HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
N	Remote Control	Rc.exe	Hinet Hi-Five ISP software
N	Remote Controller	TVRMVCR.EXE	"ProLink PlayTVpro TV tuner software"
U	Remote Desktop Computing	marspc.exe	"Marspc Remote Desktop Computing"
U	Remote Management Agent	zenrc32.exe	"Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation"
U	remote master	remote master.exe	Required if you want your ASUS Remote control to work at all. Available via Start -> Programs
X	Remote Procedure Call	winrpc.exe	"Added by the RBOT-KM WORM!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	"Added by a variant of the LOVGATE WORM!"
X	Remote Procedure Calls	mswinrpc.exe	"Added by the RBOT.KJ WORM!"
X	Remote Procedure Calls	mswinc.exe	"Added by the RBOT-IT WORM!"
X	Remote Procedure Calls	win.exe	"Added by the SDBOT-QI WORM!"
Y	Remote Update Monitor	imonitor.exe	"Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer"
Y	RemoteAgent	RAUAgent.exe	"Trend Micro's Office Scan Client
U	RemoteCenter	RcMan.exe	"Remote control for Creative MediaSource - plays back music in DVD-Audio
U	RemoteControl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
U	RemoteControl	PDVDServ.exe	"Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
N	Remote_Agent	RemoteAgent.exe	"Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this
X	REMOVE ME	windos.exe	"Added by the SDBOT.EE WORM!"
N	Removecpl	Removecpl.exe	Related to a Belkin 54Mbps Wireless Utility Control Panel applet
X	Removed.exe	Removed.exe	GatorCheat - adware downloader
?	RemStart	remstart.exe	"Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required?"
?	RenolB	ib.exe	"??"
U	Replay Center	ReplayRadio.exe	"Replay Radio - ""makes it easy to automatically record your favorite radio shows
U	RepliGo Assistant	RepliGoMon.exe	"Cerience RepliGo software - ""any document you have on your PC can be transferred to your mobile device"""
U	ReproPRD	PrdUsb.exe	"Thrustmaster Corporation Presets application - a game controller driver
X	requester	requester.*.exe	"Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit
X	Requester	requester.11.exe	"Added by the MUQUEST TROJAN!"
X	Required Service Drivers	micront.exe	"Added by the RBOT-ABD WORM!"
X	resagnt	restun.exe	"Adware downloader - detected by Panda antivirus as Trj/Downloader.ALQ"
X	reseurce	[path to trojan]	"Added by the LINEAGE-AI TROJAN!"
X	reseurce	svchost.exe	"Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
N	Resolution Assistant	matcli.exe	"Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Resource Meter	rsrcmtr.exe	Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes
?	Restart Watch	Watch.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?"
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
?	Restart_VS	Viewsonic.exe	Could be a left-over from the installation of a Viewsonic flat panel display
U	RestoreDesktop	RestoreDesktop.exe	"Softwarium Restore Desktop ""is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change"""
Y	RestoreIT!	VBPTASK.EXE	"RestoreIT! from FarStone "allows you to recover instantly your files
X	restory	restory.exe	"Added by the RETSAM TROJAN!"
U	Resume Copy	copyfstq.exe	"Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function"
U	ResumeFixClocks	resumefix.exe	"Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards"
X	retime	retime.exe	"Added by the GIPMA TROJAN!"
U	RetrieverScheduler	retrieverscheduler.exe	"80-20 Retriever from 80-20 - ""80-20 Retriever is a powerful personal search tool that encompasses email folders
U	RetroExpress	RetroExpress.exe	"EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices"
U	RevoTaskbarApp	RevoTask.exe	Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
N	RexSyMon	rexsymon.exe	"Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC"
X	RF	EC.exe	"Added by the LINEAGE-U TROJAN!"
U	rfagent	rfagent.exe	"Registry First Aid - scans the Windows registry for orphan file/folder references
X	rforce	EXP1ORER.EXE	"Added by the DROPPER.KN TROJAN! Note the number ""1"" in the filename rather than letter ""L"". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN!"
X	RFTray	RFTRay.exe	Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
Y	rfw	Rfw.exe	"RAV AntiVirus"
?	rfwydg	rfwydg.exe	"??"
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
U	RH	rh32.exe	EuroFonts - adds Euro symbols to pre-Euro computers
X	Rhino	[random name]32.exe	"Added by the BOFRA.A WORM!"
U	RhinoBlocker	RhinoBlocker.exe	"RhinoBlocker - pop-up stopper"
N	RHPTray	RHPTray.exe	"System tray access to Red Hot Pawn - online chess"
N	RHSI SHS	SHS.exe	"Rogers Hi-Speed Internet software. ""Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail
X	RichMedia	HBHelper.dll	"HenBang adware"
X	richup	richup.exe	"SafeSurfing adware"
U	RightFAX Print-to-Fax Driver	FaxCtrl.exe	"Part of RightFAX from Captaris - ""the proven market leader in fax server and document delivery software"""
U	Ring Central Fax	rcenterrll.exe	Only needed if you want a PC to answer faxes automatically
X	rIOphosIs	rIOPHosIs.vBS	"Added by the RIOSYS MACRO!"
