What processes can be deleted?

Question

What are processes that are operating and which ones are necessary and which can I safely delete.

Answer

This question was answered on December 2, 2004. Much of the information contained herein may have changed since posting.

System Idle Process

Description: The system idle process, is getting CPU time when the system is idle. Doing nothing. The System (NOP).

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A

Removal: N/A

External Info: Win32 Services book

System -

Description: The operation system process.

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A (emmm...uninstall windows?)

External Info: Mastering windows 2000 server

smss.exe -

Description: The operation system process.

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A (emmm...uninstall windows?)

External Info: Win32 Services book

csrss.exe -

Description: Client-Server run-time server subsystem.

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A (emmm...uninstall windows?)

External Info: Win32 Services book

winlogon.exe -

Description: Handles logon authentication.

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

services.exe -

Description: A catch-all for many system services. Handles DHCP client, DNS queries, browser services, plug-and- play, messenger, and time services

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

svchost.exe -

Description: A generic program that DLL-based services are executed under. Multiple services can be in each svchost.exe that is running (more than one can run at a time)

Services:

COM+ Event System

(EventSystem)

Internet Authentication Service (IAS)

Internet Connection Sharing (SharedAccess)

Network Connections (NetMan)

Remote Access Auto Connection Manager (RasAuto)

Remote Access Connection Manager (RasMan)

Remote Procedure Call (RPCSS)

Removable Storage (Ntmssvc)

Routing and Remote Access (RemoteAccess)

System Event Notification (SENS)

Telephony (TapiSrv)

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: N/A but check the registry for this: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Svchost]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Svchost]

External Info: Win32 Services book

SPOOLSV.EXE -

Description: Printer spooler service

Obligatory: Yes

System: Yes

Developer: Microsoft

Removal: Remove printers from (settings -> printers)

External Info: Win32 Services book

navapw32.exe -

Description: Norton anti-virus program check for windows32

Obligatory: No (but better to have)

System: No

Developer: Symantec

Removal: Remove the norton antivirus program

External Info: Inside norton Anti-Virus

NAVAPSVC.EXE -

Description: Norton anti-virus service

Obligatory: No (but better to have)

System: No

Developer: Symantec

Removal: Remove the norton antivirus program from (settings -> control panel -> add/remove programs)

External Info: Inside norton Anti-Virus

defwatch.exe -

Description: New Norton anti-virus program check for WINNT

Obligatory: No (but better to have)

System: No

Developer: Symantec

Removal: Remove the norton antivirus program, or just stop it from the tray icon

External Info: Inside norton Anti-Virus

alertsvc.exe -

Description: This one is in charge of alerting whenever NAV detects a virus

Obligatory: No

System: No

Developer: Symantec

Removal: Remove NAV

External Info: Win32 Services book

PSSVC.EXE -

Description: Also Norton anti-virus something i don't know exactly

Obligatory: No (but better to have)

System: No

Developer: Symantec

Removal: Remove the norton antivirus program from (settings -> control panel -> add/remove programs)

External Info: Win32 Services book

regsvc.exe -

Description: Registry service, primarily for allowing remote registry manipulation

Obligatory: No

System: Yes

Developer: Microsoft

Removal: Stop remote registry services

External Info: Windows 2000 Registry

mstask.exe -

Description: Task scheduling service

Obligatory: No

System: Yes

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

winmgmt.exe -

Description: Windows Management Instrumentation (WMI) functionality (eh?)

Obligatory: No

System: Yes

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

mspmspsv.exe -

Description: Windows Pre-Message security protocol service, i think. I have a strong belive it belongs to windows media player. WMDM PMSP Service. This Service is added during installation of Windows Media Player 7 (Or newer). WMDM (Windows Media Device Manager) PMSP (Pre-Message Security Protocol) is a feature of the Windows Media Format SDK, which supports the SDMI (Secure Digital Music Initiative) for packaging copyrighted music. Applications developed with WMDM will enable users to copy their music compact disc (CD) collection, as well as protected music downloaded from the Web, to SDMI-compliant portable music players & SDMI-compliant portable storage devices (such as flash memory cards). If you are intending to transfers music to SDMI-compliant portable devices (I know of no such devices existing currently) then set this to Automatic, otherwise you may safely leave this set to Manual. Thanks to Patrick Gagnon, Seth Hanford & Chanur Silvarian for their help with information about this Service.Thanks to Jason A.

