| Status | Autorun name | Command | Description |
| X | Ncua | ihoo.exe | PurityScan adware |
| X | NDAv | csnss.exe | Added by the SERFLOG.C WORM! |
| X | NDAv | svhost.exe | Added by the SERFLOG.C WORM! |
| ? | NDDEAGNT | NDDEAGNT.EXE | WinNT default process. Network Dynamic Data Exchange (DDE) Agent, handles requests for network DDE services |
| X | NDIS Adapter | ndis.exe | Added by the SDBOT.VF WORM! |
| X | NDIS Adapter | windows.exe | Added by the FORBOT-BR WORM! |
| X | NDIS Adapter | lsass2.exe | Added by the WOOTBOT.CW WORM! |
| X | NDIS Adapter | servenxpp.exe | Added by the FORBOT-GP WORM! |
| X | NDIS Adapter | Servenxp.exe | Added by the SPYBOT.LY WORM! |
| X | NDIS Adapter | svchosttt.exe | Added by the WOOTBOT.AN WORM! |
| X | NDIS Adapter | Winman.exe | Added by the WOOTBOT.AG WORM! |
| X | ndlhosta | uiremsyl.exe | Added by a variant of the SDBOT WORM! |
| X | Ndpldaemon | [filename].exe | Added by the RPCSDBOT-A BACKDOOR! The file is located in %System% |
| X | NDplDeamon | nstask32.exe | Added by the RANDEX.E WORM! |
| X | NDplDeamon | winlogin.exe | Added by the RANDEX.E WORM! |
| U | NDPS | DPMW32.EXE | Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not required if you don't use this feature |
| X | NDrv | NDrv.exe | PurityScan adware |
| U | NDSTray | NDSTray.exe | ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have |
| U | NDSTray.exe | NDSTray.exe | ConfigFree Tray on a Toshiba laptop. Tray utility for their network switching application which permits switching network devices and settings with a click on the tray icon. While it is not required, for people who span multiple networks and want an easy way to go from wired to wireless and change addresses and other network settings, it's a must have |
| X | Ndtstat | Ndtstat.exe | Added by a variant of the BANLOAD family of TROJANS! |
| N | Necbar | Necbar.exe | Nec Assistant; Ark's Navigator, a graphical interface for NEC computers |
| X | necix | aceyukujy.exe | Added by the SDBOT-UE WORM! |
| Y | NECMFK | necmfk.exe | NEC wireless keyboard driver |
| U | Necutray | Necutray.exe | Driver for external USB storage devices (hard drives, flsh disks, etc) |
| X | Negative | spain.exe | Added by the BANKER-EXJ TROJAN! |
| X | neos | neos.exe | Added by the BDOORB-FAM TROJAN! |
| X | Neospace Internet Security | Internet Security.exe | Neospace Internet Security rogue spyware remover - not recommended |
| X | Neospace Internet Security | isec30.exe | Neospace Internet Security rogue spyware remover - not recommended |
| ? | neqprvfy.exe | neqprvfy.exe | Appears to be related to the downloading of some application - possibly verifying updates? |
| X | Nero | shch.exe | Added by a variant of the BDOOR-EB BACKDOOR! |
| Y | Nero AG InCD | InCD.exe | InCD packet writing utility which allows the user to format CDs/DVDs so that they can be used by simply dragging and dropping files to the disk or by saving to disk from within other applications. Included with Nero digital media suites (CD/DVD burning, authoring, etc) until version 9 (optional install for versions 7 thru 9) and now available as a separate download. If you prefer not to use InCD (due to the obvious alternatives such as USB flash drives) you can disable it |
| N | Nero AG NeroCheck | NeroCheck.exe | Included with some Nero digital media suites (CD/DVD burning, authoring, etc). Looks for known driver conflicts with Nero software and lists these in a log file to help the user determine what may be causing a problem. This is therefore not required if the Nero software is working correctly |
| U | Nero BackItUp | NBAgent.exe | Core task for Nero BackItUp version 4 which provides System Tray access and runs all backup jobs (to hard disk, Network, FTP, CD/DVD) for the files and folders that you specify to either a local folder or Nero Online Backup. Required if you have have any scheduled backups or use the Autobackup feature. Installed as part of both Nero BackItUp & Burn and Nero Multimedia Suite 10 |
