Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
N Quicken Scheduled Updates bagent.exeQuicken background downloading module
N Quicken Startup QWDLLS.EXEQuicken option to load DLLs at startup
N QuickenSEMessage Qsemsg.exeQuicken option
N QuickFinder Scheduler QFSCHD100.exeUsed in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N QuickFinder Scheduler QFSched.exeUsed in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N QuickFinder Scheduler QFSCHD110.EXE"Used in Corel WordPerfect Office 11 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
N QuickFinder Scheduler QFSCHD130.EXE"Used in Corel WordPerfect Office X3 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
Y QuickLaunchEr QuickLaunchEr.ExeQuickLaunchEr - allows you to quickly launch programs from an icon in the system tray
N Quicklink III QL.EXEHP fax program and only needs to be in the start-up group if you allow your phone to automatically answer your phone in fax mode that is to receive faxes after a certain number of rings. Available via Start -> Programs
N Quicknote quicknote.exe"JC&MB Quicknote Virtual Scrapbook"
U QuickPassword agquickp.exeSmart card-based authentication and digital signature client software
N QuickRes QUICKRES.EXEUtility to quickly change desktop resolution - left over from Win95 Power Toys. In Win98 and above incorporated via Control Panel -> Display. Not required unless you have to change resolutions on a regular basis
N quickset quickset.exeDell taskbar icon allowing you to quickly change settings
X QuickSet mmspng.exeAdded by a variant of the IROFFER.Z TROJAN!
X Quicktime qttasks.exe"Added by the ADCLICK-AK TROJAN!"
X Quicktime shch.exe"Added by a variant of the BDOOR-EB BACKDOOR!"
X Quicktime Mediaplayer winmplyer32.exe"Added by the RBOT-PM WORM!"
X Quicktime Mediaplayr wnmplyr.exe"Added by a variant of the RBOT WORM!"
X Quicktime Pro 3.0 winuodps.exe"Added by the GAOBOT.BH WORM!"
N QuickTime Task Qttask.exeSystem Tray access to Apple's "Quick Time" viewer from version 5 onwards
X QuickTime Task qttasks.exe"CoolWebSearch parasite variant"
X Quicktime Task [random filename]"Trafficadvance dialer"
N QuickTime Update Completion x quicktimeupdatehelper.exeDifferent numbers caused by number of launches. So if 3 updates are made separately 3 would appear (in theory)
X QuicktimeMngr QUICKTIMEMNGR.EXE"Added by the WOOTBOT.AW WORM!"
X QuickTimeUpdate QuickUpdate.exe"Added by the BIFROSE-CW TROJAN!"
X Quicktlme ru.exeAdult content dialler
U QuickTV QuickTV.exe"Infra-red remote control driver for the AVerTV Studio TV tuner/personal video recoder from AVerMedia. Required if you use the remote control"
X Quickzip Ls.exeMsConnect browser hijacker and dialler
X QuickZip lu.exeMsConnect browser hijacker and dialler
N QuikShield qkshield.exe"QuikShield popup blocker - reportedly stealth installed see here"
N QuikSync QUIKSYNC.EXEUsed by Iomega drives. Available via Start -> Programs
X qwe qwe.exe"Added by the LINEAGE-F TROJAN!"
? QWERTY qwerty.exePossibly adult content related adware
X qwertybot.exe qwertybot.exe"Added by the AGENT.ALF TROJAN!"
U QWS3270 Sessions sessions.exeQWS3270 Secure terminal emulation software
X R rundll32.exe msprt.dll"Chinese originated browser hijacker - redirecting to 4199.com Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X RA Server Slave.exeAdded by the RA TROJAN!
X RabbitWannaHome rabbit.exe"Added by the MIMAIL.S WORM!"
Y Rabo Session Monitor RaboSessionMon.exe"Related to RaboBank electronic banking software"
N RaConfig2500 RaConfig2500.exe"RaLink wireless LAN configuration utility"
N RadarSync RadarSync.exeRadarsync utility comes from DFI with their latest motherboards e.g. DFI LanParty Ultra - checks for BIOS and driver updates periodically
U RadBoot RadBoot.exeRadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings
U Radio365Agent Radio365TrayAgent.exe"Radio365 - create playlists and broadcast live straight from your PC!"
