HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	Registry Value Name	enzxp.exe	"Added by the RBOT-BAJ WORM!"
X	Registry Value Name Start	MsPMSPSa.exe	"Added by a variant of the SDBOT WORM!"
N	RegistryBooster	RegistryBooster.exe	"RegistryBooster registry optimizer utility from Uniblue Systems Limited - which will ""clean
X	RegistryCheck	"rundll32.exe chkreg.dll	CheckRegistry"
X	RegistryChk	winbackup.exe	"Added by the MERTIAN WORM!"
X	RegistryCleanFixMFC	registrycleanfix.exe	"RegistryCleanFix rogue registry cleaner - not recommended"
X	RegistryConfig	rundll.exe	"Added by the AGOBOT-KN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	RegistryDoctor2008	registrydoctor.exe	"RegistryDoctor2008 rogue registry cleaner - not recommended
X	RegistryFix.exe	registryfix.exe	"RegistryFix rogue registry cleaner - not recommended
X	RegistryGreat.exe	RegistryGreat.exe	"Registry Great rogue registry cleaner - not recommended"
U	RegistryMechanic	RegMech.exe	"Part of Registry Mechanic from PC Tools - which ""is an advanced registry cleaner for Windows that can safely clean
U	RegistryMechanic	RMTray.exe	"Part of Registry Mechanic from PC Tools - which ""is an advanced registry cleaner for Windows that can safely clean
X	RegistryMonitor	registry.pif	"Affilred adware"
X	RegistryMonitor	sysfade.exe	"Added by the SYSFADE TROJAN!"
X	RegistryMonitor1	mljul1.exe	"Added by the SPAMBOT TROJAN!"
X	RegistryMonitor1	qtplugin.exe	"Added by the DELF-EZY TROJAN!"
X	RegistryMonitor1	igfxpers.exe	"Added by the DELF-EZZ TROJAN! Note - this is not the legitimate Intel graphics driver which has the same filename"
X	RegistryMonitor1	incognito.exe	"Added by the BUZUS.DAHY TROJAN!"
U	REGIST~1	REGIST~1.EXE	"Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for ""Send To"" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation"
X	Regkey for autostart	winservice.exe	"Added by the RBOT-NU WORM!"
U	RegKillTray	RegKillTray.exe	"DVD region killer part of CloneDVD from Elaborate Bytes AG. Copies the main movie
U	RegMech	RegMech.exe	"Part of Registry Mechanic from PC Tools - which ""is an advanced registry cleaner for Windows that can safely clean
X	Regmonitor	regmaping.exe	"Added by the BEAGLE.DO WORM!"
X	REGMSYS	[path to file]	"Added by the LOWZONE-AX TROJAN!"
X	RegMutex	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	RegPowerClean	RegPowerClean.exe	"Registry Power Cleaner rogue registry cleaner - not recommended"
Y	RegProt	Regprot.exe	"RegistryProt from Diamond Computer Systems - protects the system registry against changes"
X	Regptmens	REGPTMENS.EXE	"Added by the BANCOS-ED TROJAN!"
X	Regro	rundll132.exe	"Added by the OKARAG TROJAN!"
X	RegRun	mActiveX.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
X	REGRUN	winfix22490.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
X	REGRUN	[path to trojan]	"Added by the LOWZONE-AH TROJAN!"
X	REGRUN	regeditt.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
X	REGRUN	sory.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
X	REGRUN	dialer.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
U	RegRun WinBait	winbait.exe	"Part of RegRun - used to detect unknown viruses. RegRun compares winbait.exe with the original copy called winbait.org and warns if the files are different.."
Y	Regrun2	WatchDog.exe	"Greatis Software's RegRun security suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's
X	REGRUNM	autoprotect.exe	Added by an unidentified WORM or TROJAN!
X	Regrx	rundll32.exe	"Added by the WAYIC-A TROJAN! Note - this is not the legitimate rundll32.exe process
X	Regscan	regscanr.exe	"Added by the OPTIX-SE TROJAN!"
X	RegScan	DLLSRV32.EXE	"Added by the AGOBOT.AEW WORM!"
X	RegScan	Regscan.exe	"Added by the TALEX TROJAN!"
?	RegServer	regserve.exe	"Related to XGI Technology's Volari graphics cards - what does it do and is it required?"
X	regservices.exe	regservices.exe	"Added by an unidentified VIRUS
N	RegShave	regshave.exe	"Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers
X	regsrv	regsrv.exe	"Added by the OPTIXPRO.11 TROJAN!"
