From Helpful

These are primarily notes This is probably not going to be complete in any real sense, and exists to contain bits of useful information.

For those that are trying to figure out whether there are any running processes that shouldn't be there.

Contents 1 Windows 1.1 system stuff 1.2 installed apps 1.3 See also

Windows

Common background processes:

Note that this list cannot tell you whether a process is spyware or such, since spyware may choose to name processes one of the below. Install a spyware scanner to discover this.

system stuff

• svchost.exe: (usually several) hosts a service (those that need this type of hosting) (You can't easily tell which of these processes hosts which service)
• services.exe: assists service starts/stops
• rundll32.exe

• alg.exe (mainly handles windows firewall and connection sharing)
• csrss.exe (graphics processing proxy)
• smss.exe (manages login sessions)
• lsass.exe (local security, login. Perhaps see lsass.exe taking all cpu)
• spoolsv.exe (handles printing)
• HelpSvc.exe (Help service. Perhaps see HelpSvc.exe taking all cpu)
• mmc.exe (supports elements of device manager, etc.)

• mdm.exe (process debugging, used e.g. in IE script debugging)

installed apps

Microsoft:

• ctfmon.exe (alternate input methods for MS office)
• wdfmgr.exe (part of Windows Media Player 10)

nVidia (video card drivers/utilities):

• nvsvc32.exe

ATI (video card drivers/utilities):

• ati2evxx.exe
• mom.exe
• CCC.exe

Novell:

• naldesk.exe
• nalntsrv.exe
• nalrstrt.exe (NAL Restart Utility?)
• zentray.exe
• ZenRem32.exe (Remote Management)
• dpmw32.exe (print, security)
• nwtray.exe (tray menu)
• nwquota.exe (quota checker & tray menu)
• wm.exe (Workstation Manager)
• wmrundll.exe
• iprntlgn.exe (iPrint)
• iprntctl.exe (iPrint)
• xtagent.exe (NetIdentity)

Apple

• mDNSResponder.exe (Bonjour for Windows, used by iTunes music sharing, and some other apps. See also zeroconf)
• iTunesHelper.exe
• iPodService.exe

Symantec/Norton AntiVirus/Internet Security:

• ccApp.exe (autoprotect and such)
• ccEvtMgr.exe (logger)
• VPtray.exe (tray icon)
• DefWatch.exe (updates virus definitions)
• SavRoam.exe (roaming user support)
• ccSetMgr.exe
• spbbcsvc.exe

Spybot S&D

• TeaTimer.exe (resident protection)

GEAR

• gearsec.exe: Usually seen because some application (such as iTunes, Drive Image, Norton Ghost, MixMeister, Cakewalk, others) embeds the GEAR CD recording engine. See also http://www.gearsoftware.com/wiki/index.php?title=Gearsec

Google:

• googletalk.exe: Google talk app
• GoogleUpdateService.exe

VMWare:

• vmware-authd.exe
• vmnat.exe

Installshield:

• ikernel.exe (installation engine, while some installation is open)

Adobe

• apdproxy.exe (camera photo download helper, lightroom)

Wacom

• Tablet.exe
• tabuserw.exe

S3:

• s3hotkey.exe: utility for S3 Twister integrated graphics card (laptops, miniITX systems, etc.), apparently used to switch between monitors, whatever that means exactly.

Sun:

• jusched.exe (java update scheduler/checker)
• jucheck.exe (same)

Realtek:

• RTLCPL.exe (installed with motherboard sound cards)
• soundman.exe (installed with motherboard sound cards)

Pinnacle:

• remoterm.exe (the app that handles the remote for various Pinnacle video products)

InterVideo:

• WinCinemaMgr.exe (part of WinDVD)

AOL (Viewpoint Media Player or Viewpoint Toolbar, used by AIM, AOL, but not really necessary. See also [1]):

• viewpointservice.exe
• viewmgr.exe

Other/unsorted:

• starwindservice.exe (Alcohol 120%)

See also

• http://www.processlibrary.com/directory/ (explains many services, searchable by executable name. There are various other sites like these; you can often search google for the process name)

• The autoruns app, which gives a brief description of the things registered to start with windows