HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
U	Narrator	Narrator.exe	Associated with the Narrator accessibility feature on Windows XP. It is used to convert text to speech
X	Natal	Natal.scr	"Added by the OPASERV.AE WORM!"
X	NAV	RuxDLL32.exe	"Added by the MAPSON.D WORM!"
Y	NAV Agent	navapw32.exe	Norton Anti-Virus's background scanning process
X	nAv AGENT	N/A	"Added by the RIOSYS MACRO! Note the lower-case ""n"" and ""v"" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes"
X	NAV Agent	systems.exe	"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X	NAV Agent	winsnav.vbs	"Added by the ANPES WORM!"
X	NAV Agent	wmilib32.exe	"Added by the VB-XU TROJAN!"
X	NAV Auto Prot	navprot1.exe	"Added by the RBOT.ZAC WORM!"
X	NAV Auto Protect	msfwe1.exe	"Added by a variant of the RBOT WORM!"
X	NAV Auto Protect	navprotect.exe	"Added by a variant of the RBOT WORM!"
X	NAV Auto Protect	dnsserv.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Protect	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
X	NAV Auto Update	Navautoupdate.exe	"Added by a variant of the SPYBOT WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	slserves.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navupdaters.exe	"Added by the RBOT-UN WORM!"
X	NAV Auto Updates	navupdaterx.exe	"Added by a variant of the RBOT WORM!"
N	NAV CfgWiz	cfgwiz.exe	Introduced with Norton Anti-Virus 2002 this is a real resource hog. Many NAV users will find they can live without loading it
N	NAV Configuration Wizard	cfgwiz.exe	Introduced with Norton Anti-Virus 2002 this is a real resource hog. Many NAV users will find they can live without loading it
U	NAV DefAlert	DefAlert.exe	Norton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis
X	NAV Live Update	[path to worm]	"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X	NAV Scan Service	NAVSCAN32.EXE	"Added by the SDBOT.VG WORM!"
X	NavAgent32	lasvr32.exe	"Added by the FEMOT.D WORM!"
X	NavAgent32	SCardSvr32.Exe	"Added by the MOFEI.B WORM!"
X	navapp	navapp.exe	"NavExcel adware variant"
Y	navapw32	navapw32.exe	Norton Anti-Virus's background scanning process
X	NAVCheck	navchk.exe	Premium rate adult content dialer
X	NAVCheck	shman.exe	Premium rate adult content dialer
U	NaverPCGreen	NPCGreenUpgrader.exe	"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
U	Naviscope	naviscope.exe	"Naviscope is a multipurpose browser enhancement that can speed up Web searches lock out cookies examine HTML send/receive headers provide single-click network diagnostics and much more"
X	NaviSearch	nls.exe	NaviSearch eXact Advertising variant
N	NavLoad	NAVBrowser.exe	Registration reminder for CorelDRAW 10
X	navman_20	sysnav32.exe	"Hijacker possibly a CoolWebSearch parasite variant"
?	NAVMD25	UpdtNv28.exe	Added by Symantec for updating the MicroDefs for their AV products - is it required?
X	NAVMon32	NAVMon32.exE	"Added by the WINKO.AO WORM!"
X	NAVNet	***.tmp [* = random digit]	Unidentified adware
X	navp.exe	navp.exe	"Added by the AGOBOT-OE WORM!"
X	NavPass	NavPass.exe	Free system for gaining access to and downloading from adult content web-sites
X	NavScan	[filename]	"Added by the OBSORB TROJAN!"
X	NAVSCAN32.EXE	NAVSCAN32.exe	"Added by the SDBOT-DO WORM!"
X	NAVSCANNER32	NAVSCANNER32.EXE	"Added by the RBOT.QC WORM!"
X	NAVUpd	rundll32.exe navupd.dll Startup	"Added by the NAVU TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	NAVWatch	NAVWatcher.exe	"VX2.Transponder parasite updater/installer related"
X	NAV_Update	NAV_Update.exe	Unidentified WORM or TROJAN!
X	nawadll32	nawadll32.exe	"Added by the SDBOT-ZI WORM!"
X	nawdll32	nawdll32.exe	"Added by the SDBOT-ZM WORM!"
N	NB Common Dialog Enhancements	COMDLGEX.EXE	Part of McAfee Nuts & Bolts. With Common Dialog Enhancements you can add MRU list box to open dialogs
N	NB Start Menu	STARTM.EXE	Part of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B
N	NB Windows Patterns	WINDBKGND.EXE	Part of McAfee Nuts & Bolts. With Background Patterns you can change background patterns of wizard and dialog windows
X	NBInstall	MBDownloader_876919.exe	"Added by the MIRAR_D TROJAN!"
