Corel Standby Service scans your hard disk continuosly. Why?

By ldsandon, 7 February, 2010

I started to inspect what the hell Corel Standby Service is used for and why. It is started in the registry Run section at startup.

Iit scans your hard disk - yes, exactly - and then build a list of dlls in a file called StandbyList.dat in the PSP X3 folder. The filename is recorded in the HKEY_LOCAL_MACHINE\SOFTWARE\Corel\Standby\1.0\ImageLists\PaintShop Photo Pro registry key. It keeps on scanning the same files over and over. Sometimes it loads a DLL, probably to read resources.

The executable supports the -START, -RESTART, -STOP, -SCAN and -SCANWOM command line switches. The meaning of the first three is obvious (and the -STOP command may be used to stop it running), while I have still to discover what the last two do, and what's the difference between them. It attempts to run in a low priority mode, but process priority is not lowered, thereby it does not run only when the computer is idle.

Update: I identified a piece of code that first loads dlls into the current process, then calls ReadProcessMemory() to scan its memory. That code contains references to strings like "Standby::CImageFileList::ScanImageMemory". Does it try to build a list of dlls containing image data? And if so, why? Unluckily I am now in a piece of code where function calls are dynamic thereby it's difficult to tell what it does exactly without running it into a debugger.

I asked Corel support what the hell this programs does, but the answer was "Sorry we don't answer technical questions about the application working". Nothing more. I believe it is my right to know what an application activated at startup and scanning my hard disk does.

To be continued...