U | Cookie Pal | CPBRWTCH.EXE | "Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
|
U | CookieJar | Cookiejar.exe | "Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return. No longer being actively supported"
|
U | CookiePatrol | CookiePatrol.exe | "CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition"
|
U | CookieWall | cookie.exe | "CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return"
|
X | cookw | cookw.exe | "Part of the ErrClean rogue system error and cleaning utility - not recommended. See here"
|
U | Cool Desk | cdesk.exe | "Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you"
|
X | CoolDownloads | "rundll32.exe MSA64CHK.dll | DllMostrar" |
U | CoolMon | CoolMon.exe | """CoolMon monitors vital system stats and almost anything else you wish to display on the desktop"""
|
X | CoolMP3 | "rundll32.exe MSA64CHK.dll | DllMostrar" |
U | CoolSwitch | taskswitch.exe | ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen
|
N | Coolwallpaper | cwm_tray.exe | "Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers"
|
X | coolwebprogram | clrssn.exe | "CoolWebSearch Smartsearch parasite variant"
|
N | Copernic Desktop Search | DesktopSearch.exe | "Copernic Desktop Search - ""Easily search your entire hard drive in less than a second to pinpoint the right file |
U | Copernic Desktop Search 2 | DesktopSearchService.exe | "Copernic Desktop Search - search agent"
|
U | CopernicPerUserTaskMgr | CopernicPerUserTaskMgr.exe | Automatic tasking feature of Copernic Pro multi-search engine tool
|
U | Copperhead | razerhid.exe | "Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
|
U | Copy handler | Copy Handler.exe | "Copy Handler lets you copy between hard disks |
N | Copyright | mwcpyrt.exe | Displays copyright information on IBM ThinkPads
|
X | Core Process Aplication | ccapl.exe | "Added by the QHOSTS.G TROJAN!"
|
X | Core Process Aplication x16 | ccapl16.exe | "Added by the SPYBOT.AFT WORM!"
|
X | Core Process Aplication x32 | ccapl32.exe | "Added by the SRAMLER.E TROJAN!"
|
X | Core System Hardware | syscorehd.exe | "Added by a variant of the IRCBOT BACKDOOR! See here"
|
U | CoreCenter | CoreCenter.exe | "MSI Core Center - motherboard utility for monitoring CPU speed |
U | CoreCenter | CORECE~1.EXE | "MSI Core Center - motherboard utility for monitoring CPU speed |
X | Coreguard Antivirus 2009 | Coreguard 2009.exe | "Coreguard Antivirus 2009 rogue security software - not recommended |
N | Corel Colleagues & Contacts Reminders | cffrem.exe | "Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings |
N | Corel Desktop Application Director | dadx.exe | The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
|
N | Corel Family & Friends reminders | CFFREM.EXE | "Corel Family & Friends - all-in-one calender |
N | Corel Photo Downloader | MediaDetect.exe | "Related to Corel Photo Album"
|
N | Corel Registration | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it
|
N | Corel Registration Reminder | Remind32.exe | If you don't want to register Corel products and be reminded about it every 2 weeks disable it
|
N | Corel Reminder | NAVBROWSER.EXE | If you don't want to register Corel products and be reminded about it every 2 weeks disable it
|
N | Corel Reminder | NAVBrowser.exe | Registration reminder for CorelDRAW 10
|
N | CorelCENTRAL 10 | I_26dadCC.exe | "CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs"
|
X | CorelDraw Toolbox | CorelDraw.exe | "Added by the SDBOT-VZ WORM!"
|
N | CorelMedia FoldersIndexer8 | MFindexer.exe | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
|
N | CorelMedia FoldersIndexer8 | MFINDE~1.EXE | Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
|
X | CoreSrv | coresrv.exe | "Some IRC trojans/worms use this - see here for more information"
|
? | CORESYS | coresys.exe | "??"
|
X | Corporate Microsoft Update | uptask.exe | "Added by the RBOT-GVB WORM!"
|
N | CorrectConnect | CConnect.exe | Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
|
X | cosine | cosine.exe | "Added by the RBOT-SW WORM!"
