| Name |
Filename |
Status |
Description |
|
Optimum Online
|
Netsurf.exe
|
X
|
An Optimum Online application that is used to display advertisements.
|
|
Openwares LiveUpdate
|
LiveUpdate.exe
|
U
|
Web-update utility from Openwares.
|
|
OP12 Reminder
|
Ereg.exe
|
N
|
Registration reminder for OmniPage Pro 12 from ScanSoft now known as Nuance. |
|
OmniPage
|
Opware32.exe
|
N
|
Part of OmniPage Pro from Scansoft (was Caere) - "the fastest, easiest way to turn paper documents into digital files you can edit." Opware32.exe links Word, via OLE, with OmniPage. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs |
|
OfficeScanNT Monitor
|
pccntmon.exe
|
Y
|
Trend Micro OfficeScan Antivirus real-time scan monitor |
|
ODBC BackUp
|
fdxxl.exe
|
U
|
G Data "PC Spion" - monitoring and surveillance software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! |
|
nwiz
|
nwiz.exe
|
N
|
Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the operation of your system
|
|
NWEReboot
|
dummy.exe
|
Y
|
Temporary file used during the installation of Ahead Nero CD/DVD burning software.
|
|
NVQuickTweak
|
NVQTWK.DLL
|
N
|
System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties.
Please note: C:\Windows\System32\rundll32.exe is a legitimate program and should not be deleted.
|
|
NvMediaCenter
|
NvMCTray.dll
|
U
|
System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties
|
|
NvCplDaemon
|
NvCpl.dll
|
U
|
Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card
|
|
NvCplDaemon
|
NvQtwk.dll
|
N
|
System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here) |
|
NvCplDaemon
|
NvCpl.dll
|
U
|
Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card.
Please note: %system%\rundll32.exe is a legitimate program and should not be deleted.
|
|
NvColorInit
|
NVQTWK.DLL
|
?
|
Associated with Nvidia based graphics cards
|
|
NSupdate
|
NSupdate.exe
|
X
|
Added by the Dial/Laet-B premium rate dialer. |
|
NPROTECT
|
nprotect.exe
|
U
|
Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid - see here |
|
Norton System Doctor
|
Sysdoc32.exe
|
N
|
Norton Disk Doctor from Norton Utilities. Automatically runs at start-up, major resource hog and best started manually form Start -> Programs. Delete the shortcut in the Start -> Programs -> Startup folder as well
|
|
NoAdware
|
NoAdware.exe
|
U
|
NoAdware Adware/Spyware remover - initially considerered a "rogue" program - see here . Has since apparently mended its ways: see note |
|
NiceDownloads
|
MSA64CHK.dll
|
X
|
MatrixDialer related. Please note: %system%\rundll32.exe is a legitimate program and should not be deleted.
|
|
New.net Startup
|
rundll32 [path], NewDotNetStartup -s
|
X
|
|
|
New.net Startup
|
newdotnet4_5.dll
|
X
|
NewDotNet foistware
Please note: C:\Windows\System32\rundll32.exe is a legitimate program and should not be deleted.
|
|
Network Associates Error Reporting Service
|
TBMon.exe
|
U
|
Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
|
|
NetShow Powerpoint Helper
|
NSPPTHLP.EXE
|
U
|
If disabled, user created fonts can no longer be seen by other programs
|
|
NetPumper
|
NetPumperIEProxy.exe
|
X
|
NetPumper download manager - bundles Cydoor and SaveNow adware, see here |
|
NDSTray
|
NDSTray.exe
|
U
|
ConfigFreeT Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have
|
|
NCLAUNCH
|
NCLAUNCH.Exe
|
U
|
Part of SWF Studio from Northcode Inc - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP. |
|
NaviSearch
|
nls.exe
|
X
|
NaviSearch, eXact Advertising variant |
|
MyWebSearch Email Plugin
|
mwsoemon.exe
|
X
|
"My Web Search" malware
|
|
MySoftware NewsFlash
|
Newsflsh.exe
|
N
|
A program that runs in your task bar and receives alerts and release information on MySoftware products.
|
|
MULTIMEDIA KEYBOARD
|
MMKeybd.exe
|
U
|
Developed by Netropa Corp. and bundled with many different multimedia keyboards, this file is the OneTouch Multimedia Keyboard manager allowing the user, through a tray icon, to use predefined or user-configured one-touch keys such as Email key. The multimedia keys will not work if this startup is disabled.
