HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
U	Remote Desktop Computing	marspc.exe	"Marspc Remote Desktop Computing"
X	Remote Desktop Help Session Manager	WinRDH.exe	"Added by a variant of the SDBOT WORM!"
X	Remote Event System	resmsvc.exe	"Detected by Trend Micro as the IRCBOT.YF TROJAN! See here"
U	Remote Management Agent	zenrc32.exe	"Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation"
U	remote master	remote master.exe	Required if you want your ASUS Remote control to work at all. Available via Start -> Programs
X	Remote Procedure Call	winrpc.exe	"Added by the RBOT-KM WORM!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	"Added by the LOVGATE.F WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Remote Procedure Calls	mswinrpc.exe	"Added by the RBOT.KJ WORM!"
X	Remote Procedure Calls	mswinc.exe	"Added by the RBOT-IT WORM!"
X	Remote Procedure Calls	win.exe	"Added by the SDBOT-QI WORM!"
X	Remote Services Manager	msrmsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Remote Storage Access	rmasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Remote Terminal Task	rtsbsvc.exe	"Detected by Trend Micro as the IRCBOT.AUZ TROJAN! See here"
Y	Remote Update Monitor	imonitor.exe	"Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer"
Y	RemoteAgent	RAUAgent.exe	"Trend Micro's Office Scan Client see here - ""Its Web-based management console gives administrators transparent access to desktop and mobile clients to coordinate automatic deployment of security policies and software updates"""
U	RemoteCenter	RcMan.exe	"Remote control for Creative MediaSource - plays back music in DVD-Audio MP3 WMA WAV and other media formats"
U	RemoteControl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control or don't wish to use one"
U	RemoteControl	PDVDServ.exe	"Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control or don't wish to use one"
U	RemoteControl8	PDVD8Serv.exe	"Remote Control background application for Cyberlink's PowerDVD version 8. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control or don't wish to use one"
N	Remote_Agent	RemoteAgent.exe	"Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this otherwise can be disabled. Available via Start -> Programs"
X	Remove 54tr10	smss.exe	"Added by the BRONTOK-CH WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data"
X	REMOVE ME	windos.exe	"Added by the SDBOT.EE WORM!"
N	Removecpl	Removecpl.exe	Related to a Belkin 54Mbps Wireless Utility Control Panel applet
X	Removed.exe	Removed.exe	GatorCheat - adware downloader
U	RemoveIT Pro XT	removeit.exe	"RemoveIT Pro from InCode Solutions - spyware virus and malware removal tool"
?	RemStart	remstart.exe	"Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required?"
X	renascimento	svchost.exe	"Detected by Kaspersky as the BANKER.GAX TROJAN! See here. Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the ""Help"" sub-folder of the Winnt or Windows folder"
?	RenolB	ib.exe	"??"
X	repl	repl.exe	"Added by the YABE.CD TROJAN!"
U	Replay Center	ReplayRadio.exe	"Replay Radio - ""makes it easy to automatically record your favorite radio shows so you can listen wherever and whenever you like"""
U	Replicator	PTReplicator.exe	"Replicator from Karen's powertools. ""Automatically backup files directories even entire drives!"""
U	RepliGo Assistant	RepliGoMon.exe	"Cerience RepliGo software - ""any document you have on your PC can be transferred to your mobile device"""
U	ReproPRD	PrdUsb.exe	Thrustmaster Corporation Presets application - a game controller driver presumably necessary for certain functions to work
X	requester	requester.*.exe	"Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit examples: requester.5.exe requester.10.exe"
X	Requester	requester.11.exe	"Added by the MUQUEST TROJAN!"
X	Required Service Drivers	micront.exe	"Added by the RBOT-ABD WORM!"
X	resagnt	restun.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
U	ResChanger2004	ResChanger2004.exe	EVGA graphic card utility providing easy access to display settings
X	reseurce	[path to trojan]	"Added by the LINEAGE-AI TROJAN!"
X	reseurce	svchost.exe	"Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
U	Resolution Assistant	matcli.exe	"Dell Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address city state etc and gets written to a log file"". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide"
N	Resource Meter	rsrcmtr.exe	Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes
?	Restart Watch	Watch.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?"
