Bleeping Computer

Welcome Guide    Blogs    Chat    Help    Search    RSS

Welcome Guest (Log In | Create Account) New Member? Join for free.

  Have a problem and would like to ask us for help? To learn how to ask your question Click Here!
  Do you have popups or other malware infecting your computer? If so, Start Here!
  Are you having trouble using this site? Then you should visit the New User Orientation Center!

BleepingComputer.com -> Startup Programs Database -> Filenames that start with R

A    B    C    D    E    F    G    H    I    J    K    L    M    N    O    P    Q    R    S    T    U    V    W    X    Y    Z    Other    HJT: F0, F1, F2, F3 · O4 · O20 · O21 · O22 · O23 Rootkit List  · Submit a Startup  · Top Submitters  Startup Index · Newest Entries · Mozilla Search Tools · WebMaster Site Tools · Status Key Startup Database Forum · Computer Help Forums · How to use the Startup Database Enter the filename or keyword you would like to search for: Advanced Search Name Filename Status Description 123456 123456.cpl X Added by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number. Please not that C:\Windows\System32\shell32.dll is a legitimate ... Read More AME_CSA amecsa.cpl N Loads ADSL modem Control Panel applet AUNPS2 AUNPS2.DLL X AlwaysUpdatedNews.com parasite related bxxs5 bxxs5.dll X BookedSpace parasite cmpciaudio CMICNFG3.CPL U Registers the Control Panel applet for a C-Media PCI sound card AsioReg ctasio.dll U ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this ... Read More REGSVR32 ctasio.dll U ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this ... Read More SoundFusion cwcprops.cpl ? Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Also fo ... Read More a70f6a1d-0195-42a2-934c-d8ac0f7c08eb E6F1873B.DLL X BrowserAid/Startium parasite related gsifinal gspndll.dll ? USB DSL modem related - [what does it do and is it required in startup? ICSDCLT Icsdclt.dll U Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networkin ... Read More desktopupdate MSA64CHK.dll X MatrixDialer related ... Read More takemp3 MSA64CHK.dll X MatrixDialer related ... Read More Rundll32_7 MSIEFR40.DLL X BrowserAid "Featured Results" hijacker variant NvCplDaemon NvCpl.dll U Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card ... Read More NvMediaCenter NvMCTray.dll U System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - ... Read More NvCplDaemon NvQtwk.dll N System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since yo ... Read More P17Helper P17.dll ? ASIO driver for the Sound Blaster Audigy & Audigy 2 series sound card - is it required in startup? ... Read More ptiupbmd ptipbm.dll ? Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. If used is it required? ... Read More windows service r.exe X Added by a variant of the TROJ_SMALL.VZ TROJAN ... Read More valuename r.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. update r00t.exe X Added by the W32/Rbot-ACO worm. When started, this infection connects to an IRC where it waits for remote commands to execute. ... Read More HOT FIX R0chis.exe X Identified by Kaspersky antivirus as a variant of the Backdoor.Win32.SdBot.cic malware. ... Read More msftp service config r3grun.exe X Added by a variant of the W32/SDBOT WORM! ... Read More Fellowes Proxy R3proxy.exe U Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended featur ... Read More [random name] r?gedit.exe X PurityScan/Clickspring adware ... Read More [random name] r?gsvr32.exe X PurityScan/Clickspring adware [random name] r?ndll.exe X PurityScan/Clickspring adware ... Read More [random name] r?ndll32.exe X PurityScan adware variant. f~a ra32.exe X Password stealer trojan webexremoteaccessagent raagtapp.exe U Related to Web_Meetings from WebEx Communications, Inc. Share and present online with anyone, anywhere. ... Read More RabbitWannaHome rabbit.exe X Added by the MIMAIL.S WORM! Rabo Session Monitor RaboSessionMon.exe Y Related to RaboBank electronic banking software Rapdatae rabseuser.exe X Added by the Troj/QQPass-S/a> Trojan. raconfig2500 RaConfig2500.exe N Related to RaLink_Config_Utility It is used to configure the RaLink Wireless LAN cards. This is a non-essential program. *Disabling or enabling it is ... Read More RadarSync RadarSync.exe N Radarsync utility comes from DFI with their latest motherboards, e.g., DFI LanParty Ultra - checks for BIOS and driver updates periodically ... Read More RadBoot RadBoot.exe U RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings ... Read More RadClock RadClock.exe Y Manages Radeon clock rate at system boot. Found in %windir%system32RadClock.exe Windows DLL Loader radeonfx.exe X Added by the W32/Poebot-E trojan. When started this infection connects to a remote IRC server where it waits for commands to execute. ... Read More Free Radio radio.exe X Added by the Downloader.Centim Trojan. radio365agent Radio365TrayAgent.exe U Related to Radio365 Create playlists and broadcast LIVE straight from your PC! ... Read More RadioSvr RadioSvr.EXE U Used to configure wire less networks. Windows automatically detects the Wireless network and it configures the network ... Read More Microsoft radnom.exe X Added by the W32/Rbot-GHO worm and IRC backdoor. rdshost rafba.dll X A variant of the IRCBot family of worms and IRC backdoor Trojans. OrigRage128Tweaker RAGE128TWEAK.EXE U Third party tweaker for ATI Rage 128 Video cards from http://www.rageunderground.com ... Read More logmein gui ragui.exe U RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, a ... Read More raidhost raidhost.exe X Added by the Troj/Agent-LID Trojan. highpoint ata raid management software raidman.exe Y Related to RAID_management_software Products from HighPoint Technologies. Note: located in C:\Program Files\HighPoint Technologies, Inc\HighPoint ATA ... Read More raidtool raid_tool.exe U Related to VIA_RAID_Tool from VIA Technologies. This is the VIA Raid configuration ... Read More rainit RAinit.dll Y Associated with Remotely Anywhere. rainlendar Rainlendar.exe U Rainlendar is a customizable calendar that displays the current month. ... Read More Bron-Spizaetus RakyatKelaparan.exe X Added by the W32/Brontok-I worm. Msn Service raloded.exe X Added by the W32/Mytob-DY worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More LogMeIn Maintenance Service RaMaint.exe U RemotelyAnywhere is a remote administration and remote control applications for Windows. ... Read More RAMASST RAMASST.exe U Optionally installed with some DVD drives (LG, Panasonic, etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. ... Read More RAMBooster.Net RAMBooster.exe U The Ram Booster .NET memory optimizer. RAMDef ramdef.exe U Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. Some users swear by programs such as this but I suggest yo ... Read More RamIdle ramidle.exe U RAM Idle - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by  freeing up physical ... Read More RAMpage RAMpage.exe U Small Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray ... Read More RamPrx RamPrx.dll X Identified by Kaspersky as a variant of the Trojan.Win32.Agent.evy Trojan. RamRunOnce RamRunOnce.dll X Identified by Kaspersky as a variant of the Trojan.Win32.Agent.evy Trojan. run= ramsys.exe U Advanced Startup Manager from Rays Lab FPU mainboard extention ramvxt.sys X Variant of the Troj/Haxdor-Fam rootkit. ram idle professional RAM_XP.exe U RAM_Idle - a memory management program which manages the free RAM that is available to Windows, thus preventing your computer from running progressive ... Read More RandomWin32 rand32.exe X Added by the Troj/SdBot-HG worm. When started, this infection connects to an IRC server where it waits for remote commands to execute. ... Read More windows update checker random file names X adware downloader trojan random random.exe X Added by Troj/Dloader-KL. rant rant.exe X Added by the W32/Rbot-ZB WORM/IRC backdoor Trojan! RapApp RAPAPP.EXE Y Application protection component of BlackICE PC Protection (was Defender) firewall, informing you of any modifications to programs, files or folders a ... Read More Rapid Antivirus Rapid Antivirus.exe X Added by the RapidAntivirus rogue anti-spyware program. {28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} raping.exe X Identified as a variant of the IRC-Worm.Win32.Small.be worm. RaptorDefence RaptorDefence.exe X Added by the RaptorDefence rogue anti-spyware program. NtmsSvc rar2.com X Added by the Troj/GrayBrd-CB backdoor Trojan. {6598FF45-DA60-F48A-BC43-10AC47853D56} rarjfpi.dll X Added by the PWS-OnlineGames.q password-stealing Trojan for online games. macromedia critical updater rarww.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More NET-SERVICES rascal32.exe X Added by the W32/Otakbokep-A worm. <not used> rascal32.exe X Added by the W32/Otakbokep-A worm. rasctrs rasctrs.exe X Hijacker, also detected as the ADWAHECK TROJAN! ... Read More rasdfgl32 rasdfgl32.exe X Added by the W32/Tilebot-CH worm and IRC backdoor. RasMan.exe RasMan.exe X Added by the Troj/Feutel-H keylogging backdoor trojan. rasman rasman32.exe X Added by the Troj/Bckdr-QGN backdoor Trojan. Microsoft DirectX rasmngr.exe X Added by a variant of the RBOT WORM! RasCon Remote Access Service Manager rasmngr.exe X Added by the SPYBOT.EM WORM! <not used> rasmnlht.dll X Added by the W32.Stration.D@mm mass-mailing worm. W32.Stration.D@mm is a mass-mailing worm that gathers email addresses from the compromised computer. ... Read More rasmvc.exe X Unknown malware. Windows Defendar RatBot.exe X A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans. WINDOWS VISTA UPDATA DEFENDAR RatBot.exe X A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans. RemoteAgent RAUAgent.exe Y Trend Micro's Office Scan Client, see here - "Its Web-based management console gives administrators transparent access to desktop and mobile clients t ... Read More UpDate RAuth.exe X Added by the Troj/Dloader-UL Trojan downloader. Microsoft Autorun9 Ravasktao.exe X Added by the W32.Ogleon.A worm. W32.Ogleon.A is a worm that spreads through removable storage devices. It also drops a copy of Infostealer.Gampass, on ... Read More Rising Scan Services RavCopy.exe X Added by the Troj/Bckdr-QSU backdoor Trojan. RAVEN_VLZS.EXE RAVEN_VLZS.EXE X Another eAcceleration program - spyware. Read their privacy statement here RavMon RavMon.exe Y RAV AntiVirus RavMont RavMon.exe X Added by the W32/VB-CYK worm. <not used> RAVMOND.exe X Added by a variant of the LOVGATE WORM! Rising RealTime Monitor Ravmond.exe Y Related to Rising Antivirus. RavAV RavMonE.exe X Added by the Troj/Bdoor-DIJ backdoor Trojan. WinsRavon Ravon.exe X Added by the Troj/QQPass-ALV keylogger Trojan. ravqjmon ravqjmon.exe X Added by the Trojan-Downloader.Win32.Agent.dey Trojan. Rapdata ravsecs.exe X Added by the Troj/QQPass-V Trojan. RavUptpe ravsesur.exe X Added by the Troj/QQPass-T Trojan. Rapdatei ravseteyi.exe X Added by the Troj/QQPass-AO Trojan. Rapdatybs ravseteyns.exe X Added by the Troj/PWS-ACP password-stealing Trojan. Update.exe ravseuper.exe X Added by the Troj/QQPass-P password-stealing Trojan. This also installs a file named winpose.dll in the Windows %System% directory that can be delete ... Read More Raptelnet ravspeger.exe X Added by the Troj/QQPass-AA Trojan. Raptelt ravspegtl.exe X Added by the Troj/QQPass-AB Trojan. Rapdeyer ravspepts.exe X Added by the Troj/LegMir-DZ information stealing Trojan for the online game Legend of Mir. ... Read More RavTimer RavTimer.exe X RAV AntiVirus RAV8Tray ravtray8.exe Y RAV anti-virus related ravztmon ravztmon.exe X Added by the rojan-PSW.Win32.OnLineGames.cei information-stealing Trojan. rav_temp.exe rav_temp.exe ? ?? Shell ray.exe X Homepage hijacker re-directing browsers to adult content websites SfKg6w rayiou.exe X Identified as the Trojan-Downloader.Win32.Agent.buo Trojan. This file can also be found in the %StartupFolder%. ... Read More CaptionMgr32 raz32.exe X Added by the W32/VBSun-A WORM! razer razerhid.exe U Related to Razer diamondback mouse driver its offers task bar changes for buttons / movements. ... Read More Tarantula razerhid.exe U Related to Razer Tarantula mouse driver its offers task bar changes for buttons / movements. ... Read More Copperhead razerhid.exe U Related to Razer CopperHead mouse driver its offers task bar changes for buttons / movements. ... Read More DeathAdder razerhid.exe U Related to Razer DeathAdder mouse driver its offers task bar changes for buttons / movements. ... Read More razertra razertra.exe Y razer diamondback mouse driver ... Read More RazeSpyware RazeSpyware.exe X Added by the RazeSpyware rogue anti-spyware application. RazeSpyware is a program claiming to remove spyware, even from those computers which are clea ... Read More RazeSpyware Monitor RazeSpyware_monitor.exe X Added by the RazeSpyware rogue anti-spyware application. RazeSpyware is a program claiming to remove spyware, even from those computers which are clea ... Read More razor.exe razor.exe X Added by the W32/SillyFDC-AY worm. RamBooster2 rb.exe X Added by the AKAK TROJAN! RapidBlaster rb32.exe X Homepage hijacker (adult content) - see this newsgroup thread rb32 lptt01 rb32.exe X Variant of the RapidBlaster parasite (in a "RapidBlaster" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use ... Read More rb32 ml097e rb32.exe X Variant of the RapidBlaster parasite (in a "RapidBlaster" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use ... Read More rbenh ml***e rbenh.exe X Variant of the RapidBlaster parasite (in a "RBEnhance" folder in Program Files) where *** represents random digits. It is not recommended you manuall ... Read More rBot.exe rBot.exe X A variant of the IRCBot family of worms and IRC backdoors. : rbot.