startup list [WinLibUpdte] Confirmed=X Filename=libupdte.exe Description=Added as a result of the BIONET.318 VIRUS! Source=Paul Collins Startup list [Winlme] Confirmed=X Filename=windll.exe Description=Added as a result of the GOP.F VIRUS! Source=Paul Collins Startup list [WinLoader] Confirmed=X Filename= Description=Added as a result of versions of the SUBSEVEN VIRUS! Source=Paul Collins Startup list [winlocatorupdate] Confirmed=X Filename=updatewinlocator.exe Description=Locator adult content toolbar related Source=Paul Collins Startup list [winlogon] Confirmed=Y Filename=winlogon.exe Description=Windows Logon Process - handles user logons described here Source=Paul Collins Startup list [winlogon] Confirmed=X Filename=winlogon.exe Description=Hijacker or adult content dialler - file is located in C:\\Windows or C:\\Winnt, and not in it's System or System32 subdirectory, as is the case with the legitimate winlogon.exe file described here Source=Paul Collins Startup list [winlogon] Confirmed=X Filename=winlogin.exe Description=Added as a result of the RANDEX.E VIRUS!. This is not the valid winlogon.exe as described here Source=Paul Collins Startup list [winlogon] Confirmed=X Filename=winlogon.exe Description=Added as a result of the TRODAL VIRUS! - file is located in C:\\Windows or C:\\Winnt, and not in it's System or System32 subdirectory, as is the case with the legitimate winlogon.exe file Source=Paul Collins Startup list [Winlogon.exe] Confirmed=X Filename=N/A Description=CoolWebSearch parasite related - resets home page to an adult material site Source=Paul Collins Startup list [Winmain] Confirmed=X Filename=winmain.exe Description=One of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. BOClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled! Source=Paul Collins Startup list [WinManager] Confirmed=? Filename=schost.exe Description=?? Source=Paul Collins Startup list [winmatrix.exe] Confirmed=U Filename=WinMatrixXP.exe Description=WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop Source=Paul Collins Startup list [WinMenssage] Confirmed=X Filename=winmax.exe Description=Added as a result of the BANCOS.B VIRUS! Source=Paul Collins Startup list [WinMgmt] Confirmed=N Filename=WinMgmt.exe Description=Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth "scheduler" - refer here Source=Paul Collins Startup list [WinMgr32] Confirmed=X Filename=winmgr32.exe Description=Added as a result of the MIMAIL.P VIRUS! Source=Paul Collins Startup list [WinMine] Confirmed=X Filename=D4NG3.vbs Description=Added as a result of the BISCUIT.A VIRUS! Source=Paul Collins Startup list [winmodem] Confirmed=Y Filename=wmexe.exe Description=Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [winmysqladminorWinMySQLadmin Tool] Confirmed=N Filename=winmysqladmin.exe Description=Starts the MySQL database admin tool Source=Paul Collins Startup list [winnet] Confirmed=X Filename=winnet.exe Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [Winnov Menu] Confirmed=? Filename=WnvMenu.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [Winnov Remote] Confirmed=? Filename=WnvRsvr.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [Winnov Status] Confirmed=? Filename=WvStatus.Exe Description=Winnov Video Capture Card related. What does it do and is it required? Source=Paul Collins Startup list [WinNtBB] Confirmed=X Filename=WinntBB.exe Description=Added as a result of the DULOAD.C VIRUS! Source=Paul Collins Startup list [WinPatrol] Confirmed=U Filename=WinPatrol.exe Description=WinPatrol - "Manage Startup programs, tasks, cookies; will sniff out Worms, Trojan horses, Cookies, Adware, Spyware, Klez, Assumption and other malicious programs" Source=Paul Collins Startup list [WinPoet] Confirmed=Y Filename=WinPPPoverEthernet.exe Description=WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion, WinPoET is attractive to equipment providers, modem suppliers, RBOCs and ISPs. For more info read here. It uses dial-up networking for new high-speed internet customers who are more familiar with analogue modems. If unchecked in MSCONFIG it reports Error 360 - Hardware Error in dial-up networking Source=Paul Collins Startup list [WinPopup] Confirmed=N Filename=WINPOPUP.EXE Description=Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95, and maybe in WFWG 3.11. Normally it won't set itself up to run unless the user specifically adds it to startup Source=Paul Collins Startup list [winpopup] Confirmed=X Filename=winupie.exe Description=Adware by Tradeexit.com Source=Paul Collins Startup list [WinProfile] Confirmed=X Filename=Command.exe Description=Added as a result of the BUDDY VIRUS! Source=Paul Collins Startup list [WinProt] Confirmed=X Filename=Winprot.exeserver.exe