Obligatory: N/A

System: N/A

Developer: Microsoft

Removal: N/A

Links: http://superiemand.com/etc/Windows%202000%20Services%20Tweak%20guide.htm

External Info: Win32 Services book

inetinfo.exe -

Description: Internet Information Services (IIS) service - web servers will see this service utilized heavily

Obligatory: No

System: No

Developer: Microsoft

Removal: Remove IIS, or stop it's service

External Info: Internet Information Services Administration

explorer.exe -

Description: The Windows 2000 shell; basically the GUI for Windows 2000

Obligatory: No

System: No

Developer: Microsoft

Removal: Close the system

External Info: Dora the explorer, good night Dora, book

Microsoft Internet Explorer 6.0

MAPISP32.EXE -

Description: Mail API Service, i belive

Obligatory: No

System: No

Developer: Microsoft

Removal: Stop the service, or outlook

External Info: Cdo and Mapi Programming With Visual Basic

Mapi, Sapi, and Tapi : Developer's Guide

winampa.exe -

Description: Someone told me it's the WinAmp (music program) small tray Icon, but i'm not sure. Its the winamp agent, it makes sure no other programs steal the .mp3 extension.. you can deselect itduring install (Thanks to Arne S). The Winamp agent can be disabled from within Winamp in it's preferences. It is not at all critical unless you are a digital DJ and can't afford having another media player messing with file associations. Winamp can correct associations at startup without Winamp Agent being active anyway, so most users will not need it. (Thanks to Bruce J).

Obligatory: No

System: No

Developer: WinAmp (NullSoft)

Removal: The Winamp agent can be disabled from within Winamp in it's preferences, When in Winamp, hit control-P, go to setup - agent, then uncheck maintain file associations.

External Info: MP3 power with WinAmp

fwenc.exe -

Description: user portion of SecuRemote,part of FireWall and VPN architecture

Obligatory: No

System: No

Developer: CheckPoint (FireWall) (VPN)

Removal: Remove Secure remote, or stop it from running

Links: CheckPoint site

External Info: Essential Checkpoint Firewall-1: An Installation, Configuration, and Troubleshooting Guide

OUTLOOK.EXE - Description: Not a service, it's the Microsoft outlook program.

Obligatory: No

System: No

Developer: Microsoft

Removal: Close outlook express

Links: http://www.phoneboy.com/faq/0328.html

External Info: Win32 Services book

MSDEV.EXE -

Description: Not a service, it's the Microsoft Development environment, like VC++ etc'

Obligatory: No

System: No

Developer: Microsoft

Removal: Close msdev

External Info: Programming Microsoft .NET

DEVENV.EXE -

Description: Not a service, it's the Microsoft Development environment

Obligatory: No

System: No

Developer: Microsoft

Removal: Close msdev

External Info: Programming Microsoft .NET

SSEXP.EXE -

Description: Not a service, it's the Microsoft Source Safe

Obligatory: No

System: No

Developer: Microsoft

Removal: Close the Source Safe

External Info: Win32 Services book

taskmgr.exe -

Description: Not a service, it's the windows task manager program for viewing running processes

Obligatory: No

System: Yes

Developer: Microsoft

Removal: Close the task manager

External Info: Win32 Services book

Icq.exe -

Description: Aservice and a program. ICQ Instant Messaging program.

Obligatory: No

System: No

Developer: ICQ, AOL, Mirablis

Removal: Configure ICQ not to run on startup, or remove it.

External Info: Win32 Services book

MDM.EXE -

Description: The Microsoft Machine Debug Manager, a bit buggy program.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: Part of the RPCSS.exe and other services.

