Windows XP A to Z - http://www.softwaretipsandtricks.com/windowsxp
Start Up Applications R
http://www.softwaretipsandtricks.com/windowsxp/articles/611/1/Start-Up-Applications-R
Super Admin
 
By Super Admin
Published on 03/28/2005
 
Starting with letter R

Start Up Applications R Page 1

Close Program/Task Manager
This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Operating System Differences
A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Noeton eMail Protect" in the registry.

To avoid the list becoming too large, all VIRUSES are shown using the registry version which is common to all Windows versions.

Alternatively use your browsers search facility - Ctrl+F for IE users.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

Use your browsers search facility - Ctrl+F for IE users.

X RA Server Slave.exe Added by the RA TROJAN!
X RabbitWannaHome rabbit.exe Added by the MIMAIL.S WORM!
Y Rabo Session Monitor RaboSessionMon.exe Related to RaboBank electronic banking software
N RadarSync RadarSync.exe Radarsync utility comes from DFI with their latest motherboards, e.g., DFI LanParty Ultra - checks for BIOS and driver updates periodically
U RadBoot RadBoot.exe RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings
U RadioSvr RadioSvr.EXE Used to configure wire less networks. Windows automatically detects the Wireless network and it configures the network
U RAMASST RAMASST.exe Optionally installed with some DVD drives (LG, Panasonic, etc). Disables Windows XP's CD-burning abilities because they cause some incompatibilities. It does not affect your ability to burn CDs. If you do not have this program running, you may have some compatibility issues with burnt DVDs
X RamBooster2 rb.exe Added by the AKAK TROJAN!
U RAMDef ramdef.exe Ram Def Xtreme - monitors and defragments your system RAM to improve reliability and speed. Some users swear by programs such as this but I suggest you read this article and make up your own mind
U RamIdle ramidle.exe RAM Idle - "A smart memory management program that will keep your computer running better, faster, and longer. RAM Idle works by  freeing up physical RAM wasted by Windows and other applications. In addition, RAM Idle also includes Cache and startup manager program that will give you more power to optimize your Windows." Some users swear by programs such as this but I suggest you read this article and make up your own mind
U RAMpage RAMpage.exe Small Windows utility that displays the amount of available memory in an icon in the System Tray. It can also free memory by double clicking the tray icon, or by setting a threshold that activates the program automatically, or by having it run automatically when an application exits. RAMpage is free, and open source
X Randex virus built for IRBMe irbme.exe Added by the RANDEX.RH WORM!
X RandomWin32 mgnwin32.exe Added by the SDBOT-DV WORM!
Y RapApp RAPAPP.EXE Application protection component of BlackICE PC Protection (was Defender) firewall, informing you of any modifications to programs, files or folders and detecting unknown programs trying to launch
U Rapid Restore rrpcsb.exe XPoint "Rapid Restore PC" - a "Managed Recovery™ solution that enables IT Administrators to protect the corporate image, while offloading personal data backup and recovery chores to the end user"
X RapidBlaster rb32.exe Homepage hijacker (adult content) - see this newsgroup thread
Y Raptor Mobile vpnservices.exe Symantec VPN Client used to connect to corporate networks. If unchecked, must be uninstalled using Add/Remove Programs as it tightly integrates into networking
X RasCon Remote Access Service Manager rasmngr.exe Added by the SPYBOT.EM WORM!
X Rase boln.exe PurityScan/Clickspring adware
X rate.exe i11r54n4.exe Added by the BEAGLE.E or BEAGLE.F or BEAGLE.G or BEAGLE.H or BEAGLE.I WORMS!
X rate.exe ********.exe [* = random char] Unidentified adware
Y RAV8Tray ravtray8.exe RAV anti-virus related
X RAVEN_VLZS.EXE RAVEN_VLZS.EXE Another eAcceleration program - spyware. Read their privacy statement here
Y RavMon RavMon.exe RAV AntiVirus
X RavTime Mstray.exe Added by the WUKILL.A WORM!
