# 2-Spyware

> Malware removal guides for Windows, Mac, Android and iPhone, scam alerts, software reviews and live security data, since 2003.

Every page below is written for people and kept up to date. Please quote briefly and link to the page; do not republish the full text.

## Guides by threat type

- [What is adware and how to remove it](https://www.2-spyware.com/c/viruses/adware): Adware floods you with pop-ups, redirects and notification spam. See the signs, the risks and how to remove it on Windows, Mac, Chrome and Android.
- [What is a backdoor and how to remove it](https://www.2-spyware.com/c/backdoors): What a backdoor is, what a Defender Backdoor: detection means, web shells, xz and 3CX, and how to remove a backdoor from PC, Mac, phone and router.
- [Malicious browser extensions and toolbars: how to check and remove them](https://www.2-spyware.com/c/browser-addons): Are Chrome extensions safe? See what extension permissions mean, how good add-ons turn bad, and how to remove one from Chrome, Edge, Firefox and Safari.
- [What is a browser hijacker and how to remove it](https://www.2-spyware.com/c/viruses/browser-hijackers): A browser hijacker swaps your search engine, home page or new tab and keeps putting it back. See the signs and how to remove it on Windows, Mac and phones.
- [What is a keylogger and how to remove it](https://www.2-spyware.com/c/keyloggers): A keylogger records what you type and sends it to someone else. See the types, real examples, the signs and how to remove one from a PC, Mac or phone.
- [Can Macs get viruses? Mac malware explained](https://www.2-spyware.com/c/mac-viruses): Yes, Macs get malware. See which Mac threats are common in 2026, what Apple's built-in protection stops, the signs of infection and how to remove it.
- [What is malware and how to remove it](https://www.2-spyware.com/c/viruses/malware-viruses): Malware steals logins, locks files and spies on you. See how it gets in, the signs, the main types and how to remove it on Windows, Mac, browsers and phones.
- [What is ransomware and how to remove it](https://www.2-spyware.com/c/viruses/ransomware): Ransomware encrypts your files and demands payment. See how it works, the signs, what to do first, how to remove it and how to get your files back.
- [Rogue anti-spyware and scareware: how to spot fake antivirus and remove it](https://www.2-spyware.com/c/viruses/rogue-anti-spyware): Scareware and fake antivirus invent threats to sell you a fix. Learn to spot a fake virus warning, remove it on any device and get your money back.
- [Spam and scam emails: how to spot them, stop them and what to do if you clicked](https://www.2-spyware.com/c/spam-tools): What spam and scam emails are, real examples from sextortion to fake invoices, how to tell a scam, and how to block spam in Gmail, Outlook and Yahoo.
- [What is spyware and how to remove it](https://www.2-spyware.com/c/viruses/spyware): Spyware secretly records your passwords, messages and location. Learn the types, the honest signs and how to remove it from Windows, Mac, Android and iPhone.
- [Potentially unwanted programs: what they are and how to remove them](https://www.2-spyware.com/c/viruses/system-tools): What a potentially unwanted program (PUP, PUA) is, what PUP.Optional means, and how to remove PUPs from Windows, Mac, browsers and phones and block them.
- [What is a trojan and how to remove it](https://www.2-spyware.com/c/viruses/trojans): A trojan hides in a crack, fake update or attachment, then steals logins or loads more malware. See the signs and how to remove it on Windows, Mac and phones.
- [What is a computer worm and how to remove it](https://www.2-spyware.com/c/worms): A computer worm copies itself to USB drives, shared folders and other PCs. Worm vs virus, famous worms, signs and removal on Windows, Mac and phones.

## In-depth guides

- [7-Zip and WinRAR vulnerabilities: what was exploited and what to do](https://www.2-spyware.com/7-zip-vulnerability): The 7-Zip and WinRAR flaws used in real attacks, how to see your version and update it by hand, and what to do if you opened a malicious archive.
- [Android security updates: check, install and know when support ends](https://www.2-spyware.com/android-security-update): How to check your Android security patch level, install the update on Pixel and Samsung, and find out how long your phone will keep getting security fixes.
- [Best adware removal tools in 2026](https://www.2-spyware.com/best-adware-removal-tools): We compare six adware removal tools for Windows and Mac: what each removes, what is free, prices and our review scores, plus the free built-in options.
- [Best anti-spyware tools in 2026](https://www.2-spyware.com/best-anti-spyware): Six anti-spyware tools we reviewed for Windows and Mac, what they catch (stealers, keyloggers, remote tools), what they miss and what to use on phones.
- [Best browser hijacker removal tools in 2026](https://www.2-spyware.com/best-browser-hijacker-removal-tools): Which browser hijacker removal tool undoes policies, forced extensions, tasks and Mac profiles? Fortect, SpyHunter, Combo Cleaner, Intego and free options.
- [Best malware removal tools in 2026](https://www.2-spyware.com/best-malware-removal-tools): Malware removal tools compared: real-time vs on-demand scanners, offline scans, repair after trojans and stealers, what free really covers and lab results.
- [Best ransomware protection in 2026](https://www.2-spyware.com/best-ransomware-protection): Ransomware protection in layers: the tools we rate, Controlled folder access steps for Windows 11 and 10, backups ransomware cannot reach, and a checklist.
- [Best trojan removal tools in 2026](https://www.2-spyware.com/best-trojan-removal-tools): Six trojan removal tools compared: what a trojan scan must catch, Defender Offline, Wacatac and false positives, and what no scanner can undo.
- [How to check your phone for spyware](https://www.2-spyware.com/check-phone-for-spyware): Think someone is spying on your phone? Check Android and iPhone settings for stalkerware, shared accounts, location sharing and hidden trackers, safely.
- [Chrome "Managed by your organization": what it means and how to remove it](https://www.2-spyware.com/chrome-managed-by-your-organization): Why Chrome or Edge says Managed by your organization, how to check chrome://policy, and how to remove hijacker policies on Windows and Mac safely.
- [Chrome zero-day: what it is and how to update Chrome now](https://www.2-spyware.com/chrome-zero-day): Chrome zero-day under attack? Update Chrome on Windows, Mac, Android and iPhone, relaunch it, check the version, then patch Edge, Brave and Opera.
- [Credential stuffing: how leaked passwords open your other accounts](https://www.2-spyware.com/credential-stuffing): What credential stuffing is, where combolists and stealer logs come from, real cases like 23andMe and Roku, and how to stop reused passwords being used.
- [How to detect a keylogger on your PC, Mac or phone](https://www.2-spyware.com/how-to-detect-keylogger): How to tell if you have a keylogger: check processes, startup, Autoruns, drivers, extensions and network links in Windows, then Mac, Android and iPhone.
- [Info stealers: what they take, how fast, and what to do](https://www.2-spyware.com/info-stealers): An info stealer copies passwords, session cookies and crypto wallets in seconds. Lumma, RedLine, Vidar, StealC and AMOS explained, and what to do, in order.
- [iPhone security updates: what they fix and how to install them](https://www.2-spyware.com/iphone-security-update): What each iPhone security update fixes, what "may have been exploited" means, how to install it on iOS 26 and 27, and what to do if your iPhone cannot update.
- [Phishing emails and texts: how to spot them and what to do if you clicked](https://www.2-spyware.com/phishing-emails): Real phishing email examples, how to spot one, how to check a link safely, and what to do in order if you clicked, typed a password or gave an MFA code.
- [Free ransomware decryptors: when they work and how to use one safely](https://www.2-spyware.com/ransomware-decryptors): Find a free ransomware decryptor: identify the family, get a tool from No More Ransom or Emsisoft, test on copies, and read your STOP/Djvu ID.
- [Remote access trojans (RATs): how to tell if someone is in your PC and lock them out](https://www.2-spyware.com/remote-access-trojans): What a remote access trojan can do, how to tell if someone is remotely accessing your PC, where RATs hide in Windows, and how to remove and lock them out.
- [How to remove adware from Android](https://www.2-spyware.com/remove-adware-from-android): Full-screen ads or pop-ups on your Android phone? Find the app behind them, remove it in Safe mode, clean up Chrome and stop the ads coming back.
- [How to remove adware from a Mac](https://www.2-spyware.com/remove-adware-from-mac): Remove adware from your Mac step by step: profiles, login items, LaunchAgents, Safari and Chrome. Exact menus for macOS Sonoma 14 and Sequoia 15.
- [How to remove a virus or malware from an Android phone](https://www.2-spyware.com/remove-malware-from-android): Banking trojan, spyware or fake parcel app on your Android phone? Check four permissions, remove the app in Safe mode, then secure your bank and accounts.
- [How to remove a virus or malware from a Mac](https://www.2-spyware.com/remove-malware-from-mac): Remove malware from your Mac: Atomic (AMOS) stealers, fake installers, backdoors. Check Login Items, daemons and permissions, then change passwords.
- [Ransomware recovery: how to restore your files on Windows](https://www.2-spyware.com/shadow-copies-previous-versions): Restore files after ransomware: Previous Versions, shadow copies, File History, OneDrive and Google Drive versions, recovery tools, and the order to try them.
- [Should you pay the ransomware ransom?](https://www.2-spyware.com/should-you-pay-ransomware): Should you pay a ransomware ransom? What the FBI, NCSC and Europol say, how often payers get files back, the STOP/Djvu 50% offer and what to try first.
- [Types of malware: what each kind does and how to spot it](https://www.2-spyware.com/types-of-malware): The different types of malware compared: what each does, how it spreads, the signs on your PC, how serious it is and how to remove it, with current examples.
- [What to do after a data breach](https://www.2-spyware.com/what-to-do-after-a-data-breach): Got a breach notice or found your email on Have I Been Pwned? What to do first for leaked passwords, phone numbers, cards and SSNs, and which scams follow.
- [Windows zero-day vulnerabilities: what they are and how to close them](https://www.2-spyware.com/windows-zero-day): What a Windows zero-day is, how Patch Tuesday and out-of-band fixes work, which flaws ransomware uses, and how to update Windows 11 and 10 the right way.

