| Status | Autorun name | Command | Description |
| X | NvCplDaemon32 | anvshell32.exe | Added by the VB-XU TROJAN! |
| X | NvCplDaemonTool | rundll32.exe [path] adload4C.dll,_IWMPEvents | Added by the AGENT-QXD TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "adload4C.dll" file is located in %System% |
| X | NvCplDaemonTool | rundll32.exe [path] wtload08.dll,_IWMPEvents | Added by the SINOWA-GEN TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wtload08.dll" file is located in %System% and %UserProfile% |
| X | NvCplDeamon | nvdisp.exe | Added by the PEEPVIE-I TROJAN! |
| X | NvCplDeamon | servise.exe | Added by the AUTORUN-BNY WORM! |
| X | NvCplDmn | NAVSVC.EXE | Added by an unidentified VIRUS, WORM or TROJAN! |
| X | nvcpll | nvcpll.exe | Added by the BANCBAN-PF TROJAN! |
| X | NvCplScan | msc32.exe | Added by the FORBOT-DD WORM! |
| X | NvCplScan | winasp.exe | Added by the FORBOT.BZ WORM! |
| X | NvCplScan | nvsc32.exe | Added by the BROPIA.N WORM! |
| X | NvCplScan | kav32.exe | Added by the FORBOT-EW WORM! |
| X | NvCplScan | netstat32.exe | Added by the SDBOT.BRL WORM! |
| X | NvCplScan | dllmanager.exe | Added by the FORBOT.R WORM! |
| X | NvCpTDaemon | wuauqmr.exe | Added by the CULT-B WORM! |
| X | nvctrl.exe | nvctrl.exe | Added by the ZLOB.G TROJAN! |
| X | nvd32 lptt01 | nvd32.exe | RapidBlaster variant (in a "NvidStar" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | nvd32 ml097e | nvd32.exe | RapidBlaster variant (in a "NvidStar" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove it |
| X | NVDispDrv | NVDispDRV.EXE | Added by the WINKO.AO WORM! |
| X | nvdisplay | csrss.exe | Added by the VB-FBO WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData% |
| X | NvGraphicsInterface | [path to trojan] | Added by the BCKDR-QKI BACKDOOR! |
| U | NVHotkey | rundll32.exe nvHotkey.dll | Enables the use of "hot keys" for changing setting on Nvidia graphics |
| X | Nvid | [8 random charachters] | Unidentified adware |
| X | Nvid32 | Nvid32.exe | Added by the GEMA TROJAN! |
| X | Nvidex32 | Nvidex32.exe | Added by the GEMA TROJAN! |
| Y | NVIDIA ActiveArmor | ntrayfw.exe | System Tray access to the NVIDIA ActiveArmor hardware-optimized firewall built into some older nForce 3 and 4 series motherboard chipsets |
| X | nVidia Application Drivers | nvidiav32.exe | Added by a variant of the IRCBOT BACKDOOR! |
| X | nVidia Chip4 | NVCHIP4.EXE | Added by the LAMECADA-D BACKDOOR! |
| U | NVIDIA Compatible Windows Vista Display driver, Version * | RUNDLL32.EXE NvCpl.dll,NvStartup | If you use a utility (such as RivaTuner) to overclock any of the default display settings (system clock, memory clock, etc) for NVIDIA based graphics chipsets and want to apply these new settings at startup then this entry will maintain these. Leaving this entry enabled doesn't appear to have an impact on startup time. Not required if you use default settings and if you disable this entry you may also have to disable the associated "NVIDIA Display Driver Service" or "NVIDIA Driver Helper Service". Included with drivers since late 2002 |
| U | NVIDIA Compatible Windows7 Display driver, Version * | RUNDLL32.EXE NvCpl.dll,NvStartup | If you use a utility (such as RivaTuner) to overclock any of the default display settings (system clock, memory clock, etc) for NVIDIA based graphics chipsets and want to apply these new settings at startup then this entry will maintain these. Leaving this entry enabled doesn't appear to have an impact on startup time. Not required if you use default settings and if you disable this entry you may also have to disable the associated "NVIDIA Display Driver Service" or "NVIDIA Driver Helper Service". Included with drivers since late 2002 |
| X | Nvidia Control Center | NvTaskbarInit.exe | Added by the HILOTI-AY TROJAN! |
| X | Nvidia Control Daemon | nksvc32.exe | Added by an unidentified WORM or TROJAN! |
| X | Nvidia Control Panel | ncsvc32.exe | Added by an unidentified VIRUS, WORM or TROJAN! |
| X | NVIDIA Display | DisplayMonitor.exe | Added by the ABI.C WORM! Note - this is not a legitimate nVidia entry |
