| Status | Autorun name | Command | Description |
| X | Remote Access Tool | rwosvc.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| N | Remote Control | Rc.exe | Hinet Hi-Five ISP software |
| N | Remote Controller | TVRMVCR.EXE | ProLink PlayTVpro TV tuner software |
| U | Remote Data Backups | CBSysTray.exe | System Tray access to Remote Data Backups online system/data backup utility |
| U | Remote Data Backups | COBackup.exe | Remote Data Backups online system/data backup utility |
| U | Remote Data Backups TaskBar Icon | CBSysTray.exe | System Tray access to Remote Data Backups online system/data backup utility |
| U | Remote Desktop Computing | marspc.exe | Marspc Remote Desktop Computing |
| X | Remote Desktop Help Session Manager | WinRDH.exe | Added by a variant of the SDBOT WORM! |
| X | Remote Event System | resmsvc.exe | Added by the IRCBOT.YF BACKDOOR! |
| U | Remote Management Agent | zenrc32.exe | Part of Novell's ZENworks - "Complete End-to-End Directory-enabled Network Management". Installed on a managed workstation fo an administrator to remotely manage the workstation. Required if the PC is a managed workstation |
| U | remote master | remote master.exe | Required if you want your ASUS Remote control to work at all. Available via Start -> Programs |
| X | Remote Procedure Call | winrpc.exe | Added by the RBOT-KM WORM! |
| X | Remote Procedure Call | winsysrpc.exe | Added by the SDBOT-PS WORM! |
| X | Remote Procedure Call For Windows 32bit | rpc.exe | Added by the RBOT-MD WORM! |
| X | Remote Procedure Call Locator | RUNDLL32.EXE reg678.dll ondll_reg | Added by the LOVGATE.F WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| X | Remote Procedure Calls | mswinrpc.exe | Added by the RBOT.KJ WORM! |
| X | Remote Procedure Calls | mswinc.exe | Added by the RBOT-IT WORM! |
| X | Remote Procedure Calls | win.exe | Added by the SDBOT-QI WORM! |
| X | Remote Services Manager | msrmsvc.exe | Added by the SLENFBOT.AJ WORM! |
| X | Remote Storage Access | rmasvc.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| X | Remote System Protection | rundll32.exe [random].dll, HUI_proc | Added by the ERTFOR.B TROJAN! |
| X | Remote Terminal Task | rtsbsvc.exe | Added by the IRCBOT.AUZ BACKDOOR! |
| Y | Remote Update Monitor | imonitor.exe | Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer |
| N | Remote_Agent | RemoteAgent.exe | Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this, otherwise can be disabled. Available via Start -> Programs |
| Y | RemoteAgent | RAUAgent.exe | Trend Micro's Office Scan Client, see here - "Its Web-based management console gives administrators transparent access to desktop and mobile clients to coordinate automatic deployment of security policies and software updates" |
| U | RemoteCenter | RcMan.exe | Remote control for Creative MediaSource - plays back music in DVD-Audio, MP3, WMA, WAV and other media formats |
| U | RemoteControl | rmctrl.exe | Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one |
| U | RemoteControl | PDVDServ.exe | Remote Control background application for Cyberlink's PowerDVD from version 5 thru 7. Enables you to use a remote control with your Blu-ray or DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one |
| U | RemoteControl10 | PDVD10Serv.exe | Remote Control background application for version 10 of Cyberlink's PowerDVD. Enables you to use a remote control with your Blu-ray or DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one |
| U | RemoteControl8 | PDVD8Serv.exe | Remote Control background application for version 8 of Cyberlink's PowerDVD. Enables you to use a remote control with your Blu-ray or DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one. Also rebranded as ASUSDVD 8 for ASUSTek based systems |
| U | RemoteControl9 | PDVD9Serv.exe | Remote Control background application for version 9 of Cyberlink's PowerDVD. Enables you to use a remote control with your Blu-ray or DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one |
