Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X NAV Agent systems.exe"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X NAV Agent winsnav.vbs"Added by the ANPES WORM!"
X NAV Agent wmilib32.exe"Added by the VB-XU TROJAN!"
X NAV Auto Prot navprot1.exe"Added by the RBOT.ZAC WORM!"
X NAV Auto Protect msfwe1.exe"Added by a variant of the RBOT WORM!"
X NAV Auto Protect navprotect.exe"Added by the RBOT.BKW WORM! Note - this is not a valid Norton AntiVirus product from Symantec"
X NAV Auto Protect dnsserv.exe"Added by a variant of the SDBOT WORM!"
X NAV Auto Protect mcafee32.exe"Added by a variant of the SPYBOT WORM!"
X NAV Auto Update [random filename]"Added by the SPYBOT-E WORM!"
X NAV Auto Update iamsad.exe"Added by the SPYBOT-CE BACKDOOR!"
X NAV Auto Update Sadness.exe"Added by the SPYBOT-E WORM!"
X NAV Auto Updates csrssp.exe"Added by a variant of the SDBOT WORM!"
X NAV Auto Updates navwindows.exe"Added by a variant of the SDBOT WORM!"
X NAV Auto Updates slserves.exe"Added by the RBOT.COI BACKDOOR!"
X NAV Auto Updates navupdaterx.exe"Added by a variant of the RBOT WORM!"
N NAV CfgWiz cfgwiz.exe"Introduced with Norton Anti-Virus 2002
N NAV Configuration Wizard cfgwiz.exe"Introduced with Norton Anti-Virus 2002
U NAV DefAlert DefAlert.exeNorton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis
X NAV Live Update [path to worm]"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X NAV Scan Service NAVSCAN32.EXE"Added by the SDBOT.VG WORM!"
X NavAgent32 lasvr32.exe"Added by the FEMOT.D WORM!"
X NavAgent32 SCardSvr32.Exe"Added by the MOFEI.B WORM!"
X navapp navapp.exe"NavExcel adware variant"
Y navapw32 navapw32.exeNorton Anti-Virus's background scanning process
X NAVCheck navchk.exePremium rate adult content dialer
X NAVCheck shman.exePremium rate adult content dialer
X Navegate iiexplorer.exe"Added by the BANCBAN-OP TROJAN!"
X Navegate wisterd.exe"Added by the BANKER-BOS TROJAN!"
U NaverPCGreen NPCGreenUpgrader.exe"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
U Naviscope naviscope.exe"Naviscope is a multipurpose browser enhancement that can speed up Web searches
X NaviSearch nls.exe"NaviSearch
N NavLoad NAVBrowser.exeRegistration reminder for CorelDRAW 10
X navman_20 sysnav32.exe"Hijacker
? NAVMD25 UpdtNv28.exeAdded by Symantec for updating the MicroDefs for their AV products - is it required?
X NAVMon32 NAVMon32.exE"Added by the WINKO.AO WORM!"
X NAVNet ***.tmp [* = random digit]Unidentified adware
X navp.exe navp.exe"Added by the AGOBOT-OE WORM!"
X NavPass NavPass.exeFree system for gaining access to and downloading from adult content web-sites
X NavScan [filename]"Added by the OBSORB TROJAN!"
X NAVtask NAVtask.exe"Added by the REMBOT-A BACKDOOR!"
X NAVUpd "rundll32.exe navupd.dll Startup"
X NAVWatch NAVWatcher.exe"VX2.Transponder parasite updater/installer related"
X NAV_Update NAV_Update.exeUnidentified WORM or TROJAN!
X nawadll32 nawadll32.exe"Added by the SDBOT-ZI WORM!"
X nawdll32 nawdll32.exe"Added by the SDBOT-ZM WORM!"