|
U | CostAware | niIPCApp.exe | "NetInternals CostAware - download quota measuring tool"
|
X | Counterstrike Service Agent | czrzns.exe | "Added by the MEDBOT.AR WORM!"
|
N | Country Select | pctptt.exe | "Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell |
N | CountrySelection | pctptt.exe | "Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell |
? | Coupon Offers | ?? | "??"
|
X | couponica | couponica.exe | "Adware - see here"
|
? | CP | CopyProtectionNotifier.exe | "Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
|
U | CP32NOT | CP32BTN.EXE | For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons
|
U | CP4HPOT | OneTouch.EXE | "Supports the additional multimedia keys on HP/Compaq laptops which give single button press access to standard functions such as Mail |
N | CP888M1 | CP888M1.EXE | Related to EZbutton quick launcher for the Media player app that comes with certain laptops
|
? | CPA9P2PSERVER | CPA9P2PS.exe | "Found on a Compaq Presario but what is it?"
|
X | cpanel | winlogin32.exe | "Added by the RBOT-FOY WORM!"
|
U | CPATR10 | CPATR10.EXE | "Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba |
U | CPBrWtch | CPBrWtch.exe | "Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
|
X | CPCmscl0ck | CPCmsclock.ExE | "Added by the IRCFLOOD.BF TROJAN!"
|
Y | CPD_EXE | CPD.EXE | Firewall bundled with McAfee VirusScan 6.*
|
X | cpl | deamon.exe | "Added by the TACTSLAY.C TROJAN!"
|
X | cpl | msgaol.exe | "Added by the TACTSLAY.C TROJAN!"
|
X | cpl | s_menu.exe | "Added by the TACTSLAY.C TROJAN!"
|
X | cpl | browse.exe | "Added by the TACTSLAY.C TROJAN!"
|
N | CplBTQ00 | CplBTQ00.EXE | Related to EZbutton quick launcher for the Media player app that comes with certain laptops
|
N | CPLDBL10 | CPLDBL10.exe | Related to EZbutton quick launcher for the Media player app that comes with certain laptops
|
U | CPLDFL10 | CPLDFL10.EXE | Part of the EzButton feature on some Toshiba (and maybe others) laptops which support additional buttons
|
X | cpntmgc | wincomp.exe | "Added by the WINTRIM.A TROJAN!"
|
X | cpntmgc | simcss.exe | "Added by the MAGICON.A TROJAN!"
|
X | cpntmgc | navpmc.exe | "Added by the SIMCSS TROJAN!"
|
X | cpntmgc | winmgts.exe | "Added by the WINTRIM-B TROJAN!"
|
? | CPortPatch | cppatch.exe | "CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
|
X | cppc | [path to trojan] | "Added by the VB-NV BACKDOOR!"
|
Y | CPQAcDc | CPQAcDc.exe | Compaq PowerCon power management software for laptops
|
U | CPQAlert | CPQAlert.exe | "Compaq's Insight Manager Agent - a tool that allows for ""fault |
N | CPQBootPerfDB | CPQBootPerfDB.EXE | See the entry for Compaq Message Server
|
Y | CPQCalib | CPQCalib.exe | Compaq PowerCon power management software for laptops
|
N | CPQDFWAG | CpqDfwAg.exe | For Compaq PC's. Runs Compaq diagnostics on every boot
|
U | CPQEASYACC | cpqeadm.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
|
U | CPQEASYACC | StartEAK.exe | "Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
|
U | CPQEASYACC | STARTDRV.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
|
U | cpqeaui | cpqeaui.exe | For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
|
U | cpqek | kcpqek.exe | "For Compaq PC's. Easy Access button support for the keyboard"
|
X | CPQHotKeys | hotkeysvc.exe | "Added by the RBOT-XA WORM!"
|
U | CPQInet Runtime Service | CpqInet.exe | "For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
|
N | CPQINKAGENT | cpqinkag.exe | "That is the Compaq Ink Agent for some inkjet printers |
U | cpqns | cpqnpcss.exe | Related to Compaq.Net - not required if you don't use that
|
N | Cpqset | Cpqset.exe | Default settings software in Hewlett Packard notebook
|
Y | CPQSTUTFIX | stutfix.exe | "For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton"
|
U | CPQTEAM | cpqteam.exe | This program is bundled with HP servers. When loaded a system tray icon will be available that launches the HP Network Configuration Tool
|
X | cpr | cpr | Adroar.com adware downloader
|
X | cprocsvc | cproc.exe | Added by MSIL.AGENT.C TROJAN!
