# BHO

FILES:
sidesearch.dll, sidesearch****.dll ( * = digit)


FILES:
n3tpa1p.dll, Calsdr.dll, Gr0*.dll (* = digit), td1.dll, random file names


FILES:
F1.dll, mpz300.dll, ZZ.dll, ***.dll (random chars)


NAME:
Malware taking advantage of the ASN.1 exploit


FILES:
2IN***~1.DLL, (* = random char), mskceo.dll


FILES:
ms****.dll, dnsrep********, ( * = random char)


NAME:
BellSouth Internet Services ISP software


FILES:
NN_Bar.dll, NN_Bar**.dll (* = random digit)


FILES:
AutoDisplay***.dll, (* = a random digit)


FILES:
eXactToolbar.dll, Exacttoolbar*****.dll, (* = random digit)


FILES:
googletoolbar.dll, googletoolbar*.dll (* = digit), googlenav.dll, googlenav*.dll, googletoolbar_en_*.**-big.dll, googletoolbar_en_*.*.**-deleon.dll


FILES:
Shdocvw.dll, do not delete the file itself, it`s a Windows system file!


FILES:
bundle********.dll, MS****.dll (* = random char)


FILES:
ctpp*.dll, ctpp*_**.dll (* = random digit)


FILES:
Iefeatsl.dll, win**32.dll, sys**32.dll, ie**32.dll, ms**32.dll, (* = random char)


FILES:
data.dll, toolbar_nieuw**.dll (* = random digit)


FILES:
Btiein.dll, *******~1.EXE, (* = random char/digit)


URL:
it`s a Windows system file!)  http://www.doxdesk.com/parasite/TinyBar.html


FILES:
webcbrowse.dll, webcbrowse*.dll  (* = digit)


URL:
it`s a Windows system file!) http://www.doxdesk.com/parasite/TinyBar.html


FILES:
shdocvw.dll, NOTE:  Do not delete dll itself; its a Windows system file!)


FILES:
ms****.dll, urlcli*******.dll (* = random char)


FILES:
dnsrep*******.dll , (* = random char), Ms****.dll (* = random char)


FILES:
brbho.dll, brbho***.dll,  (* = random char)


FILES:
urlcli*******.dll (* = random digit), Ms****.dll (* = random char)


FILES:
googletoolbar.dll, googletoolbar*.dll (* = number), googletoolbar_en_*.**-big.dll, Googletoolbar_en_*.*.**-deleon.dll.


FILES:
Gstyle~1.dll, Metahe~1.dll, ms****.dll  (* = random char)


FILES:
plg_ie0.dll, *********. dll (random chars)


FILES:
Nzdd.dll, Nzdd*dll (* = digit), Rdxph.dll, Sdph20.dll

URL:
Real Download Netscape Smart Download http://editor.actrix.co.nz/byarticle/spyw.htm


FILES:
browserhelpere******.dll (* = random digit), Ms****.dll (* = random char), Tagger~*.dll


FILES:
midaddle.dll, *****.dll (* = random char/digit)


NAME:
Actual Names (AdvSearch) Internet Keywords


# Events

event:
Spyware scan detected 27 infected locations


event:
Spyware scan detected 9 infected locations


event:
Spyware scan detected 0 infected locations


event:
Spyware scan detected 17 infected locations


event:
Spyware scan detected 28 infected locations


event:
Spyware scan detected 2 infected locations


event:
Spyware scan detected 29 infected locations


# spyw

Files:
,  2020Search.dll, 2020SE~1.DLL, 2020install.exe, mssvr.exe, svchost.exe, irsetup.exe


Files:
,  bi.dll, host.dll, biprep.exe, Belt.exe, Belt.ini

Variant:
ABetterInternet  ABetterInternet.B  ABetterInternet.C  ABetterInternet.D  ABetterInternet.E  ABetterInternet.F  ABetterInternet.susp


Files:
,  regsvr32.exe, ooldlz.exe, defscangui.exe, ws_uninst.exe, email_update.exe, eanth_alert.exe, eanthology.exe, eAnthology_updater2.exe, eanth_update.exe, syspatch_install.exe, eanthtutor.exe, threatscan_setup.exe, StopSign_install-r.exe, oodlz_install.exe


Files:
,  FindService.exe, cliner.exe, FindDll.dll, MailBook.exe, mailbookproxy.dll, MyDll.dll, Nn7Dll.dll, NnDll.dll, spredirect.dll, update.exe, updater.exe, updateproxy.dll


Files:
,  ftpcutrs2.dll, iudq.dll, icbmp.dll, DRMV2ICLT.DLL, Daxtime.dll, thid.dll, eventlowg.dll, dandgerous creatures.dll


Files:
,  intnets.exe, sysinfer.exe, msfiles.exe, scridows.exe


Files:
,  Ice Age.exe, 2 Fast 2 Furious.exe, Finding Nemo ScreenMate.exe


Files:
,  alxtb.dll, alxbp328.dll, alxie328.dll, amcis.dll, alxtb1.dll, alxres.dll, Alexaie.dll


Files:
,  sysmonn.exe, sysmono.exe, monpop.exe, AutoUpdate.exe, popsrv184.exe, popsrv185.exe, popsrv205.exe, POP205.DLL


Files:
,  advert.dll, ipcclient.dll, tfde.dll, adimage.dll


Vendor:
Avatar Resources, Inc, avatarresources.com, whois


Files:
,  BDEViewer.exe, BDEClean.exe, bdedetect1.dll, BDEplayer3.dll, BDEengine3.dll, bdeimage.dll, BDEwrapper3.dll, bdedetect1.dll


Files:
,  Blubster.exe, blubstershop.exe, mySetp_bb.exe, whcc-1.exe, cd_install_336.exe, Blubster.url, NCTAudioFile.dll, MyFiles.dat, Settings.ini, NCTAudioPlayer.dll, MSINET.OCX, diCrHash.dll, EBCRYPT.DLL, MSWINSCK.OCX, contactsR.dat, weblinks.dat, MyFiles.dat.


Files:
,  rem00001.dll, bs2.dll, bs3.dll, oo4.dll. bsx5.dll, bxxs5.dll


Files:
,  stlbdist.dll, stlbupdt.dll, CashToolbar.exe, msiefr40.dll, QuickLaunch.exe, LetsSearch.exe, BrowserAid.exe, bpsinstall.exe, uptodate.exe, ctb_s.exe, rundll16.exe, CashToolbarIE.dll, BrowserAidBarWnd.dll, LetsSearchIE.dll, BABarWnd.dll, QuickLaunchIE.dl


Files:
,  WToolsA.exe, WSup.exe, WToolsS.exe, WToolsB.dll


Files:
,  ChannelUp.exe, ShellInstaller.ocx, ShellInstallerRaptor.ocx, blengine.dll, blengine.exe, blengine.exe, bldll.dll, blpref.exe, uninst.exe, unimt.exe


Variant:
ClientMan  ClientMan.b99  ClientMan.bho1  ClientMan.bho2  ClientMan.msdaim  ClientMan.mskhhe  ClientMan.msmc


Variant:
Common Name  Common Name.cnbabe  Common Name.winnet


Files:
,  loader.exe, Tapicfg.exe, ctfmon32.exe, iedll.exe, svcpack.exe, svcinit.exe, bootconf.exe, msinfo.exe, svchost32.exe, msupdate.exe, msspi.dll, dnsrelay.dll

Variant:
CoolWebSearch  CoolWebSearch.alfasearch  CoolWebSearch.control  CoolWebSearch.cpan  CoolWebSearch.criticalupdater  CoolWebSearch.ctrlpan  CoolWebSearch.dnse  CoolWebSearch.dnserr  CoolWebSearch.dpe  CoolWebSearch.ehttp  CoolWebSearch.excel10  CoolWebSe


Files:
,  IEFEATSL.DLL, MSIESH.DLL, mshp.dll, syskd.dll, winug.dll, iefn.dll, ield32.dll, winkq.dll, IEAL.DLL, wincq32.dll, SYSUT32.DLL, msea32.dll, IEMB32.DLL, SYSBS32.DLL, sysca32.dll, msqx32.dll, winmd32.dll, winph32.dll, winxw32.dll, mshy.dll, iewr32.dll, sy


Files:
,  time.exe, exploreer.exe, systeem.exe, sistem.exe, iexplorer.exe, inetinf.exe, systeem.exe, autorun.exe


Files:
,  winug.dll, IEKZ32.DLL, iejd32.dll, iexs32.dll, sysad32.dll, ievd.dll, windc32.dll, IELJ32.DLL, iedx.dll, syscb32.dll, winjk32.dll, msqx32.dll, sysjy32.dll, msqo.dll, IEPV32.DLL, ieee.dll, IETH32.DLL, msvt32.dll, WINDR.DLL, winmu.dll, MSUJ.DLL, winii.dl