| U | RemotelyAnywhere GUI | ragui.exe | RemotelyAnywhere by LogMeIn, Inc - "Experience fast, secure system administration from anywhere. RemotelyAnywhere offers industry-leading security and performance for remote administration" |
| X | Remove 54tr10 | smss.exe | Added by the BRONTOK-CH WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data |
| X | REMOVE ME | windos.exe | Added by the SDBOT.EE WORM! |
| X | REMOVE ME | tbbzxzxcxxcx.exe | Added by the SDBOT-TA WORM! |
| X | REMOVE ME | asclt.exe | Added by the RANDEX-FC WORM! |
| N | Removecpl | Removecpl.exe | Related to a Belkin 54Mbps Wireless Utility Control Panel applet |
| X | Removed.exe | Removed.exe | GatorCheat - adware downloader |
| U | RemoveIT Pro XT | removeit.exe | RemoveIT Pro from InCode Solutions - spyware, virus and malware removal tool |
| ? | RemStart | remstart.exe | Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required? |
| X | renascimento | svchost.exe | Added by the BANKER.GAX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help |
| ? | RenolB | ib.exe | ?? |
| X | reouv | reouv.exe | Added by the SILLYFDC-FX WORM! |
| X | Repair Registry Pro | RepairRegistryPro.exe | Repair Registry Pro rogue registry cleaner - not recommended, removal instructions here |
| X | ReparateurDeSysteme | SysRep.exe | ReparateurDeSysteme, French rogue system error and cleaning utility - not recommended. A member of the ErrClean family |
| X | repl | repl.exe | Added by the YABE.CD TROJAN! |
| U | Replay Center | ReplayRadio.exe | Replay Radio - "makes it easy to automatically record your favorite radio shows, so you can listen wherever and whenever you like" |
| U | Replicator | PTReplicator.exe | Replicator from Karen's powertools. "Automatically backup files, directories, even entire drives!" |
| U | RepliGo Assistant | RepliGoMon.exe | Cerience RepliGo software - "any document you have on your PC can be transferred to your mobile device" |
| U | ReproPRD | PrdUsb.exe | Thrustmaster Corporation Presets application - a game controller driver, presumably necessary for certain functions to work |
| X | requester | requester.*.exe | Added by a variant of the MUQUEST.A trojan - NOTE: the * stands for a digit, examples: requester.5.exe, requester.10.exe |
| X | Requester | requester.11.exe | Added by the MUQUEST TROJAN! |
| X | Required Service Drivers | micront.exe | Added by the RBOT-ABD WORM! |
| X | resagnt | restun.exe | Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader |
| U | ResChanger2004 | ResChanger2004.exe | EVGA graphic card utility providing easy access to display settings |
| X | reseurce | [path to trojan] | Added by the LINEAGE-AI TROJAN! |
| X | reseurce | svchost.exe | Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| U | Resolution Assistant | matcli.exe | Dell Resolution Assistant. "matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, state, etc and gets written to a log file". Resolution Assistant is required to run with the Help and Support program. If you uncheck Resolution Assistant and then run Help and Support it will add another Resolution Assistant in the startup menu. If you remove the Resolution Assistant in the add/remove program some help menus in help and support will not be available. You decide |
| N | Resource Meter | rsrcmtr.exe | Windows Resource Meter. Available via Start -> Programs. You may want this enabled if your PC is suffering from crashes and want to know potential causes |
| X | RESpyWare.exe | RESpyWare.exe | RESpyWare rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| ? | Restart Watch | Watch.exe | Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required? |
| U | Restart WSC Setting | wscrestp.exe | WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes |
| ? | Restart_VS | Viewsonic.exe | Could be a left-over from the installation of a Viewsonic flat panel display |
| X | Restore | restore.exe | Antispyware Shield Pro rogue security software - not recommended, removal instructions here |
| X | Restore Operation | svchots.exe | Added by a variant of the RBOT WORM! |
| U | RestoreDesktop | RestoreDesktop.exe | Softwarium Restore Desktop "is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change" |