Links: http://www.cexx.org/rpcss.htm

External Info: Win32 Services book

Mediadet.exe -

Description: I don't know exactly, something with the SoundBlaster CDROM and music.

Obligatory: No

System: No

Developer: Microsoft

Removal: mmm.. i don't know, just stop it

External Info: Win32 Services book

internat.exe -

Description: Microsoft says its Installs international information for Office2000 on your computer but i don't trust them,if so why is it a service. Additional information from Li H. Says: "internat.exe" is the language input system, for instance, if u want to type chinese in ur compter, u will find this.

This one is the small system-tray icon that allows you to change the input-locales

Obligatory: N/A

System: Yes

Developer: Microsoft

Removal: don't use multilangual system

External Info: Win32 Services book

Ctmix32.exe -

Description: Sound BalsterCreative Mixer service.for volume control. stays in tray icon.

Obligatory: No

System: No

Developer: Creative Labs

Removal: Just stop it and remove it from startup

External Info: Win32 Services book

CTNotify.exe -

Description: Sound BalsterCreative Mixer service.for volume control. stays in tray icon.

Obligatory: No

System: No

Developer: Creative Labs

Removal: Just stop it and remove it from startup

External Info: Win32 Services book

WinVNC.exe -

Description: VNC (Virtual Network Computing) - a program to control a computer from far, over the LAN and WAN, very suspicious if you did not installed it.A well written program, not a trojan or a virus, but means that other people cancontrol the computer.

Obligatory: No

System: No

Developer: www.uk.research.att.com/vnc(AT&T Labs Cambridge)

Removal: stop it from processes list. Delete it from ProgramFiles\vnc. Remove from registrey.

External Info: Win32 Services book

AGSatellite.exe -

Description: AudioGalaxy client program. Uses for sharing mp3 files. Use with caution, open port (xxxx) and share your files with other users. It is a good program butcheck whichdirectories are being shared by it.

Obligatory: No

System: No

Developer: www.audiogalaxy.com

Removal: stop it from processes list. Delete it from ProgramFiles\vnc. Remove from registrey.

External Info: Win32 Services book

SpeedKey.exe Type32 -

Description: Microsoft IntelliType Pro. I think, but i'm not sure, and i have no idea wht it does.

It's the program that runs your programmable hotkeys. It was always running when I had Win98SE but when I upgraded to Win XP I had to download a newer version. I haven't seen Speedkey in my Task Manager since, even though my hotkeys are working. Thanks to Arcavius Maximus

Type32 - it is name in WinXP.

Obligatory: No

System: No

Developer: Microsoft

Removal: stop it from processes list.

External Info: Win32 Services book

atiptaxx.exe -

Description: AtiPTA - I belive it is connected to the ATI Monitor or Sound Card, but i'm not sure.

Zamorski G. J. Updated me:

As near as we can tell this allows access to the specialized setting for the ATI Radeon cards when you click on the "advanced" button under display properties. To get rid of it update your registry according to the key below. Delete it from the "run" key in the registry as well so it will not start on boot. I can't find anything wrong with disabling it. As near as I can tell you can access all the functions through a different set of APIs.

[HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Desktop\] "NoAtipta"=1

Obligatory: No

System: No

Developer: ATI?

Removal: stop it from processes list.

External Info: Win32 Services book

Apache.exe -

Description: Apache Web Server Service, HTTP Server. If you didn't install it, i recomend you to check beacouse your HTTP port 80 is open. (It is the best web server written)

Obligatory: No

System: No

Developer: www.apache.org

Removal: stop it from processes list, stop it in the registrey. you may delete the files, usually in

"c:\program files\apache group".

External Info: Apache Server 2.0: A Beginner's Guide

mysqld-nt.exe -

Description: MySQL Database service

Obligatory: No

System: No

Developer: www.mysql.org

Removal: stop it from processes list. uninstall it.

