W98eject

W98eject.exe

(Sigmatel)

USB disconnect.  Background startup task installed by the drivers CD of Sigmatel-made USB MP3 players or USB pen drives.  This task is only needed for Windows 98 where it installs an icon in the System Tray which simulates the Windows ME/2000/XP/2003/Vista USB  “Safely Remove Hardware”  icon.  Clicking on the icon ensures that Windows 98 writes to the USB device any data that it still has in memory (thus avoiding data corruption on the USB device) and then a message pops up telling the user that he/she can unplug the USB pen/MP3-player.

Note that Sigmatel is an OEM manufacturer which means that it makes products for other manufacturers to sell under their own badges and model names.  As a result this task will be installed by the drivers CD of many other brands, such as Matsunichi, SanDisk, and others.

Recommendation :
This task is simply not needed on any version of Windows other than Windows 98/98SE – what it does is part and parcel of what any modern version of Windows provides already.

Thus, if you do not have Windows 98/98SE, as a first step disable this task on the  Startups  tab of  The Ultimate Troubleshooter  and use your PC for a few days.  This will enable you to verify that you indeed do not need this task to access your USB pen/MP3-player and that Windows does have the inbuilt facility to enable you to  “Safely Remove Hardware”  before you unplug the device thus ensuring you do not suffer data corruption.

This program normally uses between 3Mb to 4Mb of memory and it is not unusual to see two instances of it on the  Tasks  tab of TUT.

Wapicc

Wapicc.exe
 

See   WINSERVN.

Wapiit

Wapiit.exe

See   WINSERVN.
 

Wapisu

Wapisu.exe
 

See   WINSERVN.

Wapisvit

Wapisvit.exe
 

See   WINSERVN.

Wapisvsu

Wapisvsu.exe
 

See   WINSERVN.

Wapitr

Wapitr.exe
 

See   WINSERVN.

Watch

Watch.exe

(Mustek, ScanMagic & others)

Direct Scan System Tray utility installed by the Twain drivers for Mustek and ScanMagic scanners, and possibly other makes of scanners.  In this case  “Direct Scan”  is not quite what its name normally implies when used in conjunction with other scanners.  Here  WATCH  is simply a green System Tray icon which depicts a scanner.  When you double-click on it it brings up a Scan Panel where you can press on‑screen buttons to :  scan into an application of your choice, scan directly to a printer, scan and fax through your fax modem, scan to email, and scan to OCR (convert scanned document into a wordprocessor document).

Recommendation :
This icon is larger than most System Tray icons, and it is so life-like and so noticeable, it actually makes remembering how to start the scanner, dead easy.  We find it very user friendly as a result and recommend keeping it.

Recommendation :
Since we do not know what it does, we can only recommend to leave it alone.

Wbengine

Wbengine.exe

(Microsoft)

Block Level Backup Engine service.  A better name for this service would have been  Disk Imaging Service.  This service, found in Windows Vista, comes into use when you use the  Vista Backup and Restore Center  to perform a  Complete PC Backup  of your PC – this Complete PC Backup effectively backs up your computer as a complete disk image which you can use at a later date to restore your entire Vista PC using the  Windows Recovery Environment  from your original Vista Boot CD (Vista Installation CD).  Users of Norton Ghost or LiveState Recovery will be familiar with the concept.

When you backup your PC in this way, this particular service, the  Block Level Backup Engine Service, performs the actual backup by reading your hard disk block by block of information (rather than file by file or folder by folder).

Recommendation :
Leave alone.  The  Startup Mode  of this service is set to  Manual  by default and the service only kicks in when you perform a  Complete PC Backup.  Thereafter it automatically terminates once you exit the  Complete PC Backup  screen.

Wcpcc

Wcpcc.exe
 

See   WINSERVN.

Wcpsvsu

Wcpsvsu.exe
 

See   WINSERVN.

Wcpsvtr

Wcpsvtr.exe

See   WINSERVN.
 