Files:
,  loader.exe, dia1C.exe, dload.exe, Porn Turbo.exe


Files:
,  cd_install_202.exe, cd_clint.dll, cd_htm.dll, cd_load.exe, cd_swf.dll,


Files:
,  Information.exe, URLDownload.exe, connecting*.exe, dating*.exe, smsdial*.exe, Kontaktannonser.lnk, SMS-KUL.lnk, XXX.lnk


Files:
,  DEALHLPR.DLL, dhbrwsr.exe, DHUpdt.exe, DHUpdt1.exe, DHP.dll, dhsvr.exe


Files:
,  DialerOffline.dll, livegirls.exe, "live girls.exe"


Files:
,  ttuh.exe, dpep.exe, BNSH.EXE, iebs.exe, ssuu.exe, ESCN.EXE, iroo.exe, rlnr.exe, tpoa.exe, iuea.exe, urod.exe, asri.exe, wtr.exe, brmn.exe, ewra.exe, uppe.exe, rcea.exe, ctsc.exe, demu.exe, ttwc.exe,ohco.exe, aods.exe, SNOA.EXE, aean.exe, aatu.exe, dwtn


Files:
,  EasyDates_*.exe, where * reprents two character. For example


Files:
,  rmashlex.dll, nvrcr32.dll, eblaster.exe; msrac32.exe, ebsetup.exe


Files:
,  csrss.exe, smss.exe, svchost.exe, Uninstall.exe, uninstall.dat


Files:
,  dirote.exe, dorod.ini, redroses.exe, van32.exe, demo.xt, dordo.sys, kltye.exe, processes.exe, niamx.exe, romto.exe, wexp.exe, dir32.exe, dorod.exe, kolder.exe, ppi.exe


Files:
,  acl.exe, cisvc.dll, cisvc.exe, cisvc.txt, license.txt, readme.txt, uninstall.exe


Files:
,  fserv.exe, serverconfig.exe, faq.html, manual.html, uninstall.bat


Files:
,  DDM3DIA.DLL, favorite.dll, w3th3rb.dll, ofrg.dll, favboot.dll, favman.dll, lwz.dll, SysLdr.dll, F1.dll, FOne.dll, SysLdr.dll, Ss32.dll, Gr02.dll, trk.dll, gig.dll, mbr32.dll, mpz300.dll, mbr32.dll, ZZ.dll, td1.dll, aess2.dll Source1Source2


Files:
,  bridge.dll, vnmispoisn_downloader.exe, dwnupdt.exe, run.exe, REGIST~1.EXE, oken.exe, Loader.exe, exmtmpaj.exe, sb.exe, 2PortalMon.exe, INFAMOUS_DOWNLOADER.EXE


Files:
,  FSW.EXE, support.exe, IdleUI.dll, fswinst.ocx, updater.exe


Name:
Gator Advertising Information Network (GAIN)


Files:
,  syncagent.exe, syncconfig.exe, logfile.cip, manual.html, faq.html, syncagent.cfg, syncagent.dll


Files:
,  Sexy_sg.exe, ORGYCAM.EXE, Hot_jp.exe, VIDEOGIRLS_NL.EXE, Hot_gb.exe, hotvideo_es.exe, hotvideo_no.exe, Hot_nl.exe, hotvideo_es.exe,


Files:
,  CRS32.dll, CRS.EXE, CRS32.REG, CRS.OLD


Files:
,  HXDL.EXE, HXIUL.EXE, HelpExp.exe, emsw.exe, HXDLDMDM.EXE, wsme.ini


Files:
,  Keylogger.exe, Keylogger.dll, uninstall.exe, LICENCE.TXT, README.TXT


Files:
,  HbInst.exe, HbSrv.exe,HbInstIE.dll, hotbar.exe, HBCORESRV.DLL, HbToolbar.dll, HBHOSTOE.DLL, HBHOSTOL.DLL, HbHostIE.dll


Files:
,  msiets.dll, msielink.dll, btlink.dll, msiein.dll, SToolbar.dll

Vendor:
First Cash Reserve, LLC (TrafficSyndicate).


Files:
,  IEDriver.exe, IEUpdate.exe, IEDriver.bin, iedclean.exe, td.exe, uninstall.exe


Files:
,  winobject.dll, winserv.exe, wupdt.exe, systb.dll, kw.dat, toServer.pst, lu.dat, extract.exe, button0.ico, button1.ico, button2.ico, logo.ico


Files:
,  stcloader.exe, bho.dll, bho001.dll, rsp.dll, rsp001.dll, install_all.dll,                             update_com.dll, winstart.exe, winstart001.exe, Loader.exe, IE_ClrSch.DLL, Install_All.dll, Update_Hosts.DLL, Update_BHO.DLL, Update_RSP.DLL, Update_Re


Files:
,  Ineb.dll, GWS.dll, Chgrgs.dll, abeb.dll, sbus.dll, drbr.dll


Files:
,  BHO42602.dll, WindowsIE.dll, iexplorr11.dll, iexplorr22.dll, iexplorr23.dll, iexplorr24.dll, iexplorr25.dll, iexplorr26.dll, iexplorr27.dll, iexplorr29.dll, boombar.dll


Variant:
Instant Access Dialer  Instant Access Dialer.B  Instant Access Dialer.C  Instant Access Dialer.D  Instant Access Dialer.E  Instant Access Dialer.F


Files:
,  EGDHTML_1023.dll, EGDial.dll, ia.dll, mseggrpid.dll, SuperBabes.lnk


Files:
,  EGDHTML_1024.dll, EGDial.dll, ia.dll, mseggrpid.dll, Instant Access.lnk, NoCreditCard.lnk


Files:
,  EGDHTML_1025.dll, EGDial.dll, ia.dll, mseggrpid.dll, Instant Access.lnk, NoCreditCard.lnk


Files:
,  EGDHTML_1026.dll, EGDial.dll, ia.dll, mseggrpid.dll, Instant Access.lnk, NoCreditCard.lnk


Files:
,  iopti130.dll, nem207.dll, nem212.dll, nem214.dll, wsem210.dll, wsem216.dll, optimize.exe, actalert.exe


Files:
,  ispynow.exe, ISNSYS.dll, 1500 nokia ringtones.exe, Virtuagirl_brianabanks_full.exe, Joi2A6.tmp, grand theft auto vice city.exe, Joi2D0.tmp, turbo tax key code.exe, Keygen super bounce out.exe, a (1).exe, TURBO_TAX_KEY_CODE.EXE, AolPassHack.exe, BIKO.EX


Files:
,  mscache.exe, aupdate.exe, aupdate_uninstall.exe, istsvc.exe, mscache.dll, istbar.dll


Files:
,  KeenValue.exe, IESliderWin32.dll, Keenvalue.exe, KeenValueInstall_with_track_120.exe, Killkeenvalue.exe, Kv???.dat, Kvlhookwin.dll, Kwm.exe, SendUninstallInfo.exe, Setup_incredifind_ultimatesaver_with_track.exe, Setup_powersearch_ultimateSaver_with_tra


Files:
,  AVP32.exe, svchost.exe, secbsn.exe, SVCHOSTÿ.exe, winsrv.exe


Files:
,  WINCOMP.EXE, WINTRIM.EXE, NAVPMC.EXE, winmgts.exe


Files:
,  MemoryWatcher.exe, TrayIcon.ocx, UpgradeMemoryWatcher.exe, uninst.exe, wowex32.exe


Variant:
Mirar Toolbar.A  Mirar Toolbar.B  Mirar Toolbar.winnb40  Mirar Toolbar.winnb41  Mirar Toolbar.winnb42  Mirar Toolbar.winnb51

Vendor:
www.getmirar.com (Site down 2003-11-21) whois


Vendor:
www.getmirar.com (Site down 2004-02-19) whois


Files:
,  morpheus.exe, CrashSaver.exe, DeskBandSearch.dll, GeoCtl.dll, GnucDNA.dll, MorphEXE.exe, UninstMorph.exe, mgwz.dll, mlnet.exe, zlib.dll, unzip.exe


Variant:
MySearch Bar  MySearch Bar.B  MySearch Bar.C


Files:
,  NHelper.dll, NHUninstaller.exe, NHUpdater.exe, NHelper.htm


Files:
,  TurnLog.exe, unins000.dat, unins000.exe, x.bat, NetPumper.exe, NetPumperNNProxy.dll, NetPumperIEProxy.exe, shutdown.exe, NPNetPumper_Audio.dll, NPNetPumper_Video.dll, NPNetPumper_Application.dll, TurnLog.exe


Files:
,  nsys.exe, nsutil.exe, nconfig.exe, _ISREG32.DLL, kbhook.dll, file.txt, file_keys.txt


Files:
,  CleanReg.exe, Keying.txt, PCWeasel.exe, ijl11.dll


Files:
,  Amh4V.exe, FmrCj.exe, JvfMa7R.exe, SjrZsY.exe, Iei1NKe7.exe, CpaFG.exe, DozMu4.exe, Cio9f.exe, Ryf9m24V.exe, Idk277g.exe, Oval73H.exe, Yfk8.exe, LgnJ8V3.exe, YmxB.exe, MtyJ62.exe, Szep85ln.exe, XioVQ8s0.exe, Corx5Ux.exe, IpwoDw.exe, Xej7.exe, Kvw1.exe,


