Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X*Microsoft Updatectxma.exe"Added by the STMU TROJAN!"
X*Security Centersecctr.exe"Added by the SDBOT.BRO WORM!"
X*windows updatewsctl.exe"Added by the SPYBOT.PR WORM!"
X.protectedN/A"Smitfraud variant"
Y00PCTFWFirewallGUI.exe"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
X1234klsjdc uiar924c afsxgnsvuxct.exe"Added by the FAKEALERT-AM TROJAN!"
U12Ghosts TrayProtect12srvc.exe"12Ghosts TrayProtect - ""Hide tray icons
U3Deep Control Panel3DeepCTL.EXE"3Deep® from E-Color corrects lighting
U3qdctl.exe3qdctl.exe"Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup
X9xHtProtectAVprotect9x.exe"Added by the NETSKY.M WORM!"
Xaaprotect[path to trojan]"Added by the BANCBAN-MJ TROJAN!"
UAccess ConnectionsACTray.exe"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
UAcctMgrAcctMgr.exe"Norton™ Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information
NAcer Product RegistrationACE1.exeAcer Product Registration - remove when registration is completed
UAct! PreloaderAct8.exe"Sage Software's ACT! ""enables individuals and small business customers to instantly access key contact and customer information
NAction Manager 32am32.exeAssociated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
?ActionAgentactionagent.exe"""A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client"". Is it required?"
NActivationActivation.exePart of Microsoft Money
UActivboardMMKeybd.exe"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
UACTIVBOARDABoard.exe"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
XActive Bit Stationabs.exe"Added by the MYTOB.BZ WORM!"
NActive CPUacpu.exe"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
UActive Desktop CalendarADC.EXE"XemiComputers Active Desktop Calendar"
UActive Email Monitoraem25.exe"Active Email Monitor checks multiple accounts for email
XActive Securityasecurity.exe"Active Security rogue security software - not recommended
UActive shieldActiveshield.exe"Active Shield is ""an heuristic screen that actively protects your computer from trojans
XActiveDesktopsystray32.exe"Added by the DABOOM WORM!"
XACTIVEDSACTIVEDS.EXE"Added by the OPASERV.T WORM!"
NActiveEyesActiveEyes.exe"ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small
UActiveKeys.AAB635BD7D054a37A576akeys.exe"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
UActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
UActivePlusactiveplus.exe"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
XActiveScan AntivirusActiveScan.exe"Added by the RBOT-FKQ WORM!"
XActiveScript32nod.exe"Added by the SOHANA-AJ WORM!"
YActiveShieldmcvsshld.exe"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
NActiveSpeedAS.exe"Ascentive ActiveSpeed internet optimizer - not recommended
XActiveSyncwcescom32.exe"Added by the MANCSYN-E TROJAN!"
NActiveWordsAWMonitor.exe"ActiveWords from ActiveWord Systems
XActiveX File Registration Servicefilereg.exe"Added by the RBOT-DVD WORM!"
XActiveX Streamermsgfix.exe"Added by the SDBOT.NQ WORM!"
XActiveXUpdatesvcss.exe"Added by a variant of the DEDLER.C TROJAN!"
UActivityactik.exe"ActivityKey keystroke logger/monitoring program - remove unless you installed it yourself!"
NActivSurfbackweb*****.exePackard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
UActMakerActMak25.exe"""ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding
UActMakerActMaker25.exe"ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload"
UACTrayACTray.exe"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
UActual Window ManagerActualWindowManagerCenter.exe"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
UActual Window MinimizerActualWindowMinimizerCenter.exe"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
XACTX1v1201.exe"Added by the VB.IS TROJAN!"
UAd-Protectad-protect.exe"Ad-Protect spyware and spam monitoring tool"
NAdaptec DirectCDDirectcd.exeDirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
NAdaptecDirectCDDirectcd.exeDirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
XAdditional GuardWI[random characters].exe"Additional Guard rogue security software - not recommended
XAdmanager ControllerAdManCtl.exe"Adware
YAdslTaskBar"rundll32.exe stmctrl.dll TaskBar"
UAdSubtractadsub.exe"AdSubtract blocks ads
XAdvanced Protection Systemadvpsys.exe"Added by a variant of the RBOT WORM!"
XAdwareProtectorAdwareProtector.exe"Part of rogue security tools
NAeXAgentLogonAeXAgentActivate.exe"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
UAJC Active BackupAJCActBk.exe"AJC Active Backup from AJC Software - ""Instantly backup files you change on your PC and keep multiple versions to undo"""
XAlcmtrMalware Doctor.exe"MalwareDoc rogue security software - not recommended
YAlps Electric USB ServerMonserv.exe"Alps Electric USB Server - required according to this article"
Xalt CTRL Shiftet3rd.exe"Added by the SDBOT-RH BACKDOOR!"
XAnti-Virus Product Sync[unprintable character][3 characters]log.exe"Added by the KEDEBE.D WORM!"
XAntimalware Doctor.exeAntimalware Doctor.exe"Antimalware Doctor rogue security software - not recommended
XAntiVirProtectAntiVirProtect.exe"AntiVirProtect rogue security software - not recommended
XAntivirus Protection Servicesccapp2.exe"Added by the RBOT.EXI WORM!"
?AntiVirusProtectionqumk.exe"??"
XAntivirusProtectionantivirusprotection.exe"Antivirus Protection rogue security software - not recommended
UAOL Spyware ProtectionAOLSP Scheduler.exeAOL's spyware protection program
XAPCProtect.exeAPCProtect.exe"APCProtect rogue security software - not recommended
NArcSoft ConnectACDaemon.exe"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
NArcSoft Connection ServiceACDaemon.exe"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
UArctosarazerhid.exe"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
UAshampoo Core Tunerct.exe"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
UAshampoo Magical DefragaDefragCtrl.exe"System Tray access to the main user interface for Ashampoo® Magical Defrag from Ashampoo GmbH & Co. KG - which ""runs in the background as a service
UAsioRegregsvr32.exe ctasio.dll"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
UAsioThk32Regrregsvr32.exe ctasio.dll"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
?ASUS Screen Saver ProtectorASScrPro.exe"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
UASUS SmartDoctorVGAProbe.exeASUS video card fan/thermal monitor
XATI Active Graphics Card Monitoratievx.exe"Added by the IRCBOT-TL WORM!"
NATI DeviceDetectATIDtct.EXEUtility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
XATITechActive.exe"Added by the ROAMER-A TROJAN!"
UAtomicTimeATOMICTIME.EXE"AtomicTime - utility that synchronizes your PC clock to an atomic clock"
?AudCtrl"RunDll32 AudCtrl.dll RCMonitor"
YAureal A3D Interactive Audiosa3dsrv.exeFor Aureal based 3D soundcards. A3D sound features won't work with this disabled
YAureal A3D Interactive Audio InitA3dInit.exeFor Aureal based 3D soundcards. A3D sound features won't work with this disabled
UAuto EPSON PictureMate Deluxe on XE_FATI9TA.EXE"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
Xautochk"rundll32.exe protect.dll_IWMPEvents@16"
XAutoProtectAutoProtect.vbs"Added by the KILLBAT-C WORM!"
XAUTOPROTECTUnavapq32.exeAdded by an unidentified WORM or TROJAN!
XAutoVirusProtectionciscv.exe"Added by a variant of the RBOT WORM!"
YAVGCtrlAVGCtrl.exe"Part of AntiVir® PersonalEdition Classic antivirus"
UBCDetectbcdetect.exeBcdetect.exe searches the system to make sure Creative drivers are installed for the video card. It loads the BlasterControl when the drivers are detected. Your choice - try it and see
UBCTweakbctweak.exe"BlasterControl for Creative video cards - controls for desktop settings
NBlackICE PC Protectionblackice.exe"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
?BlazeServoToolMediaDetector.exe"Related to BlazeDVD from BlazeVideo - which ""is leading powerful and easy-to-use DVD player software."" What does it do and is it required?"
XBlockProtector.exeBlockProtector.exe"BlockProtector rogue security software - not recommended
UBluetooth Connection AssistantLBTWiz.exe"Bluetooth connection manager for Logitech based bluetooth wireless products"
XBootCTRLbootctrl.exeAdded by an unidentified WORM or TROJAN!
?Boots Insert DetectInsDetect.exe"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
XBrcttrdb.exe"Detected by Kaspersky as the PURITYSCAN.Y TROJAN!"
XBrO_AcTBrO-AcT.exe"Added by the SILLYFDC-D WORM!"
UBTModemProtectionBTModemProtection.exe"BT Privacy Online modem protection software
?BZEnvironmentVariableCollectorBZEnvironmentVariableCollector.exe"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
?BZUtilizationCollectorBZUtilizationCollector.exe"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
UC-Media Echo ControlEchoCtrl.exeC-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
XCall Function System32sddriver.exe"Added by a variant of the SDBOT TROJAN!"
NCallControlftctrl32.exe"FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed
UCamera DetectorCAMDET~*.EXE"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
UCamera DetectorCamdetect.exe"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
UCamera DetectorDEVDET~*.EXE"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
Xcartaoconflicted.exe"Added by the DADOBRA-DV TROJAN!"
XccctpHistoryJMTi.exe"Added by the GANBATE.A WORM!"
YCCDoctorLogonTestingccdoctor.exe"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
Ucctraycctray.exe"Part of CA Internet Security Suite"
XCdnCtrcdnup.exe"CNNIC Update pest"
?checktimect.exe"Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required?"
XCleanPCToolSysRep.exe"CleanPCTool rogue system error and cleaning utility - not recommended
NCleanupONICTASK.EXE"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
XCleanUp AntivirusCU[random characters].exe"Cleanup Antivirus rogue security software - not recommended
XClickTheButtonCTB.EXE"ClickTheButton adware"
UCMSETTINGSctmn.exe"Part of NetNanny
NColorificHgcctl95.exe"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
NColorific Control PanelHgcctl95.exe"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
Ucom.codeode.cactusspamfiltercactusspamfilter.exe"Cactus Spam - free easy-to-use spam blocker"
Xcomctl32comctl32.exe"Adware - detected by Kaspersky as the AGENT.AM TROJAN!"
NCommCtrcommctr.exe"""Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!"". Available via Start -> Programs"
NCompaq ConnectionsCOMPAQ~1.EXE"See here - ""messaging service that automatically sends you support information
NCompaq ConnectionsBackWeb-1940576.exe"See here - ""messaging service that automatically sends you support information
NCompaq ConnectionsCompaq Connections.exe"See here - ""messaging service that automatically sends you support information
XConducteurPriveGDC.exe"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
UConnect KasambaKasamba.exe"""Finding the expert help that you need is easy on Kasamba. With more than 30
XConnect2Partyconnect2party.exeAdult content dialler
NCONNECTAuto UpdateCONNECTScheduler.exe"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
NCONNECTAUTrayAppCONNECTAUTrayApp.exe"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
UConnection KeeperConKeepM.exe"""Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle
NConnection ManagerCManager.exeSBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service
XConnectivity Tool[path to trojan]"Added by the LITEBOT-E TROJAN!"