Wdfmgr

UMWdf

Wdfmgr.exe

(Microsoft)

Microsoft’s User Mode Driver Manager service.  At the time of writing this service gets installed on Windows XP when you either install Windows Media Player 10, or when you upgrade to Service Pack 2 for Windows XP.  Introduced in September 2004.  This service is part of the new device driver strategy from Microsoft for Windows 2000/XP/2003 and future versions of Windows :  this strategy, the  Windows Driver Foundation (WDF),  aims to make it significantly simpler to write drivers for tomorrow’s Windows environments which hopefully will lead to higher quality and more reliable drivers;  it also aims to ensure that, in future, buggy or badly written drivers will not have the detrimental or catastrophic effects that they have nowadays (freezes, instability, Windows not booting up, illegal operations, etc..);  finally, the new strategy also aims to ensure that many more drivers will be installable without the PC needing to be logged in as “Administrator” or with  “Administrator”  privileges.  Starting with Windows XP Service Pack 2 and Windows Media Player 10, Microsoft is adding the WDF framework to Windows 2000/XP/2003 to enable peripheral manufacturers to start producing WDF drivers.  For technical users :  this particular service, WDFMGR, implements the user-mode driver framework of the new WDF driver strategy.  This framework enables developers to create drivers for network connected devices, and some USB devices, where the drivers run in user mode rather than kernel mode but still behave as standard Plug-and-Play drivers.

Recommendation :
This service, introduced in September 2004, is now an essential service which you should leave running as, in 2006, many manufacturers have now produced WDF drivers and  WDFMGR  will therefore be needed for those drivers.

Wdvrctrl

WinDRVCtrl

WDVRCtrl.exe

(???)

Driver task installed by the drivers for some TV capture cards.  We are not sure who makes the drivers but some of the manufacturers whose TV cards might include this driver task include Asus, Guillemot, and LifeView.

Recommendation :  
As we do not know the purpose of this task, we can only recommend to leave it alone.

Webcamrt

WebCamRT.exe

(???)

Startup item installed by the SpotLife broadcast software which comes with some Logitech QuickCam webcams.  While we are not certain about the exact role of  WEBCAMRT itself, for those who do not know the SpotLife software enables the user to effectively have his/her own TV station !   This is achieved through the SpotLife software which broadcasts the images and sound captured through your QuickCam webcam, to a URL on the  SpotLife.com  website.  As and when you want to broadcast, you give the URL to those people who will be allowed to watch the broadcast.  All the allowed viewers then have to do is home in on that URL and that in turn starts RealPlayer which plays your broadcast.

Recommendation :
After 4 years in operation SpotLife.com ceased operation on 12-Dec-2003.  On this basis you can safely de-install SpotLife software from the  “Add/Remove Programs”  icon in the Control Panel (if there is a SpotLife uninstall entry), and delete this entry from the  Startups  tab of  The Ultimate Troubleshooter.

Webrebates

Webrebates0

Webrebates1

WebRebates.exe

WebRebates0.exe

WebRebates1.exe

(TopRebates.com)

Program that is part of the  TopRebates.com AutoTrack  software.  TopRebates.com’s description of AutoTrack :  “It simply notices when you land on selected sites and sends a message notifying you of participating merchants.  TopRebates AutoTrack ensures that your purchases from all participating merchants earn you rebates, whether you’ve recently visited the TopRebates website or not.”.  At the time of writing we are not sure as to whether AutoTrack is only ever installed if the end‑user willingly decides to try the TopRebates.com rebates programme, or whether it is sometimes installed surreptitiously when the end‑user installs other software downloaded from the web.

Recommendation :
This program is effectively Adware, ie. software which pulls up advertisements while you are browsing the web.  The only question is whether this is adware that you want because you want and like the TopRebates.com programme, or whether it is adware you never realised you were installing and which you therefore want off your PC.  If it is the latter, the first thing to do is to go to the  “Add/Remove Programs”  icon in the Control Panel and see if there is a  WebRebates  entry that you can remove.  If there is, remove it.  Next, reboot and check whether you see can still see this entry in  The Ultimate Troubleshooter.  If you can, then do as follows :
1)  Boot your PC into Safe Mode.

2)  On the  Startups  tab, for each instance of a  WebRebates  entry, right-click on the entry and choose the  Delete from the hard disk the file that this Startup points to  option.

3)  Next, still on the  Startups  tab, right-click on each instance of  WebRebates  and delete the entry.

4)  Click the big green  APPLY  button to make the changes stick.

5)  If you have Windows 2000/XP/2003, switch over to the  Services  tab and check whether there are any  WebRebates  services.  If there are, right-click on each of them and set their  Startup Mode  to  Disabled.

6)  Reboot your PC into Normal Mode.

7)  Using Windows Explorer or  “My Computer”, locate the  Web_Rebates  folder in the  “C:\Program Files\”  folder – if it exists, delete it.

8)  You’re done.