|
X | CPU Idle | cpuidlexp.exe | "Added by the AGOBOT-BW WORM!"
|
U | Cpu Level Up help | CpuLevelUpHelp.exe | "Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme) |
X | CPU Manager | cpumgr.exe | "Added by the PANDEM.B WORM!"
|
U | CPU Power Monitor | CpuPowerMonitor.exe | "Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme). Associated with the ""Energy Saving"" feature of AI Gear - which ""is a utility designed to configure and support all ASUS EPU (Energy Processing Unit) features."" Part of AI Suite"
|
X | CPU Temp Control | wuitgurd.exe | "Added by the RBOT-AHV WORM!"
|
X | CPU Watcher | "rundll32.exe cpu.dll | load" |
X | CPU Windows Status | cpustats.exe | "Added by a variant of the RBOT WORM!"
|
U | CPUcool | Cpucool.exe | Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel
|
N | CPUMon | CPUMon.exe | """CPUMon continuously displays the updated system statistics in a floating window as well as in system tray area"""
|
X | Cpusave | Cpusave.exe | "Added by the GEMA TROJAN!"
|
X | Cpusave32 | Cpusave32.exe | "Added by the GEMA TROJAN!"
|
X | CPVHOST Settings | cpvhost.exe | "Added by a variant of the SDBOT TROJAN!"
|
X | cpyt | hidep.exe | "Added by the MIRJACK-A TROJAN!"
|
X | cqlyg | world_cup_.bat | "Added by the WCUP.A WORM!"
|
? | CQSCP2PS | CQSCP2PS.EXE | """Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
|
? | CQSCP2PSERVER | CQSCP2PS.EXE | """Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
|
X | Cr**.exe [* = random char] | Cr**.exe [* = random char] | "CoolWebSearch/HomeSearch adware - for examples |
X | Cr**32.exe [* = random char] | Cr**32.exe [* = random char] | "CoolWebSearch/HomeSearch adware - for examples |
U | cracked_windows1 | cracked_windows1.exe | "Cracked Windows popup killer"
|
X | crash0001 | restorecrashwin32.bat | "Added by the AGENT-ZC TROJAN!"
|
X | CrashDump | [path to trojan] | "Added by the DROPPER.EAT TROJAN!"
|
N | CrazyTalk Serve | "rundll32.exe CrazyTalk.dll | DIIServeMediaFile" |
U | CRBroadCasting | CRBroadCasting.exe | "CardReader2 from On Track Inovations Ltd. USB Card Reader"
|
X | CRC Value Verifier | crsss32.exe | "Added by a variant of the RBOT WORM!"
|
X | CRC Value Verifier | Crsss64.exe | "Added by the RBOT-NY WORM!"
|
X | CRC Value Verifier | svchost32.exe | "Added by the RBOT-OA WORM!"
|
X | CRC Value Verifier | crsss.exe | "Added by the SPYBOT.UK WORM!"
|
X | Crc32stats Dependencies | Crc32stats.exe | "Added by the MYTOB.GT WORM!"
|
X | CRCSS | crcss.exe | "Added by the IRCBOT-TH WORM!"
|
U | Creata Mail | JMSrvr.exe | "Creata_Mail. Smileys |
X | Create A Monster | createAMonster.exe | "Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
|
N | CreateCD | Createcd.exe | Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
|
N | CreateCD50 | Createcd50.exe | Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
|
N | CreateCD_Reminder | reminder.exe | Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
|
X | Creates stractures for system management | stacture.exe | "Added by the SDBOT-DHS WORM!"
|
N | Creative AGP Wizard | agpwiz.exe | Part of Creative's BlasterControl
|
X | Creative Audio Drivers | creative.exe | "Added by the RBOT-FKR WORM!"