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Microsoft Update Machine rBot.exe X Added by the Troj/Drop-AF Trojan. sl4 rules rbot32.exe X Added by the W32/SDBOT-QC WORM! ... Read More {67525E1B-5B8E-41d4-AFCC-03CC04F141FA} rbsgam.dll X Added by the Trojan.Nethell Trojan. Trojan.Nethell is a Trojan horse with keylogging capabilities that can download commands from a remote comp ... Read More WinUpdate RBSKQQBO.EXE X Added by the VBSWG2B.A WORM! MicrosoftUpdate RBuilder.exe X Added by the Troj/Dloadr-BMV Trojan. Remote Control Rc.exe N Hinet Hi-Five ISP software RC.exe RC.exe U Remote control software for the AVerTV DVB-T PC HDTV tuner. ElsaCapiCtl Rcapi.exe Y Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there ... Read More <not used> rcbwmpd.dll X Added by the WORM_STRATIO.MY mass-mailing worm. Soot rcea.exe ? ?? Ring Central Fax rcenterrll.exe U Only needed if you want a PC to answer faxes automatically Rcf Driver rcf.exe X Added by the RANDEX.BLD WORM! RegClean Expert Scheduler RCHelper.exe U Required to run scheduled Registry cleanings. .norton rchost.exe X Added by a variant of the BOXED-A TROJAN! rcimlby.exe rcimlby.exe X Added by the W32/Sdbot-DHK worm and IRC backdoor. LTCISI rckit.exe X Added by the W32/IRCBot-YJ worm and IRC backdoor. Inters Configuration Loader RCL0ADERS.exe X Added by the W32/Sdbot-KX worm. When started this infection connects to an IRC server where it waits for remote commands. ... Read More RemoteCenter RcMan.exe U Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats ... Read More {b23dc537-3e13-44c7-bf67-d8405eb377f7} rcohty.dll X Part of the Zlob trojan that displays fake security alerts for the rogue anti-spyware program called SpywareLocked. ... Read More rCron rcron.exe X "Switch" adult content dialler RCScheduleCheck RCSCHED.EXE U Scheduler for VCOM's Recovery Commander - which "can restore your non-booting system back to normal. It only takes a few minutes to get your system ba ... Read More RCSync RCSync.exe X PrizeSurfer related. "PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping onli ... Read More buzme RCUI.exe U Display Client for the BuzMe Internet Call Waiting Service. ... Read More RDClient RDCLIENT.EXE U Remote Disconnection Utility from Twiga. Used for connecting and disconnecting dial up connections on a network - only needed if there is a shared int ... Read More rdshost rdfhost.dll X Added by the W32/IrcWorm-A worm and IRC backdoor. {3D38667C-CF08-4060-BAD3-30797B8FE363} rdihost.dll X Added by the W32/IRCBot-VR worm and IRC backdoor. RDP Host Device Driver rdpdrv.sys X Added by the Backdoor.Sanjicom backdoor Trojan. RDPlatinum v5 RDPlatinumv5.exe X Added by the Registry Defender Platinum rogue registry cleaning software. rdriv rdriv.sys X A rootkit bundled with various infections in order to hide them. rdrVR2 rdrVR2.dll X Added by the Troj/Haxdoor-AJ backdoor Trojan. rdshost rdshost.dll X Identified as the Backdoor.Win32.IRCBot.aaq worm and IRC backdoor. RAMDrive RDTask.exe U Virtual Hard Drive (Ram Drive) takes a portion of your system memory (RAM) and uses it to simulate a hard disk drive. For more information see FarSton ... Read More Microsoft Software10 re101.exe X Added by the Troj/Bckdr-QNV backdoor Trojan. RealP1ayer rea1p1ayer.exe X Added by the Trojan.Rplay.A Trojan! Files are located in the C: drive or in the folder where the trojan was run. ... Read More RealP Rea1P1ayer.exe X Added by the Trojan.Rplay.A Trojan! Files are located in the C: drive or in the folder where the trojan was run. ... Read More WinReader read.exe X Added by the W32/Delbot-V worm and IRC backdoor. Microsoftz turn Control read.pif X Added by the W32/Rbot-AFS worm. When started, this infections connects to a remote IRC server where it waits for commands to execute. ... Read More User32 Read101.exe X Added by Backdoor.Cyn. This infection listens on ports 15432 and 51234 awaiting remote commands. ... Read More readericon readericon45G.exe N Tray icon to set various configuration settings for Sunkist media card readers. Mobipocket Reader Notifications readernotify.exe N Added by the MobiPocket Blackberry Bookreader software. reader_s reader_s.exe X Added by the Troj/Agent-IUT Trojan. This infection is also known to infect your computer with the Virut virus as well as other malware. Due to Virut ... Read More Adobe Reader Speed Launch reader_sl.exe N Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly ... Read More Adobe Reader Speed Launcher Reader_sl.exe N Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly ... Read More adobe reader speed lauch READER~1.EXE N Speeds up the lauch of Adobe (Acrobat) Reader 7 gouday.exe readme.exe X Added by the BEAGLE.C WORM! eomsistem readme.exe X Added by the W32.Racita.A worm. W32.Racita.A is a worm that copies itself to mapped drives D through H. It also attempts to lower security settings on ... Read More winlogin ReadMe.exe X Added by the W32.SillyFDC.BBT removable media worm. Firewall config ReadMe.exe X Added by the W32.SillyFDC.BBT removable media worm. readme Driver readme.VBS X Added by the W32/VB-CTH worm. Vista ReadyService readysrv.exe X Added by the W32/Sdbot-CTZ worm and IRC backdoor. Real Internet Player Reaiplay.exe X Added by a variant of the SPYBOT WORM! atidriver reaIplayer.exe X Added by the W32/WarPigs-E worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More real scheduler real scheduler.hta X Added by the CEEGAR TROJAN! ... Read More Real-Tens Real-Tens.exe X DownloadWare based advetising spyware run= real.exe X Added by a variant of the LOVGATE WORM! Service real.exe X Added by the W32/Rbot-CUG worm and IRC backdoor. RealUpdate real.exe X Added by the Troj/DwnLdr-FUU downloader Trojan. <not used> real.exe X Added by the W32.Snaban worm. W32.Snaban is a worm that spreads by copying itself to removable drives and network drives on the compromised computer. ... Read More RealAudio RealAudio.exe X Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player ... Read More real scheduler.hta RealAudio.exe X Added by the CEEGAR TROJAN! Realaudio Player realaudio32.exe X Added by the Worm.AGOBOT-VA.Process network worm and IRC backdoor. RealAV RealAV.exe X Added by the RealAV rogue anti-spyware program. Java inetice realetin.exe X Added by the Troj/Bckdr-PQM Trojan. real realjbox.exe N Related to Real_Jukebox which allows you to play your MP3 and music files. This is a non-essential process. Disabling or enabling this is down to use ... Read More Realtime Monitor realmon.exe Y Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates ... Read More [not used] realone.exe X Added by the Troj/LegMir-AU Trojan. msgcenterexe RealOneMessageCenter.exe N RealNetworks RealPlayer related - disabling this application will not affect Real Player in any way. ... Read More RealP1ayer realp1ayer.exe X Added by the Trojan.Rplay.A Trojan! Files are located in the C: drive or in the folder where the trojan was run. ... Read More RealDownload RealPlay.exe N Download manager. Available via Start -> Programs realplay lptt01 realplay.exe X Variant of the RapidBlaster parasite (in a "RealPlay" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use Rap ... Read More realplay ml097e realplay.exe X Variant of the RapidBlaster parasite (in a "RealPlay" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use Rap ... Read More Realplayer One realplay.exe X Added by the RBOT-NK WORM! RealTray RealPlay.exe N System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happen ... Read More realplay realplay.exe N System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happen ... Read More Realplayer Video RealPlay.exe X A variant of the Win32/Rbot.IAK family of worms and IRC backdoor Trojans. QQ2007I RealPlayeg.exe X Added by the W32/Autorun-HY removable media worm. wintask dll RealPlayer Ath Check X Added by the W32.Mytob.AG@mm worm. W32.Mytob.AG@mm is a mass-mailing worm that uses its own SMTP engine to send an email to addresses that it gathers ... Read More Real Media Player realplayer2.exe X A variant of the Backdoor.Win32.Rbot.bng family of worms and IRC backdoor Trojans. ... Read More this change me realplayers.exe X Added by the W32/Tilebot-HF worm and IRC backdoor. This infection utilizes the rdriv.sys rootkit to hide itself. W32/Tilebot-HF spreads ... Read More ms real player RealPlyr.exe X Added by the RBOT.MR WORM! ... Read More Realpopup Realpopup.exe ? RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor" ... Read More tkbellexee realschd.exe X Added by an unidentified downloader TROJAN! Realsched realsched.exe N Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform th ... Read More TkBell.Exe realsched.exe N Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. Not required - see here for more i ... Read More TkBellExe realsched.exe N Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. Not required - see here for more i ... Read More WinHelp realsched.exe X Added by a variant of the LOVGATE WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name ... Read More Realplayer Codec Support realsched.exe X Added by the W32/Agobot-AAD worm. When started, this infection connects to an IRC where it waits for remote commands to execute. ... Read More MSService_v1.0 realsched.exe X Added by the EHU Installer adware. realspeed RealSPEED.Exe U Related to Stay_Alive Stay connected even after a period of inactiviry on the net. ... Read More Realtek Sound Manager Realtek.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Realtek_Audio Realtek.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More RealtekAC RealtekAC.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More Windows Network Service Realteks.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. PCDRealtime realtime.exe N Apparently the monitoring device for PC Doctor Online. It provides a "free" examination on system files (i.e. registry), reports the number of errors ... Read More eTrust RealTimeMon.exe X Added by the Troj/Delf-EPG destructive Trojan. Troj/Delf-EPG may delete data in files and stop the computer from booting. ... Read More RealTimeUpdate RealTimeUpdate.exe ? Product description in properties is "InternetExplorerCommunicationAgent Module" ? ... Read More Real player updater realupd.exe X Added by the PARLAY TROJAN! RealUpdater realupd.exe X Added by the PARLAY or MITGLIEDER.I TROJANS! RealPlayerUpdater realupd32.exe X Added by the Troj/Lohav-T backdoor Trojan. [not used] realupd32.exe X Added by the Troj/Mitglie-B backdoor Trojan. updatereal realupdate.exe X Identified as a variant of the Trojan-Downloader.Win32.Small.dts malware. rebatenation0 RebateNation0.exe X WebRebates adware variant ... Read More Reboot Reboot.exe N MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards ... Read More System Reboot rebootsys.exe X Added by W32/Rbot-WU, a WORM/backdoor, found in the Windows system folder. Diesel Recalculate.exe X Added by the LAZAR trojan downloader. netservices recall.exe X Added by a variant of the SDBOT WORM! Recguard recguard.exe Y On HP computers, Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled, it is possible to knock that comple ... Read More winldr Rechnung.pdf.exe X Added by the DOWNLOADER-ACS TROJAN! ... Read More Reclip reclip.exe N Reclip Popup Clipboard manager mmsys recover.exe ? ?? RecoverFromReboot RecoverFromReboot.exe N This program is used by installation programs to restart the installation from the previous point it was at it before the reboot. It is commonly used ... Read More Windows Recovery Console recovery.exe X Added by the WORM_RANSOM.FD worm. This worm will encrypt files found on your drive and then require you to purchase a program that will decrypt them. ... Read More RecoverFromReboo RECOVE~1.EXE ? ?? RecoverFromReboot RECOVE~1.EXE ? ?? Internet recruit.exe X Added by the W32/Rbot-AJG worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More RecShe RecSche.exe N Recording scheduler for WatchTV Capture Card (TV Tuner card) mysvcig38 recsl.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Time jugs Rect Bike.exe X Added by the Adware.Memini adware. Adware.Memini is a program that displays advertisements. ... Read More Recycler DO NOT MODIFY recyclecl.exe X Added by the W32/Rbot-BCD worm and IRC backdoor. dll Recycled.exe X Added by the W32/Setrox-B worm. Recycle Bin Handler recycler.exe X Added by the Troj/Shuckbot-A Trojan/IRC backdoor! [not used] RECYCLER.exe X Added by the Troj/Agent-AET password-stealing Trojan. Windows Recycled Recycler.exe X Added by the W32.Lecna.H worm. W32.Lecna.H is a worm that spreads by copying itself to mapped drives. It also opens a back door and may download poten ... Read More [random name] REDAEMON.EXE X Added by the W32/RpcSdbot-B worm. redbook redbook.sys Y According to this MSDN article, "The Redbook system driver (Redbook.sys) is the KS filter that manages the rendering of CD digital audio. The Redbook ... Read More Red Flag redflag.exe N PMS prediction program with modes for guys and girls - no longer available RedGirl RedGirl.exe X Added by the Troj/Agent-GVO Trojan. redirect redirect*.exe X Dotcomtoolbar/Linksummary hijacker installer - where * is a random digit McAfee Redirector Service redirsvc.exe Y Related to Mcafee Security Products. logons redist.dll X Added by the Troj/Dloadr-UY downloader Trojan. reek 32 server reek32.exe X Added by the RANDEX.AL WORM! ... Read More Referee referee.exe U MediaComm's monitor for file association changes. Stop rogue programs from screwing your settings either on installation or whenever they run ... Read More Macrium Reflect Image Mounting Service ReflectService.exe U Related to the Reflect disk imaging and backup software. Refresh Refresh.exe N (Iomega) Refresh - loads the Iomega desktop icons at startup Refreshlock Refreshlock.exe Y Tool used to lock the refresh rate of your monitor in Windows XP. vuaaa reg.