Wflmgr32

Wflmgr32.exe

(FileNet Corp / Novell)

This is a background program which runs when you have Novell GroupWise 5.5 running.

Recommendation : 
Essential.  Leave alone.

Wfshell

WFShell.exe

(Citrix Systems)

Citrix WinFrame Shell.  Background tasks running on end-user PCs in a Citrix / Terminal Server environment and which manages the environment of a user session (drive mappings, shares, printers, etc..).

Recommendation :  
Essential to the proper functioning of your user session on your network.  Note, however, that this process has had a history of excessive CPU usage in some versions of WinFrame, resulting in very slow PC performance – if you have this problem, have your System Administrator check for updates.

Win32sl

Win32SL.exe

(Intel)

Dell’s OpenManage DMI Service Layer.   This service contains a collection of motherboard related MIFs installed on the PC and allows OpenManage modules to access them.

Recommendation :
If you use Dell’s OpenManage software, you need this service running, otherwise you can disable it by setting its startup mode to  Disabled  on the  Services  tab of  The Ultimate Troubleshooter.

Winampa

Winampa.exe

(Nullsoft)

Background task from Winamp which has two purposes :  on the one hand it provides the Winamp System Tray icon, and on the other it maintains file associations so that other applications do not take over file associations which Winamp normally handles.  As a System Tray icon Winamp is rarely used; most users use Winamp through double-clicking on an MP3 file rather than through actually starting it through Start \ Programs.  Therefore, for most users there is no need for a Tray icon which just adds to the clutter.  More worryingly, in our experience WINAMPA seems to cause unexplained crashes in Netscape and Internet Explorer, and a few other programs.  Disabling WINAMPA totally seemingly gets rid of the crashes.

Recommendation :
Disable Winamp Agent.  Right-click on the  Winamp  icon in the System Tray and choose  Disable Winamp Agent.  Reboot your PC.

Winbackup
Registrychk

Winbackup.exe

(???)

You have the  W32.Mertian@mm  virus.

Wincinemamgr

WinCinemaMgr.exe

(InterVideo)

System Tray icon installed by InterVideo’s  WinDVD  DVD playing software.  This icon enables you to configure some simple WinDVD options from the System Tray, or to start WinDVD from the System Tray.

Recommendation :
Down to end-user preference.  We ourselves normally get rid of it from the  Startups  tab of  The Ultimate Troubleshooter  in order to reduce System Tray clutter.

Wincomm

Windows Communicator

Wincomm.exe

(???)

You have the   WORM_AGOBOT.AZ   virus which attacks Windows 2000/XP/2003 PCs which have not had critical  Windows Updates  installed.

Recommendation :
Many antivirus programs do  not  detect this virus.  If your antivirus software does not detect this virus, do as follows :

1)  Reboot your PC into Safe Mode.

2)  On the  Startups  tab of  The Ultimate Troubleshooter, right-click on this entry and choose  “Delete from the hard disk the file that this Startup points to”.

3)  Next, delete this startup from the same  Startups  tab.

4)  Switch to the  Services  tab of The Ultimate Troubleshooter and set the  Startup Mode  of this service to  Disabled.

5)  Restart your PC into Normal Mode and immediately do a Windows Update.  At the time of writing, 30‑Oct‑2004, if you have Windows XP we recommend you say  No  to installing Service Pack 2 for Windows XP as that may cause you more problems than you bargained for.  Simply choose the option to  Review and install other updates  (you may be asked, before that, to install the latest version of  Windows Update; do so)  and install all critical updates.

Windirect

win_upd2.exe

WINdirect.exe

(???)

You have the  W32.Beagle.AO@mm  virus.

Winfi1e32

Winfi1e32.exe

(???)

You have the  W32.Mertian@mm  virus.

Wingo

Wingo.exe

(???)

You have the   W32.Beagle.AW@mm  \  Win32.Bagle.AR  \  W32/Bagle.bd@MM   or   W32.Beagle.AV@mm  \  Win32.Bagle.AQ  \  W32/Bagle.bb@MM  \  BAGLE.BC    virus.

Winhost

Winhost.exe

Win.exe

Winh.exe

(???)

If the full path to this program shows in  The Ultimate Troubleshooter  as  C:\Windows\Winhost.exe  or  C:\WinNT\Winhost.exe  then this is a nightmarish background task picked up almost exclusively either through adult websites or through spam emails.  This task affects Internet Explorer with endless popup and popunder ads from adult websites.  Whenever we have come across this program on a PC, we have also found countless other viruses on the same PC so we think that this particular task may also be responsible for pulling down various viruses.