XConnectorSYS.EXE"Nunci premium rate dialer"
XConnectorsms.EXE"Added by the ExDial-B premium rate adult content dialer"
NCONNECTSchedulerCONNECTScheduler.exe"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
?Contactecontacte.exe"Some kind of driver?"
XContent connector[random filename].exe"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
UContentTransferWMDetector.exeContentTransferWMDetector.exe"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
XControl"rundll32.exe ctrlpan.dll Restore ControlPanel"
Ncontrol panelsmctrlw.exeSystem Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
YControlCenterctlcntr.exe"Part of Lenovo's (IBM) ThinkVantage Fingerprint Software - used on laptops and keyboards with integrated fingerprint readers"
NControlCenter2.0brctrcen.exeBrother scanner 'Control Center' application - can be started manually
NControlCentreTrayXWCTray.exe"System Tray access for the Xerox ControlCentre 2.0 software for their range of printers
NControllerWFXCTL32.EXEFrom Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
XControlPanel"systemctrl.exe internet.dll LoadNetworkProfile"
NCorel Colleagues & Contacts Reminderscffrem.exe"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
NCorel Desktop Application Directordadx.exeThe Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
NCorel Photo DownloaderMediaDetect.exe"Related to Corel Photo Album"
NCorrectConnectCConnect.exeBroadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
NCountry Selectpctptt.exe"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
NCountrySelectionpctptt.exe"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?CPCopyProtectionNotifier.exe"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
XCreates stractures for system managementstacture.exe"Added by the SDBOT-DHS WORM!"
NCreative DetectorCTDetect.exe"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
NCreative LauncherCTLauncher.exeFor Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
UCreative Live! Cam ManagerCTLCMgr.exe"Creative Live! Cam Manager"
UCreative MediaSource GoCTCMSGo.exe"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
UCreative MediaSource GoCTCMSGoU.exe"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
NCreativeDiscNotifierCTNOTIFY.EXE"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
UCreativeMixerCTMIX32.EXE"Creative soundcard System Tray access to
?CreativeTaskSchedulerCTSched.exe"Creative Task Scheduler. What does it do and is it required?"
XCS Updatecopy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dllAdded by an unidentified malware
UCSINJECT.EXECSINJECT.EXE"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
Yctct.exect.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it
XCT Control SettingsCTSVCCD.EXE"Added by the RBOT-YS WORM!"
UCTAPR2CTAPR2.exe"Console Launcher for the Creative Sound Blaster X-Fi series"
NCTAVTrayCTAvTray.exeFor Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
UCTCheckCTCheck.exe"Associated with the ZEN range of MP3 players from Creative Technology Ltd. A visitor recommended the ""U"" status but what does it do?"
UCTCMonitorCTCMonitor.exe"Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office
XCTDrive"rundll32.exe drvmod.dllstartup"
NCTDVDDetCTDVDDet.exe"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
XCTF Device Loaderctfmond.exe"Added by the AGOBOT-FO WORM!"
Xctf.exectf.exeAdded by a variant of the BIFROSE TROJAN!
Xctflog managerctflog.exe"Added by the DONBOMB.A TROJAN!"
XCTFM0N.exeCTFM0N.exe"Added by the STARTPAGE.P TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
Xctfmencssrs.exe"Added by the STARTP-DC TROJAN!"
Xctfmomctfnom.exe"Added by the BCKDR-QTA BACKDOOR!"
Uctfmonctfmon.exe"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
Xctfmontaskmgr32*.exe [* = number]"Added by the SOWSAT.B WORM!"
Xctfmoncftmon.exe"Added by the DELIVE-A BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
XctfmonmIRC.dll"Added by the DELBOT-E TROJAN!"
XctfmonWinConst.exe"Added by the ASSASIN-G TROJAN!"
UCTFMonctfmon.exe"Family KeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""CTF"" sub-folder"
Xctfmonmsnmsgr.exe"Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
XCTFMONwscript.exe /E:vbs winjpg.jpg"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
XCTFMONwscript.exe /E:vbs regedit.sys"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
XCTFMONwin.exe"Added by the VBS.RUNAUTO.G WORM!"
XCtfmonwmisys.exe"Added by the IRCBOT-ADS WORM!"
XctfmonWinUP.exe"Added by the BANKER-VV TROJAN!"
XCTFMON.CPLCTFM0N.CMD"Detected by Symantec as the SILLYFDC WORM! See here"
XCtfmon.exectfmon32.exe"CoolWebSearch Ctfmon32 parasite variant"
Xctfmon.exectfmon.exe"Added by the RAIDYS TROJAN! Note - this overwrites the legitimate ctfmon.exe process associated with alternate text inputs which is located in %System%"
Xctfmon.exemsupdate32.exe"Spy Sheriff/SpywareNO malware
Uctfmon.exectfmon.exe"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
Xctfmon.exectfmon.exe eminem.exe"Added by the BHARAT.A WORM!"
XCTFMON.EXEsvchost.exe"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XCTFMON32CTFMON32.EXE"CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN!"
Xctfmon32[random filename].exe"Added by the RBOT-GSN WORM!"
Xctfmon32taskmgr32*.exe [* = digit]"Added by the SOWSAT.C WORM!"
Xctfmonactfmona.exe"Added by the DLOADR-BME TROJAN!"
XCTFMONSSCTFMONSS.EXE"Added by the CWS-F TROJAN!"
Xctfmoonmicrosoftconfigurator.exe"Added by the DELF-ALS TROJAN!"
Xctfmunctfmun.exe"Added by the AGENT.ACEZ TROJAN!"
Xctfnnonctfmon.exe"Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
XctfnomrundIl32.exe"Added by the LEGMIR-AW TROJAN!"
Xctfnom.exeSVOHOST.exe"Added by the DIGIDOR-A TROJAN!"
Xctfnom.exeOSRSS.exe"Added by the DLOADER-UQ TROJAN!"
Xcthelpcthelp.exe"Added by the SDBOT TROJAN!"
UCTHELPERCTHELPER.EXE"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
XCTHelpercthelper.exe"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
XCTHELPERsvhost.exe"Added by the SDBOT-RZ WORM!"
XCTime[path to trojan]"Added by the HTTPDOS TROJAN!"
XCTin10CTin10.exe"Added by the BANCOS.E TROJAN!"
XCtModuleCtModule.exe"Added by the CLICKER-EG TROJAN!"
XCTMON.EXEcfmon.exe"Added by the CLCKR-AN TROJAN!"
UCTNMRUNctnmrun.exeDetects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
?CTPDPSRVCTPDPSRV.EXE"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
NCTPerformanceUtilityCTPowUti.exe"Related to Creative PowerSysTrayApp. This program is a non-essential process
Xctpmonctpmon.exe"Registry Cleaner rogue - not recommended
NCTRegRunCTRegRun.exeFor Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
UCtrlVolCtrlVol.exe"Volume control key on Acer
?CTSchedCTSched.exe"Creative Task Scheduler. What does it do and is it required?"
NCTStartupCTEaxSpl.exeSplash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
UCTSVolFECTSVolFE.exeCreative Labs Mixer applet for the Sound Blaster Audigy
UCTSVolFE.exeCTSVolFE.exeCreative Labs Mixer applet for the Sound Blaster Audigy
NCTSyncU.exeCTSyncU.exe"Creative Sync Manager - synchronizes music tracks on your computer with your player"
UCTsysVolCTSYSVOL.exeCreative sound card volume controls
?cttdpsrvcttdpsrv.exe"??"
XCTUpdatectupdclt.exe"Added by the RBOT-ABG WORM!"
NCTxfiHlpCTXFIHLP.EXEAdded by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card
NCTXFIREGCTxfiReg.exeCreative Labs sound card driver related. It appears that it isn't required and maybe registration related
XCtykd[path to file]"SMALL.SN spyware"
NCTZDetec.exeCTZDetec.exe"Auto-detect feature of Creative Media Lite which assists you in managing your music
XData Protectiondatprot.exe"Data Protection rogue security software - not recommended
NDDCActiveMenuDDCActiveMenu.exeDigital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Uddoctorv2sprtcmd.exe /P ddoctorv2"Comcast Desktop Doctor (provided by SupportSoft
YDellAutomatedPCTuneUpPTAgnt.exe"PC TuneUp from Dell - ""silently monitors your system
NDesktop ArchitectDATRAY.EXE"Desktop theme manager available
Udetectidetect.exe"iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled"
?detectturbodetect.exe"??"
NDetectordetector.exe"USB port detector for LG scanners. Sits in the System Tray
UDetectorAppDetectorApp.exe"Related to Roxio MyDVD (was Sonic) DVD authoring software"
UDevice DetectorDevDetect.exe"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
NDevice Detector 2DevDtct2.exe"Installed by various Olympus products
XDevicePathProyecto1.exe"Added by the GRUEL WORM!"
UDialer Detectdd.exe"DialerDetect detects stealth installed premium rate diallers
NDigital Line DetectDLG.exeDetects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems
XDigital Protectiondigprot.exe"Digital Protection rogue security software - not recommended
XDirect settingssdchost.exe"Added by the DAEMONI-I TROJAN!"
UDirect UpdateDUControl.exe"DirectUpdate dynamic DNS updater"
XDirect X Direct3Ddxd3d.exe"Added by a variant of the SDBOT WORM!"
XDirect X Opengldxopengl.exe"Added by a variant of the RBOT-CJ WORM!"
Xdirect3d.exedirect3d.exe"Added by the CERTIF-F TROJAN!"
NDirectCDDirectCD.exeDirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
XDirector Videobtnmgern.exe"Added by the MYTOB-KL WORM!"
YDirectory Opus Desktop Dblclkdopusrt.exe"Directory Opus - an advanced file manager. ""Directory Opus goes beyond the simple file manager metaphor
Xdirects.exedirects.exe"Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS!"
UDIRECTVDSLDirectvdsl.exeStarts DirectTV DSL modem at boot up. Can also be started manually
XDirectXddhelp32.exe"Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe"
XdirectxDirectx.exe"Added by the SDBOT.D TROJAN!"
XdirectxSqlexploit.exe"Added by the SDBOT.D TROJAN!"
XDirectXDirectX.exe"Added by the BLAXE or LOGPOLE WORMS!"
XdirectxNTCmd.exe"Added by the SDBOT.D TROJAN!"
XdirectxPipeCmd.exe"Added by the SDBOT.D TROJAN!"
XDirectX 32directx32.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XDirectX Driverstdhost.exe"Added by the SDBOT.GVJ BACKDOOR!"
XDirectX For Microsoft Windowsdtxservice.exe"Added by the PROGENT TROJAN!"