Description=Added as a result of the CHUPACABRA VIRUS! Source=Paul Collins Startup list [WinProxy] Confirmed=U Filename=WinProxy.EXE Description="WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP" Source=Paul Collins Startup list [winpup32] Confirmed=X Filename=Winpup32.exe Description=Added as a result of the ADCLICKER VIRUS! Source=Paul Collins Startup list [winrar] Confirmed=X Filename=winrar.exe Description=CoolWebSearch parasite variant. Note! - this is not the file zipping utility also known as WinRAR and it's located in C:\\Winnt or C:\\Windows Source=Paul Collins Startup list [winrarshell] Confirmed=X Filename=winrarshell32.exe Description=Added as a result of the SALIRA VIRUS! Source=Paul Collins Startup list [winReg] Confirmed=X Filename=winReg.exe Description=Added as a result of the YAHA.H or YAHA.J VIRUSES! Source=Paul Collins Startup list [winregsrv] Confirmed=X Filename=winregsrv.exe Description=Added as a result of the SYNRG VIRUS! Source=Paul Collins Startup list [Winres32vis] Confirmed=X Filename= Description=Added as a result of the THRAX.A VIRUS! Source=Paul Collins Startup list [winroute] Confirmed=N Filename=winroute.exe Description=Win-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process, also to log in to the console to view logs and change settings. Can be unchecked and the engine still runs and functions normally. Can then use provided shortcuts for administration of the program. Loaded in SERVICES on Windows 2k Source=Paul Collins Startup list [winrun] Confirmed=X Filename=msconfig.exe Description=Added as a result of the WINUR VIRUS! Note - this is not the real msconfig.exe Source=Paul Collins Startup list [WinRunners] Confirmed=X Filename=WinDrivers.exe Description=Added as a result of the DULOAD.C VIRUS! Source=Paul Collins Startup list [winserver] Confirmed=X Filename=Server.txt.vbs Description=Added as a result of the DELTAD.A VIRUS! Source=Paul Collins Startup list [WinServices] Confirmed=X Filename=WinServices.exe Description=Added as a result of the YAHA.K or YAHA.M VIRUSES! Source=Paul Collins Startup list [winservn] Confirmed=X Filename=winservn.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [winservs] Confirmed=X Filename=winservs.exe Description=PurityScan/Clickspring adware Source=Paul Collins Startup list [WinSetBrowse] Confirmed=X Filename=BasicUpdate.dll.vbs Description=Added as a result of the BISCUIT.A VIRUS! Source=Paul Collins Startup list [Winshoe] Confirmed=? Filename=wuadfdqr.exe Description=Probably an unidentified VIRUS! Adds itself to 3 registry "Run" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed Source=Paul Collins Startup list [WinShowUpdate] Confirmed=X Filename=copy C:\\WINDOWS\\winshow.new C:\\WINDOWS\\winshow.dll Description=Winshow parasiate related - from the "RunOnce" keys it replaces "winshow.dll" with a new version Source=Paul Collins Startup list [Winsock2 driver] Confirmed=X Filename=SDJOIJE.EXE Description=Added as a result of the SPYBOT.DR VIRUS! Source=Paul Collins Startup list [Winsock2.dll] Confirmed=X Filename=WINLODR.SCR Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [Winsock32 driver] Confirmed=X Filename=Testing.exelcd.exeSdjoije.exe Description=Added as a result of the SPYBOT.B VIRUS! Source=Paul Collins Startup list [Winsock32driver] Confirmed=X Filename=win32server.scr Description=Added as a result of the HACARMY VIRUS! Source=Paul Collins Startup list [winsockdriver] Confirmed=X Filename=tskmg.exe Description=Added as a result of the SDBOT.GEN or WARPIGS.C VIRUSES! Source=Paul Collins Startup list [winsockdriver] Confirmed=X Filename=winsock2.2.exe Description=Added as a result of a variant of the SPYBOT VIRUS! Source=Paul Collins Startup list [WinSocketComponent] Confirmed=X Filename=nthost.exe Description=Added as a result of an unidentified VIRUS! Source=Paul Collins Startup list [WinSrv] Confirmed=X Filename=kn0x.exe Description=Added as a result of the HOBBIT.F VIRUS! Source=Paul Collins Startup list [WinSrv] Confirmed=X Filename=SHIZZLE.EXE Description=Added as a result of the HOBBIT.C VIRUS! Source=Paul Collins Startup list [Winsrv] Confirmed=X Filename=winsrv.exe Description=Added as a result of the OPASERV.T VIRUS! Source=Paul Collins Startup list [WinStart] Confirmed=X Filename=WinStart.exe Description=From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge Source=Paul Collins Startup list [WinStart] Confirmed=X Filename=Wscript.exe WinStart.vbs Description=Added as a result of the CIAN.C VIRUS! Source=Paul Collins Startup list [WinStart] Confirmed=X Filename=winstart32.exe Description=Added as a result of the PUROL VIRUS! Source=Paul Collins Startup list [WinStart001orWinStart001.EXE] Confirmed=X Filename=WinStart001.exe