Recommendation :
This program is detected only by specific antivirus programs.  Therefore, if your antivirus software does not detect it as a Trojan virus, and if the full path as shown in  The Ultimate Troubleshooter  is  C:\Windows\Winhost.exe  or  C:\WinNT\Winhost.exe ,  then do as follows :

1)  Reboot your PC into Safe Mode.

2)  Start The Ultimate Troubleshooter and position yourself on the  Startups  tab.

3)  Right-click on the  WINHOST  entry and choose  Delete from the hard disk the file that this Startup points to.

4)  Next, right-click on the  WINHOST  entry again but this time choose  Delete this Startup Entry.

5)   Using Windows Explorer, or  “My Computer”,  delete the following two files if you can find them :  C:\Windows\System.html  and  C:\Windows\System.hta  or  C:\WinNT\System.html  and  C:\WinNT\System.hta.

6)  Restart your PC into Normal Mode.

7)  Make sure you have an up-to-date reputable antivirus program and virus scan your entire PC both in Normal Mode and in Safe Mode.

Wininit

Wininit.exe

(Microsoft)

Windows Vista Start-Up Application.  Core session‑start process present in each Windows Vista session and whose job is to start some of the core Windows Vista background services (for the benefit of advanced users WININIT starts the Service Control Manager, SCM, the Local Security Authority SubSystem, LSASS, and the Local Session Manager, LSM.EXE, which manages terminal services connections).

Recommendation :
An essential Windows Vista background program – Leave alone.

Winlogon  (1)

WinLogon.exe

(Microsoft)

Windows NT4/2000/XP/2003 Logon application whose full path is either  C:\WinNT\System32\Winlogon.exe   or   C:\Windows\System32\Winlogon.exe.  This process manages users’ logons and logoffs on your PC/Server.  The window which pops up and prompts you for your username and password, or which allows you to logoff or shutdown, is the  WINLOGON  process.

Recommendation :
An integral part of the operating system, leave alone.

Winlogon  (2)

WinLogon.exe

(???)

If you have Windows NT4/2000/XP/2003 and the full path for this task is   C:\WinNT\Winlogon.exe   or   C:\Windows\Winlogon.exe ,  then you may have the   W32.Netsky.C@mm   virus, or a newer virus.   If you have Windows 95/98/ME then you definitely have either the above virus or a newer virus.

Recommendation :
Make sure you have a current, reputable, and recently updated antivirus program and then run a full virus scan of your PC, preferably after having booted it up into Safe Mode.

Winmgr32

WinMgr32.exe

(???)

You have the  W32.Mimail.P@mm  virus.

Winoldap

Winoldap.exe

(Microsoft)

Windows module, required to run MS-DOS based applications, and which is auto-started when Windows is asked to run an MS-DOS application.  In general, therefore, this module will only ever appear in the Task List when you also have MS-DOS based applications running.

Recommendation : 
Leave untouched.

Winservn

Manage,
Sear1,
Wapicc,
Wapiit,
Wapisu,
Wapisvit,
Wapisvsu,
Wcpcc,
Wcpsvsu,
Wapitr,
Wcpsvtr,
Winservs,
Wintsu,
Wintsvcc,
Wnsapicc,
Wnsapisu,
Wnsapisv,
Wnscpsu,
Wnscpsv,
Wnsintit,
Wnsinttr,
Wnsintsu,
Wnsintsv,
Wnstscc,
Wnstssv,
Wtsit,
Wtstr

sear1 MFC Application

ContentService,
Version,
WAPI,
WCPC,
WCPS,
WINT,
WNSA,
WNSC,
WNSI,
WNST,
WTSI,
WTSS

Winservn.exe

Manage.exe,
Sear1.exe,
Wapicc.exe,
Wapiit.exe,
Wapisu.exe,
Wapisvit.exe,
Wapisvsu.exe,
Wcpcc.exe,
Wcpsvsu.exe,
Wapitr.exe,
Wcpsvtr.exe,
Winservs.exe,
Wintsu.exe,
Wintsvcc.exe,
Wnsapicc.exe,
Wnsapisu.exe,
Wnsapisv.exe,
Wnscpsu.exe,
Wnscpsv.exe,
Wnsintit.exe,
Wnsinttr.exe,
Wnsintsu.exe,
Wnsintsv.exe,
Wnstscc.exe,
Wnstssv.exe,
Wtsit.exe,
Wtstr.exe

