| Status | Autorun name | Command | Description |
| X | rieysha | rieysha.exe | Added by the DELF.KG WORM! |
| U | RightFAX Print-to-Fax Driver | FaxCtrl.exe | Part of RightFAX from Captaris - "the proven market leader in fax server and document delivery software" |
| U | Ring Central Fax | rcenterrll.exe | Only needed if you want a PC to answer faxes automatically |
| X | rIOphosIs | rIOPHosIs.vBS | Added by the RIOSYS MACRO! |
| N | Riorad Manager | riomgr.exe | "Riorad Explorer is hands-down the most advanced Windows software companion for your Rio MP3 player" |
| U | RIP 2007 Clock | RIP 2007 Clock.exe | Clock gadget included with the Rest In Peace theme for MyColors from Stardock Corporation |
| ? | RIS2PostReboot | LaunchRIS2.exe | Part of the programming software for LEGO® Mindstorms robotic building system. What does it do and is it required? |
| X | rising | [worm filename] | Added by the AUTORUN-AW WORM! |
| X | Rising Driver | driver.exe | Added by the SILLYFD-TL WORM! |
| X | risings | svchost.exe | Added by the AGENT-GLC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | Risorse di Windows | [path to backdoor] | Added by the MESUB.KJ BACKDOOR! |
| N | Ritaglio schermata e avvio di OneNote 2007 | ONENOTEM.EXE | System Tray access to MS Office OneNote 2007 - an electronic notebook that allows you to create free-form notes, including text, graphics and audio/video. When running, ONENOTEM.EXE also enables the WINDOWS KEY combinations - such as WINDOWS KEY+N (new Side Note) and WINDOWS KEY+S (insert screen grab into a note). Leave the icon enabled in OneNote but move the shortcut from Start → All Programs → Startup to the desktop or elsewhere on the Start menu and run when needed. Italian version |
| U | RivaTuner | RivaTuner.exe | RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of "RivaTuner" and "RivaTunerStartupDaemon" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the "Launcher" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| U | RivaTuner | RivaTunerWrapper.exe | RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of "RivaTuner" and "RivaTunerStartupDaemon" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the "Launcher" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| U | RivaTuner Application | RivaTuner.exe | RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of "RivaTuner" and "RivaTunerStartupDaemon" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the "Launcher" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| U | RivaTunerStartupDaemon | RivaTuner.exe | Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| U | RivaTunerStartupDaemon | RivaTunerWrapper.exe | Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| U | RivaTunerWrapper Application | RivaTunerWrapper.exe | RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of "RivaTuner" and "RivaTunerStartupDaemon" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the "Launcher" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information |
| ? | RjLyraInstaller | setup.exe | ?? |
| U | RK Launcher | RKLauncher.exe | RK Launcher by RaduKing - "is a free application that will allow the user to have a visually pleasing bar at the side of the screen that is used to quickly launch shortcuts" |
| U | RKLG Startup | klg.exe | Local Keylogger Pro keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | RKrx | rundll32.exe | Added by the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in %Windir% (98/ME) or %System% (NT/2K/XP). This one is located in %Windir%\down |
| X | RKrx | rundll32.exe | Added by a variant of the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in %Windir% (98/ME) or %System% (NT/2K/XP). This one is located in %Windir%\inf |
| X | rlPympjVAQQ.exe | rlPympjVAQQ.exe | Added by the FAKEAV-IK MALWARE! |
| X | rmalt | [random filename] | Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe, Keygen.exe, Keygen-Serial.exe, Photoshop.CS2.KeyGen.exe and more |
| U | rmctrl | rmctrl.exe | Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control, or don't wish to use one |
| X | rmdrfje.dll | rundll32.exe rmdrfje.dll,[random characters] | Added by the DLOADR-ANM TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "rmdrfje.dll" file is located in %Windir% |
| N | rmmon | mprmmon.exe | Resource Monitor for the now defunct Chromatic Research MPact2 3DVD graphics card |
| U | rmoc3260.dll OCX | regsvr32.exe rmoc3260.dll | A module that contains COM components for media playback used by both RealPlayer and Windows Media Player - see here. The "rmoc3260.dll" file is found in %System% |
| ? | RMremote | RmRemote.exe | Remote control driver for REALmagic Xcard. Is it required? |
| X | rn4d | kolder.exe dirote.exe | Added by the MAROON.A BACKDOOR! Both files are located in %System%\d0e0t1 |
