When I press Ctrl+Alt+Delete in Windows Me, I get a list of memory
modules with three options: "End Task" ,"Shut Down" or "Cancel". Can
you tell me what use the following programs have so that I can choose
whether I should remove them from memory: "Win32_a", "Mpbtn"
"Wmencagt", "Ipclient", "Devldr16", "Motivesb", "Lvcoms", "Ipmon32"
and "Rb32".

Hi maya,

I've provided information on all the programs you listed.  I've
indicated where I found the information, what the program is, and what
to do about it.
 
Basically everything should be removed except "Devldr16"  - but it's a
user's choice... depends whether a user deems it necessary.  You'll
read more about it when you see my list.

I'd like to suggest you get 2 free programs to dump your spyware and
run them both weekly.  Before you run them check for updates.  You're
collecting spyware on your computer - everyone does - and you'll need
to get rid of it.  The information is at the end of my posting.

===============================================================================

For future reference on Startup Programs Full List:
http://www.geocities.com/greyknight17/startup_list.htm

Key: 

"Y" - Normally leave to run at start-up

"N" - Not required - typically infrequently used tasks that can be
started manually if necessary

"U" - User's choice - depends whether a user deems it necessary

"X" - Definitely not required - typically viruses, spyware, adware and
"resource hogs"


And, another resource for you called Security Risks Listed in the
WinTasks Process Library:
http://www.liutilities.com/products/wintaskspro/processlibrary/

===============================================================================

OK... here's the information you requested!


Win32_a - (Spyware - remove)
http://www.doxdesk.com/parasite/RapidBlaster.html

"RapidBlaster/Rnd is an update which uses pseudo-random filenames
which it fetches from its controlling server www.rapidblaster.com. If
it fails to contact its server it will just use
'RapidBlaster\rb32.exe' as with older variants. If you remove it, it
will reinstall itself using a new name. Filenames seen so far include:
 (very long list)

win32_A\win32_a.exe"

===============================================================================


Mpbtn - "N"  Not required - typically infrequently used tasks that can
be started manually if necessary
http://www.geocities.com/greyknight17/startup_list_a.htm#M

"N  Motive SmartBridge mpbtn.exe   System tray icon for the Virtual
Assistant from AT&T Broadband, used to communicate internet problems
via the network rather than telephone. Available via desktop shortcut
or Start -> Programs - not required"

===============================================================================


Wmencagt - "N" - Not required - typically infrequently used tasks that
can be started manually if necessary
http://www.geocities.com/greyknight17/startup_list.htm

"MS Windows Media Encoder, which already has a shortcut in the Start
Menu if installed"

===============================================================================


IPclient - "X" - Definitely not required - typically viruses, spyware,
adware and "resource hogs"
http://www.geocities.com/greyknight17/startup_list.htm#I

"X  IPInSightLAN 01 ipclient.exe -  Installed with Verizon DSL
accounts. IP Insight is a Quality of Service monitor and diagnostic
tool that isn't required - This one constantly "phones home" and
wastes resource - hence the "X" status
Verizon Online DSL FAQ» 6. Software" 

Q: Is IP insight really needed? (#1247)
http://www.dslreports.com/faq/1247
  
A: No it's not necessary at all. It's a diagnostic tool that Verizon
techs can use to troubleshoot connection problems on your line. IP
Insight is a Quality of Service and /or diagnostic package - but it's
not used by VOL at this time - there's no back-end companion for tech
support or NOC to use to access it... It does send "phone home" data
used to check latency and network traffic occasionally, but like any
other features that it contains are unused or not implemented."

===============================================================================


Devldr16 - "U" - User's choice - depends whether a user deems it necessary
http://www.geocities.com/greyknight17/startup_list.htm#D

"U   devldr16 devldr16.exe   Associated with some Creative Labs sound
cards.  Provides audio support for DOS applications.  Not needed if
you don't have those.  Required if you use "Sound Play Control" and
"Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start ->
Settings -> Control Panel -> System -> Device Manager then disable
"Creative SB16 Emulation" under Creative Miscellaneous Devices"

===============================================================================


Motivesb - (Spyware remove)
http://www.annoyances.org/exec/forum/win98/t1071688321

" Question: I am running an HP e-Vectra under Win 98 and recently
upgraded Word 97 to Word 2000 using the Office 200 suite. Since
upgrading to Office 2000 and updates, I began receiving dual error
messages. The first is "motivesb has performed an illegal operation
and will be shut down," followed by an invitation to start the script
debugging routine. I got rid of the second message by disabling the
option to debug java scripts on the IE 6 option page, but I'm still
getting the "motivesb" message.

Answer: Your error is part of Spyware/Adware/Malware. Uninstall
whichever of those junk applications are loaded. This site..."

===============================================================================


Lvcoms  "N" - Not required - typically infrequently used tasks that
can be started manually if necessary
http://www.geocities.com/greyknight17/startup_list.htm#D

N   LVComs lvcoms.exe Lvcomm server.  Related to Logitech Quick Cam -
works fine without it

===============================================================================


IPmon32   "N" - Not required - typically infrequently used tasks that
can be started manually
if necessary
http://www.geocities.com/greyknight17/startup_list.htm#D

"N  IPInSightMonitor 01 ipmon32.exe Installed with Verizon DSL
accounts. IP Insight is a Quality of Service monitor and diagnostic
tool that isn't required - see here for more information"

Verizon Online DSL FAQ» 6. Software 
http://www.dslreports.com/faq/1247
 
"Q: Is IP insight really needed? (#1247)  

A: No it's not necessary at all. It's a diagnostic tool that Verizon
techs can use to troubleshoot connection problems on your line. IP
Insight is a Quality of Service and /or diagnostic package - but it's
not used by VOL at this time - there's no back-end companion for tech
support or NOC to use to access it... It does send "phone home" data
used to check latency and network traffic occasionally, but like any
other features that it contains are unused or not implemented."