U RadioSvr RadioSvr.EXEUsed to configure wire less networks. Windows automatically detects the Wireless network and it configures the network
U RAID Event Monitor iaanotif.exe"IAA Event Monitor User Notification Tool - part of Intel® Application Accelerator - ""a performance software package for desktop PCs using select Intel® chipsets"" that ""replaces the ATA drivers that come with Windows with drivers optimized for desktop and mobile PCs."" If you use the RAID version it's required to notify you if a RAID 1 disk has failed"
U RaidTool raid_tool.exeVIA V-RAID Tool - hard disk striping/mirroring utility for increased performance and reliability
U Rainlendar Rainlendar.exe"Rainlendar is a customizable calendar that displays the current month"
U Rainlendar2 Rainlendar2.exe"Rainlendar is a customizable calendar that displays the current month"
N Rainmeter Rainmeter.exeRainmeter is a customizable performance meter which can display the CPU load memory utilization etc
U RAM Idle Professional RAM_XP.exe"RAM Idle LE - ""A smart memory management program that will keep your computer running better faster and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other applications. In addition RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows."" MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U RAMASST RAMASST.exeOptionally installed with some DVD drives (LG Panasonic etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. It does not affect your ability to burn CDs. If you do not have this program running you may have some compatibility issues with burnt DVDs
X RamBooster2 rb.exe"Added by the AKAK TROJAN!"
U RAMDef ramdef.exe"Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U RAMDrive RDTask.exe"Virtual Hard Drive Pro from Farstone - ""takes a portion of your system memory and creates a RAM disk drive which functions like a physical hard drive only with much better access rates"""
U RamIdle ramidle.exe"RAM Idle LE - ""A smart memory management program that will keep your computer running better faster and longer. RAM Idle works by freeing up physical RAM wasted by Windows and other applications. In addition RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows."" MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U RAMpage RAMpage.exeSmall Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray icon or by setting a threshold that activates the program automatically or by having it run automatically when an application exits. RAMpage is free and open source
X Randex virus built for IRBMe irbme.exe"Added by the RANDEX.RH WORM!"
X random random.exe"Added by the DLOADER-KM TROJAN!"
X Random Interface Network rst.exe"Added by the DELBOT-P WORM!"
X Random Interface Network Manager rinsv.exe"Added by the DELBOT-L WORM!"
X Random Unique ID [worm filename]"Added by the XROVE-A WORM!"
X RandomWin32 mgnwin32.exe"Added by the SDBOT-DV WORM!"
U Randsoft Harmony '98 rsMenu.exe"Randsoft Harmony '98 (superseeded by Enterprise Harmony 98) for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X rant rant.exe"Added by the RBOT-ZB WORM!"
Y RapApp RAPAPP.EXE"Application protection component of BlackICE PC Protection (was Defender) firewall informing you of any modifications to programs files or folders and detecting unknown programs trying to launch"
X Rapdata ravsecs.exe"Added by the QQPASS-V TROJAN!"
X Rapdatae rabseuser.exe"Added by the QQPASS-S TROJAN!"
X Rapdatybs ravseteyns.exe"Added by the PWS-ACP TROJAN!"
U Rapid Restore rrpcsb.exe"XPoint ""Rapid Restore PC"" - a ""Managed Recovery? solution that enables IT Administrators to protect the corporate image while offloading personal data backup and recovery chores to the end user"""
X RapidBlaster rb32.exe"RapidBlaster parasite. Recommended you use RapidBlaster Killer to uninstall - see here"
X Raptelnet ravspeger.exe"Added by the QQPASS-AA TROJAN!"
X Raptelt ravspegtl.exe"Added by the QQPASS-AB TROJAN!"
Y Raptor Mobile vpnservices.exe"Symantec VPN Client used to connect to corporate networks. If unchecked must be uninstalled using Add/Remove Programs as it tightly integrates into networking"
X RasCon Remote Access Service Manager rasmngr.exe"Added by the SPYBOT.EM WORM!"
X rasctrs rasctrs.exe"Hijacker also detected as the ADWAHECK TROJAN!"
X Rase boln.exe"PurityScan/Clickspring adware"
X rasman rasman32.exe"Added by the BCKDR-QGN BACKDOOR!"
X RasMan.exe RasMan.exe"Added by the FEUTEL-H TROJAN!"
X rate.exe i11r54n4.exe"Added by the BEAGLE-I WORM!"
X rate.exe i1ru74n4.exe"Added by the BEAGLE.E WORM and variants!"
Y RAV8Tray ravtray8.exe"RAV anti-virus related"
X RavAv RavMonE.exe"Added by the RJUMPF-F WORM!"