| U | Nero BackItUp | NBCore.exe | Autobackup feature of Nero BackItUp version 4 which runs in the background and backs up the files and folders that you specify to either a local folder or Nero Online Backup. If there are modifications or new files, Autobackup carries out a backup update automatically, replacing the existing backup with the current one. Installed as part of both the stand alone product and Nero 9 digital media suites (CD/DVD burning, authoring, etc) |
| U | Nero BackItUp | NBKeyScan.exe | Nero BackItUp versions 2 thru 4 support the "Push for backup" feature that's implemented on some external hard disks - which enables the user to start a predefined backup by pushing a button on the drive. NBKeyScan is used to scan the peripherals for compatible devices and - if such devices have been found - to communicate between Nero BackItUp and the external hard drive. Installed as part of both stand alone products and Nero digital media suites (CD/DVD burning, authoring, etc) |
| U | Nero BackItUp Scheduler | NBJ.exe | Scheduler for backup jobs using Nero BackItUp in earlier versions of Nero digital media suites (CD/DVD burning, authoring, etc). If no backup jobs are scheduled this entry will remain but it will not run at start-up. If you have any scheduled backup jobs and try disabling it by a means other than the program's own option (right-click on tray icon → Settings) it will re-instate itself on the next run of Nero BackItUp |
| X | Nero Checker | nerocheck.exe | Added by the PROXY-X TROJAN! Note - this is not the legitmate file of the same name from the Nero CD/DVD burning software which is usually located in %System%. This one is located in %Windir% |
| N | Nero DriveSpeed | DriveSpeed.exe | Utility included with some Nero digital media suites (CD/DVD burning, authoring, etc) which allows the user to set the reading speed an spin down time of a CD/DVD drive on-the-fly - typically to avoid read errors on discs with surface scratches and to reduce the noise on high-speed drives |
| N | Nero DriveSpeed | DRIVES~1.EXE | Utility included with some Nero digital media suites (CD/DVD burning, authoring, etc) which allows the user to set the reading speed an spin down time of a CD/DVD drive on-the-fly - typically to avoid read errors on discs with surface scratches and to reduce the noise on high-speed drives |
| U | Nero Home | NMBgMonitor.exe | Looks for new files which can be included in Nero Scout which is "a database program which indexes and catalogs all media files on your computer and makes the database available to all programs in the Nero product package." Included in version 7 of the Nero digital media suites (CD/DVD burning, authoring, etc). Integrated into a number of Nero applications and is of particular significance for the Nero Home media center - for more information see the link. If you have trouble disabling Nero Scout try here |
| Y | Nero Home | NMFirstStart.exe | Appears to be related to the first run of Nero Home, which "combines television and the recording of television programs with playback of DVD-Videos and audio/video files in an easy-to-use interface" and "can also catalog them and organize them into individual libraries." Included in versions 7 and 8 of Nero digital media suites (CD/DVD burning, authoring, etc). Loads only on the first reboot after installation via the HKCU\RunOnce key |
| U | Nero Home | NMIndexStoreSvr.exe | Indexing and storage service for Nero Scout which is "a database program which indexes and catalogs all media files on your computer and makes the database available to all programs in the Nero product package." Included in version 8 of the Nero digital media suites (CD/DVD burning, authoring, etc). Integrated into a number of Nero applications and is of particular significance for the Nero Home media center - for more information see the link |
| U | Nero MediaHome | NeroMediaHome.exe | Nero MediaHome is a UPnP AV (Audio/Video) Media Server. This allows your computer to link up you other home entertainment electronic devices (ie, televisions, stereos) to create a unified media centre, sharing media files such as MP3's and videos |
