CastleCops® - O23 List of Windows XP/NT services

Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9466.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

O23 List of Windows XP/NT services

Currently 3876 entries and growing...
Last updated on 2008-05-09 18:10:24 Eastern.

This list was originally started at SpywareAid with 730 entries and Matt gave CastleCops permission to host it. CastleCops has since (May 2005) been adding new entries to it here. The new items may not be in the original list but attempts are made to ensure the original is also updated. The full HTML list is here.

KEY:

"L" = Legitimate

"O" = Open to Debate

"X" = Malware/Bad

"?" - Unknown

ABC List: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z

Full List

Name	Status	Filename	Description
Netgroup Packet Filter (NPF)	X	npf.sys	W32/Rbot-GSI Note:Located in C:\Windows\System\Drivers (Win9x/Me), C:\%WINDIR%\System32\Drivers (XP/WinNT/2K)
NetGroup Packet Filter Driver (NPF)	X	npf.sys	Troj/Delf-EQE Note: Located in %windir%\system32\drivers
Neth	X	netid.exe	Added by an unidentified TROJAN! Note: of the Win32/Rbot Family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
Netilla SSL Tunnel Helper Service (NetillaVPNService)	L	NVPNs.exe	Related to Netilla_SSL Tunnel Helper Service. Policy Networking ties network and application access to identity and policy. Note: located in \%WINDIR%\
NETINFO	X	netinfo.exe	Added by the W32/Tilebot-J WORM! Read the link, rootkit type stealth involved.
NetLimiter (nlsvc)	L	nlsvc.exe	NetLimiter_2 shows list of all applications communicating over network.
NetLogon	X	svchost.exe -k NetLogon	Added by the Fuwudoor TROJAN!
NetLogon P2P (NFOSVC)	X	nfosvc.exe	Added by a variant of the SdBot.aad family of worms and IRC backdoor Trojans. Note: This trojan is located in C:\WINDOWS\AppPatch\
NetM (Ne)	X	win32udt.exe	Added by a variant of the SDBOT.CZD family of trojan. Note: This trojan is located in C:\%WINDIR%\
Netman	X	Netserv.dll	Troj/Protux-E
NetOp Helper ver. 7.50 (2002343) (NetOp Host for NT Service)	L	NHOSTSVC.EXE	Related to Danware NetOp products Note: Located in C:\Program Files\Danware Data\NetOp Remote Control\HOST\
NetOp Helper ver. 7.65 (2004242) (NetOp Host for NT Service)	L	NHOSTSWC.EXE	Related to Danware NetOp products
Netropa NHK Server	L	Nhksrv.exe	nhksrv.exe is a process that belongs to DELL and Compaq systems. It is used to halt any configured hotkeys while the screensaver is running.
Netropa NHK Server (nhksrv)	L	nhksrv.exe	Netropa Hotkey Server task seen only on DELL and Compaq PCs running Windows NT4/2000/XP
Netscape Update Service (NCUpdateSvc)	L	ncupdatesvc.exe	Netscape Communications Corporation updater
NetSendServer (NetSendServer)	X	NetSend.exe	Added by the Troj/Hupigon-DQ TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
netservice (DDMP)	X	netservice.exe	Troj/Delf-EXQ Note: Located in %User%\Favorites\ Turns off anti-virus applications Allows others to access the computer
NetSign AutoUpdate Service (NsAUSvc)	L	NsAUSvc.exe	Related to SecurityFocus - http://www.securityfocus.com/
nettoservice	X	time.exe	W32/Otamyu-A Note:Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K) Leaves non-infected files on computer
NetVeda Safety.Net (ipcSvc)	L	ipcsvc.exe	Related to Safety_net from Netveda. Security and advanced Internet firewall protection for all your LAN computers.
Network	?	nettcp.exe	Unknown owner: Location C:\WINDOWS\system32\nettcp.exe
Network ADSL Server (Network ADSL Server)	X	woaisaomm.exe	Added by the Troj/GrayBrd-AQ TROJAN! Note: This trojan file is found in the System32 folder.
Network Associates McShield (McShield)	L	Mcshield.exe	Related to McAfee_Virus_Shield Note: Located in \%Program Files%\Network Associates\VIRUSSCAN\
