|Windows Help > Windows Processes > alg.exe|
alg.exe - Application Layer GatewayThe alg.exe process is a legitimate Windows component that's enabled by default on most pre-installed XP systems. "ALG" stands for Application Layer Gateway, and it is a required component of the Windows Firewall. This service is used by the Windows Firewall (ICF) and Internet Connection Sharing (ICS) to connect to the Internet.
Never attempt to end this process via Task Manager, since the result may be a total loss of network connectivity until the machine is rebooted. Reported behaviors vary. Some users have reported disabling alg.exe in order to resolve Internet Explorer crashes, but this may be due to incompatible versions of the two applications. If you are not using the Windows (built in) Firewall, you can successfully disable this service altogether without losing any functionality.
This said, you should only find a copy of alg.exe in the c:\windows\system32 folder on XP systems. On older OS variants like Windows 2000 or NT it will appear in c:\winnt\system32. Any other copies found on your system are likely spyware or other forms of malware that are attempting to remain hidden by using legitimate OS file names. A running alg.exe process on an XP SP2 box appears to use approximately 688kb of memory, though this may vary if the process is in active use. Copies running on other variants of the OS may use more or less RAM.
Alg.exe has also been used by certain pieces of malware in the past. The BraveSentry parasite, for instance, attempted to hide its processes using the alg.exe process. PC Magazine recommends that "If you are using neither ICF nor ICS and are warned that ALG.exe is trying to access the Net, deny it. A Trojan horse or worm may be trying to use it as a backdoor."
As always, if you're suspicious about a particular process you should immediately obtain and run a current spyware/virus detection package. Never attempt to delete files manually, since this could result in an unstable system if a particular file is legitimate and actively used by Windows.