X RavAv AdobeR.exe"Added by the RJUMP.D WORM!"
X RAVEN_VLZS.EXE RAVEN_VLZS.EXE"DownloadReceiver parasite - no longer in existence"
Y RavMon RavMon.exe"RAV AntiVirus"
X ravshell expl0rer.exe"Added by the DLOADER.MAR TROJAN!"
X Ravshell explore3.exe"Added by the PAKES.HZ TROJAN!"
X Ravshell IEXPLORER.EXE"Added by the AGENT.URZ TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X Ravshell rund1132.exe"Added by the AGENT.OKZ TROJAN!"
X Ravshell svch0st.exe"Added by the NSPM.PU TROJAN! Notice the digit ""0"" in the filename rather than the lower case ""O"""
X ravshell 1explore.exe"Added by the DLOADER.MJF TROJAN!"
Y RavStub ravstub.exe"Rising antivirus"
X ravtask rund1132.exe"Added by the DLOADER.IYT TROJAN!"
X ravtask svch0st.exe"Added by the LINEAG-AIN TROJAN!"
Y RavTask RavTask.exe"Rising antivirus"
X RavTime Mstray.exe"Added by the WUKILL.A WORM!"
Y RavTimer RavTimer.exe"RAV AntiVirus"
X RavTimer explores.exe"Added by the HOMEY-A TROJAN!"
X RavTimeXP [worm filename]"Added by the WULLIK.B WORM!"
X RavTimeXP Virus"Added by the CAGER.A WORM!"
X RavTimXP [worm filename]"Added by the WULLIK.B WORM!"
X RavUptets agetlke.exe"Added by the QQPASS-AK TROJAN!"
X RavUptkt agetlktz.exe"Added by the QQPASS-AJ TROJAN!"
X RavUptpe ravsesur.exe"Added by the QQPASS-T TROJAN!"
? rav_temp.exe rav_temp.exe"??"
X rawload [path to trojan]"Added by the DARKIRC.QZ TROJAN!"
X RAX SYSTEM scrigz.exe"Added by the MYTOB.KR WORM!"
N Ray Process Killer Prkill.exe"Ray Process Killer - clicking right mouse button produces popup menu with current active tasks. You can choose any task and click "Ok" to terminate it. Use CTRL+ALT+DEL instead"
X Raymond present friska_w32.exe"Added by the RUBBLE-C WORM!"
U razer razerhid.exe"Razer mouse driver"
X rb32 lptt01 rb32.exe"RapidBlaster variant (in a ""RapidBlaster"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X rb32 ml097e rb32.exe"RapidBlaster variant (in a ""RapidBlaster"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X rbenh ml***e rbenh.exe"RapidBlaster variant (in a ""RBEnhance"" folder in Program Files) where *** represents random digits. Recommended you use RapidBlaster Killer to uninstall - see here"
X RBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Server glossary.exe"Added by the VANEBOT-J WORM!"
X Rcf Driver rcf.exe"Added by the RANDEX.BLD WORM!"
U RCHotKey RCHotKey.exe"Part of RingCentral Call Controller™ which ""turns your PC into your personal business command center. It brings you real time control of your calls and immediate access to faxing your account Microsoft Outlook® contacts and many powerful business efficiency tools"""
X rcimlby.exe rcimlby.exe"Added by the SDBOT-DHK WORM!"
X rCron rcron.exe"""Switch"" premium rate adult content dialler variant"
X rCron dservice.exe"""Switch"" premium rate adult content dialler variant"
U RCScheduleCheck RCSCHED.EXE"Scheduler for VCOM's Recovery Commander - which ""can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running"""
X RCSync RCSync.exe"PrizeSurfer related. ""PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!"" Stealth installed malware"
U RCSystem DLLML.exe RCSystem"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system but should not be terminated unless suspected to be causing problems"
U RDClient RDCLIENT.EXE"Remote Disconnection Utility from Twiga. Used for connecting and disconnecting dial up connections on a network - only needed if there is a shared internet connection"
X RDLL RunDll16.exe"Added by the SDBOT.F TROJAN!"
X rdvs [worm filename]"Added by the ULTIMAX.B WORM!"
X Reactor3 [random name]32.exe"Added by the BOFRA.A WORM!"
X Reactor5 [random name]32.exe"Added by the BOFRA.D WORM!"
X Reactor6 [random name]32.exe"Added by the BOFRA.C WORM!"