XDirectX for Microsoft WindowsFservice.exe"Added by the PRORAT TROJAN!"
XDirectX for Microsoft WindowsSservice.exe"Added by the PRORAT TROJAN!"
XDirectX For Microsoft® Windowsfservice.exe"Added by the PRORAT-P TROJAN!"
XDirectX For Microsoft® Windowsfservice.exe"Added by the PRORAT-L TROJAN!"
XDirectX shell driver[path to trojan]"Added by the MARKTMAN-B TROJAN!"
XDirectx Startup Driversdirect.exe"Added by the RBOT.UXL WORM!"
XDirectX Video Driverdxterm5.exe"Added by the WILAB-A TROJAN!"
XDirectX64DirectXset.exe"Added by the BROWNEY.A WORM!"
XDirectX9direct3d.exe"Added by the AGENT.EAK TROJAN!"
XDirectX9svchost32.exe"Added by the RBOT.AQG WORM!"
XDirectX9 Diagdx9diag.exe"Added by the RBOT-ALT WORM!"
NDisc DetectorCtNotify.exe"For Creative sound cards. Detects when you insert a CD
?disc detectorqnetquestnotifty.exe"??"
?Dixons Insert DetectInsDetect.exe"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
Ydlatfswctrl.exe"Drive letter access to a UDF packet writer for CD-RW - from HP
YDLADLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
YDLACTRLWDLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
YDLACTRLW.EXEDLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
YDLCCCATS"rundll32 [path] DLCCtime.dll_RunDLLEntry@16"
XDocTorDoctor.exe"Added by the DOTOR.A WORM!"
XDoctor Antivirus 2008antvr.exe"Doctor Antivirus 2008 rogue security software - not recommended
XdpzProtectn.vbe"Added by the RUNAUTO.H WORM!"
NDriveSelectdriveselect.exe"DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs"
XDrProtectionDrProtection.exe"DrProtection rogue security software - not recommended"
Udscactivatedsca.exeDell Support Agent offers additional support and update features for your Dell computer or laptop
XDsplObjectswindspl.exe"Added by the BEAGLE.DN WORM!"
Xdstiosysplsitctl.exe"Added by the MAILBOT-BX TROJAN!"
?Duane Reade Insert DetectInsDetect.exe"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
XDyFuCA Active Alertactalert.exe"Adult content dialler - see here"
UE06DXLRD_7604703EDICT.EXE"Related to Microsoft Encarta dictionary functions"
YEarthlink Protection Control Centerelnk_pcc.exe"EarthLink Protection Control Center - ""powerful
UEasySync Pro - PocketPCAutoDetect.exe"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
XEfata[random 5 characters].exe"Added by the FLUKAN-D WORM!"
UElectron MicroscopeEMIII.exe"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
XEliteProtectorEliteProtector.exe"EliteProtector rogue spyware remover - not recommended
?ElkCtrlElkCtrl.exeEntry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
YElsaCapiCtlRcapi.exe"Assumed to stand for Remote Common Application Programming Interface (RCAPI)
UELSAChipGuardelsavect.exe"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
YEmail Protectionemlproxy.exe"AntiVirus Quick Heal - E-mail protection"
NEN4060C Taskbaren4060ct.exeComes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
NEncarta Dictionary QuickshelfQSHLFED.EXE"Provides quick access to Encarta's Dictionary features?"
XEnterprise SuiteWE[random characters].exe"Enterprise Suite rogue security software - not recommended
UEPSON PictureMate DeluxeE_FATI9TA.EXE"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
XErrorProtector Freeertmain.exe"ErrorProtector rogue system error and cleaning utility - not recommended"
YeSafe ProtectESPWatch.exe"eSafe from Aladdin - internet security for gateway and E-mail servers"
YeScan MonitorAVKWCTL9X.EXE"MicroWorld eScan antivirus"
UETDWareETDCtrl.exeElantech smart-pad touchpad driver for the Asus Eee PC range
UeTrust PestPatrol Active ProtectionPPActiveDetection.exe"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
YezShieldProtector for PxezSP_Px.exe"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
YezShieldProtector for PxezSP_PxEngine.exe"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
XFantasia injectorwincfg.exe"Added by the AGOBOT.US WORM!"
UFaxCtrl.exeASMediaProxyServer.exe"Part of Avaya's Contact Center Express - ""a multi-channel
NFaxTalk CallControl 6.0FTClCtrl.EXEThis allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
UFBDirectFBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
XFBSearchFastBrowserSearchProtection.exe"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
XFile Protection Monitorfilemon.exe"Added by a variant of the RBOT WORM!"
XFirewallctfmon.exe"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
XFirewallActiviescsrss.exe"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
UFmctrlTrayFmctrl.EXEGenius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used)
NFree DVD DirectFreeDVDDirect.exe"Free DVD Direct - provides a program to access a peer-to-peer (P2P) file-sharing network (see here)"
UFRITZ!webProtectFwebProt.exeFirewall included in FRITZ! ISP DSL software
NFSScrCtlFSScrCtl.exeScreen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
?g3dctlg3dctl.exe"??"
XGeneric Host Processcamacttiv.exe"Detected by AVG as the CIADOOR.13 TROJAN!"
Xgfxtray"rundll32 ctccw32.dllfindwnd"
UGroupWise PDA Connect - 3CmPlmAutoDet.exe"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
UGroupWise PDA Connect - GrpWseAgnt.exe"GroupWise PDA Connect PDA synchronisation utility - from Novell"
UGroupWise PDA Connect - PocketPCAUTODE~1.EXE"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
UGroupWise PDA Connect - ScheduleSyncSCHEDU~1.EXE"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
Ygw port controllerPORTCT95.EXE"From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties
UH/PC Connection AgentWCESCOMM.EXE"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
UHardware DoctorHwdoctor.exe"Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds
XHardware Shell DetectionWinHSD.exe"Added by a variant of the RBOT WORM!"
NHCDetectHCDetect.exe"MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification
Xhelpctl.exehelpctl.exe"Added by the GASLIDE TROJAN!"
YHEProtectHSockPE.exe"Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite"
UHide and Protect any Drives for Win95/98/Me/2k/XPHPDAgent.exe"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
XHotAction_hrhotaction_hr.exe"Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""HotAction_hr"""
UHP Laser Jet Directorhppdirector.exe"System Tray icon that opens various functions such as copy
NHP ScanPicturehpsplmwa.exeHP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
UHPGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
UHPLaptopGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
NHPUProvenTactics.exe"Proven Internet Marketing software"
XHtProtectAVprotect.exe"Added by the NETSKY.L WORM!"
UIBM ThinkPad EasyEject Support ApplicationEzEjMnAp.Exe"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
NIBM ThinkPad EasyEject Tray UtilityEZEJTRAY.EXE"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
UIE DoctorIEDoctor.exe"IE Doctor Toolbar - ""IE Doctor can help you to Repair IE easily
?iHP-100iHPDetect.exe"Drive Letter Searcher
UInfo Selectis.exe"Info Select from Micro Logic - personal information manager"
?InstallNAIProductSETUP.EXE"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
Xintdctrridctup20.exe"SafeSurfing adware variant"
UIntel Active Monitorimontray.exe"System tray monitoring of fans
UIntel Product Number UtilityIntelProcNumUtility.exe"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
XinternctWinSocks5.exe"Added by the GRAYBIRD.F TROJAN!"
UInternet Call DirectorICD.EXE"TELUS Internet Call Director (ICD) provides Internet users with real-time call notification while connected to the Internet"
XInternet Connection Wizardstisvsq.exe"EasySearch adware"
XInternet Connection Wizard[path to trojan]"Added by the SMUTSRCH-A TROJAN!"
XInternet Connection Wizardstisvsq1.exe"Added by the DLOADR-AWD TROJAN!"
XInternetGetConnectedStatewinupdate.exe"Added by the SDBOT-JN WORM!"
XInternetGetConnectedStateExwinupdate.exe"Added by the SDBOT-JN WORM!"
NIntroduction-Registration??"For Compaq PC's. Should only run first time
XIP Packet Redirect Serviceipredirect.exe"Added by the FORBOT.SM WORM!"
XIPC Connectionipcconn.exe"Added by the RBOT-AEG WORM!"
XIpCtrlipcon32.exe"Added by an unidentified VIRUS
NIPPDetectIPP4Detect.exe"Part of Presto! Mr.Photo - ""an ideal program for creating
?iPrint LPT Redirectornipplpte.exe"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
NiPrint Trayiprntctl.exe"Novell® iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net"
UiProtectYouip.exe"iProtectYou - internet filtering/parental control and network monitoring software"
NiRis Active Monitorwinmon32.exe"Iris Antivirus - discontinued
NiRiS AntiVirus Active MonitorWIMMUN32.exe"Iris Antivirus - discontinued
YISTraypctsTray.exe"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
NItsDeductiblePopUpItsDeductible.exe"ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip"
NIW ControlCenteriwctrl.exe"Pinnacle Systems InstantWrite enables you to use your CD-R
Uiwctrliwctrl.exe"Pinnacle Systems InstantWrite enables you to use your CD-R
UIW_Drop_Iconiwctrl.exe"Pinnacle Systems InstantWrite enables you to use your CD-R
Xjava-pluginjavasctp.exe"Added by the VB.AMX TROJAN!"
?Jessops Insert DetectInsDetect.exe"Part of Jessops Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
NJet DetectionADGJDet.exeAdded with SoundBlaster Live! or Audigy soundcards for headphone autodetection
Ujv16PT - Privacy ProtectorTask.jvb"jv16 PowerTools Privacy Protector - ""allows you to protect your privacy by automatically clearing out all the unwanted history items and cookies from you computer
UKBD MediaCenterMEDIACTR.EXEMultimedia keyboard manager. Required if you use the multimedia keys
Xkernctl32"rundll32 kctl32.dll initialize"
UKernel and Hardware Abstraction LayerKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
Xkernel system daemonACTIVAT0R.exe"Added by the RANDEX.AW WORM!"
NKodak Picture Easy *.* Batch TransferPezDownload.exe"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version"
NKodak Picture Transfer Softwarepts.exeLooks for Kodak camera connection and media insertion. Available via Start -> Programs
ULG Direct Media Button ServiceLGDMEBTN.exe"Supports the Direct Media button on LG Notebooks that support it - such as the S1 PRO EXPRESS DUAL. Pressing this button launches the application for watching movies or listening to music"
ULicCtrl"rundll32.exe MMFS.DLL Service"
NLifeScape Media DetectorPicasaMediaDetector.exe"Media detector for Picasa's automatic photo organizer"
XLive PC CareLP[random characters].exe"Live PC Care rogue security software - not recommended
XLiveProtectLiveProtect.exe"System Live Protect rogue security software - not recommended
ULMgrOSDOSDCtrl.exe"OSD (on-screen-display) utility - part of Acer Launch Manager. Gives you control to customize the monitor to your liking...from sound
Xloadctftpscr32.exe"Added by the AGENT-FPN TROJAN!"