|
N | Creative Detector | CTDetect.exe | "Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player |
N | Creative Launcher | CTLauncher.exe | For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
|
U | Creative Live! Cam Manager | CTLCMgr.exe | "Creative Live! Cam Manager"
|
U | Creative MediaSource Go | CTCMSGo.exe | "Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
|
U | Creative MediaSource Go | CTCMSGoU.exe | "Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
|
N | Creative PCI Audio Configuration Utility | starter.exe | "System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
|
N | Creative Software Update | AutoUpdate.exe | Auto-updater for Creative Labs software
|
N | Creative WebCam Tray | Camtray.exe | Creative WebCam tray control - can be started manually
|
X | Creative.exe | Creative.exe | "Added by the PROLIN WORM!"
|
N | CreativeDiscNotifier | CTNOTIFY.EXE | "For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM |
U | CreativeMixer | CTMIX32.EXE | "Creative soundcard System Tray access to |
? | CreativeTaskScheduler | CTSched.exe | "Creative Task Scheduler. What does it do and is it required?"
|
X | CrisysTec Sentry | Sentry.exe | "CrisysTec Sentry rogue privacy program - not recommended"
|
X | Critical Error Safe32 | GetWaylayer32.exe | Added by the RBOT.IAL WORM!
|
X | Critical Update Check | battlenet.exe | "Added by the DELF-LB TROJAN!"
|
N | CriticalUpdate | Wucrtupd.exe | "MS Windows Critical Update Notification. If you want to keep Windows up-to-date |
X | CriticalUpdate | wucrtupd.exe | "Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder |
X | crmssrlt | [random filename] | "Added by a variant of the SLAPER TROJAN!"
|
X | Crnsava | scrnsave.pif | "Added by the SDBOT-ZV WORM!"
|
X | cronos | MARCO!.SCR | "Added by the OPASERV.G WORM!"
|
X | CrossMenu | CrossMenu | Toshiba CrossMenu Utility - allows the user to create their own menus
|
U | CrossMenu | CrossMenu.exe | Toshiba CrossMenu Utility - allows the user to create their own menus
|
X | CRP386 Networking | crp386.exe | "Added by the IRCBOT.N TROJAN!"
|
X | crs | crs.exe | "Added by the AGOBOT-TJ WORM!"
|
X | crsmons | iomssls.exe | "Added by the BACKDR-AU TROJAN!"
|
X | CRSS | CRSS.exe | "Added by the AGOBOT-RM WORM!"
|
X | CRSS | lssas.exe | Added by an unidentified WORM or TROJAN!
|
X | crsss | crsss.exe | "Added by the AUTORUN.FM WORM!"
|
X | CRSSXP SysInfo | crssxp.exe | "Added by a variant of the SDBOT TROJAN!"
|
X | Crusty | dmcpl.exe | "Added by the RUSTY WORM!"
|
X | cryptdlg | cryptdlg.exe | Added by an unidentified TROJAN!
|
N | CryptLoad | RouterClient.exe | "CryptLoad download manager"
|
U | cryptoexpert | cexpert.exe | "CryptoExpert from SecureAction Research. Advanced on the fly encryption system"
|
X | Cryptographic Service | ******.exe [* = random char] | "Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
|
? | Crystal 3D Audio Control | CWD3DSND.EXE | "Crystal 3D Audio sound driver. Is it required?"
|
X | CS | tsc.exe | "Cyber Security rogue security software - not recommended |
X | CS Update | copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll | Added by an unidentified malware
|
N | csaRem | spqmdmui.exe | Compaq modem country selection
|
Y | CSAV_CheckViruses | vchk.exe | "Command Antivirus related"
|
U | csc | csc.exe | Command line compiler for Microsoft C# it gets installed with the .NET SDK
|
X | cscripts | cscripts.exe | "Added by the BDOOR-AAP BACKDOOR!"
|
X | CSCRS Value | cscrs.exe | "Added by the RBOT-AAA WORM!"
|
X | CSCRS Value Check | MsPMSPSd.exe | "Added by a variant of the SDBOT WORM!"
|
X | Csec | cs.exe | "Cyber Security rogue security software - not recommended |
N | csecwiz | csecwiz.exe | "Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once |
X | cserv32 | cserv32.exe | "Added by the STRATION.EC WORM!"