## Software reviews

- [a-squared Anti-Malware Review 2026: Now Emsisoft Anti-Malware](https://www.2-spyware.com/review-a-squared-anti-malware.html): a-squared Anti-Malware is now Emsisoft Anti-Malware Home. What changed, 2026 features, prices, lab tests, privacy, the free Emergency Kit and decryptors.
- [Brave Browser Review 2026: Shields, Price, Privacy](https://www.2-spyware.com/review-brave-browser.html): Brave browser review 2026: what changed since 2018, Shields blocking, free vs VPN price, privacy policy, system needs and how to uninstall it.
- [Chromium Browser Review 2026: Is It Safe, and Is It Chrome?](https://www.2-spyware.com/review-chromium.html): Chromium review 2026: how it differs from Chrome, where to get a safe build, why updates lag, and how to spot and remove fake Chromium adware browsers.
- [Combo Cleaner Review 2026: Is It Safe, Free and Worth It?](https://www.2-spyware.com/review-combo-cleaner.html): Combo Cleaner review 2026: what the Mac and Windows antivirus does, what is free, prices, refunds, how to cancel and uninstall it.
- [CyberGhost VPN Review 2026: Prices, Audit, Refund, Safety](https://www.2-spyware.com/review-cyberghost.html): CyberGhost VPN review 2026: Kape ownership, Deloitte no-logs audits, 100 countries, prices, the 45-day refund, how to cancel and uninstall it.
- [DriverFix Review 2026: Discontinued, Safe or Not, Uninstall](https://www.2-spyware.com/review-driverfix.html): DriverFix review 2026: the driver updater is discontinued. What it did, last prices, whether it is safe, how to uninstall it and safer ways to update drivers.
- [Fortect Review 2026: Free Scan, Repair, Prices and Safety](https://www.2-spyware.com/review-fortect.html): Fortect review 2026: what the Windows repair tool does, whether it is safe, what the free scan covers, prices, renewal, refunds and how to uninstall it.
- [HitmanPro Review 2026: Is It Still Worth It?](https://www.2-spyware.com/review-hitman-pro.html): HitmanPro review 2026: HitmanPro and HitmanPro.Alert by Sophos, prices from $24.95, free 30-day trial, Windows 11 support, renewal and how to uninstall.
- [Intego Review 2026: Intego ONE, VPN, Prices and Safety](https://www.2-spyware.com/review-intego-antivirus.html): Intego review 2026: what Intego ONE for Mac does, lab results, the VPN, prices and renewals, refunds, the Windows antivirus and how to uninstall it.
- [Malwarebytes Review 2026: Free vs Premium, Tests and Prices](https://www.2-spyware.com/review-malwarebytes-anti-malware.html): Malwarebytes review 2026: what the free scanner does, what Standard, Plus and Ultimate add, AV-TEST and AV-Comparatives results, privacy and prices.
- [Microsoft AntiSpyware Beta 1 Review 2026: History, Status](https://www.2-spyware.com/review-microsoft-antispyware-beta1.html): Microsoft AntiSpyware Beta 1 review: the 2005 beta built on GIANT AntiSpyware, how it became Microsoft Defender, and why old downloads are unsafe in 2026.
- [Microsoft Defender Review 2026: Is Windows Defender Enough?](https://www.2-spyware.com/review-windows-defender.html): Microsoft Defender review 2026: the free antivirus in Windows 11 and 10 checked against AV-TEST and AV-Comparatives, features, privacy and the paid app.
- [Microsoft Safety Scanner Review 2026: Free msert.exe Tested](https://www.2-spyware.com/review-microsoft-safety-scanner.html): Microsoft Safety Scanner review for 2026: what the free msert.exe tool does, is it safe, the 10-day limit, and how it compares with Defender and Malwarebytes.
- [Norton Internet Security Review 2026: Now Norton 360](https://www.2-spyware.com/review-norton-internet-security.html): Norton Internet Security is now Norton 360. What changed, 2026 plans and renewal prices, lab test scores, the 60-day refund and how to uninstall it.
- [Private Internet Access Review 2026: Audits, Prices, Refund](https://www.2-spyware.com/review-private-internet-access.html): Private Internet Access review 2026: Kape ownership, Deloitte no-logs audits, 104 countries, prices, the 30-day refund, how to cancel and uninstall it.
- [Restoro Review 2026: FTC Case, PUP Flag, Uninstall, Refund](https://www.2-spyware.com/review-restoro.html): Restoro review 2026: no longer sold after a $26M FTC case. Why Malwarebytes flags it as a PUP, how to uninstall it, stop charges and get FTC refunds.
- [Spybot Search & Destroy Review 2026: Still Worth It?](https://www.2-spyware.com/review-spybot-search-and-destroy.html): Spybot Search & Destroy review 2026: Free vs Home vs Pro, prices, Windows 11 support, updates, refunds, safety, uninstall steps and how it compares.
- [SpyHunter 5 Review 2026: Is It Safe, Free and Worth It?](https://www.2-spyware.com/review-spyhunter.html): SpyHunter 5 review 2026: what the free scan does, what removal costs, AV-TEST results, the trial, refunds, safe download and how to uninstall it.
- [SUPERAntiSpyware Review 2026: Free vs Professional X](https://www.2-spyware.com/review-superantispyware.html): SUPERAntiSpyware review 2026: who owns it now, Free vs Professional X Edition, price, lab tests, privacy, install and how to uninstall it.
- [Webroot Review 2026: Essentials, Price, Tests, Uninstall](https://www.2-spyware.com/review-webroot-secureanywhere-antivirus.html): Webroot SecureAnywhere review 2026: now Webroot Essentials, plans and prices, SE Labs result, OpenText ownership, refunds and how to uninstall it.
- [Zemana AntiMalware Review 2026: Is It Still Worth Using?](https://www.2-spyware.com/review-zemana-antimalware.html): Zemana AntiMalware review 2026: Free vs Premium, price, Windows 11 support, last update in 2021, refunds, safety, uninstall steps and how it compares.

