Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Newsgroup lptt01	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Newsgroup ml097e	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
N	NewsUpd	newsupd.exe	"For Creative Soundblaster Live! series soundcards. System tray application for News updates. Available via Start -> Programs. Also spyware - see here."
X	NewtonKnowsUpd	"NewtKnow.exe ...NewtnUpd.dll	runkey"
U	NexusServer	PNXSERVR.exe	"Related to ProCoder 2.0 from Canopus. ""ProCoder 2.0 software combines speed and flexibility into a streamlined video conversion tool for professionals. Featuring
U	NFM Service	NPDOR9x.exe	"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
N	nForce Tray Options	sstray.exe	nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys
U	NGClient	ngctw32.exe	"Symantec Ghost Server software - needed for a ""a Ghost multicast"" (transfer images to multiple machines). Can be launched manually"
X	ngpw36	ngpw36.exe	"AdBlaster adware variant"
N	NGServer	ngserver.exe	Symantec/Norton Ghost Console service
X	NI.UERSM_0001_N68M1602	UERSM_0001_N68M1602NetInstaller.exe	"Added by ErrorSafe - a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats"
X	NI.UWA6P_0001_N56M1001	WinAntiVirusPro2006Installer.exe	"WinFixer web installer. Winfixer is ""Foistware""
U	NI.UWA6P_0001_N69M0303	WinAntiVirusPro2006Installer[1].exe	"WinFixer web installer. Winfixer is ""Foistware""
X	NI.UWAS6_0001_N68M2301	UWAS6_0001_N68M2301NetInstaller.exe	"WinFixer web installer. Winfixer is ""Foistware""
X	NI.UWFX5	UWFX5NetInstaller.exe	"WinFixer web installer. Winfixer is ""Foistware""
X	NI.UWFX5T	UWFX5TNetInstaller.exe	"Added by the DOWNLDR-BO TROJAN!"
X	NI.UWFX5[various]	[various filenames]	"WinFixer web installer. Winfixer is ""Foistware""
X	NiceDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Nielsen NetRatings	insight.exe	"NetRatings Premeter spyware"
U	NIHomeAM	LiteClientAM.exe	"A managed web based internet security service that provides comprehensive & total protection for laptops/desktops - regardless of how
X	nikLaus	nikLaus.exe	"Added by the NIKLAS WORM!"
N	NInit	NInit.exe	Norton Uninstall Deluxe. Monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging - not required
Y	nisserv	NISSERV.EXE	Norton Personal Firewall
Y	Nisum	NISUM.EXE	Norton Personal Firewall
U	niSvcLoc	niSvcLoc.exe	"Related to National Instruments Corp. LabView"
X	NJG40	NJG40.EXE	"Added by the BANCOS.D TROJAN!"
N	NkbMonitor	NkbMonitor.exe	"Part of Nikon PictureProject - image management for Nikon digital cameras"
N	NkvMon.exe	NkvMon.exe	Nikon View 5 - for transferring pictures from Nikon digital cameras
N	NkVwMon.exe	NkVwMon.exe	Nikon View - for transferring pictures from Nikon digital cameras
X	NLS Keyboard	keyboard.exe	"Added by a variant of the SPYBOT WORM!"
X	NLS Monitor	nlsmon.exe	"Added by the RBOT-AXJ WORM!"
U	nmapp	nmapp.exe	"Pure Networks ""Network Magic eliminates common frustrations and saves time by simplifying and automating set up
?	NMBgMonitor	NMBgMonitor.exe	"Associated with the Nero digital media suite - what does it do and is it required?"
X	nmgr	nnmgr.exe	"Added by the Adware.FFToolBar adware toolbar"
?	NMSSvc	NMSSVC.EXE	NIC Management Service - diagnostics program for Intel Pro family network cards
Y	NMSVC	nmSvc.exe	"Covenant Eyes - surveillance software that creates records of everything people do on a computer
?	nMTaskBarService	nMtsk.exe	"Taskbar control for ISDN NetMod modem. What does it do and is it required?"