X	regsrv	scvhost.exe	"Added by the AGOBOT.E WORM!"
X	RegSrv64D	RegSrv64D.exE	"Added by the WINKO.AO WORM!"
X	regsrvc	regsrvc.exe	"Added by the STOPED-A TROJAN!"
X	Regsv	regsv.exe	Search hijacker - redirecting to scheo.com
X	Regsvc	regsv.exe	Added by an unidentified TROJAN!
X	regsvc	sysd	"Sys Detective+ spyware"
X	regsvc32	regsvc32.exe	Homepage hijacker that changes your homepage to an adult content site
X	regsvr	regsvr.exe	"Added by the WEBMONEY-G TROJAN!"
U	REGSVR32	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
X	RegSvr32	msmsgs.exe	"Added by the ZLOB.B TROJAN! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	regsync	regsync.exe	"SafeSurfing adware"
?	regtmlp	N/A	"??"
U	RegTweak	RegTwk.exe	"Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options
U	RegUpdate	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	RegVer	REGVER.EXE	"Added by the LATINUS.16 TROJAN!"
X	RegVfy32	Regverif32.exe	"Added by the SYGYP.A WORM!"
X	RegWrite	csrss.exe	"Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
Y	Regx10EXE	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
X	reg_key	FUKULAMER.exe	"Added by the BEAGLE.AH WORM!"
X	reg_key	loader_name.exe	"Added by the BEAGLE.Y or BEAGLE.Z or BEAGLE.AA WORMS!"
X	Reg_WFT	Regsysw.com	"Added by the WILSEF VIRUS!"
X	Reg_WFT	scanreg32.com	"Added by the SENNASPY-F TROJAN!"
X	Reg_WFT	Regsysw.exe	"Added by the WILSEF.A WORM!"
U	ReleaseRAM	RRAM.exe	"""Release RAM allows your computer to run faster and uses your computer's RAM more efficiently"". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	RelevantKnowledge	rlvknlg.exe	"Marketscore.RelevantKnowledge adware"
X	relinson	cmdno.exe	"Added by the DROPPER-PS TROJAN!"
X	reload	reload.vbs	"Added by the LOVELETTER.AS VIRUS!"
X	Reload	reload.exe	"Added by the LAZAR TROJAN!"
X	reluvage	ilulupac.exe	"Added by the SDBOT-UJ WORM!"
N	RemHelp	Remhelp.exe	BT Voyager ADSL Modem Help related
N	Reminder	reminder.exe	From MS Money. Reminds you of your bills
N	Reminder	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
N	Reminder	Reminder.exe	"Registration reminder for the PC Pitstop Optimize 2.0 system optimizatoon utility by CA. Located in %ProgramFiles%\PCPitstop\Optimize2"
X	Reminder	Reminder.exe	"Registration reminder for the Secure Expert Cleaner rogue privacy program - see here. Located in %ProgramFiles%\SecureExpertCleaner"
N	Reminder-cpqXXXXX	remind32.exe	Compaq printer Registration
N	Reminder-hpcXXXXX	remind32.exe	HP CD-Writer Registration
N	Reminder-ranXXXXX	remind32.exe	Registration reminder widget for Rand Mcnally maps
N	reminder-ScanSoft Product Registration	remind32.exe	Registration reminder for ScanSoft products such as PaperPort
U	RemindMe	RemindMe.exe	"Remind-Me - calendar software"
N	Remind_XP	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
X	Remndr	CsRemnd.exe	CasinoOnline foistware
U	Remote	Remote.exe	"Remote Control driver for LifeView internal and external TV products"
U	Remote Access	rnaapp.exe	"Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie
X	Remote Access Adapter	rvasvc.exe	"Added by the IRCBOT.BIF BACKDOOR!"
X	Remote Access Domain	rswsvc.exe	"Added by the IRCBOT.BFA TROJAN!"
X	Remote Access Monitor	rpgsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Remote Access Service Manager	rasmngr.exe	"Added by the AGOBOT.KU WORM!"
X	Remote Access Slave	Synchost.exe	"Added by the RIPJAC TROJAN!"
X	Remote Access Tool	rwosvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Remote Control	Rc.exe	Hinet Hi-Five ISP software
N	Remote Controller	TVRMVCR.EXE	"ProLink PlayTVpro TV tuner software"
U	Remote Data Backups	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	Remote Data Backups	COBackup.exe	"Remote Data Backups online system/data backup utility"
U	Remote Data Backups TaskBar Icon	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	Remote Desktop Computing	marspc.exe	"Marspc Remote Desktop Computing"
X	Remote Desktop Help Session Manager	WinRDH.exe	"Added by a variant of the SDBOT WORM!"