XLoadDBackUpBcTool.exe"Added by the GIBE WORM!"
XloadMect1explorer.exe"Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
XLocal Internet ConnectionLIC.exe"Added by the SDBOT-YA WORM!"
XLogical Disk Detectionmrisvc.exe"Added by the IRCBOT.AOW BACKDOOR!"
NLogitech . Product RegistrationeReg.exe"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
?Logitech Camera SoftwareElkCtrl.exeEntry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
ULogitech Hardware Abstraction LayerKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
?LogitechCameraService(E)ElkCtrl.exeEntry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
ULogitechVideo[inspector]InstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
YLogoffSCTUINotify.exe"Part of Windows SteadyState
NLotus QuickStartsmartctr.exe"Lotus central application
YLXCCCATS"rundll32 [path] LXCCtime.dll _RunDLLEntry@16"
YLXCTCATS"rundll32 [path] LXCTtime.dll _RunDLLEntry@16"
Ulxctmon.exelxctmon.exeLexmark 5400 Series printer device monitor
YLXDCCATS"rundll32 [path] LXDCtime.dll _RunDLLEntry@16"
XM S DVD DirectX Dll Driversmsxdl.exe"Added by the SDBOT-BJN WORM!"
XMalware Destructor 2009MD345d.exe"Malware Destructor 2009 rogue security software - not recommended
XManageProtocolCtrlcsmsv.exe"Added by the LOOKSKY.B TROJAN!"
NMatrox Color Controlhgcctl95.exeFor Matrox video cards. Quick access to changing colors
NMatrox Control Centermgactrl.exeFor Matrox video cards. Quick access to settings
UMBMon"Rundll32 CTMBHA.DLLMBMon"
XMcAfee Antivirus ProtectionmcafeeAV.exe"Added by a variant of the RBOT WORM!"
XMcafee Auto Protectmcafeshield.exe"Added by the RBOT-UH WORM!"
YMcAfee Family Protectionmfp.exe"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
XMcAfee Windows Protectionmcafee32.exe"Added by a variant of the SPYBOT WORM!"
YMCTskShdmctskshd.exe"Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online and used to schedule tasks such as automatic updates
UMDDiskProtectMDDiskProtect.exe"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
UMDDiskProtect.exeMDDiskProtect.exe"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
Xmdetect[path to trojan]"Added by the SPABOT TROJAN!"
UMediafour MacDriveMDDiskProtect.exe"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
XMediaPathProyecto1.exe"Added by the GRUEL WORM!"
XMeeting Connectioncomsutil.exe"Added by the PPDOOR-E TROJAN!"
XMeeting Connectionwowdache.exe"Added by the PPDOOR-D TROJAN!"
XMeeting Connectionhgakdl32.exe"Looks like a variant of the PPDOOR-E TROJAN!"
Ymgavctrlmgavrtcl.exePart of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
UMGSysCtrlMGSysCtrlPart of the System Control Manager for MSI notebooks - displays animations for hot key commands (such as turning the wirelss card on/off)
XMicrosoft (R) Windows Protected Content Restoration Serviceservices.exe"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
UMicrosoft ActiveSyncWCESCOMM.EXE"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
XMicrosoft ActiveX Debugger NT[path to trojan]"Added by the BANCOS-DO TROJAN!"
XMicrosoft boot system cfg32actboost.exe"Added by the BROPIA.R WORM!"
XMicrosoft Connection Manager Monitorcmmon.pif"Added by the RBOT-AKV WORM!"
UMicrosoft CTF Loaderctfmon.exe"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
XMicrosoft DirectXSpoolserv.exe"Added by the DINFOR WORM!"
XMicrosoft DirectXrasmngr.exe"Added by a variant of the RBOT WORM!"
XMicrosoft DirectXPDSched.exe"Added by the SDBOT.CN WORM!"
XMicrosoft DirectXwuamgrd.exe"Added by the SDBOT.MY WORM!"
XMicrosoft DirectXtime123.exe"Added by the SDBOT.MD WORM!"
XMicrosoft Directxdirectxat.exe"Added by the SDBOT-BXF WORM! Note - disables autostart for the SharedAccess service and deactivates the Microsoft Internet Connection Firewall (ICF)"
XMicrosoft DirectXwupdate.exe"Added by the RBOT-L WORM!"
XMicrosoft Directx clickdirectxclick.exe"Added by a variant of the RBOT-GHT WORM!"
XMicrosoft Directx clicksdirectxclickers.exe"Added by the RBOT-GHT WORM!"
XMicrosoft Directx pushdirectxpushup.exe"Added by a variant of the RBOT-GHT WORM!"
XMicrosoft Directxspdirectxbt.exe"Added by a variant of the RBOT-GHT WORM!"
XMicrosoft Directxspnewdirectxnew.exe"Added by a variant of the RBOT-GHT WORM!"
XMicrosoft Internet Antivirus Protectionantivirus.exe"Detected by Kaspersky as the IRCBOT.BSK TROJAN!"
XMicrosoft Macro Protection SubSsymsacroprots386.exe"Added by the RBOT-KE WORM!"
XMicrosoft Macro Protection Subsystemsmsmacroprotxz.exe"Added by a variant of the SPYBOT WORM!"
XMicrosoft Macro Protection SubsystemsMsmacroprot32.exe"Added by the RBOT.KN WORM!"
XMicrosoft Messenger Management Controlsmsmgmctl.exe"Added by the RBOT-APA WORM!"
XMicrosoft Problem Doctorwindr128.exe"Added by the SMALLTRO.EF TROJAN!"
XMicrosoft Problem Doctorwindr32.exe"Added by a variant of the SMALLTRO.EF TROJAN!"
XMicrosoft Problem Doctorwindr64.exe"Added by a variant of the SMALLTRO.EF TROJAN!"
XMicrosoft Redirect[path to file]"Added by the BANKER-FW TROJAN!"
XMicrosoft Redirectsysten.exe"Added by the BANCOS-FO TROJAN!"
XMicrosoft Security Managementwuauct1.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Server Applacationswuauct1.exe"Added by a variant of the RBOT WORM!"
XMicrosoft standard protectorwinsocks5.exeAdded by the SMALL.CF TROJAN!
XMicrosoft standard protector[path to trojan]"Added by the STOX-C TROJAN!"
XMicrosoft task tray monitorctray.exe"Added by a variant of the RBOT WORM!"
XMicrosoft TCP/IP Connection Monitorsvchost32.exe"Added by the RBOT.KS WORM!"
UMicrosoft Webserversvctrl.exePersonal web server program which enables you to create and host a web server from your computer. Not required for most people
XMicrosoft Windows Controlmswctl32.exe"Added by the RBOT.JP WORM!"
XMicrosoft WordBootSector.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
NMicrosoft Works Update Detectionwkdetect.exeChecks for updates to MS Works
XMicrosoft« ActiveX Debugger NTsetdebugnt.exe"Added by the BANCOS-CZ TROJAN!"
NMightyFAX ControllerMFNTCTL.EXE"Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software""
NMirabilis ICQNDetect.exe"If connected to the internet
?misiCTRLmisiCTRL.exe"Miro video driver related. Is it required?"
NMobile Connectivity SuiteApplication Launcher.exe"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
NMoneyStartUp10.0Activation.exePart of MS Money 2002. Available via Start -> Programs
NMonstersoundtrayFreectrl.exeDiamond Multimedia sound card control panel
NMP3 CD ExtractorCD-Extractor.exe"""MP3 CD Extractor is an audio CD to MP3 ripper which can extract Digital Audio tracks from Audio CDs into files on the hard disk"""
XMP3Collection"rundll32.exe MSA64CHK.dllDllMostrar"
Xmrsvctrmrsvctr.exe"Added by a variant of the SDBOT WORM!"
XMS Agent Protectionag1.exe"Added by the IRCBOT.AZ BACKDOOR!"
XMS Auto-IPSec ProtectionMSASP32.exe"Added by the RBOT-AER WORM!"
XMS Decryption Softwareactive.exe"MediaTickets adware variant"
XMS DirectX Sound Driversmsdrvdx.exe"Added by the RBOT.BCX WORM!"
XMS DVD DirectX Dll Driversmdxdl.exe"Added by the SDBOT-XI WORM!"
XMS DVD DirectX Sound Driversmsdrvdx.exe"Added by the SDBOT-XJ WORM!"
XMS System Call Functionmsscf32.exe"Added by the RBOT-GBZ WORM!"
Xms window update******.exe [* = random character]"Added by a variant of the RBOT WORM!"
XMS Windows Local DirectoryMSWLD32.exe"Added by a variant of the RBOT WORM!"
XMS-Connectarr.exe"Adult content dialler - see here"
XMS-Connectcdm.exe"Adult content dialler - see here"
XMS-Connectgame.exe"Adult content dialler - see here"
XMS-Connectmsite18.exe"Adult content dialler - see here"
XMS-Connectweb.exe"Adult content dialler - see here"
Xmsconfiguratorctfsdk.exe"Added by the DELF-ALS TROJAN!"
Xmsctfg32msctfg32.exe"Added by the RBOT-TJ WORM!"
Xmsctrl.exemsctrl.exe"Microsoft Security Adviser rogue security software - not recommended"
XMsctrl32Msctrl32.scr"Added by the REDIST WORM!"
Xmsdev controlmsdevctrl.exe"Added by the SPYBOT.N BACKDOOR!"
Xmsdirect.exemsdirect.exe"Added by the CERTIF-L TROJAN!"
Xmsdrvctrlmsdrvctrl.exe"Added by the VIDCACH-A TROJAN!"
UMSKDetectorExeMSKDetct.exe"Part of McAfee Spamkiller"
Xmsmautoprotectmsmssgs.exe"Added by the BIFROSE-AJ TROJAN!"
XMSNctfmoons.exe"Added by the SPYBOT.HI WORM!"
XMSObject32MSObject32.js"Added by the PUN TROJAN!"
XMSprotect.exeMSprotect.exe"Added by the DABYREV.A VIRUS!"
XMSVsmtrpcxctx.exeAdded by an unidentified WORM or TROJAN!
Xmsxctmsxct.exe"eXact Advertising (NaviSearch
UMulti-function keyboardGWHotkey.exe"Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail
XMy Security EngineMS[random characters].exe"My Security Engine rogue security software - not recommended
XMy Security WallMS[random characters].exe"My Security Wall rogue security software - not recommended
XNAV Auto Protectmsfwe1.exe"Added by a variant of the RBOT WORM!"
XNAV Auto Protectnavprotect.exe"Added by the RBOT.BKW WORM! Note - this is not a valid Norton AntiVirus product from Symantec"
XNAV Auto Protectdnsserv.exe"Added by a variant of the SDBOT WORM!"