U	NNLL	nnll.exe	"Net Nanny internet filter"
X	nnqcouu	nnqcouu.exe	"The Abi Network adware"
U	NNSvc	nnsvc.exe	"NetNanny internet filter"
X	No Credit Card	plugin-[random].exe	Adult content pop-up dialler
U	No-IP DUC	DUC20.exe	"Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available"
U	NoAds	NoAds.exe	Blocks advertisement banners in Internet Explorer
U	NoAdware	NoAdware.exe	"NoAdware - spyware remover. This version is not recommended - see here"
U	NoAdware3	NoAdware3.exe	"NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here"
U	NoAdware4	NoAdware4.exe	"NoAdware - spyware remover. Initially not recommended due to false positives and aggressive advertising but the later versions have since improved - see here"
X	Nocana	[path to worm]	"Added by the ANACON-B WORM!"
X	NOD32 FiX	regedt32.exe	"NodFix is a is a potentially unwanted application. This application is given an (X) status because we does not and will not support Cracks or Warez. Do not delete the regedt32.exe as it is the legitimate Windows application. NodFix interferes with the default settings of the NOD32 AV application allowing to bypass its free using period as well as changes the default update server to that eval signatures thus allowing to update NOD32 without password. Note - to avoid interfering with the NOD32 application original settings no full cleanup can be provided"
X	Nod32 Free antivirus	nod32krn.exe	"Added by the RBOT-AAO WORM! Note - not the popular free Nod32 antivirus software
U	Nod32CC	nod32cc.exe	"Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button"
Y	NOD32kernel	Nod32krn.exe	"Nod32 Antivirus Version 2"
Y	nod32kui	nod32kui.exe	"Nod32 Antivirus Version 2"
Y	NOD32POP3	Pop3scan.exe	"POP3 E-mail part of Eset's NOD32 virus-scanner"
X	Nod3d2 Free antivirus	N0D32KRN.EXE	"Added by the RBOT-ABQ WORM!"
?	NodeMnger	Nodemngr.exe	"Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon?"
X	nodriver	AUEKXRZ.EXE	"Added by a variant of the SPYBOT WORM!"
X	Noha	aasd.exe	"PurityScan/Clickspring adware"
X	Nokia Check	nokiacheck.exe	"Added by the WORM_RBOT.CDC WORM!"
N	Nokia Connection Monitor	NclConf.exe	"Monitors the infrared port
U	Nokia Tray Application	NclTray.exe	"Nokia PC Suite 5 - ""A collection of powerful tools that you can use to manage your phone features and data."" Synchronize the phone with
U	NOMAD Detector	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
N	NomdCheck	nomdchek.exe	Part of Intel's Native Audio
U	nomtray	nomtray.exe	"System Tray access to NetMotion Wireless options - including connectivity status (see here)"
U	Norman ZANDA	ZLH.EXE	"System Tray icon for Norman Antivirus"
X	NortE Antivirus	norte.exe	"Added by the RBOT.BQQ WORM!"
X	NortE Antivirus	norten.exe	"Added by the RBOT-AFF WORM!"
X	norten Software Intrenet	norten.pif	"Added by the RBOT-AWA WORM!"
X	Norton Antivirus	nortonav.exe	"Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV!"
X	Norton Antivirus 2004	SYMANTECAV2.EXE	"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
X	Norton Antivirus 7.0a	[path to file]	"Added by the PERDA-B or RANCK-CT TROJANS!"
X	Norton Antivirus AV	FVProtect.exe	"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
X	Norton AntiVirus Sys	NAVsys32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Norton Auto Protect	nava.exe	Added by an unidentified WORM or TROJAN!
X	Norton Auto Protect	crss32.exe	"Added by the SDBOT.ATF WORM!"
Y	Norton Auto-Protect	navapw32.exe	Norton Anti-Virus's background scanning process
X	Norton Auto-Protect	ccApp.exe	"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
X	Norton Auto-Protect	SERVICES.exe	"Added by the Ahker.B WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder. Also
?	Norton AV Preload	Premend.exe	"Norton Antivirus related. What does it do and is it required"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
N	Norton Crashguard Monitor	cgmenu.exe	Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001
N	Norton Disk Doctor	Ndd32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
X	Norton Drive Protection	msdt32.exe	"Added by the FORBOT-GB WORM! Note - this not a valid Norton program!"