|
X | CsimPlayer | CsimPlayer.exe | "Added by the KOOBFACE-AD WORM!"
|
U | CSINJECT.EXE | CSINJECT.EXE | "Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
|
X | csm Win Updates | csm.exe | "Added by the ZOTOB.B WORM!"
|
X | CSNetManagerXp | isass.exe | "Added by the HIDER-O TROJAN!"
|
X | csoftok | softok.exe | "Added by the QQPASS.G TROJAN!"
|
X | csos | csos.exe | "Added by the SDBOT-DFE WORM!"
|
X | csrcs | csrcs.exe | "Added by the AGENT-HUA TROJAN!"
|
X | csrs | csrs.exe | "Added by the GAOBOT.GEN!POLY WORM!"
|
X | csrsc | csrsc.exe | "Added by an unidentified VIRUS |
X | CSRSS | CSRSS.EXE | "Search page hijacker |
X | Csrss | csrss.exe | "Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
|
X | csrss | csrss.exe | "Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
|
X | csrss | csrss.exe | "Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
|
X | csrss | msmsgs.exe | "Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
|
X | csrss | nwiz.exe | "Added by the CHODE-J WORM!"
|
U | csrss | csrss.exe | "BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
|
X | Csrss | CSRSS.EXE | "Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
|
X | csrss | ssms.exe | Added by an unidentified malware
|
X | Csrss Host | csrhost.exe | "Added by the IRCBOT.BIZ WORM!"
|
X | CSRSS Loader | csrsss.exe | "Added by the AGOBOT.TX WORM!"
|
X | csrss.exe | csrss.exe | "Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
|
X | csrssLevel4 | csrss.exe | "Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
|
X | CSRSSU | CSRSSU.exe | "CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
|
X | CSRSSW | CSRSSW.EXE | "Added by the CWS-F TROJAN!"
|
X | CSRSWIN | [trojan filename] | "Added by the WINSHELL.50 TROJAN!"
|
X | CSRSX | [trojan filename] | "Added by the WINSHELL.50.B TROJAN!"
|
X | csrvss | csrvss.exe | "Added by a variant of the SDBOT TROJAN!"
|
U | CSS Server | CSSServer.exe | "ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
|
N | cssauth | cssauth.exe | "Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
|
N | cssauthe | cssauthe.exe | "Part of Thinkvantage Client Security Solution for IBM/Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
|
Y | CSScheduleCheck | SCHWIZEX.EXE | "Part of ConfigSafe - lets you identify changes to the registry |
X | cssrs | cssrs.exe | "Added by the BANCBAN-DW TROJAN!"
|
X | cssrss.exe | cssrss.exe | "Malware installed by different rogue security software including SpyKillerPro"
|
X | csss | Csss.exe | "Added by the BALICK TROJAN!"
|
U | CSS_Central | CSS_1631.EXE | "CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
|
X | CSV10P1 | CSP001.exe | "ClearSearch adware"
|
X | CSV10P70 | CSv10P070.exe | "ClearSearch adware"
|
X | CSV7P26 | CSV7P26.exe | "ClearSearch adware"
|
X | CSV7P70 | CSV7P070.exe | "ClearSearch adware"
|
X | CSV7P91 | CSV7P91.exe | "ClearSearch adware"
|
U | csvdea | csvdea.exe | "SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
|
X | csvhost.exe | csvhost.exe | "Added by the CIMUZ-BD TROJAN!"
|
Y | ct | ct.exe | ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it
|
X | CT Control Settings | CTSVCCD.EXE | "Added by the RBOT-YS WORM!"
|
U | CTAPR2 | CTAPR2.exe | "Console Launcher for the Creative Sound Blaster X-Fi series"
|
N | CTAVTray | CTAvTray.exe | For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
|
U | CTCheck | CTCheck.exe | "Associated with the ZEN range of MP3 players from Creative Technology Ltd. A visitor recommended the ""U"" status but what does it do?"
|
U | CTCMonitor | CTCMonitor.exe | "Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office |
X | CTDrive | "rundll32.exe drvmod.dll | startup" |
N | CTDVDDet | CTDVDDet.exe | "Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player |
X | CTF Device Loader | ctfmond.exe | "Added by the AGOBOT-FO WORM!"