Files:
,  PerfectNavBHO.dll, Tipb.exe, PftNavBho.dll, PERFEC~1.DLL


Files:
,  dp-b23011805.exe, g181511.exe, ezbndlwr.exe, Bundleware_p5.exe, omi-setup.exe, EUNIVERSE1.EXE


Files:
,  PowrStrp.dll, LTDMgr.exe, LSvr.exe, PSSetup.exe, PSOCX.DLL


Variant:
PurityScan  PurityScan.b  PurityScan.c  PurityScan.wcpt  PurityScan.wtsc  PurityScan.wtss


Files:
,  wtstr.exe, wtssvtr.exe, wtssu.exe, wtssvsu.exe, wtssvit.exe, wnscpsv.exe, wnscpsu.exe, wnscptr.exe, wnscpcc.exe, wnstscc.exe, wnstsit.exe, wnstssv.exe, wnststr.exe, wnstssu.exe, wcpsu.exe, wcpcc.exe, wcpsvsu.exe, wcpsvit.exe, wtscc.exe, wtssvcc.exe, wt

Variant:
PurityScan  PurityScan.b  PurityScan.c  PurityScan.ndrv  PurityScan.wcpt  PurityScan.wtsc  PurityScan.wtss


Files:
,  adaware.exe, aimaol.exe, Bsoft.exe, dkware.exe, efaxs.exe, exe.exe, explorer.exe, foobin.exe, icon.exe, iexplorer.exe, kazaa.exe, mcf.exe, mslogin.exe,msconfig.exe, msys.exe, newsgroup.exe, Notepad.exe, nvd32.exe, rb32.exe, realplay.exe, services.exe,s


Files:
,  Real Spy Monitor.exe, GetYahoo.dll, ijl11.dll, Plus.exe, WinHook.dll


Files:
,  redirect1.exe, redirect2.exe, redirect3.exe, redirect4.exe, redirect5.exe, redirect6.exe, redirect7.exe, redirect8.exe, redirect9.exe


Vendor:
relatedltd.com (site down 2004-06-30) whois


Variant:
SearchCentrix.barbho  SearchCentrix.mygeek  SearchCentrix.somatic  SearchCentrix.webalize  SearchCentrix.wzhelper


Files:
,  IEBrw.dll, HomePage.dll, HmePge.dll, Hotlink.dll


Files:
,  SearchSquire.exe, SquireUninst.exe, SearchUpdate.exe, unsearch.exe, SearchSquire.dll, SearchSquire2.dll, engines.txt, partner.txt


Files:
,  bh21.dll, sb21.dll, toolbarlib32.dll, bholib32.dll


Files:
,  bh22.dll, sb22.dll, toolbarlib32.dll, bholib32.dll, vnmispoisn_downloader.exe, vpinst.exe


Files:
,  sidesearch.dll, sidesearch1211.dll, SIDESEARCH1307.DLL, sidesearch1311.dll


Files:
,  wswinntfp.exe, winnetcl.exe, winnetcl.exe, spsetup.exe, spector_eval.exe, webebot.exe, spadmin.exe, sp40setup.exe, netknl.dll, netknlhm.dllmsurlbot.dll, abfrnex.dll, netknlhm.dll, mstfgher.dll, wmhshell.dll


Files:
,  sysdiag.exe, Deploy.exe, svchost.exe, NoStealth.exe, sslist.dat, SystemSA32.dll, sbrowse.exe, packet.dll, wpcap.dll


Files:
,  p2p-10110.exe, P2P p2p-10110.lnk, StarInstall.ocx


Files:
,  BHO2.dll, MSNIE.dll, sbsrch_v2.dll, SbSrch_V21.dll, msvcn.dll, SbSrch_V22.dll, winfgnet_1.dat, winfgnet_2.dat, rmvold.exe, restore.exe, backup.reg


Files:
,  sescli.exe, config.exe, faq.html, manual.html, uninstall.bat, sescli.cfg


Files:
,  taskmgr.exe,  twunk_64.exe, TCPDETECT.EXE, winpup32.exe


Files:
,  tikl.exe, tikl32.dll, tikl.log. These are the default file names. They could have been changed when the keylogger was installed.


Files:
,  Idhost.exe, HtCheck2.dll, IdmUp.dll, TPReg.dll, TpBar.dll, DataMgr.dll, idmcom.dll, htps.dll, Topicks.reg


Files:
,  Datamgr.dll, HtCheck2.dll, Idhost.exe, IdmUn.exe, IdmUp.dll, TPReg.dll, Topicks.reg, TpBar.dll, hthost.exe, htps.dll, idmcom.dll


Files:
,  ehelper.dll, MSVPrep.exe, IEHelper.dll, VX2.dll, TPS108.dll, MSView.dll, host.dll, BI.dll, SiteHlpr.dll, hostprep.exe


Files:
,  wmssys32.dll, nosys32.dll, easys32.dll, mw6p.dll, KeyLogger.dll, syncagent.dll, ExEMail.dll, DDClinet.dll, DDClient.dll, ikeyhk2.dll, pcSpyAssistant.dll, ipcSpyAssistant.dll, zsHook.dll, izsHook.dll, tikl.dll, ISNSYS.dll


Files:
,  AxMetaStream.dll, ComponentMgr.dll, MetaStreamID.ini, MtsAxInstaller.exe, npViewpoint.dll, npViewpoint.xpt, JpegReader.dll, Mts3Reader.dll, SceneComponent.dll, SreeDMMX.dll, SWFView.dll, WaveletReader.dll


Files:
,  VirtualBouncer.exe, VBouncerInner**********.exe , where * represents a digit.


Files:
,  load32.exe, Dllreg.exe, Vxdmgr32.exe, Rundllw.exe, patch.exe, netda.exe, swchost.exe


Files:
,  MaConnect.dll, od-dflt0001.exe, od-boob3.exe, od-teen7.exe, od-teen22.exe, od-ftsh47.exe, od-teen88.exe, od-teen98.exe, od-teen185.exe


Files:
,  WebSavingsfromEbates.exe, WebSavingsfromEbates1.exe, websearch.exe, couponsandoffers.exe


Variant:
MySearch Bar  MySearch Bar.B  MySearch Bar.C  MyWebSearch Toolbar.B  MyWebSearch Toolbar.emailplug  MyWebSearch Toolbar.bho1  MyWebSearch Toolbar.bho2


Files:
,  WANOBSI.exe, bho.dll, whattt.dll, outones.dll, newones.dll, whattn.dll, HYKFRETI.dll

Vendor:
Windows Media Solutions (Site down 2003.09.09)


Files:
,  wcmdmgr.exe, GameChannel.exe, wtbgmtt.exe, wtdmmp.dll, wtdmmpi.jar, wtdmmpv.dll, wtdmmp.dll, wtdmmpi.jar, wtdmmpv.dll, wcmdmgrl.exe


Files:
,  pup.exe, telnat.exe, comms.exe, ogonl.exe, erflib_Perfdata_1c4P.exe, idimapm.exe, sign32i.exe, _874c.exe, fffilto.exe, axdrvf.exe, svpcntsr.exe, iprt400o.exe, ppmgmta.exe, jl11i.exe, insw.exe, p2ress.exe, tl3d32c.exe, NWISEU.exe, etshn.exe, snppagnp.ex


Files:
,  csrss.exe, Out.exe, ccctr.exe, ij12.exe, ijl11.dll, rf.exe, services.exe, sm.exe, syst.exe, ezVidC60.ocx, unin.exe, uninse.exe, winsyst.exe, zapro.exe.


Files:
,  mobho.dll, mscstat.exe, mscstat2.exe, mostat.exe, mdefshop.dll, bpboh.dll, mbho.dll, m030106shop.dll, m030206pohs.dll, mo030414s.dll, moaa030425s.dll


Files:
,  XPCSpy.exe, AppSpy.dll, Protector.dll, KeySpy.dll


Files:
,  XupiterStartup.exe, BWCfgLoader.exe, XTCfgLoader.exe, XupiterToolbarLoader.exe, xupiterstartup2003.exe, RunDownload.exe, XupiterToolbar.exe, XupiterToolbar.dll, XTUpdate.dll, XTSearch.dll, BrowserToolbar.dll, BWUpdate.dll, BWSearch.dll, t.dll, u.dll, s


Files:
,  zp.dll. spp.reg, zp.inf, zp.txt, zp.tmp


# processes

Description:
Acrobat Reader, which is used to view PDF documents.


Description:
Acrobat Distiller, which is used to print PDF documents.


Description:
Application that helps to save time when the users signs back on manually after loosing connectivity with AOL. The application starts an automatic function that restores the connection.


Description:
Variant of the RapidBlaster parasite that gets a new folder and file name from its controlling server. After that it creates a named folder, copies itself to that directory, deletes the original process, and runs a new file.


Description:
ActiveX control that helps software developers to add character animation to their software or web pages, text to speech facilities, or end-user voice commands capability.