Network Associates Task Manager (McTaskManager)	L	VsTskMgr.exe	Related to Network Associates Virus protection software.
Network Client (nwclntg)	X	winlogon.exe	Added by the Boxed.E TROJAN!
Network Confg System	X	lviss.exe	WORM_SDBOT.AXG Read the link, allows remote access
Network Configuration Service (NetCfgSvr)	L	NetCfgSv.EXE	Related to AT&T http://www.anti-spy.info/process/netcfgsv.exe.html
Network Connections Sharing (RpcTftpd)	X	svchost.exe	Added by the W32.Welchia WORM! **Note - This service will be set to start manually
Network DDE Client (NetDDEclnt)	X	netddeclnt.exe	Added by the W32/Codbot-M WORM!
Network dde connections	X	service.exe	adtech.de redirections
Network DDE Connections (NETDDEC)	X	winmgnt.exe	Added by unknown malware, the file winmgnt.exe may be a Serv-U FTP server used to download other malicious files to your computer. File location is in the System32 folder.
Network DDE DSMA (NetDDEdsma)	X	svchost.exe	Added by the W32/Sdbot-BMG WORM! Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This worm file is found in the Windows or Winnt folder.
Network DDS (NetDDS)	X	NetDDS.exe	Reported as Troj/ServU-Gen See Sophos Unknown owner :Location: C:\WINDOWS\system32\NetDDS.exe
Network Devices Controller (ndcsvc)	X	random.$$$	Added by the Alnica TROJAN!
Network Devices Controller (ndcsvc)	X	random file name	Added by the Alnica TROJAN!
Network Distributed Transaction Coordinator for Workstation (MSDCSRV32)	X	mssrv.exe	Added by the PWSteal.Drorar TROJAN! Note: This trojan file is found in the Program Files\Common Files\system\ado folder.
Network DRV (NTDRV)	X	netdrvr.exe	Added by the W32/Sdbot-AZK WORM! Note: This worm file is found in the System or System32 folder.
Network Gateway Manager (npx)	X	csrsc.exe	Added by the W32/Sdbot-CPE WORM! Note: This worm\trojan is located in C:\%WINDIR%
Network helper Service (MSDisk)	X	irdvxc.exe	Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
Network Location Awareness (Network Location)	X	Network.exe	Troj/Dloadr-BBE Copies itself to %Common Files%\Microsoft Shared\MSInfo\
Network Location Manager	X	lssc.exe	Added by the Trojan.Backdoor.Gen TROJAN! Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
Network Management Center Time (W32Times)	X	TIMEMAN32.EXE	Added by the Troj/GrayBrd-AA TROJAN! Note: This worm\trojan file is found in the Program Files\Internet Explorer\plugins folder.
Network Messenger (MStdc )	L	mstdc.exe	Related to Microsoft Personal Web Server and Microsoft SQL Sever software http://www.2-files.com/process/microsoft-distributed-transaction-coordinator
Network Monitor	X	netmon.exe	Reported by Panda as the Trj/Cicos.H TROJAN! This trojan if found in the \Program Files\Network Monitor\ folder. Note: This is not the legitimate Microsoft Network Monitor (Netmon.exe) process which is legitimate to capture network traffic. Article_Q812953
Network Provision Managing Service (xmlprovman)	X	provsvc.exe	Added by the W32/Sdbot-CRS WORM! Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K)
Network Security Service	X	random	CoolWebSearch res:// variant
Network Security Service (NSS)	X	random	CoolWebSearch res:// variant
Network Security Service (__NS_Service_3)	X	sdkbj32.exe	Detected as Trojan.Agent.bi by ewido(now known as AVG-antispyware)
Network Source Engine (NSEsvc)	X	nsecvc.exe	Identified by Bitdefender as Trojan.Peed.Gen Note: located in \%WINDIR%\Help\
Network Station Task Manager (TASKSQ)	X	tasksch.exe	Added by an unknown variant of a backdoor TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\

Engine Version 2.0 by CastleCops


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 168ppm 0.238s (0.017s) Making cybercriminals unhappy since 2002*