| Status | Autorun name | Command | Description |
| Y | Nwpopup | Nwpopup.exe | Broadcast message handler part of Novell Netware that displays server, printer and other messages |
| U | nwrecmsg | nwrecmsg.exe | Broadcast message handler part of Novell Netware that displays server, printer and other messages - can cause crashes |
| U | nwss | Sp0.exe | SpyOutside surveillance software. Uninstall this software unless you put it there yourself |
| Y | NWTRAY | nwtray.exe | Novell Netware. Displays the red "N" tray icon which can be disabled (by right-click on the icon) but is also needed by the client |
| X | nxgsvc | rundll32.exe nxgsvc.dll,start | Added by the AKBOT.BA WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "nxgsvc.dll" file is found in %System% |
| X | nxosys | rundll32.exe nxosys.dll,start | Added by the AKBOT.BD WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "nxosys.dll" file is found in %System% |
| U | nxpclient | sprtcmd.exe /P nxpclient | NetExpert - "India's first ever automated Broadband care technology." Identifies and automatically fixes typical problems that may occur with your high-speed internet service |
| X | Nxvst | cssrs.exe | Added by the GAOBOT.CD WORM! |
| X | Nxvst | lsas.exe | Added by the GAOBOT.CD WORM! |
| X | Nyet.exe | Nyet.exe | Added by the DELF.MP TROJAN! |
| X | NZ01 | NZ01.exe | Added by the SCAR-K TROJAN! |
| ? | oadaemon | oadaemon.exe | Background process that establishes connection with a C3-1000 scanner and watch general status of the device and for scanner button presses. Can it be started manually? |
| U | OADP Utility | OadpUtil.exe | Part of the Sabre computer reservations system/global distribution system (GDS) - used by airlines, railways, hotels, travel agents and other travel companies for reservations and ticketing. OADP is the Open Auxiliary Device Platform |
| Y | oahstifr | oahstifr.exe | Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." |
| X | oaiyhlyv | newdevi.exe | Added by the AGENT-QTM TROJAN! |
| U | OAKSTART | OAKSTART.EXE | Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW. |
| N | OAKTASK | OAKTASK.EXE | Taskbar utility for a "control panel" for a CD-RW |
| Y | OASClnt | oasclnt.exe | On-access real-time scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files for malware as you access, create, copy or download them |
| Y | oaui | oaui.exe | System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall, limited startup manager, tamper protection and keylogger detection whilst paid versions add features such as a mail/web shield, phishing filter and anti-malware |
| X | OB Updater | ob.exe | Added by the AGOBOT-IH WORM! |
| Y | Object Store Server | osserver.exe | Comes with HyperTextStudio. From the supplier - "The Osserver maintains the database for HyperText Studio projects - absolutely vital, it verifies all the links etc in a site. It runs as a service in NT, 2K and XP but needs to start up in Win 9.x so you'll see a DOS box for a short while during boot up." |
| X | Object_Inside.exe Nacional | Object_Inside.exe | Added by the AGENT.EKMQ TROJAN! |
| X | ObjectDock | Brico.cmd | Added by the BOBANDY-A WORM! |
| U | ObjectDock Plus | ObjectDock.exe | ObjectDock Plus from Stardock Corporation - "Organize your shortcuts, programs and running tasks into an attractive and fun animated dock." Required if you want to use standard or custom shortcuts on the dock |
| X | ObjectKernel | objectpsilog.exe | Added by the TRITE-A WORM! |
| ? | objtjprx | objtjprx.exe | ?? |
| Y | OBRCheck | check.exe | Now part of Acer Empowering Technology. "Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer, and also acts as a versatile standalone backup and recovery manager". Whilst the exact purpose of this entry isn't known it runs and closes so leave it enabled in case it's required |
| ? | obsver | obsver.exe | Part of LingoWare translating software - what does it do and is it required? |
| X | OC SpywareExpert | spywareexpert.exe | OneClick Spyware Expert rogue security software - not recommended, removal instructions here |
| N | OCAudioIni | OCAudioIni.exe | One-click Audio Converter - allows you to convert files of multiple audio formats right from Windows Explorer |
| N | ocraware | ocraware.exe | Optical Character Recognition software as part of OmniPage Limited Edition - supplied with some scanners. Scan directly into most word processor applications, such as Word, WordPerfect, etc. Available via Start -> Programs |