| X | nVidia Display Driver | nvsvc64.exe | Added by the IRCBOT-YK WORM! Note - this is not related to any nVidia based graphics card |
| X | nVidia Display Drivers (x86) | nvsys86.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | NVIDIA Driver | MSPMSPSU.EXE | Added by the WOOTBOT.Y WORM! |
| U | NVIDIA Driver Helper Service, Version * | RUNDLL32.EXE nvsvc.dll,nvsvcStart | Initially installed with Vista display drivers for NVIDIA based graphics cards. This entry replaced the "NVIDIA Display Driver Service" or "NVIDIA Driver Helper Service" in XP - which was used in part to maintain overclocked display settings. In a GeForce 8800GT test system this isn't the case. Disabling it caused no ill effects but it's exact purpose isn't known - hence the "U" recommendation |
| X | NVIDIA driver monitor | nvsvc32.exe | Added by the AGENT-OZH TROJAN! |
| X | nVidia Drivers | nVidiaDrvers.exe | Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card |
| X | NVidia Drivers | [path to trojan] | Added by the RANCK-R TROJAN! Note - this is not related to any nVidia based motherboard or graphics card |
| U | NVIDIA Media Center Library | RunDLL32.exe NvMCTray.dll,NvTaskbarInit | Installed with display drivers for NVIDIA based graphics cards since late 2002, this entry allows the System Tray icon to be displayed - which gives access to (amongst others) the display settings (such as Antialiasing, Rotation and Colour) and the Desktop Manager (nView). If you don't change display settings very often then this is not required and settings can be changed manually via display properties. No tray icon option is available in Vista. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest" |
| X | NVIDIA Media Center Library | winlogon.exe | Added by the AUTORUN-AZK WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| N | NVIDIA nForce APU1 Utilities | NVATray.exe | nVidia's nForce Audio Processing Unit (APU)- "provides 3D positional audio and DirectX 8.0 compatibility, and encodes and decodes Dolby Digital 5.1 audio in real time" |
| U | NVIDIA nTune | nTune.exe | Older version of the NVIDIA nTune utilty for monitoring and modifying the settings (such as temperatures, voltages, clocks and fan speeds) of NVIDIA based motherboards and graphics cards from within Windows. Now part of NVIDIA System Tools |
| U | NVIDIA nTune | nTuneCmd.exe | Now part of NVIDIA System Tools under the "Peformance" tag. NVIDIA nTune is utilty for monitoring and modifying the settings (such as temperatures, voltages, clocks and fan speeds) of NVIDIA based motherboards and graphics cards from within Windows. Until version 6.01 (when System Tools was released) graphics settings weren't retained in a profile but now they are. From version 6.05, nTuneCmd is no longer loaded via the registry "Run" keys but instead runs via the Performance Service (nTuneService.exe) |
| X | Nvidia Startup Manager | ksvc32.exe | Added by the AGENT-IWD TROJAN! |
| X | nVidia System Drivers | nvsys32.exe | Added by an unidentified WORM or TROJAN! See here |
| U | NVIDIA System Monitor | NVMonitor.exe | NVIDIA System Monitor - part of NVIDIA System Tools. Utility for monitoring and logging system statistics (such as temperatures, voltages, clocks and fan speeds) of NVIDIA based motherboards and graphics cards |
| U | NVidia System Utility | NVSystemUtility.exe | NVidia System Utility - older version of the NVIDIA nTune utilty for monitoring and modifying the settings (such as temperatures, voltages, clocks and fan speeds) of NVIDIA based motherboards and graphics cards from within Windows. Now part of NVIDIA System Tools |
| X | NVIDIA Video drivers | video_32D.exe | Added by the AGOBOT.KV WORM! |
| X | NVIDIA Video drivers | video_32sD.exe | Added by the RBOT-BB WORM! |
| U | NVIDIA® NVRAID | nvraidservice.exe | Part of NVIDIA® MediaShield™ Storage - NVIDIA's management utility for creating and monitoring hard disk RAID arrays for the controllers integrated on their motherboards. Includes a Disk Alert System for troubleshooting with notifications via the System Tray. Not required if you don't have a RAID array or if you created the array at the BIOS level. Some users complain that it can report false errors |