## Windows file library

- [Files](https://www.2-spyware.com/c/files): is a file or process genuine or malware using its name, and where it belongs
  - [System files](https://www.2-spyware.com/c/files/system-files): files that come with Windows
  - [Application files](https://www.2-spyware.com/c/application-files): files that programs and games ship
  - [Spyware-related files](https://www.2-spyware.com/c/files/spyware-related): files known only as malware
- [000.exe](https://www.2-spyware.com/file-000-exe-virus.html): 000.exe is a destructive prank malware by YouTuber FlyTech. It disables Explorer and Task Manager and renames the account to UR NEXT. How to remove it.
- [1.exe](https://www.2-spyware.com/file-1-exe.html): 1.exe is a generic file name used by many old parasites, and sometimes by harmless programs. How to tell which one you have, and how to remove it.
- [1234.exe](https://www.2-spyware.com/file-1234-exe.html): 1234.exe is a file name the old report tied to fake system-repair and fake security programs. How to check your copy and remove it.
- [7.hta](https://www.2-spyware.com/file-7-hta.html): 7.hta is an HTML Application file reported with TeamViewer. How to check it, why hta files raise alerts, and what to do if someone asked you to install TeamViewer.
- [aam-registration-notifier.exe](https://www.2-spyware.com/file-aam-registration-notifier-exe.html): aam-registration-notifier.exe is an Adobe Application Manager update notifier. What it does, how to check it, and how to stop it or uninstall the program.
- [abdocsdllloader.exe](https://www.2-spyware.com/file-abdocsdllloader-exe.html): abdocsdllloader.exe is a startup component of Acer abDocs, the cloud document sync app. What abDocs is, where the file lives, and how to uninstall it.
- [active.exe](https://www.2-spyware.com/file-active-exe.html): active.exe is a generic file name with no known publisher. How to tell a harmless copy from a malicious one, where it hides and how to remove it.
- [adobe-gamma-loader.exe](https://www.2-spyware.com/file-adobe-gamma-loader-exe.html): Adobe Gamma Loader.exe loads the Adobe Gamma monitor profile at start-up. What it is, where it belongs, and how to stop it from starting.
- [advapi32.dll](https://www.2-spyware.com/file-advapi32-dll.html): advapi32.dll is the Advanced Windows 32 Base API, part of every Windows. How to tell the genuine file from a copy in another folder that only uses its name.
- [agentsvr.exe](https://www.2-spyware.com/file-agentsvr-exe.html): agentsvr.exe is the Microsoft Agent Server behind animated characters like the Office Assistant. Genuine folder, size, how to check it and how to remove fakes.
- [alcxmntr.exe](https://www.2-spyware.com/file-alcxmntr-exe.html): alcxmntr.exe is the Realtek AC'97 audio event monitor. Where it lives, what installs it, whether you need it at start-up, and how to spot a fake.
- [alg.exe](https://www.2-spyware.com/file-alg-exe.html): alg.exe is the Windows Application Layer Gateway Service for Internet Connection Sharing plug-ins. Its folder, how to check it, and whether you can disable it.
- [amd_ags_x64.dll](https://www.2-spyware.com/file-amd_ags_x64-dll.html): amd_ags_x64.dll is AMD's GPU Services library that games ship in their own folders. How to tell AMD's copy from a planted or repack file, and when to worry.
- [ams.exe](https://www.2-spyware.com/file-ams-exe.html): ams.exe is reported to start AntiMalwareSuite, a rogue anti-spyware that shows fake infections to sell a licence. How to find it, remove it and what to do next.
- [amtemu.exe](https://www.2-spyware.com/file-amtemu-exe.html): amtemu.exe is AMT Emulator, a crack that patches Adobe's amtlib.dll. Why it is unsafe, how to check your PC and how to restore genuine Adobe files.
- [api-ms-win-core-path-l1-1-0.dll](https://www.2-spyware.com/file-api-ms-win-core-path-l1-1-0-dll.html): api-ms-win-core-path-l1-1-0.dll is a Microsoft API set name of Windows 8 and later. Where a genuine stub lives and why copies for Windows 7 are not Microsoft's.
- [api-ms-win-crt-runtime-l1-1-0.dll](https://www.2-spyware.com/file-api-ms-win-crt-runtime-l1-1-0-dll.html): api-ms-win-crt-runtime-l1-1-0.dll is a Microsoft forwarder of the Universal C Runtime. Where genuine copies live, and how to spot a fake or planted one.
- [apoint.exe](https://www.2-spyware.com/file-apoint-exe.html): apoint.exe is the Alps touchpad driver process on many laptops. Where the genuine file lives, how to check it, and what happens if you stop or remove it.
- [apphostregistrationverifier.exe](https://www.2-spyware.com/file-apphostregistrationverifier-exe.html): apphostregistrationverifier.exe is a genuine Windows developer tool that tests app-to-website links. How to check your copy and what a copy elsewhere means.
- [appnhost.exe](https://www.2-spyware.com/file-appnhost-exe.html): appnhost.exe is tied to Mixesoft and the Click&Clean extension, but the name is also used as a disguise. See how to check it, find it and remove it.
- [arp.exe](https://www.2-spyware.com/file-arp-exe.html): arp.exe is the Windows command that shows and edits the ARP cache. What it does, where the genuine file lives, how to check it, and what ARP spoofing is.
- [arpproducticon.exe](https://www.2-spyware.com/file-arpproducticon-exe.html): arpproducticon.exe is normally the program icon Windows Installer keeps for Apps settings. How to check it, when it is a threat and how to remove the program.
- [asd.exe](https://www.2-spyware.com/file-asd-exe.html): asd.exe is the executable of Advanced Spyware Detector, a rogue anti-spyware program. What it does, how to find it, and how to remove it step by step.
- [at1.job](https://www.2-spyware.com/file-at1-job.html): at1.job is a task file made by the Windows at command. What it is, how to see what it runs, when it is dangerous, and how to delete the task safely.
- [aupdate.exe](https://www.2-spyware.com/file-aupdate-exe.html): aupdate.exe is the Automatic LiveUpdate module of Symantec security software. Where the genuine file lives, how to check it, and whether you can remove it.
- [autoclk.exe](https://www.2-spyware.com/file-autoclk-exe.html): autoclk.exe is the process of a little-known mouse utility, normally in C:\Windows. How to check it, stop it starting and uninstall the program.
- [autorun.ico](https://www.2-spyware.com/file-autorun-ico.html): autorun.ico is an icon image that an autorun.inf file can point to on a USB drive. What it is, how to check it, and how to remove an autorun worm.
- [avlaunch.exe](https://www.2-spyware.com/file-avlaunch-exe.html): avlaunch.exe is the start-up component of Avast Antivirus. Where the genuine file lives, how to check it, and how to stop it or uninstall the program.
- [backweb.exe](https://www.2-spyware.com/file-backweb-exe.html): backweb.exe is the BackWeb update and news client used by Logitech Desktop Messenger. How to check it, why it runs, and how to remove the program.
- [binkw32.dll](https://www.2-spyware.com/file-binkw32-dll.html): binkw32.dll is the Bink Video library from RAD Game Tools that 32-bit games ship. Mods and cracks swap it. How to tell RAD's copy from a planted one.
- [biprep.exe](https://www.2-spyware.com/file-biprep-exe.html): biprep.exe is installed by the Gator adware Browser Helper Object. It tracks browsing, shows pop-up ads and should be removed. How to find and remove it.
- [bl.exe](https://www.2-spyware.com/file-bl-exe.html): bl.exe is reported as a file installed by BlackLog, a keylogger. What the name means, how to find the file, how to remove it, and when a bl.exe is harmless.
- [boom.exe](https://www.2-spyware.com/file-boom-exe.html): boom.exe is reported as the file of a flooder called Boom, but harmless programs also use the name. How to tell which one you have, and how to remove it.
- [borlndmm.dll](https://www.2-spyware.com/file-borlndmm-dll.html): borlndmm.dll is the Borland Delphi shared memory manager library. Where it belongs, how to check it, fix a missing error and when to remove it.
- [brhost.exe](https://www.2-spyware.com/file-brhost-exe.html): brhost.exe is reported as a trojan that mines Bitcoin and Monero with your CPU. See how it arrives, how to find it without Task Manager and how to remove it.
- [bridge.dll](https://www.2-spyware.com/file-bridge-dll.html): bridge.dll is a browser helper object linked to WinFavorites adware and spyware. What it does, how to check it, and how to remove it from Windows.
- [browser_broker.exe](https://www.2-spyware.com/file-browser_broker-exe.html): browser_broker.exe is a Windows file that Microsoft Edge Legacy uses. Where it sits, how to check it, why it cannot be ended and what its errors mean.
- [bytefence.exe](https://www.2-spyware.com/file-bytefence-exe.html): bytefence.exe is the main file of ByteFence Anti-Malware, a bundled program security vendors class as unwanted. How to check it and how to uninstall it.
- [capturescreen.ocx](https://www.2-spyware.com/file-capturescreen-ocx.html): capturescreen.ocx is an ActiveX control that normal programs and the NetSpy keylogger have used. How to find what loads it, fix error 336 and remove it if needed.
- [cc.exe](https://www.2-spyware.com/file-cc-exe.html): cc.exe is the main file of Control Center, a rogue PC optimizer that shows fake virus alerts to sell a licence. Where it hides, how to find it and how to remove it.
- [ccxprocess.exe](https://www.2-spyware.com/file-ccxprocess-exe.html): ccxprocess.exe belongs to Adobe Creative Cloud. How to check it is genuine, why it can use CPU or run many copies, and how to stop it or remove it.
- [checker.exe](https://www.2-spyware.com/file-checker-exe.html): checker.exe is a generic file name with no known publisher. Old reports tie it to a threat called Network Control. How to check it, remove it, and what it is not.
- [chrome_elf.dll](https://www.2-spyware.com/file-chrome_elf-dll.html): chrome_elf.dll is the first library Google Chrome loads. Other Chromium browsers carry it too. How to tell Google's copy from one you never installed.
- [chrome.exe](https://www.2-spyware.com/file-chrome-exe.html): chrome.exe is Google Chrome's own program file. How to tell the genuine file (folder, Google LLC signature) from a fake copy, and what to do if it is fake.
- [chromium.exe](https://www.2-spyware.com/file-chromium-exe.html): chromium.exe is the open-source Chromium browser's program file, but adware also uses the name. How to check yours, when to remove it, and how it gets installed.
- [cisvc.exe](https://www.2-spyware.com/file-cisvc-exe.html): cisvc.exe is the Microsoft Indexing Service file that helps find files and folders faster. How to check it, whether you can stop it, and when a copy is malware.
- [close.js](https://www.2-spyware.com/file-close-js.html): close.js is a malicious script linked to Spora ransomware. How it arrives in email, how to find it, and why deleting it alone does not stop the encryption.
- [cmd32.exe](https://www.2-spyware.com/file-cmd32-exe.html): cmd32.exe is a copy of the Tanked file-sharing worm, also called Kwbot. It opens an IRC backdoor for attackers. How to find it and remove it from Windows.
- [codex64.dll](https://www.2-spyware.com/file-codex64-dll.html): codex64.dll comes with games cracked by the CODEX group, not with any game you buy. Why antivirus flags it, why it goes missing and how to clean the PC.
- [comrade.exe](https://www.2-spyware.com/file-comrade-exe.html): comrade.exe is the GameSpy Comrade game chat client from IGN. Where the real file sits, whether it is a virus and how to uninstall GameSpy Comrade.
- [configuration-utility.exe](https://www.2-spyware.com/file-configuration-utility-exe.html): Configuration Utility.exe can be a file of the 2003 Lacon email worm. How to tell it from a harmless program's file, and how to remove it with Defender.
- [conhost.exe](https://www.2-spyware.com/file-conhost-exe.html): conhost.exe (Console Window Host) is a genuine Windows file. How to check yours, why several copies run, high CPU, and the crypto-miner that copied its name.