| U | Rnaomflt | naomf.exe | Naomi internet filtering software |
| X | RNBc Test | wf32vbs.exe | Added by the RBOT-AGR WORM! |
| X | RNBc Test | bvldv32.exe | Added by the RBOT-AJF WORM! |
| U | RNBOStart | sentstrt.exe | Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools |
| X | RNBz Test | wf32vbc.exe | Added by the RBOT-AEY WORM! |
| X | RNDc Test | wf32b.exe | Added by a variant of the SDBOT WORM! |
| ? | rndll2 | rndll2.exe | May be related to the DivX program as a *.dat file in the same directory had "DivXPro505Bundle.exe" mentioned within? |
| X | rngmf | [path to trojan] | Added by the RANKY.C TROJAN! |
| X | Rnudll32 | tadxtr.exe | Added by the QQPASS-O TROJAN! |
| X | rnwabmig | rnwabmig.exe | Added by the AGENT-LMI TROJAN! |
| ? | rnxqh | rnxqh.exe | ?? |
| X | Roam04 | ActiveX.exe | Added by the ROAMER-A TROJAN! |
| N | RoboForm | RoboTaskBarIcon.exe | Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin |
| N | RoboFormWatcher | RoboFormWatcher.exe | Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs |
| U | Rocket.Time | RocketTime.exe | Rocket.Time - time synchronization software from Rocket Software |
| N | RocketDock | RocketDock.exe | "RocketDock is a smoothly animated, alpha blended application launcher. It provides a nice clean interface to drop shortcuts on for easy access and organization" |
| X | Roflcopteur | seman.exe | Added by an unidentified WORM or TROJAN! |
| U | Rogers SHS | shs.exe | "Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free" |
| U | RogersAgent | rogersagent.exe | "Rogers Self Help Software is a free suite of tools and utilities for your computer that keeps your system running properly, and makes your Hi-Speed Internet experience smooth and trouble-free" |
| Y | RogersServicepointAgent.exe | RogersServicepointAgent.exe | Rogers Servicepoint Agent tool installed when you choose to install their Online Protection internet security suite - sourced by Radialpoint. Apart from downloading the suite installation files, the exact purpose is unknown at this time but it may be used to source critical updates and alerts so should therefore be left enabled |
| Y | RogueMonitor | RogueRemoverPRO.exe | Part of Malwarebytes' RogueRemover PRO - the realtime "RogueMonitor will alert you before you download a rogue application keeping you safe and secure before trouble occurs." Now discontinued and the funtionality is included in Malwarebytes' Anti-Malware |
| Y | RogueRemoverPRO | RogueRemoverPRO.exe | Part of Malwarebytes' RogueRemover PRO - the realtime "RogueMonitor will alert you before you download a rogue application keeping you safe and secure before trouble occurs." Now discontinued and the funtionality is included in Malwarebytes' Anti-Malware |
| ? | roketpipe | rpclient.exe | ?? |
| U | Rollback | RollbackTray.exe | Added by the RollBack Rx system restore program |
| X | rollbk | dsm.exe | Added by the SERFLOG.B WORM! |
| X | rollbk | msmpatch.exe | Added by the SERFLOG.B WORM! |
| X | rollbk | svosm.exe | Added by the SERFLOG.B WORM! |
| X | rollbk | sysup.exe | Added by the SERFLOG.B WORM! |
| X | romahere | matrixhere.exe | SuperSpider hijacker - a CoolWebSearch parasite variant |
| X | romahere2 | ************.exe [* = random char] | SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! |
| X | romahere3 | ************.exe [* = random char] | SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN! |
| X | Root System Service | rootsvc32.exe | Added by the AUTORUN-BGZ WORM! |
| X | Root_Machine | [path to trojan] | Added by the BANCBAN-DI TROJAN! |
| X | ROOT_Machine | winlogon.exe | Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf |
| X | RosTika | RosTika.exe | Added by the BRONTOK-BU WORM! |
| ? | ROUTD | ROUTD.exe | ?? |
| X | Router | Router.exe | Added by the AGENT.FJN TROJAN! |
| N | RoxAssist | RoxAssist.exe | Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize, the applications in Easy CD & DVD Creator will not recognize your recorder. After running this program you should receive the message "Engine initialized successfully with full recorder support". If this doesn't happen you may have to add support for newer drives using Roxio Updater, check for product updates and even re-install the software. See this thread for more information |
| N | RoxAssistant | RoxAssist.exe | Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize, the applications in Easy CD & DVD Creator will not recognize your recorder. After running this program you should receive the message "Engine initialized successfully with full recorder support". If this doesn't happen you may have to add support for newer drives using Roxio Updater, check for product updates and even re-install the software. See this thread for more information |