Description=From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words, with this installed, typing "car" in the IE address bar will point the browser to the Lexus web site. Foistware - installs components without your knowledge Source=Paul Collins Startup list [Winsta~1] Confirmed=X Filename=winsta~1.exe Description=GoHip foistware Source=Paul Collins Startup list [WinSth16] Confirmed=X Filename=WinSth16.exe Description=Added as a result of the CAKE VIRUS! Source=Paul Collins Startup list [winstro] Confirmed=X Filename=RUN32DLL.exe Description=Added as a result of the FTP_ANA VIRUS! Source=Paul Collins Startup list [Winsvc32] Confirmed=X Filename=Winsvc32.exe Description=Homepage hijacker Source=Paul Collins Startup list [Winsys] Confirmed=U Filename=Winsys.exe Description=Win-Spy - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it Source=Paul Collins Startup list [WinSys32] Confirmed=X Filename=Winsys32.exe Description=Added as a result of the CIGIVIP or RECKUS VIRUSES! Source=Paul Collins Startup list [winsyslog lptt01] Confirmed=X Filename=winsyslog.exe Description=Variant of the RapidBlaster parasite (in a "Winsyslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [WinSysStartUpWKbLw] Confirmed=X Filename=TaskSystemDll.Exe Description=Added as a result of the BACKZAT.G VIRUS! Source=Paul Collins Startup list [WinSyst32] Confirmed=X Filename=winsyst32.exe Description=Added as a result of the MORB VIRUS! Source=Paul Collins Startup list [WinSystem] Confirmed=X Filename=winsystem.exe Description=Added as a result of the WHITEBAIT VIRUS! Source=Paul Collins Startup list [WinTask] Confirmed=X Filename=Wintask.exe Description=Added as a result of the HIPO or LEMIR.F VIRUSES! Source=Paul Collins Startup list [WinTasks Traybar] Confirmed=U Filename=wintasks.exe Description=WinTasks - "Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task, but will actually make your system run faster and more smoothly than ever before" Source=Paul Collins Startup list [Wintercooler Pro] Confirmed=N Filename=WINCOOL.EXE Description=Wintercooler Pro - utility that monitors CPU usage, RAM consumption and Internet connection speed Source=Paul Collins Startup list [WinTidy] Confirmed=N Filename=WinTidy.exe Description=Desktop icon manager from PC Magazine (Ziff-Davis) for Win95. Available via Start -> Programs Source=Paul Collins Startup list [Wintime Wtxpload] Confirmed=N Filename=Wxpload.exe Wintime Description=Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet, if it's not already running. It then starts an application which manages the tablet messages. Since I leave the tablet unplugged unless I need to use it, I don't need this running at startup. I suspect that this program monitors a number of windows messages, so that when it's loaded, my regular mouse slows down - it acts like it 'sticks' entering and leaving windows. Certainly my performance returned to what I expected when I removed this item using MSCONFIG" Source=Paul Collins Startup list [WinTOTAL Scheduler] Confirmed=N Filename=guru.exe Description=WinTOTAL Real estate appraisal software related Source=Paul Collins Startup list [WinTray] Confirmed=X Filename=wintray.exe Description=Added as a result of the LEGUARDIEN.B VIRUS! Source=Paul Collins Startup list [WinUPD32] Confirmed=X Filename=explorer.exe Description=Unidentified VIRUS! Source=Paul Collins Startup list [WinUpdate] Confirmed=X Filename=RBSKQQBO.EXE Description=Added as a result of the VBS.Vbswg2b.A@mm VIRUS! Source=Paul Collins Startup list [winupdate.exe] Confirmed=X Filename=winupdate.exe Description=Added as a result of the RADO VIRUS! Source=Paul Collins Startup list [Winux Piriax Service] Confirmed=X Filename=PH32.EXE Description=Added as a result of the RANDEX.G VIRUS! Source=Paul Collins Startup list [WinVNC] Confirmed=U Filename=WinVNC.exe Description=WinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet Source=Paul Collins Startup list [winwan lptt01orwinwan ml097e] Confirmed=X Filename=winwan.exe Description=Variant of the RapidBlaster parasite (in a "Winwan" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [WinXPLoad] Confirmed=U Filename=Rundll32 LoadDll, LoadExe WinXPLoad.exe Description=Compaq hotkey related - required if you use the hotkeys Source=Paul Collins Startup list [WinZip Quick Pick] Confirmed=N Filename=WZQKPICK.EXE Description=Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up Source=Paul Collins Startup list [Win_api_driver] Confirmed=X Filename=system.exe Description=Added as a result of the REVIRD VIRUS! Source=Paul Collins Startup list [Win_Library] Confirmed=X Filename=INISvc.exe Description=Added as a result of the ANARCH VIRUS! Source=Paul Collins Startup list [Win_vader] Confirmed=X Filename=Win_vader.vbs Description=Added as a result of the INVASION.A VIRUS! Source=Paul Collins Startup list [Wireless PCI Card Configuration Utility] Confirmed=U Filename=WMP11Cfg.exe Description=Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration Source=Paul Collins Startup list [Wireless-G Notebook Adapter Utility] Confirmed=U Filename=WPC54CFG.EXE Description=Utility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G) Source=Paul Collins Startup list [wjview] Confirmed=N Filename=wjview.exe Description=MS tool used to view window-based Java applications from the command line Source=Paul Collins Startup list [wkcalrem] Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [WkDetect] Confirmed=N Filename=WkDetect.exe Description=Checks for updates to MS Works Source=Paul Collins Startup list [wkfud] Confirmed=N Filename=wkfud.exe Description=A marketing program for MS Works Source=Paul Collins Startup list [WksSb] Confirmed=N Filename=WksSb.exe Description=The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file Source=Paul Collins Startup list [WkUFind] Confirmed=N Filename=WkUFind.exe Description=MS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet, if you have your system set to automatically dial when the internet is invoked. To manually update, go to Microsoft's Office/Works update site Source=Paul Collins Startup list [WLAN Status Tray Applet] Confirmed=N Filename=WLANSTA.EXE Description=System Tray icon for checking the status of a Wireless LAN Source=Paul Collins Startup list [WLAN_Cfg.exe] Confirmed=Y Filename=WLAN_Cfg.exe Description=Linksys Instant Wireless USB Network Adapter driver Source=Paul Collins Startup list [WMBoot] Confirmed=N Filename=N/A Description=Associated with Logitech Wingman game controllers. Not required but what does it do? Source=Paul Collins Startup list [WMIEXE.exe] Confirmed=U Filename=wmiexe.exe Description=NT component, used by Windows Millennium to detect Plug and Play-compliant IEEE 1394 devices during the startup process. Since this is important for the computer to work properly if you have these, Windows Millennium protects wmiexe.exe and will restore the file even if it's deleted or renamed. Check here for some details on what to do to stop it loading Source=Paul Collins Startup list [Wminf] Confirmed=X Filename=Wminf.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [Wminfo] Confirmed=X Filename=Wminfo.exe Description=Added as a result of the GEMA VIRUS! Source=Paul Collins Startup list [wmsys32] Confirmed=X Filename=wmsys32.exe Description=Added as a result of the BANPAES.B VIRUS! Source=Paul Collins Startup list [WM_LOGIN] Confirmed=? Filename=MSGLOGIN.EXE Description=Part of McAfee Firewall. What is it for and is it needed? Source=Paul Collins Startup list [WNAD] Confirmed=X Filename=WNAD.EXE Description=Spyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like Source=Paul Collins Startup list [Woowatch] Confirmed=N Filename=Watch.exe Description=Wanadoo ISP software, not required Source=Paul Collins Startup list [WordWeb] Confirmed=N Filename=wweb32.exe Description=WordWeb - free theasaurus and dictionary. Start manually Source=Paul Collins Startup list [Workflo] Confirmed=? Filename=workflow.exe Description=Related to BroadJump Client Foundation - broadband troubleshooting software installed by various companies. Is it required? Source=Paul Collins Startup list [Works Calendar Reminder] Confirmed=N Filename=wkcalrem.exe Description=Produces a pop-up reminder of events scheduled using the MS Works Calendar Source=Paul Collins Startup list [WorksFUD] Confirmed=N Filename=wkfud.exe Description=A marketing program for MS Works Source=Paul Collins Startup list [Workstation Scheduler] Confirmed=U Filename=wm95.exe Description=Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled, it is required, otherwise, it is useless and a memory hog Source=Paul Collins Startup list [Worm Detector] Confirmed=U Filename=wd.exe Description=Worm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam Source=Paul Collins Startup list [wormexe] Confirmed=X Filename=winstart.exe Description=Added as a result of the EARLYBIRD VIRUS! Source=Paul Collins Startup list [Wpctrlorwpctrl95] Confirmed=N Filename=wpctrlnt.exewpctrl95.exe Description=WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens, for example). Shortcut available via Display Properties Source=Paul Collins Startup list [WPCycle.exe] Confirmed=Y Filename=WpCycleWin.exe Description=Added when selecting Mplayer2 to open media files. Forces other codes to Wait for Previous instructions to end, preventing instability of your CPU (freezing) Source=Paul Collins Startup list [WQK] Confirmed=X Filename=WQK.exe