X RavTimer RavTimer.exe RAV AntiVirus
X RavTimeXP [worm filename] Added by the WULLIK.B WORM!
X RavTimXP [worm filename] Added by the WULLIK.B WORM!
? rav_temp.exe rav_temp.exe ??
N Ray Process Killer Prkill.exe Ray Process Killer - clicking right mouse button produces popup menu with current active tasks. You can choose any task and click "Ok" to terminate it. Use CTRL+ALT+DEL instead
X rb32 lptt01 rb32.exe Variant of the RapidBlaster parasite (in a "RapidBlaster" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X rb32 ml097e rb32.exe Variant of the RapidBlaster parasite (in a "RapidBlaster" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X rbenh ml***e rbenh.exe Variant of the RapidBlaster parasite (in a "RBEnhance" folder in Program Files) where *** represents random digits. It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Rcf Driver rcf.exe Added by the RANDEX.BLD WORM!
X rCron rcron.exe "Switch" adult content dialler
X rCron dservice.exe Switch premium rate adult content dialer
U RCScheduleCheck RCSCHED.EXE Scheduler for VCOM's Recovery Commander - which "can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running"
X RCSync RCSync.exe PrizeSurfer related. "PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!" Stealth installed malware
U RDClient RDCLIENT.EXE Remote Disconnection Utility from Twiga. Used for connecting and disconnecting dial up connections on a network - only needed if there is a shared internet connection
X RDLL RunDll16.exe Added by the SDBOT.F TROJAN!
X rdvs [worm filename] Added by the ULTIMAX WORM!
X Reactor3 [random name]32.exe Added by the BOFRA.A WORM!
X Reactor5 [random name]32.exe Added by the BOFRA.D WORM!
X Reactor6 [random name]32.exe Added by the BOFRA.C WORM!
X Reactor7 [random name]32.exe Added by the BOFRA.B WORM!
X Reactor8 [random name]32.exe Added by the BOFRA.E WORM!
X Reactor9 [random name]32.exe Added by the BOFRA.E WORM!
X readdb40 rundll32.exe [path] readdb40.dll, EnableRunDLL32 LZIO.com adware downloader
X Real Internet Player Reaiplay.exe Added by a variant of the SPYBOT WORM!
X Real player updater realupd.exe Added by the PARLAY TROJAN!
X real scheduler.hta RealAudio.exe Added by the CEEGAR TROJAN!
X Real-Tens Real-Tens.exe DownloadWare based advetising spyware
X RealAudio RealAudio.exe Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player
N RealDownload RealPlay.exe Download manager. Available via Start -> Programs
X RealDownload Express npnzdad.exe Advertising spyware
N Reality Fusion GameCam SE RFTRay.exe System Tray access for Logitech's Reality Fusion GameCam. For more details see here. Available via Start -> Programs
N RealJukeboxSystray tsystray.exe System Tray icon for RealJukebox
X realone_nt2003 moniker.exe Added by the SNONE.A WORM!
X RealP1ayer [path to file] Added by the RPLAY.A TROJAN! Note that the name has a number "1" in place of the second lower case "L"
N realplay realplay.exe System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X realplay lptt01 realplay.exe Variant of the RapidBlaster parasite (in a "RealPlay" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not RealPlayer which can have the same executable name
X realplay ml097e realplay.exe Variant of the RapidBlaster parasite (in a "RealPlay" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not RealPlayer which can have the same executable name
X Realplayer One realplay.exe Added by the RBOT-NK WORM!
? Realpopup Realpopup.exe RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor"
N Realsched realsched.exe Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry
? Realtime Audio Engine mmrtkrnl.exe ??
Y Realtime Monitor realmon.exe Realtime scanner part of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates
? RealTimeUpdate RealTimeUpdate.exe Product description in properties is "InternetExplorerCommunicationAgent Module" ?
N RealTray RealPlay.exe System Tray icon for RealPlayer. If you subsequently start RealPlayer manually it adds itself back to the start-up list. You can stop this from happening by right-clicking on the tray icon and disabling StartCenter via Preferences
X RealUpdater realupd.exe Added by the PARLAY or MITGLIEDER.I TROJANS!