XNAV Auto Protectmcafee32.exe"Added by a variant of the SPYBOT WORM!"
UNbkCtrlNbkCtrl.exe"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
NNeroNETTrayIconNNServiceCtrl.exe"System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network"
UNet Activity Diagramnad.exe"Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs"
XNET protection systemnetst.exe"Added by the RIZO.A TROJAN!"
XNetwork Connectionsinternat.exe"Added by the VB-ZD TROJAN!"
XNetwork ServiceMccTrayApp.exeAdded by an unidentified WORM or TROJAN!
UNGClientngctw32.exe"Symantec Ghost Server software - needed for a ""a Ghost multicast"" (transfer images to multiple machines). Can be launched manually"
XNI.UGDCTH_0001_N122M1712[path to file]"Installer for the PC Drive Tool rogue privacy tool - see here"
XNI.UGDCTR_0001_N108M0407[path to file]"Installer for the PC Drive Tool rogue privacy tool - see here"
XNI.USYPSysProtectScannerInstall.exe"Installer for the SysProtect rogue security software
Unmctxthnmctxth.exe"Related to Pure Networks comprehensive home and small business networking software that simplifies network configuration"
YNMSSupportIntelHCTAgent.exe"Network monitor for Intel® Hub Connect Technology"
NNokia Connection MonitorNclConf.exe"Monitors the infrared port
NNokiaPCSyncTrayPCSync.exe"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
UNOMAD Detectorctnmrun.exeDetects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
XNorton Antivirus AVFVProtect.exe"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
XNorton Auto Protectnava.exeAdded by an unidentified WORM or TROJAN!
XNorton Auto Protectcrss32.exe"Added by the SDBOT.ATF WORM!"
YNorton Auto-Protectnavapw32.exeNorton Anti-Virus's background scanning process
XNorton Auto-ProtectccApp.exe"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
XNorton Auto-ProtectSERVICES.exe"Added by the AHKER.B WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Also
XNorton Auto-Protectffbaqe.exe"Added by the SLINBOT.RF BACKDOOR! Note - this is not a valid Norton product"
XNorton AV Protection StartupAti2xxx.exe"Added by a variant of the RBOT WORM!"
NNorton Disk DoctorNdd32.exe"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
XNorton Drive Protectionmsdt32.exe"Added by the FORBOT-GB WORM! Note - this not a valid Norton program!"
YNorton eMail ProtectPOPROXY.EXE"Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed
XNorton GProtectngrfn.exe"Added by a variant of the RBOT WORM!"
XNorton Protectnpprotect.exe"Added by the RBOT-WW WORM!"
XNorton protectnvsvc.exe"Added by a variant of the RBOT WORM!"
XNorton Protect Activiescsrss.exe"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
NNorton System DoctorSysdoc32.exe"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
UNovaBackup * Tray ControlNbkCtrl.exe"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here. * represents the version number"
UNPROTECTnprotect.exeNorton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid
Xntddetectntddetect.exe"Added by the AGENT-CU TROJAN!"
Xntuserctfmun.exe"Added by the SILLYFDC WORM!"
Xntuserctfmon.exe"Added by the AGENT-GSG TROJAN! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %UserProfile%"
Xnvctrl.exenvctrl.exe"Added by the ZLOB.G TROJAN!"
YNVIDIA ActiveArmorntrayfw.exe"System Tray access to the the NVIDIA ActiveArmor hardware-optimized firewall built into some older nForce 3 and 4 series motherboard chipsets"
UNVIDIA Media Center Library"RunDLL32.exe NvMCTray.dllNvTaskbarInit"
UNVMCTRAY"RunDLL32.exe NvMCTray.dllNvTaskbarInit"
UNvMediaCenter"RunDLL32.exe NvMCTray.dllNvTaskbarInit"
YNvRegisterMCTray"RUNDLL32.EXE NVMCTRAY.DLLNvMCRegisterApp NvCpl.dll"
YNvRegisterMCTrayNview"RUNDLL32.EXE NVMCTRAY.DLLNvMCRegisterApp nView.dll"
YObject Store Serverosserver.exe"Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital
XObjectDockBrico.cmd"Added by the BOBANDY-A WORM!"
UOctoshape Streaming ServicesOctoshapeClient.exe"Octoshape Live Streaming - ""is a revolutionary technology that will reduce your bandwidth cost and improve the quality in sound and picture"""
NOfotoNow USB Detection"Rundll32.exe OFUSBS.DLL WatchForConnection OfotoNow"
NOil ChangeOCTray32.exeFrom CyberMedia/Network Associates. Checks for updates to software installed on your PC. Available via Start -> Programs
?online cdromActive acid.exe"??"
YOrange Connection Kitatdialler1.exe"Part of the Orange Connection Kit - changes the dial-up for Orange Any Time if access problems are encountered"
UOSSelectorReinstalloss_reinstall.exe"Related to Acronis Disk Director Suite"
NOurPicturesOurPictures.exe"Related to RitzPix Online Photo Print services"
XPC Live GuardPC[random characters].exe"PC Live Guard rogue security software - not recommended
XPC Protection CenterPcProtection.exe"PC Protection Center 2008 rogue security software - not recommended
YPC Tools AntiVirus ClientPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
YPcCtlComPCCTLCOM.EXE"Part of Trend Micro web-security products - Internet Security 2005-2006 and Virus Buster 2005-2006"
XPCprotectar.exePCprotectar.exe"PCprotectar rogue security software - not recommended. A member of the AntiAID family"
XPcsProtectorPcsProtector.exe"PcsProtector rogue security software - not recommended
YPCTAVPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
YPCTAVAppPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
Xpctdf.exepctdf.exePCTotalDefender rogue spyware remover variant
UPcThrustPcThrust.exe"PCThrust from SwiftDog - ""increases computer performance by allocating higher portions of CPU power to active applications and games"""
XPCToolProSysRep.exe"PCToolPro rogue system error and cleaning utility - not recommended
XPCTotalDefenderpgs.exe"PCTotalDefender rogue security software - not recommended. A member of the AVSystemCare family"
Xpctp_checkstartmon.exe"Part of the PcTurboPro rogue system optimization tool - not recommended
Upctspkpctspk.exeUsed for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use any of those functions
YpctsTraypctsTray.exe"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
YpctsTray.exepctsTray.exe"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
XPCTurboPropctp.exe"PcTurboPro rogue system optimization tool - not recommended
UPCTVOICEpctvoice.exe"The program PCTVoice is used by the modem to interface with your computer and also used for some V.80 functions for Video Conferencing. if you uncheck it
UPCTVRemoteremoterm.exeControls the remote control on some Pinnacle TV tuners
UpdfFactory Dispatcher v1fppdis1a.exe"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Dispatcher v2fppdis2a.exe"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Pro Dispatcher v1fppdis1.exe"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Pro Dispatcher v3fppdis3a.exe"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
NPDirectPDirect.exeIBM Presentation Director software
Updp Serverctpdpsrvr.exeIncluded and setup with the drivers for my Compaq A3000 all-in-one printer/scanner - maybe for networking. Works fine without it - but may be needed when used over a network
YPER Email Protectionpavmail.exe"PER Antivirus"
XPerfect Defender 2009pdfndr.exe"Perfect Defender 2009 rogue security software - not recommended
NPerfectPrintpfppop70.exePrint engine used by Corel WordPerfect 7 and Presentations 7
UPerfectSuitedthtml.exe"PerfectSuite™ from ViewSonic. Rebranded version of Display Tune from Portrait Displays
XPerforms peer to peer connectionWinPTTP.exe"Added by the RBOT-GMI WORM!"
Xpersonalprotectorpersonalprotector.exe"Personal Protector rogue security software - not recommended
XPHIME2004CCTFMDN.exe"Added by the DLOADR-AMV TROJAN!"
UPhone Connection Monitoraudevicemgr.exe"Connection monitor part of the Sony Ericsson PC Suite mobile phone management utility for some models
NPicasa Media DetectorPicasaMediaDetector.exe"Media detector for Picasa's automatic photo organizer"
NPicture Motion Browser Media Check ToolSPUVolumeWatcher.exe"Part of the Sony Picture Uility software supplied with Sony camera/camcorder products. Automatically invokes an import process if the camera/camcorder is connected and has media on it"
UPicture Package VCD MakerResidence.exe"Sony Picture Package software for their range of Digital Handycam video cameras. Used to connect the camcorder via USB and allows the user to burn the content directly to a CD"
NpictureBUZZTrayswtray.exe"System Tray access to PictureBUZZ on-line printing software from Streetwise Software. If you use the software set the page you use as a favourite in your browser and run it manually"
NPivotSoftwarewpctrl.exe"PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
Xpm32ctrlpwr32crtl.exe"Added by the CRYPTER.A TROJAN!"
UPopSubtractPopSub.exe"PopSubtract - pop-up killer"
XPopularScreensaversWallpaper"rundll32 [path] F3SCRCTR.DLLLES"
UPowerPanel Personal Edition User Interactionpppeuser.exe"CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - ""is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system
UPowertweakPTCTRL.EXE""Powertweak is designed to configure your system in the best way. A processor
NPP****usbFBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
UPractiSearchPSearch.exe"PractiSearch web search software"
Xprdtectprdtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprgtectprgtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
XPrivacy ProtectorPrivacy Protector.exe"PrivacyProtector rogue privacy tool - not recommended
XPrivacyConductorGDC.exe"PrivacyConductor rogue privacy tool - not recommended
XPrivacyProtector FreeUPRP.exe"PrivacyProtector rogue privacy tool - not recommended
Xprjtectprjtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprktectprktect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprltectprltect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprmtectprmtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
UProjectWhoisProjectWhois.exe"""Project Whois loads the domain names from all open Firefox and Internet Explorer windows into the one-click menu and gives easy access to the whois records from the System Tray"""
Nprojselectorprojselector.exeRoxio Project Selector - can be started manually
UProtectSHVRTF.EXE"PC Angel takes a 5-second snapshot of the current system registry each time the PC boots up. In the event of a crash
Xprotectprotect.scr"Added by the DLOADER-TQ TROJAN!"
XProtectDefenderProtectDefender.exe"ProtectDefender rogue security software - not recommended
XProtected StorageRUNDLL32.EXE MSSIGN30.DLL ondll_reg"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
Xprotectinfoprotectinfo.exe"ProtectInfo rogue security software - not recommended"
XProtectingToolSysRep.exe"ProtectingTool rogue system error and cleaning utility - not recommended
XProtection[path] runtask.exe [path] protection.exeAdded by a variant of the AGENT.3.AU TROJAN!
XProtectionProtection.exe"Added by the FEBELNECK-A WORM!"