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
?	Restart_VS	Viewsonic.exe	Could be a left-over from the installation of a Viewsonic flat panel display
X	Restore Operation	svchots.exe	"Added by a variant of the RBOT WORM!"
U	RestoreDesktop	RestoreDesktop.exe	"Softwarium Restore Desktop ""is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change"""
Y	RestoreIT!	VBPTASK.EXE	"RestoreIT! from FarStone - ""automatically backs up all files on your computer to a protected partition on your hard drive"""
X	restory	restory.exe	"Added by the RETSAM TROJAN!"
U	Resume Copy	copyfstq.exe	"Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function"
U	ResumeFixClocks	resumefix.exe	"Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards"
X	reszrv	[8 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	retime	retime.exe	"Added by the GIPMA TROJAN!"
U	RetrieverScheduler	retrieverscheduler.exe	"80-20 Retriever from 80-20 - ""80-20 Retriever is a powerful personal search tool that encompasses email folders archived email and local or network file systems giving users one point of fast accurate search for all personal information"". Real-time scheduler - shortcut available"
U	RetroExpress	RetroExpress.exe	"EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices"
U	RevoTaskbarApp	RevoTask.exe	Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
N	RexSyMon	rexsymon.exe	"Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC"
X	RF	EC.exe	"Added by the LINEAGE-U TROJAN!"
U	rfagent	rfagent.exe	"Registry First Aid - scans the Windows registry for orphan file/folder references finds these files or folders on your drives that may have been moved from their initial locations and then corrects your registry entries to match the located files or folders"
X	rforce	EXP1ORER.EXE	"Added by the DROPPER.KN TROJAN! Note the number ""1"" in the filename rather than letter ""L"". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN!"
N	RFTray	RFTRay.exe	Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
Y	rfw	Rfw.exe	"RAV AntiVirus"
Y	RfwMain	rfwmain.exe	"Rising antivirus"
?	rfwydg	rfwydg.exe	"??"
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
X	Rg2catbd	Rg2catbd.exe	Added by a variant of the BANLOAD family of TROJANS!
U	RH	rh32.exe	EuroFonts - adds Euro symbols to pre-Euro computers
X	Rhino	[random name]32.exe	"Added by the BOFRA.A WORM!"
U	RhinoBlocker	RhinoBlocker.exe	"RhinoBlocker - pop-up stopper"
N	RHPTray	RHPTray.exe	"System tray access to Red Hot Pawn - online chess"
N	RHSI SHS	SHS.exe	"Rogers Hi-Speed Internet software. ""Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail the Self-Healing Software (SHS.exe) will automatically repair your settings to get you up and running in a flash"""
X	RichMedia	HBHelper.dll	"HenBang adware"
X	RichMedia	rundll32.exe [path] hbcast.dll WaitWindows	"Henbang adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	richup	richup.exe	"SafeSurfing adware"
U	RightFAX Print-to-Fax Driver	FaxCtrl.exe	"Part of RightFAX from Captaris - ""the proven market leader in fax server and document delivery software"""
U	Ring Central Fax	rcenterrll.exe	Only needed if you want a PC to answer faxes automatically
X	rIOphosIs	rIOPHosIs.vBS	"Added by the RIOSYS MACRO!"
N	Riorad Manager	riomgr.exe	"""Riorad Explorer is hands-down the most advanced Windows software companion for your Rio MP3 player"""
U	RivaTuner	RivaTuner.exe	"RivaTuner for tweaking nVidia graphics cards. Required if you make any changes"
U	RivaTunerStartupDaemon	RivaTuner.exe	"RivaTuner for tweaking nVidia graphics cards. Required if you make any changes"
?	RjLyraInstaller	setup.exe	"??"
U	RK Launcher	RKLauncher.exe	"RK Launcher by RaduKing - ""is a free application that will allow the user to have a visually pleasing bar at the side of the screen that is used to quickly launch shortcuts"""
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe Keygen.exe Keygen-Serial.exe Photoshop.CS2.KeyGen.exe and more"
U	rmctrl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control or don't wish to use one"
X	rmdrfje.dll	rundll32.exe rmdrfje.dll[random characters]	"Added by the DLOADR-ANM TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""rmdrfje.dll"" file is located in %Windir%"
N	rmmon	mprmmon.exe	Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card
U	rmoc3260.dll OCX	regsvr32.exe rmoc3260.dll	"A module that contains COM components for media playback used by both RealPlayer and Windows Media Player - see here. The ""rmoc3260.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
?	RMremote	RmRemote.exe	"Remote control driver for REALmagic Xcard. Is it required?"