Description:
AOL Instant Messenger, which is an online chat and instant messaging client.


Description:
Added to the system as a result of Opaserv-A WORM that spreads with network shares.


Description:
Part of Internet Connection Sharing application and Internet Connection Firewall for Windows XP. This service provides support for third party protocol plug-ins for the Internet Connection Sharing application and Internet Connection Firewall.


Description:
Pointing-device driver for touchpads manufactured by Alps.


Description:
Adult content dialer application that can be used to access pornographic material by dialing high-cost numbers using a modem.


Description:
ATI External Event Utility EXE module working in the background.


Description:
Newly added feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) that provides instant notification of events as they happen.


Description:
AutoRun facility for Windows 95, 98, ME, NT4, 2000, and XP. This facility will automatically run an executable as soon as a CD-ROM is inserted into the CD drive of the computer.


Description:
Service that synchronizes the workstation virus definitions with those collected from the McAfee site by the central file server on network versions of McAfee VirusScan.


Description:
Comes with the software for Logitech products. Automatically checks for software upgrades and new products, services, and special offerings from Logitech.


Description:
Advertising spyware that comes with some free software.


Description:
Background task used as a BCM voice modem driver and required for dial-up modems.


Description:
CBlaster Trojan/dialer/downloader that dials pay numbers to adult sites.


Description:
Homepage hijacker, redirecting to coolwebsearch.com.


Description:
Spyware included with the latest version of Grokster.


Description:
Added to the system as a result of the OPASERV.E virus.


Description:
An adware program that downloads and displays advertisements from shopathomeselect.com.


Description:
Process added to the system as a result of AUTOUPDER virus that can be used as a distribution mechanism by worms or other malicious programs.


Description:
Background application that allows the internal modem speaker and allows you to listen to the dial-up sounds. It is related with Zoltrix modems.


Description:
Associated with Norton AntiVirus 2003, which runs auto-protect and email checking facilities. Without this service, both facilities cannot function correctly.


Description:
Program associated with Norton AntiVirus 2003/4. The program is responsible for keeping track of all events that occur within the previously-mentioned products and then writing the details of those events to the Activity Log.


Description:
Background application that is included with the Windows 2000 Resource Kit and monitors user connections to servers and the system they are logging on to.


Description:
Background task associated with Norton Personal Firewall 2003/4 and Norton Internet Security 2003/4 in Windows 2000/XP.


Name:
Common Client Registry Integrity Verifier.

Description:
Service that checks the integrity of the Windows registry entries for Norton AntiVirus 2003/4 and Norton Internet Security 2003/4 in case they may have been modified by a hacker or an unknown virus. Once complete, this task terminates.


Description:
Associated with MacroVision SafeCast copy protection software that allows other software manufacturers to protect their products from illegal copying.


Description:
Microsoft Windows audio CD player, which comes with the Windows operating system.


Description:
Newer name for BroadJump Foundation Client (BJCFD) from BroadJump.com, now Motive. The software collects information on your Internet activity and sends it to your ISP so that your ISP can serve you advertisements related to the type of sites you visit.


Description:
Indexing Service that runs in the background and catalogs files so that you can search for files containing a specific text string.


Description:
Microsoft Index Service Helper, a service that monitors the memory usage of Microsoft Indexing Service (cidaemon.exe) and automatically re-starts cidaemon.exe if it uses more than 40 MB of memory.


Description:
SMS Client Service (Clisvcl.exe) that starts the Microsoft Systems Management Server Software Inventory process. Microsoft Systems Management Server Software Inventory provides a comprehensive scan of the software installed on the computer.


Description:
Microsoft Windows command prompt. Cmd.exe is a 32-bit command prompt used in Windows NT, 2000, and XP.


Description:
Added to the system as a result of the P2P.TANKED virus


Description:
Gator GAIN, adware that is installed by certain free software and is advertising spyware that runs in the background and displays advertisements.


Description:
Background task that works as a MIDI emulator for the integrated sound chip by C-Media based on the CMI-8330 chip set found in cheap motherboards.


Description:
Background task from McAfee Personal Firewall. The application implements the firewall security features. In older versions, the task was named CPDCLNT.exe.


Description:
Windows client server run-time subsystem handles Windows and graphics functions for all subsystems.


Description:
A service that handles the Alternative User Input Text Processor (TIP) and the Microsoft Office Language Bar. It provides text input support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.


Description:
Background task that works as a plug-in manager for Creative drivers. It helps the third party manufacturers to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative sound drivers and utilities.


Description:
Background task for CD-ROM access that gets installed by the Windows 95, 98, or ME drivers of some Creative SoundBlaster soundcards. It also sometimes gets installed on Windows 2000 by non-driver related Creative software suites, such as Creative Jukebox.


Description:
Background application used by Cisco VPN client for making a connection to a remote IPSec server.


Description:
Background task found on Dell laptop computers. The task implements the programmable buttons that you can set up for your laptop computer.


Description:
Background task that is associated with the Dell support software suite.


Description:
Date Manager is a well-designed system tray calendar with a reminder facility. It also installs some adware along with it. Adware software communicates back to an advertising server and displays advertisements as you are browsing the Internet.


Description:
Added to the system as a result of the CIREBOT virus


Description:
Application that is associated with Wild Tangent GameChannel software.


Description:
DirectDraw Helper, a part of DirectX and is used for graphics related services.


Description:
Background application that detects out-of-date virus definitions for Norton Anti-Virus software and runs the Defwatch Wizard. Required only if you don't update the virus definitions manually on a regular basis.


Description:
Process that runs solely on Windows 2000 and XP. It seems to be crucial to the audio input, the Creative Mixer, the PlayCenter, and the AudioHQ application.


Description:
Background task that implements a Distributed File System (DFS) that consists of logical volumes distributed across a local or wide area network.


Description:
Background task included with Easy CD Creator that allows you to use CDs and DVDs formatted with DirectCD.


Description:
Essential background task that is required to assign drive icons and names to flash memory cards.


Description:
Added to the system as a result of the MASTAK virus


Description:
Application that comes with Connexant V.92 and Broadcom modems and is used to check whether you are connected with a digital telephone line or not. If you are connected, the application displays the information graphically.


Description:
DCOM DLL host process that supports DLL-based COM objects and is used by many Windows programs.


Description:
Added to the system as a result of Dumaru.c virus that is a new variant of the Dumaru Virus. The worm trawls the hard disk, looking for files with extensions .htm, .wab, .html, .dbx, .tbb, or .abd for email addresses to send itself to. These email addresses are written to the winload.log file.


Description:
Manages Domain Name System Server (DNS).


Description:
Application that is used to control popups. It blocks those annoying popup advertisements from displaying while you are browsing the Internet.


Description:
Application provided by Dell that is anti-spyware. The application blocks other applications that send vital information to other computers.


Description:
Application that works in the background to send system information to the originators of the program by encrypted emails.


Description:
Microsoft provided Windows Error Dump Reporting Tool that creates memory dump reports that you can send back to Microsoft for further analysis. The tool is found on Windows XP/2003.


Description:
Application that is used to accelerate the download process using intelligent multi-part downloading technology. It can create, add, and modify multiple connections for each download based on your current speed and available bandwidth.


Description:
Believed to be spyware by Alset and is also known as "HelpExpress". The spyware installs itself if you have previously had Attune by Aveo installed.


Description:
Logitech MouseWare tray icon from which you can access the Control Panel Mouse properties and the MouseWare help.


Description:
Application which works as a Scheduler for Real Networks .It is installed with RealOne Player.


Description:
Added to the system as a result of the GRAYBIRD.G virus.


Description:
Windows Program Manager or Windows Explorer, which handles the Windows Graphical Shell including the Start menu, taskbar, desktop, and File Manager.


Description:
Application that is installed by the Easy Systems DragÆn Drop CD & DVD writing software found on most Japanese computers.


Description:
Microsoft Office Indexing process used by Microsoft Office applications to index Office documents to speed up search operations.


Description:
Application that works in the background and allows a user to install and run any other suitable application as a Windows NT or 2000 service.


Description:
Application that is associated with the file sharing software iMesh. The application has many versions.


Description:
Application that notifies a user of new or updated Wild Tangent games. If the application finds updated versions of installed games, then the application automatically downloads the updated version in the background.


Description:
Spyware application associated with the Gator advertising program.


Description:
Background program that is part of the Gator GAIN adware software.


Description:
Application that is used to convert the Windows 3.1 groups to folders while upgrading from Windows 3.1.


Description:
Installer for a program called "HotBar". Hotbar enhances the surfing experience offering a variety of innovative and fresh skins for the browser while providing users worldwide access to various services. These programs gather information on your browsing habits and transmit it back to HotBar.


Description:
Part of Hotbar.com HotBar. HotBar is software that supposedly enhances and personalizes your Internet and email applications.


Description:
Part of the Windows XP Help system. This application is started when you click Start > Help and Support from the Windows taskbar.


Description:
Windows Help program, which is used to open Help files and documentation included with many Windows programs.