N NB Common Dialog Enhancements COMDLGEX.EXE"Part of McAfee Nuts & Bolts. With Common Dialog Enhancements
U NB Probe NBProbe.exe"Monitors the status of notebooks from ASUS - including CPU (speed
N NB Start Menu STARTM.EXEPart of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B
N NB Windows Patterns WINDBKGND.EXE"Part of McAfee Nuts & Bolts. With Background Patterns
X NBInstall MBDownloader_876919.exe"Added by the MIRAR_D TROJAN!"
U NBJ NBJ.exeAhead Nero BackItUp - backup program. Only required for if you have scheduled back-ups
U NbkCtrl NbkCtrl.exe"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
U NBKeyScan NBKeyScan.exe"This tool comes with a special version of Nero BackItUp for some external harddisks. Controls two buttons on the drive - one button power off the drive and the other directly calls Nero BackItUp to make a quick backup"
X NBT System alias [path] repcale.exe [path] beird.exe"Added by a variant of the RANDON.AN WORM!"
? nbustrce1D nbustrce1D.exe"Device driver
X NC1565 winntsrv -l -p10001 -d -e cmd.exe -L"Added by the NEWLEY-A WORM!"
X Ncao osoa.exe"PurityScan adware"
X Ncao urpo.exe"PurityScan adware"
? NCClient N/A"??"
N NCD ncd.exeNorton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path
N NCLAUNCH NCLAUNCH.exe"Part of SWF Studio from Northcode Inc. - an extension to Flash. Bundled when you create a self-installing screen-saver on Win2K/XP"
X nClient cnen.exe"Added by the DELBOT-AL WORM!"
N NclTray NclTray.exe"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
U Ncr3 ncrcore3.exe"Network camera recording software for home/office security systems using wired or wireless Panasonic cameras that enables you to locally view
Y NCSW Server NcsW.exe"LockLink access control management software. LockLink 7.0 lets users seamlessly manage both offline and online access control solutions available from IR Security & Safety"
N NCS_SS Csinsm32.exeSame as CleanSweep Smart Sweep-Internet Sweep
X Ncua ihoo.exe"PurityScan adware"
X NDAv csnss.exe"Added by the SERFLOG.C WORM!"
X NDAv svhost.exe"Added by the SERFLOG.C WORM!"
? NDDEAGNT NDDEAGNT.EXE"WinNT default process. Network Dynamic Data Exchange (DDE) Agent
X NDIS Adapter ndis.exe"Added by the SDBOT.VF WORM!"
X NDIS Adapter windows.exe"Added by the FORBOT-BR WORM!"
X NDIS Adapter lsass2.exe"Added by the WOOTBOT.CW WORM!"
X NDIS Adapter servenxpp.exe"Added by the FORBOT-GP WORM!"
X NDIS Adapter Servenxp.exe"Added by the SPYBOT.LY WORM!"
X NDIS Adapter svchosttt.exe"Added by the WOOTBOT.AN WORM!"
X NDIS Adapter Winman.exe"Added by the WOOTBOT.AG WORM!"
X ndlhosta uiremsyl.exe"Added by a variant of the SDBOT WORM!"
X Ndpldaemon [path to trojan]"Added by the RPCSDBOT-A TROJAN!"
X NDplDeamon nstask32.exe"Added by the RANDEX.E WORM!"
X NDplDeamon winlogin.exe"Added by the RANDEX.E WORM!"
U NDPS DPMW32.EXE"Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature"
X NDrv NDrv.exe"PurityScan adware"
U NDSTray NDSTray.exe"ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required
U NDSTray.exe NDSTray.exe"ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required
X Ndtstat Ndtstat.exeAdded by a variant of the BANLOAD family of TROJANS!
N Necbar Necbar.exe"Nec Assistant; Ark's Navigator
Y NECMFK necmfk.exeNEC wireless keyboard driver
U Necutray Necutray.exe"Driver for external USB storage devices (hard drives
X Negative spain.exe"Added by the BANKER-EXJ TROJAN!"
X neos neos.exe"Added by the BDOORB-FAM TROJAN!"