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More Reg Reg.hta X Homepage hi-jacker. Removal instructions here System REG1.exe X Added by the Troj/PcClien-FP IRC backdoor Trojan. EReg reg32.exe N EReg is a software registration tool incorporated on products such as those by Brøderbund, Connectix, Hewlett-Packard, The Learning Company, and Sierr ... Read More Reg32 Reg32.exe X Hijacker - redirecting to only-virgins.com reg32 reg32.exe X Added by the NOUPDATE.B TROJAN! Microsoft System Firewall 2006.2 reg32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Reg32 reg33.exe X CoolWebSearch parasite variant Regcaioft REGCAIOFT.EXE X added by the Troj/Bancos-BV TROJAN! Registry Cleaner Regclean.exe X Supposed registry cleaner installed via misleading popups. RegClean RegClean.exe X Added by the RegClean rogue registry cleaner. Card Monitor REGCNT09.exe N For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs ... Read More RegCompact RegCompact.dll Y Related to AMUST Registry Cleaner 3.5. SAClient RegCon.exe N AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded ... Read More RegCompres Regcpm32.exe X Added by the POLDO.B TROJAN! RegCompres REGCPM32.EXE X Adult content dialler - see here. This has to be cleared at the same time as MSStartOptimizer (WINUPD.EXE), atisrc2 (windfind.exe) and mmxrun (msosa.e ... Read More Regcxdinaf REGCXDINAF.EXE X A variant of the Bancos TROJAN adds this file. Regcxn Regcxn.exe X Added by the COIBOA-D TROJAN! Regcxsjaftp REGCXSJAFTP.EXE X Added by the Troj/Bancos-AE password-stealing trojan. This infection targets users of Brazilian banks. ... Read More regdefend regdefend.exe U RegDefend is a configurable, kernel based registry protection system, designed to intercept selected changes before they occur, thus also preventing ... Read More Register DLL Driver regdll.exe X Added by the W32/Sdbot-CXB worm and IRC backdoor. Optim1 regdtopt.exe X Added by the Trojan.Ramvicrype Trojan. Optim2 regdtopt.exe X Added by the Trojan.Ramvicrype Trojan. Optim3 regdtopt.exe X Added by the Trojan.Ramvicrype Trojan. Optim4 regdtopt.exe X Added by the Trojan.Ramvicrype Trojan. rege2usb rege2usb.dll X Added by a variant of the Goldun.Fam Trojan. This infection utilizes the regepsrvc.sys rootkit to stealth itself. ... Read More @ regedit -s ..win.dll X Added by the SEEKER.K TROJAN! win regedit -s ..win.dll X Added by the SEEKER.K TROJAN! spp regedit -s spp.reg X IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/ ... Read More system regedit -s system.dll X Homepage hijacker tour regedit ..tour.reg N Edits registry values to keep the WinMe tour in Task Scheduler DJREGFIX regedit /s c:\hpdjregfix.reg N DJRegFix showed up first in WinME as a "clever" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were h ... Read More sys regedit /s sys.reg X Added by the Adware.Raxums hijacker. When cleaning this infection you do not want to delete the regedit program, but rather delete the sys.reg file. ... Read More tourpath regedit /s [path] tour.reg N Edits registry values to keep the Win 2000 "tour" in Task Scheduler sp regedit-s .... sp.dll X Malicious javascript annoyance that changes the default search engine in IE to one of many including "topsearcher". See here for more and a fix ... Read More NeroCheck regedit.exe X Added by the DOOMJUICE.B WORM! Note - this is not the valid Ahead Nero CD burning program. Also it is not the valid Windows registry editor which resi ... Read More regedit regedit.exe X Added by the BRID.A WORM! Note - resides in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP). The valid "reg ... Read More Registry Editor regedit.exe X Added by the W32/Codbot-U backdoor Trojan. regedit regedit.exe X Added by the W32.Ganbate.A worm. W32.Ganbate.A is a worm that spreads through removable storage devices. It may also attempt to disable certain system ... Read More Microsoft Regestry Edit Manager regedit.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. This infection should not be confused with the legitimate C:\Windows\regedit.exe. ... Read More SystemSearch regedit.exe -s c:\ie.reg X Installs a Seachxl.com browser page hijack SystemSearch regedit.exe -s c:\sys.reg X Installs a i--search.com browser page hijack SysSearch Regedit.exe -s [path] pcsearch.reg X Added by the StartPage-FN browser hijacker SysSearch REGEDIT.EXE -s [path] sysreg.reg X Added by the STARTPA-ME TROJAN! Data789 Regedit.exe ....data789.tmp X Homepage hijacker Internal regedit.exe /s %windir%c:\[month number] X Added by the FORTNIGHT.D TROJAN! PowerSet Regedit.exe /s ...PowerSet_8100_CU.REG ? Appears to be Toshiba power management related OPQFile regedit.exe /s ...rad03FA6.tmp X Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit ... Read More setupuser regedit.exe setupuser.log X Regfile in disguise - another CoolWebSearch parasite variant Secure64 Regedit32.com X Added by the W32/Brontok-CJ worm. RegEdit32 RegEdit32.exe X Added by the W32/Voumit-A P2P worm. Microsoft Regestry Manager regedit32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Service Registry NT Save regeditnt.exe X Added by Troj/Bancos-BM TROJAN to steal passwords and download code from websites. ... Read More Regedit regedits.exe X Added by the Troj/Bancban-QV Trojan. regrun regeditt.exe X Added by the WIN32.AGENT.MM Trojan dropper! tsx regedlt.exe X Added by the W32/Sdbot-KA worm. When started this infection connects to an IRC server where it waits for remote commands. ... Read More Register Manager regent.exe X Added by the W32/Sdbot-DFJ worm and IRC backdoor. <unknown> regepsrvc.sys X Added by a variant of the Goldun.Fam rootkit. Windows Registry Express Loader regexpress.exe X Added by the FORBOT-CJ WORM! RegFreeze regfreeze.exe U RegFreeze anti-spyware software Registration Host reghost.exe X Added by the W32/Rbot-GKS worm and IRC backdoor. W32/Rbot-GKS spreads to other network computers by exploiting common buffer overflow vulnerabi ... Read More reghost reghost.exe U Added by the Spyware.SpyPal surveillance software. Spyware.SpyPal is a spyware program that monitors user activity on the computer. If you did not in ... Read More 32-bit Registration Host reghost32.exe X Added by the W32/Rbot-GKR worm and IRC backdoor. W32/Rbot-GKS spreads to other network computers by exploiting common buffer overflow vulnerabi ... Read More {9D71D88C-C598-4935-C5D1-43AA4DB90836} Regidl.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More reginfo32 reginfo32.exe ? ?? registry integrity checker regintmon.exe X Added by a variant of the AGOBOT/GAOBOT WORM! ... Read More registry integrity checker regintmon.exe X Added by a variant of the AGOBOT/GAOBOT WORM! ... Read More Register MediaRing Talk register.exe N If you don't want to register MediaRing and be reminded about it every bootup disable it ... Read More Windows Register Control register.exe X Added by the W32/Tilebot-GO worm and IRC backdoor. windows register edit registr32.exe X Added by an unidentified WORM or TROJAN! Registration Assassin's Creed RegistrationReminder.exe N Registration nag screen for the Assassin's Creed game. Registry Services Registry.exe X Added by the DOWNLOADER.CILE TROJAN! RegistryMonitor registry.pif X Affilred adware Reg32 Registry32.exe X Added by Backdoor.Crazynet. Microsoft Regestry Manager registry32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Uniblue Registry Booster RegistryBooster.exe U Uniblue Registry Booster is a Windows Registry optimizer. PDF Converter Registry Controller RegistryController.exe ? ScanSoft PDF_Converter related - what does it do and is it required? Registry Doc 2006 RegistryDoc2006.exe X Added by the Registry Doc 2006 registry cleaning application and adware installer. According to Sophos this is a potentially unwanted application. ... Read More RegistryDoctor2008 registrydoctor.exe X Added by the RegistryDoctor2008 rogue Windows Registry cleaner. RegistryFix.exe registryfix.exe N Added by the RegistryFix rogue security program. RegistryGreat.exe RegistryGreat.exe X Added by the RegistryGreat misleading application. RegistryGreat is a misleading application that may give a report of exaggerated registry errors on ... Read More register manager RegistryManage.exe X Added by the SDBOT.AYH WORM! ... Read More run= RegistryReminder.exe X Added by the APSTROJAN.OB TROJAN! Windows Registry Repair Pro RegistryRepairPro.exe N Windows Registry cleaning program. RegistrySmart RegistrySmart.exe N This program is to monitor registry activity, and to generate back up logs, watches for registry errors and can be used to correct or modify registry. ... Read More Regman RegistrySweeperPro.exe X Added by the RegistrySweeper security risk. As described by Symantec, "RegistrySweeper is a program that may give exaggerated reports of th ... Read More RegisterDropHandler REGIST~1.EXE U Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras ... Read More regkilltray RegKillTray.exe U Related to CloneDVD from Elaborate Bytes AG. ... Read More checkscan32 regload16.exe X Added by the AEBOT.K WORM! ... Read More Registry Loader regloadr.exe X Added by the GAOBOT.AO WORM! {35a88e51-b53d-43e9-b8a7-75d4c31b4676} reglogs.dll X A file used by the rogue antispyware app, SpyFalcon, to issue fake security alerts on your taskbar. ... Read More Regmonitor regmaping.exe X Added by the W32/Bagle-CJ worm. RegistryMechanic RegMech.exe U Registry Mechanic for Windows - "you can safely clean and repair Windows registry problems with a few simple mouse clicks! Problems with the Windows r ... Read More Registry Monitor regmon.exe X Added by the Troj/Bckdr-QKH Trojan. RegMon32 regmon32.exe X Added by the W32/Sdbot-ALK worm and IRC backdoor. regP32 regP32.dll X Added by a variant of the Troj/Haxdoor Trojan. This infection utilizes the regP32.sys and the regP64.sys rootkits to hide itself. ... Read More Registry protect service 2 regP32.sys X Added by a variant of the Troj/Haxdor-Gen rootkit. Registry protect service regP64.sys X Added by a variant of the Troj/Haxdor-Gen rootkit. wininet.dll regperf.exe X Added by the Troj/Zlob-IJ Trojan. RegPowerClean RegPowerClean.exe X Added by the RegistryPowerCleaner security risk. RegistryPowerCleaner is a security risk that may give exaggerated reports of errors in the registry o ... Read More AUTOPROP REGPROP.EXE WMPADDIN.DLL N Both the files are in the MS Office/Bots/FP_WMP directory. Apparently, it registers the FrontPage WiMP extension ... Read More RegProt Regprot.exe Y RegistryProt from Diamond Computer Systems - protects the system registry against changes ... Read More Regptmens REGPTMENS.EXE X Added by the Troj/Bancos-ED Internet Banking Trojan. registry checker Regrun.exe X Added by the SDBOT TROJAN! ... Read More Window Registry Config1 regrun32a.exe X Added by the W32/Rbot-VB worm. When connected this infections connects to an IRC server where it waits for remote commands to execute. ... Read More Windows Services Agant regs32.exe X Added by the W32/Sdbot-DIK worm and IRC backdoor. Windows Registry Scan regscan.exe X Added by the W32/Rbot-HA trojan backdoor. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More Regscan regscan.exe X Added by the Troj/Clicker-DV Trojan. RAMM2000 regscan.exe X Added by the W32/VB-DDG network worm. windows registry scan regscan23.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More Windows Registry Scan regscan32.exe X Added by the RBOT.KE WORM! Registry Scanner regscanr.exe X Added by a variant of the OPTIX TROJAN! Regscan regscanr.exe X Added by Troj/Optix-SE. The TROJAN is a multi-component type, and will terminate a number of anti-virus and security-related applications while ope ... Read More Microsoft Update regscr32.exe X Added by the W32/Rbot-GT trojan backdoor. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. This i ... Read More Server Registry regscr32.exe X Added by the Troj/Bifrose-ZB Trojan. microsoft windows dll services configuration regscv.exe X Added by a variant of the W32/SDBOT WORM! ... Read More windows update service regscv.exe X Added by the W32/AGOBOT-AM WORM! ... Read More Registry Server regserv.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Windows Registry Services regserv.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. regserver regserve.exe ? Related to XGI Technology's Volari graphics cards - what does it do and is it required? ... Read More regservices.exe regservices.exe X Added by an unidentified VIRUS, WORM or TROJAN! RegShave regshave.exe N Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BE ... Read More regsrv regsrv.exe X Added by the OPTIXPRO.11 TROJAN! System Profile Regsrv.exe X Added by a variant of the OPTIX TROJAN! Registry Services regsrv.