XProtectionFirewall.exe"Added by the ELIPTER.A or ELIPTER.B WORMS! Located in %ProgramFiles%\Internet Explorer"
XProtectionIExplore .exe"Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
XProtectionNorton Internet Security.exe"Added by the ELITPER.E WORM!"
XProtection Centercntprot.exe"Protection Center rogue security software - not recommended
XProtection Systempsystem.exe"Protection System rogue security software - not recommended
XProtectionCompletepgs.exe"ProtectionComplete rogue security software - not recommended. A member of the AVSystemCare family"
XProtectionConuepgs.exe"ProtectionConue rogue security software - not recommended. A member of the AVSystemCare family"
XProtectionDeDriverGDC.exe"ProtectionDeDriver rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
XProtectionsProtEX32.exe"Ultimate SecuritySuite rogue malware remover - not recommended
XProtector GBprotectgb.exe"Added by the BANKER.EIE TROJAN!"
XProtectPcs.exeProtectPcs.exe"ProtectPcs rogue security software - not recommended
XProtectSoldierProtectSoldier.exe"ProtectSoldier rogue security software - not recommended
Xprqtectprqtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprrtectprrtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprstectprstect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprtcctprtcct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprttectprttect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutcctprutcct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutdctprutdct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutgctprutgct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xpruthctpruthct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutictprutict.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutlctprutlct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutpctprutpct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprutsctprutsct.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprvtectprvtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
Xprxtectprxtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
NPSIWin2.3 Connection ServerPsconsv.exeAllows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
XPwr32ctrPwr32ctr.exe"Added by the GEMA TROJAN!"
XPwr32ctrlPwr32ctrl.exe"Added by the GEMA TROJAN!"
UPWSActivePrint_5ActivePrintSystem.exe"ActivePrint from Pocket Watch LLC - ""Windows Mobile users are given the invaluable capability of printing from their mobile devices to any Windows 2000/XP/2003/Vista compatible printer without the necessity of wireless hardware"""
UQCTrayQCTray.exe"System Tray access to IBM Access Connections - forerunner to the current ThinkVantage version. Connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
UQlbCtrlQlbCtrl.exe"HP Quick Launch Buttons control center on their laptops"
YQuick Heal On-Line ProtectionCateye.exe"Quick Heal - virus scanner"
XQuick Officeactivate.exe"Added by the RANSOMLOCK.D TROJAN! Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key"
?RAMConnectionCheckerRAMConnChecker.exe"Part of Remote Access Manager (RAM) for Nortel Networks - which ""combines an intuitive
Xrasctrsrasctrs.exe"Hijacker
Xrbnynkctvrbnynkctv.exe"Added by the AGENT-GPA BACKDOOR!"
XReactor3[random name]32.exe"Added by the BOFRA.A WORM!"
XReactor5[random name]32.exe"Added by the BOFRA.D WORM!"
XReactor6[random name]32.exe"Added by the BOFRA.C WORM!"
XReactor7[random name]32.exe"Added by the BOFRA.B WORM!"
XReactor8[random name]32.exe"Added by the BOFRA.E WORM!"
XReactor9[random name]32.exe"Added by the BOFRA.E WORM!"
NRealtek HD Audio Sound Effect ManagerRTHDCPL.EXE"Realtek HD Audio Control Panel
XRealTimeProtectorwinlogon.exe"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
Xredirectredirect*.exeDotcomtoolbar/Linksummary hijacker installer - where * is a random digit
XRegistry Protectorregprotect.exe"Added by the ARIVER.A WORM!"
XRegistryDoctor2008registrydoctor.exe"RegistryDoctor2008 rogue registry cleaner - not recommended
XRegRunmActiveX.exe"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
XREGRUNMautoprotect.exeAdded by an unidentified WORM or TROJAN!
UREGSVR32regsvr32.exe ctasio.dll"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
Nreminder-ScanSoft Product Registrationremind32.exeRegistration reminder for ScanSoft products such as PaperPort
XRemote System Protection"rundll32.exe [random].dll HUI_proc"
URemoteControlrmctrl.exe"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
URightFAX Print-to-Fax DriverFaxCtrl.exe"Part of RightFAX from Captaris - ""the proven market leader in fax server and document delivery software"""
Urmctrlrmctrl.exe"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
XRoam04ActiveX.exe"Added by the ROAMER-A TROJAN!"
URun Nintendo Wi-Fi USB Connector Registration ToolNintendoWFCReg.exe"Related to Wi-Fi USB Connector from Nintendo"
URunDLL32"RunDLL32.exe NvMCTray.dllNvTaskbarInit"
XRundll32.exeProyecto1.exe"Added by the GRUEL WORM!"
XSafePCToolSysRep.exe"SafePCTool rogue system error and cleaning utility - not recommended
XSafetyCenterprotector.exe"Safety Center rogue security software - not recommended
USafetyNetipcTray.exe"Safety.Net from Netveda - ""offers Internet security
USametime ConnectConnect.exe"IBM Lotus Sametime - instant messaging and Web conferencing software"
USandboxieControlSbieCtrl.exe"""SandBoxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer"""
NSBC Yahoo! Connection ManagerConnectionManager.exeUsed to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection
USbUsb AudCtrl"RunDll32 sbusbdll.dll RCMonitor"
?Scan DetectorPmxdetect.exe"Associated with PrimaScan scanners. Is it required?"
NScanner DetectorSDetect.exe"ScanSuite Scanner Detector - part of ScanWizard
NScreen Saver ControlFSScrCtl.exeInstalls as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
Xsctrlmgrsescmgr.exe"Added by a variant of the DWNLDR-GAH TROJAN!"
YSCTUINotifySCTUINotify.exe"Part of Windows SteadyState
NSDetectSDetect.exe"ScanSuite Scanner Detector - part of ScanWizard
XSDK Codre Function22sdkimddprovment2.exe"Added by the SDBOT-YJ WORM!"
XSDK Core Functionsdkimprovment.exe"Added by the RBOT.BHL WORM!"
XSDK Core Function2sdkimprovment2.exe"Added by the SPYBOT.OGX WORM!"
USearch ProtectionSearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
USearchProtectionSearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
USecondChancesctray.exe"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
NSecureClean4Traysctray4.exe"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
XSecurity AntivirusSA[random characters].exe"Security Antivirus rogue security software - not recommended
XSecurity GuardSG[random characters].exe"Security Guard rogue security software - not recommended
XSecurity Master AVSM[random characters].exe"Security Master AV rogue security software - not recommended
XsecurwNctrup.exe"Added by the NOPIR.A WORM!"
XSelect serverslcsvr.exe"Added by the DLOADER-WD TROJAN!"
Yserrdctl.exeserrdctl.exe"Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems
NService Connectionsccenter.exeFor Compaq PC's. Part of Backweb
NService Connectionbwtray.exeFor Compaq PC's. Part of Backweb
Xserviceconnectserviceconnect.exe"Added by the AGOBOT.AIR WORM!"
XServicesActivecssrs.exe"Added by the AGOBOT-GB BACKDOOR!"
NSharkEjectAEJCT32.exe"Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded
XShedule Connectionarpo412.exe"Added by the PPDOOR-R WORM!"
?ShowIcon_Justrams_USB Product Driver v2.12r012shwicon.exe"Related to Just Rams USB product driver. Is it required?"
USideACTSideACT.exe"SideACT organizer software"
USmart Connect MonitorSCMon.exeAppears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
USmart Connect SetupSCSetup.exeAppears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
USmart Protector ProSmartProtector-Pro.exe"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
NSmart Start UPPnPDetect.exe"Part of Presto! Mr.Photo - ""an ideal program for creating
XSmart Virus EliminatorSM[random characters].exe"Smart Virus Eliminator rogue security software - not recommended
Xsmartprotectorsmartprotector.exe"Smart Protector rogue security software - not recommended
USmartProtector-ProSmartProtector-Pro.exe"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
XSmiley Districtplugin.exe"Smiley District adware"
USnapfish Media DetectorSnapfishMediaDetector.exe"Snapfish Media Detector - ""Upload your photos to Snapfish
USnapfishMediaDetectorSnapfishMediaDetector.exe"Snapfish Media Detector - ""Upload your photos to Snapfish
?SNCT511vsnct511.exe"Unidentified ""Snapshot Viewer""- what does it do and is it required?"
Xsomeicthis.exe"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
NSonic A3D Controlvrtxctrl.exeSound related options
NSony Auto Update Tray ApplicationCONNECTAUTrayApp.exe"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
Xsoundtctrlssoundtctrls.exe"Added by the AGOBOT-ZV WORM!"
USP2 Connection PatcherSP2ConnPatcher.exeChanges limit of concurrent TCP connections of Windows Service Pack 2
Xsp2ctrsp2ctr.exe"Added by the DLUCA-M TROJAN!"
USpamSubtractSpamSubtract.exe"Intermute SpamSubtract - junk email detection and removal program"
UspamsubtractSpamSub.exeInterMute™ SpamSubtract - junk email detection and removal program. InterMute™ is now part of Trend Micro and their products are no longer supported
NSpeed racerCTSRReg.exeSoftware for a Creative sound card
USPSTEALTSmartProtectorPro.exe"Smart Protector Pro - internet privacy tool that erases tracks
USPSTEALTSmartProtector-Pro.exe"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
USpy ProtectorSpyProtector.exe"Included in the full version of Security Task Manager
XSpy Protectorsrcss.exe"SpyProtector rogue security suite - not recommended
XSpy Protectorlsascs.exe"Spy Protector rogue security software - not recommended
Uspyprodetectorspydetector.exeSpyware Process Detector spyware remover
USpySubtractSpySub.exe"SpySubtract - multi spyware removal tool"
YSpyware Doctorspydoctor.exe"Older version of Spyware Doctor antispyware from PC Tools"
YSpyware Doctorswdoctor.exe"Older version of Spyware Doctor antispyware from PC Tools"
UStardock ObjectDockObjectDock.exe"Stardock ObjectDock is a program that enables users to organize their shortcuts
Xstart extractingspoolvse.exe"Added by the RBOT-XF WORM!"
Xstart extractingspoolvs.exe"Added by the RBOT.BAN WORM!"
Xstart extractingmcafee.exe"Added by the RBOT.FO BACKDOOR! Note - this is not a valid McAfee program and is located in %System%"
XStartup Configuration[six character filename]"Added by the RBOT-ARV WORM!"
NStay Connected!StayCon.exe"More than just a pinger
Xstealth.injector.exestealth.injector.exe"Added by the THEALS.A WORM!"
XStorageProtectorSysRep.exe"StorageProtector rogue system error and cleaning utility - not recommended
NSubtract the AdsAdSub.exeRemoves adverts from web pages. Although useful - not required
YSunProtectionServerSunProtectionServer.exe"CounterSpy antispyware software"
Xsvchctrlsvchctrl.exe"Added by the COBFINN TROJAN!"