External Info: Managing & Using MySQL

ntvdm.exe -

Description: Basically a virtual machine program to allow 16-bit programs to execute (or maybe NT - Virtual Device Manager)

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

hidserv.exe -

Description: Stands for Human Interface Device Service. Deals with keyboards, mice, etc. connected through the USB bus.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

webtool.exe -

Description: Use this Tool to implement HTTP (Hypertext Transfer Protocol) controls and HTTPS (HTTP with Secure Socket Layer Encryption) controls. I'm really not sure this is what it is. It might also be a program that spy on where you surf.

Scott W. updated me: "Microsoft Web Application Stress Tool". It never appeared until I installed that utility, and it's in that utilities folder only.

Obligatory: No

System: No

Developer: N/A

Removal: stop it from processes list

External Info: Win32 Services book

msdtc.exe -

Description: Microsoft Distributed Transaction Coordinator service

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

termsvc.exe -

Description: Terminal Services service, used to allow remote administration and even program execution. Be caution if you find it running with out you knowing about it.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

dns.exe -

Description: The DNS (Domain Naming Service) service.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list, stop it from running at startup.

External Info: DNS on Windows 2000

tcpsvcs.exe -

Description: Simple TCP/IP services, such as DHCP and WINS. Only present on servers hosting those services

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list, stop TCP/IP connection

External Info: Internetworking with TCP/IP Vol.1: Principles, Protocols, and Architecture

ismserv.exe -

Description: Intersite Messaging (IsmServ)

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

isssrv.exe -

Description: The License Logging Service, which keeps track of software licensing - need a bit of checking, how exactly does it works???

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

ntfrs.exe -

Description: The Windows 2000 File Replication Service. Used on Domain Controllers and servers participating in DFS

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

locator.exe -

Description: The RPC Locator service. Remote Procedure Call.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

ups.exe -

Description: UPS (Uninterruptible Power Supply) service, which communicates with backup batteries, mostly represent in laptop computers.

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

External Info: Win32 Services book

dfssvc.exe -

Description: Distributed File System (DFS) service

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list, check for file sharing properties

External Info: Win32 Services book

rpcss.exe -

Description: Remote Procedure Call Service, maybe can be used to access your computer and invoke calls

Obligatory: No

System: Yes

Developer: Microsoft

Removal: stop it from processes list

Links: http://www.cexx.org/rpcss.htm</p>

External Info: The Art of distrebuted applications

savenow.exe -

Description: malicious something - slow the computer

Obligatory: No - should be removed

System: No

Developer: N/A

Removal: stop in processes list and then delete from \program files\ directory

External Info: Win32 Services book

Ndetect.exe -

Description: Automatically detect when you are connected to the Internet and runs the ICQ.

Obligatory: No

System: No

Developer: Mirabilis ICQ, AOL

Removal: right click on systray icon and exit, remove from registry or remove ICQ

External Info: Win32 Services book

rundll.exe -

Description: A very good question what it does exactly, but i belive it runs dlls (wow) and loads them to memory

Obligatory: No

System: Yes

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

pwstray.exe -

Description: Microsoft's Personal Web Server, an application which allows PCs to behave as web servers allows you to test your .asp pages on your own PC without having to load them onto the internet). Available via Start - Programs. I would say it is suspicious, opens your port 80 and actually turn your computer as a web server, note that if you don't need it, it is better to remove it.

Obligatory: No

System: No

Developer: Microsoft

Removal: N/A

External Info: Win32 Services book

starter.exe - Description: Not sure but i think it starts the internet connection service when you start the Internet Explorer.

Obligatory: No

System: No

Developer: Microsoft

Removal: Changes in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\PBR\FMedia\2.0\Internet - "Application Path/Module"

External Info: Win32 Services book

systray.exe -

Description: System Tray Services. Provides the Volume Control, PC Card Status and Power Management icons that reside in the System Tray. SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel Note i heard there is a virus/trojan replacing this service

Obligatory: No

System: Yes

Developer: Microsoft

Removal: http://www.dark-e.com/archive/trojans/subseven/16/index.shtml

External Info: Win32 Services book

rnudll32.exe -

Description: Thanks to Li H. - i have no other confirmation to this. A trojan file, sits under WINDOWS\SYSTEM32\ [HKEY_USERS]-[S-1-5-21-1935655697-1563985-344-1060284298-500]-[SOFTWARE]- [MICROSOFT]-[INTERNET EXPLORER]-[EXPLORER BARS]- {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}-[CONTAINING TEXTMRU] LOCOM~ file appear.