|
X | ctf.exe | ctf.exe | Added by a variant of the BIFROSE TROJAN!
|
X | ctflog manager | ctflog.exe | "Added by the DONBOMB.A TROJAN!"
|
X | CTFM0N.exe | CTFM0N.exe | "Added by the STARTPAGE.P TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
|
X | ctfmen | cssrs.exe | "Added by the STARTP-DC TROJAN!"
|
X | ctfmom | ctfnom.exe | "Added by the BCKDR-QTA BACKDOOR!"
|
U | ctfmon | ctfmon.exe | "Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or |
X | ctfmon | taskmgr32*.exe [* = number] | "Added by the SOWSAT.B WORM!"
|
X | ctfmon | cftmon.exe | "Added by the DELIVE-A BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
|
X | ctfmon | mIRC.dll | "Added by the DELBOT-E TROJAN!"
|
X | ctfmon | WinConst.exe | "Added by the ASSASIN-G TROJAN!"
|
U | CTFMon | ctfmon.exe | "Family KeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""CTF"" sub-folder"
|
X | ctfmon | msnmsgr.exe | "Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
|
X | CTFMON | wscript.exe /E:vbs winjpg.jpg | "Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
|
X | CTFMON | wscript.exe /E:vbs regedit.sys | "Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
|
X | CTFMON | win.exe | "Added by the VBS.RUNAUTO.G WORM!"
|
X | Ctfmon | wmisys.exe | "Added by the IRCBOT-ADS WORM!"
|
X | ctfmon | WinUP.exe | "Added by the BANKER-VV TROJAN!"
|
X | CTFMON.CPL | CTFM0N.CMD | "Detected by Symantec as the SILLYFDC WORM! See here"
|
X | Ctfmon.exe | ctfmon32.exe | "CoolWebSearch Ctfmon32 parasite variant"
|
X | ctfmon.exe | ctfmon.exe | "Added by the RAIDYS TROJAN! Note - this overwrites the legitimate ctfmon.exe process associated with alternate text inputs which is located in %System%"
|
X | ctfmon.exe | msupdate32.exe | "Spy Sheriff/SpywareNO malware |
U | ctfmon.exe | ctfmon.exe | "Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or |
X | ctfmon.exe | ctfmon.exe eminem.exe | "Added by the BHARAT.A WORM!"
|
X | CTFMON.EXE | svchost.exe | "Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
|
X | CTFMON32 | CTFMON32.EXE | "CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN!"
|
X | ctfmon32 | [random filename].exe | "Added by the RBOT-GSN WORM!"
|
X | ctfmon32 | taskmgr32*.exe [* = digit] | "Added by the SOWSAT.C WORM!"
|
X | ctfmona | ctfmona.exe | "Added by the DLOADR-BME TROJAN!"
|
X | CTFMONSS | CTFMONSS.EXE | "Added by the CWS-F TROJAN!"
|
X | ctfmoon | microsoftconfigurator.exe | "Added by the DELF-ALS TROJAN!"
|
X | ctfmun | ctfmun.exe | "Added by the AGENT.ACEZ TROJAN!"
|
X | ctfnnon | ctfmon.exe | "Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
|
X | ctfnom | rundIl32.exe | "Added by the LEGMIR-AW TROJAN!"
|
X | ctfnom.exe | SVOHOST.exe | "Added by the DIGIDOR-A TROJAN!"
|
X | ctfnom.exe | OSRSS.exe | "Added by the DLOADER-UQ TROJAN!"
|
X | cthelp | cthelp.exe | "Added by the SDBOT TROJAN!"
|
U | CTHELPER | CTHELPER.EXE | "CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers |
X | CTHelper | cthelper.exe | "Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
|
X | CTHELPER | svhost.exe | "Added by the SDBOT-RZ WORM!"
|
X | CTime | [path to trojan] | "Added by the HTTPDOS TROJAN!"
|
X | CTin10 | CTin10.exe | "Added by the BANCOS.E TROJAN!"
|
X | CtModule | CtModule.exe | "Added by the CLICKER-EG TROJAN!"