(ClickSpring)

Task which is dropped onto your PC when you run the free  “hidden pornography”  scanner from PuritySCAN.com.  At the time of writing, 9‑May‑2004, PuritySCAN.com purports to scan your PC for hidden pornography and help you remove it.  For a start, at the time of writing, 9‑May‑2004, the scan for pornographic content is a total scam and downright dangerous.  The scan will reports files like  ASSETS.GIF  and  ASSETS.EXE  as files containing pornographic material because, wait for it, because ..... the names of the files contain the word  “ass”.  Shocking, shocking, shocking.  If we had gone ahead and  “cleaned”  our test hard drive of the reported files, we would have lost  “ASSETS.GIF”  which is a graphic file that is part of Microsoft Office 2000, and we would have lost  “ASSETS.EXE”  which is asset management software !!  And it gets worse :  STRIPED.GIF will also have been deleted because the filename has the letters  “strip”, and, unbelievably, SUNBANNA.GIF will have been deleted because the filename contains the letters .......... “Anna” !   There are no words to describe a scam like this one. 

It gets worse still :  what this software also does do is drop this file together with a second one onto your PC (The Ultimate Troubleshooter  will also highlight the second file), sets both up as startup entries, and the PC then gets inundated with popup advertisements and also experiences serious Internet browsing performance issues.  As much as it irritates us to be, to be fair there is a license agreement which states, amongst other things, that you agree to receive advertising :  “By installing PurityScan you understand and agree that PurityScan will make the following changes to your Internet Browser:  Several PROMOTIONAL CONSOLES (daughter console/interstitial) may be launched for the duration of time you spend online. These consoles may continue to be launched as long as you have PurityScan installed on your machine. PurityScan does not monitor the activities or collect information from users once they have left PurityScan.  By downloading PurityScan, you understand that these changes cannot be reversed without running the removal executable of PurityScan.  If you try to change the items above manually, your changes will be lost when you reboot or turn off your computer.”. 

This is nightmarish adware posing as a  free service to the Internet community – the publishers know full well that 90% of users never read License Agreements and that they will therefore get conned into running a not only useless but dangerous scan, and they will also get infected with adware (advertising software) !   Since its introduction in 2002 this task not only constantly changes name, to evade detection, but it has also appeared in the Task List of users who have never accessed PuritySCAN.com, so we suspect that ClickSpring have an Affiliates programme which allows unscrupulous websites to co‑brand the PuritySCAN program so they can lure users into running scans of their PCs while at the same time dropping onto those PCs this task which will continually pull up popup advertisements about their products !   Through investigation and talking to infected users, we even have strong circumstantial evidence that this task is obtained, of all places, on pornographic websites which provide a free  “tool to erase all traces of the user’s visit to those sites” !!

Finally, we have also noticed that all users who had this task and who did not have adequate antivirus protection, were all infected with the  Badtrans  virus – we are not yet sure of the reason for this strange coincidence.

Recommendation :
Get rid of this task immediately.  Read the following carefully to do so.

1)  Terminate  WINSERVN  (or its equivalent) on the  Tasks  tab of  The Ultimate Troubleshooter. 
 
2)  Terminate the second task which The Ultimate Troubleshooter will have also identified as being ClickSpring software. 

3)  Switch to the  Startups  tab, highlight the startup entry which has  WINSERVN.EXE,  right-click on it and choose the  “Delete from the hard disk the file that this startup points to”  menu option.  Delete the file.

4)  Repeat this file deletion process for all other tasks identified on the  Startups  tab as being  ClickSpring  software (do not assume there will only be two ClickSpring startup entries – there are sometimes many more).

5)  Search your hard disk for a file called PURITYSCAN.EXE.  If you find it, delete it. 
 
6)  Delete all ClickSpring entries from the  Startups  tab of The Ultimate Troubleshooter.
 
7)  Finally, make sure you have a reputable antivirus product, manually update it fully, then reboot your PC into Safe Mode and run a full virus scan of your PC.

8)  Reboot into Normal Mode and empty your Recycle Bin.
 

Winservs

Winservs.exe
 

See   WINSERVN.

Wintsu

Wintsu.exe

See   WINSERVN.
 

Wintsvcc

Wintsvcc.exe

See   WINSERVN.
 

Winupdate

Microsoft Eventlog

WinUpdate.exe

(???)

You have the   Trojan.Trunlow \ VBS/Psyme   or   W32.P