N Reboot Reboot.exe MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards
Y Recguard recguard.exe On HP computers, Recguard prevents the deletion or corruption of the WinXP Recovery Partition. Without it enabled, it is possible to knock that completely out and force the customer to send the PC back to HP for a re-image, possibly at the customer's expense
N Reclip reclip.exe Reclip Popup Clipboard manager
X Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} RH.DLL SmartPops adware
N Recover N/A Added during the installation of Comcast High Speed Internet software. During installation the system reboots and if the disk is removed a screen appears asking for the disk to be re-inserted to complete installation. Not required once installion is complete
? RecoverFromReboo RECOVE~1.EXE ??
? RecoverFromReboo RecoverFromReboot.exe ??
? RecoverFromReboot RECOVE~1.EXE ??
? RecoverFromReboot RecoverFromReboot.exe ??
N RecShe RecSche.exe Recording scheduler for WatchTV Capture Card (TV Tuner card)
X RecycleSTR msreg32.exe Added by the RBOT-TC WORM!
N Red Flag redflag.exe PMS prediction program with modes for guys and girls - no longer available
X Red Swoosh EDN Client RSEDNClient.exe Red Swoosh - mechanism used by web sites to allow you to download files from those sites quicker and more efficiently. Note from the license agreement they automatically update the software and share non-personally identifiable information with others in the network
X redirect redirect*.exe Dotcomtoolbar/Linksummary hijacker installer - where * is a random digit
N Redline Taskbar taskbar.exe Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards
X REEGRUN [path to file] Added by the SECDROP.AI TROJAN
U Referee referee.exe MediaComm's monitor for file association changes. Stop rogue programs from screwing your settings either on installation or whenever they run
N Refresh Refresh.exe (Iomega) Refresh - loads the Iomega desktop icons at startup
X Reg Reg.hta Homepage hi-jacker. Removal instructions here
? Reg Check lpt.exe Related to Supanet ISP software - what does it do and is it required?
X Reg Service winsy.exe Added by a variant of the SPYBOT WORM!
X Reg Services Winboot32.exe Added by the RBOT.PB WORM!
X reg1.reg vuamgard.exe Added by a variant of the IRC.BOT TROJAN!
X Reg32 Reg32.exe Hijacker - redirecting to only-virgins.com
X reg32 reg32.exe Added by the NOUPDATE.B TROJAN!
X Reg32 reg33.exe CoolWebSearch parasite variant


Start Up Applications R Page 2
X Regcheck ~CAB001.EXE Added by the CYBRSPY.13A or CYBRSPY.13B TROJANS!
X RegCleaner SYSio32.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - do not confuse this with the popular RegCleaner registry cleaner freeware
X RegCompres Regcpm32.exe Added by the POLDO.B TROJAN!
X RegCompres REGCPM32.EXE Adult content dialler - see here. This has to be cleared at the same time as MSStartOptimizer (WINUPD.EXE), atisrc2 (windfind.exe) and mmxrun (msosa.exe), otherwise they return
X Regcxn Regcxn.exe Added by the COIBOA-D TROJAN!
X RegDone services.exe Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X RegDone winlogon.exe Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process, which should not appear in Msconfig/Startup!
X RegDone Ex csrss.exe Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
X RegDoneEx lsass.exe Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup!
X regedit regedit.exe Added by the BRID.A WORM! Note - resides in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP). The valid "regedit.exe" resides in C:Windows (Win9x/Me/XP) or C:Winnt (WinNT/2K)
X REGEDIT Regsrv32.com Added by the SOUTHGHOST WORM!
U RegFreeze regfreeze.exe RegFreeze anti-spyware software
X reggsdg spoolserv.exe Added by the SDBOT-MS WORM!
? reginfo32 reginfo32.exe ??
N Register MediaRing Talk register.exe If you don't want to register MediaRing and be reminded about it every bootup disable it
? Register SeqChk regsvr32.exe ..csseqchk.dll ??