| X | Nvidia32 | nvidia32.exe | CoolWebSearch parasite variant - also detected as the HOSTS-B TROJAN! |
| X | NVidiaDrv | nvfsvm.com | Added by the DELF-A BACKDOOR! |
| X | NviDiaGT | lsass.exe | Added by the AUTORUN-DV WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder |
| N | NvidiaQuickTweak | rundll32.exe NvQtwk.dll, NvTaskbarInit | System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties |
| X | nvidll32 | nvidll32.exe | Added by the RBOT-XK WORM! |
| X | NvidMediaCenter | wmsncs.exe | Added by the BBJC.A TROJAN! |
| U | NVIEW | rundll32.exe nview.dll,nViewLoadHook | Part of NVIDIA's NVIEW Display Management Software - included in drivers for consumer and professional graphics products. In earlier drivers this entry enables the Desktop Manager and makes it's features such as multiple desktops and hot keys available to the user. Available via Control Panel → NVIDIA nView Desktop Manager |
| X | nviload32 | nviload32.exe | Added by the SDBOT-VT WORM! |
| N | NvInitialize | rundll32.exe NvQtwk.dll, NvXTInit | Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled |
| X | nvirundll | nvirundll.exe | Added by the SPYBOT.NPS WORM! |
| X | nvjxue | nvjxue.exe | Added by the EYEVEG-J WORM! |
| Y | NVmax | NVmax.exe | NVmax is a old tweaking utility for NVidia graphics cards. In the startup list if the user chooses to overclock their card |
| U | NVMCTRAY | RunDLL32.exe NvMCTray.dll,NvTaskbarInit | Installed with display drivers for NVIDIA based graphics cards since late 2002, this entry allows the System Tray icon to be displayed - which gives access to (amongst others) the display settings (such as Antialiasing, Rotation and Colour) and the Desktop Manager (nView). If you don't change display settings very often then this is not required and settings can be changed manually via display properties. No tray icon option is available in Vista. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest" |
| U | NvMediaCenter | RunDLL32.exe NvMCTray.dll,NvTaskbarInit | Installed with display drivers for NVIDIA based graphics cards since late 2002, this entry allows the System Tray icon to be displayed - which gives access to (amongst others) the display settings (such as Antialiasing, Rotation and Colour) and the Desktop Manager (nView). If you don't change display settings very often then this is not required and settings can be changed manually via display properties. No tray icon option is available in Vista. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest" |
| N | NVMixerTray | NVMixerTray.exe | System Tray access to audio controls from nVidia's motherboard ForceWare software |
| U | NVMonitor | NVMonitor.exe | NVIDIA System Monitor - part of NVIDIA System Tools. Utility for monitoring and logging system statistics (such as temperatures, voltages, clocks and fan speeds) of NVIDIA based motherboards and graphics cards |
| X | nvmsgdwn | NVMSGDWN.EXE | Added by the GRABER-D TROJAN! |
| X | NvMsnW | Isass.exe | Added by the BROPIA.K WORM! |
| X | nvpatch | napatch.exe | Added by the SASSER-F WORM! |
| U | NvPvrNetMon | NvPvrNetMon.exe | Network monitor for the Personal Video Recorder function of the NVIDIA ForceWare Multimedia application - "makes sure you don't miss your favorite show. If you won't be home to watch the show, just use the PVR to set future recordings" |
| N | NVQuickTweak | rundll32.exe NvQtwk.dll, NvTaskbarInit | System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties |
| U | NVRaidService | nvraidservice.exe | Part of NVIDIA® MediaShield™ Storage - NVIDIA's management utility for creating and monitoring hard disk RAID arrays for the controllers integrated on their motherboards. Includes a Disk Alert System for troubleshooting with notifications via the System Tray. Not required if you don't have a RAID array or if you created the array at the BIOS level. Some users complain that it can report false errors |
