Mystery Filenames that Make No Sense

Have you ever notice a filename that is so bizarre you think it must be some kind of malware? Microsoft Windows has supported long filenames for years but most folks still haven’t caught on. Microsoft is especially guilty of using short useless filenames like lsass.exe, mdm.exe and the most infamous ctfmon.exe.

One of the features of WinPatrol PLUS is the ability to click on a filename and receive a human readable explanation. We try our best to let you know what a file does, if it’s safe and why you might need it. I keep track of all the requests to make sure I’ll can catch any new mystery files, good or bad.

I’ve taken a snapshot of all our PLUS Info from last month and thought I’d share some of the top requests with all my readers.

The number one mystery file that people want to know about continues to be “CTFMON.exe”. Here’s a little of what you’ll read in our PLUS databae.

CTFMON.exe
Ctfmon.exe activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office Language Bar. It monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies. Initially it only installed with Microsoft Office 2002 and XP. Now it may be used by a number of Microsoft programs that supports alternative user input. When you run such a program, the file Ctfmon.exe runs in the background. It remains in memory even after you quit the program. More detail on what the program does can be found at http://support.microsoft.com/default.aspx?scid=kb;EN-US;q282599 and at http://support.microsoft.com/?kbid=823586.

While Microsoft typically holds the number one spot they aren’t the only one with startup programs with mystery filename.

Adobe Acrobat Speed Launch – READER_SL.EXE
Reader_sl.exe installs with Adobe Acrobat reader 7 or later as its "speed launch" utility. This file runs on system setup and pre-loads the acrobat reader so that it will launch more quickly when needed.

There are multiple versions of the speed launch feature available. Typically they install with different versions of Acrobat but they all do the same thing. You shouldn't need more than one of these files running on system startup in order to get the benefit of the faster launch: reader_sl.exe, sc_acrobat.exe, _sc_acrobat.exe, sc_reader.exe, and acrobat_sl.exe. You'll find more information on Speed Launch for Adobe Acrobat, Adobe Reader, and Acrobat 3D at http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=331131.

Sun's Java BHO – SSV.DLL
Ssv.dll is a browser helper object that installs with the Sun Java Runtime Environment and Java 2 Platform Standard Edition 5.0 Update 6 or later. It will appear in your c:\Program Files\Java\jre_1.5.0 folder (name varies with version number). SSV stands for Secure Static Version. It is a feature that allows an HTML file to specify which JRE family to run.

For more information about this feature, please see the documents Deploying Java Applets With Family JRE Versions in Java Plug-in for Internet Explorer: http://java.sun.com/javase/6/webnotes/family-clsid.html and the alert Java Plug-in and Java Web Start May Allow Applets and Applications to Run With Unpatched JRE: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1.

Other popular file searches this past month include many programs which aren’t necessary. Programs that run in the background just to see if you need an updated version are far too popular. As you can see, the filenames rarely give you a clue what these files do.

OSA.EXE, OSA9.EXE - Office Startup Assistant
MDNSRESPONDER.EXE - part of Apple Bonjour
JUSCHED.EXE - Sun's Java Plug-in Updater
NVSTARTUP, NVCPL.DLL - NVidia Graphics system tray applet
MSASCUI.EXE - Obviously is Windows Defender
QTTASK.EXE - Apple Quicktime Player always come back unless disabled with WinPatrol.
SMSS.EXE - Session Manager Subsystem of course

Google, Adobe and Apple are actually the ones using long filenames most often even though we don’t normally need their programs running in the background.

GOOGLETOOLBARNOTIFIER.exe
GOOGLEUPDATERSERVICE.exe - Not required programs but at least you get a clue to what they do.

ADOBEUPDATER.exe – Given how many vulnerabilities Adobe has been running into lately it might be worth running this one.

APPLEMOBILEDEVICESERVICE.exe - Apple iTunes Mobile Connection doesn’t need to be running all the time and will be installed with iTunes even if you have a regular iPod that doesn’t use mobile services of the iPhone or iTouch.

Let's Talk About Startup Applets and Services

The only thing I hate more than programs that auto-update without permission are programs that automatically start without getting your ok. One of our new friends, Larry Osterman wrote a multiple part series describing his thoughts on the topic. As a Windows programmer for Microsoft Larry has some real insight on how and why startup applets and many services exist.

If you’re interested, especially if you’re a programmer, the links to each topic are below. You’ll also want to read the comments and replies to comments on each topic.

1) It's my computer, dagnabbit, not yours!

“Applets come in lots of sizes and shapes - they can be services waiting on an app to use them; they can be processes that handle systray icons; they can be helper applications. But they share one common: they all consume resources, sometimes LOTs of resources. And I would rather that these applets NOT consume resources.”

2) Why do people write applets?

“Generally, applets seem to fall into several rough categories:
Updaters
Notification Area Handlers
Helper applications
Services

3) So why are applets so bad, anyway?

“Updaters often to run all the time, even though they're only actually doing work once a day (or once a month). That means that they consume resources all the time that they're active.”

4) Applet Mitigations

“Think about how to reduce the applets impact on the user. Reduce the DLL load in your applet whenever possible - each DLL you load consumes a minimum of 4 private pages (16K on x86) and takes between 500K and 1M cycles to load.”

5) Applet Mitigations – Updaters

“…use the task scheduler functionality built into Windows to schedule your updater. The task scheduler is a remarkably flexible mechanism for scheduling periodic operations. “

6) Applet Mitigations – Notification Area Handlers

“…some notification area handlers are quite well thought out and provide easy access to useful information or commonly accessed functionality (the volume, clock, taskmgr, "safely remove hardware" and RSS Bandit are ones come to mind). Some have questionable value (the network and outlook handlers come to mind), some just don't seem to make sense at all (Quicktime and handlers like the various display driver and printer control panel notification area handlers)”

7) Applet Mitigations - Services

"...seriously consider how much time you spend in your service's start routine. The less time the better (especially if you're an auto-start service). The less work you can do before reporting that your service has started to the service controller, the faster the system will boot. "

WinPatrol 2007 Build 3

As the one who reads all the Email from folks who use WinPatrol, I see a wide variety of notes. Most of the Emails are some kind of thank you and stories of positive results. Many are suggestions or bug reports with complete details and screen shots. Occasionally, I get the really helpful single line message like “Something is wrong”.

Thanks to the folks who spent the time to let me know what they were experiencing I’ve been able to fix a couple bugs and even added a new feature. We’ve had a number of reports that programs weren’t starting and I think we’ve nailed that one down. The only more common report was why Scotty isn’t barking in Vista. I’m sorry to say that one still hasn’t been addressed even after spending 45 minutes on the phone with Microsoft Vista support. My experience with Microsoft support may become a completely separate Blog entry.

So for now here’s what’s new.

Added new "Open As..." option to Delay Startup program options

Fixed bug moving Startup Folder programs to Delayed Start.
Programs will now start as expected.

NEW Setup/Uninstall program. Much smaller and prevents multiple Add/Remove entries. * See Update below

Fixed bug when using "Confirm Exit..." option.

Fixed bug adding Programs/Services to “Detected” registry when file no longer exists.



The most dangerous change for me is probably the new Setup program. I’ve gone with a completely new setup package vendor and setup programs are notorious for being flakey. Seems like there’s always some machine that doesn’t want to be compatible which is why in the past we always had an alternate setup program available.

* Update: Unfortunately, too many problems have been reported with the newer smaller setup program so we've reverted back to the previous setup package. Anyone who successfully was able to use the new install won't be affected.