U RegisterDropHandler REGIST~1.EXE Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation
N Registration-Studio 8 RegTool.exe Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems
X Registry wscript.exe Added by the VBSWG.AQ WORM!
X Registry Checkup winreg.exe Added by an unidentified WORM or TROJAN!
X Registry Loader regloadr.exe Added by the GAOBOT.AO WORM!
X Registry Loader winhlpp32.exe Added by the GAOBOT.AO WORM!
X Registry Scanner regscanr.exe Added by a variant of the OPTIX TROJAN!
X Registry Server regsrv32.exe Added by the RBOT-GM WORM!
X Registry Services Registry.exe Added by the DOWNLOADER.CILE TROJAN!
X Registry System16 Checkup Monitor SystemReg16.exe Added by a variant of the RBOT WORM!
X Registry System166 Checkup Monitor SystemReg166.exe Added by a variant of the RBOT WORM!
X RegistryChk winbackup.exe Added by the MERTIAN WORM!
U RegistryMechanic RegMech.exe Registry Mechanic for Windows - "you can safely clean and repair Windows registry problems with a few simple mouse clicks! Problems with the Windows registry are a common cause of Windows crashes and error messages"
X RegistryMonitor registry.pif Affilred adware
U REGIST~1 REGIST~1.EXE Part of the OCR software TextBridge Pro 9.0 (and possibly earlier versions). Typically used with imaging devices such as scanners and digital cameras for creating text documents from images. This item will probably be displayed twice and will re-instate itself whenever you start the main program so leave it - once started it frees the memory it used. Its purpose and an explanation of how to correct a problem it creates for "Send To" can be found here. Note that you don't have to uninstall TextBridge for this fix to work and the program works fine afterwards. Not used on later versions of the software - hence the 'U' recommendation
Y RegProt Regprot.exe RegistryProt from Diamond Computer Systems - protects the system registry against changes
X RegRun mActiveX.exe Added by a variant of the RBOT WORM!
X REGRUN winfix22490.exe Added by a variant of the RBOT WORM!
Y Regrun2 WatchDog.exe Greatis Software's RegRun 3 Security Suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's, viruses, etc 
X regservices.exe regservices.exe Added by an unidentified VIRUS, WORM or TROJAN!
N RegShave regshave.exe Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BEFORE attempting to uninstall the Fuji software or the uninstall may not work correctly
X regsrv regsrv.exe Added by the OPTIXPRO.11 TROJAN!
X Regsv regsv.exe Search hijacker - redirecting to scheo.com
X regsvc32 regsvc32.exe Homepage hijacker that changes your homepage to an adult content site
X regsvr regsvr.exe Added by the WEBMONEY-G TROJAN!
U REGSVR32 regsvr32.exe ctasio.dll ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality
? regtmlp N/A ??
U RegTweak RegTwk.exe Rage3d Tweak - ATI Radeon tweaker which allows access to registry tweak options, custom display modes, refresh rates and overclocking all through an easy to use interface
X RegVer REGVER.EXE Added by the LATINUS.16 TROJAN!
X RegWrite csrss.exe Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
U Regx10EXE atix10.exe ATI Remote Wonder - PC wireless remote control
X reg_key FUKULAMER.exe Added by the BEAGLE.AH WORM!
X reg_key loader_name.exe Added by the BEAGLE.Y or BEAGLE.Z or BEAGLE.AA WORMS!
X Reg_WFT Regsysw.com Added by the WILSEF VIRUS!
U ReleaseRAM RRAM.exe "Release RAM allows your computer to run faster and uses your computer's RAM more efficiently". Some users swear by programs such as this but I suggest you read this article and make up your own mind
X reload reload.vbs Added by the LOVELETTER.AS VIRUS!
X Reload reload.exe Added by the LAZAR TROJAN!