Name:
Microsoft Human Interface Device Audio Service

Description:
Background service that provides support for USB audio devices and USB multimedia keyboards


Description:
Application that implements the Intel Hotkey command.


Description:
Application that is a component for SiS AGP patch, which is useful only when the processor supports HyperThreading.


Description:
Adware that helps a user in purchasing items. For example, the application tells a user when to buy printer cartridges and where to buy them.


Description:
Another adware application from Alset Inc. It has same functionality as others. For example, the application tells a user when to buy printer cartridges and where to buy them.


Description:
Essential component of the Norton Internet Security and Norton Personal Firewall security products.


Description:
Application that hijacks the browser home page and redirects all requests to coolwwwsearch.com.


Description:
Application that is installed by peer-to-peer file sharing software.


Description:
Microsoft Internet Explorer web browse used to browse the World Wide Web through HTTP.


Description:
Application that is a variant of the RapidBlaster parasite that downloads advertising from the Internet and displays it periodically.


Description:
Intel graphics system tray icon that gets installed with the drivers for onboard VGA cards based on the Intel 81x graphics chip set. Double-clicking the icon allows you to quickly change the display resolution, save your current display scheme, or configure your onboard graphics card. You can also configure keyboard hotkeys; shortcuts are handled by another background task called HKCMD. You can access the same features through the "Intel Graphics Technology" icon in the Control Panel.


Description:
InetInfo, which is part of Microsoft Internet Information Services (IIS) and is used for debugging. The service is seen primarily on Windows NT 4 or 2000 Server where InetInfo provides Internet proxy and web server services.


Description:
Adult content dialer that is specific to porn related material.


Description:
Variant of Msview parasite that monitors web pages requested and data entered into forms. The parasite sends this information to its home server and opens pop-up advertisement windows.


Description:
Adware application that provides offers to users through popups.


Description:
Application that provides multi-language support on keyboards for Microsoft Windows programs.


Description:
Microsoft virtual private network client that provide remotes access connections across public networks, such as the Internet.


Description:
Virus added to the system as a result of variant of the OPTIX PRO TROJAN that opens TCP port 3410 and allows a hacker to control an infected computer.


Description:
Application that allows a user to send and receive messages between Windows Advanced Server sites.


Description:
Application that is an Internet Explorer toolbar that helps a user to find adult material on the net. The application also displays advertisements.


Description:
Application that is associated with Sun Java for Windows.


Description:
Added to the system as a result of the TROJ_DASMIN.B virus that creates auto-run registry entries that enable the automatic execution of its copy, JDBGMRG.EXE.


Description:
Application that is an update scheduler. The application checks the Sun site to see if newer Java versions are available.


Description:
Application that is a file sharing program used by adware programs.


Description:
Indication of a possible infection of OPTIXPRO.12.C. Backdoor.OptixPro.12.c is a variant of the Backdoor.OptixPro.12 Trojan Horse and allows unauthorized remote access to an infected computer on port 3410.


Description:
Multimedia keyboard manager for Logitech keyboards and is required if you use the multimedia keys.


Description:
Application that monitors the web pages a user visits and displays advertisements based on keyword searches from the user.


Description:
Windows Kernel, which provides system services for managing threads, memory, and resources.


Description:
Virus added to the system as a result of Floodnet virus that attempts to send a message to the alias"All Users" using Microsoft Outlook. If this address is not present in a local or global address book, or not an alias on the specified SMTP server, then the message is not sent.


Description:
Application that is a Microsoft Systems Management Server that provides application deployment, asset management, security patch management, Windows Management Services integration, and other facilities.


Description:
Spyware application associated with DownloadWare.


Description:
Application that is associated with Lexmark MarkVision software that is used to configure the internal network card that comes with a Lexmark printer.


Description:
Background application used for the Lexmark Printer Port Scanner. The application allows a user to share a printer over a Windows network. Without this application, users cannot share printers. The application is installed with other printer drivers.


Description:
System tray bar application that is used to show the modem status. The application contains two red/green activity lights that help users to get the modem status.


Description:
Application that is used to update the Asus graphics card drivers.


Description:
Application that hijacks a userÆs home page and redirects the browser to coolwwwsearch.com.


Description:
MSN Queue Manager Loader, a service that is installed with MSN Explorer and MSN Messenger. It can use a lot of system resources.


Description:
Load WebCheck does the following: (1) customizes some of the settings in Internet Explorer, (2) adds, removes, and updates subscriptions and (3) propagates settings for user profiles.


Description:
Background task that runs on Windows NT 4, 2000, and XP platforms, and maintains the database of currently publicly-declared procedures. Server processes and applications register all their publicly declared procedures with Locator. Thus, client processes can query Locator for specific publicly-declared procedures.


Description:
Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.


Description:
Application that is associated with Norton LiveUpdate, which updates the software and virus definitions.


Description:
Application that is used for Logitech QuickCam home cameras. The application allows the camera to be accessed by NetMeeting, Windows Movie Maker, and the QuickCam software.


Description:
System Attendant Service for Microsoft Exchange Server that runs in the background and is needed by Microsoft Exchange Server. The service loads DLLs for Microsoft Exchange, writes log messages, and generates the offline address books


Description:
Also known as MAPI Spooler. The application dispatches the messages waiting in Microsoft Exchange, Windows Messaging, or the Microsoft Outlook outbox.


Description:
Added to the system as a result of the KX virus and also recognized by Symantec as FPAI adware.


Description:
Application that is associated with McAfee antivirus software that scans files in the background when you access them.


Description:
Home page hijacker application that redirects the browser to a pornographic web site.


Description:
Machine Debug Manager is used for debugging applications by technically advanced users and developers and is installed by the Microsoft Script Editor that is included in Microsoft Office.


Description:
MyFreeInternetUpdate is an adware program and downloader.


Description:
Matrox BIOS guard process. Disabling this will impact the operation of your Matrox graphics card.


Description:
Microsoft Management Console application is used to display various management plug-ins accessed from the Control Panel, such as the Device Manager or the Computer Management console. The Microsoft Management Console manages most of the Microsoft system products such as SQL Server, Exchange server, and more.


Description:
Spyware application that is packed with the popular iMesh and KaZaA file-sharing programs.


Description:
Windows Multimedia Background Task Support Module that handles multimedia services. The software provides simulated multitasking for multimedia applications; for example, you could be playing more than one AVI movie at the same time. This task does not exist in Windows NT 4, 2000, or XP operating systems, which are true multitasking operating systems.


Description:
Part of MusicMatch Jukebox that is digital music player, CD burner and ripper, music organizer, and play list creator.


Description:
Application that is associated with Internet Explorer and used to update the network copy of materials that are edited offline, such as documents, calendars, and email messages.


Description:
Application that helps in monitoring Windows NT Server Performance. Monitor.exe runs from the command line on your local workstation. You use this service to start, stop, and set up the Datalog service on the target server.


Description:
Application that is used to collect information and statistics about user browsing habits and transmit them back to the World Media center. The application takes the browser to a site that is part of the advertising network and then redirects back the browser to the original target site.


Description:
Newer version of Windows Media Player, which is used to open and play music, sound and video files.


Description:
Application that allows Windows 95, 98, or ME to have more than one network client, protocol, or adapter. The software routes network requests between the different adapters and clients.


Description:
Added to the system as a result of the RSBOT virus.


Description:
MSBB Web3000 spyware application that is included with some adware products and is started from the registry when Windows is loaded.


Description:
Internet worm that uses a vulnerability in DCOM/RPC (port 135) to infect 2000/XP systems. The worm allows TFTP that is used to transfer the worm.


Description:
Spyware web downloader. The application is installed by a spyware ISTbar that is an Internet Explorer toolbar. The spyware is a home page and search hijacker.


Description:
Added to the system as a result of Win32.Sobig.B@mm (Palyh) virus that is a mass mailer and spreads with email, as an attached file.


Description:
Application that loads into the system as an Internet Explorer Helper add-on and changes the browser behavior. When the user browses the Internet, specific words are highlighted in yellow to attract the user and re-direct the user to advertiser related pages when the user clicks on the words.


Description:
A file that helps to manage startup and configure system files like autoexec.bat and win.ini. This file also changes the display of printer properties.


Description:
Added as to the system as a result of the MULDROP.352 virus.


Description:
Application that is loaded into the system by Microsoft Personal Web Server and Microsoft SQL Server. The service is used to manage transactions across multiple servers.


Description:
Windows Message Server, which loads Windows drivers and the Program Manager at start-up. The software runs invisibly in the background performing a variety of essential services, most of which concern on-screen messages and notifications.


Description:
Application that belongs to Intel LANDesk client Manager v6.0.


Description:
Application that is used to run HTA files in Windows. The application is loaded as soon as an .HTA application needs to run and then terminates when the application completes.


Description:
Windows Installer Component that is used to install new programs that use Windows Installer package files (MSI).


Description:
Added to the system as a result of the Troj/OptixP-13 Trojan. This Trojan is a backdoor virus that can be used to gain unauthorized remote access to the computer over a network.