Obligatory: No

System: No

Developer: N/A

Removal: delete it !

External Info: Win32 Services book

LoadQM.exe -

Description: This program is the Microsoft MSN query manager, used with the chat program MSN Messenger.Disabling it from startup will not harm the software. In fact, it will free up some of your computer's resources. From MSConfig's startup tab you can simply uncheck the box next to loadqm.exe.

Obligatory: No

System: No

Developer: Microsoft

Removal: Remove from registry

External Info: Win32 Services book

mobsync.exe -

Description: This program is the Microsoft IE bug reportdaemon, usedto notify microsoft for any problems in installing Internet Explorer. I recomend to remove it, why do you need to give microsoft any information at all?

Obligatory: No - even better to be removed

System: No

Developer: Microsoft

Removal: Remove from registry - delete for HD

Links: microsoft mobsync.exe

External Info: Win32 Services book

cd_load.exe CD_Clint.dll -

Description: Advertising software. should be removed, beeing install by free softawre and may have the option to change your computer to a proxy server.

Obligatory: No

System: No

Developer: Cydoor (A href="http://www.cydoor.com/Cydoor/">http://www.cydoor.com/Cydoor/)

Removal: What is CD-LOAD.EXE and do I need it? Its an AdWare using Cydoor's Ad Loader. The perpetrator is called Cd_load.exe and is located in C:\WINNT\SYSTEM32 (Windows NT4/2000) or C:\WINDOWS\SYSTEM (Windows 95/98/ME). Just search on the filename and remove it. To get rid of its registry entries, find and remove the following: Run Regedit and go to: HKEY_CURRENT_USER\Software and delete the "Cydoor" and "Cydoor Services" keys.

Then go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

delete the "Cydoor"="CD_Load.exe" value.

Link: All the information you ever needed:

>http://www.cexx.org/cydoor.htm

External Info: Win32 Services book

Point32.exe -

Description: Microsoft IntelliPoint Mouse software.

Obligatory: No

System: No

Developer: Microsoft

Removal: just uninstall

External Info: Win32 Services book

promon.exe -

Description: Intel Pro100 + network card icon in the system tray by the clock. The tools typically display the

LEDs on the NIC, and information about the link status, duplex mode, etc. None of the functionality

of such agents is necessary or required.

Obligatory: No

System: No

Developer: Intel

Removal: remove from registry startup

External Info: Win32 Services book

FSscrCtl.exe - Description: SouthWest Screen Saver control. To control your newly unnessacry screen saver you had installed to waste you nice new HD place.

Obligatory: No

System: No

Developer: SSS - SouthWest Screen Saver

Removal: Uninstall

More info is here - http://www.rickslighthouses.com/users_guide.htm

External Info: Win32 Services book

whAgent.exe -

Description: A bad publicity Trojan. It's monitors your Internet usage.

According to the WebHancer website, the purpose of this program is as follows: "webHancer

Customer Companion resides on the end-user's computer, where it transparently monitors Internet

performance. webHancer Customer Companion measures overall network/site delay and the

performance times experienced by actual end-users."

It modify system files and may transfer information to other computer on the Internet.

Remove it and read the link section for more information. It collects information baout your surfing habits.