X	rn4d	dirote.exe	"Added by the MAROON.A TROJAN!"
U	Rnaomflt	naomf.exe	"Naomi internet filtering software"
X	RNBc Test	wf32vbs.exe	"Added by the RBOT-AGR WORM!"
X	RNBc Test	bvldv32.exe	"Added by the RBOT-AJF WORM!"
U	RNBOStart	sentstrt.exe	Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
X	RNBz Test	wf32vbc.exe	"Added by the RBOT-AEY WORM!"
X	RNDc Test	wf32b.exe	"Added by a variant of the SDBOT WORM!"
?	rndll2	rndll2.exe	"May be related to the DivX program as a *.dat file in the same directory had ""DivXPro505Bundle.exe"" mentioned within?"
X	rngmf	[path to trojan]	"Added by the RANKY.C TROJAN!"
X	Rnudll32	tadxtr.exe	"Added by the QQPASS-O TROJAN!"
?	rnxqh	rnxqh.exe	"??"
X	Roam04	ActiveX.exe	"Added by the ROAMER-A TROJAN!"
N	RoboForm	RoboTaskBarIcon.exe	"Roboform - password manager and web form filler. Will work without this startup entry as the ""active"" component is an integrated Internet Explorer browser plugin"
N	RoboFormWatcher	RoboFormWatcher.exe	"Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs"
U	Rocket.Time	RocketTime.exe	"Rocket.Time - time synchronization software from Rocket Software"
N	RocketDock	RocketDock.exe	"""RocketDock is a smoothly animated alpha blended application launcher. It provides a nice clean interface to drop shortcuts on for easy access and organization"""
X	Roflcopteur	seman.exe	Added by an unidentified WORM or TROJAN!
N	RogueMonitor	RogueRemoverPRO.exe	"Rogue Remover PRO - utility to detect and remove misleading security programs masqerading as virus scanners spyware removers etc that lure people into buying them with false positives"
?	roketpipe	rpclient.exe	"??"
U	Rollback	RollbackTray.exe	"Added by the RollBack Rx system restore program"
X	rollbk	dsm.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	svosm.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	sysup.exe	"Added by the SERFLOG.B WORM!"
X	romahere	matrixhere.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant"
X	romahere2	************.exe [* = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	romahere3	************.exe [* = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	Root_Machine	[path to trojan]	"Added by the BANCBAN-DI TROJAN!"
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Windowsinf or Winntinf folder"
X	RosTika	RosTika.exe	"Added by the BRONTOK-BU WORM!"
?	ROUTD	ROUTD.exe	"??"
X	Router	Router.exe	"Detected by Kaspersky as the AGENT.FJN TROJAN! See here"
N	RoxAssist	RoxAssist.exe	"Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize the applications in Easy CD & DVD Creator will not recognize your recorder. After running this program you should receive the message ""Engine initialized successfully with full recorder support"". If you do not receive the message update your Virus software and then check and clean your system for viruses. After the removal of any viruses uninstall and then reinstall Easy CD & DVD Creator (use ""Add Remove Programs"" in ""Control Panel""). Can be run manually"
?	Roxio Engine	MSMNGR32.EXE	"Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN!"
N	RoxioAudioCentral	RxMon.exe	"Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. ""Includes a player media manager ripper tag and sound editor - integrated in a single application"". Not required for Roxio to work properly."
N	RoxioDragToDisc	DrgToDsc.exe	"Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly"
Y	RoxioEngineUtility	EngUtil.exe	Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine it exits after checking
N	RoxWatchTray	RoxWatchTray.exe	System Tray icon installed by Roxio Easy Media Creator 8 and which allows you to configure your watched folders or to turn the ?Watched Folders? feature of Roxio ON or OFF
U	RP32	rp32.exe	"Unicenter Remote Control (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems"
X	RPC	MSschost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	RPC Drivers	rpcall.exe	"Detected by Trend Micro as the SDBOT.FLY WORM! See here"
X	RPC Patcher	[path to worm]	"Added by the BOLGI WORM!"