? neqprvfy.exe neqprvfy.exe"Appears to be related to the downloading of some application - possibly verifying updates?"
X Nero shch.exe"Added by a variant of the BDOOR-EB BACKDOOR!"
X Nero Checker nerocheck.exe"Added by the PROXY-X TROJAN! Note - this is not related to ""Nero Burning Rom"" CD writing software"
N Nero DriveSpeed DRIVESPEED.EXE"Ahead Nero DriveSpeed - set the CD reading speed of a CD/DVD drive on-the-fly to reduce the noise on high-speed drives"
N Nero PhotoShow Media Manager mssysmgr.exe"Nero rebranded version of Simple Star's PhotoShow photo editing and organizing software
X Nero Updater.6.12 wmp9.exe"Added by the AGOBOT-AAG WORM!"
X ***.exe [*** = 2 to 3 digits]"Added by the JONBARR.D WORM!"
X NeroAutoStartClient NeroASM.exe"Added by the AGOBOT.VG WORM!"
U NeroCheck nerocheck.exeAssociated with "Nero Burning Rom" CD writing software. Checks for driver issues
X NeroCheck regedit.exe"Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD/DVD burning program. Also
X NeroFil NeroFil.EXE"Added by the RBOT.EAM TROJAN!"
X NeroFileCheck msjavam32.exe"Added by the AGOBOT.AKM WORM!"
U NeroFilterCheck NeroCheck.exeAssociated with "Nero Burning Rom" CD writing software. Checks for driver issues
U NeroHomeFirstStart NMFirstStart.exe"Associated with Nero Scout
X NeroLoader NeroLoader.exe"Added by the BANCBAN-EJ TROJAN!"
N NeroNETTrayIcon NNServiceCtrl.exe"System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network"
X NeroUpdate Check msjava.exe"Added by the AGOBOT.AMH WORM!"
X NeroUpdater6.8 winjava.exe"Added by the AGOBOT.AMK WORM!"
X net"Added by the MDROP-CIF TROJAN!"
U Net Accelerator NetAccelerator.exe"Rizal NetAccelerator - ""Optimizing Dial-Up
U Net Activity Diagram nad.exe"Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs"
X NET Bios Stats ntbstats.exe"Added by the SDBOT-ZX WORM!"
X Net Command Senter nvscvse.exe"Added by the IRCBOT!DF6280E5 VIRUS!"
X Net CoNN Antispy.exe"Added by the AGOBOT.ALK WORM!"
X NET DEMON ndemon.exe"Added by the AGOBOT-LA WORM!"
U Net iD iid.exe"""With the Net_iD program
X NET protection system netst.exe"Added by the RIZO.A TROJAN!"
X Net**.exe [* = random char] Net**.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
X Net**32.exe [* = random char] Net**32.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
N Net-It Launcher NILaunch.exe"Net-It - web publishing software"
X net32 svhost.exeAdded by a variant of the Trojan.Clicker family
U Net4Switch Net4Switch.exe"ASUS Net4Switch utility as provided on their range of notebooks - which ""helps users to quickly configure the notebook PC's network settings and easily switch between different network environments. A wizard guides users to create and edit configuration settings as well as diagnose problems in the settings for timely connection"""
X net64 svhoster.exe"Added by the AGENT.JVF TROJAN!"
U NetAccelerator NetAccel.exe"NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster
X NetAdm7 NETADM7.EXE"Added by the BANCOS.F TROJAN!"
X Netapi Netapi.exe"Added by the NETDEVIL.14 TROJAN!"
X netapi32 netapi32.exeAdded by an unidentified TROJAN!
X NetApp winserv.exe"Added by the SHADOWTHIEF TROJAN!"
N NetAppel NetAppel.exe"NetAppel - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U NetAssistant matcli.exe"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X Netbeans netbeans.exe"Added by the DELBOT-R WORM!"
X Netbios Helper nbthlp.exe"Added by the BANKER.Y TROJAN!"