| U | Nero MediaHome 4 | NeroMediaHome.exe | Nero MediaHome is a UPnP AV (Audio/Video) Media Server. This allows your computer to link up you other home entertainment electronic devices (ie, televisions, stereos) to create a unified media centre, sharing media files such as MP3's and videos |
| N | Nero PhotoShow Media Manager | mssysmgr.exe | Nero rebranded version of Simple Star's PhotoShow photo editing and organizing software, makes it easy to send and share digital photos |
| U | Nero SecurDisc client | NBHGui.exe | SecurDisc support for the Nero InCD packet writing utility. "SecureDisc includes special protection properties, such as data integrity, rebuilding, encryption and duplication protection". If you don't use InCD or your optical drive doesn't support SecureDisc you can disable this |
| X | Nero Updater.6.12 | wmp9.exe | Added by the AGOBOT-AAG WORM! |
| X | Nero.ma | ***.exe [*** = 2 to 3 digits] | Added by the JONBARR.D WORM! |
| X | NeroAutoStartClient | NeroASM.exe | Added by the AGOBOT.VG WORM! |
| N | NeroCheck | NeroCheck.exe | Included with some Nero digital media suites (CD/DVD burning, authoring, etc). Looks for known driver conflicts with Nero software and lists these in a log file to help the user determine what may be causing a problem. This is therefore not required if the Nero software is working correctly |
| X | NeroCheck | regedit.exe | Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD/DVD burning program. Also, it is not the valid Windows registry editor which resides in %Windir% and will not normally figure in Msconfig/Startup! This version resides in %System% |
| X | NeroCheck | NeroFilter.EXE | Added by the RBOT.DAO WORM! |
| X | NeroFil | NeroFil.EXE | Added by the RBOT.EAM BACKDOOR! |
| X | NeroFileCheck | msjavam32.exe | Added by the AGOBOT.AKM WORM! |
| N | NeroFilterCheck | NeroCheck.exe | Included with some Nero digital media suites (CD/DVD burning, authoring, etc). Looks for known driver conflicts with Nero software and lists these in a log file to help the user determine what may be causing a problem. This is therefore not required if the Nero software is working correctly |
| Y | NeroHomeFirstStart | NMFirstStart.exe | Appears to be related to the first run of Nero Home, which "combines television and the recording of television programs with playback of DVD-Videos and audio/video files in an easy-to-use interface" and "can also catalog them and organize them into individual libraries." Included in versions 7 and 8 of Nero digital media suites (CD/DVD burning, authoring, etc). Loads only on the first reboot after installation via the HKCU\RunOnce key |
| X | NeroLoader | NeroLoader.exe | Added by the BANCBAN-EJ TROJAN! |
| U | NeroMediaHome | NeroMediaHome.exe | Nero MediaHome is a UPnP AV (Audio/Video) Media Server. This allows your computer to link up you other home entertainment electronic devices (ie, televisions, stereos) to create a unified media centre, sharing media files such as MP3's and videos |
| N | NeroNETTrayIcon | NNServiceCtrl.exe | System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network |
| X | NeroUpdate Check | msjava.exe | Added by the AGOBOT.AMH WORM! |
| X | NeroUpdater6.8 | winjava.exe | Added by the AGOBOT.AMK WORM! |
| X | Net | WINREG.EXE | Added by the ASSASIN.D TROJAN! |
| X | net | net.net | Added by the MDROP-CIF TROJAN! |
| X | Net | services.exe | Added by the BRAVO-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| U | Net Accelerator | NetAccelerator.exe | Rizal NetAccelerator - "Optimizing Dial-Up, Lan, Cable, DSL, and Satellite connections do you want to speed up your Internet access up to 200% - 300% ???". Only required if you find it helps improve your performance |
| U | Net Activity Diagram | nad.exe | Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs |
| X | NET Bios Stats | ntbstats.exe | Added by the SDBOT-ZX WORM! |
| X | Net Command Senter | nvscvse.exe | Added by the IRCBOT!DF6280E5 VIRUS! |
| X | Net CoNN | Antispy.exe | Added by the AGOBOT.ALK WORM! |