| Y | NvRegisterMCTray | RUNDLL32.EXE NVMCTRAY.DLL,NvMCRegisterApp NvCpl.dll | Registers the NVIDIA Control Panel (NvCpl.dll) via the NVIDIA Media Center Library (NVMCTRAY.DLL) on the first reboot only after the installation of NVIDIA graphics drivers on Win Me/XP. Added with nVidia graphics drivers since GeForce/ION Driver - Release 186. Both files are located in %System% |
| Y | NvRegisterMCTrayNview | RUNDLL32.EXE NVMCTRAY.DLL,NvMCRegisterApp nView.dll | Registers the NVIDIA Nview Desktop Manager (nView.dll) via the NVIDIA Media Center Library (NVMCTRAY.DLL) on the first reboot only after the installation of NVIDIA graphics drivers on Win Me/XP. Added with nVidia graphics drivers since GeForce/ION Driver - Release 186. Both files are located in %System% |
| ? | NVRotateSysTray | nvsysrot.dll | Related to NVIDIA nView Control Panel. What does it do and is it required? |
| N | NVRT | nvrt.exe | NVRefreshTool is a utility that will automatically detect the maximum refresh rate at each resolution that your monitor supports |
| ? | NVRTClk | NVRTClk.exe | Related to a Gigabyte video card. What does it do, and is it required? |
| X | nvsv32.exe | nvsv32.exe | Added by the FORBOT-DI WORM! |
| X | nvsv32.exe | cstr.exe | Added by a variant of the SDBOT WORM! |
| X | nvsv32.exe | asr_fnt.exe | Added by the WOOTBOT.GE WORM! |
| X | nvsv32.exe | nvsv33.exe | Added by the WOOTBOT.FP WORM! |
| N | NvSvc | nvsvc.exe | NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active, but no adverse side effects with it disabled. NOTE: If using drivers other than nVidia's, such as Asus, this service may have been renamed to reflect that |
| X | nvsvc | nvsvc.exe | Added by the BANKER-HQ TROJAN! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System% |
| X | NVSVC | nvsvc.exe | Added by the AGOBOT.ALX WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System% |
| U | NvSvc | RUNDLL32.EXE nvsvc.dll,nvsvcStart | Initially installed with Vista display drivers for NVIDIA based graphics cards. This entry replaced the "NVIDIA Display Driver Service" or "NVIDIA Driver Helper Service" in XP - which was used in part to maintain overclocked display settings. In a GeForce 8800GT test system this isn't the case. Disabling it caused no ill effects but it's exact purpose isn't known - hence the "U" recommendation |
| U | nvsvc16 | nvsvc16.exe | MySuperSPy surveillance software. Uninstall this software unless you put it there yourself |
| X | nvsvca32 | nvsvca32.exe | Added by the TACTSLAY.E TROJAN! |
| X | nvsvca32 | clfmon.exe | Added by the TACTSLAY.E TROJAN! |
| X | NVSystem32 | nvscv32.exe | Added by the AGOBOT-NO WORM! |
| X | Nvt32 | complaint_7251.exe | Added by the ARTIEF.B TROJAN! |
| X | NvUpdater | nwiz32.exe | Added by a variant of the RBOT WORM! |
| X | nvviddrv32 | [random filename] | Added by the RBOT-HT BACKDOOR! |
| X | NvVideoCenter | NvVid.exe | Added by the HAXDOOR-DO TROJAN! |
| X | NvXplDeamon | xstyles.exe | Added by the SMALL.AJ VIRUS! |
| ? | NWEReboot | dummy.exe | ?? |
| U | nwiz | nwiz.exe | Part of NVIDIA's NVIEW Display Management Software - included in drivers for consumer and professional graphics products. This entry runs the "NVIDIA Display Setup Wizard" if you connect (or already have connected) an additional display once the drivers have been installed. In later drivers it also loads the "nView Desktop Manager" (if you enable it via Control Panel → NVIDIA nView Desktop Manager) if you want to use features such as Hot Keys and Zoom. In both cases nwiz.exe doesn't remain in memory |
| X | nwiz | KHATRA.exe | Added by the ORBINA-A WORM! |
| U | nwiz.exe | nwiz.exe | Part of NVIDIA's NVIEW Display Management Software - included in drivers for consumer and professional graphics products. This entry runs the "NVIDIA Display Setup Wizard" if you connect (or already have connected) an additional display once the drivers have been installed. In later drivers it also loads the "nView Desktop Manager" (if you enable it via Control Panel → NVIDIA nView Desktop Manager) if you want to use features such as Hot Keys and Zoom. In both cases nwiz.exe doesn't remain in memory |