N RemHelp Remhelp.exe BT Voyager ADSL Modem Help related
N Reminder reminder.exe From MS Money. Reminds you of your bills
N Reminder Remind_XP.exe HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
N Reminder-cpqXXXXX remind32.exe Compaq printer Registration
N Reminder-hpcXXXXX remind32.exe HP CD-Writer Registration
N Reminder-ranXXXXX remind32.exe Registration reminder widget for Rand Mcnally maps
N reminder-ScanSoft Product Registration remind32.exe Registration reminder for ScanSoft products such as PaperPort
U RemindMe RemindMe.exe Remind-Me - calendar software
N Remind_XP Remind_XP.exe HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
X Remndr CsRemnd.exe CasinoOnline foistware
U Remote Access rnaapp.exe Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie, analogue 56K modem) and terminates after the connection is closed
X Remote Access Slave Synchost.exe Added by the RIPJAC TROJAN!
N Remote Control Rc.exe Hinet Hi-Five ISP software
U Remote Desktop Computing marspc.exe Marspc Remote Desktop Computing
U Remote Management Agent zenrc32.exe Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation
U remote master remote master.exe Required if you want your ASUS Remote control to work at all. Available via Start -> Programs
X Remote Procedure Call winrpc.exe Added by the RBOT-KM WORM!
X Remote Procedure Call winsysrpc.exe Added by the SDBOT-PS WORM!
X Remote Procedure Call For Windows 32bit rpc.exe Added by the RBOT-MD WORM!
X Remote Procedure Call Locator RUNDLL32.EXE reg678.dll ondll_reg Added by a variant of the LOVGATE WORM!
X Remote Procedure Calls mswinrpc.exe Added by the RBOT.KJ WORM!
X Remote Procedure Calls mswinc.exe Added by the RBOT-IT WORM!
X Remote Procedure Calls win.exe Added by the SDBOT-QI WORM!
Y Remote Update Monitor imonitor.exe Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer
Y RemoteAgent RAUAgent.exe Trend Micro's Office Scan Client, see here - "Its Web-based management console gives administrators transparent access to desktop and mobile clients to coordinate automatic deployment of security policies and software updates"
U RemoteCenter RcMan.exe Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats
U RemoteControl rmctrl.exe Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one
U RemoteControl PDVDServ.exe Remote Control background application for CyberLink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one
N Remote_Agent RemoteAgent.exe Cyberlink Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings, you will need this, otherwise can be disabled. Available via Start -> Programs
N Removecpl Removecpl.exe Related to a Belkin 54Mbps Wireless Utility Control Panel applet
X Removed.exe Removed.exe GatorCheat - adware downloader
? RemStart remstart.exe Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required?
? RenolB ib.exe ??
U RepliGo Assistant RepliGoMon.exe Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device"
U ReproPRD PrdUsb.exe Thrustmaster Corporation Presets application - a game controller driver, presumably necessary for certain functions to work
X requester requester.*.exe Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit, examples: requester.5.exe, requester.10.exe
N Resolution Assistant matcli.exe Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide

Start Up Applications R Page 3
N Resource Meter rsrcmtr.exe Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes
? Restart Watch Watch.exe Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?
U Restart WSC Setting wscrestp.exe WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes
? Restart_VS Viewsonic.exe Could be a left-over from the installation of a Viewsonic flat panel display
Y RestoreIT! VBPTASK.EXE RestoreIT! from FarStone "allows you to recover instantly your files, system configuration, and even your operating system, to any point in time prior to the data loss or system failure."
X restory restory.exe Added by the RETSAM TROJAN!
U Resume Copy copyfstq.exe Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function
U ResumeFixClocks resumefix.exe Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards
X retime retime.exe Added by the GIPMA TROJAN!
U RetrieverScheduler retrieverscheduler.exe 80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network file systems, giving users one point of fast, accurate search for all personal information". Real-time scheduler - shortcut available
U RevoTaskbarApp RevoTask.exe Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
N RexSyMon rexsymon.exe Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC
U rfagent rfagent.exe Registry First Aid - scans the Windows registry for orphan file/folder references, finds these files or folders on your drives that may have been moved from their initial locations, and then corrects your registry entries to match the located files or folders
X RFTray RFTRay.exe Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs
Y rfw Rfw.exe RAV AntiVirus
? rfwydg rfwydg.exe ??