- [consent.exe](https://www.2-spyware.com/file-consent-exe.html): consent.exe is the Windows User Account Control prompt (Consent UI). How to check that yours is genuine, why it may use CPU, and why you should not delete it.
- [cookies.sqlite](https://www.2-spyware.com/file-cookies-sqlite.html): cookies.sqlite is the file where Mozilla Firefox stores cookies. Where it is, why -wal and -shm files appear next to it, and whether you can delete it.
- [crdownload](https://www.2-spyware.com/file-crdownload.html): A .crdownload file is a partly downloaded file made by Chrome, Edge or Chromium. What it is, how to resume the download, and when it is safe to delete.
- [csrss.exe](https://www.2-spyware.com/file-csrss-exe.html): csrss.exe is a genuine Windows process that cannot be ended. How to check yours, why more than one runs, and how to spot a fake csrss.exe in another folder.
- [ctfmon.exe](https://www.2-spyware.com/file-ctfmon-exe.html): ctfmon.exe (CTF Loader) is a genuine Windows text-input process. How to check yours, why it runs, and malware that copies its name.
- [ctl3d32.dll](https://www.2-spyware.com/file-ctl3d32-dll.html): ctl3d32.dll is Ctl3D 3D Windows Controls, a 32-bit Windows file kept for old programs. Where the genuine copy lives and how to tell a planted one.
- [cure.exe](https://www.2-spyware.com/file-cure-exe.html): cure.exe is not a Windows or cure program file. In 2020 a file of this name delivered the HawkEye keylogger. How to find it, remove it and what is unknown.
- [d3d11.dll](https://www.2-spyware.com/file-d3d11-dll.html): d3d11.dll is the Direct3D 11 Runtime, part of Windows. A copy in a game or program folder is a graphics mod or a planted file. How to tell them apart.
- [d3d12.dll](https://www.2-spyware.com/file-d3d12-dll.html): d3d12.dll is the Direct3D 12 Runtime of Windows 10 and 11. A copy beside a game's .exe or a Windows program is not Windows' own. How to tell them apart.
- [d3d9.dll](https://www.2-spyware.com/file-d3d9-dll.html): d3d9.dll is the Direct3D 9 Runtime, part of Windows. A copy in a game folder is a graphics mod or a planted file. How to tell which one you have.
- [d3dcompiler_43.dll](https://www.2-spyware.com/file-d3dcompiler_43-dll.html): d3dcompiler_43.dll is Microsoft's June 2010 shader compiler that games ship with them. Where a genuine copy lives, who signs it and when a copy needs a scan.
- [d3dcompiler_47.dll](https://www.2-spyware.com/file-d3dcompiler_47-dll.html): d3dcompiler_47.dll is Microsoft's shader compiler in Windows and in many app folders. Which copies are genuine and which one needs a closer look.
- [d3dx9_42.dll](https://www.2-spyware.com/file-d3dx9_42-dll.html): d3dx9_42.dll is Microsoft's August 2009 D3DX9 graphics library. A Skyrim mod uses the same name. How to tell which copy you have and when to worry.
- [d3dx9_43.dll](https://www.2-spyware.com/file-d3dx9_43-dll.html): d3dx9_43.dll is Microsoft's Direct3D 9 helper library. Loaders hidden in pirated game installers have used its name. How to tell your copy apart.
- [daemon.exe](https://www.2-spyware.com/file-daemon-exe.html): daemon.exe belongs to DAEMON Tools, a disc image program from Disc Soft. How to check that it is genuine, why it runs, and how to uninstall the program.
- [dbdata.dll](https://www.2-spyware.com/file-dbdata-dll.html): dbdata.dll is a crack loader from pirated Ubisoft games. Why security software removes it, what "Unable to load library" means and how to clean up.
- [dbghelp.dll](https://www.2-spyware.com/file-dbghelp-dll.html): dbghelp.dll is the Windows Image Helper, part of Windows. Programs also ship their own copy, and attackers plant fakes. How to tell which one you have.
- [decrypt_instructions](https://www.2-spyware.com/file-decrypt_instructions.html): DECRYPT_INSTRUCTIONS.html and .txt are ransom notes left by CryptoWall-type ransomware. What they mean, why deleting them is not enough, and what to do next.
- [delme.bat](https://www.2-spyware.com/file-delme-bat.html): delme.bat is a batch script of unknown origin. How to find it, why a .bat file raises alarms, how to check it and remove it, and what a batch file can do.
- [dialer.exe](https://www.2-spyware.com/file-dialer-exe.html): dialer.exe is the Windows Phone Dialer, a genuine Microsoft file in System32. How to check yours, why dialer viruses use the name, and high RAM.
- [dinput8.dll](https://www.2-spyware.com/file-dinput8-dll.html): dinput8.dll is Microsoft DirectInput, part of Windows. A copy in a game folder is a mod, cheat or trainer loader. How to tell which one you have.
- [discord_game_sdk.dll](https://www.2-spyware.com/file-discord_game_sdk-dll.html): discord_game_sdk.dll is the Discord Game SDK library that games ship for Rich Presence and invites. How to tell a game's copy from a planted one.
- [discordhookhelper.exe](https://www.2-spyware.com/file-discordhookhelper-exe.html): discordhookhelper.exe is a signed helper of the Discord app for game detection and the overlay. Where it lives, how to check it and what to do if flagged.
- [dload.exe](https://www.2-spyware.com/file-dload-exe.html): dload.exe is most likely part of Microsoft's MSDN Office Test Platform & Development Tools, but can be dialer malware. How to tell which one you have.
- [drsmartload.exe](https://www.2-spyware.com/file-drsmartload-exe.html): drsmartload.exe starts the Drsmartload adware and downloads more spyware. It is not a Windows file. How to check the file and remove it with Defender.
- [dsound.dll](https://www.2-spyware.com/file-dsound-dll.html): dsound.dll is DirectSound, part of Windows. A copy in a game folder is an ASI loader, a sound wrapper, a trainer or a cheat. How to tell which you have.
- [dumprep.exe](https://www.2-spyware.com/file-dumprep-exe.html): dumprep.exe is a Microsoft crash dump reporting tool of Windows XP. What "dumprep 0 -k" means, where the real file is and why Windows 10 and 11 have none.
- [dwm.exe](https://www.2-spyware.com/file-dwm-exe.html): dwm.exe (Desktop Window Manager) is a genuine Windows process that draws windows on screen. How to check yours, why it uses memory, and malware that copies its name.
- [dwwin.exe](https://www.2-spyware.com/file-dwwin-exe.html): dwwin.exe is the Windows Error Reporting program, also called Dr. Watson. What it does, where the genuine file is, how to check it and what its errors mean.
- [dxgi.dll](https://www.2-spyware.com/file-dxgi-dll.html): dxgi.dll is DirectX Graphics Infrastructure, part of Windows. A copy in a game folder is a graphics mod or injector. How to tell which one you have.
- [e_spyw.ivd](https://www.2-spyware.com/file-e_spyw-ivd.html): e_spyw.ivd belongs to the Plugins\e_spyw family of security-product detection files. What the family is, how to check your copy, and the old fake-antivirus claim.
- [elevation_service.exe](https://www.2-spyware.com/file-elevation_service-exe.html): elevation_service.exe is the Chrome and Edge elevation service. Where the genuine file lives, how to check it, why it may use CPU, and what to do about errors.
- [eula.rtf](https://www.2-spyware.com/file-eula-rtf.html): eula.rtf is the End User License Agreement text that software ships with. What it is, how to check it, when an RTF file is dangerous, and how to remove it.
- [exefile.exe](https://www.2-spyware.com/file-exefile-exe.html): exefile.exe is a process started by EVE Online and similar games. How to tell the genuine file in Program Files from a fake in C:\Windows.
- [explorer.exe](https://www.2-spyware.com/file-explorer-exe.html): explorer.exe is the genuine Windows shell: desktop, taskbar and File Explorer. How to check yours, restart it when frozen, and malware that copies or hijacks it.
- [ezsp_px.exe](https://www.2-spyware.com/file-ezsp_px-exe.html): ezsp_px.exe belongs to Easy Systems Japan's Drag'n Drop CD & DVD software. How to check it (System32, 40,960 bytes), and how to remove the program.
- [fake-client.exe](https://www.2-spyware.com/file-fake-client-exe.html): fake-client.exe is not one program: it is the label for a malicious client.exe, often tied to RocketTab adware or a scam. How to find it and remove it.
- [ffmpeg.dll](https://www.2-spyware.com/file-ffmpeg-dll.html): ffmpeg.dll is the media library Discord, Teams, VS Code and other Electron apps ship. It was also trojanized in the 3CX attack. How to tell a safe copy apart.
- [fontdrvhost.exe](https://www.2-spyware.com/file-fontdrvhost-exe.html): fontdrvhost.exe (Usermode Font Driver Host) is a genuine Windows process that parses fonts. How to check yours and whether to remove it.
- [fs.exe](https://www.2-spyware.com/file-fs-exe.html): fs.exe is reported as part of the rogue program Windows System Defender, which fakes infections to sell a useless removal tool. How to check for it and remove it.
- [funny.exe](https://www.2-spyware.com/file-funny-exe.html): funny.exe is not a Windows file and no known publisher uses it. What is and is not known, how to find it, how to remove it, and how it differs from fun.exe.
- [g.exe](https://www.2-spyware.com/file-g-exe.html): g.exe is reported as Backdoor.Graybird.Q malware, and a hidden window titled G is also blamed for blocked shutdowns. How to tell them apart and remove it.
- [gdipfontcachev1.dat](https://www.2-spyware.com/file-gdipfontcachev1-dat.html): gdipfontcachev1.dat is a font cache that programs using Windows GDI+ create in your profile. What it holds, how to check it, and whether to delete it.
- [goat.exe](https://www.2-spyware.com/file-goat-exe.html): goat.exe is reported as a file installed by the Donut Trojan. What is and is not known, how to find it, and how to remove it safely.
- [googlecrashhandler.exe](https://www.2-spyware.com/file-googlecrashhandler-exe.html): GoogleCrashHandler.exe is the crash handler of Google Update, which updates Chrome. Where the genuine file lives, how to check it and what to do if it is a fake.
- [gotoassist.exe](https://www.2-spyware.com/file-gotoassist-exe.html): gotoassist.exe is the GoTo remote support program. It is genuine, but scammers use it with fake alerts. How to tell and what to do if you let someone in.
- [groovemonitor.exe](https://www.2-spyware.com/file-groovemonitor-exe.html): groovemonitor.exe is Microsoft's GrooveMonitor Utility, which reports Groove Collaboration Service errors. How to check it, and what high CPU use means.
- [gui.exe](https://www.2-spyware.com/file-gui-exe.html): gui.exe is the interface of Gigabyte Smart 6 on PCs with Gigabyte motherboards. How to check the genuine file, spot an imitation and remove the program.
- [gup.exe](https://www.2-spyware.com/file-gup-exe.html): gup.exe is WinGUp, the update helper of Notepad++. Where the genuine file lives, how to check it, and how to stop it or remove the program.
- [gwx.exe](https://www.2-spyware.com/file-gwx-exe.html): gwx.exe is the Get Windows 10 upgrade-reminder app from Microsoft update KB3035583. Where the real file is, whether it is a virus and how to remove it.
- [hidfind.exe](https://www.2-spyware.com/file-hidfind-exe.html): hidfind.exe is a component of the Alps Pointing-device Driver for laptop touchpads. Where the genuine file lives, how to check it and what to do if it is not.
- [hkcmd.exe](https://www.2-spyware.com/file-hkcmd-exe.html): hkcmd.exe is Intel's graphics hotkey interpreter from older driver packages. Where the genuine file lives, how to check it, and how to stop it starting.
- [hook.dll](https://www.2-spyware.com/file-hook-dll.html): hook.dll is a name keyloggers and other spyware use for their harmful library. How to find it, remove it, and tell it from a legitimate hook.dll.
- [hpgs2wnd.exe](https://www.2-spyware.com/file-hpgs2wnd-exe.html): hpgs2wnd.exe is a Hewlett-Packard Share-to-Web utility. Where the genuine file lives, its known size, how to check it and what to do if it causes problems.
- [hpwuschd2.exe](https://www.2-spyware.com/file-hpwuschd2-exe.html): hpwuschd2.exe is the HP Software Update Scheduler installed with HP printers and scanners. Where the genuine file lives, how to check it and how to remove it.
- [hxtsr.exe](https://www.2-spyware.com/file-hxtsr-exe.html): hxtsr.exe is part of the Windows Mail and Calendar app. How to check yours, why antivirus flags it, why it uses CPU, and whether you can remove it.