| Y | RestoreIT! | VBPTASK.EXE | RestoreIT! from FarStone - "automatically backs up all files on your computer to a protected partition on your hard drive" |
| X | restorer32_a | restorer32_a.exe | Added by the AGENT.CQQB TROJAN! |
| X | restorer64_a | restorer64_a.exe | Added by the DLDR-BY TROJAN! |
| X | restory | restory.exe | Added by the RETSAM TROJAN! |
| U | Resume Copy | copyfstq.exe | Part of Total Copy - an improved version of the Windows copy function. Allows for resumption file copies or moves in progress when computer was shut down. Not required if your not using the program or don't care about that function |
| U | ResumeFixClocks | resumefix.exe | Part of the RadeonTweaker utility for overclocking ATI Radeon graphics cards |
| Y | ResumeQuickupDownload | acappaa.exe | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. The exact purpose of this entry is unknown at present but it appears to be associated with incomplete upgrade/update downloads. Also included by vendors who use the Quick Heal engine such as Omniquad and iQon |
| X | reszrv | [8 random letters].exe | Added by a variant of the SDBOT WORM! See here |
| X | retime | retime.exe | Added by the GIPMA TROJAN! |
| U | RetrieverScheduler | retrieverscheduler.exe | 80-20 Retriever from 80-20 - "80-20 Retriever is a powerful personal search tool that encompasses email folders, archived email, and local or network file systems, giving users one point of fast, accurate search for all personal information". Real-time scheduler - shortcut available |
| U | RetroExpress | RetroExpress.exe | EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices |
| X | revo | revo.exe | Added by the ONLINEG.AFU WORM! |
| U | RevoTaskbarApp | RevoTask.exe | Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available |
| N | RexSyMon | rexsymon.exe | Intellisync for REX sychronization software for Xircom REX MicroPDAs for sharing information between the PDA and PC |
| X | RF | EC.exe | Added by the LINEAGE-U TROJAN! |
| U | rfagent | rfagent.exe | Registry First Aid - scans the Windows registry for orphan file/folder references, finds these files or folders on your drives that may have been moved from their initial locations, and then corrects your registry entries to match the located files or folders |
| X | RFCILHKT | RFCILHKT.exe | Added by the AGENT-RGM TROJAN! |
| X | rforce | EXP1ORER.EXE | Added by the DROPPER.KN TROJAN! Note the number "1" in the filename rather than letter "L". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN! |
| N | RFTray | RFTRay.exe | Reality Fusion GameCam Video Interaction Technology Software that comes with the Logitech QuickCam PC video camera and other USB cameras. It's only an icon that appears on your System Tray. Available via Start -> Programs |
| Y | rfw | Rfw.exe | RAV AntiVirus |
| Y | RfwMain | rfwmain.exe | Rising antivirus |
| ? | rfwydg | rfwydg.exe | ?? |
| N | RFX_auto_upgrade | rundll32.exe npvpg005.dll | A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade |
| X | Rg2catbd | Rg2catbd.exe | Added by a variant of the BANLOAD family of TROJANS! |
| U | RH | rh32.exe | EuroFonts - adds Euro symbols to pre-Euro computers |
| X | Rhg | rundll32.exe | Added by the LINEAG-BIT TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in %Windir% (98/ME) or %System% (NT/2K/XP). This one is located in %Windir%\inf |
| X | Rhino | [random name]32.exe | Added by the BOFRA.A WORM! |
| U | RhinoBlocker | RhinoBlocker.exe | RhinoBlocker - pop-up stopper |
| N | RHPTray | RHPTray.exe | System tray access to Red Hot Pawn - online chess |
| U | RHSI SHS | SHS.exe | "Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free" |
| X | Riau | nmrc.exe | PurityScan adware |
| X | RichMedia | Rundll32.exe [path] HBHelper.dll | HenBang adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "HBHelper.dll" file is located in %ProgramFiles%\hbclient |
| X | RichMedia | rundll32.exe [path] hbcast.dll, WaitWindows | Henbang adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| X | richup | richup.exe | SafeSurfing adware |