N RFX_auto_upgrade rundll32.exe npvpg005.dll A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade
U RH rh32.exe EuroFonts - adds Euro symbols to pre-Euro computers
X Rhino [random name]32.exe Added by the BOFRA.A WORM!
U RhinoBlocker RhinoBlocker.exe RhinoBlocker - pop-up stopper
N RHSI SHS SHS.exe Rogers Hi-Speed Internet software. "Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail, the Self-Healing Software (SHS.exe) will automatically repair your settings to get you up and running in a flash"
U Ring Central Fax rcenterrll.exe Only needed if you want a PC to answer faxes automatically
X rIOphosIs rIOPHosIs.vBS Added by the RIOSYS MACRO!
U RivaTuner RivaTuner.exe RivaTuner for tweaking nVidia graphics cards. Required if you make any changes
U RivaTunerStartupDaemon RivaTuner.exe RivaTuner for tweaking nVidia graphics cards. Required if you make any changes
? RjLyraInstaller setup.exe ??
U rmctrl rmctrl.exe Remote Control background application for CyberLink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one
N rmmon mprmmon.exe Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card
? RMremote RmRemote.exe Remote control driver for REALmagic Xcard. Is it required?
X rn4d dirote.exe Added by the BKDR_MAROON.A TROJAN!
U RNBOStart sentstrt.exe Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
? rndll2 rndll2.exe May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within?
X rngmf [path to trojan] Added by the RANKY.C TROJAN!
N RoboForm RoboTaskBarIcon.exe Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin
N RoboFormWatcher RoboFormWatcher.exe AI Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs
U Rocket.Time RocketTime.exe Time synchronization software from Rocket Software
? roketpipe rpclient.exe ??
X rollbk dsm.exe Added by the SERFLOG.B WORM!
X rollbk msmpatch.exe Added by the SERFLOG.B WORM!
X rollbk svosm.exe Added by the SERFLOG.B WORM!
X rollbk sysup.exe Added by the SERFLOG.B WORM!
X romahere matrixhere.exe SuperSpider hijacker - a CoolWebSearch parasite variant
U romahere2 ************.exe [* = random char] SuperSpider hijacker - a CoolWebSearch parasite variant
X romahere3 ************.exe [* = random char] SuperSpider hijacker - a CoolWebSearch parasite variant
? ROUTD ROUTD.exe ??
N RoxAssist RoxAssist.exe Roxio Assistant is designed to correct Engine Initialization errors. If Easy CD & DVD Creator's Engine does not initialize, the applications in Easy CD & DVD Creator will not recognize your recorder. After running this program you should receive the message "Engine initialized successfully with full recorder support". If you do not receive the message, update your Virus software and then check and clean your system for viruses. After the removal of any viruses, uninstall and then reinstall Easy CD & DVD Creator (use "Add Remove Programs" in "Control Panel"). Can be run manually
? Roxio Engine MSMNGR32.EXE Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN!
N RoxioAudioCentral RxMon.exe Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound editor - integrated in a single application". Not required for Roxio to work properly.
N RoxioDragToDisc DrgToDsc.exe Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly
Y RoxioEngineUtility EngUtil.exe Part of Roxio EasyCD Creator 6.0 - corrects any modification made to the Roxio Engine, it exits after checking
U RP32 rp32.exe ControlIT (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems.
X RPC MSschost.exe Added by a variant of the GAOBOT/AGOBOT WORM!
X RPC Patcher [path to worm] Added by the BOLGI WORM!
X RPCserv32 services.exe Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
Y RPCSS.exe rpcss.exe Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se, a program may need it to communicate with other components of itself. You could delete the program but if any abnormalities occur soon after then reinstall. Under NT, deleting this critical system component will disable the OS. For a more detailed explanation see here
X RRMedic rrmedic.exe Troubleshooting utility for the RoadRunner cable internet service. Not required and you are advised to completely uninstall it. Provides a lot of false alarms and gets a lot of people panicking about there internet connection

Start Up Applications R Page 4
U rscmpt rscmpt.exe Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status
U rsMenu rsMenu.exe Synchronizes a Casio PDA with MS Outlook
X RSPC Driver [random filename].exe Added by the RBOT-SN WORM!