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. REGEDIT Regsrv32.com X Added by the SOUTHGHOST WORM! [executed file name] Regsrv32.com X Added by the SOUTHGHOST WORM! Registry Server regsrv32.exe X Added by the RBOT-GM WORM! registry service REGSRV32.EXE X Added by an unidentified WORM or TROJAN! regsrvc regsrvc.exe X Added by the Troj/Stoped-A trojan. It will create an IE plug-in and opens IE's "about blank" page to run an executable file. ... Read More RegSrvc RegSrvc.exe ? Definitely related to Intel network cards. This particular entry is for their wireless card. Other directories it can be found in are: C ... Read More regstrmon regstrmon.exe X Added by the W32/Tilebot-FZ worm and IRC backdoor. This infection also utilizes the remon.sys rootkit. ... Read More Regsv regsv.exe X Search hijacker - redirecting to scheo.com Registry Service regsvc.exe X Added by the Troj/IRCBot-ZM worm and IRC backdoor. Generic Service Process regsvc32.exe X Added by the GAOBOT.UJ, GAOBOT.UL or W32/Agobot-FM WORMS! Generic Services Process regsvc32.exe X Added by the GAOBOT.SY WORM! MSRegSvc regsvc32.exe X Homepage hijacker that changes your homepage to an adult content site regsvc32 regsvc32.exe X Homepage hijacker that changes your homepage to an adult content site Task Commander regsvc32.exe X Added by the W32/Agobot-RX worm/IRC backdoor Trojan. Remote Registry Regsvc32 Regsvc32.exe X Added by the Troj/Tanto-I Trojan. regsvcdll regsvcdll.exe X Added by the Spyware.PowerSpy spyware. Spyware.PowerSpy is a spyware program that gathers confidential information from the computer and can send this ... Read More InternetHostSecurity regsvchost.exe X Added by the Troj/Spyal-A information stealing Trojan. DHCP Server regsvr.exe X Added by the RBOT-PR WORM! regsvr regsvr.exe X Added by the WEBMONEY-G TROJAN! Yahoo Messengger regsvr.exe X Added by the W32.Imaut.CN worm. W32.Imaut.CN is a worm that spreads through Yahoo! Instant Messenger and network shares. It may also download potentia ... Read More Msn Messsenger regsvr.exe X Added by the Troj/Agent-GXM Trojan. popup defence updater (required) regsvr32 /s [path] pdf****.dll (* = random char/digit) X SafeguardProtect/Veevo hijacker ... Read More Popup Defence Updater regsvr32 /s [path] pdf****.dll [* = random char/digit] X SafeguardProtect/Veevo hijacker PCShield regsvr32 /s [path] sfg_****.dll [* = random char] X SafeguardProtect/Veevo malware uninstal regsvr32 /u /s image.dll X CoolWebSearch parasite related Popup Blocker Updater regsvr32 veev****.dll [**** = random char] X SafeguardProtect/Veevo hijacker Kazaa Download Accelerator Updater (required) regsvr32 [path] kdp****.dll [* = random char] X SafeguardProtect/Veevo hijacker SafeGuard Popup Updater (required) regsvr32 [path] PDF****.dll [* = random char/digit] X SafeguardProtect/Veevo hijacker SafeGuard Popup Blocker Updater (required) regsvr32 [path] sfg****.dll [* = ramdom char/digit] X SafeGuard Protect/Veevo - hijacker SafeGuard Popup Updater (required) regsvr32 [path] sfg****.dll [* = ramdom char/digit] X SafeguardProtect/Veevo hijacker SafeGuard Popup Blocker Updater regsvr32 [path] sfgupd.dll X SafeguardProtect/Veevo hijacker WUx_RegSvr RegSvr32.exe ? x is any number?? HREF.OCX regsvr32.exe ....HREF.OCX U HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller ... Read More Register SeqChk regsvr32.exe ..csseqchk.dll ? ?? kvern16.dll regsvr32.exe [path] kvern16.dll X DailyWinner adware vernn16.dll regsvr32.exe [path] vernn16.dll X DailyWinner adware vern16.dll regsvr32.exe [path] vernn16.dll X DailyWinner adware ... Read More {A5CDF7EC-751B-46aa-AD69-4005FE080DE8} regsvrs32.exe X Identified as a variant of the Bifrose Trojan. Compatibility Service Process regsvs.exe X Added by the GAOBOT.YN WORM! regsync regsync.exe X SafeSurfing adware ... Read More Reg_WFT Regsysw.com X Added by the WILSEF VIRUS! Registration-Studio 8 RegTool.exe N Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems ... Read More RegTweak RegTwk.exe U Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options, custom display modes, refresh rates and overclocking all through an e ... Read More RegVer REGVER.EXE X Added by the LATINUS.16 TROJAN! Windows [non-printable] regver.exe X Added by the Troj/Graybird-T backdoor Trojan. RegVfy32 Regverif32.exe X Added by the W32.Sygyp.A@mm mass-mailing worm. stem% regwiz.exe X Added by the Trojan-Dropper.Win32.Small.azk Trojan. {08315C1A-9BA9-4B7C-A432-26885F78DF28} rejoi.vxd X Added by the Troj/Hook-GH Trojan. [not used] rejoice.exe X Added by the Troj/Prosti-Q Trojan. Windows_rejoice rejoice42.exe X Added by the Backdoor.Shangxing backdoor Trojan. Backdoor.Shangxing is a Trojan horse that opens a back door on the compromised computer. The file for ... Read More Windows_rejoice46 rejoice46.exe X Added by the W32/AutoRun-LH removable media worm. Windows_rejoice2007_91 rejoice91.exe X Added by the WORM_AUTORUN.KY removable media worm. Windows_wei rejoicewei.exe X Added by the Troj/Bckdr-QLT backdoor worm. Launcher relaunch.exe N Audio Applications Launcher for the Philips Rythmiic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtr ... Read More zcseacrt relccxs.exe X Identified as a variant of the Trojan-Proxy.Win32.Slaper Trojan. Reload reload.exe X Added by the LAZAR trojan downloader. reload reload.vbs X Added by the LOVELETTER.AS VIRUS! emory relocation service reloc32.exe X Added by the W32.Relfeer worm. W32.Relfeer is a worm that spreads through network shares and file-sharing applications. It may also attempt to downloa ... Read More Memory relocation service reloc32.exe X Added by the W32.Relfeer worm. W32.Relfeer is a worm that spreads through network shares and file-sharing applications. It may also attempt to downloa ... Read More Advanced DHTML Enable relpk.exe X Added by the Backdoor.Ranky backdoor Trojan. Regmonitor remaping.exe X Added by the W32.Beagle.DO@mm mass-mailing worm. RemHelp Remhelp.exe N BT Voyager ADSL Modem Help related B.Reader remin.exe N Birthday Reminder 5.0 - as the name implies Corel Registration Remind32.exe N If you don't want to register Corel products and be reminded about it every 2 weeks disable it ... Read More Corel Registration Reminder Remind32.exe N If you don't want to register Corel products and be reminded about it every 2 weeks disable it ... Read More Hewlett Packard Recorder Remind32.exe N HP multifunction registration HP-Aio Flight Remind32.exe N HP multifunction registration Reminder-cpqXXXXX remind32.exe N Compaq printer Registration Reminder-hpcXXXXX remind32.exe N HP CD-Writer Registration Reminder-ranXXXXX remind32.exe N Registration reminder widget for Rand Mcnally maps reminder-ScanSoft Product Registration remind32.exe N Registration reminder for ScanSoft products such as PaperPort @loha reminder.exe N Registration reminder for @loha@home E-mail utility Instant Update Center reminder.exe N From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it ... Read More Kana Reminder Reminder.exe N Kana Reminder is a program which can be used to set a reminder to be triggered at a specified time ... Read More Reminder reminder.exe N From MS Money. Reminds you of your bills Acer Tour Reminder Reminder.exe N Reminder that pops up and reminds you to take tour of your new Acer computer or laptop. ... Read More Reminder Reminder.exe X Added by the Secure Expert Cleaner rogue security software. RemindMe RemindMe.exe U Remind-Me - calendar software Reminder Remind_XP.exe N HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD C ... Read More Remind_XP Remind_XP.exe N HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD C ... Read More Remocon_Path remocon.exe Y Remote control software for the Sigma TV Card. remon REMON.SYS X Rootkit used by some infections to hide other files and configuration information. ... Read More remote master remote master.exe U Required if you want your ASUS Remote control to work at all. Available via Start -> Programs ... Read More hotdlll remote.cmd X Added by the Troj/Banker-EHG online banking Trojan. If you are infected with this Trojan, you should immediately contact your banks and change your ac ... Read More java remote.cmd X Added by the Troj/Banker-EHG online banking Trojan. If you are infected with this Trojan, you should immediately contact your banks and change your ac ... Read More Remote Procedure Call (RPC) Remote remote.exe X Added by the W32/Mytob-EW worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More Remote remote.exe U Added by the Spyware.Watchdog surveillance software. Spyware.WatchDog is a spyware program that logs keystrokes. It monitors Instant Messenger convers ... Read More Remote Remote.exe U Added by the FlyVideo PC video tuner. This program allows you to use the external remote to operate the tuner. ... Read More system Tools Remote.exe X Added by the Troj/DInject-A Trojan. RemoteABC RemoteAbc.exe X Added by the Troj/Agent-GHH Trojan. RemoteABCServer2 RemoteAbc2.exe X Added by the Troj/Agent-GQE Trojan. Remote_Agent RemoteAgent.exe N Cyberlink Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings, you will need this, otherwise can be disabled. Availab ... Read More Sistray32 remotehost.pif X Added by the HOLCAS.A WORM! remotewatch remotewatch.exe X Added by the Troj/Squatbot-A Trojan. This program is used to monitor expiring domain names. This Trojan contains an uninstall entry here. ... Read More <not used> Removal.vbs X Added by the VBS/Small-ELQ worm. Removecpl Removecpl.exe N Related to a Belkin 54Mbps Wireless Utility Control Panel applet Removed.exe Removed.exe X GatorCheat - adware downloader remove removeJK.exe X Added by the Trojan.Remojin Trojan. Zonealarm Removeme.exe X Added by the FORBOT-BG WORM! Spyware remover Remove_spyware.exe X Unidentified, but not known to belong to any known spyware remover, and strongly suspected to be adware related! ... Read More Windows Update 32 rempss.exe X Added by the W32/Forbot-FW worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More RemStart remstart.exe ? Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required? ... Read More Agente Remupd.exe ? Part of Panda Antivirus Titanium. Is this an update reminder (guess because of the name), virus definition update reminder or something similar? ... Read More Shell Renova.exe X Added by the W32/Levona-A worm. W32/Levona-A spreads to network shares and removable drives. ... Read More renus2008.exe renus.exe X Added by the Renus 2008 rogue anti-spyware program. MSN Messenger Reosmsngr.exe X Added by a variant of the SPYBOT WORM! [not used] repairs.dll X Added by a new version of the Adware.SurfSideKick adware. This file protects the Surf Sidekick 3 from being removed and must be killed before you can ... Read More LAsIAf32 RePEAtLD.exe X Added by the REPEATLD WORM! repl repl.exe X Added by the TROJ_YABE.CD Trojan downloader. RepliGo Assistant RepliGoMon.exe U Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device" ... Read More {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} replmap.dll X Used by the rogue anti-spyware application SpyAxe to issue fake taskbar alerts as a goad to make you purchase the full commercial version. ... Read More NT System Service replymessage.BAT X Added by the W32/HidAgent-B Trojan. req req.dat X Added by the Trojan.Vundo.B adware/redirector. req req.dll X Added by the Troj/ConHook-B trojan downloader. There will usually be other malware on your system if this infection is present. ... Read More Requester requester.11.exe X Added by the Trojan.Muquest proxy Trojan. requester requester.5.exe X Adware downloader, identified as TrojanProxy.Win32.Delf.h requester requester.5.exe X Added by the MUQUEST.A TROJAN! requester requester.6.exe X Added by a variant of the MUQUEST.A TROJAN! requester requester.8.exe X Added by a variant of the MUQUEST.A TROJAN! [System Mechanic Professional Update [Incinerator.dll] REREG: [path] Incinerator.dll N System_Mechanic's "Incinerator" feature securely deletes files and folders from your PC so they can never be recovered again ... Read More reset5c reset5c.dll X Added by the Troj/DwnLdr-HTJ Trojan. Remote Event System resmsvc.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. loadservice Rest In Peace X Added by the W32/KANGAROO-A WORM! ... Read More SvcManager restore3.exe X Added by the Troj/Agent-DSS backdoor Trojan. restorer64_a restorer64_a.exe X Added by the Troj/Inject-KE Trojan. restory restory.exe X Added by the RETSAM TROJAN! resagnt restun.exe X Adware downloader - detected by Panda antivirus as Trj/Downloader.ALQ ... Read More ResumeFixClocks resumefix.exe U Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards Registry Service resvs.exe X Added by the W32/Delbot-I worm and IRC backdoor. Mania Win Restore RESWIN.EXE N Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs ... Read More runner1 retadpuxx.exe X Added by the Retadpu Trojan. The filename for this infection always starts with retadpu, followed by two random numbers, and then .exe. Examples fil ... Read More retime retime.exe X Added by the GIPMA TROJAN! RetrieverScheduler retrieverscheduler.exe U 80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network ... Read More Rvsystem Returnil.exe U Related to Returnil Virtual System 2008 Personal Edition. This program will show a pop-up when you logon that shows whether or not your hard drive is ... Read More retx2 retx2.sys X Identified as a variant of the Backdoor:Win32/Rustock.gen rootkit. revo revo.exe X Added by the WORM_ONLINEG.AFU worm. kmmsoft revo.exe X Added by the W32/AutoRun-QR removable media worm. RevoTaskbarApp RevoTask.exe U Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modificati ... Read More RexSyMon rexsymon.exe N Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC ... Read More rfagent rfagent.exe U Registry First Aid - scans the Windows registry for orphan file/folder references, finds these files or folders on your drives that may have been move ... Read More Windows-TCP-IP rfkampig.exe X Added by the GIPMA TROJAN! RegiFast RFManager.exe U Added by the Adware.RegiFast. Adware.RegiFast is an adware program that automatically fills in forms on Web pages. When a form is filled in, the progr ... Read More Reality Fusion GameCam SE RFTRay.exe N System Tray access for Logitech's Reality Fusion GameCam. For more details see here. Available via Start -> Programs ... Read More RFTray RFTRay.exe X Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an ... Read More rfw Rfw.exe Y RAV AntiVirus Rising Personal Firewall Services RfwSrv.exe X Added by the Troj/Delf-FBV Trojan. rfwydg rfwydg.exe ? ?? MSN rfxjga.exe X A variant of the Rbot.XFC family of worms and IRC backdoor Trojans. rgbopx rgbopx.dll X Added by a variant of the Goldun.Fam Trojan. This infection is utilizes the ycsrga.sys and the ycsrgb.sys rootkits to hide itself. ... Read More windows asn service rge.exe X Added by the W32/Rbot-AOK logonUiInit rgtndz.dll X Identified as a variant of the Trojan-Clicker.Win32.Agent.bqy malware. Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} RH.DLL X SmartPops adware RH rh32.exe U EuroFonts - adds Euro symbols to pre-Euro computers rhammet_.exe rhammet_.exe X Added by the W32/VB-CUE worm. {5B7AC5A1-6568-13F1-261B-67911AF4B4D8} rhb32swo.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More Remote Heacle Deamon Security Audit rhdsa.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. RhinoBlocker RhinoBlocker.exe U RhinoBlocker - pop-up stopper Microsoft IT Update Rhost32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Microsoft Windows Update rhost32.