Obligatory: No - remove it

System: No

Developer: WebHancer / AudioGalaxy

Removal: http://www.realenduser.com/utilities/download/filelist/</p>>http://www.cexx.org/webhancer.htm</p>>http://www.computerhope.com/issues/ch000453.htm>http://www.computerhope.com/issues/ch000453.htm

External Info: Win32 Services book

userinit.exe -

Description: Operating system task, runs when you log into windows NT/2000 and establish user framework

Obligatory: Yes

System: Yes

Developer: Microsoft

More info: user access

External Info: Win32 Services book

Gstartup.exe -

Description: Advertising program

Obligatory: No - and better be removed

System: No

Developer: N/A

More info:

External Info: Win32 Services book

GMT.exe CMEsys.exe GAIN.exe gator.exe -

Description: Advertising program - Gator GAIN (GMT.exe, CMESys.exe, GAIN_TRICKLER_*.EXE) - Pops up advertising, apparently a new Gator product. A security hole in some versions allows Web sites to install arbitrary software on your computer. This URL will detect GAIN. Gator recommends on its Web site to contact support(at)gator.com for removal instructions. Gator software may be quietly installed by drive-by download.

Obligatory: No - and better be removed

System: No

Developer: Gator

More info: About Gator

Removal: 1. Open Control Panel -> Add/Remove prograns, and Remove gator

2. Deletes from C:\Program Files\gator directory

3. Search the registry and delete remmaining evidance

External Info: Win32 Services book

Isass.exe -

Description: LSA Shell (export version)

Obligatory: Yes

System: Yes

Developer: Micorsoft

Removal: N/A

External Info: Win32 Services book

snmp.exe -

Description: SNMP service (Simple Network Managment Protocol)

Obligatory: No

System: Yes

Developer: Micorsoft

Removal: Stop the snmp service from ControlPanel -> Services

External Info: Win32 Services book

nvsvc32.exe -

Description: NVIDIA Driver Helper Srvice

Obligatory: No

System: No

Developer: nVidia

Removal: Uninstall nVidia Drivers (not recommended unless you don? have an nVidia video card, but then why would you install the drivers??)

External Info: www.nvidia.com site

Win32 Services book

free bonzai -

Description: free Bonzai malicious program, installs when imesh is installing or kazaa or other bad programs and create a link to freeBonzai site.

Obligatory: No - Better be removed

System: No

Developer: free Bonzai yimach shmam

Removal: Just delete the short cuts to the URL link site. Usually one on the desktop and the other one inside your "start" menu, just right click and delete

External Info: Win32 Services book

NewDotNet newDotNet4_50.dll newdotnet.dll -

Description: Very bad and malicious program that istall itself on your computer and messes with your network winsock2 parameters, it slows down your computer and network connection. Usually sneaks in when installing iMesh.

Obligatory: No - Better be removed

System: No

Developer: newDotNet

Removal: Very hard to be removed:

1. Best method is to use Add/Remove programs, and remove it.

2. Delete from C:\Program Files\NewDotNet directory - sometimes it is impossible, then you will have to reboot and sometime exit windows or stop TCP/IP connection.

3. Carefully when deleting from the registry, be sure to restore your right parameteres for winsock2, if you don't know how to do it, advise with your administrator.

Links: cexx newDotNet information

External Info: Win32 Services book

CommonName CNBabe.dll onflow cbebeie cneII.exe -

Description: Evil programs that changes your Internet Explorer settings and install itself on your HardDrive

Obligatory: No - Better be removed

System: No

Developer: N/A

Removal: 1. Stop the process from the TaskManager.

2. Delete C:\Program Files\CommonName directory.

3. Search in the registry for CommonName and delete the appearnce.

Links: Parasite infromation about CommonName

External Info: Win32 Services book

onflow flt.dll -

Description: Evil program - i don;t know what it does

Obligatory: No - Better be removed

System: No

Developer: N/A

Removal: 1. Stop the process from the TaskManager.

2. Delete C:\Program Files\flt directory.

3. Search in the registry for flt.dll and delete the appearnce.

4. Carefull, fllt.dll is a good program, do not delete it

Need Help with this Issue?

We help people with technology! It's what we do.
Schedule an Appointment with a location for help!

Author

Posted by Henry of Katharine Gibbs School - New York on December 2, 2004