Y	Norton eMail Protect	POPROXY.EXE	"Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed
X	Norton Firewall	[path to trojan]	"Added by the BANKER-ET TROJAN!"
N	Norton Ghost 9.0	GhostTray.exe	"Norton Ghost tray icon - the application can be launched manually"
X	Norton Guard 32	ntguard32.exe	"Added by a variant of the RBOT WORM!"
X	Norton Live Update Server	cpsdv.exe	"Added by the AGOBOT.EW TROJAN!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Sochost.exe	"Added by the GAOBOT.AO WORM!"
N	Norton Navigator Loader	nnloader.exe	"An older Norton utility for file management under Windows 95. More information here"
X	Norton Personal Firewall	jah.exe	"Added by a variant of the SDBOT WORM!"
X	Norton Personal Firewall	npfw.exe	"Added by the RBOT-UI WORM!"
X	Norton Personal Firewall	lah.exe	"Added by a variant of the RBOT WORM!"
X	Norton Personal Firewall	npfw32.exe	"Added by the RBOT-UQ WORM!"
Y	Norton Personal Firewall	IntroWiz.exe	Part of Norton Personal Firewall or Norton Internet Security
U	Norton Program Scheduler	nsched32.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
U	Norton Program Scheduler	NPSsvc.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
?	Norton Program Scheduler Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
X	Norton Protect	npprotect.exe	"Added by the RBOT-WW WORM!"
X	Norton protect	nvsvc.exe	"Added by a variant of the RBOT WORM!"
X	Norton Protect Activies	csrss.exe	"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""D5133"" subfolder"
X	Norton Service Driver	wsul.exe	"Added by the RBOT-ABI WORM!"
X	Norton Service Process	navapvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton SpySweeper AutoUpdate	navsw.exe	"Added by the FORBOT-AS WORM!"
N	Norton System Doctor	Sysdoc32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
N	Norton SystemWorks	cfgwiz.exe	Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it
X	Norton Update	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Update	cUpdate.exe	"Added by the AGOBOT.APP WORM!"
X	Norton updated	NVSV32.EXE	"Added by the SDBOT.ABH WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
X	Norton Updater	NortonUpdate.exe	Added by an unidentified WORM or TROJAN!
X	Norton Updater	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Updater	navupdtr.exe	"Added by the SDBOT.AXV WORM!"
X	Norton Wizzard	nwiz.exe	"Added by the GAOBOT.ADV WORM! Note - this is not the valid nVidia application that shares the same name"
X	norton32	norton32.exe	"Added by an unidentified VIRUS
X	NortonAntivirus	LSASS.exe	"Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""Temp"" subfolder of the Winnt or Windows folder. It also has nothing to do with Norton AV"
X	NortonAV	norton_antivirus.exe	"Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program"
X	nortonav	CCUPD32.EXE	Added by an unidentified WORM or TROJAN!
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	nortonsantivirus	ccEvtMngr.exe	"Added by the HZDOOR-A TROJAN!"
X	NortonVPlus	svchost.exe	"Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
?	NotebookManager	nbm.exe	"Associated with Acer notebook PCs. What does it do and is it required?"
X	NOTEPAD	NOTEPAD.exe	"Added as the result of the RUSTY VIRUS! Note - not to be confused with the valid Windows ""NOTEPAD"" text editor! This malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
X	Notepad lptt01	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	Notepad ml097e	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	notepad.exe	upx.exe	Added by a variant of the AGENT.AH TROJAN!
X	notepad.exe	msmsgs.exe	"Added by a variant of the FAKESPY-B TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder
X	notepad.exe	msmsgs.exe	"Added by the ZLOB-I TROJAN!
X	notepad.exe	msmsgs.exe	"Added by the ZLOB-I and ZLOB-H TROJANS! Note - not to be confused with msmsgs.exe
X	notepad2.exe	popuper.exe	"Added by the PUPER-E TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.