U	NBJ	NBJ.exe	Ahead Nero BackItUp - backup program. Only required for if you have scheduled back-ups
U	NbkCtrl	NbkCtrl.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
U	NBKeyScan	NBKeyScan.exe	"This tool comes with a special version of Nero BackItUp for some external harddisks. Controls two buttons on the drive - one button power off the drive and the other directly calls Nero BackItUp to make a quick backup"
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
?	nbustrce1D	nbustrce1D.exe	"Device driver possibly CD/DVD - what exactly is it and is it required in startup?"
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
X	Ncao	osoa.exe	"PurityScan/Clickspring adware"
X	Ncao	urpo.exe	"PurityScan/Clickspring adware"
?	NCClient	N/A	"??"
N	NCD	ncd.exe	Norton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path
N	NCLAUNCH	NCLAUNCH.exe	"Part of SWF Studio from Northcode Inc. - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP"
X	nClient	cnen.exe	"Added by the DELBOT-AL WORM!"
Y	NCSW Server	NcsW.exe	"LockLink access control management software. LockLink 7.0 lets users seamlessly manage both offline and online access control solutions available from IR Security & Safety"
N	NCS_SS	Csinsm32.exe	Same as CleanSweep Smart Sweep-Internet Sweep
X	NDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	NDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
?	NDDEAGNT	NDDEAGNT.EXE	WinNT default process. Network Dynamic Data Exchange (DDE) Agent handles requests for network DDE services
X	NDIS Adapter	ndis.exe	"Added by the SDBOT.VF WORM!"
X	NDIS Adapter	windows.exe	"Added by the FORBOT-BR WORM!"
X	NDIS Adapter	lsass2.exe	"Added by the WOOTBOT.CW WORM!"
X	NDIS Adapter	servenxpp.exe	"Added by the FORBOT-GP WORM!"
X	NDIS Adapter	Servenxp.exe	"Added by the SPYBOT.LY WORM!"
X	NDIS Adapter	svchosttt.exe	"Added by the WOOTBOT.AN WORM!"
X	NDIS Adapter	Winman.exe	"Added by the WOOTBOT.AG WORM!"
X	ndlhosta	uiremsyl.exe	"Added by a variant of the SDBOT WORM!"
X	Ndpldaemon	[path to trojan]	"Added by the RPCSDBOT-A TROJAN!"
X	NDplDeamon	nstask32.exe	"Added by the RANDEX.E WORM!"
X	NDplDeamon	winlogin.exe	"Added by the RANDEX.E WORM!"
U	NDPS	DPMW32.EXE	"Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature"
X	NDrv	NDrv.exe	"PurityScan/Clickspring adware"
U	NDSTray	NDSTray.exe	ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings it's a must have
U	NDSTray.exe	NDSTray.exe	ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings it's a must have
X	Ndtstat	Ndtstat.exe	Added by a variant of the BANLOAD family of TROJANS!
N	Necbar	Necbar.exe	Nec Assistant; Ark's Navigator a graphical interface for NEC computers
Y	NECMFK	necmfk.exe	NEC wireless keyboard driver
U	Necutray	Necutray.exe	Driver for external USB storage devices (hard drives flsh disks etc)
X	neos	neos.exe	"Added by the BDOORB-FAM TROJAN!"
?	neqprvfy.exe	neqprvfy.exe	"Appears to be related to the downloading of some application - possibly verifying updates?"
X	Nero	shch.exe	"Added by a variant of the BDOOR-EB BACKDOOR!"
X	Nero Checker	nerocheck.exe	"Added by the PROXY-X TROJAN! Note - this is not related to ""Nero Burning Rom"" CD writing software"
N	Nero DriveSpeed	DRIVESPEED.EXE	"Ahead Nero DriveSpeed - set the CD reading speed of a CD/DVD drive on-the-fly to reduce the noise on high-speed drives"
N	Nero PhotoShow Media Manager	mssysmgr.exe	"Nero rebranded version of Simple Star's PhotoShow photo editing and organizing software makes it easy to send and share digital photos"
X	Nero Updater.6.12	wmp9.exe	"Added by the AGOBOT-AAG WORM!"
X	Nero.ma	***.exe [*** = 2 to 3 digits]	"Added by the JONBARR.D WORM!"
X	NeroAutoStartClient	NeroASM.exe	"Added by the AGOBOT.VG WORM!"
U	NeroCheck	nerocheck.exe	Associated with "Nero Burning Rom" CD writing software. Checks for driver issues
X	NeroCheck	regedit.exe	"Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD/DVD burning program. Also it is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	NeroFil	NeroFil.EXE	"Added by the RBOT.EAM TROJAN!"