Description=Added as a result of a version of the KLEZ VIRUS! Source=Paul Collins Startup list [wr] Confirmed=? Filename=WR.EXE Description=?? Source=Paul Collins Startup list [WR Command] Confirmed=? Filename=wr.exe Description=?? Source=Paul Collins Startup list [WrCtrl] Confirmed=N Filename=WrCtrl.exe Description=Win-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not work, but you can manually start/stop the service with a shortcut the program installs at any time Source=Paul Collins Startup list [WRDialer] Confirmed=X Filename=WrDialer.exe Description=WinPoet DSL dialler Source=Paul Collins Startup list [WRECK GUARD] Confirmed=? Filename=?? Description=?? Source=Paul Collins Startup list [WregBios] Confirmed=? Filename=wregbios.exe Description=Desktop Management BIOS (DMI BIOS) related. Apparently invokes the DosBios.exe file. Is it required? Source=Paul Collins Startup list [wrexec] Confirmed=U Filename=wrexec.exe Description=Watch Right - monitoring program, part of the PowerTools add-on for AOL. Records instant messages, E-mail, chat. Watch Right appears to be, and functions as an online clock updater which connects with the U.S. National Institute of Standards and Technology. It was designed for parents who wish to keep an eye on what their children are doing online Source=Paul Collins Startup list [wriste] Confirmed=? Filename=wriste.exe Description=?? Source=Paul Collins Startup list [WScheduler] Confirmed=U Filename=WScheduler.exe Description=Windows Scheduler - "schedule unattended running of applications, batch files, scripts and much more. Also, you can schedule popup reminders so you'll never forget reminders, tasks and other events." Source=Paul Collins Startup list [WService] Confirmed=U Filename=WService.exe Description=Tablet client Driver for UC-Logic Pen/Graphics Tablet Source=Paul Collins Startup list [wstimeb] Confirmed=Y Filename=wstimeb.exe Description=Used with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it Source=Paul Collins Startup list [wswpd] Confirmed=Y Filename=wswpd.exe Description=Used with some models of Panasonic, Epson and NEC printers. Some older drivers known to have a "memory leak". Needed for printing to work Source=Paul Collins Startup list [WT Game ChannelorWT GameChannel] Confirmed=N Filename=GameChannel.exewtgamechannel.exe Description=Wild Tangent GameChannel - notification of new games, quick access to games and fast and easy game downloads. Note that Wild Tanget's privacy policy states they also collect and share individuals information Source=Paul Collins Startup list [WTIndicator] Confirmed=U Filename=SchedInd.exe Description=WinTask - software that automates a variety of routine tasks quickly and simply Source=Paul Collins Startup list [WUOLService] Confirmed=Y Filename=WUOLService9x.exe Description=Remote wakeup status agent. Part of Novell's ZenWorks. Processes Wake-up on LAN requests (turn on a computer remotely on LAN) Source=Paul Collins Startup list [WUPD] Confirmed=X Filename=iglmtray.exe Description=Added as a result of the TZET VIRUS! Source=Paul Collins Startup list [wupdt] Confirmed=X Filename=wupdt.exe Description=Added as a result of the IMISERV VIRUS! Source=Paul Collins Startup list [WUSB11B.exe] Confirmed=Y Filename=WUSB11B.exe Description=Linksys WUSB11 WLAN USB adapter Source=Paul Collins Startup list [WUx_RegSvr] Confirmed=? Filename=RegSvr32.exe Description=x is any number?? Source=Paul Collins Startup list [www.hidro.4t.com] Confirmed=X Filename=enbiei.exe Description=Added as a result of the BLASTER.F VIRUS! Source=Paul Collins Startup list [WXProcMgr Module] Confirmed=N Filename=WXprocMgr.exe Description=TVTonic from Wavexpress - "enjoy 3 full-screen, DVD-quality video channels for FREE". Allows data content to be downloaded and synchronized on your system Source=Paul Collins Startup list [wzhelper] Confirmed=X Filename=wzhelper.exe Description=Searchcentrix hijacker Source=Paul Collins Startup list [X Server] Confirmed=U Filename=X.exe Description="XoftWare for Windows" enables you to run network-based UNIX programs ("X programs" or "clients") side-by-side with Windows applications on your personal computer. You can also share programs and computing resources with host computers connected to your PC over a network Source=Paul Collins Startup list [X-Grabber] Confirmed=N Filename=sswizard.exe Description=ScreenShot Wizard Source=Paul Collins Startup list [x3watch] Confirmed=U Filename=x3watch.exe Description="program helping with online integrity. Whenever you browse the internet and accesses a site which may contain questionable material, the program will save the site name on your computer. Approximately every 30 days, a person of your choice (an accountabiltiy