X RSPC Driver D [random filename] Added by a variant of the RBOT WORM!
? RSRCMTZ RSRCMTZ.exe ??
X RSS rundll32 RSSToolbar.dll, DllRunMain "Related Sites" toolbar - SearchAndClick hijacker variant
X RSync netsync.exe Pops-stop.com parasite, an IEPageHelper/SafeSurfing adware variant
N RtlMon.exe RtlMon.exe Monitor for RealTek network card
Y RTMonitor RTMonitor.exe Cheyenne (now eTrust) antivirus
X rtos rtos.exe IRC trojan
? RTStartMute N/A ??
Y rtvscn95 RTVSCN95.EXE Real-time virus scanner component of Norton Anti-Virus Corporate Edition
X Ruby13 Ruby13.exe Added by the MEXER.E WORM!
X Ruby14 Ruby14.exe Added by the FIGHTRUB-A WORM!
U RuLaunch RuLaunch.exe Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis
X run Autoexec.com Added by the HOLCAS.A WORM!
X run inetinfo.exe Added by the BINGHE TROJAN!
X Run Msn Messenger msnmgr.exe Added by the AGOBOT.HA WORM!
X Run MSupdt32 wscript MSupdt32.vbs Added by the CASER WORM!
U Run POPFile in background perl.exe POPFile - E-mail spam blocker
U Run POPFile in background wperl.exe POPFile - E-mail spam blocker
U Run StartupMonitor StartupMonitor.exe Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu
X Run TaskMrg csrss.exe Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
X Run XP Service Pack xpservicepack.exe Added by the SDBOT.AQA WORM!
X run32dll WINClock.exe Added by an unidentified VIRUS, WORM or TROJAN!
X run32dll task32.exe Added by an unidentified VIRUS, WORM or TROJAN!
X Run32dll ocxdll.exe Added by an unidentified VIRUS, WORM or TROJAN!
N run= cmmpu.exe MIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI)
N run= hpfsched HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
N run= lxdboxcp.exe Lexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS
N run= pcfix2k.exe pcfix2k splash screen
X run= ptlseq.cpl PhoenixNet BIOS adware. See here
U run= ramsys.exe Advanced Startup Manager from Rays Lab
? run= wallflip.exe Desktop wallpaper changer?
X run= svcinit.exe CoolWebSearch parasite variant
X run= fntldr.exe CoolWebSearch parasite variant
Y run= smsrun16.exe Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1, Windows for Workgroups, Win95, or OS/2 to create program groups on the client and then launch SMS client programs
? run= win.ini ??
X run= RAVMOND.exe Added by a variant of the LOVGATE WORM!
X run= real.exe Added by a variant of the LOVGATE WORM!
X run= dec25.exe Added by the ATAK.F WORM!
? run= LXBTppls.exe Reportedly part of Lexmark printer software - what does it do and is it required?
N run= fmedia.exe FMedia FaxWorks related - can be run manually
Y run= wswpd.exe Used with some models of Panasonic, Epson and NEC printers - required for printer to work
X run= cyxid98.exe Unidentified malware
X run= info32.exe CoolWebSearch parasite variant
X run= mouse_configurator.win Added by the GAGGLE.E WORM!
X run= RegistryReminder.exe Added by the APSTROJAN.OB TROJAN!
X run= sec5dec.exe Added by the ATAK.G WORM!
X run= wmplayer.exe CoolWebSearch parasite variant - Note: this is not the Windows Media Player executable!
X run= Autoexec.com Added by the HOLCAS.A WORM!
U RunAlert AService.exe MSI MOtherboard PC Alert III - MSI motherboard monitoring software. Only required if you "overclock" your system
N runAP runAP.exe Not required but what is it?
X Runapp32 Runapp32.exe Added by the NEODURK TROJAN!