X	NeroFileCheck	msjavam32.exe	"Added by the AGOBOT.AKM WORM!"
U	NeroFilterCheck	NeroCheck.exe	Associated with "Nero Burning Rom" CD writing software. Checks for driver issues
U	NeroHomeFirstStart	NMFirstStart.exe	"Associated with Nero Scout added by version 7 of the Nero digital media suite (CD & DVD burning authoring etc). Thanks to Help2Go.com if you feel this is draining more resources that necessary you can disable it by clicking here"
X	NeroLoader	NeroLoader.exe	"Added by the BANCBAN-EJ TROJAN!"
N	NeroNETTrayIcon	NNServiceCtrl.exe	"System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
X	Net	WINREG.EXE	"Added by the ASSASIN.D TROJAN!"
U	Net Accelerator	NetAccelerator.exe	"Rizal NetAccelerator - ""Optimizing Dial-Up Lan Cable DSL and Satellite connections do you want to speed up your Internet access up to 200% - 300% ???"". Only required if you find it helps improve your performance"
U	Net Activity Diagram	nad.exe	"Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs"
X	NET Bios Stats	ntbstats.exe	"Added by the SDBOT-ZX WORM!"
X	Net Command Senter	nvscvse.exe	"Added by the IRCBOT!DF6280E5 VIRUS!"
X	Net CoNN	Antispy.exe	"Added by the AGOBOT.ALK WORM!"
X	NET DEMON	ndemon.exe	"Added by the AGOBOT-LA WORM!"
U	Net iD	iid.exe	"""With the Net_iD program you can easily and securely logon with a smart card into a domain a virtual private network (VPN) or in Citrix and Terminal Server environments"""
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	Net**.exe [* = random char]	Net**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	Net**32.exe [* = random char]	Net**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
N	Net-It Launcher	NILaunch.exe	"Net-It - web publishing software"
X	net32	svhost.exe	Added by a variant of the Trojan.Clicker family
X	net64	svhoster.exe	"Detected by PCTools as the AGENT.JVF TROJAN! See here"
U	NetAccelerator	NetAccel.exe	"NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster browse faster surf faster!. Only required if you find it helps improve your performance"
X	NetAdm7	NETADM7.EXE	"Added by the BANCOS.F TROJAN!"
X	Netapi	Netapi.exe	"Added by the NETDEVIL.14 TROJAN!"
X	netapi32	netapi32.exe	Added by an unidentified TROJAN!
X	NetApp	winserv.exe	"Added by the SHADOWTHIEF TROJAN!"
N	NetAppel	NetAppel.exe	"NetAppel - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	NetAssistant	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address city county etc and gets written to a log file"". NetAssistant Help is required to run with the Help and Support program. If you uncheck NetAssistant Help and and then run Help and Support it will add another NetAssistant Help in the startup menu. If you remove the NetAssistant Help in the add/remove program some help menus in help and support will not be available. You decide"
X	Netbeans	netbeans.exe	"Added by the DELBOT-R WORM!"
X	Netbios Helper	nbthlp.exe	"Added by the BANKER.Y TROJAN!"
X	NetBiosSrvc	HPSrvPrt.exe	"Added by the SDBOT-COL WORM!"
X	NetBioy Client	netbioy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	netc	svc.exe	"Detected by Bitdefender as DROPPER.LDPINCH.Q malware"
X	netconfig	netconfig.exe	"Added by the NETWARE TROJAN!"
U	NetCruiser Dialer	NCDialer.exe	"NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected dial and hangup at predefined times and automatic redialing of dropped connections""
X	netdaemon	netdaemon /v	"Malware designed to ""kill"" a number of antispyware applications (SpyBot Giant SpyDoctor SpySweeper SpyHunter Anvir WinPatrol and more)"
X	netdll32	netdll32.exe	"Added by the CRYPTER.A TROJAN!"
X	netdllex	netdllex.Exe	"Added by the CRYPTER.A TROJAN!"
X	NetDy	VisualGuard.exe	"Added by the NETSKY.N or NETSKY.W WORMS!"
X	NETFP32.EXE	NETFP32.EXE	Added by the AGENT.CD TROJAN!
?	netfxupdate	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?	NetFxUpdate_v1.0.3705	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
U	NETGEAR WG111T Smart Wizard	wlan111t.exe	"Configuration utility for the Netgear WG111T multi-rate Wireless USB 2.0 Adapter that ""provides wireless access to your desktop or notebook PC through the computer's USB port"""
U	NetGuard	NetGuard.exe	FBM Software ZeroSpyware 2004 spyware detector and remover - real time monitor
X	nethost.exe	[path to file]	"Added by the PERDA-J TROJAN!"