X NetBiosSrvc HPSrvPrt.exe"Added by the SDBOT-COL WORM!"
X NetBioy Client netbioy.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
? NetBrowser NetBrowser.exe"Part of Best Network Security
? NetBrowser.exe NetBrowser.exe"Part of Best Network Security
X netc svc.exe"Added by the VESLORUKI.DWK TROJAN!"
X netconfig netconfig.exe"Added by the NETWARE TROJAN!"
U NetCruiser Dialer NCDialer.exe"NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected
X netdaemon netdaemon /v"Malware designed to ""kill"" a number of antispyware applications (SpyBot
X netdll32 netdll32.exe"Added by the CRYPTER.A TROJAN!"
X netdllex netdllex.Exe"Added by the CRYPTER.A TROJAN!"
X NetDy VisualGuard.exe"Added by the NETSKY.N or NETSKY.W WORMS!"
? netfxupdate netfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
? NetFxUpdate_v1.0.3705 netfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
U NETGEAR WG111T Smart Wizard wlan111t.exe"Configuration utility for the Netgear WG111T multi-rate Wireless USB 2.0 Adapter that ""provides wireless access to your desktop or notebook PC through the computer's USB port"""
U NetGuard NetGuard.exeFBM Software ZeroSpyware 2004 spyware detector and remover - real time monitor
X nethost.exe [path to file]"Added by the PERDA-J TROJAN!"
U Netlimiter Netlimiter.exe"Netlimiter - ""An internet traffic control tool to monitor applications which access the internet and actively control their internet traffic. Use it o set (download/upload) speed limits for applications or even single connection. NetLimiter also allows you to share your internet connection bandwidth among all applications running on your PC."""
N Netline User netchk.exe"Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game
X NetLink netlink32.exe"Added by the GAOBOT.WO WORM!"
X NetLogon userint.exe"Added by the SDBOT-BC WORM!"
U NetManageImport nmcpdata.exe"NetManage business software related"
X NetManagerService ntss.exe"Added by the BESTPICS.A TROJAN!"
U NetMeter NetMeter.exe"""Net Meter is a small
X NetMeter NielsenOnline.exe"NetRatings software by Opistat. ""OpiStat measures Internet usage anonymously and surveys participants according to their profiles and online habits"". This software has been reported to get downloaded and installed automatically after a Grokster install. It anonymously collects your use of the Internet protocols (sites visited
U NetMeter HooNetMeter.exe"""Net Meter is a powerful and easy-to-use bandwidth meter. It monitors traffic of all network connections and displays real-time graphical and numerical data transfer rates. Net Meter can display details of multiple network connections at the same time. It records all network traffic and includes extensive logging (daily
X NetMon netmon.exe"Added by the MIMAIL.M WORM!"
X netmon dllcache.exe"Added by the BCKDR-RAA TROJAN!"
X Netmonw Netmonw.exe"Added by the BDOOR-FX BACKDOOR!"
U netmsg netmsg.exe"Net_Message is a small tool to send messages across the network
U NetOnHold FTNOHMgr.EXE"""FaxTalk NetOnHold 1.5 works with the Modem-On-Hold capabilities found in V.92 modems to provide the ability to place an Internet connection ""on hold"" and receive incoming calls or place outgoing calls"""
U NetPanel Starter.exe"Gemius surveillance software. Uninstall this software unless you put it there yourself"
U NetPatrol winclient.exe"NetPatrol network monitoring software"
X netpc32.exe netpc32.exe"Malware
N NetPerSec NetPerSec.exe"
N NetPumper NetPumperIEProxy.exe"NetPumper download manager - bundles Cydoor and SaveNow adware
X NetReach nrcheck.exe"Added by an unidentified VIRUS
X Netropa Internet Receiver Netropa.exeNetropa Internet Receiver. Shows a scrolling bar with the news. Major resource hog and flagged as spyware
U NetRun NetRun.exe"NetRun - will 'RUN' a 'List' of programs only when a internet connection is detected
U Netscape InstallService.exeRelated to Netscape installation
N Netscape Messenger NETSCAPE.EXE"In Netscape 6 (I know for sure with 6.2.1
N Netscp6 Netscp6.exeNetscape 6
U NetScreen-Remote SafeCfg.exe"NetScreen Remote VPN client software"
X NetService ntsvc.exe"Added by the QQPASS-DU TROJAN!"