- [iamdb.rdb](https://www.2-spyware.com/file-iamdb-rdb.html): iamdb.rdb is an Internet Access Monitoring Database. The .rdb extension is ZoneAlarm's, and the file is also linked to Ghost Keylogger. How to check and remove it.
- [icq126pw.exe](https://www.2-spyware.com/file-icq126pw-exe.html): icq126pw.exe is installed by the parasite ICQ Patch and can launch other threats. Do not run it. How to check the file and remove it with Microsoft Defender.
- [idle.exe](https://www.2-spyware.com/file-idle-exe.html): idle.exe is normally the Python IDLE launcher. How to tell it from a hidden miner, why it differs from System Idle Process, and how to remove it.
- [iehelper.dll](https://www.2-spyware.com/file-iehelper-dll.html): iehelper.dll is a Browser Helper Object that third-party programs load into Internet Explorer. Which program owns your copy, how to check it and remove it.
- [ielowutil.exe](https://www.2-spyware.com/file-ielowutil-exe.html): ielowutil.exe is the Internet Explorer Low-Mic Utility Tool, a genuine Microsoft file. Where it lives, how to check it, and why it keeps starting.
- [igfxpers.exe](https://www.2-spyware.com/file-igfxpers-exe.html): igfxpers.exe is Intel's graphics Persistence Module. Where the real file lives, how to check it, why it uses CPU and whether to disable it at startup.
- [igfxtray.exe](https://www.2-spyware.com/file-igfxtray-exe.html): igfxtray.exe is Intel's graphics tray module. Genuine folder, the errors it triggers, fake files that used its name and how to remove the program.
- [img001.exe](https://www.2-spyware.com/file-img001-exe.html): img001.exe is not a Windows or program file. What is known and not known about it, how to find it, and how to remove it. img001.jpg is a different, normal name.
- [imjpmig.exe](https://www.2-spyware.com/file-imjpmig-exe.html): imjpmig.exe belongs to the Microsoft Input Method Editor and supports Japanese keyboard entry. Where it lives, how to check it and when it can be removed.
- [inetinfo.exe](https://www.2-spyware.com/file-inetinfo-exe.html): inetinfo.exe is the Internet Information Services (IIS) Admin Service process in C:\Windows\System32\inetsrv. What it does, how to check it and how to stop it.
- [installer.exe](https://www.2-spyware.com/file-installer-exe.html): installer.exe is a generic file name used by adware and trojans, and by harmless setup programs. How to tell which one you have and how to remove it.
- [inststat.exe](https://www.2-spyware.com/file-inststat-exe.html): inststat.exe is a small file installed with IObit Driver Booster. Where the genuine copy is, how to check it, and how to remove the program it belongs to.
- [instup.exe](https://www.2-spyware.com/file-instup-exe.html): instup.exe is the Avast and AVG installer and updater. Where the genuine file lives, why several copies run, and how to uninstall Avast properly.
- [interop-iwshruntimelibrary.dll](https://www.2-spyware.com/file-interop-iwshruntimelibrary-dll.html): Interop.IWshRuntimeLibrary.dll is a .NET interop file for Windows Script Host. What uses it, how to check it, fix a missing error and when to remove it.
- [ipmon32.exe](https://www.2-spyware.com/file-ipmon32-exe.html): ipmon32.exe is the background traffic monitor of Visual IP InSight. How to confirm it is the real one, when to remove it, and what a fake copy looks like.
- [irsetup.exe](https://www.2-spyware.com/file-irsetup-exe.html): irsetup.exe is the engine of installers built with Setup Factory by Indigo Rose. Where it runs from, why it appears, errors and how to uninstall the program.
- [isass.exe](https://www.2-spyware.com/file-isass-exe.html): isass.exe is not Windows lsass.exe. It was reported as a component of an OptixPro backdoor. See how to check it, find it and remove it.
- [isdone.dll](https://www.2-spyware.com/file-isdone-dll.html): isdone.dll is a plugin game installers use to unpack their data files. It is a fixture of repacked and cracked downloads. How to tell a normal copy from a risky one.
- [istsvc.exe](https://www.2-spyware.com/file-istsvc-exe.html): istsvc.exe belongs to the ISTBar adware toolbar. It redirects to adult and commercial content and can restart itself. How to find it and remove it.
- [itibiti.exe](https://www.2-spyware.com/file-itibiti-exe.html): itibiti.exe belongs to Itibiti Soft Phone, shown as KNCTR in Installed apps. A bundled ad-supported program: its folder, how to check it and remove it.
- [javaw.exe](https://www.2-spyware.com/file-javaw-exe.html): javaw.exe starts Java programs without a console window. How to check that your copy is genuine, fix the error message and remove Java if you do not need it.
- [kernel32.dll](https://www.2-spyware.com/file-kernel32-dll.html): kernel32.dll is the Windows NT BASE API Client DLL, part of every Windows. How to tell the genuine file from a copy that only uses its name.
- [kernelbase.dll](https://www.2-spyware.com/file-kernelbase-dll.html): KernelBase.dll is a core Windows library in System32 and SysWOW64. How to tell the genuine file from a copy elsewhere, and how malware abuses it.
- [lexpps.exe](https://www.2-spyware.com/file-lexpps-exe.html): lexpps.exe is a Lexmark printer driver part that shares a printer on a network. How to check it, why it runs at startup and how to stop it or remove the driver.
- [libcef.dll](https://www.2-spyware.com/file-libcef-dll.html): libcef.dll is the Chromium Embedded Framework library many programs ship. Attackers plant fakes next to signed .exe files. How to tell the real one.
- [libcurl.dll](https://www.2-spyware.com/file-libcurl-dll.html): libcurl.dll is the open-source curl network library that programs ship in their own folders. Signed programs can load a planted copy. How to tell them apart.
- [license.rtf](https://www.2-spyware.com/file-license-rtf.html): license.rtf is a generic name. Usually it is a program's license text, but malware has used the name too. How to check the file, and can an RTF carry a virus.
- [lights.exe](https://www.2-spyware.com/file-lights-exe.html): lights.exe is the old Windows modem status icon for the system tray. What it does, how to check a copy on a modern PC and when to scan or remove it.
- [ligma.exe](https://www.2-spyware.com/file-ligma-exe.html): ligma.exe starts the 2018 LIGMA ransomware-wiper that renames files .ForgiveMe and wrecks the boot record. What it does, how to find it and what to do.
- [lms.exe](https://www.2-spyware.com/file-lms-exe.html): lms.exe is Intel's Local Manageability Service, part of Intel AMT. How to check it, fix high CPU use, tell it from a coin miner and decide whether to remove it.
- [loader.vbs](https://www.2-spyware.com/file-loader-vbs.html): Loader.vbs is a malicious script started by a hidden scheduled task. Why "Can not find script file" appears and how to remove the task and its folders.
- [lockapp.exe](https://www.2-spyware.com/file-lockapp-exe.html): lockapp.exe is the genuine Windows lock screen app, not a crypto miner. How to check yours, why it shows in Task Manager, and what a fake copy looks like.
- [logilda.dll](https://www.2-spyware.com/file-logilda-dll.html): LogiLDA.dll is the Logitech Download Assistant, started at sign-in from System32. How to tell Logitech's copy from a file that only borrows the name.
- [lol.bat](https://www.2-spyware.com/file-lol-bat.html): lol.bat is a batch file reported with the Backdoor.ServuDoor.a backdoor. What it does, whether bat files are safe, how to check it and how to remove it.
- [lsass.exe](https://www.2-spyware.com/file-lsass-exe.html): lsass.exe signs you in to Windows and must never be ended. How to check yours, fix high CPU and restart errors, and turn on LSA protection in Windows 11.
- [lvcoms.exe](https://www.2-spyware.com/file-lvcoms-exe.html): lvcoms.exe is the LVCom Server installed with Logitech QuickCam and ImageStudio webcam software. What it does, where it lives and how to spot a fake copy.
- [madchook.dll](https://www.2-spyware.com/file-madchook-dll.html): madchook.dll is a hooking library from the madCodeHook package that programs load. What it does, how to check a copy, and when to remove its program.
- [mapping2.map](https://www.2-spyware.com/file-mapping2-map.html): mapping2.map is a .map file the old report tied to the Aurora adware. Most .map files are harmless data. How to tell which one you have, and how to remove it.
- [mbamservice.exe](https://www.2-spyware.com/file-mbamservice-exe.html): mbamservice.exe is the service of the MBAM Anti-Malware program. Why it used over 90 percent CPU after a bad update, how to fix it, and how to spot a fake.
- [md5.db](https://www.2-spyware.com/file-md5-db.html): md5.db is a data file of Ad-Protect, a rogue antispyware program. What it is, where it hides, how to find it and how to remove the program.
- [mdm.exe](https://www.2-spyware.com/file-mdm-exe.html): mdm.exe is Microsoft's Machine Debug Manager, installed with developer tools. Where the real file lives, why many copies run, and how to check a fake.
- [mdnsnsp.dll](https://www.2-spyware.com/file-mdnsnsp-dll.html): mdnsnsp.dll is Apple's Bonjour Namespace Provider. Why Windows blocks it from the Local Security Authority, and how to tell Apple's copy from a fake.
- [memu-installer.exe](https://www.2-spyware.com/file-memu-installer-exe.html): memu-installer.exe is the installer of the MEmu Android emulator by Microvirt. Why security software flags it, how to tell it from a fake, and how to remove MEmu.
- [mfc140.dll](https://www.2-spyware.com/file-mfc140-dll.html): mfc140.dll is Microsoft's ANSI MFC library for desktop programs. Which folders hold genuine copies, what a planted one looks like and how to check yours.
- [mfc140u.dll](https://www.2-spyware.com/file-mfc140u-dll.html): mfc140u.dll is Microsoft's MFC library for classic desktop programs. Where genuine copies live, which ones to look at twice and how to check yours.
- [mfplat.dll](https://www.2-spyware.com/file-mfplat-dll.html): mfplat.dll is the Media Foundation Platform, part of Windows. Copies outside System32 and SysWOW64 are not Windows' own. How to tell which one you have.
- [microsoft-photos.exe](https://www.2-spyware.com/file-microsoft-photos-exe.html): Microsoft.Photos.exe (photos.exe) is the process of the Windows Photos app. Where the genuine file lives, how to check it and how to stop it running.
- [microsoft-vc80-mfc.manifest](https://www.2-spyware.com/file-microsoft-vc80-mfc-manifest.html): Microsoft.VC80.MFC.manifest describes the Visual C++ 2005 MFC library for a program. Where it belongs, how to check it, and when to remove the program.
- [mmtask.exe](https://www.2-spyware.com/file-mmtask-exe.html): mmtask.exe is a background task of MusicMatch Jukebox that watches the optical drive for a CD. How to check it, stop it starting and fix its errors.
- [movies.exe](https://www.2-spyware.com/file-movies-exe.html): movies.exe is an executable that an old report links to Blackworm and Myftu malware. How to check where your copy came from and how to remove it.
- [mps.exe](https://www.2-spyware.com/file-mps-exe.html): mps.exe is normally the McAfee Privacy Service program in Program Files\McAfee\MPS. How to tell it from a fake copy, and how to stop or remove it.
- [msa64chk.dll](https://www.2-spyware.com/file-msa64chk-dll.html): msa64chk.dll is reported as a DLL carrying malicious code, but the name can also belong to a legitimate program. How to check it with Process Explorer and remove it.
- [mscoree.dll](https://www.2-spyware.com/file-mscoree-dll.html): mscoree.dll is the Microsoft .NET Runtime Execution Engine, part of Windows. A copy elsewhere has been used by ShadowPad. How to tell which you have.
- [msdc.exe](https://www.2-spyware.com/file-msdc-exe.html): msdc.exe is a spam mailer dropped by the Kalshi Trojan, which also installs a backdoor. How to find the file, check it and remove it with Microsoft Defender.
- [msert.exe](https://www.2-spyware.com/file-msert-exe.html): msert.exe is the Microsoft Safety Scanner, a standalone malware scanner. How to tell the genuine file from a fake, why it stops working after ten days.