partner) will receive an e-mail containing all possible questionable sites you may have visited within the month. This information is meant to encourage an open and honest conversation between friends and help us all be more accountable" Source=Paul Collins Startup list [Xanadu] Confirmed=N Filename=Xanadu.exe Description=Xanadu - free language and translation wizard from Foreignword Source=Paul Collins Startup list [xBrotherMeCom] Confirmed=? Filename=BrMeCom.exe Description=Related to Brother MFC-9200c printer. What does it do and is it required? Source=Paul Collins Startup list [XE 8x LM Status] Confirmed=U Filename=lmsxxe.exe Description=Xerox XE8 series laser printer status monitor Source=Paul Collins Startup list [Xecuter.bat] Confirmed=X Filename=psexec.bat Description=Added as a result of the BOOHOO VIRUS! Source=Paul Collins Startup list [XemiCo] Confirmed=N Filename=ADC.EXE Description=XemiComputers Active Desktop Calendar Source=Paul Collins Startup list [xicon] Confirmed=? Filename=xicon.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [XiD] Confirmed=X Filename=mmx.exe Description=Added as a result of the ANALOGX VIRUS! Source=Paul Collins Startup list [XircWinModem4] Confirmed=Y Filename=ltcm000c.exe Description=WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information Source=Paul Collins Startup list [xitami] Confirmed=U Filename=Xiwin32.exe Description=Xitami Multiplatform Open Source web server Source=Paul Collins Startup list [xkstartup] Confirmed=? Filename=RunDll32 InstZ82.dll, SetUsbPrinterPort Description=On a system with a Lexmark printer Source=Paul Collins Startup list [XNSearchAssistant] Confirmed=X Filename=SrchAsst.exe Description=iWon Search Assistant - spyware Source=Paul Collins Startup list [Xpagent] Confirmed=? Filename=xpagent.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [xpcfg] Confirmed=? Filename=xpcfg.exe Description=?? Source=Paul Collins Startup list [Xpclient] Confirmed=? Filename=xpclient.exe Description=Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required? Source=Paul Collins Startup list [xpsystem] Confirmed=X Filename=y.exeservices.exe Description=CoolWebSearch parasite variant Source=Paul Collins Startup list [XStop95] Confirmed=U Filename=XStop95.exe Description=XStop - internet filter Source=Paul Collins Startup list [xswin] Confirmed=N Filename=xswin.exe Description=Installed with a Xerox Work Centre Pro 555. Unchecking it removes an "out of system memory" error Source=Paul Collins Startup list [XTCsgloader] Confirmed=? Filename=XTCsgloader.exe Description=Another Xupiter toolbar variant?? Source=Paul Collins Startup list [XTNDConnect PC - 3CmPlm] Confirmed=U Filename=Autodet.exe Description=Component of EasySync Pro. Synchronisation between Palm PDAs and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - ErPhn2] Confirmed=U Filename=ErPhn2.exe Description=Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - ErTray] Confirmed=U Filename=ErTray.exe Description=Component of EasySync Pro. Synchronisation between SonyEricsson mobile phones and Microsoft Outlook Source=Paul Collins Startup list [XTNDConnect PC - LtNts4] Confirmed=U Filename=NtsAgnt.exe Description=Component of EasySync Pro Source=Paul Collins Startup list [XtreamLok License Manager] Confirmed=U Filename=xl.exe Description=License manager for xLok (XtreamLok) - prevents software being reverse engineered Source=Paul Collins Startup list [xuio.exe] Confirmed=? Filename=xuio.exe Description=?? Source=Paul Collins Startup list [Xupiter Startup] Confirmed=X Filename=XupiterStartup.exe Description=Xupiter - adware and homepage hijacker. To remove Xupiter go here and to prevent it re-installing in the future see here Source=Paul Collins Startup list [XupiterCfgLoader] Confirmed=X Filename=XTCfgLoader.exeBWCfgLoader.exe Description=Xupiter - adware and homepage hijacker. To remove Xupiter go here and to prevent it re-installing in the future see here Source=Paul Collins Startup list [xupiterstartup2003] Confirmed=X Filename=xupiterstartup2003.exe Description=Xupiter - adware and homepage hijacker. To remove Xupiter go here and to prevent it re-installing in the future see here Source=Paul Collins Startup list [XupiterToolbarLoader] Confirmed=X Filename=XupiterToolbarLoader.exe Description=Xupiter - adware and homepage hijacker. To remove Xupiter go here and to prevent it re-installing in the future see here Source=Paul Collins Startup list [xv_ctrl] Confirmed=U Filename=v_ctrl.exe Description=3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter" Source=Paul Collins Startup list [XWMSUSBAPI] Confirmed=? Filename=XWMSAPI.EXE Description=Part of the installation of a Xerox WorkCentre printer/scanner. Is it