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. rhptray RHPTray.exe U Related to Red_Hot_Pawn Play Online Chess. Note: located in C:\Program Files\RHPTray ... Read More Comcast Network ribiva.exe X Added by an IRC_TROJAN variant! {9D0351F9-8E49-4ed1-BBCE-0795F5B9F240} richnotify.exe X Added by the Trojan.Dachri backdoor Trojan. richup richup.exe X SafeSurfing parasite variant ... Read More Cyberlink RichVideo Service(CRVS) RichVideo.exe U Extension to CyberLink products for enhanced editing of videos. Random Interface Network Manager rinsv.exe X Added by the W32/Delbot-L worm and IRC backdoor. riode32 riode32.sys X Identified as a variant of the Rootkit.Win32.Agent.adm rootkit. RioDrvs Usb Driver RioDrvs.sys X Added by the W32.Almanahe.B worm. W32.Almanahe.B is a worm that infects executable files. It attempts to spread to network shares protected by weak pa ... Read More riorad manager riomgr.exe U Related to Riorad_Explorer for your Rio MP3 player. Note: located in C:\Program Files\Red Chair Software\Riorad Explorer\ ... Read More Rio MSC Manager RioMSC.exe U Used by the RIO MP3 player to organize and copy music to your MP3 player. rIOphosIs rIOPHosIs.vBS X Added by the RIOSYS MACRO! RIOTBOT riotz.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. htmamx rispac.exe X Unidentified online banking Trojan. If you are infected with this Trojan you should change all of your online banking passwords and contact your bank ... Read More {9988775D-4368-4857-871A-D01D66CA3A71} ritz8.dll X Added by the Troj/Alpha-H Trojan. Please note that C:\Windows\System32\rundll32.exe is a legitimate program. ... Read More dcom ritz8.dll X Identified as a variant of the Troj/Alpha-H malware. RivaTuner RivaTuner.exe U RivaTuner for tweaking nVidia graphics cards. Required if you make any changes RivaTunerStartupDaemon RivaTuner.exe U RivaTuner for tweaking nVidia graphics cards. Required if you make any changes OSS rk.exe X RelevantKnowledge, NetSetter/Marketscore foistware variant garcea rkaxfza.dll X Zlob Trojan that infects you with the VirusHeat rogue anti-spyware program. Please use the guide below to remove this infection. ... Read More WindowsRegKey update rkbuouoxfl.exe X Added by the W32/Rbot-OO trojan backdoor. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. These ... Read More 65438761234587528 rkgnd.exe X Added by the ANG AntiVirus 09 rogue anti-spyware program. (DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D) rksldk.dll X Added by the Troj/PWS-AOF password-stealing Trojan. asparagine rkvdr.dll X Zlob Trojan that infects you with the VirusHeat rogue anti-spyware program. Please use the guide below to remove this infection. ... Read More bemocked rldyt.dll X Zlob Trojan which installs the Virus Protect 3.8 rogue anti-spyware program. This program displays fake security alerts stating that your comput ... Read More Key1 Rlid.exe X Added by the LIXY TROJAN! oss rlvknlg.exe X NetSetter/Marketscore foistware rlx51dom rlx51dom.dll X Added by the Troj/Haxdor-Fam. This infection utilizes the rlx66dob.sys rootkit to hide itself. ... Read More rlx5dom1 rlx5dom1.dll X Added by a variant of the Trojan.Goldun information stealing Trojan. This infection utilizes the rlx6dob6.sys rootkit to hide itself. ... Read More rlx66dob rlx66dob.sys X A variant of the Troj/Haxdor-Fam rootkit. rlx6dob6 rlx6dob6.sys X A variant of the Goldun rootkit. Remote Storage Access rmasvc.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Windows Terminal Manager rmbsvc.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. RemoteControl rmctrl.exe U Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your dr ... Read More rmctrl rmctrl.exe U Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your dr ... Read More rmdrfje.dll rmdrfje.dll X Added by the Troj/Dloadr-ANM Trojan downloader. rmincon rmincon.exe X Added by the WORM_REALOR.A worm and real media file infector. Windows Service Agccnt rmizjgz.exe X Added by the W32/Sdbot-DIM worm and IRC backdoor. rmk8ot rmk8ot.dll X Added by a variant of the Haxdoor Trojan family. This infection utilizes the rmk9ot.sys and the rmk8ot.sys rootkits to hide itself. ... Read More MMX virtualization service rmk8ot.sys X Added by a variant of the Troj/Haxdor-Gen rootkit. MMX2 virtualization service rmk9ot.sys X Added by a variant of the Troj/Haxdor-Gen rootkit. RMremote RmRemote.exe ? Remote control driver for REALmagic Xcard. Is it required? MicrosoftUpdate rmsm.exe X Added by the W32.Barten@mm worm. W32.Barten@mm is a mass-mailing worm that spreads through email and Microsoft Messenger. ... Read More Extender Resource Monitor RMSysTry.exe N Part of Windows Media Center. Reports system resource utilization after you add your first Media Center extender. ... Read More 1 rmtdll.exe X Added by the Troj/Backdr-F backdoor Trojan. Troj/Backdr-F may arrive embedded into a document that exploits a Microsoft Word vulnerability (MS06-047) ... Read More checkman rmtdvc.dll X Added by a Zlob Trojan which installs AntiVirgear 3.8 and display fake security alerts in your Windows taskbar. ... Read More rmvgor rmvgor.dll X Added by a variant of the MyGeek/CPVFeed adware. {9ae613a2-a13b-4379-8d0e-86a1a78476ec} rmzdzx.dll X A file used by the rogue antispyware app, SpywareQuake, to issue fake security alerts on your taskbar. ... Read More DialUp Network Application Rnaap.exe X Added by a variant of the W32/SDBOT WORM! Remote Access rnaapp.exe U Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie, analogue 56K mo ... Read More RealPlayer Ath Check rnathchk.exe X Added by the W32.Mytob.AG@mm worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More Usrr rncr.exe X PurityScan/Clickspring adware rncsys32.exe rncsys32.exe X Added by the Downloader-BRM downloader. file laoder configuration rnd32.exe X Added by the RBOT.BQJ WORM! ... Read More rndll2 rndll2.exe ? May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within? ... Read More setupdata rnll32.exe X Added by the Troj/QQPass-AG keylogger Trojan. It also creates the following files: %System%rull32.dll, %System%rnull32.dll, %System%temp1.jpg ... Read More rnopbfgt rnopbfgt.dll X Identified as a variant of the Adware.Agent malware. Zonesoft Cleaner rnsys.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. rnwabmig rnwabmig.exe X Added by the Troj/Agent-LMI Trojan. xmnfuruwk rnxntup.exe X Added by the Infostealer.Orcu.B information stealing Trojan. rnxqh rnxqh.exe ? ?? draughtsmanship rnxwph.dll X Added by a Zlob Trojan which installs AntiVirgear 3.7 and display fake security alerts in your Windows taskbar. ... Read More ro0 Service ro0.exe X Identified as a Spambot variant. ro0 Service ro0.exe X Added by the Backdoor.HackDefender rootkit. RoboFormWatcher RoboFormWatcher.exe N AI Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs ... Read More RoboForm RoboTaskBarIcon.exe N Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer br ... Read More rock rock.exe X Added by the Troj/LowZone-CR Trojan that lowers the security settings on your computer. ... Read More RocketDock RocketDock.exe U Starts the RocketDock program; A configurable Mac OS style dock for Windows XP. Rocket.Time RocketTime.exe U Time synchronization software from Rocket Software rofl rofl.sys X Added by the Hacktool.Rootkit rootkit. Sb Rolin.bat X Added by the WM97/Lahey-A Word macro virus. roll roll.exe X Added by the Troj/LowZone-CP Trojan. This Trojan will lower the security on your computer so other malware can bypass any security restrictions that ... Read More RollbackClientService RollbackClnt.exe U Added by the RollBack Rx system restore program. Rollback RollbackTray.exe U Added by the RollBack Rx system restore program. RomAvp RomAvp.dll X Identified by Kaspersky as a variant of the Trojan.Win32.Agent.evy Trojan. {09B68AD9-FF66-3E63-636B-B693E62F6236} romdrivers.dll X Added by the W32.Drom worm. W32.Drom is a worm that downloads and executes malicious files on the compromised computer and spreads through removable s ... Read More RomSetup RomSetup.dll X Identified by Kaspersky as a variant of the Trojan.Win32.Agent.evy Trojan. rundll32 rookie.vbs X Added by the VBS/Rookie-A Trojan. DevicePath Root.exe X Added by the GRUEL WORM! MediaPath Root.exe X Added by the GRUEL WORM! Rundll32.exe Root.exe X Added by the GRUEL WORM! vysmet rootdir.exe X Added by the W32.Nopir.D P2P worm. {bb720bab-2f75-456b-a850-04d77b20f6b8} rosdzop.dll X A Trojan used by the rogue anti-spyware program VirusBurster. This Trojan, when installed, will display fake security alerts on your taskbar and insta ... Read More dll rose.exe X Added by the W32/Setrox-A worm. Registry Value Name roses.exe X Added by the W32/Rbot-AFT worm. When started, this infections connects to a remote IRC server where it waits for commands to execute. ... Read More RosettaStoneLtdController RosettaStoneLtdController.exe ? Related to the Rosetta Stone language-learning software. RosTika RosTika.exe X Added by the W32/Brontok-BU worm. WLAN route service rotr.sys X Identified as a variant of the Rootkit.Win32.Agent.ahf rootkit. {2B7A49E8-4AF7-D18A-0506-030006080100} rout.exe X Added by the Troj/Keylog-JF keylogging Trojan. ROUTD ROUTD.exe ? ?? Router Router.exe X Identified as a variant of the Trojan.Matcash malware. Microsoft Router Manager router.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Sophos Message Router RouterNT.exe Y This service provides communication between various components. Its main purpose is to send and receive information between the server and managed com ... Read More routing Service routing.exe X Identified as a variant of the Backdoor:Win32/Refpron.C malware. RoxAssist RoxAssist.exe N Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize, the applications in Easy C ... Read More RoxMediaDB9 RoxMediaDB9.exe U Used by Roxio products to keep the Media Library updated. It has been reported that this program can cause a lot of disk activity. ... Read More roxwatchtray RoxWatchTray.exe U Related to Roxio_easy_CD_creater System Tray icon installed by Roxio Easy Media Creator 8 and which allows you to configure your watched folders or t ... Read More RP32 rp32.exe U ControlIT (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems. ... Read More Remote Procedure Call For Windows 32bit rpc.exe X Added by the RBOT-MD WORM! RPC Drivers rpcall.exe X A variant of the W32/IRCbot.BGA.worm family of worms and IRC backdoor Trojans. Remote Packet Capture Protocol v.0 (experimental) rpcapd.exe Y Service name is rpcapd. "WinPcap is an open source library for packet capture and network analysis for the Win32 platforms. It includes a kernel-level ... Read More rpcc rpcc.dll X Added by the Troj/Spabot-O spamming Trojan. This infection should not be confused with the legitimate C:\Windows\System32\rpcss.dll file. ... Read More rpcc rpcc.exe X Added by the Troj/Dloadr-AEL downloader Trojan. WindowsHive rpcc.exe X Added by the Troj/Dlena-A Trojan. Remote Procedure Call (RPC) Center RpcCenter.exe X Added by the W32/Sdbot-AQH worm and IRC backdoor. Remote Procedure Call (RPC) Client rpcclient.exe X Added by the W32/Codbot-L worm and IRC backdoor. rpcda Win32 rpcda.exe X Added by the W32/Rbot-AEE worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More Generic Host Process for Win32 Service rpchost.exe X Added by the W32.IRCBot.DCN worm and IRC backdoor. roketpipe rpclient.exe ? ?? Remote Procedure Call (RPC) Locator rpclocator.exe X Added by the W32/Codbot-Q worm and IRC backdoor. Sysmon rpcmon.exe X Added by the RANDEX.ATX WORM! Remote Procedure Call (RPC) Monitoring Rpcmon.exe X Added by the W32/Codbot-T worm and IRC backdoor. OpenSSL rpcmon.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Remote Procedure Call System(RPCS) RPCS.exe X Added by the Troj/QQRob-ABS Trojan. Remote Procedure Call System(RPCS) Rpcse.exe X Added by the Troj/QQRob-ABW spyware Trojan. RPCSS.exe rpcss.exe Y Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now ... Read More Remote Procedure Call (RPC) Service RpcSs.exe X Added by the W32/Cuebot-J worm and IRC backdoor. RPC+ Service Provider rpcss_pl.exe X This is an unknown malware. This malware makes the legitimate RPCSS service depend on it so that if you shut it down your computer will be come unsta ... Read More Windows Remote Procedure Call Monitoring Service rpcsvc.exe X Added by the W32/Cuebot-I worm and IRC backdoor. windowsupdate RPCX1SQ234.exe X Added by the Troj/IRCBot-U worm. When started, this infection connects to a remote IRC server and waits for commands to execute. ... Read More windowsupdate RPCX1sQ3.exe X Added by the IRCBOT.B TROJAN! System Setup rpcxcmod.exe X Added by an unidentified WORM or TROJAN! MSVsmt rpcxctx.exe X Added by an unidentified WORM or TROJAN! WSAConfiguration rpcxmn32.exe X Added by the AGOBOT.ABG WORM! social security agency rpcxsocsa.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More userinit startup rpcxuisu.exe X Added by a variant of the W32/SDBOT WORM! ... Read More Microsoft Windows Secure Server rpcxWindows.exe X Added by the RBOT-LL WORM! RpcxWindows Extensions rpcxwinex.exe X Added by the RBOT.ACP WORM! microsoft windows secure update rpcxwinupdt.exe X Added by an unidentified WORM or TROJAN! usrr rpen.exe X PurityScan/Clickspring adware ... Read More Remote Access Monitor rpgsvc.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. RplSvr rplsvr.exe X The WORM variant W32/MyDoom-J uses email & P2P to add a TROJAN, copies itself as this file to run at each logon. ... Read More RPM Services rpmserv.