| X | NET DEMON | ndemon.exe | Added by the AGOBOT-LA WORM! |
| U | Net iD | iid.exe | "With the Net_iD program, you can easily and securely logon with a smart card into a domain, a virtual private network (VPN) or in Citrix and Terminal Server environments" |
| X | NET protection system | netst.exe | Added by the RIZO.A TROJAN! |
| X | Net**.exe [* = random char] | Net**.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| X | Net**32.exe [* = random char] | Net**32.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| N | Net-It Launcher | NILaunch.exe | Net-It - web publishing software |
| X | net32 | svhost.exe | Added by a variant of the Trojan.Clicker family |
| U | Net4Switch | Net4Switch.exe | ASUS Net4Switch utility as provided on their range of notebooks - which "helps users to quickly configure the notebook PC's network settings and easily switch between different network environments. A wizard guides users to create and edit configuration settings as well as diagnose problems in the settings for timely connection" |
| X | net64 | svhoster.exe | Added by the AGENT.JVF TROJAN! |
| U | NetAccelerator | NetAccel.exe | NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster, browse faster, surf faster!. Only required if you find it helps improve your performance |
| X | NetAdm7 | NETADM7.EXE | Added by the BANCOS.F TROJAN! |
| X | Netapi | Netapi.exe | Added by the NETDEVIL.14 BACKDOOR! |
| X | netapi32 | netapi32.exe | Added by an unidentified TROJAN! |
| X | NetApp | winserv.exe | Added by the SHADOWTHIEF BACKDOOR! |
| N | NetAppel | NetAppel.exe | NetAppel - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype |
| U | NetAssistant | matcli.exe | "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file". NetAssistant Help is required to run with the Help and Support program. If you uncheck NetAssistant Help and then run Help and Support it will add another NetAssistant Help in the startup menu. If you remove the NetAssistant Help in the add/remove program some help menus in help and support will not be available. You decide |
| X | Netbeans | netbeans.exe | Added by the DELBOT-R WORM! |
| X | Netbios Helper | nbthlp.exe | Added by the BANKER.Y TROJAN! |
| X | NetBiosSrvc | HPSrvPrt.exe | Added by the SDBOT-COL WORM! |
| X | NetBioy Client | netbioy.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| ? | NetBrowser | NetBrowser.exe | Part of Best Network Security, 1st Network Admin and Corporate Network Security (and maybe others) - network-based password-protected security software that lets you impose access restrictions to all your PC workstations you have in your corporate network to stop users from tampering with them. The exact purpose of this startup entry is unknown at present |
| ? | NetBrowser.exe | NetBrowser.exe | Part of Best Network Security, 1st Network Admin and Corporate Network Security (and maybe others) - network-based password-protected security software that lets you impose access restrictions to all your PC workstations you have in your corporate network to stop users from tampering with them. The exact purpose of this startup entry is unknown at present |
| X | netc | svc.exe | Added by the VESLORUKI.DWK TROJAN! |
| X | netconfig | netconfig.exe | Added by the NETWARE TROJAN! |
| U | NetCruiser Dialer | NCDialer.exe | NetCruiser Dialer from NetCruiser Software. "An Internet dialer and connection monitor with features to launch applications when a connection is detected, dial and hangup at predefined times and automatic redialing of dropped connections" |
| X | netdaemon | netdaemon /v | Malware designed to "kill" a number of antispyware applications (SpyBot, Giant, SpyDoctor, SpySweeper, SpyHunter, Anvir, WinPatrol, and more) |
| X | netdll32 | netdll32.exe | Added by the CRYPTER.A TROJAN! |
| X | netdllex | netdllex.Exe | Added by the CRYPTER.A TROJAN! |
| X | NetDy | VisualGuard.exe | Added by the NETSKY.N or NETSKY.W WORMS! |
| X | netfilt4 | netfilt4.exe | Added by the TIBS.VQ TROJAN! |
| X | NETFP32.EXE | NETFP32.EXE | Added by the AGENT.CD TROJAN! |