X netservices recall.exe"Added by the WOOTBOT.D WORM!"
X netservices svchostn.exe"Added by the SDBOT.GI WORM!"
X NETServices csxrs.exe"Added by a variant of the SDBOT WORM!"
U NetShow Powerpoint Helper NSPPTHLP.EXE"If disabled
X NetStart svchost.exe"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
N NetStat Live Nsl.exe"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X NetSurfageAssure GDC.exe"NetSurfageAssure French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X netsv32 netsv32.exe"Added by the SDBOT-PX WORM!"
X netsv32 sv.exe"Added by the DELF.CCD TROJAN!"
Y NettGain2000 WgwMngr.exe"Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution
Y NettGain2000 Verifier NettGain2000 Verifier.exePart of the Starband satellite client that attempts to optimize your satellite connection to increase speed
U NetTime NETTIME.EXE"From a visitor - "This is the executable for NetTime. It is started from the registry when you check the box to start at startup. NetTime allows you to synchronize your computers' clock with a server on your local net or the internet using any of several protocols
X Nettordinateur GDC.exe"Nettordinateur rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X NettoyeurDePC GDC.exe"NettoyeurDePC French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U NetTurbo netturbo.exe"NetTurbo from "Accelerate Your Internet Connections by up to 600%". If you find it helps your connectivity leave it enabled"
X Netunit32 wunit32.exeAdded by an unidentified WORM or TROJAN!
X netupdate32 netupdate32.exe"Added by the RBOT-GQZ WORM!"
X netview netview.exe"Added by the BIFROSE.L BACKDOOR!"
X NETVISIONAdulti [random filename]"Trafficadvance dialer"
X NETVISIONPasse-partout Passe-partout.exe"Added by the DIALCAR-M DIALER!"
X netw svw.exe"Detected by Bitdefender as a variant of DROPPER.LDPINCH.Q malware"
X NetWatch32 netwatch.exe"Added by the MIMAIL.C WORM!"
N Netword Agent nwant33.exeAn interesting browser utility that allows you to navigate by typing a single word or phrase (a "NetWord") related to what you're looking for into your browser's location field. It also puts an icon in the system tray icon that is a circle with the letter N in the center to access the menu faster. Available via Start -> Programs
X NetWork csrs.exe"Added by the AGOBOT.JJ WORM!"
X Network netwin.exe"Added by the SILLYFDC-CG WORM!"
X Network Access winssh.exe"Added by a variant of the SDBOT WORM!"
X Network Administration NAS.exe"Added by the ANTILAM.20.Q TROJAN!"
X Network Administration Service rsvc32.exe"Added by the RBOT.ABH WORM!"
U Network Associates Error Reporting Service TBMon.exeNetwork Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
X Network Connections internat.exe"Added by the VB-ZD TROJAN!"
X network device driver msfirewall.exe"Added by the DELF-LB TROJAN!"
U NetWork Device Switch NetDevSW.exeToshiba laptops with built-in Wi-Fi. Allows switching between Wi-Fi and internal ethernet. Only necessary if you have regular need to switch back and forward between these network interfaces. Located in Startup folder so make own shortcut to it and disable if not really necessary
X Network Host Controller [path to trojan]"Added by the WHISPER TROJAN!"
X Network Host Service msmnart32.exe"Added by the RBOT-CJV WORM!"
X Network Host Service [random]32.exe"Added by the RBOT-BAB WORM!"
X Network maneger svchost.exe"Added by the AGENT.BX BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list