Xsvchost connection monitorsvchost32.exe"Added by a variant of the SDBOT WORM!"
XsvcshareCTMONTv.exe"Added by the FUJACKS-AJ WORM!"
Xsvctasksvctask.exe"Added by the CHUCKYB-A TROJAN!"
USX Virtual LinkConnect.exe"SX Virtual Link from Silex Technology America
NsXe InjectedsXe Injected.exe"sXe Injected anti-cheat system client/server for Half-Life server based games that prevents cheat programs being loaded"
XSysCtlsysctl.exe"Added by the AOK TROJAN!"
XSysctrlsprocdll.exe"Added by the WEEDBOTZ.14 TROJAN!"
XSysctrlswinupdate.exeAdded by an unidentified WORM or TROJAN!
XSysctrlsmscntrl.exe"Added by the KOLABC.BB WORM!"
XSysctrlsSysctrls.exe"Added by the AGENT.AWZ TROJAN!"
XSysctrlswin32dll.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XSysctrls32sevchost.exe"Added by the RBOT.ADF BACKDOOR!"
XSysProtectSystem.exe"Added by the NETSPY TROJAN!"
XSysProtectsyp.exe"SysProtect rogue security software
XSysProtectUSYP.exe"SysProtect rogue security software
XSysProtect FreeUSYP.exe"SysProtect rogue security software
XSysProtectorSysProtector.exe"SysProtector rogue security software - not recommended
USystemsysctrl.exe"Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance
XSystemBrO_AcT.exe"Added by the SILLYFDC-AL WORM!"
XSystem DefenderWS[random characters].exe"System Defender rogue security software - not recommended
XSystem Doctor Freesystemdoc.exe"SystemDoctor rogue security software - not recommended
XSystem Protectorlsascs.exe"System Protector rogue security software - not recommended
XSystem Redirectsysbho.exe"Downloader trojan
XSystem Servicesconnection.exeAdded by an unidentified WORM or TROJAN!
XSystemDoctor 2006 Freesd2006.exe"SystemDoctor rogue security software - not recommended
XSystemDoctor Freesystemdoc.exe"SystemDoctor rogue security software - not recommended
UTask Catcher Real-Time Detectortasktrap.exe"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
XTask Helpwualcts.exe"Added by a variant of the RBOT WORM!"
NTaskBarCTLTask.exe"Creative SoundBlaster Audigy Taskbar - used to choose between different types of EAX Effects
NTasktrayCTLTray.exeInstalled with the Sound Blaster Audigy range of soundcards. Allows you to set EAX effects or equalizer settings for the Sound Blaster Audigy from a systray icon. Also allows you to launch the Taskbar via right-click → Show Taskbar. The tasktray can be accessed via Start → Programs → Creative → Sound Blaster Audigy → Taskbar
?TAudEffectTAudEff.exe"TOSHIBA Notebook related. What does it do and is it required?"
Ntbctraytbctray.exeProvides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel
Ytcactivetca.exe"Part of The Cleaner from MooSoft - stops virus trojans before they can do any damage"
?TCtlIHook.exeTCtrlIOHook.exe"TOSHIBA Control Utility Hotkey Hook - hotkey configuration process unique to Toshiba laptops. What does it do and is it required?"
?TCtrlIOHookTCtrlIOHook.exe"TOSHIBA Control Utility Hotkey Hook - hotkey configuration process unique to Toshiba laptops. What does it do and is it required?"
?TCtryIOHookTCtrlIOHook.exe"TOSHIBA Control Utility Hotkey Hook - hotkey configuration process unique to Toshiba laptops. What does it do and is it required?"
?Tesco Insert DetectInsDetect.exe"Part of Tesco Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
Ytfswctrltfswctrl.exe"Drive letter access to a UDF packet writer for CD-RW - from HP
Ytfswctrl.exetfswctrl.exe"Drive letter access to a UDF packet writer for CD-RW - from HP
UThinkPad EasyEject UtilityEzEjMnAp.Exe"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
NThinkPad EasyEject UtilityEZEJTRAY.EXE"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
UThinkPad Presentation DirectorNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
UThinkVantage Access ConnectionsACTray.exe"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
UThinkVantage Access ConnectionsACWLIcon.exe"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
YThinkVantage Active Protection SystemTpShocks.exe"Part of the Active Protection System found on some IBM/Lenovo Thinkpad models - including the T
NtkonnectTKONNECT.EXE"Dialer for the Tiscali internet service provider. Available as a desktop shortcut"
UTMERzCtl.EXETMERzCtl.EXEToshiba TME (Toshiba Mobile Extension) Control
XTotal Protect 2009pcpc_starter.exe"Total Protect 2009 rogue security software - not recommended
XTotal Virus ProtectionTotalVirusProtection.exe"Total Virus Protection rogue security software - not recommended
YTPSODDCtlTPSODDCtl.exePower saving software on Toshiba laptops
XTransaction Taskerstdhost.exe"Added by the SDBOT.HNK BACKDOOR!"
YTray control for Malwarebytes' Anti-Malwarembamtrayctrl.exe"Malwarebytes' Anti-Malware - ""monitors every process and actually stops malicious processes before they even start. It uses our impressive technology that is in fact a completely novel way of heuristic scanning and it is our response to the increasingly complex malware threats"""
NTraySantaCruztbctray.exeProvides quick access via a System Tray icon to the control panel for Turtle Beach's Santa Cruz or VideoLogic's SonicFury soundcards. Available via Start -> Settings -> Control Panel
UTrojanShield ProtectorPort.exe"TrojanShield anti-hacker/anti-trojan software"
YTrueVectorVSMON.EXEEven if you don't have ZoneAlarm or ZoneAlarm Pro run at start-up you do need this
XTrustDoctorTrustDoctor.exe"TrustDoctor rogue security software - not recommended
UTV878 Remote ControlC7XRCtl.exe"Related to Kworld TV878 Tuner"
Xtvctraytvctray.exeAdded by the VB.QJ TROJAN!
?Ulead AutoDetectorMonitor.exe"Related to Ulead Systems Inc. programs. What does it do and is it required?"
?Ulead AutoDetector v2monitor.exe"Related to Ulead Systems Inc.. What does it do and is it required?"
UUlead Memory Card DetectorMonitor.exe"Ulead Memory Card Detector - ""Automatically starts datadownload when your card is inserted into a memory card reader"""
XUPCTPcwUPCTPcw.exe"Part of the PcTurboPro rogue system optimization tool - not recommended
UUSBDetectorUSBDetector.exeUSBDetector sets up an icon in the System Tray for a USB card which is intended to be used to eject or unplug hardware
UUSBDetectorUDetect.exeUSB tray icon/detection for external Belkin (and maybe other makes) under Win98
XUser Input ServicesCTFMON32.EXE"Added by the MANCSYN.AK TROJAN!"
XUser Protectionusrprot.exe"User Protection rogue security software - not recommended
UUSIUDF_Eject_MonitorUSISrv.exe"Added by Ulead DVD Moviefactory. This program monitors your DVD or CD drives and alerts when you eject the media or have no media present"
XVaCtrlsv7"Downloader
YVAGCtrlVAGCTRL.EXE"Vexira Antivirus - virus scanner from Central Command"
UVAIO Action Setup (Server)VAServ.exe"Sony Vaio utility that auto-launches selected applications when you plug in a digital video camera
XVB_runcomctl_32.exeDubious downloader from densmail.com
UVeo Velocity Connectstim11.exeSupport software for the Veo Velocity Connect webcam
XVhosts Protectionvhosts.exeAdded by an unidentified WORM or TROJAN!
Xvidctrlvidctrl.exe"Delfin Promulgate adware variant"
UViewpointPhotosDeviceConnectFotomatDeviceConnect.exe"Related to Viewpoint which is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything ""bad"". This will change from what we know in 2006 according to this article. You can remove it via Start -> Settings -> Control Panel -> Add/Remove Programs list..."
Xvirtualwinprotect.exe"Added by the MUGLY.C WORM!"
XVirus DoctorVdoc[random].exe"Virus Doctor rogue security software - not recommended
XVirus Protectvrsprtc.exe"Added by the RBOT-APR WORM!"
XVirus Protector[random].exe"Virus Protector rogue security software - not recommended
XVirusProtect 3.8VirusProtect 3.8.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtect 3.9VirusProtect 3.9.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtectPro 3.3VirusProtectPro 3.3.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtectPro 3.4VirusProtectPro 3.4.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtectPro 3.5VirusProtectPro 3.5.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtectPro 3.6VirusProtectPro 3.6.exe"VirusProtect Pro rogue security software - not recommended
XVirusProtectPro 3.7VirusProtectPro 3.7.exe"VirusProtect Pro rogue security software - not recommended
XVolcano Security SuiteVS[random characters].exe"Volcano Security Suite rogue security software - not recommended
UVZRemoteCommanderAvRmtCtr.exeRelated to Sony's VAIO Zone Remote Commander
Uw98Ejectw98Eject.exe"Related to USB support for Sigmatel MP3 audio palyer (and others such as SanDisk). It's intent is to ""put away"" the ""disk"" before you unplug it from the USB port
Xwdskctlwdskctl.exeIEPlugin spyware
Xwdwctrlwdwctrl.exe"Added by the DLUCA.E TROJAN!"
NWebCallDirectWebCallDirect.exe"WebCallDirect - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Nwextract_cleanup0"advpack.dll DelNodeRunDLL32 [path] [filename].TMP"
NWFXCTL32.EXEWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
XWifi Connectionwificon.exe"Added by the SLENFBOT.AC WORM!"
XWifi Connection!wificonnect.exe"Added by the IRCBOT.XEL BACKDOOR!"
Xwin ctl appwuctl.exe"Added by a variant of the SDBOT WORM!"
XWin Updator Servicesctfnom.exe"Added by a variant of the WOOTBOT WORM!"
XWin32 FireWire DriverCTHELPER32.EXE"Added by the WOOTBOT TROJAN!"
XwinactiveWINACTIVE.EXE"WinActive variant of the LOP.com hijacker"
XWinActiveJWinActiveJ.exeAdded by the ROTARRAN VIRUS!
Xwinctlwinctl.exe"Added by the IRCBOT-YI TROJAN!"
XWind0ws Sharingssprotecter.exe"Added by the RBOT-AHW WORM!"
XWinDirectoriestdirs.exe"Added by the VB-EPB VIRUS!"
XWinDLL (ctfmonm.exe)"rundll32.exe ctfmonm.exestart"
XWindows (random character)diskcheck.exe"Added by the SINGU.B TROJAN!"
XWindows Actioncsrs.exe"Added by the SECCMU-A WORM!"
XWindows Activate Systemsyssv.exe"Added by a variant of the SPYBOT WORM!"