Description:
Microsoft Outlook Express, an email and newsgroup client included with Microsoft Windows.


Description:
Added to the system as a result of as a result of the BLASTER.E WORM that exploits the DCOM Rcomputer vulnerability using TCP port 135. The worm targets only Windows 2000 and Windows XP computers.


Description:
Added to the system as a result of the RANDEX.D virus.


Description:
Tray bar icon for MSN Messenger that is an online chat and instant messaging client.


Description:
MSN Messenger, an online chat and instant messaging client.


Description:
Windows Product Activation, which is used to activate an Windows XP license.


Description:
Microsoft Paint, which is an image editor included with Microsoft Windows that can be used to edit bitmap images.


Description:
Helper service installed by Windows Media Player 7. The service allows Windows Media Player to support the SDMI (Secure Digital Music Initiative) protocol when copying CDs or packaging copyrighted downloaded music to SDMI-compliant music players and storage devices.


Name:
Remote Access / Hacking tool / ICQ trojan

Description:
Added to the system as a result of an ICQ Trojan that alters Win.ini and System.ini files and generates several. .exe-files with randomly chosen names.


Description:
Application that generates full-text indexes on content and properties of structured and semi-structured data to allow fast linguistic searches on this data that is used for IIS.


Description:
Application that is used to hide folders, files, and applications. The application can also encrypt them for better protection. Folders and files are hidden even when this application and the operating system are not running.


Description:
Added to the system as a result of the MYSS.B virus.


Description:
Windows Task Scheduler, a service that schedules tasks, such as backups or updates, to run at certain times or dates.


Description:
Msvxd.exe, the executable component of a Win32 worm called W32/Datom-A that uses Windows network shares to spread. The worm consists of three files: msvxd.exe, msvxd16.dll and msvxd32.dll. Msvxd.exe loads two other DLL files.


Description:
Application that is used to load a specific MTS package by generating MTS objects on behalf of client applications.


Description:
Background application for Norton AntiVirus that provides auto-protection features to the system. It runs on Windows NT/2000/XP.


Description:
Background application for Norton AntiVirus that provides auto-protection to the system. It runs on Windows 95/98/ME.


Description:
Application that is used to install or control Nero driver nerocd2k.sys application. It is associated with Nero CD writing software.


Description:
Added to the system as a result of the RANDEX.F virus that is a network aware worm.


Description:
Application that is the Network DDE server for Microsoft Windows. The software allows applications that use the DDE transport to transparently exchange data over a network.


Description:
Application that is the principal file called by Netscape Navigator, Netscape Mail and News, and Netscape Messenger.


Description:
Application that collects all information about the traffic that passes through the Norton firewall.


Description:
Application that is associated with Norton Speed Disk. The application is installed only to start the Speed Disk automatically by default on Windows start-up.


Description:
Notepad, text editor that is used to open text documents and is included with Windows.


Description:
Added to the system as a result of an unidentified virus.


Description:
Added to the system as a result of the RANDEX.E virus.


Description:
A dialer program that dials to a site specific to adult or pornographic content.


Description:
Application that is used to maintain file synchronization of file directory contents among multiple servers.


Description:
Application that provides an environment for a 16-bit process to execute on a 32-bit platform.


Description:
Application that is loaded to the system by NVIDIA graphics card drivers.


Description:
Application that allows a users to have 32 virtual desktops, get a desktop larger than the viewable area of the monitor, divide the display across more than one monitor, manage applications, and many more features.


Description:
Adult content dialer that dials numbers specific to porn related sites.


Description:
Microsoft Office Startup Assistant that is loaded at start-up and improves performance by handling automation, Office fonts, certain Office commands, and Outlook notification.


Description:
System tray bar application that allows a user to change the color or font of display. The user can also modify other display settings.


Description:
Added to the system as a result of the NETBUS virus. The program is a remote administration hack tool that can be used to control other computers, with Netbus Server installed, through the Internet or the network. The hacker must have the Netbus Client installed. PATCH.EXE is the server part of the program.


Description:
Application that is loaded to the system by the drivers for the PCTEL 2304WT V.92 MDC modems.


Description:
Application that is associated with Intel LANDesk Management Suite software. The application helps to find registered products on a computer.


Description:
Application that is associated with the advertising product from The Delfin Project. The application is loaded to the system by the file sharing application kazaa.


Description:
Background task for Toshiba that regularly checks for software and driver updates.


Description:
Microsoft Intellimouse Monitor adds a mouse settings icon to the tray bar.


Description:
Foistware by Integrated Search Technologies that is behind the ISTbar parasite. ISTbar is an Internet Explorer toolbar, home page, and search hijacker.


Description:
Application that allows users to win cash and prizes just for surfing the Internet and shopping online.


Description:
NetRatings software that measures Internet usage anonymously and surveys participants according to their profiles and online habits. This software has been reported to be installed automatically after a Grokster install. The application anonymously collects your use of the Internet protocols, such as sites visited, web pages, advertisements seen, electronic commerce, and streaming data.


Description:
Adware software Adtomi that offers banner advertising services and ad hosting for web masters.


Description:
System tray bar application that shows LEDs that give information on the network traffic going through an Intel Pro network card. The application also allows users to call diagnostic features, configuration data, and setup screens.


Description:
Application that detects whether the laptop computer is getting its power from the battery or from the adaptor. If the laptop computer is running on a battery, the application scales down the frequency and voltage of the CPU to reduce power consumption.


Description:
Application that provides functionality to keyboard on Hewlett Packard computers.


Description:
Application that allows a user to block advertising popups while browsing the Internet.


Description:
Microsoft Protected Storage Server, in Win95/98/ME, or Protected Storage Service, in WinNT/2000/XP. Protected Storage, in the form of PSTORES, was introduced with Internet Explorer 4. It is invoked by Microsoft Internet programs, such as Outlook Express and Internet Explorer, to securely store a variety of secure and confidential data into the registry, such as Outlook Express passwords, SSL certificates, auto-complete fields, such as usernames and passwords to enter web sites, and so forth, and web forms data.


Description:
Application that is associated with PCTEL modems and is needed for the functioning of those modems.


Name:
NAV CE Server/Client - Symantec Central Quarantine

Description:
Application that is associated with Norton and is used to accept infected files from servers and clients and communicates with Quarantine Console.


Description:
System tray bar application for Apple QuickTime software that allows a user to access software from the system tray.


Description:
Application that allows a user to control system startup programs. By using the registry, Startup folders in the Start menu and Win.ini file, the application gives list of all programs that are configured to start on boot up. A user can enable, disable, or delete an application from that list.


Description:
Application that hijacks the browser home page and re-directs browsers to adult content web sites.


Description:
Variant of the RapidBlaster parasite that runs as a task at Windows start-up. The application downloads advertising from the Internet and displays it periodically.


Description:
Related to PrizeSurfer. PrizeSurfer is stealth-installed malware that automatically enters you to win cash and prizes when you surf and shop on the web. This program can show different popup windows and can redirect you to different web sites. This may cause a problem with your security and privacy.


Description:
System tray icon for RealPlayer. Real Player is a media player used to open and play music, sound and video files in Real Media Format. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling SmartCenter with Preferences


Description:
Application that is a scheduler program for the RealOne player that prompts for update.


Description:
Small Dos based application used to reboot the computer. Users can set delays for reboots through the command line switch.


Description:
Application that is used to change settings in the system registry. This application contains information about how your computer runs and what software is installed on the computer.


Description:
A service that allows access to the Windows registry from remote computers. The service runs on Windows 2000 Server and Advanced Server. Whenever you install Microsoft software, such as SQL on Windows 2000 Server, and your setup program needs to write keys to the registry, the setup program interacts with the Remote registry Service (REGSVC.EXE) and the Remote registry Service does the actual writing of the registry keys. This background service is also required if you intend to edit the registry from a remote computer using Windows 2000 Remote Administration facilities.


Description:
Application that is used to register dynamic-link libraries and ActiveX controls in the registry.


Description:
Windows Dial-Up Networking application that handles dial-up modem connections. RNAAPP only appears in your Task List if your computer tries or tried to dial out at some stage or if the computer is waiting for an in-bound connection using Dial-Up Networking.


Description:
Background application associated with Real Networks RealOne Player.


Description:
Application that allows other programs to call publicly declared procedures over a network. This application becomes a crucial component for other network related Microsoft software.


Description:
Application that is associated with Norton Anti-Virus that provides a real-time virus scan service. It also helps to keep in touch with the Symantec System Center.


Description:
Background application used to download Instant Updater for McAfee VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products whenever a user connects to the Internet.


Description:
A key recorder and screen capture utility that controls and monitors everything that happens on your computer and online.


Description:
Added to the system as a result of the LOXOSCAM virus that is a backdoor Trojan that allows a hacker to gain access to the computer. The application is written in the Delphi programming language.


Description:
Added to the system as a result of the Sdbot.F virus that is a Backdoor Trojan that is a variant of Backdoor.Sdbot. The application allows a hacker to control your computer by using the Internet Relay Chat (IRC).