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Remote Procedure Qall System(RPQS) RpQs.exe X Added by the Troj/Kbroy-G backdoor Trojan. ntl netguard RPS.exe Y Related to ntlworld_Netguard Anti-virus a package of services, specifically designed to keep you safe and secure with their online services. ... Read More Rundll32 rps32.exe X Added by the Troj/Bdoor-ABJ backdoor Trojan. RPSP Rpsserv32.exe U Added by the Spyware.RedPill surveillance software. This software should be removed if found installed without your permission on your computer. ... Read More rqbmvpso rqbmvpso.dll X Identified as a variant of the VideoAccessCodec malware. rqksgpu rqksgpu.cur X Added by the Backdoor.Rustock backdoor rootkit. rqrqrqq rqrqrqq.dll X Identified by AVG as a variant of the Trojan horse BHO.CWF malware. ReleaseRAM RRAM.exe U "Release RAM allows your computer to run faster and uses your computer's RAM more efficiently". Some users swear by programs such as this but I sugges ... Read More bluestart rraut.exe X Added by the VB.GY.2 downloader TROJAN! rreg rreg.exe X Unidentified adware RRMedic rrmedic.exe X Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of fals ... Read More Rapid Restore rrpcsb.exe U XPoint "Rapid Restore PC" - a "Managed Recovery™ solution that enables IT Administrators to protect the corporate image, while offloading personal dat ... Read More TVT Backup Service rrservice.exe Y IBM Thinkpad Rescue and Recovery Service {27321538-5739-4aa1-b84c-7d18e4383f1f} rrtcany.dll X A Trojan used by the rogue anti-spyware program VirusBursters. This Trojan, when installed, will display fake security alerts on your taskbar and inst ... Read More eurymus rrtrit.dll X Added by a Zlob Trojan which installs AntiVirgear 3.8 and display fake security alerts in your Windows taskbar. ... Read More Osus rrup.exe X PurityScan/Clickspring -Adware. rs32net rs32net.exe X Identified as a variant of the Trojan.Win32.Agent.aecm malware. rs32net rs32net.exe X Identified by Trend Micro antivirus as a variant of the TROJ_PUSHDO.BI malware. <random characters and digits> rsbmsc.exe X This infection is detected as BackDoor.Generic5.IDY. Print Spooler Service rsbmsc.exe X This infection is detected as BackDoor.Generic5.IDY. Microsoft Agent rschost.exe X Added by the W32/Vanebot-Z networm and email worm. rscmpt rscmpt.exe U Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. ... Read More rsdapi rsdapi.dll X Added by a variant of the Goldun.Fam Trojan. Red Swoosh EDN Client RSEDNClient.exe U Red Swoosh is a piece of software that allows you to download videos from sites that utilize its technology quicker. It does this by using P2P technol ... Read More Microsoft Server rserv.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Synchronization Manager rservers.exe X Added by the W32/Forbot-FM worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More Synchronization Manager rservers.exe X Added by the W32/Forbot-FM worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. This entry corr ... Read More synchronization manage rservers.exe X Added by the W32/Forbot-FM ... Read More {22FAACDE-34DA-CCD4-AB4D-DA34485A3422} rsjzbpm.dll X Added by the PWS-OnlineGames.q password-stealing Trojan. rsmb rsmb.exe X Added by the W32/Stration-H mass-mailing worm and backdoor Trojan. W32/Stration-H spreads by sending emails with itself as an attachment to email addr ... Read More rsmb32 rsmb32.exe X Added by the W32.Stration.AV@mm worm. W32.Stration.AV@mm is a mass-mailing worm that gathers email addresses from the compromised computer. ... Read More rsMenu rsMenu.exe U Synchronizes a Casio PDA with MS Outlook Window Firewall rsms.exe X Added by a new Rbot variant. This infection when started connects to a remote IRC server where it waits for commands to execute. ... Read More Remote Services Manager rsmss.exe X Added by the Troj/Bckdr-BBK backdoor Trojan. [not used] rsmss.exe X Added by the Troj/Prosti-BL backdoor Trojan. Explorer.exe is not part of this infection and should not be removed. ... Read More Remote Procedure Call System(RPCSsd) RsmSss.exe X Added by the Troj/Agent-GGZ Trojan. {BE32FA58-3453-FA2D-BC49-F340348ACCEB} rsmykpm.dll X Added by the PWS-OnlineGames.q password-stealing Trojan for online games. Extra Logs and Alerts rsn.exe X Added by the Troj/Keylog-AU keylogging Trojan. This infection also installs the files c:\windows\system32\fixapi.exe, c:\windows\system32\hotkey.exe, ... Read More Resource Meter rsrcmtr.exe N Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential cau ... Read More RSRCMTZ RSRCMTZ.exe ? ?? VgaDriver RsrVga32.exe X Added by the Troj/Keylog-AH keylogger trojan. This infection logs your keystrokes to a file named C:\WINDOWS\INFRCMTRX.DL. ... Read More rsrvmon.exe rsrvmon.exe X Identified as a variant of the Trojan-Clicker.Win32.Agent.ny malware. rssreader RssReader.exe U RssReader - a free RSS reader able to display any RSS and Atom news feed (XML) ... Read More WinFix service rsswjzgp.exe X Added by the W32/Rbot-FAE worm and IRC backdoor. Random Interface Network rst.exe X Added by the W32.Rinbot.L worm. W32.Rinbot.L is a worm that spreads through network shares and by exploiting vulnerabilities. It also opens a back doo ... Read More <not used> Rstd.exe X Added by the W32/Autorun-HS removable media worm. Network Administration Service rsvc32.exe X Added by the RBOT.ABH WORM! MSN UPDATER RSVC32.EXE X Added by the W32/Rbot-HW trojan backdoor. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. This ... Read More <not used> rsvp322.dll X Added by the Troj/Riler-AA Trojan. Remote Access Domain rswsvc.exe X A variant of the Backdoor.Win32.IRCBot.bfa family of worms and IRC backdoor Trojans. ... Read More {434345F1-DACF-3452-CB7D-4620F34A1534} rsztdpm.dll X Added by the PWS-OnlineGames.k.dll password-stealing Trojan. rtasks rtasks.exe X Startup program associated with WinAntiVirus Pro 2007. WinAntiVirus Pro 2007 is a rogue anti-spyware program that displays fake alerts, and downloads ... Read More rtasks rtasks.exe X Added by the AntiSpywareSuite rogue anti-spyware program. AntiSpywareSuite is a security risk that may give exaggerated reports of threats on the comp ... Read More rtcdll rtcdll.exe X Unidentified adware StartKey rtfmsv.exe X Added by the Troj/Edepol-C backdoor Trojan. rthdcpl RTHDCPL.EXE Y Realtek HD Audio Sound Effect Manager RtHDVCpl RtHDVCpl.exe Y Part of the Realtek Semiconductor High Definition Audio System driver. msMGR rtkmsg.exe X Added by the W32/Sdbot-BPY worm. This infection when started connects to a remote IRC server where it waits for commands to execute. ... Read More rtl.exe rtl.exe X Added by the Troj/Tiotua-J Trojan. [Various Names] RtlFindVal.exe X Part of the Wareout infection as described here. RtlMon.exe RtlMon.exe N Monitor for RealTek network card delayingly rtmipr.dll X Zlob Trojan that infects you with the VirusHeat rogue anti-spyware program. Please use the guide below to remove this infection. ... Read More RTMonitor RTMonitor.exe Y Cheyenne (now eTrust) antivirus <not used> rtmp.dll X Added by the Troj/Lineag-DE password-stealing Trojan for the online game Lineage. ... Read More rtos rtos.exe X IRC trojan Remote Terminal Task rtsbsvc.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Microsoft Media Rtsecar.exe X Added by the W32/Vanebot-AX worm and IRC backdoor. Microsoft Media rtsecas.exe X Added by the W32/Rbot-KPH worm and IRC backdoor. Microsoft Agent rtsecas.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. ertyuop rttrwq.exe X Added by the W32/AutoRun-APA removable media worm. Microsoft rtvcscan.exe X Added by the W32/Rbot-GGU worm and IRC backdoor. Symantec AntiVirus Client rtvscan.exe Y This is the real-time component of the Symantec antivirus proection program. This program should not be disabled as you will no longer have real-time ... Read More rtvscan rtvscan.exe X A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans. rtvscn95 RTVSCN95.EXE Y Real-time virus scanner component of Norton Anti-Virus Corporate Edition {9D71D88C-C598-4935-C5D1-43AA4DB90836}] rty.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More Quicktlme ru.exe X Adult content dialler RubeL RubeL.exe X Added by the Trojan.Rubelor Trojan. LIU Rubicon.exe N Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and y ... Read More Ruby13 Ruby13.exe X Added by the MEXER.E WORM! Ruby14 Ruby14.exe X Added by the FIGHTRUB-A WORM! Showme Ruden.vbs X Added by the WM97/Handle-A virus. rudll rudll.exe X Added by the Troj/Vanti-K. McAfee.InstantUpdate.Monitor RuLaunch.exe U Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled u ... Read More RuLaunch RuLaunch.exe U Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled u ... Read More SecurePatch run.dll X Added by the Troj/Dloader-XF Trojan. Secure Patch run.dll X Added by the Troj/Dloader-ZS Trojan. Desktop Run.dll X Added by the WSearch adware. sc run.exe U All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes, rememb ... Read More SPP run.exe ? ?? Windows run.exe X Added by the W32/Sdbot-XW. When this infection starts it connects to a remote IRC server where it waits for commands to execute. ... Read More runs run.exe X Added by the W32/Rbot-BWF worm. When started, this infections connects to a remote IRC server where it waits for commands to execute. ... Read More LSA run.exe X Unknown malware. System run322.exe X Added by the LANFILT TROJAN! klp run32dll.exe U PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online ... Read More winstro RUN32DLL.exe X Added by the FTP_ANA TROJAN! run32 run32dll.exe X Added by the W32/Sdbot-CWB worm and IRC backdoor. WinLogons run32dll.exe X Identified as a variant of the TrojanSpy.Agent malware. runAP runAP.exe N Not required but what is it? Microsoft Dll runapidll.exe X Added by the W32/Rbot-GRG worm and IRC backdoor. Runapp32 Runapp32.exe X Added by the NEODURK TROJAN! AlfaAntivirus runbst.exe X Related to the AlfaAntivirus rogue anti-spyware program. atf.exe runbst.exe X Related to the AlfaAntivirus rogue anti-spyware program. SecurePCGuard runbst.exe X Added by the SecurePCGuard rogue antispyware program. micore runc.exe X Mediainject displays advertisements on your computer. Rund013.exe Rund013.exe X Added by the Troj/StartPa-HX Trojan. This infection will change Internet Explorer's home page. ... Read More Taskbell.exe Rund1.exe X Added by the YIPID TROJAN! Rund11 Rund11.EXE X Added by the W32/Mario-C worm. rund1132 rund1132.exe X Added by the W32/Dopbot-A worm. Rund1132.exe Rund1132.exe X Added by the Troj/StartPa-HS Trojan. sys001 rund1132.exe X Added by the Troj/Small-DLD downloading Trojan. avptask rund1132.exe X Added by the Troj/Nofere-G Trojan. Troj/Nofere-G contains functionality to communicate with a remote server using HTTP, execute downloaded files, kill ... Read More Tencent QQ Rund1132.exe qq.dll, Rundll32 X Added by the QQPASS.F TROJAN! SysDeskqqfx Runddll32.exe X Added by the PWSteal.Changgame password-stealing Trojan for a chinese online gaming site. ... Read More windows automaticupdater runddls.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More {1acc2535-fa1a-4478-0302-020006060805} rundII32.exe X A variant of the Backdoor.Win32.PoisonIvy malware. This infection should not be confused with the legitimate C:\Windows\System32\rundll32.exe file. ... Read More runner rundIl.exe X Added by the WORM_MYTOB.FV mass-mailing worm. ctfnom rundIl32.exe X Added by the LEGMIR-AW TROJAN! {9D71D88C-C598-4935-C5D1-43AA4DB90836} RUNDILL32.exe X A variant of the Backdoor.Bifrose backdoor Trojan. Backdoor.Bifrose is a Trojan horse that uses a backdoor server to send information to a remote serv ... Read More LoadPowerProfile rundl.exe X Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll ... Read More PowerPrifile rundl132 kenel.dll, PowerProfileEnable X Added by the INMOTA WORM! [not used] rundl132.exe X Added by the W32/Looked-A EXE virus. ryy rundl132.exe X Added by the Troj/Lineag-BBD password-stealing Trojan for the online game Lineage. ... Read More <random name> rundl13a.exe X Added by the Troj/Gampass-L information-stealing Trojan. RUNDLL32 rundl32.exe X Added by the W32/Demotry-A worm. NvCpl rundl32.exe X Added by the W32/Agobot-TO worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More Windows DNS rundl32.exe X Added by the Troj/GrayBrd-AG backdoor Trojan. Windows Automatic Updater rundl32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Microsoft Windows RUN DLL RUNDL32.EXE X Added by the W32/Rbot-GVK worm and IRC backdoor. This infection should not be confused with the legitimate C:\Windows\System32\rundll32.exe file. ... Read More startwindowskeyuser rundle2.exe X Added by the JAVAKILLER TROJAN! rundli32 rundli32.exe X Added by the LADE WORM! Windows TM rundlI32.exe X Added by a variant of the WIN32.RBOT WORM! Taskbar Display Controls RunDLL deskcp16.dll, QUICKRES_RUNDLLENTRY N Only appears in MSCONFIG if you have a Display Settings icon in the System Tray allowing resolution changes on the fly. Can also be disabled under Con ... Read More DNE Binding Watchdog rundll dnes.dll, DnDneCheckBindings Y Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol d ... Read More DNE DUN Watchdog rundll dnes.dll, DnDneCheckDUN13 Y Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol d ... Read More RundllSvr Rundll.exe X Added by the HUAYU WORM! Windows Upate rundll.exe X Added by the HAKO TROJAN! Note - this is NOT the Windows system file of the same name as described here ... Read More Windows32 rundll.exe X Added by the AGOBOT-LK or AGOBOT-ND WORMS! @ RUNDLL.EXE X Added by the W32/Spybot-DN WORM! Windows Config RUNDLL.EXE X Added by the W32/Spybot-DX worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More RunDll RunDll.exe X Added by the Troj/QQPass-AH password-stealing Trojan. Microsoft Service rundll.exe X Added by the W32/Popo-A worm. Microsoft run manager rundll.exe X Added by the W32/Rbot-BFP worm and IRC backdoor. Autostart Helper rundll.exe X Added by the W32/Sdbot-BBG worm and IRC backdoor. Windows RunDLL32 rundll.exe X Added by the W32/Mytob-HS worm and IRC backdoor. This infection should not be confused with the legitimate c:\windows\system32\rundll32.exe file. ... Read More DateTimeUpdater rundll.exe X Identified as Win-Trojan/MircPack. This Trojan will connect to an IRC channel where it will wait for commands. ... Read More System rundll.exe X Added by the W32/SillyFD-A worm. Microsoft DLL Verifier rundll.exe X A variant of the RBot family of worms and IRC backdoor Trojans. RunDLL Kernel File Core rundll.exe X A variant of the RBot family of worms and IRC backdoor Trojans. LoadPowerProfile Rundll.exe powerprof.dll X Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses "Rundll.exe" whereas ... Read More clnwall rundll.exe setupx.dll, InstallHinfSection ..delwall.inf ? ?? LLMODCL2 rundll.exe setupx.dll, InstallHinfSection ..LLMODCL2.INF ? ?? ZIBMACC rundll.exe ZIBMACC.INF X ZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if ne ... Read More Windows Running DLL Service rundll128.