X Reactor7 [random name]32.exe"Added by the BOFRA.B WORM!"
X Reactor8 [random name]32.exe"Added by the BOFRA.E WORM!"
X Reactor9 [random name]32.exe"Added by the BOFRA.E WORM!"
X readdb40 rundll32.exe readdb40.dll EnableRunDLL32"LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""readdb40.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
U readericon readericon45G.exeTray icon to set various configuration settings for Sunkist (and maybe other) media card readers
N REAL realjbox.exe"Real Jukebox - MP3 and music files player"
X Real Internet Player Reaiplay.exe"Added by a variant of the SPYBOT WORM!"
X Real Media Player realplayer2.exe"Added by a variant of the RBOT WORM!"
X Real player updater realupd.exe"Added by the PARLAY TROJAN!"
X real scheduler.hta RealAudio.exe"Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player"
U Real Spy Monitor Winrsm.exe"Realspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X Real Statics Agent ccreal.exe"Added by a variant of the RBOT WORM!"
X Real-Tens Real-Tens.exe"DownloadWare adware"
X RealAudio RealAudio.exe"Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player"
X Realaudio Player realaudio32.exe"Added by the AGOBOT.AFR WORM!"
N RealDownload RealPlay.exeDownload manager. Available via Start -> Programs
X RealDownload Express npnzdad.exeAdvertising spyware
N Reality Fusion GameCam SE RFTRay.exeReality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
N RealJukeboxSystray tsystray.exeSystem Tray icon for RealJukebox
X realone_nt2003 moniker.exe"Added by the SNONE.A WORM!"
X RealP1ayer [path to file]"Added by the RPLAY.A TROJAN! Note that the name has a number ""1"" in place of the second lower case ""L"""
N realplay realplay.exeSystem Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X realplay lptt01 realplay.exe"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
X realplay ml097e realplay.exe"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
N RealPlayer realplay.exeSystem Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X RealPlayer Ath Check rnathchk.exe"Added by the MYTOB.AG WORM!"
X Realplayer Codec Support realsched.exe"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X Realplayer One realplay.exe"Added by the RBOT-NK WORM!"
X Realplayer Video RealPlay.exe"Added by a variant of the RBOT WORM!"
X Realplayer.exe Realplayer.exe"Added by the DELF.CNV TROJAN!"
N RealPlayer2 MsgCenterExe"RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way"
X RealPlayerUpdater realupd32.exe"Added by the LOHAV-T TROJAN!"
? Realpopup Realpopup.exe"RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor""
N Realsched realsched.exe"Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry"
U RealSPEED RealSPEED.Exe"RealSPEED - tweaking utility to speed-up your internet connection"
X Realtek Sound Manager Tecompntwx.exe"Added by a variant of the IRCBOT BACKDOOR!"
U Realtime Audio Engine mmrtkrnl.exe"Associated with ALCATech BPM Studio"
Y Realtime Monitor realmon.exe"Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates"
X RealTimeProtector winlogon.exe"Detected by Kaspersky as the AUTORUN.DIB WORM! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
? RealTimeUpdate RealTimeUpdate.exe"Product description in properties is ""InternetExplorerCommunicationAgent Module"" ?"
X realtpsk realsched.exe"Chinese originated adware - detected by Panda as NewWeb. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name and this file is located in %System%"
N RealTray RealPlay.exeSystem Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X RealUpdater realupd.exe"Added by the PARLAY or MITGLIEDER.I TROJANS!"
X RebateNation0 RebateNation0.exe"RebateNation adware"
N Reboot Reboot.exeMS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards
U Receiver PcfaxRcv.exe"Incorporated on multifunction digital copiers (such as the MX-3500NM) Sharp's innovative PC fax driver enables users to send fax documents right from their desktop"
Y Recguard recguard.exeOn HP computers Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled it is possible to knock that completely out and force the customer to send the PC back to HP for a re-image possibly at the customer's expense
N Reclip reclip.exe"Reclip Popup Clipboard manager"
X Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} RH.DLL"SmartPops search hijacker"
N Recover N/AAdded during the installation of Comcast High Speed Internet software. During installation the system reboots and if the disk is removed a screen appears asking for the disk to be re-inserted to complete installation. Not required once installion is complete
X recover.bmp.exe Rundll.exe"Added by the ANAFTP-01 TROJAN! Note - this is NOT the Windows system file of the same name as described here"
N RecoverFromReboo RECOVE~1.EXEPart of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched this entry may be left in the registry

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list