|
X | CTMON.EXE | cfmon.exe | "Added by the CLCKR-AN TROJAN!"
|
U | CTNMRUN | ctnmrun.exe | Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
|
? | CTPDPSRV | CTPDPSRV.EXE | "Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
|
N | CTPerformanceUtility | CTPowUti.exe | "Related to Creative PowerSysTrayApp. This program is a non-essential process |
X | ctpmon | ctpmon.exe | "Registry Cleaner rogue - not recommended |
N | CTRegRun | CTRegRun.exe | For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
|
U | CtrlVol | CtrlVol.exe | "Volume control key on Acer |
? | CTSched | CTSched.exe | "Creative Task Scheduler. What does it do and is it required?"
|
N | CTStartup | CTEaxSpl.exe | Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
|
U | CTSVolFE | CTSVolFE.exe | Creative Labs Mixer applet for the Sound Blaster Audigy
|
U | CTSVolFE.exe | CTSVolFE.exe | Creative Labs Mixer applet for the Sound Blaster Audigy
|
N | CTSyncU.exe | CTSyncU.exe | "Creative Sync Manager - synchronizes music tracks on your computer with your player"
|
U | CTsysVol | CTSYSVOL.exe | Creative sound card volume controls
|
? | cttdpsrv | cttdpsrv.exe | "??"
|
X | CTUpdate | ctupdclt.exe | "Added by the RBOT-ABG WORM!"
|
N | CTxfiHlp | CTXFIHLP.EXE | Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card
|
N | CTXFIREG | CTxfiReg.exe | Creative Labs sound card driver related. It appears that it isn't required and maybe registration related
|
X | Ctykd | [path to file] | "SMALL.SN spyware"
|
N | CTZDetec.exe | CTZDetec.exe | "Auto-detect feature of Creative Media Lite which assists you in managing your music |
X | CU1 | VCClient.exe | Associated with the Surf Sidekick adware and should be removed
|
X | CU2 | VCMain.exe | Associated with the Surf Sidekick adware and should be removed
|
Y | cuagentExe | Cuagent.exe | "Command Antivirus related"
|
X | CueX44 | Dago.exe | "Added by the PUNYA-B WORM!"
|
X | CueX44_stil_here | WINLOGON.EXE | "Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process |
X | cuo | cuo.exe | "Added by the BUGBEAR.A WORM!"
|
X | Current Security Config | csecure.exe | "Added by the RBOT-AMO WORM!"
|
X | Current32 | msnpla.exe | "Added by the SDBOT-DIS WORM!"
|
N | CurseClient | CurseClient.exe | "CurseClient add-on manager for World of Warcraft and Warhammer Online games"
|
N | cursor | Screendragon_VS_Taskbar.exe | "ScreenDragon video player"
|
U | CursorGizmo | CursorGizmo.exe | "Cursor Gizmo - cursor management utility"
|
N | CursorXP | CursorXP.exe | "CursorXP from Stardock - tool for creating mouse cursors"
|
U | Curtain | Curtain.exe | "Curtain (from Chaotic Visions) - ""is a Windows utility which gives you the power to hide any window or group of windows to your system tray"""
|
U | Customizer2000 | logon.exe | "Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows |
N | CuteMX | CuteMX.EXE | File sharing utility
|
X | Cvfjx | ANACON.EXE | "Added by the NACO.A WORM!"
|
X | cvhnykzx | keepSafe.exe | "Added by the KILLAV.KAX TROJAN!"
|
X | cvmonitor.exe | cvmonitor.exe | "Added by the SDBOT.BV WORM!"
|
X | cvmsyslpd | sdservss.exe | "Added by the MAILBOT-BY TROJAN!"
|
Y | CVPND | cvpnd.exe | Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
|
U | CW | cw4.exe | "Chat Watch ""is a monitoring and logging software for online chat and instant messaging programs"""
|
U | CWatch | cw.exe | "ChatWatch - chat monitoring tool"
|
N | cwbckver | cwbckver.exe | "Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop |
N | cwbinhlp | cwbinhlp.exe | "Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop |
N | cwbsvstr | cwbsvstr.exe | "Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop |
? | cwbwlwiz | cwbwlwiz.exe | "Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop |
? | Cwcdschk.exe | Cwcdschk.exe | "IBM Thinkpad related?"