===============================================================================


Rb32 - Spyware (remove) 
http://www.liutilities.com/products/wintaskspro/processlibrary/rb32/

"rb32 - rb32.exe - Process Information
Process File: rb32 or rb32.exe
Process Name: Rrb32
Description: Variant of the RapidBlaster parasite which runs as a task
at Windows startup. It downloads advertising from the Internet and
displays it periodically.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes"

===============================================================================


Dumping Spyware 101   :)   Spybot, Adaware, and Spywareblaster

Please get Spybot S&D to clear out most of the spyware. Short tutorial
and download link http://tomcoyote.org/SPYBOT/index1.html

After installing, first press Online, and search for, put a check mark
at, and install all updates.
Next, close all Internet Explorer windows, hit 'Check for Problems',
and have SpyBot fix everything it labels in red.Reboot


Download Ad-Aware at http://lavasoft.element5.com/support/download/ 

After installing AAW, and before running the program, update by using
the Globe icon. Shut down and restart Ad-Aware. Now press "Scan Now",
"Select drives\folders to scan" and select the active partition
(usually C: ), then 'next', and let Ad-Aware scan your drives. It will
find a number of "bad" files and registry keys. Click 'Next' again.
Rightclick in that pane and choose "select all" and click 'next'. It
will ask you whether you'd like to remove all checked items. Click OK.
 Finally, close Ad-Aware, and reboot.


I also like another free program called Spywareblaster 
http://www.webattack.com/get/spywareblaster.html

"SpywareBlaster doesn`t scan and clean for so-called spyware, but
prevents it from being installed in the first place. It achieves this
by disabling the CLSIDs of popular spyware ActiveX controls, and also
prevents the installation of any of them via a webpage. This allows
you to run Internet Explorer with Active-X enabled, but it will never
download or even prompt you for any of the known ActiveX controls. All
other Active-X controls or plug-ins will work fine. The..."

===============================================================================

Google search:

Startup Programs Full List
Spyware
Adware
WinTasks Process Library
annoyances.org


Best regards,
tlspiegel

---

Request for Answer Clarification by maya2003-ga on 02 Jan 2004 20:16 PST

Thanks for your answer. I have tried the lavasoft software and was
also able to deactivate unnecessary processes through msconfig startup
list but another problem I still have is the following: After pressing
ctrl+alt+del and removing rb32,deleting the directory of that program
and rebooting, I got two new tasks in my task list labelled "Mad" and
"Msgsrv32 (not responding)". When I remove "Msgsrv32 (not responding)"
"Mad" also disappears giving me the suspicion that these two programs
work together. But when I reboot my system they seem to come back
again. I can't seem to localize these two processes in msconfig's
startup list or find a directory for them. I have norton Antivirus
2001 with up to date virus definitions which I download every week,
but it does not seem to find any virus on my system after scanning.
What can I do to get rid of these two suspicious ("Mad" and Msgsrv32) processes.

---

Clarification of Answer by tlspiegel-ga on 02 Jan 2004 21:19 PST

Hi maya2003,
 
I received your request for clarification and will try to further help
you.  By going to the link provided in my answer, I have located what
those 2 processes are.  The information say Y (Yes) to leave them
running.
 
From the link provided at:
http://www.geocities.com/greyknight17/startup_list_a.htm#M

Y  -  MAD.EXE       MAD.EXE              MAD.exe is the MS Exchange
5.5 System Attendant and can also consume a large amount of resources
- resolved by the latest Exchange 5.5 Service Pack. Also part of
Exchange 2000 Server but does it have the same problems?. Apparently
you need to leave this running but is it needed at start-up?


Y  -  MSGSRV32.exe  msgsrv32.exe         Windows 32-bit VxD Message
Server. For more information on its function and why it's needed, see
here:

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q138/7/08.asp&NoWebContent=1

Microsoft - Function of the Windows 32-Bit Message Server

This article was previously published under Q138708 
SUMMARY  This article describes the purpose of the Windows 32-bit
message server (Msgsrv32.exe).

Msgsrv32.exe is a program that runs invisibly on the Windows desktop
and performs several background functions necessary for Windows
operation. These functions include:

Mediate Plug and Play messages among various parts of the operating system. 
Coordinate automatic responses to Setup programs. This includes
checking whether a Setup program has improperly overwritten Windows
files, and optionally restoring the Windows versions of those files.
Display the initial logon dialog box if networking is enabled. 
Play the system startup and shutdown sounds. 
Load installable Windows drivers at startup and unload them at shutdown. 
Run the shell program (usually Explorer.exe) and re-run the shell if
it fails to respond.

===============================================================================

I'd also recommend you install SpyBot and run that after or before you
run AdAware from Lavasoft.  Reason being - one program might 'catch'
something the other didn't.  Running both is recommended by the
experts for dumping spyware.

I hope this has helped.

Best regards,
tlspiegel

No comment.