- [msfeedssync.exe](https://www.2-spyware.com/file-msfeedssync-exe.html): msfeedssync.exe is the Windows RSS feed updater from Internet Explorer. How to check that yours is genuine, why it runs, and what a fake copy looks like.
- [msgsrv32.exe](https://www.2-spyware.com/file-msgsrv32-exe.html): msgsrv32.exe is the Windows 95/98/Me 32-bit VxD Message Server in C:\WINDOWS\SYSTEM. On any other system or folder, treat it as a threat.
- [mshta.exe](https://www.2-spyware.com/file-mshta-exe.html): mshta.exe runs .hta files and is a genuine Windows file in System32, but attackers use it too. How to check it, why it runs, and how to block it.
- [msiexec.exe](https://www.2-spyware.com/file-msiexec-exe.html): msiexec.exe is the genuine Windows Installer that runs .msi packages. How to check your copy, malware that abuses it, and how to fix Windows Installer errors.
- [msmpeng.exe](https://www.2-spyware.com/file-msmpeng-exe.html): msmpeng.exe is the Microsoft Defender Antivirus engine. How to check yours, why it uses high CPU, and malware that imitates Defender's names.
- [mssecsvc.exe](https://www.2-spyware.com/file-mssecsvc-exe.html): mssecsvc.exe is the WannaCry ransomware service, not a Windows file. See how to find it, how it spread through EternalBlue and how to remove it.
- [mssetup.exe](https://www.2-spyware.com/file-mssetup-exe.html): mssetup.exe has no known publisher. What is and is not known, how it differs from the ~MSSETUP.T setup folder, how to check it and remove it.
- [msvbvm50.dll](https://www.2-spyware.com/file-msvbvm50-dll.html): msvbvm50.dll is the Visual Basic 5.0 runtime that old programs need and Windows does not include. Where a genuine copy sits and how to spot a fake one.
- [msvcp100.dll](https://www.2-spyware.com/file-msvcp100-dll.html): msvcp100.dll is Microsoft's Visual C++ 2010 C++ library. Where the genuine file lives, how to check a copy, and why malware kits carry it along.
- [msvcp110.dll](https://www.2-spyware.com/file-msvcp110-dll.html): msvcp110.dll is Microsoft's Visual C++ 2012 C++ library. A 2025 fake VPN dropped a hidden copy in AppData to run a stealer. How to tell which one you have.
- [msvcp120.dll](https://www.2-spyware.com/file-msvcp120-dll.html): msvcp120.dll is Microsoft's Visual C++ 2013 C++ library. Attack kits in 2020 and 2026 carried the real file beside a malicious DLL. How to check yours.
- [msvcp140_atomic_wait.dll](https://www.2-spyware.com/file-msvcp140_atomic_wait-dll.html): msvcp140_atomic_wait.dll is a Microsoft Visual C++ runtime file. Where the genuine copy lives, how to read its signature and when a copy needs a closer look.
- [msvcp140.dll](https://www.2-spyware.com/file-msvcp140-dll.html): msvcp140.dll is a Microsoft C++ runtime library, and malware has used its name for side-loading. Where the genuine file lives and how to check yours.
- [msvcp80.dll](https://www.2-spyware.com/file-msvcp80-dll.html): msvcp80.dll is the Microsoft Visual C++ 2005 runtime library. Fix the missing-DLL error with the Redistributable, check your copy, and know when it is not genuine.
- [msvcr100.dll](https://www.2-spyware.com/file-msvcr100-dll.html): msvcr100.dll is Microsoft's Visual C++ 2010 C runtime. Lazarus, a supply chain attack and PXA Stealer reused the name. How to tell your copy apart.
- [msvcr110.dll](https://www.2-spyware.com/file-msvcr110-dll.html): msvcr110.dll is Microsoft's Visual C++ 2012 C runtime. Attackers have planted fake copies beside trusted programs. How to tell the real file from a fake.
- [msvcr120.dll](https://www.2-spyware.com/file-msvcr120-dll.html): msvcr120.dll is Microsoft's Visual C++ 2013 C runtime. Malware kits have carried it next to their loaders. Where the genuine file lives and how to check yours.
- [msvcr71.dll](https://www.2-spyware.com/file-msvcr71-dll.html): msvcr71.dll is the Visual C++ .NET 2003 runtime that old programs ship in their own folders. Where a genuine copy sits and how to spot a file posing under the name.
- [msvcrt.dll](https://www.2-spyware.com/file-msvcrt-dll.html): msvcrt.dll is the Windows NT CRT DLL, part of Windows. Copies outside System32 and SysWOW64 are not Windows' own. How to tell which one you have.
- [mwsoemon.exe](https://www.2-spyware.com/file-mwsoemon-exe.html): mwsoemon.exe is the Outlook Express component of the WebSearch Toolbar (MyWebSearch) adware. It tracks browsing and shows ads. How to find and remove it.
- [mybar.dll](https://www.2-spyware.com/file-mybar-dll.html): mybar.dll is the library of the My Search Bar.B and My Search Bar.C browser plugins. What loads it, how to find it with Process Explorer and how to remove it.
- [nano.exe](https://www.2-spyware.com/file-nano-exe.html): nano.exe is usually the GNU nano text editor that ships with Git for Windows and Cygwin. Where the genuine file lives, how to check it, and how to remove it.
- [nc.exe](https://www.2-spyware.com/file-nc-exe.html): nc.exe is Netcat, a network utility that reads and writes TCP connections. It is not part of Windows. How to check it, when it is a backdoor and how to remove it.
- [netmeter.exe](https://www.2-spyware.com/file-netmeter-exe.html): netmeter.exe may start a parasite such as the NetRatings trojan, but the name can also belong to a program you need. How to check the file and remove it.
- [netscan.exe](https://www.2-spyware.com/file-netscan-exe.html): netscan.exe is the program file of SoftPerfect Network Scanner, a legitimate admin tool that ransomware groups also misuse. How to check it and remove it.
- [newdot2.dll](https://www.2-spyware.com/file-newdot2-dll.html): newdot2.dll is part of an Internet Explorer add-on that promotes .shop and .mp3 style domains and arrives with file-sharing programs. How to remove it.
- [nhelper.dll](https://www.2-spyware.com/file-nhelper-dll.html): nhelper.dll can be a component of browser hijackers such as ShopNav and NavExcel, or a harmless helper of legitimate software. How to check it and remove it.
- [ntdll.dll](https://www.2-spyware.com/file-ntdll-dll.html): ntdll.dll is the NT Layer DLL, a core Windows file in System32 and SysWOW64. Why malware targets it in memory and how to spot a fake copy on disk.
- [ntvdm.exe](https://www.2-spyware.com/file-ntvdm-exe.html): ntvdm.exe is the Windows NT DOS Virtual Machine that runs 16-bit programs on 32-bit Windows. Is it safe, why it uses CPU, and how to fix its crash message.
- [nvdisplay-container.exe](https://www.2-spyware.com/file-nvdisplay-container-exe.html): nvdisplay.container.exe is the NVIDIA Display Container service. Learn what it does, how to tell the real file from a fake one and how to remove the driver software.
- [nvmctray.dll](https://www.2-spyware.com/file-nvmctray-dll.html): nvmctray.dll is an NVIDIA driver library started by the NvTaskbarInit command. Where it lives, how to check it, and how to fix the "problem starting" error.
- [nvwgf2umx.dll](https://www.2-spyware.com/file-nvwgf2umx-dll.html): nvwgf2umx.dll is NVIDIA's 64-bit DirectX 10 and 11 user-mode driver. Where the genuine file sits, who signs it and how to spot a copy that does not belong.
- [oo2core_8_win64.dll](https://www.2-spyware.com/file-oo2core_8_win64-dll.html): oo2core_8_win64.dll is the Oodle compression library from RAD Game Tools that games ship. Cracked downloads lack it. How to tell a genuine copy from a risky one.
- [openal32.dll](https://www.2-spyware.com/file-openal32-dll.html): openal32.dll is the OpenAL audio library from Creative's installer or a game's own folder. How to tell a genuine copy from a planted file with the same name.
- [opencl.dll](https://www.2-spyware.com/file-opencl-dll.html): opencl.dll is the OpenCL Client DLL, shipped by Windows and by graphics drivers. A copy next to a program is something else. How to tell which one you have.
- [opengl32.dll](https://www.2-spyware.com/file-opengl32-dll.html): opengl32.dll is the OpenGL Client DLL, part of Windows. A copy next to a program is a renderer, wrapper or injector. How to tell which one you have.
- [p_981116.exe](https://www.2-spyware.com/file-p_981116-exe.html): p_981116.exe is a self-extracting DirectX 6.0 patch (DXM6Patch_981116) found in C:\Windows. How to check it, why it starts with Windows and how to remove it.
- [pe.exe](https://www.2-spyware.com/file-pe-exe.html): pe.exe is reported as a malicious executable, possibly tied to the rogue anti-spyware Virus Sweeper that shows fake alerts. How to find and remove it.
- [pib.exe](https://www.2-spyware.com/file-pib-exe.html): pib.exe is the main component of an adware program that tracks browsing and shows ads. What it sends out, how to find it and how to remove it from Windows.
- [pic1234.exe](https://www.2-spyware.com/file-pic1234-exe.html): pic1234.exe is installed and used by the worm I-Worm.Newpic. It launches the malware and runs its payload. How to find the file, stop it and remove it.
- [player.exe](https://www.2-spyware.com/file-player-exe.html): player.exe is most often the Veetle TV Player. Its genuine folder, how to check the signature, why the name is generic, and how to uninstall the program.
- [powershell.exe](https://www.2-spyware.com/file-powershell-exe.html): powershell.exe is the genuine Windows PowerShell shell. How to check your copy, why it runs in the background, and the malware that abuses it.
- [prefs.js](https://www.2-spyware.com/file-prefs-js.html): prefs.js is the file where Firefox and Thunderbird save your changed settings. Where it is, what it holds, why a scan flags it and how to fix a hijacked homepage.
- [pw.exe](https://www.2-spyware.com/file-pw-exe.html): pw.exe is the executable of the 2010-2011 rogue antivirus Vista Security 2011 and its clones. How to find it, why it blocks programs, and how to remove it.
- [qttask.exe](https://www.2-spyware.com/file-qttask-exe.html): qttask.exe starts Apple QuickTime Player and related functions. See where it should be, how much memory it uses, and how to uninstall QuickTime for Windows.
- [qtwebengineprocess.exe](https://www.2-spyware.com/file-qtwebengineprocess-exe.html): qtwebengineprocess.exe is a helper that apps such as Origin and Dropbox use to show web content. See where it belongs, why it uses CPU and when to scan.
- [quickset.exe](https://www.2-spyware.com/file-quickset-exe.html): quickset.exe is part of Dell QuickSet, the settings utility pre-installed on Dell laptops. See where it belongs, how to spot a fake and how to remove it.
- [rasphone.pbk](https://www.2-spyware.com/file-rasphone-pbk.html): rasphone.pbk is the Windows phonebook that stores dial-up and VPN connection settings. Where it lives, how to check it, why it comes back after deleting.
- [ravbg64.exe](https://www.2-spyware.com/file-ravbg64-exe.html): ravbg64.exe is a Realtek HD Audio Driver process. What it does, the Skype prompt, high CPU fixes, how to check it is genuine and how to stop it starting.
- [recguard.exe](https://www.2-spyware.com/file-recguard-exe.html): recguard.exe (RecGuard) is a Hewlett-Packard file that protects the Windows XP recovery partition. Genuine folder, why not to end it and how to check it.
- [regkey.dat](https://www.2-spyware.com/file-regkey-dat.html): regkey.dat is a data file the old report tied to the fake antispyware SpyDefender 2010. What is and is not known, how to find it and how to remove it.
- [regtool.exe](https://www.2-spyware.com/file-regtool-exe.html): regtool.exe belongs to RegTool, a fake registry cleaner that reports doubtful errors and asks you to pay. Do not buy it. How to find and remove it.
- [rename-me.exe](https://www.2-spyware.com/file-rename-me-exe.html): rename-me.exe is not a Windows file. Where the name has been documented, how to check the file on your PC, how to remove it, and how to rename an exe file.
- [riched20.dll](https://www.2-spyware.com/file-riched20-dll.html): riched20.dll is the Windows Rich Edit 3.1 text control library. Its folder, how to check it, how it differs from msftedit.dll (RICHEDIT50W), and fixing errors.
- [rlls.dll](https://www.2-spyware.com/file-rlls-dll.html): rlls.dll is not a Windows file. It belongs to the RelevantKnowledge adware. How to find it, why it can slow the PC, and how to remove it step by step.