|
U | cwcptray | cwcptray.exe | "Related to ContentWatch Parental Control internet filter"
|
X | cwingllib | atllsimm.exe | "Added by a variant of the SDBOT WORM!"
|
X | cwriter | ucookw.exe | "Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
|
X | cwriter | cwriter.exe | "Part of PcRaiser |
U | cwupdate | cwupdate.exe | "ContentProtect from ContentWatch - internet filter"
|
X | cximddl | ldfrmmd.exe | "Added by the BUZUS.CQMU TROJAN!"
|
N | CXMon | Hpi_Monitor.exe | Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs
|
X | cybansos | cyban.exe | "Added by the TATERF-V WORM!"
|
N | Cyber | cyberchk.exe | "Part of Belkins ""Multimedia Cleaning Kit"" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after ""x"" amount of time has passed"
|
U | Cyber Trio | showmode.exe | "From G-Tek Technologies. Allows you to set the PC in one of three modes |
U | Cyber-Defender 2003 | uwcdsvr.exe | "
N | Cyber-shot Viewer Media Check Tool | SPUVolumeWatcher.exe | "Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
|
N | Cyber-shot Viewer Media Check Tool | SPUVOL~1.EXE | "Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
|
X | cyberfree.exe | ****.dat [* = random char] | Unidentified adware
|
U | Cyberhawk | CHTray.exe | "Cyberhawk from Novatix. Protects against viruses |
U | CyberLat Ram Cleaner | CLRamCleaner.exe | "CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
|
U | CyberLat Ram Cleaner | CyberLat Ram Cleaner 1.1.exe | "CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
|
N | Cyberlink PowerCinema 3.0 | PCMService.exe | "Part of Cyberlink's PowerCinema - which can be used to watch movies |
N | CyberMedia Agent | CMAGENT.EXE | "Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge |
U | CyberPatrolNew | cphq.exe | """CyberPatrol is one of the most powerful and popular client-based |
X | CyberWolf | CyberWolf.exe | "Added by the KICKIN.A (or CYDOG.C) WORM!"
|
X | CyDoor | CD_Load.exe | "Adware. Check here for information about Cy-Door and here for a program that can remove it"
|
X | CydoorUpdate | CD_Load.exe | "Adware. Check here for information about Cy-Door and here for a program that can remove it"
|
? | CYNHKey | CYNHKey.exe | "??"
|
N | CyphTray | CyphTray.exe | "Cypherus - encryption software"
|
U | CypressLinkMon | CypressLinkMon.exe | "Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store |
Y | D-Link Air USB Utility | AirCFG.exe | D-Link Air USB wireless driver and configuration utility
|
Y | D-Link Air Utility | AirCFG.exe | D-Link Air PCI wireless driver and configuration utility
|
Y | D-Link AirPlus G | AirGCFG.exe | D-Link Airplus G wireless router driver and configuration utility
|
Y | D-Link AirPlus XtremeG | AirPlusCFG.exe | "D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
|
Y | D-Link D-Link DWA-125 | AirGCFG.exe | "D-Link DWA-125 Wireless 150 USB adapter driver and configuration utility"
|
Y | D-Link D-Link RangeBooster N DWA-140 | AirNCFG.exe | "D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
|
Y | D-Link D-Link Wireless 108G DWA-120 | AirPlusCFG.exe | D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
|
Y | D-Link D-Link Wireless 108G DWA-520 | AirPlusCFG.exe | D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
|
Y | D-Link D-Link Wireless G DWA-110 | AirGCFG.exe | D-Link DWA-110 Wireless G USB adapter driver and configuration utility
|
Y | D-Link D-Link Wireless G DWA-510 | AirGCFG.exe | D-Link DWA-510 Wireless G desktop adapter driver and configuration utility
|
Y | D-Link D-Link Wireless N Dual Band DWA-160 | AirNCFG.exe | "D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
|
Y | D-Link D-Link Wireless N DWA-130 | AirNCFG.exe | "D-Link DWA-130 Wireless N USB adapter driver and configuration utility"
|
Y | | |