What is it?
ATI External Event Utility EXE Module AKA ATI Hotkey Poller - ati2evxx.exe
What does it do?
ati2evxx.exe - This process provides optional features that the majority of us really couldn't care less about. The XT's overdrive feature uses this. If you have an XT you'll probably want to leave this on.
This is installed as a service so you'll need to do the following to disable:
Start --> Run --> services.msc
Find ATI Hotkey Poller and double click it.
Change the startup type to disabled
According to ATI this process is supposed to have 2 instances running. ( link )
The best explanation I've managed to find for this is: (Source)
We have to have the 2 instances to support multisession (fast user switch) support. A system service does not have access to change per user settings on a any session other than the default session. In fast user switch, multiple sessions get created. To be able to change the settings on non-default session we need to create a per user instance of the external event.
Many users have reported this process to slow their boot time down.
The original ati2evxx.exe from ATI gets placed at C:WINDOWSSystem32ati2evxx.exe . If you find it anywhere else then you should be suspicious for sure.
You'll want to keep an eye on this google search for any known viruses. At this time I have not found ANY viruses that run themselves using this filename. All of the results currently affect this file in some way, but do not actually run as this filename.