X	Remote Event System	resmsvc.exe	"Added by the IRCBOT.YF BACKDOOR!"
U	Remote Management Agent	zenrc32.exe	"Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation"
U	remote master	remote master.exe	Required if you want your ASUS Remote control to work at all. Available via Start -> Programs
X	Remote Procedure Call	winrpc.exe	"Added by the RBOT-KM WORM!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	"Added by the LOVGATE.F WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Remote Procedure Calls	mswinrpc.exe	"Added by the RBOT.KJ WORM!"
X	Remote Procedure Calls	mswinc.exe	"Added by the RBOT-IT WORM!"
X	Remote Procedure Calls	win.exe	"Added by the SDBOT-QI WORM!"
X	Remote Services Manager	msrmsvc.exe	"Added by the SLENFBOT.AJ WORM!"
X	Remote Storage Access	rmasvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
X	Remote Terminal Task	rtsbsvc.exe	"Added by the IRCBOT.AUZ BACKDOOR!"
Y	Remote Update Monitor	imonitor.exe	"Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer"
Y	RemoteAgent	RAUAgent.exe	"Trend Micro's Office Scan Client
U	RemoteCenter	RcMan.exe	"Remote control for Creative MediaSource - plays back music in DVD-Audio
U	RemoteControl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
U	RemoteControl	PDVDServ.exe	"Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
U	RemoteControl8	PDVD8Serv.exe	"Remote Control background application for Cyberlink's PowerDVD version 8. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
N	Remote_Agent	RemoteAgent.exe	"Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this
X	Remove 54tr10	smss.exe	"Added by the BRONTOK-CH WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data"
X	REMOVE ME	windos.exe	"Added by the SDBOT.EE WORM!"
X	REMOVE ME	tbbzxzxcxxcx.exe	"Added by the SDBOT-TA WORM!"
X	REMOVE ME	asclt.exe	"Added by the RANDEX-FC WORM!"
N	Removecpl	Removecpl.exe	Related to a Belkin 54Mbps Wireless Utility Control Panel applet
X	Removed.exe	Removed.exe	GatorCheat - adware downloader
U	RemoveIT Pro XT	removeit.exe	"RemoveIT Pro from InCode Solutions - spyware
?	RemStart	remstart.exe	"Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required?"
X	renascimento	svchost.exe	"Added by the BANKER.GAX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
?	RenolB	ib.exe	"??"
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
X	repl	repl.exe	"Added by the YABE.CD TROJAN!"
U	Replay Center	ReplayRadio.exe	"Replay Radio - ""makes it easy to automatically record your favorite radio shows
U	Replicator	PTReplicator.exe	"Replicator from Karen's powertools. ""Automatically backup files
U	RepliGo Assistant	RepliGoMon.exe	"Cerience RepliGo software - ""any document you have on your PC can be transferred to your mobile device"""
U	ReproPRD	PrdUsb.exe	"Thrustmaster Corporation Presets application - a game controller driver
X	requester	requester.*.exe	"Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit
X	Requester	requester.11.exe	"Added by the MUQUEST TROJAN!"
X	Required Service Drivers	micront.exe	"Added by the RBOT-ABD WORM!"
X	resagnt	restun.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
U	ResChanger2004	ResChanger2004.exe	EVGA graphic card utility providing easy access to display settings
X	reseurce	[path to trojan]	"Added by the LINEAGE-AI TROJAN!"
X	reseurce	svchost.exe	"Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Resolution Assistant	matcli.exe	"Dell Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Resource Meter	rsrcmtr.exe	Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes
X	RESpyWare.exe	RESpyWare.exe	"RESpyWare rogue security software - not recommended
?	Restart Watch	Watch.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?"
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
?	Restart_VS	Viewsonic.exe	Could be a left-over from the installation of a Viewsonic flat panel display
X	Restore	restore.exe	"Antispyware Shield Pro rogue security software - not recommended
X	Restore Operation	svchots.exe	"Added by a variant of the RBOT WORM!"
U	RestoreDesktop	RestoreDesktop.exe	"Softwarium Restore Desktop ""is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change"""
Y	RestoreIT!	VBPTASK.EXE	"RestoreIT! from FarStone - ""automatically backs up all files on your computer to a protected partition on your hard drive"""
X	restorer32_a	restorer32_a.exe	"Added by the AGENT.CQQB TROJAN!"
X	restorer64_a	restorer64_a.exe	"Added by the DLDR-BY TROJAN!"