|
|
Multimedia extensions
|
mservice.exe
|
X
|
|
|
MSwheel
|
mswheel.exe
|
U
|
Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
|
|
MSUpdSrv
|
msupdsrv.exe
|
X
|
Browser hijacker, redirecting to a porn site
|
|
MSPY2002
|
ImScInst.exe
|
N
|
Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE, Outlook and Word
|
|
MSprotect.exe
|
MSprotect.exe
|
X
|
Added by the DABYREV.A VIRUS! |
|
MSOleath32
|
winss.exe
|
X
|
Added by the Kather Trojan. This infection should not be confused with the legitimate winss.exe used by Windows Live One Care. |
|
MsnMsgr
|
MsnMsgr.Exe
|
N
|
MSN Messenger utility. If you don't use MSN Messenger, this can be annoying. Available via Start -> Programs. Go to MS Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts"
|
|
Msnarrator
|
msnarrator.exe
|
X
|
Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware |
|
MSN
|
msn.exe
|
X
|
Added by the Trojan.Minit Trojan. Troj/Cimuz-AQ attempts to steal information such as email account usernames and passwords, as well as creating screenshots to capture information such as banking details, and may send the stolen information to a remote user via FTP. |
|
MSMSGS
|
msmsgs.exe
|
U
|
Windows Messenger utility. If you don't use Windows Messenger, this can be annoying. Available via Start -> Programs. Go to Windows Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts"
|
|
MsmqIntCert
|
mqrt.dll
|
?
|
Microsoft Message Queue Server - Internal Certificate - see here for more info and here for a potential problem. |
|
MSKAGENTEXE
|
MskAgent.exe
|
U
|
|
|
MSAgent
|
mshtm.exe
|
X
|
Browser hijacker - redirecting to buldog-search.com
|
|
msadcheck
|
msadcheck32.exe
|
X
|
Browser hijacker, redirecting to search-system.com
|
|
Morpheus
|
morpheus.exe
|
N
|
MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free, and a visitor quotes "I have seen no instance of any since using it"
|
|
Module Call initialize
|
reg.dll
|
X
|
Added by a variant of the LOVGATE WORM!
Please note: C:\Windows\System32\rundll32.exe is a legitimate program and should not be deleted. |
|
mobsync
|
mobsync.exe
|
N
|
MS Synchronization Manager - updates the network copy of materials that were edited offline, such as documents, calendars, and e-mail messages
|
|
mnsvcsp
|
mnsvcsp.exe
|
X
|
Added by the Troj/SCKeyLog-B keylogger. |
|
MMKeybd
|
MMKeybd.exe
|
U
|
Developed by Netropa Corp. and bundled with many different multimedia keyboards, this file is the OneTouch Multimedia Keyboard manager allowing the user, through a tray icon, to use predefined or user-configured one-touch keys such as Email key. The multimedia keys will not work if this startup is disabled.
|
|
MigrationVendorSetupCaller
|
migrate.dll
|
Y
|
migrate.dll is used by applications when upgrading to a newer OS so the application runs smoothly on the new OS. For an example, read this MS article. Once the migration is completed and the application running smoothly in the new OS, this file should no longer be running at startup.
|
|
Microsoft System Checkup
|
Cool.exe
|
X
|
Added by the DONK.B WORM! |
|
Microsoft Services
|
svshost.exe
|
X
|
Added by the ALETS.B TROJAN! |
|
Microsoft Services
|
services.exe
|
X
|
Added by the ALETS TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup! |
|
Microsoft Office
|
OSA9.EXE
|
N
|
Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show
|
|
Microsoft Office
|
Osa.exe
|
N
|
Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show
|
|
Microsoft Management Console
|
lssas.exe
|
X
|
|
|
Microsoft Internet Acceleration Utility
|
iau.exe
|
X
|
|
|
Microsoft DirectX
|
PDSched.exe
|
X
|
Added by the SDBOT.CN WORM! |
|
MemScanner
|
MemScanner.exe
|
N
|
SpyHunter - spyware remover of somewhat dubious repute, see note |
|
McAgentExe
|
mcagent.exe
|
U
|
From McAfee VirusScan On-line. The Agent is a red M icon that appears in the Windows system tray or Notification Area (if you're running Windows XP). If you don't see the agent icon, VirusScan Online may not be installed
|
|
McAfeeUpdaterUI
|
UpdaterUI.exe
|
?
|
Associated with McAfee VirusScan
|
|
Matrox PowerDesk 8
|
Matrox.PowerDesk.exe
|
N
|
Windows system tray icon for quickly changing configuration settings on your Matrox video card.
|
|
Mail.com
|
mcalert.exe
|
N
|
A program from Mail.com that sits sits in your Windows taskbar and monitors your accounts for new email. |
|
LVCOMSX
|
LVCOMSX.EXE
|
?
|
Logitech webcam related. What does it do and is it required?