U	Netlimiter	Netlimiter.exe	"Netlimiter - ""An internet traffic control tool to monitor applications which access the internet and actively control their internet traffic. Use it o set (download/upload) speed limits for applications or even single connection. NetLimiter also allows you to share your internet connection bandwidth among all applications running on your PC."""
N	Netline User	netchk.exe	Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game for example
X	NetLink	netlink32.exe	"Added by the GAOBOT.WO WORM!"
X	NetLogon	userint.exe	"Added by the SDBOT-BC WORM!"
U	NetManageImport	nmcpdata.exe	"NetManage business software related"
X	NetManagerService	ntss.exe	"Added by the BESTPICS.A TROJAN!"
U	NetMeter	NetMeter.exe	"""Net Meter is a small customizable network bandwidth monitoring program for Win9x/Me/NT4/2K/XP. NetMeter is and will always stay freeware. The program has been tested extensively on Win2K/XP but it should work just as well on all other Win32 operating systems"""
X	NetMeter	NielsenOnline.exe	"NetRatings software by Opistat. ""OpiStat measures Internet usage anonymously and surveys participants according to their profiles and online habits"". This software has been reported to get downloaded and installed automatically after a Grokster install. It anonymously collects your use of the Internet protocols (sites visited Web pages advertisements seen electronic commerce streaming). To be avoided!"
U	NetMeter	HooNetMeter.exe	"""Net Meter is a powerful and easy-to-use bandwidth meter. It monitors traffic of all network connections and displays real-time graphical and numerical data transfer rates. Net Meter can display details of multiple network connections at the same time. It records all network traffic and includes extensive logging (daily weekly and monthly) and traffic events. Net Meter works with virtually all types of network connections including phone modems DSL cable modem LAN satellite and more."""
X	NetMon	netmon.exe	"Added by the MIMAIL.M WORM!"
X	Netmonw	Netmonw.exe	"Added by the BDOOR-FX BACKDOOR!"
U	netmsg	netmsg.exe	"Net_Message is a small tool to send messages across the network using the Windows Messenger Service so there is no client install required to receive the messages. It has a number of other features as well"
U	NetOnHold	FTNOHMgr.EXE	"""FaxTalk NetOnHold 1.5 works with the Modem-On-Hold capabilities found in V.92 modems to provide the ability to place an Internet connection ""on hold"" and receive incoming calls or place outgoing calls"""
U	NetPanel	Starter.exe	"Gemius surveillance software. Uninstall this software unless you put it there yourself"
U	NetPatrol	winclient.exe	"NetPatrol network monitoring software"
X	netpc32.exe	netpc32.exe	"Malware probably a CoolWebSearch parasite variant"
N	NetPerSec	NetPerSec.exe	"NetPerSec - measures the real-time speed of your Internet connection"
N	NetPumper	NetPumperIEProxy.exe	"NetPumper download manager - bundles Cydoor and SaveNow adware see here"
X	NetReach	nrcheck.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	Netropa Internet Receiver	Netropa.exe	Netropa Internet Receiver. Shows a scrolling bar with the news. Major resource hog and flagged as spyware
U	NetRun	NetRun.exe	"NetRun - will 'RUN' a 'List' of programs only when a internet connection is detected and close/kill the same 'List' when the connection is lost"
U	Netscape	InstallService.exe	Related to Netscape installation
N	Netscape Messenger	NETSCAPE.EXE	In Netscape 6 (I know for sure with 6.2.1 maybe with 6.0) Netscape.exe is the main executable file for Netscape Navigator Netscape Mail and News and Netscape Messenger (the new name for the embedded AIM no doubt to make it sound like Windows Messenger the XP version of MSN Messenger). Basically netscape.exe can be more than just Netscape Messenger and Messenger can be more then just AIM in disguise depending on the version of Netscape installed
N	Netscp6	Netscp6.exe	Netscape 6
U	NetScreen-Remote	SafeCfg.exe	"NetScreen Remote VPN client software"
X	NetService	ntsvc.exe	"Added by the QQPASS-DU TROJAN!"
X	netservices	recall.exe	"Added by the WOOTBOT.D WORM!"
X	netservices	svchostn.exe	"Added by the SDBOT.GI WORM!"
X	NETServices	csxrs.exe	"Added by a variant of the SDBOT WORM!"
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	If disabled user created fonts can no longer be seen by other programs
X	NetStart	svchost.exe	"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
N	NetStat Live	Nsl.exe	"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X	netsv32	netsv32.exe	"Added by the SDBOT-PX WORM!"
X	netsv32	sv.exe	"Detected by PCTools as the DELF.CCD TROJAN! See here"
Y	NettGain2000	WgwMngr.exe	Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list