X	restory	restory.exe	"Added by the RETSAM TROJAN!"
U	Resume Copy	copyfstq.exe	"Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function"
U	ResumeFixClocks	resumefix.exe	"Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards"
X	reszrv	[8 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	retime	retime.exe	"Added by the GIPMA TROJAN!"
U	RetrieverScheduler	retrieverscheduler.exe	"80-20 Retriever from 80-20 - ""80-20 Retriever is a powerful personal search tool that encompasses email folders
U	RetroExpress	RetroExpress.exe	"EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices"
U	RevoTaskbarApp	RevoTask.exe	Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
N	RexSyMon	rexsymon.exe	"Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC"
X	RF	EC.exe	"Added by the LINEAGE-U TROJAN!"
U	rfagent	rfagent.exe	"Registry First Aid - scans the Windows registry for orphan file/folder references
X	rforce	EXP1ORER.EXE	"Added by the DROPPER.KN TROJAN! Note the number ""1"" in the filename rather than letter ""L"". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN!"
N	RFTray	RFTRay.exe	Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
Y	rfw	Rfw.exe	"RAV AntiVirus"
Y	RfwMain	rfwmain.exe	"Rising antivirus"
?	rfwydg	rfwydg.exe	"??"
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
X	Rg2catbd	Rg2catbd.exe	Added by a variant of the BANLOAD family of TROJANS!
U	RH	rh32.exe	EuroFonts - adds Euro symbols to pre-Euro computers
X	Rhg	rundll32.exe	"Added by the LINEAG-BIT TROJAN! Note - this is not the legitimate rundll32.exe process
X	Rhino	[random name]32.exe	"Added by the BOFRA.A WORM!"
U	RhinoBlocker	RhinoBlocker.exe	"RhinoBlocker - pop-up stopper"
N	RHPTray	RHPTray.exe	"System tray access to Red Hot Pawn - online chess"
N	RHSI SHS	SHS.exe	"Rogers Hi-Speed Internet software. ""Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail
X	Riau	nmrc.exe	"PurityScan adware"
X	RichMedia	HBHelper.dll	"HenBang adware"
X	RichMedia	"rundll32.exe [path] hbcast.dll	WaitWindows"
X	richup	richup.exe	"SafeSurfing adware"
U	RightFAX Print-to-Fax Driver	FaxCtrl.exe	"Part of RightFAX from Captaris - ""the proven market leader in fax server and document delivery software"""
U	Ring Central Fax	rcenterrll.exe	Only needed if you want a PC to answer faxes automatically
X	rIOphosIs	rIOPHosIs.vBS	"Added by the RIOSYS MACRO!"
N	Riorad Manager	riomgr.exe	"""Riorad Explorer is hands-down the most advanced Windows software companion for your Rio MP3 player"""
?	RIS2PostReboot	LaunchRIS2.exe	"Part of the programming software for LEGO® Mindstorms robotic building system. What does it do and is it required?"
U	RivaTuner	RivaTuner.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTuner	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTuner Application	RivaTuner.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTuner.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerWrapper Application	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
?	RjLyraInstaller	setup.exe	"??"
U	RK Launcher	RKLauncher.exe	"RK Launcher by RaduKing - ""is a free application that will allow the user to have a visually pleasing bar at the side of the screen that is used to quickly launch shortcuts"""
U	RKLG Startup	klg.exe	"Local Keylogger Pro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	RKrx	rundll32.exe	"Added by the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process
X	RKrx	rundll32.exe	"Added by a variant of the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe
U	rmctrl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
X	rmdrfje.dll	"rundll32.exe rmdrfje.dll	[random characters]"
N	rmmon	mprmmon.exe	Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card
U	rmoc3260.dll OCX	regsvr32.exe rmoc3260.dll	"A module that contains COM components for media playback used by both RealPlayer and Windows Media Player - see here. The ""rmoc3260.dll"" file is found in %System%"
?	RMremote	RmRemote.exe	"Remote control driver for REALmagic Xcard. Is it required?"
X	rn4d	dirote.exe	"Added by the MAROON.A TROJAN!"
U	Rnaomflt	naomf.exe	"Naomi internet filtering software"
X	RNBc Test	wf32vbs.exe	"Added by the RBOT-AGR WORM!"
X	RNBc Test	bvldv32.exe	"Added by the RBOT-AJF WORM!"
U	RNBOStart	sentstrt.exe	Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
X	RNBz Test	wf32vbc.exe	"Added by the RBOT-AEY WORM!"
X	RNDc Test	wf32b.exe	"Added by a variant of the SDBOT WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list