|
|
LTWinModem1
|
ltmsg.exe
|
Y
|
One of the "popular" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information |
|
LTSMMSG
|
LTSMMSG.exe
|
N
|
Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook, Acer and Sony Vaio notebooks, maybe others too
|
|
LtMoh
|
Ltmoh.exe
|
U
|
Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet
|
|
LSPmonitor
|
LSPmonitor.exe
|
N
|
eAcceleration Stop-Sign related; not recommended; see note |
|
LSPFix
|
LSPmonitor.exe
|
N
|
eAcceleration Stop-Sign related; not recommended; see note |
|
Logi_Mwx
|
Logi_MwX.exe
|
U
|
Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled
|
|
LogitechVideoTray
|
LogiTray.exe
|
N
|
Logitech Image Studio - installed with Logitech QuickCams
|
|
LogitechVideoRepair
|
ISStart.exe
|
U
|
LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation
|
|
LogitechSoftwareUpdate
|
ManifestEngine.exe
|
?
|
Updater, part of Logitech Image Studio - installed with Logitech QuickCam cameras. Probably not required
|
|
LogitechGalleryRepair
|
ISStart.exe
|
U
|
LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos, not if you don't. Also not required for versions up to and including 7.30 and after version 8.30 - hence the "U" rather than "Y" recommendation
|
|
Logitech Utility
|
Logi_MwX.exe
|
U
|
Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled
|
|
Logitech SetPoint
|
KEM.exe
|
U
|
Keyboard and mouse drivers and utilities for Logitech's latest products - supersedes iTouch and MouseWare on their older products. Required if you use special features such as multimedia keys
|
|
Logitech Hardware Abstraction Layer
|
Khalmnpr.exe
|
U
|
Logitech Bluetooth mouse Hardware Abstraction layer. A "hardware abstraction layer" is an interface that enables adding support for new devices and new ways of connecting devices to the computer, without modifying every application that uses the device. "This process is Logitech's mouse sensitivity monitor. When you enable Logitech's own sensitivity management, this process is required. This will allow you to change sensitivity on a per program level using their profile manager inside SetPoint."
|
|
loads.exe
|
medload.exe
|
X
|
Added by the Adware.Medload adware. |
|
loader
|
WMPLAYER.EXE
|
X
|
Unknown malware. This infection replaces the legitimate wmplayer.exe file with an infection file of the same name.
|
|
loader
|
loader.exe
|
X
|
Added by the Troj/Zlob-AAV homepage hijackthis and downloader Trojan. |
|
LoadBtnHnd
|
BtnHnd.exe
|
U
|
Fujitsu Lifebook computers have some buttons on the case - they can be programmed to execute specified programs (like hotkeys). The buttons can also be used as a combination lock input.
|
|
LManager
|
QtZgAcer.EXE
|
U
|
Acer Launch Manager - on Acer laptops it allows users to configure shortcut keys and to set the operating state of the WLAN module and the (optional) Bluetooth radio
|
|
LiveUpdate
|
LiveUpdate.exe
|
U
|
Web-update utility from Openwares.
|
|
LHTTSENG
|
LHTTSENG.inf
|
N
|
Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine. Please note that C:\Windows\System32\rundll32.exe and C:\Windows\System32\advpack.dll are legitimate files and should not be removed.
|
|
LDM
|
backweb-8876480.exe
|
N
|
Installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech
|
|
Launcher
|
launcher.exe
|
X
|
Spyware component related to DownloadWare and found in Program FilesKFH
|
|
LaunchApp
|
Alaunch.exe
|
U
|
Acer Launch tool utility on laptops
|
|
LapLink scheduler
|
Llsched.exe
|
U
|
Utility that automatically performs file transfers as unattended background operations
|
|
LanSpeed2
|
LanSpeed2.exe
|
U
|
Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card)
|
|
KodakCCS
|
KodakCCS.exe
|
Y
|
Kodak DC File System Driver
|
|
Kodak EasyShare software
|
EasyShare.exe
|
U
|
Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually
|
|
Keyboard Manager
|
MMKeybd.exe
|
U
|
Developed by Netropa Corp. and bundled with many different multimedia keyboards, this file is the OneTouch Multimedia Keyboard manager allowing the user, through a tray icon, to use predefined or user-configured one-touch keys such as Email key. The multimedia keys will not work if this startup is disabled.
|
|
kernelfaultcheck
|
dumprep.exe
|
N
|
Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
|
|
kernel32
|
kernel32.dlI
|
X
|
Added by the NETDEVIL.15 TROJAN! |
|
KAVPersonal50
|
Kav.exe
|
Y
|
Kaspersky Anti-Virus Personal 5.0
|
|
K2ps_full.task
|
K2ps_full.exe
|
X
|
Added by the JUNTADOR.K TROJAN! |
|
jusched
|
jusched.exe
|
Y
|
Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel
We specify that this entry should be allowed to run due to the security risks involved with not updating Java when a new version is released. |
|
Jet Detection
|
ADGJDet.exe
|
N
|
Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection
|
|
Jammer2nd
|
Jammer2nd.exe
|
X
|
Added by the NETSKY.Z WORM! |
|
iTunes Helper
|
iTunesHelper.exe
|
Y
|
Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
|