| U | Octoshape Streaming Services | OctoshapeClient.exe | Octoshape Live Streaming - "is a revolutionary technology that will reduce your bandwidth cost and improve the quality in sound and picture" |
| U | Octoshape Streaming Services | OctoshapeClient.exe | Octoshape Internet media delivery software - as used customers such as CNN, Deutsche Welle and NASCAR |
| X | ocx32 | ocx32.exe | Added by the ASTEF or RESPAN WORMS! |
| X | OCXUPDT32 | ocxupdt32.exe | Added by the AGOBOT-IF WORM! |
| X | OczyszczaczKomputerza | GDC.exe | OczyszczaczKomputerza Polish rogue privacy tool - not recommended. A member of the PCPrivacyTool family |
| X | OD | SYSCNTR.EXE | HotVideo dialler |
| X | od-matrxx | od-matrxx.exe | Adult dialler - xx can be any number |
| X | od-stndxx | od-stndxx.exe | Adult dialler - xx can be any number |
| X | od-teenxx | od-teenxx.exe | Adult dialler - xx can be any number |
| U | ODBC BackUp | fdxxl.exe | G Data "PC Spion". PC monitoring and surveilling software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself! |
| X | ODBCJET | ODBCJET.exe | Added by the DLOADR-ATS TROJAN! |
| X | oddworldz.exe | oddworldz.exe | Added by the MULTIDR-EG TROJAN! |
| N | Odebit Multimedia V2 | Odebit.exe | Odébit Multimedia - free French multimedia player giving access to the best of television, videos, radio, games and chat |
| N | Odebit Multimedia V3 | Odebit.exe | Odébit Multimedia - free French multimedia player giving access to the best of television, videos, radio, games and chat |
| N | Odebit Multimedia V3 - Services | Odebit.exe | Odébit Multimedia - free French multimedia player giving access to the best of television, videos, radio, games and chat |
| X | odnex | odbns.exe | Added by the AGENT-MPM TROJAN! |
| X | odnexy | odbnsy.exe | Added by the VESLORUKI.DWJ TROJAN! |
| N | Odometer | Odometer.EXE | Mouse odometer - tracks how far your pointer/arrow has traveled on the screen. Shortcut available |
| U | ODSPConfig | ODSPConfig.exe | DsktopSurveil surveillance software. Uninstall this software if you did not install it yourself |
| X | oe_drop_spam | oesrv.exe | Dropspam adware |
| Y | OE_OEM | TMAS_OEMon.exe | Related to Trend Micro PC-cillin - Internet Security 12 |
| X | Oeloader | Oeloader.exe | Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D, Adware or similar to detect and remove and to prevent it re-installing in the future see here |
| X | OEM Tools 32 | tres32.exe | Added by the RBOT.QB WORM! |
| U | OEM02Mon.exe | OEM02Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| U | OEM03Mon.exe | OEM03Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| U | OEM04Mon.exe | OEM04Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| U | OEM05Mon.exe | OEM05Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| U | OEM07Mon.exe | OEM07Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| U | OEM08Mon.exe | OEM08Mon.exe | Creative Live! Cam Console Auto Launcher. You can use the console to toggle Face Tracking ON and OFF, adjust brightness, contrast, colour, burst rate, gain, etc |
| X | OEM32 Tools | sres32.exe | Added by the RBOT.AML BACKDOOR! |
| N | OEMCLEANUP | oemreset.exe | Resets OEM installation settings at bootup. Not required unless you're new to PC's |
| U | OEMRESET | oemreset.exe | Resets OEM installation settings at bootup. Not required unless you're new to PC's |
| U | OEMRUNONCE | oemrun.exe | Windows Millennium file - used by setup when installing the OEM 'express' version of the operating system. Uncheck after setup has finished |
| U | oeplugin | bxOEPlugin.exe | noHTML for Outlook Express is an add-on that protects Outlook Express from email viruses and email scripts by converting incoming email messages from HTML format to simple text |
| ? | OEPowerPlugs | winoeinit.exe | ?? |
| Y | oeprsrv | oeprsrv.exe | Outlook Express Privacy - which "lets you control access to Outlook Express and its email message database. When you enable protection, the program disables access to the message database and address book files. As a result, when you open Outlook Express or Windows Address Book, a password will be asked for authentication." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| Y | oeprsrv.exe | oeprsrv.exe | Outlook Express Privacy - which "lets you control access to Outlook Express and its email message database. When you enable protection, the program disables access to the message database and address book files. As a result, when you open Outlook Express or Windows Address Book, a password will be asked for authentication." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| Y | oepsrv | oepsrv.exe | Outlook Express Protector from Ixis Research, Ltd - which is "designed for controlling access to Outlook Express and its e-mail and address data bases. Outlook Express Protector does not encrypt protected files and folders, however no programs can get access to them when the program is active." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| Y | oepsrv.exe | oepsrv.exe | Outlook Express Protector from Ixis Research, Ltd - which is "designed for controlling access to Outlook Express and its e-mail and address data bases. Outlook Express Protector does not encrypt protected files and folders, however no programs can get access to them when the program is active." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| X | OESET | setup60.exe | Added by the WAREZDL.28672 TROJAN! |
| X | Oesi | srts.exe | PurityScan adware |
| U | OESpamTest | OESpamTest.ExE | Kaspersky Anti-Spam |
| Y | oessrv | oessrv.exe | Outlook Express Security - which is used "to control access to Outlook Express and its databases. When it is active, Outlook Express becomes locked and no third-party programs can access its message base files and the address book. As a result, when you try to start Outlook Express, open the address book or access the files, a password will be asked to allow access." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| Y | oessrv.exe | oessrv.exe | Outlook Express Security - which is used "to control access to Outlook Express and its databases. When it is active, Outlook Express becomes locked and no third-party programs can access its message base files and the address book. As a result, when you try to start Outlook Express, open the address book or access the files, a password will be asked to allow access." If protection within the program is enabled and this entry is disabled Outlook Express will fail to run |
| N | OEXCheck | EA2Check.exe | Express Assist from AJSystems.com. Utility for use with Outlook Express to backup, restore, synchronize amongst others |
| X | Offer Companion | offers.exe | Adware |
| N | OfferBox | OfferBox.exe | OfferBox "personal shopping assistant that gathers the best offers and discounts helping users from France, Italy, Spain and soon Brazil save money on their online shopping" |
| X | Offers | offers.exe | Adware |
| X | Offica Monitor Secura Systeme | winxp_sp3.exe | Added by a variant of the RBOT WORM! |
| X | Office | Office.exe | Added by the KRAIMER.12 TROJAN! |
| X | Office Desktops | imag.exe | Added by the SPYBOT.AQR WORM! |
| U | Office Mail | off_mail.exe | Office Mail from Burrotech Ltd - "complete email solution for small/medium businesses, homes, schools and colleges. It is a small email server which forms the perfect gateway between your internal and external email" |
| U | Office Mail Alerter | om_Alerter.exe | Office Mail Alerter - "alert Office Mail users when they receive new emails" via a System Tray icon |
| X | Office Monitor | adv32.exe | Added by the SDBOT-CWO WORM! |
| X | Office Monitor | alg32.exe | Added by the RBOT-GMM WORM! |
| X | Office Monitor | nvsvc86.exe | Added by the IRCBOT.BVO BACKDOOR! |
| X | Office Monitor Secure Systema | absecure32.exe | Added by the RBOT.FPW WORM! |
| X | Office Monitor Word Exel R | svch.exe | Added by the DWNLDR-GWW TROJAN! |
| X | Office Monitor Word Exel R | u.exe | Added by the SDBOT-DEE WORM! |
| X | Office Monitor Word Exel R | [trojan filename] | Added by the IRCBOT-VX TROJAN! |
| X | Office Monitors | GoogleUpdater.exe | Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools |
| X | Office Monitorse | [path to worm] | Added by the SDBOT-CZX WORM! |
| N | Office Startup | osa.exe | On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs |
| X | Office Startup | Exploer.exe | Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries |
| N | Office Startup | Osa9.exe | On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs |
| X | Office SturtUp | osa9.exe | Added by the CLICKER-EC TROJAN! Note - this trojan is located in %Windir% and should not be confused with the Microsoft office program, located in %Program Files%\Microsoft Office\Office |
| X | Office_app | msnmrgs.exe | Added by a variant of the VBBANC-A TROJAN! |
| X | office_update | [path to trojan] | Added by the DLOADER-ZB TROJAN! |
| X | OfficeAgent | expIorer.exe | Added by the TACTSLAY.A TROJAN! Note that the filename has a capital "i" in it |