X	RPC Service	[random filename]	"Added by the BDOOR-AAD BACKDOOR!"
X	rpc Win32	shost32.exe	"Added by the RBOT-ABL WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
X	RPCall_WIN2K	Kurawas.exe	"Added by the BHARAT.A WORM!"
X	RPCall_[ComputerName]	smhost.exe	"Added by the REDPLUT-B TROJAN!"
X	rpcc	rpcc.exe	"Added by the SPAMMIT-E TROJAN!"
X	rpcda Win32	rpcda.exe	"Added by the RBOT-AEE WORM!"
X	RPCser32g	services.exe	"Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCser32g1	services.exe	"Added by the PREXOT.D TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCser32g3	services.exe	"Added by the PREXOT.D TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCser32g4	services.exe	"Added by the PREXOT.E TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
X	RPCserv32	services.exe	"Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserv32g	services.exe	"Added by the BOBAX.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserv32g	CSRSS.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	MSDEFR.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	NB32EXT2.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
Y	RPCSS.exe	rpcss.exe	"Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se a program may need it to communicate with other components of itself. You could delete the program but if any abnormalities occur soon after then reinstall. Under NT deleting this critical system component will disable the OS. For a more detailed explanation see here"
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	Rr2	rundll32.exe	"Added by the LINEAG-ADI TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in an ""addins"" sub-folder"
X	RRMedic	rrmedic.exe	"Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there internet connection"
U	rscmpt	rscmpt.exe	"Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status"
X	rsmb	rsmb.exe	"Added by the WAREZOV.C WORM!"
U	rsMenu	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000. Formally Randsoft Harmony '98"
X	RSPC Driver	[random filename].exe	"Added by the RBOT-SN WORM!"
X	RSPC Driver D	[random filename]	"Added by a variant of the RBOT WORM!"
?	RSRCMTZ	RSRCMTZ.exe	"??"
X	rsrvmon.exe	rsrvmon.exe	"Detected by Kaspersky as the AGENT.NY TROJAN! See here"
X	RSS	rundll32 RSSToolbar.dll DllRunMain	"""Related Sites"" toolbar - SearchAndClick hijacker variant"
U	RssReader	RssReader.exe	"RssReader - a free RSS reader able to display any RSS and Atom news feed (XML)"
X	RsWin	lsass.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	RSync	netsync.exe	"SafeSurfing adware"
X	rtasks	rtasks.exe	"Misleading security software such as AntiSpywareSuite AntivirusPCSuite SpyGuardPro WinAntiVirus Pro 2006 - not recommended see here"
U	rtcdll	rtcdll.exe	"RTCDLL is ""Real Time Communication"" and is associated with Windows Messenger (the IM application not messenger service). It is only necessary if you use Windows Messenger. Most people use MSN Messenger instead so it is not required in those cases"
U	RTHDCPL	RTHDCPL.EXE	Realtek HD Audio Sound Effect Manager
U	RtHDVCpl	RtHDVCpl.exe	High definition audio codec driver from Realtek Semiconductor
X	rtkernsw	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	rtl.exe	rtl.exe	"Added by the TIOTUA-J TROJAN!"
N	RtlMon.exe	RtlMon.exe	Monitor for RealTek network card
Y	RTMonitor	RTMonitor.exe	"Cheyenne (now eTrust) antivirus"
X	rtos	rtos.exe	IRC trojan
?	RTStartMute	N/A	"??"
Y	rtvscn95	RTVSCN95.EXE	Real-time virus scanner component of Norton Anti-Virus Corporate Edition
U	RtWLan	RtWLan.exe	"Configuration utility for the Netgear WG111 54 Mbps Wireless USB 2.0 Adapter that ""provides wireless access to your desktop or notebook PC through the computer's USB port"""
X	RubeL	RubeL.exe	"Added by the RUBY-B TROJAN!"
X	Ruby13	Ruby13.exe	"Added by the MEXER.E WORM!"
X	Ruby14	Ruby14.exe	"Added by the FIGHTRUB-A WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list