Y RunCA InvokeSvc3.exe Wireless-G USB Wireless Network Adapter related - would appear to be required
X Rund1l32 Winfi1e32.exe Added by the MERTIAN WORM!
X rundl332 math.exe ...pluged.exe Added by the DOOMJUICE WORM!
X rundli32 rundli32.exe Added by the LADE WORM!
X RunDLL rundll32.exe bridge.dll, Load Flingstone.com browser hijacker
X rundll*** die.exe [path] mdll.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946
X rundll*** die.exe [path] secure.bat Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946
X rundll*** die.exe [path] secure.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946
X rundll*** die.exe [path] ttg.exe Added by the SUMTAX TROJAN! where *** is 134, 569, 777 or 946
X Rundll16 Rundll16.exe Added by a number of VIRUSES, WORMS and TROJANS!
X Rundll32 Rundll32.exe Added by the DVLDR TROJAN! Note - this is not the valid "Rundll32.exe" as it's in the WindowsFonts directory
N RUNDLL32 RUNDLL32.EXE NvQtwk, NvCplDaemon System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here)
N RunDLL32 RunDLL32.exe NvMCTray.dll, NvTaskbarInit System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties
U rundll32 Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings Loads default settings for Leadtek Winfast graphics cards
X RunDLL32 winupdate.exe Added by an unidentified TROJAN! - possibly a BMBOT variant
X Rundll32 Windows.exe Added by the QQPASS.E TROJAN!
X Rundll32 Rundll32.exe ptipbm.dll, SetWriteBack Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. If used is it required?
X rundll32 [path to worm] Added by the AUTEX WORM!
? rundll32 rundll32.exe ptipbmf.dll, SetWriteCacheMode Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller
X rundll32 rundll32.exe Added by the SANKER WORM! Note that the valid "rundll32.exe" resides in C:WindowsSystem32 wheras this version resides in C:Windows
X rundll32 csrss.exe Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
U rundll32 RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent Associated with BlueTooth software, and registers the "Infrared Port properties" Control Panel applet. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup
N Rundll32 cmicnfg Rundll32 cmicnfg.cpl, CMICtrlWnd System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel
X Rundll32.exe Proyecto1.exe Added by the GRUEL WORM!
X Rundll32.exe Root.exe Added by the GRUEL WORM!
X Rundll32_7 rundll32.exe MSIEFR40.DLL, DllRunServer BrowserAid "Featured Results" hijacker variant
X Rundll32_8 rundll32.exe inetp60.dll, DllRunServer BrowserAid parasite variant
X rundll64 [path to worm] Added by the AUTEX WORM!
X RundllSvr Rundll.exe Added by the HUAYU WORM!
X Rundllsystem32 Rundllsystem32.exe Added by the NETDEVIL.B TROJAN!
X Rundnm Rundnm.exe Added by the DELF-HA TROJAN!
U RunOnce RUNONCE.EXE Part of MS Data Access Components - only required if you use these
X RunProg Server.exe Added by the OPTIX.04.A TROJAN!
X RunProg wini.exe Added by the OPTIX.04.D TROJAN!
X runreper viewer.exe Added by the REPER.A VIRUS!
X RunServices runsvc32.exe Added by the AGOBOT.QJ WORM!
U RunSysd32 RunSysd32.exe DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within
X runwin32 runwin32.exe Added by the ESEARCH-A TROJAN!
X RunWindowsUpdate uptodate.exe BrowserAid/BrowserPal foistware
X Run[0] syscnfg.exe Added by an unidentified VIRUS, WORM or TROJAN! "syscnfg.exe" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside
X Run_cd Run_cd.exe Added by the GHOST.23 TROJAN!
? RUSBHOLoader rundll32.exe RUSBHOLoader.dll, AutoRegister ??
X rvde N/A Related to li-speed****
X RVP bpc.exe Spyware included with the latest version of Grokster. Also see here
N RxMon rxmon9x.exe Dell Resolution Assistant
Y r_server r_server.exe Radmin - remote admistrator server