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Regro rundll132.exe X Added by the PWSteal.Ragnarok password-stealing Trojan for the online game Ragnarok. ... Read More Rro rundll132.exe X Added by the Troj/LegMir-DX password-stealing Trojan for the online game Legend of Mir. This infection also creates the file C:\Windows\System32\rodl ... Read More RDLL RunDll16.exe X Added by the SDBOT.F TROJAN! Rundll16 Rundll16.exe X Added by a number of VIRUSES, WORMS and TROJANS! Win32 USB2.0 Driver rundll16.exe X Added by the WOOTBOT.H WORM! Windows DLL Loader RUNDLL16.EXE X Added by the DOMWIS TROJAN! svchost Rundll16.exe X Added by the Troj/StartPa-PB TROJAN! Redirecting of browser start & search pages will result. DBG.EXE and RUNDLL.EXE are copied to the Windows folder ... Read More (109DFD46-20F3-0D29-0600-010804010205) rundll16.exe X Added by the Troj/Delf-LV Trojan. NvCplFilter RUNDLL21.SYS X Added by the Troj/Bckdr-OYG backdoor Trojan. Microsoft Update Module rundll24.exe X Added by the RBOT-PS WORM! MMSystem RunDll32 X Added by the FUNNER-A WORM! gvagfxj rundll32 ...gvagfxj.dll X Unidentified adware, spyware or virus drvupd rundll32 ..drvupd.inf X Hijacker - drvupd.inf file installs a "searchforge.com" hijack AudCtrl RunDll32 AudCtrl.dll, RCMonitor ? Audio control panel? AxFilter Rundll32 AXFILTER.DLL, Rundll32 ? ?? sp rundll32 C:\NvRun\se.dll,DllInstall X Added by the Troj/StartPa-FJ TROJAN and might also install another start-page Trojan with the filename "fpid.dll". ... Read More Cmaudio Rundll32 cmicnfg.cpl, CMICtrlWnd N System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings - ... Read More Rundll32 cmicnfg Rundll32 cmicnfg.cpl, CMICtrlWnd N System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings - ... Read More babeie rundll32 cnbabe.dll, dllstartup X CommonName Toolbar spyware. To uninstall see here Zenet rundll32 CNBabe.dll, DllStartup X CommonName Toolbar spyware. To uninstall see here SoundFusion rundll32 hercplgs.cpl, BootEntryPoint ? Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need t ... Read More Image rundll32 image.dll, Install X CoolWebSearch parasite variant xkstartup RunDll32 InstZ82.dll, SetUsbPrinterPort ? On a system with a Lexmark printer ControlPanel rundll32 internat.dll, LoadKeyboardProfile X CoolWebSearch parasite variant kernctl32 rundll32 kctl32.dll, initialize X Added by the AGENT.AT TROJAN! WinXPLoad Rundll32 LoadDll, LoadExe WinXPLoad.exe U Compaq hotkey related - required if you use the hotkeys NVCLOCK rundll32 nvclock.dll, fnNvclock ? Overclocking utility for nVidia based graphics cards? Pwrmonit Rundll32 PwrMonit.dll Y IBM's proprietary 'battery maximiser' and power monitoring software for laptops BMMGAG Rundll32 PWRMONIT.DLL, StartPwrMonitor U Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery inf ... Read More RSS rundll32 RSSToolbar.dll, DllRunMain X "Related Sites" toolbar - SearchAndClick hijacker variant SbUsb AudCtrl RunDll32 sbusbdll.dll, RCMonitor U Control for Soundblaster MP3 external (USB) sound card keymgrldr rundll32 setupapi, InstallHinfSection... keymgr3.inf X CoolWebSearch parasite variant SysPnP rundll32 setupapi, InstallHinfSection.... oemsyspnp.inf X Search hijacker - see here Tweak UI RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup X Added by the SUBWOOFER TROJAN! Note - the real Tweak UI entry for this is "rundll32.exe tweakui.cpl, tweakmeup" ... Read More LXBTCATS rundll32 [path] LXBTtime.dll,_RunDLLEntry@16 ? Lexmark printer related - what does it do and is it required? Tesco.net rundll32 [path] RyDial.dll, QuickStart N Tesco.net dial-up ISP software - not required SurfBuddy rundll32 [path] sbuddy.dll X SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps! ... Read More WebSpecials rundll32 [path] webspec.dll X WebSpecials spyware New.net Startup rundll32 [path], NewDotNetStartup -s X NewDotNet foistware NT security rundll32.com X Added by the W32/Rbot-AJC worm. This infection, when started, connects to an IRC server where it sits on a channel awaiting commands. ... Read More BatInfEx rundll32.exe U Displays battery status information on an IBM Thinkpad LoadPowerProfile Rundll32.exe X Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line ... Read More Rundll32 Rundll32.exe X Added by the DVLDR TROJAN! Note - this is not the valid "Rundll32.exe" as it's in the WindowsFonts directory ... Read More rundll32 rundll32.exe X Added by the SANKER WORM! Note that the valid "rundll32.exe" resides in C:\Windows\System32 whereas this version resides in C:\Windows ... Read More TaskMan rundll32.exe X Added by the DVLDR TROJAN! Note - this is not the valid "rundll32.exe" as it's in the WindowsFonts directory ... Read More UPDATEHOOK Rundll32.exe ? ?? Win32 Rundll Loader Rundll32.exe X Added by the SDBOT.A TROJAN! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:\Windows directory. Th ... Read More Windows DLL Loader rundll32.exe X Added by the WHIPSER-B WORM! Note - rundll32.exe file is placed in the Windows System folder, wheras the legitimate rundll32.exe is located in the C:\ ... Read More loadMefs rundll32.exe X Added by the Troj/LegMir-JA TROJAN! SysWy rundll32.exe X Added by the Troj/Lineage-JH information-stealing Trojan for the online game Lineage. ... Read More loadMecq3 rundll32.exe X Added by the Troj/LegMir-A password-stealing Trojan. Regrx rundll32.exe X Added by the Troj/Wayic-A information stealing Trojan. Note: This should not be confused with the legitimate rundll32.exe file in your Windows system ... Read More LTT2 rundll32.exe X Added by the Troj/Lineage-BI password-stealing Trojan for the online game lineage. ... Read More rz rundll32.exe X Added by the Troj/Lineage-BP password-stealing Trojan for the online game Lineage. ... Read More rx rundll32.exe X Added by the Troj/Gamec-G password-stealing Trojan. Lwy rundll32.exe X Added by the Troj/PWS-XN password stealing Trojan. This infection should not be confused with the legitimate C:\Windows\System32\rundll32.exe file. ... Read More Loadhg rundll32.exe X Added by the Troj/Lineag-ABX password-stealing Trojan for the online game Lineage. ... Read More Rhg rundll32.exe X Added by the Troj/Lineag-BIT password stealing Trojan for the online game Lineage. This infection should not be confused with the legitimate C:\Window ... Read More Ljx rundll32.exe X Added by the Troj/Lineag-ABD backdoor and password-stealing Trojan for the online game Lineage. This infection is not the legitimate C:\Windows\Syste ... Read More rzt rundll32.exe X Added by the TSPY_LINEAGE.BDP password-stealing Trojan for the online game Lineage. This infection should not be mistaken for the legitimate C:\Window ... Read More RKrx rundll32.exe X Added by the Troj/Lineag-ADA password-stealing Trojan for the online game Lineage. ... Read More Rr2 rundll32.exe X Added by the Troj/Lineag-ACZ password-stealing Trojan for the online game Lineage. ... Read More Microsoft (R) Windows DLL Loader rundll32.exe X Added by the Backdoor.Ranky backdoor Trojan. This infection should not be confused with the legitimate C:\Windows\System32\rundll32.exe. ... Read More Microsoft Windows Driver rundll32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. This infection should not be confused with the legitimate C:\Windows\System32\rundll ... Read More Windows rundll32.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. Windows Firewall rundll32.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. This infection should not be confused with the legitimate C:\Windows\System32\rundll ... Read More CPU Watcher rundll32.exe %Windows%\cpu.dll,load X Added by the Troj/Dloader-LO. he3bbcff rundll32.exe (path) he3bbcff.dll,EnableRunDLL32 X LZIO.com adware downloader ... Read More icddefff rundll32.exe (path) icddefff.dll,EnableRunDLL32 X LZIO.com adware downloader ... Read More ielcaabe rundll32.exe (path) ielcaabe.dll,EnableRunDLL32 X LZIO.com adware downloader ... Read More wmcbaaca rundll32.exe (path) wmcbaaca.dll,EnableRunDLL32 X LZIO.com adware downloader ... Read More Bridge rundll32.exe ...Bridge.dll X Flingstone.com browser hijacker NVMCTRAY RUNDLL32.EXE ...NVMCTRAY.DLL, NvTaskbarInit N System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - ... Read More lhttseng rundll32.exe ..lhttseng.inf, RemoveCabinet N Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine ... Read More VoodooBanshee rundll32.exe 3DBBps.dll, BansheeLoadSettings U Loads the configuration settings for a 3dfx Voodoo Banshee chipset based graphics card. If you change some of the settings from default you probably n ... Read More delsubmit rundll32.exe advpack.dll, DelNodeRunDLL32 submit.exe X CoolWebSearch parasite variant BCMHal rundll32.exe bcmhal9x.dll, bcinit U BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be need ... Read More BIE Rundll32.exe BDSrHook.dll, Rundll32 X BDplugin parasite Systems Restart Rundll32.exe beem.dll, DllRegisterServer X Browser hijacker - the file serves to register a dll implemented as a browser plugin ... Read More Systems Restart Rundll32.exe boln.dll, DllRegisterServer X Added by the Troj/StartPa-FQ. RunDLL rundll32.exe bridge.dll, Load X Flingstone.com browser hijacker Bsx3 Rundll32.exe bs3.dll, DllRun X BookedSpace parasite variant bxsx5 RunDLL32.EXE bsx5.dll X BookedSpace parasite variant WildTangent CDA RUNDLL32.exe cdaEngine0400.dll,cdaEngineMain N Part of the WildTangent on-line games system. This is not required for the games to work. ... Read More CnsMin Rundll32.exe CNSMIN.DLL, Rundll32 X CnsMin "Chinese Keywords" hijacker related CrazyTalk Serve rundll32.exe CrazyTalk.dll, DIIServeMediaFile N CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph ... Read More Control rundll32.exe ctrlpan.dll, Restore ControlPanel X CoolWebSearch parasite variant 98d0ce0c16b1 rundll32.exe D0CE0C16B1,D0CE0C16B1 X BrowserAid/Startium parasite related ... Read More DeadAIM rundll32.exe DeadAIM.ocm, ExportedCheckODLs N DeadAIM - feature enhancing product for AOL's Instant Messenger program Instant Access rundll32.exe EGDHTML_1023.dll, InstantAccess X Adult content dialler related Rundll32_8 rundll32.exe inetp60.dll, DllRunServer X BrowserAid parasite variant MigrationVendorSetupCaller rundll32.exe migrate.dll, CallVendorSetupDlls ? ?? Dialer rundll32.exe msa32chk.dll X Unidentfied malware ContentDownload rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related CoolDownloads rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related CoolMP3 rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related DownloadLegalMusic rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related FreeMP3download rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related GetTheMusic rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related NiceDownloads rundll32.exe MSA64CHK.dll, DllMostrar X MatrixDialer related Desktop rundll32.exe msconfd.dll, Restore ControlPanel X Added by the BOOKMARKER TROJAN! Mass storage check registry rundll32.exe MSDServ.dll, check registry N Used with a USB based smartmedia card reader LoadHTML rundll32.exe mshtmpre.dll, MShtmpre X Browser hijacker Protected Storage RUNDLL32.EXE MSSIGN30.DLL ondll_reg X Added by a variant of the LOVGATE WORM! VFW Encoder/Decoder Settings RUNDLL32.exe MSSIGN30.DLL ondll_reg X Added by a variant of the LOVGATE WORM! NAVUpd rundll32.exe navupd.dll, Startup X Added by the NAVU TROJAN! New.net rundll32.exe NewDotNetStartup Newdot~2.exe X NewDotNet foistware NEWDOT~1 rundll32.exe NewDotNetStartup Newdot~2.exe X NewDotNet foistware RFX_auto_upgrade rundll32.exe npvpg005.dll N A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade ... Read More NvCpl rundll32.exe NvCpl.dll, NvStartup U Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card ... Read More NVIEW rundll32.exe nview.dll, nViewLoadHook U This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers ... Read More RunDLL32 RunDLL32.exe NvMCTray.dll, NvTaskbarInit N System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - ... Read More NvColorInit rundll32.exe NvQtwk.dll, NvColorInit ? Associated with Nvidia based graphics cards NvidiaQuickTweak rundll32.exe NvQtwk.dll, NvTaskbarInit N System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - ... Read More NVQuickTweak rundll32.exe NvQtwk.dll, NvTaskbarInit N System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - ... Read More NvInitialize rundll32.exe NvQtwk.dll, NvXTInit N Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled ... Read More OfotoNow USB Detection Rundll32.exe OFUSBS.DLL, WatchForConnection OfotoNow N Autodetects when a digital camera is attached to a USB port and launches OfotoNow image software. Available via Start -> Programs ... Read More oo4 RunDLL32.EXE oo4.dll, DllRun X BookedSpace parasite variant Instant Access rundll32.exe p2esocks_xxxx.dll,InstantAccess X Added by the Instant Access Adware. The file name always starts with p2esocks_ followed by 4 random numbers. ... Read More LoadPowerProfile Rundll32.exe powrprof.dll U Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your ... Read More Rundll32 Rundll32.exe ptipbm.dll, SetWriteBack X Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. If used is it required? ... Read More rundll32 rundll32.exe ptipbmf.dll, SetWriteCacheMode ? Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain ... Read More ptipbmf rundll32.exe ptipbmf.dll, SetWriteCacheMode ? Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain ... Read More ForceShow rundll32.exe QaBar.dll, ForceShowBar X AdultLinks/QAbar parasite related Module Call initialize RUNDLL32.EXE reg.dll, ondll_reg X Added by a variant of the LOVGATE WORM! Remote Procedure Call Locator RUNDLL32.EXE reg678.dll ondll_reg X Added by a variant of the LOVGATE WORM! RUSBHOLoader rundll32.exe RUSBHOLoader.dll, AutoRegister ? ?? saSyncMgr rundll32.exe sasync.dll, SyncWait X Browser hijacker - redirecting to Searchant.com Compaq Computer Security Rundll32.exe SECURE32.CPL, Service ? ?? Systems Restart Rundll32.exe snim.dll, DllRegisterServer X Browser hijacker - the file serves to register a dll implemented as a browser plugin ... Read More sre rundll32.exe sre.dll,Register X Unidentified adware WIAWizardMenu RUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenu N Still Image Class Installer - installed with a webcam {2CF0B992-5EEB-4143-99C0-5297EF71F444} rundll32.exe stlbdist.dll, DllRunMain X BrowserAid/Startium parasite stlbupdt rundll32.exe stlbupdt.DLL, DllRunMain X BrowserAid/Startium parasite {2CF0B992-5EEB-4143-99C2-5297EF71F44B} rundll32.exe stlbupdt.DLL, DllRunMain X BrowserAid/Startium parasite AdslTaskBar rundll32.exe stmctrl.dll, TaskBar Y ISP software, initializes DSL modem Ccdecode rundll32.exe streamci, StreamingDeviceSetup N Part of the closed caption decdoder/MS VBI codec. Should only run once SynUSB Manager rundll32.exe SynUSB.dll,RunDll32 X Added by the Troj/Riler-A trojan. System Check Rundll32.exe SysDll32.dll, SystemCheck U XPCSpy Pro keylogger, surveillance and monitoring software Tweak UI rundll32.exe tweakui.cpl, tweaklogon U Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed Tweak UI rundll32.exe tweakui.cpl, tweakmeup U Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed ... Read More tweak ui 1.33 deutsch RUNDLL32.EXE TWEAKUI.CPL, TweakMeUp U Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed - German version ... Read More UCmore XP - The Search Accelerator rundll32.exe UCMTSAIE.dll, DllShowTB U UCmore toolbar - search accelerator V128IID Rundll32.exe v128iitw.dll, STB_InitTweak Y Loads drivers for some STB graphics cards such as the STB nVIDIA TNT 16MB. Required if you don't want to experience lock-ups or error messages ... Read More W3KNetwork rundll32.exe w3knet.dll, dllinitrun X Advertising spyware. Check here for more info on this particular one rundll32 Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings U Loads default settings for Leadtek Winfast graphics cards Winfast2KLoadDefault Rundll32.exe Wf2kcpl.dll, DllLoadDefaultSettings U Loads default settings for Leadtek Winfast graphics cards WinFast_Gamma Rundll32.exe wfcpl.dll, DllLoadGammaRampSettings U Loads if you change the gamma settings on Leadtek WinFast graphics cards WinFast_Taskbar rundll32.exe wftask.dll, WFDllLoadDefaultSettings U Loads default settings for Leadtek WinFast graphics cards WinHacker rundll32.exe wh95.dll, HackMe N Tweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free ... Read More BMMMONWND rundll32.exe [path] BatInfEx.dll, BMMAutonomicMonitor ? IBM Thinkpad related. What does it do and is it required? cfgmgr52 RunDLL32.EXE [path] cfgmgr52.dll,DllRun X BookedSpace adware variant ... Read More he3e3fc4 rundll32.exe [path] he3e3fc4.dll, EnableRunDLL32 X LZIO.com adware downloader icdd7ee6 rundll32.exe [path] icdd7ee6.dll, EnableRunDLL32 X LZIO.com adware downloader iel2cde8 rundll32.exe [path] iel2cde8.dll, EnableRunDLL32 X LZIO.com adware downloader kw3eef76 rundll32.exe [path] kw3eef76.dll, EnableRunDLL32 X LZIO.com adware downloader li01f948 rundll32.exe [path] li01f948.dll, EnableRunDLL32 X LZIO.com adware downloader LicCtrl rundll32.exe [path] MMFS.DLL, Service U Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to e ... Read More readdb40 rundll32.exe [path] readdb40.dll, EnableRunDLL32 X LZIO.com adware downloader si91e44b rundll32.exe [path] si91e44b.dll, EnableRunDLL32 X LZIO.com adware downloader LoadSIPS rundll32.exe [path] SIPSPI32.dll, SIPSPI32 X 123Mania adware IE Menu Extension toolbar rundll32.exe [path] tbextn.dll DllShowTB X Topconverting.com/180Search "IEMenuExtension" toolbar Games toolbar rundll32.exe [path] tbGame.dll, DllShowTB X Topconverting.com180Search "Games Toolbar" adware wm41a398 rundll32.exe [path] wm41a398.dll, EnableRunDLL32 X LZIO.com adware downloader winupd RUNDLL32.EXE [random value].dll, _mainRD X Added by the MOTA.A WORM! winupdt RUNDLL32.EXE [random.dll] X Added by the MABUT.A WORM! Windows Security Assistant rundll32.vbe X CoolWebSearch parasite variant stlbdist rundll32exe stlbdist.DLL, DllRunMain X Hijacker pointing to www.searchandclick.com Compaq Service Drivers rundll42.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. MSConfigs RUNDLL64.dll.vbs X Added by the W32/Wekode-B worm. [not used] rundll64.exe X Added by the Troj/Legmir-BD informations stealing Trojan for the online game Legend of Mir. ... Read More rundll32 rundll64.exe X Added by the TROJ_DELF.BKC Trojan. Microsoft Install Shield Services rundll64.exe X Added by the W32/Rbot-FSH worm and IRC backdoor. Windows Running DLL Service rundll64.exe X A variant of the IRCBot family of worms and IRC backdoor Trojans. Run DDLs Files rundll82.exe X Added by the Net-Worm.Win32.Kolabc.d worm. Mircrosoft Windows Config DLL rundllc32b.exe X Added by W32/Rbot-ZY. PowerManagement Rundlll.exe X Added by the SURDUX TROJAN! Microsoft Windows Update rundlls.exe X Added by the HABRACK WORM! Rundll RUNDLLS.EXE X Added by the Troj/PWS-ADY password-stealing Trojan. Rundllsystem32 Rundllsystem32.exe X Added by the NETDEVIL.B TROJAN! RUNDLLW.EXE RUNDLLW.EXE X Added by the W32/Dumaru.w Trojan! Acts as a keylogger and sends out the stolen information to a predetermined email address. ... Read More <not used> Rundllw32.exe X Added by the W32/Gift-B mass-mailing worm. Run05 rundll_32.exe X Added by the Troj/Bancos-DT password-stealing Trojan. Rundll Rundll~.exe X Added by the W32/Delf-KT trojan and P2P worm. Rundnm Rundnm.exe X Added by the DELF-HA TROJAN! AdobeManager rundtl.exe X Added by an Unknown Trojan. Microsoftf DDEs ContDLL rune.pif X Added by the W32/Rbot-AGF worm. fc runfc.exe X Added by the CAMPURF WORM! Java Runtime Value runjava.exe X Added by the W32/Rbot-DDJ worm and IRC backdoor. Rnudll32 runlli32.exe X Added by the Troj/QQPass-U Trojan. chope runlli32.exe X Added by the Troj/QQPass-U ... Read More hkeyok runlli32.exe X Added by the Troj/QQPass-U ... Read More [various names] runload32.exe X TROJAN! - part of Wareout, malware masquerading as a spyware and dialer remover, see here ... Read More Microsoftf DDEs ContrDL runm.pif X Added by the W32/Rbot-AFQ worm. When started, this infection connects to a remote IRC server and waits for commands to execute. ... Read More Open2Enter runme.exe X Adult content dialler Open2Enter runme2.exe X Adult content dialler blah service runningg.exe X A variant of the IRCBot family of worms and IRC backdoors. oledb service runoledb32.exe X Added by a variant of the SPYRE.B TROJAN! ... Read More SystemR Runonce.com X Added by the Virus.Win32.HLLW.Anirak virus/worm. mdac_runonce runonce.exe N Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe".  ... Read More RunOnce RUNONCE.EXE U Part of MS Data Access Components - only required if you use these Paperport runppdrv.exe N Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here ... Read More Microsoftf DDos Contr0l runs.pif X Added by the W32/Rbot-AMH worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More LicCtrl runservice.exe U Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to e ... Read More LicCtrl Service runservice.exe Y Elicense is a common licensing tool used and installed by many programs. It should only be disabled if it is known to be causing you problems. ... Read More liccrtl runservice.exe N eLicense, licensing system incorporated with some software and games ... Read More runsql runsql.exe X Identified by Normon antivirus as the W32/Zapchast.AQK malware. Srv32 spool service runsrv32.exe X Topantispyware.com malware, recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b ... Read More RunServices runsvc32.exe X Added by the AGOBOT.QJ WORM! RunSysd32 RunSysd32.exe U DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if usi ... Read More setup runt32.exe X Added by the Troj/QQPass-K Trojan. setupa runt32.exe X Added by the TROJ/QQPASS-K TROJAN! ... Read More runtime2 runtim2.sys X Added by the Troj/Rootkit-BI rootkit. runtime.exe runtime.exe X A variant Trojan Tibs malware. Runtime runtime.sys X Added by the Troj/Agent-EEK Trojan. runtime2 runtime2.sys X Identified by Kaspersky as Rootkit.Win32.Agent.ey. runwin32 runwin32.exe X Added by the ESEARCH-A TROJAN! RUNXMLPL.exe RUNXMLPL.exe N Software found on Acer computers. Information suggests it maps keyboard buttons to operating system functions. ... Read More Classes run_21.exe X "Switch" adult content dialler Run_cd Run_cd.exe X Added by the GHOST.23 TROJAN! MSTask run_dll.exe X Added by the Adware.Yuupsearch toolbar. Rupsw32 Rupsw32.exe U MegaTec Rups, UPS monitoring software - monitor and control DB9 UPS running on either Windows & Novell NetWare (with RUPS 2000) or Unix (with RUPS ... Read More NAV RuxDLL32.exe X Added by the MAPSON.D WORM! Remote Access Adapter rvasvc.exe X A variant of the Backdoor.Win32.IRCBot.alo family of worms and IRC backdoor Trojans. ... Read More AdobeReaderPro rvdjlefr.exe X Added by the W32/Rbot-CQZ worm and IRC backdoor. Yahoo Messengger RVHIOST.exe X Added by the W32/Sohana-AC worm. Yahoo Messengger RVHOST.exe X Added by the W32/SillyFDC-G floppy disk and network worm. Microsoft IT Update Rvhost32.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. RVS CAPI rvs_cent.exe ? RVCS_CENT is used by certain Internet Providers in Germany for ISDN and DSL connections. ... Read More updmgr rvupdmgr.exe X Added by the Adware.Keenval redirector. <random characters> rwg.exe X Added by the Green AV rogue anti-spyware program. <not used> rwinsta.dll X Identified by Kaspersky as the Trojan.Win32.Agent.bea Trojan. RWipeD rwiped.exe Y This programs is related to R-Wipe & Clean. This is a helper process for task scheduling. If there are no scheduled tasks in R-Wipe&Clean then it doe ... Read More RWipeKbdDemon RWKbdD.exe Y This program is related to R-Wipe & Clean. This program provides the "boss key" functionality, it handles some hot keys if the "boss key" setting is ... Read More rwlfsdmk rwlfsdmk.dll X Identified as a variant of the VideoAccessCodec adware. Soar Rwon.exe X PurityScan/Clickspring adware Remote Access Tool rwosvc.exe X A variant of the Backdoor.Win32.IRCBot.bhb family of worms and IRC backdoor Trojans. ... Read More Remote Access Monitor rwpsvc.exe X A variant of the Backdoor.Win32.IRCBot.bfa variant family of worms and IRC backdoor Trojans. ... Read More rwtatpl rwtatpl.lid X Added by the Backdoor.Rustock backdoor rootkit. DW_Start rwwnw64d.exe X Identified as a variant of the AdWare.Win32.ZenoSearch.am malware. Microsoft Update Machine rx.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. Microsoft Update rxbot2.exe X A variant of the Rbot family of worms and IRC backdoor Trojans. Microsoft Update Machine rxhost.exe X Added by the RBOT.FC WORM! <not used> rxjddnvj.exe X Identified as part of the Adware/UltimateCleaner rogue anti-spyware program. RoxioAudioCentral RxMon.exe N Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound edi ... Read More RxMon rxmon9x.exe N Dell Resolution Assistant rxp rxp.sys Y StarSkin allows you to change the view and appearence of your Windows XP box with the use of publicaly available themes. Users may customize all visua ... Read More crsss RxpMoN.Exe X Added by the W32.Niuniu.B worm. W32.Niuniu.B is a worm that spreads through removable drives. It may also lower security settings on the compromised c ... Read More {68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3} rxqcpn.dll X Part of the Zlob trojan that displays fake security alerts for the rogue anti-spyware program called SpyLocked. ... Read More rxx5ot rxx5ot.dll X Added by a variant of the HaxDoor Trojan Trojan. microsoft update dll rxxhost.exe X Added by a variant of the WIN32.RBOT WORM! ... Read More microsoft update machine rxxhost.exe X Added by the RBOT.EP WORM! ... Read More ydanmxe.exe rydanmxe.exe X Added by the Troj/Dloadr-AZZ Trojan downloader. ntlfreedom RyDial.dll, QuickStart N NTL Freedom ISP software - reportedly not required rYehhbqzx rYehhbqzx.adm X Added by the Backdoor.Rustock backdoor rootkit. {bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d} ryxrho.dll X Zlob Trojan that installs VirusProtectPro 3.6 and shows fake security alerts from your Windows taskbar. ... Read More SB13mini RYZO32.EXE X Added by the W32/Spybot-EJ worm. When started, this infection connects to a remote IRC server where it waits for commands to execute. ... Read More rz.scr rz.scr X Added by the W32/SillyFDC-AY worm. Winds Sersc Agts rzrzncrtz.exe X Added by the W32/Rbot-GTV worm and IRC backdoor. r_server r_server.exe Y Radmin - remote admistrator server SRFirstRun srclient.dll U Created by execution of the Windows XP sr.inf file, which installs the Windows XP System Restore feature, needed for example when installing System Re ... Read More {12EE7A5E-0674-42f9-A76B-000000004D00} stlb2.dll X BrowserAid/Startium parasite Status Key Each entry in the database will have a Status assigned to it. The key to this status is the following: Y - This status flag means that this entry should be left alone and be allowed to run as if it is unchecked it may break the functionality or use of a particular program. N - This status flag means it is unnecessary to run this program automatically when Windows starts as you can run it manually when necessary. U - This status flag means it is up to you whether or not you feel this program needs to run automatically. X - This status flags means the item should definitely not start up automatically. Items that have this flag are generally malware such as viruses, trojans, hijackers, spyware but could also be programs that are not desirable to run on your computer. ? - This status flag means the status of this entry is unknown at this time and more research is necessary. If you require assistance in removing one of these files you can ask us in the Startup Database Forum. Disclaimer It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. BleepingComputer.com will not be held responsible if changes you make cause a system failure. This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Advertise   |   About Us   |   Terms of Use   |   Privacy Policy   |   Contact Us   |   Site Map   |   Chat   |   Tutorials   |   Uninstall List

Discussion Forums   |   The Computer Glossary   |   Resources   |   RSS Feeds   |   Startups   |   The File Database   |   Virus Removal Guides

Portions of this database © Paul Collins
© 2003-2009 All Rights Reserved Bleeping Computer LLC.
PGT: 0.34843 Queries: 5