N	Riorad Manager	riomgr.exe	"""Riorad Explorer is hands-down the most advanced Windows software companion for your Rio MP3 player"""
U	RivaTuner	RivaTuner.exe	"RivaTuner for tweaking nVidia graphics cards. Required if you make any changes"
U	RivaTunerStartupDaemon	RivaTuner.exe	"RivaTuner for tweaking nVidia graphics cards. Required if you make any changes"
?	RjLyraInstaller	setup.exe	"??"
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe
U	rmctrl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
N	rmmon	mprmmon.exe	Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card
?	RMremote	RmRemote.exe	"Remote control driver for REALmagic Xcard. Is it required?"
X	rn4d	dirote.exe	"Added by the MAROON.A TROJAN!"
U	Rnaomflt	naomf.exe	"Naomi internet filtering software"
X	RNBc Test	wf32vbs.exe	"Added by the RBOT-AGR WORM!"
X	RNBc Test	bvldv32.exe	"Added by the RBOT-AJF WORM!"
U	RNBOStart	sentstrt.exe	Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
X	RNBz Test	wf32vbc.exe	"Added by the RBOT-AEY WORM!"
X	RNDc Test	wf32b.exe	"Added by a variant of the SDBOT WORM!"
?	rndll2	rndll2.exe	"May be related to the DivX program as a *.dat file in the same directory had ""DivXPro505Bundle.exe"" mentioned within?"
X	rngmf	[path to trojan]	"Added by the RANKY.C TROJAN!"
X	Rnudll32	tadxtr.exe	"Added by the QQPASS-O TROJAN!"
?	rnxqh	rnxqh.exe	"??"
X	Roam04	ActiveX.exe	"Added by the ROAMER-A TROJAN!"
N	RoboForm	RoboTaskBarIcon.exe	"Roboform - password manager and web form filler. Will work without this startup entry
N	RoboFormWatcher	RoboFormWatcher.exe	"AI Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs"
U	Rocket.Time	RocketTime.exe	"Time synchronization software from Rocket Software"
?	roketpipe	rpclient.exe	"??"
X	rollbk	dsm.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	svosm.exe	"Added by the SERFLOG.B WORM!"
X	rollbk	sysup.exe	"Added by the SERFLOG.B WORM!"
X	romahere	matrixhere.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant"
X	romahere2	************.exe [* = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	romahere3	************.exe [* = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	Root_Machine	[path to trojan]	"Added by the BANCBAN-DI TROJAN!"
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process
?	ROUTD	ROUTD.exe	"??"
N	RoxAssist	RoxAssist.exe	"Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize
?	Roxio Engine	MSMNGR32.EXE	"Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN!"
N	RoxioAudioCentral	RxMon.exe	"Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. ""Includes a player
N	RoxioDragToDisc	DrgToDsc.exe	"Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly"
Y	RoxioEngineUtility	EngUtil.exe	"Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine
N	RoxWatchTray	RoxWatchTray.exe	System Tray icon installed by Roxio Easy Media Creator 8 and which allows you to configure your watched folders or to turn the “Watched Folders” feature of Roxio ON or OFF
U	RP32	rp32.exe	"ControlIT (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems."
X	RPC	MSschost.exe	"Added by a variant of the GAOBOT/AGOBOT WORM!"
X	RPC Patcher	[path to worm]	"Added by the BOLGI WORM!"
X	RPC Service	[random filename]	"Added by the AAD TROJAN!"
X	rpc Win32	shost32.exe	"Added by the RBOT-ABL WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
X	rpcc	rpcc.exe	"Added by the SPAMMIT-E TROJAN!"
X	rpcda Win32	rpcda.exe	"Added by the RBOT-AE WORM!"
X	RPCser32g	services.exe	"Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process
X	RPCserv32	services.exe	"Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserv32g	services.exe	"Added by the BOBAX.AA WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	RPCserv32g	CSRSS.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	RPCserv32g	MSDEFR.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	NB32EXT2.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process
Y	RPCSS.exe	rpcss.exe	"Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	RRMedic	rrmedic.exe	"Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there internet connection"
U	rscmpt	rscmpt.exe	"Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status"
U	rsMenu	rsMenu.exe	Synchronizes a Casio PDA with MS Outlook
X	RSPC Driver	[random filename].exe	"Added by the RBOT-SN WORM!"
X	RSPC Driver D	[random filename]	"Added by a variant of the RBOT WORM!"
?	RSRCMTZ	RSRCMTZ.exe	"??"
X	RSS	"rundll32 RSSToolbar.dll	DllRunMain"
U	RssReader	RssReader.exe	"RssReader - a free RSS reader able to display any RSS and Atom news feed (XML)"
X	RSync	netsync.exe	"SafeSurfing adware"
U	rtcdll	rtcdll.exe	"RTCDLL is ""Real Time Communication"" and is associated with Windows Messenger (the IM application
U	RTHDCPL	RTHDCPL.EXE	Realtek HD Audio Sound Effect Manager

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list