required? Source=Paul Collins Startup list [XXXmpeg] Confirmed=X Filename=XXXmpeg.exe Description=Adult content dialler Source=Paul Collins Startup list [Yahoo HP Reminder 1.1] Confirmed=? Filename=yr.exe Description=?? Source=Paul Collins Startup list [Yahoo! Pagerorypager] Confirmed=N Filename=ypager.exe Description=Yahoo! Messenger allows you to send instant messages. Available via Start -> Programs Source=Paul Collins Startup list [YahooStock] Confirmed=X Filename=Prmvr.exeystckAO32.exe Description=Adtomi adware Source=Paul Collins Startup list [yahoo_toolbar lptt01oryahoo_toolbar ml097e] Confirmed=X Filename=yahoo_toolbar.exe Description=Variant of the RapidBlaster parasite (in a "yahoo_toolbar" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here Source=Paul Collins Startup list [YAMAHA DS-XG Launcher] Confirmed=N Filename=dslaunch.exe Description=System Tray access for the features of the Yamaha DS-XG soundcard unless you regularly change set-ups Source=Paul Collins Startup list [Yankee Clipper III] Confirmed=N Filename=YankClip.exe Description=Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures, Richtext, URLS, etc - any size. Features printing, drag and drop, optional permanent storage of clippings. Familiar "Outlook" interface'. Freeware Source=Paul Collins Startup list [YBrowser] Confirmed=N Filename=ybrwicon.exe Description=SBC Yahoo! Browser system tray icon Source=Paul Collins Startup list [YOW tuner] Confirmed=? Filename=WatchPNM.exe Description=?? Source=Paul Collins Startup list [YPC] Confirmed=U Filename=ypc.exe Description=Yahoo Parental controls - "Let you decide what type of sites and Yahoo! services your kids can access" Source=Paul Collins Startup list [YTrayMagic Lite 1] Confirmed=Y Filename=YTRAYMAGIC.EXE Description=YTrayMagic from YoconSoft automatically restores your tray icons after an Explorer(the windows shell) crash. Leave to run at startup since only those icons that are in the taskbar after YTrayMagic has initialized will be restored Source=Paul Collins Startup list [ywzizdon] Confirmed=X Filename=ywzizdon.exe Description=Free_Scratch_Cards foistware Source=Paul Collins Startup list [yyyyyyyy] Confirmed=X Filename= Description=Added as a result of the MUMUBOY.B VIRUS! Source=Paul Collins Startup list [yz.exe] Confirmed=X Filename=yz.exe Description=Added as a result of the VARDO VIRUS! Source=Paul Collins Startup list [z-WrDialer] Confirmed=U Filename=WrDialer.exe Description=WinPoet DSL dialer Source=Paul Collins Startup list [ZaCker] Confirmed=X Filename=.PIF Description=Added as a result of the HOLAR.A VIRUS! where <filename> is the worm filename Source=Paul Collins Startup list [Zacker] Confirmed=X Filename=Zacker.exe Description=Added as a result of the GEMEL VIRUS! Source=Paul Collins Startup list [Zapro] Confirmed=Y Filename=Zapro.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [zBrowser Launcher] Confirmed=N Filename=iTouch.exeCommandr.exe Description=For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys Source=Paul Collins Startup list [zcproo] Confirmed=X Filename=qssstiej.exe Description=Possible homepage hijacker installing a toolbar: http://tdko.com/ ,Lop.com in disguise. see this thread Source=Paul Collins Startup list [zdnet] Confirmed=N Filename=kontiki.exe Description=Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops Source=Paul Collins Startup list [Zebus] Confirmed=N Filename=msdc32.exe Description=Runs a HTML tutorial on the Zebus web-site Source=Paul Collins Startup list [Zenet] Confirmed=X Filename=rundll32 CNBabe.dll, DllStartup Description=CommonName Toolbar spyware. To uninstall see here Source=Paul Collins Startup list [ZENRC] Confirmed=Y Filename=zenrc32.exe Description=The main component of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Leave well alone Source=Paul Collins Startup list [ZENRC Tray Icon] Confirmed=Y Filename=zentray.exe Description=Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Best left alone Source=Paul Collins Startup list [ZENworks Imaging Service] Confirmed=Y Filename=ZISWin.exe Description=Imaging Agent. Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management" Source=Paul Collins Startup list [ZeroAds] Confirmed=U Filename=0 Description=ZeroAds - culls ads, cookies and pop-ups. Tells ZeroAds not to run at startup - needed to start it manually Source=Paul Collins Startup list [ZeroAds] Confirmed=U Filename=LAS0Ads.exe Description=ZeroAds - culls ads, cookies and pop-ups. Required for the cookie interception to work Source=Paul Collins Startup list [ZGNUBI] Confirmed=? Filename=ZGNUBI.exe Description=?? Source=Paul Collins Startup list [ZIBMACC] Confirmed=X Filename=rundll.exe -> ZIBMACC.INF Description=ZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Technical Support (USA - 800-887-7435) Source=Paul Collins Startup list [ZingSpooler] Confirmed=U Filename=ZingSpooler.exe Description=Was used for a drag and drop program to upload pictures to www.zing.com but Zing has gone out of business. Now used for Sony ImageStation's upload photos to online albums Source=Paul Collins Startup list [Zinio DLM] Confirmed=N Filename=ZDLM.EXE Description=Zinio - used to read magazines in digital rather than paper format Source=Paul Collins Startup list [Zip Driver Loader] Confirmed=X Filename=ZipLoader32.exemsload32.exe Description=Added as a result of the OBLIVION VIRUS! The two executables shown are the most common but there are more Source=Paul Collins Startup list [ZipDisk Icons] Confirmed=U Filename=IMGICON.EXE Description=Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running Source=Paul Collins Startup list [ZipGenius Clean] Confirmed=N Filename=zg.exe Description=ZipGenius file compression utility Source=Paul Collins Startup list [ZipMagic] Confirmed=N Filename=zm32.exe Description=Zip utility by Ontrack. Preloading ZipMagic allows you to access files within a zip archive without unzipping them first Source=Paul Collins Startup list [zlclientorZone Labs Client] Confirmed=Y Filename=zlclient.exe Description=Firewall program from Zonelabs. Pro version inlcudes other online security options Source=Paul Collins Startup list [ZLH] Confirmed=U Filename=ZLH.EXE Description=System Tray icon for Norman Antivirus Source=Paul Collins Startup list [Zonavirus] Confirmed=X Filename=0 Description=Added as a result of the KITRO.D (or ARGEN.A) VIRUS! Source=Paul Collins Startup list [ZoneAlarm] Confirmed=Y Filename=zonealarm.exe Description=Firewall program from Zonelabs - free version Source=Paul Collins Startup list [ZoneAlarm Plus] Confirmed=Y Filename=zaplus.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [ZoneAlarm Pro] Confirmed=Y Filename=Zapro.exe Description=Firewall program from Zonelabs - paid for version Source=Paul Collins Startup list [Zoom] Confirmed=U Filename=zoom.exe Description=Zoom - speeds up Windows startup and manages startup applications Source=Paul Collins Startup list [ZPOINT32] Confirmed=Y Filename=ZPOINT32.exe Description=USB graphics/writing tablet driver Source=Paul Collins Startup list [zSPGuard] Confirmed=U Filename=Spguard.exe Description="StartPage Guard (SPG) protects your PC from cyberscam, by detecting and preventing any unauthorized changes to your internet browser's Start and Search pages. It is also capable of removing automatically most of known 'invaders'." Source=Paul Collins Startup list [ZtgServerSwitch] Confirmed=X Filename=server.vbs Description=ZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spyware Source=Paul Collins Startup list [Zupdate] Confirmed=X Filename=Zupdate.exe Description=B3d Projector - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in C:\\Windows\\System. (3) Disable and ideally delete it from the registry. (4) Remove the "BDE" directory and all its contents Source=Paul Collins Startup list [zzborzzb2] Confirmed=X Filename=zzb.exeorzzb2.exe Description=IAGold adware downloader Source=Paul Collins Startup list [zzgshp] Confirmed=X Filename=gshp.vbs Description=Homepage hi-jacker that re-defines your IE or Netscape start page Source=Paul Collins Startup list [zzz-hpi-boot] Confirmed=? Filename=hpi-boot.exe Description=Associated with HP Photosmart printers Source=Paul Collins Startup list [zzzCamlnSuitelll] Confirmed=? Filename=setup.exe 46*** Description=?? Source=Paul Collins Startup list [zzzhpsetup] Confirmed=? Filename=setup.exe Description=?? Source=Paul Collins Startup list [\\MSMcAfeee] Confirmed=X Filename=Avsynmgr32e.exe Description=Added as a result of the FRAMAR VIRUS! Source=Paul Collins Startup list [_winadm] Confirmed=U Filename=winadm.exe Description=Parents Friend - "Log any activity and protect programs with a password. Further more you can lock the pc any hour in the week you want with the main password. You can also give users allowed programs in their program-lists and you can limit the maximal daily hours and maximal weekly hours user spend on the PC" Source=Paul Collins Startup list [_x-Finder] Confirmed=X Filename=_x-Finder.exe Description=Disconnects and redials an ISP modem to an adult content site Source=Paul Collins Startup list [{2CF0B992-5EEB-4143-99C0-5297EF71F444}] Confirmed=X Filename=rundll32.exe stlbdist.dll, DllRunMain Description=BrowserAid/Startium parasite Source=Paul Collins Startup list [{2CF0B992-5EEB-4143-99C2-5297EF71F44B}] Confirmed=X Filename=rundll32.exe stlbupdt.DLL, DllRunMain Description=BrowserAid/Startium parasite Source=Paul Collins Startup list