- [rstrui.exe](https://www.2-spyware.com/file-rstrui-exe.html): rstrui.exe is the Windows System Restore wizard in System32. Check it, open it from Win+R, and fix the rstrui.exe error or Fehler in Anwendung.
- [rthdcpl.exe](https://www.2-spyware.com/file-rthdcpl-exe.html): rthdcpl.exe is the Realtek HD Audio Control Panel. Where the genuine file is, what the name means, whether it is a virus and what happens if you remove it.
- [run.vbs](https://www.2-spyware.com/file-run-vbs.html): run.vbs is a malware script set to start at logon through the Userinit value. Why the error appears and how to restore Userinit and scan the PC.
- [rundll32.exe](https://www.2-spyware.com/file-rundll32-exe.html): rundll32.exe is the Windows host process that loads and runs DLL functions. Where it lives, how to check it, why it shows up several times, and RunDLL errors.
- [runservice.exe](https://www.2-spyware.com/file-runservice-exe.html): runservice.exe is the LicCtrl Service of ViaTech's eLicense licensing. What installs it, whether you need it, how to stop or uninstall it, and how to spot a fake.
- [script.exe](https://www.2-spyware.com/file-script-exe.html): script.exe is a generic file name. The old report tied it to the Bakain virus, but script tools can also produce it. How to check your copy and remove it.
- [searchindexer.exe](https://www.2-spyware.com/file-searchindexer-exe.html): searchindexer.exe is the genuine Windows Search Indexer. How to check yours, why it uses CPU, how to restart it, and when a copy in another folder is malware.
- [sechealthui.exe](https://www.2-spyware.com/file-sechealthui-exe.html): sechealthui.exe is the Windows Security app (package Microsoft.SecHealthUI). Its folder, how to check it, and the PowerShell command that resets the app.
- [secoh-qad.exe](https://www.2-spyware.com/file-secoh-qad-exe.html): secoh-qad.exe is a component of the KMSpico Windows and Office activator, not a Windows file. What it is, the risks, how to find it and remove it.
- [securityhealthsystray.exe](https://www.2-spyware.com/file-securityhealthsystray-exe.html): securityhealthsystray.exe shows the Windows Security icon in the taskbar. It is a genuine Windows file in System32. How to check yours and what is not normal.
- [sentry.exe](https://www.2-spyware.com/file-sentry-exe.html): sentry.exe is linked to the IPInsight adware. It can start pop-up ads, track you and download more malware. How to find the file and remove it.
- [services.exe](https://www.2-spyware.com/file-services-exe.html): services.exe is the genuine Windows Service Control Manager. How to check that yours is in System32 and signed, and which malware has copied its name.
- [settings.ini](https://www.2-spyware.com/file-settings-ini.html): settings.ini is a plain-text settings file made by many programs. How to find which program owns yours, whether it is safe, and what LogUploaderSettings.ini is.
- [setup.dat](https://www.2-spyware.com/file-setup-dat.html): setup.dat is a generic data file name. Many programs use it, and one old report linked it to the Minicom trojan. How to check it and what to do.
- [sex.js](https://www.2-spyware.com/file-sex-js.html): sex.js is a JavaScript file that is harmless by itself but has been used to hide malware, including the Aphex Trojan. How to check it and remove it.
- [sexec.exe](https://www.2-spyware.com/file-sexec-exe.html): sexec.exe is linked to the Executer Trojan, which also drops exec.exe and controller.exe. See how to find the file and remove it with Microsoft Defender.
- [sgtray.exe](https://www.2-spyware.com/file-sgtray-exe.html): sgtray.exe is the system tray process of Veritas backup software such as Backup Exec Desktop Pro. What it does, how to check the folder and how to stop it.
- [shell32.dll](https://www.2-spyware.com/file-shell32-dll.html): shell32.dll is the Windows Shell Common Dll behind File Explorer. Where the genuine file lives, how a planted copy is used, and how to tell yours apart.
- [sihclient.exe](https://www.2-spyware.com/file-sihclient-exe.html): sihclient.exe (SIH Client) is a genuine Windows file that runs Server Initiated Healing for Windows Update. How to check yours and why antivirus flags it.
- [sitool.exe](https://www.2-spyware.com/file-sitool-exe-virus.html): sitool.exe is a malicious file tied to browser adware and bundled installers. How it arrives, how to find it and how to remove it with Microsoft Defender.
- [smss.exe](https://www.2-spyware.com/file-smss-exe.html): smss.exe is the Windows Session Manager Subsystem. See where the genuine file lives, how to check yours, and why a copy in another folder is not Windows.
- [soundmixer.exe](https://www.2-spyware.com/file-soundmixer-exe.html): soundmixer.exe is not a Windows file. Reported as a cryptocurrency miner in AppData\Roaming\Microsoft\SoundMixer. How to find it, remove it and stop the CMD error.
- [spchapi.exe](https://www.2-spyware.com/file-spchapi-exe.html): spchapi.exe is normally the Microsoft Speech API (SAPI 4.0a) installer shipped with older programs. How to check it is genuine and whether you can remove it.
- [spec.exe](https://www.2-spyware.com/file-spec-exe.html): spec.exe is reported as a file installed by Chaim that runs a hidden background process. See how to check it, find what starts it and remove it.
- [spectre.exe](https://www.2-spyware.com/file-spectre-exe.html): spectre.exe was reported as a file installed by trojan HLLC.4194. What is and is not known, how to check where it is, and how to remove it with Microsoft Defender.
- [spider.exe](https://www.2-spyware.com/file-spider-exe.html): spider.exe is the Spider Solitaire game of Windows XP. Where the genuine file sits, how to tell it from a trojan copy, and how to remove a fake one.
- [spoolsv.exe](https://www.2-spyware.com/file-spoolsv-exe.html): spoolsv.exe (Spooler SubSystem App) is the genuine Windows Print Spooler. How to check yours, fix high CPU, and the malware and flaws that abused it.
- [sppextcomobjhook.dll](https://www.2-spyware.com/file-sppextcomobjhook-dll.html): sppextcomobjhook.dll is installed by KMS activator hack tools. It is not part of Windows. What it is, the risks, how to find it and remove it.
- [sppextcomobjpatcher.exe](https://www.2-spyware.com/file-sppextcomobjpatcher-exe.html): sppextcomobjpatcher.exe is part of AutoKMS and KMSpico-style Windows activators, not Microsoft. See how to find it, why it is flagged and how to remove it.
- [spysetup.exe](https://www.2-spyware.com/file-spysetup-exe.html): spysetup.exe is linked to the Spy System 2.3 trojan and to spyware and keyloggers. How to find the file, check it and remove it with Microsoft Defender.
- [sqlite3.dll](https://www.2-spyware.com/file-sqlite3-dll.html): sqlite3.dll is the SQLite database library that many programs ship with. How to check a copy and fix 'sqlite3.dll not found'.
- [srchasst.exe](https://www.2-spyware.com/file-srchasst-exe.html): SrchAsst.exe is the file of the adware Aornum.B, an old Internet Explorer search assistant from iWon. What it does, where it lives and how to remove it.
- [srmclean.exe](https://www.2-spyware.com/file-srmclean-exe.html): srmclean.exe may be part of SoundMAX Remove Clean on Compaq computers. Genuine folder C:\Cpqs\Scom, whether you need it and how to uninstall SoundMAX.
- [steam_api.dll](https://www.2-spyware.com/file-steam_api-dll.html): steam_api.dll is Valve's 32-bit Steam Client API, shipped inside Steam games. Cracks swap it for an emulator. How to tell Valve's copy from a fake one.
- [steam_api64.dll](https://www.2-spyware.com/file-steam_api64-dll.html): steam_api64.dll is Valve's Steam Client API, shipped by every Steamworks game. Cracks replace it with an emulator. How to tell Valve's copy from a fake.
- [steam.exe](https://www.2-spyware.com/file-steam-exe.html): steam.exe starts Steam, Valve's game client. What it does, how to tell the real file from a fake copy, and how to stop it starting or uninstall Steam.
- [steamui.dll](https://www.2-spyware.com/file-steamui-dll.html): steamui.dll is a core file of the Steam client and belongs only in Steam's install folder. How to tell Valve's copy from a planted or fake one.
- [stopdecrypter.exe](https://www.2-spyware.com/file-stopdecrypter-exe.html): stopdecrypter.exe is a free decryptor for STOP ransomware (Djvu, .zatrov, .puma). What it does, what it cannot decrypt, and how to tell a fake.
- [support.exe](https://www.2-spyware.com/file-support-exe.html): support.exe is most often a Dell support program file in Common Files\Dell. Malware can copy the name. How to check it and how to remove the Dell software.
- [sv_chost.exe](https://www.2-spyware.com/file-sv_chost-exe.html): sv_chost.exe imitates the Windows file svchost.exe and is installed by a threat called Wanda. How to tell the two apart, find the fake and remove it.
- [svchost.exe](https://www.2-spyware.com/file-svchost-exe.html): svchost.exe (Service Host) is a genuine Windows process that hosts services. How to check yours, find the service behind high CPU, and malware that copies its name.
- [sxs.exe](https://www.2-spyware.com/file-sxs-exe.html): sxs.exe was reported as a file installed by the Pasobir parasite. How to check where your copy is, how to remove it and why the name can also look harmless.
- [syshost.exe](https://www.2-spyware.com/file-syshost-exe.html): syshost.exe is a file name used by worms such as Francette and Hugesot, and one of the files the Sober worm copies itself to. How to check and remove it.
- [system32.exe](https://www.2-spyware.com/file-system32-exe.html): There is no system32.exe in Windows: System32 is a folder. A file with this name is likely a trojan. How to find it, how it arrives and how to remove it.
- [tmp.exe](https://www.2-spyware.com/file-tmp-exe.html): tmp.exe in an AppData folder or a Run key is malware. What it did in 2010, how to find it, remove it, and why a .tmp file is not always harmless.
- [tmpfile1.exe](https://www.2-spyware.com/file-tmpfile1-exe.html): tmpFile1.exe is a file the old report tied to the fake antivirus AntiSpyGuard. What it does, how to check your copy and how to remove it.
- [tunnel.exe](https://www.2-spyware.com/file-tunnel-exe.html): tunnel.exe is linked to a trojan called Tunnel Trojan, but the name is also used by legitimate programs. How to tell which one you have and how to remove it.
- [ucrtbase.dll](https://www.2-spyware.com/file-ucrtbase-dll.html): ucrtbase.dll is the Universal C Runtime, part of Windows. Where the genuine copies live, how to check the signature and hash, and when a copy is suspect.
- [ucrtbased.dll](https://www.2-spyware.com/file-ucrtbased-dll.html): ucrtbased.dll is the debug Universal C Runtime from Microsoft's Windows SDK and is not redistributable. Where the genuine file lives and how to spot one that is not.
- [unarc.dll](https://www.2-spyware.com/file-unarc-dll.html): unarc.dll is FreeArc's unpacking library that game installers carry. It is common in repacked and cracked downloads. How to tell a normal copy from a risky one.
- [unins000.dat](https://www.2-spyware.com/file-unins000-dat.html): unins000.dat is the uninstall data file that Inno Setup installers create next to unins000.exe. Whether it is safe, why it is missing, and how to remove a program.
- [unins000.exe](https://www.2-spyware.com/file-unins000-exe.html): unins000.exe is the uninstaller that Inno Setup installers place with a program. What it does, why UAC shows an unknown publisher, and when to remove it.
- [uninst.exe](https://www.2-spyware.com/file-uninst-exe.html): uninst.exe is the uninstaller that programs such as SoundTap and Nero install. How to find which program owns it, when it is a risk, and how to remove it.
- [uninstall.exe](https://www.2-spyware.com/file-uninstall-exe.html): uninstall.exe is the uninstaller many programs place in their folder. How to check it is real, when to keep it, and how to remove the program instead of the file.
- [unityplayer.dll](https://www.2-spyware.com/file-unityplayer-dll.html): UnityPlayer.dll is the Unity engine that every Unity game ships in its folder. Attackers have planted fake copies next to signed Unity .exe files. How to tell.