XWindows AdControlWinAdCtl.exeWindupdates adware variant
XWindows Additional GuardWI[random characters].exe"Windows Additional Guard rogue security software - not recommended
XWindows ARP Detectioncnvudlsp.exe"Added by the AGENT.LMW BACKDOOR!"
XWindows ARP Detectioncwinlogon.exe"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XWindows ARP Detectioncxwinlogon.exe"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XWindows Config Connectionmsicll.exe"Added by the RBOT-EXQ WORM!"
XWindows connection managerInternet.exe"Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one
XWindows ControlAdWinCtlAd.exeWindupdates adware variant
XWindows Enterprise SuiteWE[random characters].exe"Windows Enterprise Suite rogue security software - not recommended
XWindows Event Detectionwecsvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows Event Sectionsntsvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows File Protectionwinprotect.exe"Added by the AGOBOT.JB WORM!"
XWindows Firewall Updaterctfcom.exe"Added by the RBOT-GCB WORM!"
XWindows Helperwsctnfy.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Hijack Protectioncomngr.exe"Added by the AGENT-FYD TROJAN!"
XWindows Hijack Protection Systemcommngr.exe"Added by a variant of the AGENT-FYD TROJAN!"
XWindows Instruction Serviceswinstruct32.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Live Messenger 8.12ctfmon.exe"Added by the LIPARK-A WORM! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %UserProfile%"
XWindows Logical Connectionwcnsvc.exe"Added by the VIRUT.AO VIRUS!"
NWindows Media Connect 2WMCCFG.exe"Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network"
XWindows Messenger Connectwmdsvc.exe"Added by the SLENFBOT.S WORM!"
XWindows PC DefenderWP[random characters].exe"Windows PC Defender rogue security software - not recommended
XWindows Protected Storagenpssvc.exe"Added by the IRCBOT.AUL BACKDOOR!"
XWindows Protection SuiteWI[random characters].exe"Windows Protection Suite rogue security software - not recommended
XWindows Protectotboxide.exe"Added by a variant of the WOOTBOT WORM!"
XWindows Reversed Virus Protectionwinrsvp.exe"Added by the SLENFBOT.HX WORM!"
XWindows Secure Connectionwinsc.exe"Added by the SDBOT.BTN WORM!"
XWindows Security SuiteWI[random characters].exe"Windows Security Suite rogue security software - not recommended
XWindows Service Threadssvcthreading.exe"Added by the SHEUR.AUM TROJAN!"
XWindows Service Threadssvcthreads.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Services M7ctfmon32.exe"Added by the AGENT.WOH TROJAN!"
XWindows Services Towersvctowers.exe"Added by the IRCBOT.AGJ BACKDOOR!"
XWindows Services Towersvctowing.exe"Added by the SLENFBOT.LA WORM!"
XWindows SP4directCC.exe"Added by the RBOT-ACX WORM!"
YWindows SteadyState - Session Timer Notify (UI)SCTUINotify.exe"Part of Windows SteadyState
XWindows svchostctfmon32.exe"Added by a variant of the SPYBOT WORM! See here"
XWINDOWS SYSTEMctech.exe"Added by the MYTOB-KD WORM!"
XWindows System DefenderWS[random characters].exe"Windows System Defender rogue security software - not recommended
XWindows System SuiteWS[random characters].exe"Windows System Suite rogue security software - not recommended
XWindows Tracking Clientctwsvc.exe"Added by the AGENT-GMB TROJAN!"
XWindows Update AutoUpdate Client Productwuauct.exe"Added by the AGOBOT.ACL WORM!"
XWindows Update Firewall Systemctfmoom.exe"Added by the RBOT-GAN WORM!"
XWindows Update Firewall Systemctfmom.exe"Added by the SPYBOT.ANDM WORM!"
XWindows USB 2.0 Driverusb2ctrl.exe"Added by the RBOT-BIW WORM!"
XwindowsupdateRPC[RANDOM CHARACTERS].exe"Added by the IRCBOT.B TROJAN!"
XWindowsUpdateDirectdupadirect.exe"Added by the DUPA-C TROJAN!"
XWindowsXP ModuleDirectX3D.exe"Malware
XWindows_Protectwinsystem.exe"Added by a variant of the RBOT WORM!"
XWindows_Protectwinregal.exe"Added by a variant of the RBOT WORM!"
XWindows_Protectlsas.exe"Added by the RBOT.ARO WORM!"
XWindows_Protectwincontrol32.exe"Added by the RBOT-ADK WORM!"
XWindow_Protectwinsi32.exe"Added by a variant of the RBOT WORM!"
UWINDVDpatchCTHELPER.EXE"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
NWinDVRCtrlWinDVRCtrl.exeControl center software for an AOpen VA1000 TV tuner card
NWinFax PRO ControllerWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
XWinNetDDE[random characters].exe"Added by the NETDEPIX.B TROJAN!"
XWinPatch Protectionwinpatch.exeAdded by an unidentified WORM or TROJAN!
XWinPCDoctorSysRep.exe"WinPCDoctor rogue system error and cleaning utility - not recommended
Xwinprotectwin32.exe"Added by the MUGLY.E WORM!"
Xwinprotectwinprotect.exe"Added by the SDBOT-SB WORM!"
Xwinprotectionccsrss.exe"Added by the SILLYFDC.BBT WORM!"
XWinProtectorWinProtector.exe"WinProtector rogue security software - not recommended
XWinSpywareProtectWinSpywareProtect.exe"WinSpywareProtect rogue security software - not recommended
XWinSpywareProtect (ver. 5.1)WinSpywareProtect.exe"WinSpywareProtect rogue security software - not recommended
Uwintectivewintective.exe"Wintective logs keystrokes
UWinUpdateProtectioncsrss.exe"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
XWinXProtectorWinXProtector.exe"WinXProtector rogue security software - not recommended
XWinXPServicectfmon.exe"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""ctf"" sub-folder"
Xwin_upd.exeWINdirect.exe"Added by the MITGLIEDER.M TROJAN!"
Xwin_upd2.exeWINdirect.exe"Added by the BEAGLE.AO WORM!"
XWireless ConectionsWireConnect.exe"Added by the SDBOT-VF WORM!"
UWireless Connection Managerwirelesscm.exe"Wireless adapter configuration utility for D-Link's range"
XWireless ConnectionsWIRECONNECT.EXE"Added by the SDBOT-VM WORM!"
NWkDetectWkDetect.exeChecks for updates to MS Works
NWordPerfect Office 1215Registration.exe"Corel WordPerfect Office 12 registration wizard"
UWorm Detectorwd.exe"Worm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam"
NWpctrlwpctrlnt.exe"WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
NWpctrlwpctrl95.exe"WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
Nwpctrl95wpctrlnt.exe"WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
Nwpctrl95wpctrl95.exe"WinPortrait plug-in for PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
NWrCtrlWrCtrl.exe"Win-Route 4.27 NAT engine on Win2k Pro for connection sharing and security using Win-Route by Tiny Software. A connection sharing/Firewall Application. If service is disabled the program does not work
Xwsctf.exewsctf.exe"Added by the JAMPORK.E WORM!"
UX4ALLNLwdfsctl.exe"XS4All Webdisk - web space management utility for the Dutch ISP"
XXP Protection CenterXPProtectionCenter.exe"XP Protection Center rogue security software - not recommended
Xxpprotectxpdeluxe.exe"XP Protector Deluxe rogue security software - not recommended
UXTNDConnect PCXCPCMenu.exe"XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - 3CmPlmAutodet.exe"3Com Palm PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - CasioOrgCasAgnt.exe"Casio Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - ErPhn2ErTray.exe"Sony Ericsson IrMC (Infrared Mobile Connectivity) phones and smartphones specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - LtNts4NtsAgnt.exe"(IBM) Lotus Notes 4 specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - MyPalmMPTray.exe"Palm OS specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - PocketPCAutoDetect.exe"Windows Mobile Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
UXTNDConnect PC - ScheduleSyncSCHEDU~1.EXE"ScheduleSync specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
Uxv_ctrlv_ctrl.exe3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter"
UYou've Got Pictures Screensaverygpsstra.exeAOL You've Got Pictures Screensaver
XYour Protectionurpprot.exe"Your Protection rogue security software - not recommended
UYSearchProtectionSearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
UYumgo's Homepage Protector V1YumgoHomepageProtector.exe"Yumgo's Homepage Protector"
X[12 random characters]avifile5.exe"IeDriver adware variant"
X[12 random characters]bootvid4.exe"IeDriver adware variant"
X[12 random characters]browser8.exe"IeDriver adware variant"
X[12 random characters]atitvo32.exe"IeDriver adware variant"
X[12 random characters]autodisc.exe"IeDriver adware variant"
X[12 random characters]cabview1.exe"IeDriver adware variant"
X[12 random characters]advpack1.exe"IeDriver adware variant"
X[12 random characters]batmeter.exe"IeDriver adware variant"
X[12 random characters]bidispl2.exe"IeDriver adware variant"
X[12 random characters]asferror.exe"IeDriver adware variant"
X[12 random characters]catsrvps.exe"IeDriver adware variant"
X[12 random characters]admparse.exe"IeDriver adware variant"
X[12 random characters]audiosrv.exe"IeDriver adware variant"
X[12 random characters]bootvid2.exe"IeDriver adware variant"
X[12 random characters]cmpbk321.exe"IeDriver adware variant"
X[12 random characters]ADPTIF67.exe"IeDriver adware variant"
X[12 random characters]asycfilt.exe"IeDriver adware variant"
X[12 random characters]ati2dvag.exe"IeDriver adware variant"
X[12 random characters]atl91036.exe"IeDriver adware variant"
X[12 random characters]blackbox.exe"IeDriver adware variant"
X[12 random characters]browser5.exe"IeDriver adware variant"
X[12 random characters]bthserv1.exe"IeDriver adware variant"
X[12 random characters]camocx28.exe"IeDriver adware variant"
X[12 random characters]CAMOCX74.exe"IeDriver adware variant"
X[12 random characters]capesnpn.exe"IeDriver adware variant"
X[32 random hex numbers]badware-protector.exe"Badware Protector rogue security software - not recommended
X[random characters]securewinload32x.exe"Added by the OPTIXP-N TROJAN!"
X[random characters]rsbmsc.exe"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X[random characters]_default[random].pif"Added by the BRONTOK-AI WORM and variants!"
X[random characters]j[random].exe"Added by the BRONTOK-AI WORM and variants!"
X[random characters]sv[random].exe"Added by the BRONTOK-AI WORM and variants!"
X[random characters]yesbron.com"Added by the BRONTOK-AI WORM and variants!"
X[random characters]systs.exe"Added by the AGENT-GDC TROJAN!"
X[random characters]xvassdf.exe"Added by the AUTORUN-BAD WORM!"
X[various names]_ctcp.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]ActionScr.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]CToolBar.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]defect08.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]WTFCTF.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.