Description:
Microsoft "Run a DLL as an App". RUNDLL32 is the Microsoft Windows program that loads DLLs into memory so that they can be used by specific programs or by Windows.


Description:
Known as the Microsoft "Run Once" wrapper. The application is a program that developers can use as part of their installation procedures to ensure, for example, that after the first reboot after the software installation, some additional configuration program runs once, and once only, to complete the installation.


Description:
Added to the system as a result of the MAPSON.D virus. W32.Mapson.D.Worm is a mass-mailing worm that sends itself to all the contacts in the MSN Messenger contact list and also attempts to spread through file-sharing networks and ICQ. The worm also attempts to terminate some popular antivirus, firewall, and system-monitoring programs.


Description:
Application that automatically performs system tuning tasks like disk optimization and error correction. The application can also run any application at prescheduled times.


Description:
Application that is used to detect the presence of a printer port and whether it is set to ECP or EPP. After detection, the application sets options in the printer software.


Description:
Application that collects and combines user Internet browsing behavior and sends it to ShopAtHomeSelect servers.


Description:
Application that provides users with coupons and offers while browsing the Internet. The application captures the web site addresses and search words and displays popup advertising related to sites that the user visited.


Description:
Application that provides users with crucial coupons and offers while browsing the Internet. The application captures the web site addresses and search words and displays popup advertising related to sites that the user visited.


Description:
Application that is an Internet Explorer plug-in and claims to enhance user web browser functionality.


Description:
Main executable for Watchdog 2.0 Software that is a monitoring program. The application has many features like Key Log Capture., Instant Messenger Capture, for MSN, AOL, and Yahoo, and Application Log Capture.


Description:
Added to the system as a result of the SIRCAM virus that contains its own SMTP engine and propagates in a manner similar to the W32.Magistr worm.


Description:
Application that is used to check the integrity of the Windows registry. The application starts on boot up and checks the registry for errors. On finding major errors, the application informs the user to restore from backup; otherwise, the application fixes minor errors.


Description:
Application that provides a facility for Smart Card authentication on local or network computers.


Description:
Application that is used to track the changes to the registry, INI files, system files, hardware, network connections, and operating system versions. The application also offers a restore function.


Description:
Application that is used to manage all services running on windows. The application provides functionality to stop start, pause, and restart the service. Also offers to change and set the startup type, both automatic and manual, for the service.


Description:
Application that is the OPASERV virus. The worm attempts to spread over network shares by copying itself to the Windows directory of remotely accessible computers as SCRSVR.EXE.


Description:
Added to the system as a result of the W32/Agobot-S virus that is an IRC backdoor Trojan and network worm. W32/Agobot-S copies itself to network shares with weak passwords and attempts to spread to computers using the DCOM Rcomputer and the Rcomputer locator vulnerabilities.


Description:
Application that allows web site owners to determine the geographic location, connection speed and detailed demographics of every visitor to a web site.


Description:
Added to the system as a result of the Worm.Win32.Raleka virus.


Description:
Application that is used only in Windows NT 4, 2000, and XP for starting, stopping, and interacting with system services.


Description:
System tray bar application that is used to remind the user to back up files. This free utility works with BackupMyPC, Simple Backup, and MS Backup software.


Description:
Sygate Secure Enterprise that extends the traditional network security solutions, such as firewall and IDS to the endpoint, and enforces the fact that each device on the network is running the correct security policy.


Description:
Application that is used to start, manage, and delete user sessions or client sessions under Terminal Server.


Description:
Windows Volume Control process, which is used to control the volume of the sound card and can usually be access from the system tray bar.


Description:
Windows Simple Network Managment Protocol (SNMP) agent, a proxy that listens for requests and hands them off to the appropriate network provider.


Description:
A trap message that was generated by local or remote MP agents. The service receives and passes these on to SNMP management programs on the computer.


Description:
System Soap Pro Internet cleaning software that bundles foistware like HTTPER and Zipclix.


Description:
System tray bar application that provides support to control the Sony/Philips Digital Interface input and output. The application also allows a user to change the function of the input and output ports of a soundcard from Line-In, Line-Out, and MIC to Front, Rear, and Centre speakers.


Description:
Added to the system as a result of the RANDEX.J virus, a network-aware worm. This worm receives instructions from an IRC channel on a specific IRC server. One of these commands starts the spread of the worm across the network.


Description:
Application that handles the spooling of print jobs transparently. It works only when the user configures the printer to spool print jobs.


Description:
Windows Printer Spooler Subsystem, a service that controls de-spooling of printer data from disk to printer.


Description:
Windows Printer Spooler, a service that stores printer jobs and forwards them to the printer when it is ready.


Description:
Also called ShopNav. This application is a search hijacker implemented as an Internet Explorer Browser Helper Object, with an updater process run at startup. The application tracks and hijacks the following: Address bar searches, the Search explorer bar, unknown domains, and, in some variants, non-www server names entered into the address bar without the preceding 'http://' will be sent to Srng controlling server www.srng.net, that redirects to a search service at apps.webservicehost.com.


Description:
Application that is associated with Microsoft Windows NT 4, 2000, and XP Resource Kits and is used to run normal Windows applications as services.


Description:
Application that provides Simple Service Discovery Protocol and General Event Notification Architecture services for the Universal Plug and Play functionality and is a component designed for the future generation of plug and play devices.


Description:
Hijacker application that may reset your browser home page and/or search settings to point to sites that you do not want.


Description:
Application that provides easy access features for Compaq Easy Access Keyboard. A user can program those keyboard keys to perform specific tasks.


Description:
Program used to test update and patches for Half-Life Valve game.


Description:
Application that provides one-touch scanning for a scanner. The application is automatically started through registry settings.


Description:
Still Image Service, which handles scanners and digital cameras and is installed by Windows if a scanner or camera is connected to the computer. This is the equivalent of STIMON.exe, but for Windows 2000 and XP.


Description:
Application used to play all common sound files.


Description:
Added to the system as a result of the W32.Akosw@mm virus. This virus is an email worm that spreads using its own SMTP engine. W32/Israz-A also targets the KaZaA file sharing utility. Upon execution, the worm creates copies of itself in the Windows system folder with the filenames vShell.exe and Win32.exe. The worm also creates copies of itself in the Windows temp folder using the filenames Fun.exe, FAQ.exe, Q322593.exe, Support.exe, ToolBar.exe, and Wizard.exe.


Description:
Hijacker, Clientman parasite variant, redirecting to madfinder.com. Detected by Symantec as the MADFIND virus.


Description:
Application that works as a host process for services that run from dynamic link libraries.


Description:
Added to the system as a result of the Sdbot-N virus which is a backdoor Trojan that allows a remote user unauthorized access and control over the computer with IRC channels. The application runs in the background as a service process and attempts to connect to an IRC server and join a specific channel. The virus then listens on the IRC channel for specific commands and carries out the appropriate actions.


Description:
Added to the system as a result of Worm.P2P.Spybot.gen virus. This virus spreads through peer-to-peer (P2P) sharing, rather than through open Windows file shares. The infected systems are scanned for unprotected Windows file shares.


Description:
Added as a result of the MARI , SYSXXX and other viruses. Mari is an Internet worm spreading with emails as an attached .exe file. Whereas SysXXX is a backdoor Trojan program that was written in the Delphi language, Backdoor.SysXXX gives a hacker complete access to your computer. By default, the Trojan opens two TCP ports, 31,556 and 6,051, that it uses to communicate with the hacker. The application notifies the hacker through email or ICQ. Also, Backdoor.SysXXX attempts to terminate various security products and system monitoring tools.


Description:
The Windows Memory Handler System Process zeroes any free pages of RAM and is the only process with priority 0


Description:
Background application that runs the Windows system tray, which provides space to display the clock time and icons installed by other applications.


Description:
Background service that provides Windows Telephony (TAPI) Support in Windows 98 and Windows NT 4. The service is an essential task used by all telephony services, such as dial-up networking through any type of modem, in these two operating systems.


Description:
Application that displays all processes running on the system. The application is activated by pressing Ctrl+Alt+Del buttons on Windows NT 4, 2000, and XP.


Description:
Application that is used to collect information from hard disksby monitoring the most frequently used programs. This information is used by the Disk Defragmenter program, so that the programs and files that the user accesses the most will load faster.


Description:
Application that displays a preview window of each program that the user can switch to by pressing Alt+Tab on the keyboard.


Description:
Application that provides network and Internet communication through TCP/IP. Started only when the user configures special TCP/IP services, such as the DHCP Server.


Description:
Indication of the Lovesan worm. This worm scans several IP networks to get access to port 135 (COM). The worm sends a buffer overrun request to vulnerable computers. The newly infected computer then initiates the command shell on TCP port 4444. Lovesan runs the thread that opens the connection on port 4444 and waits for the FTP 'get' request from the victim computer. The worm then forces the victim computer to send the 'FTP get' request. Thus the victim computer downloads the worm from the infected computer and runs it. The victim computer is now infected.


Description:
Application that is used to write data to CDs directly from Windows applications, without using the actual CD Writing software.