- [update.exe](https://www.2-spyware.com/file-update-exe.html): update.exe is not a Windows file. It is the updater of a desktop program, and malware can copy the name. How to find which program owns it and check it.
- [updater.exe](https://www.2-spyware.com/file-updater-exe.html): updater.exe is a name used by adware, hijackers and trojans, and by genuine updaters. How to tell which one you have, and how to remove the malicious copy.
- [ups.exe](https://www.2-spyware.com/file-ups-exe.html): ups.exe is the Uninterruptible Power Supply service file in System32 on Windows XP. How to tell it from a fake, whether to remove it, and what the errors mean.
- [user32.dll](https://www.2-spyware.com/file-user32-dll.html): user32.dll is the Multi-User Windows USER API Client DLL, part of every Windows. How to tell the genuine file from a copy that only uses its name.
- [utcsvc.exe](https://www.2-spyware.com/file-utcsvc-exe.html): utcsvc.exe is tied to the Diagnostic Tracking Service (DiagTrack) and to TouchUtility. What the old report said, how to check the file, and what to do.
- [utorrentie.exe](https://www.2-spyware.com/file-utorrentie-exe.html): utorrentie.exe is a file of the WebHelper adware that arrives with uTorrent. How to find it, why it shows ads and how to remove it with Windows tools.
- [v.exe](https://www.2-spyware.com/file-v-exe.html): v.exe is not a Windows file. It is a generic name: the old report tied it to the AimVen worm, but Smalltalk/V also used it. How to check and remove it.
- [vcruntime140_1.dll](https://www.2-spyware.com/file-vcruntime140_1-dll.html): vcruntime140_1.dll is a 64-bit Visual C++ runtime file from Microsoft. In 2026 a fake copy with this name loaded Havoc malware. How to tell which one you have.
- [vcruntime140.dll](https://www.2-spyware.com/file-vcruntime140-dll.html): vcruntime140.dll is Microsoft's Visual C++ runtime, and spy groups and RATs have side-loaded fakes with its name. Where the real file lives and how to check it.
- [vd952342.bd](https://www.2-spyware.com/file-vd952342-bd.html): vd952342.bd is listed as a component of the Virus Doctor rogue antivirus. What the .bd file is, how to find it and how to remove it with Windows tools.
- [version.dll](https://www.2-spyware.com/file-version-dll.html): version.dll is a Windows library for reading file versions. A copy next to a program's .exe is a mod loader or malware. How to tell which one you have.
- [video-ui.exe](https://www.2-spyware.com/file-video-ui-exe.html): video-ui.exe is the process of the Microsoft Movies & TV (Zune Video) app. Where the genuine file lives, how to check it, and how to remove the app.
- [vulkan-1.dll](https://www.2-spyware.com/file-vulkan-1-dll.html): vulkan-1.dll is the Vulkan Loader from your graphics driver, Windows 11 and Microsoft Edge. Where genuine copies live and how to check one you found.
- [vulkaninfo.exe](https://www.2-spyware.com/file-vulkaninfo-exe.html): vulkaninfo.exe is a Vulkan graphics API tool installed with NVIDIA, Intel and AMD drivers or the Vulkan SDK. How to check it and when to remove it.
- [vulkaninfo32.exe](https://www.2-spyware.com/file-vulkaninfo32-exe.html): vulkaninfo32.exe is the 32-bit Vulkan Info tool that lists your GPU's Vulkan features. Where it lives, how to check it and whether you can remove it.
- [vuser32.dll](https://www.2-spyware.com/file-vuser32-dll.html): vuser32.dll is not user32.dll. It comes with unofficial ports of Vista programs to Windows XP and has no publisher. How to tell a port's copy from a stray one.
- [weather.exe](https://www.2-spyware.com/file-weather-exe.html): weather.exe is the program file of WeatherBug and of several free weather apps. How to check which one you have, when it is unwanted, and how to remove it.
- [webcompanion.exe](https://www.2-spyware.com/file-webcompanion-exe.html): webcompanion.exe runs Web Companion by Lavasoft, a potentially unwanted program. What it does, which errors it shows and how to uninstall it.
- [wextract.exe](https://www.2-spyware.com/file-wextract-exe.html): wextract.exe is the Windows extractor inside IExpress self-extracting installers. Genuine folders, why it runs, what the .mui name means and when to worry.
- [wilcomemul.dll](https://www.2-spyware.com/file-wilcomemul-dll.html): WilcomEmul.dll fakes the Wilcom dongle in cracked EmbroideryStudio e4.2. Why error 59 fixes are risky, how to check your PC and how to get a real licence.
- [windll32.exe](https://www.2-spyware.com/file-windll32-exe.html): windll32.exe is reported as a file of the W32.HLLW.Respan worm and other keyloggers or backdoors. How to find it, check it and remove it with Windows tools.
- [windowsservice.exe](https://www.2-spyware.com/file-windowsservice-exe.html): WindowsService.exe is a crypto-miner loader started by the Windows Service Task. How to find it, delete its tasks and the Updates folder, and repair Defender.
- [winhelper.exe](https://www.2-spyware.com/file-winhelper-exe.html): winhelper.exe is not a Windows file. The old report tied it to the keylogger Backdoor.IRC.Fusion.20. How to find it, check it and remove it.
- [winhttp.dll](https://www.2-spyware.com/file-winhttp-dll.html): winhttp.dll is Windows HTTP Services, part of Windows. A copy next to a game or program is a mod loader or a side-loaded DLL. How to tell which.
- [winlog.exe](https://www.2-spyware.com/file-winlog-exe.html): winlog.exe is a miner trojan reported in 2019 that uses your CPU to mine Electroneum. How to find it, how to remove it, and how it differs from winlogon.exe.
- [winlogon.exe](https://www.2-spyware.com/file-winlogon-exe.html): winlogon.exe is the genuine Windows sign-in process. How to check that yours is in System32, why it cannot be ended, and malware that abused Winlogon.
- [winmm.dll](https://www.2-spyware.com/file-winmm-dll.html): winmm.dll is the Windows Multimedia library. The copies in System32 and SysWOW64 are safe; any other copy is a loader, a crack or malware. How to check yours.
- [winnet.exe](https://www.2-spyware.com/file-winnet-exe.html): winnet.exe belongs to the CommonName Toolbar browser add-on, which shows ads and changes search. What it is, how to find it and how to remove it.
- [winrmsrv.exe](https://www.2-spyware.com/file-winrmsrv-exe.html): winrmsrv.exe is not a documented Windows file. It was reported as a coin miner asking the firewall for access. How to check it and remove it.
- [winserv.exe](https://www.2-spyware.com/file-winserv-exe.html): winserv.exe is most often the WindowsHub file of the AudioHD.exe XMRig miner. How to tell it from the harmless Winserv tool, check it and remove it.
- [winsrv.exe](https://www.2-spyware.com/file-winsrv-exe.html): winsrv.exe is not a Windows file. It is reported as an SdBot IRC backdoor. How to tell it from winsrv.dll, find it and remove it.
- [winsys.exe](https://www.2-spyware.com/file-winsys-exe.html): winsys.exe is tied to MSI overclocking software, but the name is also used by backdoor trojans that log keystrokes. How to check the file and remove it.
- [wintool.exe](https://www.2-spyware.com/file-wintool-exe.html): wintool.exe is not a Windows file. Where it is usually found, why it is treated as suspicious, how to check it and how to remove it with Microsoft Defender.
- [worm.exe](https://www.2-spyware.com/file-worm-exe.html): worm.exe is a generic file name, reported with Dharma ransomware and several old worms. How to find it, what the .dharma files mean, and how to remove it.
- [ws2_32.dll](https://www.2-spyware.com/file-ws2_32-dll.html): ws2_32.dll is the genuine Windows Sockets 2 (Winsock) library. How to check your copy, fix the missing-file error, and when a copy is not genuine.
- [wscntfy.exe](https://www.2-spyware.com/file-wscntfy-exe.html): wscntfy.exe is the Windows XP SP2 Security Center tray notifier. Genuine folder, how to spot a fake, whether you can disable it, and virus removal.
- [wscript.exe](https://www.2-spyware.com/file-wscript-exe.html): wscript.exe is the genuine Windows Script Host that runs .vbs and .js files. How to check yours, why scripts malware uses it, and what to do about a fake copy.
- [wsem.dll](https://www.2-spyware.com/file-wsem-dll.html): wsem.dll is reported as a malicious library installed and used by the DyFuCa dialer. How to find which process loads it, and how to remove it safely.
- [wtsapi32.dll](https://www.2-spyware.com/file-wtsapi32-dll.html): wtsapi32.dll is a genuine Windows Remote Desktop Services library. How to check your copy, and how the Youndoo hijacker misused the name in 2021.
- [wtusystemsupport.exe](https://www.2-spyware.com/file-wtusystemsupport-exe.html): wtusystemsupport.exe belongs to AVG Web TuneUp. Where the genuine file lives, how to check it, and how to stop it and uninstall the program.
- [wucrtupd.exe](https://www.2-spyware.com/file-wucrtupd-exe.html): wucrtupd.exe is the Critical Update Notification utility of Windows 98 and ME. What it did, where it lived and why a copy on a modern PC needs a check.
- [wupdater.exe](https://www.2-spyware.com/file-wupdater-exe.html): wupdater.exe is linked to KeenValue.Updater, the updater of eUniverse adware (KeenValue, IncrediFind, PerfectNav) bundled with Kazaa 2.6. How to check and remove it.
- [wxmon.exe](https://www.2-spyware.com/file-wxmon-exe.html): wxmon.exe is reported as a Scarab-Please ransomware carrier seen in 2018. How to find it, remove it safely and what to do about .please files.
- [x3daudio1_7.dll](https://www.2-spyware.com/file-x3daudio1_7-dll.html): x3daudio1_7.dll is Microsoft's X3DAudio 1.7 library from the DirectX June 2010 runtime. Where the genuine file lives and how to tell a planted copy.
- [xgameruntime.dll](https://www.2-spyware.com/file-xgameruntime-dll.html): xgameruntime.dll is the Gaming Runtime that Gaming Services installs. Why "Failed to load xgameruntime.dll" appears and why a downloaded copy is a risk.
- [xinput1_3.dll](https://www.2-spyware.com/file-xinput1_3-dll.html): xinput1_3.dll is Microsoft's XInput 1.3 controller library. Cracks, trainers and mod loaders replace it in game folders. How to tell which copy you have.
- [xlive.dll](https://www.2-spyware.com/file-xlive-dll.html): xlive.dll is Microsoft's Games for Windows - LIVE library in SysWOW64. Cracked games drop their own copy in the game folder. How to tell which you have.
- [xlog.exe](https://www.2-spyware.com/file-xlog-exe.html): xlog.exe usually belongs to Diva or Eicon Maintenance Tools. If you installed neither, it may be a keylogger. How to tell, check it and remove the program.
- [xxx-avi.exe](https://www.2-spyware.com/file-xxx-avi-exe.html): xxx.avi.exe is an executable posing as a video. Can avi files carry viruses, why a double extension is a warning sign, and how to find and remove it.
- [xyz.exe](https://www.2-spyware.com/file-xyz-exe.html): xyz.exe is a generic file name the old report tied to the Gromozon trojan. What is and is not known, how to find your copy and how to remove it.

## Tools and live data

- [Check a link](https://www.2-spyware.com/check): test an address against live malware and phishing lists
- [Exploited vulnerabilities](https://www.2-spyware.com/exploited): vulnerabilities attacked in the wild, explained for home users
- [Data breaches](https://www.2-spyware.com/breaches): known breaches and what to do if your data was in one
- [Browser versions](https://www.2-spyware.com/browsers): the current version of each browser and whether yours is up to date
- [Scam emails](https://www.2-spyware.com/scam-emails): current scam and phishing e-mails with examples
- [Step-by-step how-tos](https://www.2-spyware.com/how-to): resetting browsers, removing extensions, offline scans and more

## About

- [About us](https://www.2-spyware.com/about-us)
- [Contact](https://www.2-spyware.com/contact-us)
- [Affiliate disclosure](https://www.2-spyware.com/disclosure)
- [Privacy policy](https://www.2-spyware.com/privacy-policy)

## Optional

- [All removal guides](https://www.2-spyware.com/c/viruses): the full list of threat guides, newest first
- [Sitemap](https://www.2-spyware.com/sitemap.xml): every indexable page