REAL

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	AdwareAlert	AdwareAlert.Exe	"Adware program
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
U	coloreal	coloreal.exe	"Makes colours sharper and brighter
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
X	MalwareAlarm	MalwareAlarm.exe	"MalwareAlarm rogue security software - not recommended
X	MEMreaload	MEMreaload.exe	"Added by the LAZAR TROJAN!"
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	MS Real Player	RealPlyr.exe	"Added by the RBOT.MR WORM!"
N	MsgCenterExe	RealOneMessageCenter.exe	"RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way"
X	MSService_v1.0	realsched.exe	"EHU adware. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
N	PCDRealtime	realtime.exe	"Apparently the monitoring device for PC Doctor Online. It provides a ""free"" examination on system files (i.e. registry)
X	PCMMRealtime	pcmm.exe	"PC MightyMax rogue security software - not recommended
Y	PP2000 Real Time Scan	PPVstop.exe	Protector Plus anti-virus software - real time scanner
N	REAL	realjbox.exe	"Real Jukebox - MP3 and music files player"
X	Real Internet Player	Reaiplay.exe	"Added by a variant of the SPYBOT WORM!"
X	Real Media Player	realplayer2.exe	"Added by a variant of the RBOT WORM!"
X	Real player updater	realupd.exe	"Added by the PARLAY TROJAN!"
X	real scheduler.hta	RealAudio.exe	"Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player"
U	Real Spy Monitor	Winrsm.exe	"Realspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Real Statics Agent	ccreal.exe	"Added by a variant of the RBOT WORM!"
X	Real-Tens	Real-Tens.exe	"DownloadWare adware"
X	RealAudio	RealAudio.exe	"Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player"
X	Realaudio Player	realaudio32.exe	"Added by the AGOBOT.AFR WORM!"
X	RealAV.exe	RealAV.exe	"Real Antivirus rogue security suite - not recommended
N	RealDownload	RealPlay.exe	Download manager. Available via Start -> Programs
X	RealDownload Express	npnzdad.exe	Advertising spyware
N	Reality Fusion GameCam SE	RFTRay.exe	Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
N	RealJukeboxSystray	tsystray.exe	System Tray icon for RealJukebox
X	realone_nt2003	moniker.exe	"Added by the SNONE.A WORM!"
X	RealP1ayer	[path to file]	"Added by the RPLAY.A TROJAN! Note that the name has a number ""1"" in place of the second lower case ""L"""
N	realplay	realplay.exe	System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X	realplay lptt01	realplay.exe	"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
X	realplay ml097e	realplay.exe	"RapidBlaster variant (in a ""RealPlay"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not RealPlayer which can have the same executable name"
N	RealPlayer	realplay.exe	System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X	RealPlayer Ath Check	rnathchk.exe	"Added by the MYTOB.AG WORM!"
X	RealPlayer Ath Check	mathchk.exe	"Added by the MYDOOM-AJ WORM!"
X	Realplayer Codec Support	realsched.exe	"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	Realplayer One	realplay.exe	"Added by the RBOT-NK WORM!"
X	Realplayer Video	RealPlay.exe	"Added by a variant of the RBOT WORM!"
X	Realplayer.exe	Realplayer.exe	"Added by the DELF.CNV TROJAN!"
N	RealPlayer2	MsgCenterExe	"RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way"
X	RealPlayerUpdater	realupd32.exe	"Added by the LOHAV-T TROJAN!"
?	Realpopup	Realpopup.exe	"RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor""
N	Realsched	realsched.exe	"Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player
U	RealSPEED	RealSPEED.Exe	"RealSPEED - tweaking utility to speed-up your internet connection"
U	Realtek AC97 Audio - Event Monitor	ALCMTR.EXE	"Realtek Azalia Audio - Event Monitor
N	Realtek HD Audio Sound Effect Manager	RTHDCPL.EXE	"Realtek HD Audio Control Panel
U	Realtek HD Sound Manager	SOUNDMAN.EXE	"Realtek Sound Manager
X	Realtek Sound Manager	Tecompntwx.exe	"Added by a variant of the IRCBOT BACKDOOR!"
U	Realtek Voice Manager	Skytel.exe	"Realtek Voice Manager
U	Realtime Audio Engine	mmrtkrnl.exe	"Associated with ALCATech BPM Studio"
Y	Realtime Monitor	realmon.exe	"Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates"
X	RealTimeProtector	winlogon.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
?	RealTimeUpdate	RealTimeUpdate.exe	"Product description in properties is ""InternetExplorerCommunicationAgent Module"" ?"
X	realtpsk	realsched.exe	"Chinese originated adware - detected by Panda as NewWeb. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name and this file is located in %System%"
N	RealTray	RealPlay.exe	System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X	RealUpdater	realupd.exe	"Added by the PARLAY or MITGLIEDER.I TROJANS!"
X	Run	real.exe	"Added by the LOVGATE.E WORM!"
U	Task Catcher Real-Time Detector	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
N	TkBell.Exe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	updatereal	realupdate.exe	Chinese originated adware
U	WCOLOREAL	coloreal.exe	"Makes colours sharper and brighter
N	WebSecureAlert	WebSecureAlert.exe	"WebSecureAlert - ""helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings
X	Windows Network Service	Realteks.exe	"Added by the RBOT-GTG WORM!"
X	Windows SYSTEM32	Realplayer.exe	"Added by the SPYBOT.ZH WORM!"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	WinHelp	realsched.exe	"Added by the LOVGATE-F WORM! Note - this is not the legitimate RealPlayer (realsched.exe) application of the same name. This one is located in %System%"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.