Description:
Spyware from SupportSoft provided to manufacturers, such as Sony (Vaio Support Agent) and Toshiba (Virtual Tech), and ISPs, such as Comcast, Cox and Charter (Pipeline Support Agent), that allows them to offer on-line support. This part ensures that software is installed correctly. Regarded as spyware as it has the ability to retrieve user information.


Description:
Application that works as a scheduler and is loaded into the system along with RealOne Player.


Description:
Gator Advertising and Informational Network (GAIN) that delivers online advertising and informational messages based on web sites that you view.


Description:
Adware application that affects the performance of Internet connections seriously. The application comes with free software.


Description:
Allows the checkout process for customers in order to safely and securely purchase software. This spyware installs automatically.


Description:
Utility program to capture, print or save the current window from Gadwin Systems, Inc.


Description:
Application that allows live streaming statistics for each match of one league or across all leagues. The application is officially licensed MLB pitch-by-pitch real-time updates from every stadium around the league.


Description:
Application that reminds users to register for their Creative Labs products.


Description:
BrowserPal, a free popup ad blocker. Browser


Description:
Program that gets installed with Microsoft Money 2002. The application runs in the background and works with Internet Explorer and the MoneySide applet from Microsoft Money. The application monitors the web pages you visit and, if you come to a page with financial information that may be relevant to financial information in Microsoft Money, the program displays the MoneySide toolbar in Internet Explorer.


Description:
Application used to run a program before a shell starts. The service runs logon scripts, reestablishes network connections and starts the shell.


Description:
Tray bar icon application for Norton AntiVirus Corporate Edition 7.x. It helps you to start Norton AntiVirus in order to configure it, run a virus scan, do a LiveUpdate, and more.


Description:
Real-time virus scanning task for McAfee VirusScan, which runs in the background and scans files as you use or create them.


Description:
Application that is associated with ZoneAlarm personal firewall, which monitors Internet traffic and generates alerts by following the security rules that users configure in Zone Alarm.


Description:
Wan miniport (ATW) service provided by AOL. Deletion of this file creates problems with Internet connections. Re-installing AOL does not fix the problem.


Description:
Microsoft free synchronization manager that runs in the background in the system tray and allows you to synchronize your Windows CE-based handheld or Palm-size computer with your desktop computer. The manager helps to synchronize documents, email, and calendar items.


Description:
Web driver used in many applications, from games to MP3 players. The driver is provided by Wild Tangent to collect feedback about new hardware through an Internet connection.


Description:
Application that is used mainly by hacker to gain control of targeted system.


Description:
Component of McAfee antivirus products that run in the background and scan Internet downloads for viruses. The component also provides you with email protection by scanning email attachments. The component also watches out for malicious code in the Java and ActiveX applets on the web pages that you access.


Description:
Added to the system as a result of the LOVELETTER (I Love You) virus.


Description:
Added to the system as a result of the RATEGA virus that is a Trojan horse that gives a hacker complete access to your computer. By default, the Trojan listens on port 6969 and notifies the hacker through email. The Trojan notification message will contain the subject line "Omega Help."


Description:
Variant of adult content dialer program that dials toll numbers without user awareness or permission.


Description:
Active variant of LOP.com hijacker that sets your start page and Internet Explorer search features to use the site lop.com ('Live Online Portal') or one of its clone sites.


Description:
Launches popular high fidelity music player for Windows 95, 98, and NT that plays MP3s, MP2s, WAVs, VOCs, and MIDIs. The utility also helps to organize these sound and video files.


Description:
Added to the system as a result of W32.HLLW.Nulut WORM that attempts to spread through file-sharing networks and email.


Description:
Added to the system as a result of the WINET VIRUS! which is a Backdoor Trojan Horse that will install itself in the System directory. It receives instructions from a hard-coded URL.


Description:
Added to the system as a result of the WOLLF.16 VIRUS! which is a Backdoor Trojan Horse that installs itself as a server and allows unauthorized access to an infected computer. This Trojan is written in Microsoft Visual C++.


Description:
Added to the system as a result of the RANDEX.E VIRUS! which is an Internet Relay Chat (IRC) Trojan Horse that allows its creator to control a computer by using IRC. It is also a worm that can use the DCOM RPC vulnerability to spread itself.


Description:
Windows NT logon utility that manages user logons and logoffs. The utility prompts you for the password when you log on and allows you to log off or shut down.


Description:
New breed of malware which loads MSHTA.EXE.mshta.exe accept HTA scripting within a web page and then execute what is embedded IN the page as a program.


Description:
Windows Management Instrumentation from Microsoft that allows you to write scripts for the management of devices, user accounts, services, networking, and other aspects of your Windows 98/ME/NT/2000 system.


Description:
Internet Explorer Add-on toolbar from CommonName which enables you to enter keywords or short phrases which will take you straight to the website of the organisation that might have bought those keywords.


Description:
Windows MS-DOS Console provides DOS console and script functions in Windows. It is the interface between the Windows mode and DOS mode in Windows.


Description:
Existance of this file shows that you have the W32.Sobig.F worm in your system.W32.Sobig.F is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds on your system. The email message has a fake FROM address


Description:
Windows Internet name service that is based on DNS (Domain Name System).


Description:
Added to the system by PurityScan which is distributed by an advertising company.winservn loads at start-up and spawn massive quantities of large popup ads when the user is online


Description:
new variant of Sobig, known as Sobig.E.The worm usually arrives in e-mails with body text "Please see the attached zip file for details." and attachment "your_details.zip"


Description:
A Foistware from iGetNet which installs components without your knowledge.It turns the IE address bar into a keyword engine piped into IGetNet.


Description:
Internet Explorer Helper plug-in from iGetNet which redirects the end-user to advertising clients of iGetNet. iGetNet sales keyword to his client.so whenever the user enters that words it connects the user to that client's site.


Description:
Addedto the system  as a result of the YAHA.U VIRUS! which is a variant of W32.Yaha.J@mm.Terminates some antivirus and firewall processes and uses its own SMTP engine to email itself to all the contacts of the Windows Address Book, MSN Messenger, .NET Messenger, Yahoo Pager, and in all the files whose extensions contain the letters HT.


Description:
Added to the system as a result of the RADO VIRUS! which is a Backdoor Trojan Horse.It gives its creator unauthorized remote access to your computer. When the Trojan is executed for the first time, it displays a fake error message with the text, "Incompartible Windows Version." See the Technical Details section for an illustration.


Description:
Microsoft Word, a word processing program included in Microsoft Office.


Description:
WinZip, which is a file compression utility used to create, open and extract zip files. WinZip zips up a document and attaches it to an email message without leaving Explorer. It can also extract and install from MIME and other encoded files. This tool makes working with .zip and other types of archive files easier.


Description:
Command line utility tool from Microsoft (R) Corporation to view window-based Java applications.


Description:
Application that is used to remind the user of scheduled events. It is associated with MS Works Calendar program.


Description:
A background process that checks automatically for Microsoft Works updates when you are connected to the Internet.


Description:
Update detector for Microsoft Works 2002 PictureIt. If the detector is enabled, it tries to dial your Internet service provider, connect to the Internet, and download any updates available.


Name:
MicrosoftÆs Windows Management Instrumentation (WMI).

Description:
Application that gives a standard method of accessing system information, performance information, event monitors, and application monitors. The application works as a transparent task.


Description:
Windows Media Player, which is used to open and play music, sound, and video files. It is the default media player that comes with the Windows operating system.


Description:
This parasite  added to the system as a result of running a program called "Yo Mama Osama" (osama.exe).There are other ways this can show up on your system, and it will manifest itself by periodically opening a new browser window with advertising for copy DVD software and the like.


Description:
WordPad, a text editor used to open and edit.txt and .rtf documents. You can create and edit simple text as well as documents with complex formatting and graphics. You can link or embed information from other documents into a WordPad document.


Description:
Windows On Windows Execution Support Process that provides support for 16-bit Windows applications together with ntvdm.exe. The service is started by NTVDM, which starts every time you run a 16-bit program.


Description:
Application that allows users to run scripts from Windows. The application displays a dialog box for setting script properties.


Description:
Background process responsible for updates to Windows ME. Whenever you connect to the Internet, Wuauclt checks the Microsoft web site for updates to Windows ME.


Description:
Added to the system as a result of the IMISERV VIRUS! which is a backdoor Trojan used to control a target computer from a remote location.It consists of a Server and a Client part. It distributes the Server part to target computers and uses the Client part to control the system running the Server part.


Description:
Application that is used to solve a problem of remote control service starting.


Description:
System tray bar application that allows a user to start WinZip software from the system tray.


Description:
Application that is associated with Intel LANDesk Management Suite and used for communicating between the core server and managed clients.


Description:
Software that prevents software from being reverse engineered.


Description:
System tray application for Yahoo Messenger, which is one of the most popular instant messaging programs.


Description:
This application protects your computer against malicious BHOs and does registry optimization.


Description:
Port Monitor is an application that monitors and protects all access ports.