| ? | Roxio Engine | MSMNGR32.EXE | Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN! |
| Y | Roxio Engine Compatibility Wizard | EngUtil.exe | Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine, it exits after checking |
| N | RoxioAudioCentral | RxMon.exe | Part of Roxio EasyCD Creator 6.0 - places the Roxio AudioCentral icon in you system tray. "Includes a player, media manager, ripper, tag and sound editor - integrated in a single application". Not required for Roxio to work properly. |
| N | RoxioDragToDisc | DrgToDsc.exe | System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly and available via the Start menu |
| Y | RoxioEngineUtility | EngUtil.exe | Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine, it exits after checking |
| N | RoxWatchTray | RoxWatchTray.exe | System Tray access to managing the "Watched Folders", "LiveShares" and "MediaSpace" features of the Roxio Easy Media Creator 8 multimedia suite. All of these options are available from the Media Manager utility. The "Watched Folders" feature monitors specified locations for new pictures, songs and videos being added and makes them available to the Media Manager - if you have 512MB of memory or less available it's recommended you also disable the associated "Roxio Hard Drive Watcher (RoxWatch)" service as well as the combination has been known to use significant amount of memory and cause other problems |
| N | RoxWatchTray | RoxWatchTray10.exe | System Tray access to managing the "Watched Folders", "LiveShares" and "MediaSpace" features of the Roxio Easy Media Creator 10 multimedia suite. All of these options are available from the Media Manager utility. The "Watched Folders" feature monitors specified locations for new pictures, songs and videos being added and makes them available to the Media Manager - if you have 512MB of memory or less available it's recommended you also disable the associated "Roxio Hard Drive Watcher 10 (RoxWatch10)" service as well as the combination has been known to use significant amount of memory and cause other problems |
| N | RoxWatchTray | RoxWatchTray9.exe | System Tray access to managing the "Watched Folders", "LiveShares" and "MediaSpace" features of the Roxio Easy Media Creator 9 multimedia suite. All of these options are available from the Media Manager utility. The "Watched Folders" feature monitors specified locations for new pictures, songs and videos being added and makes them available to the Media Manager - if you have 512MB of memory or less available it's recommended you also disable the associated "Roxio Hard Drive Watcher 9 (RoxWatch9)" service as well as the combination has been known to use significant amount of memory and cause other problems |
| N | RoxWatchTray10 | RoxWatchTray10.exe | System Tray access to managing the "Watched Folders", "LiveShares" and "MediaSpace" features of the Roxio Easy Media Creator 10 multimedia suite. All of these options are available from the Media Manager utility. The "Watched Folders" feature monitors specified locations for new pictures, songs and videos being added and makes them available to the Media Manager - if you have 512MB of memory or less available it's recommended you also disable the associated "Roxio Hard Drive Watcher 10 (RoxWatch10)" service as well as the combination has been known to use significant amount of memory and cause other problems |
| N | RoxWatchTray9 | RoxWatchTray9.exe | System Tray access to managing the "Watched Folders", "LiveShares" and "MediaSpace" features of the Roxio Easy Media Creator 9 multimedia suite. All of these options are available from the Media Manager utility. The "Watched Folders" feature monitors specified locations for new pictures, songs and videos being added and makes them available to the Media Manager - if you have 512MB of memory or less available it's recommended you also disable the associated "Roxio Hard Drive Watcher 9 (RoxWatch9)" service as well as the combination has been known to use significant amount of memory and cause other problems |
| U | RP32 | rp32.exe | Unicenter Remote Control (was Remotely Possible) from Enterprise International for remote control and access to Win9x/NT systems |
| X | RPC | MSschost.exe | Added by a variant of the AGOBOT/GAOBOT WORM! |
| X | RPC DCOM Vulnerability Patch | msgfix.exe | Added by the RBOT.S WORM! |
| X | RPC Drivers | rpcall.exe | Added by the SDBOT.FLY WORM! |
| X | RPC Patcher | [path to worm] | Added by the BOLGI WORM! |
| X | RPC Service | [random filename] | Added by the BDOOR-AAD BACKDOOR! |
| X | RPC Service | jgszznv.exe | Added by the RBOT-EMS WORM! |
| X | rpc Win32 | shost32.exe | Added by the RBOT-ABL WORM! |
| X | rpc Win32 | spoolscv.exe | Added by a variant of the RBOT WORM! |
| X | RPCall_[ComputerName] | smhost.exe | Added by the REDPLUT-B TROJAN! |
| X | RPCall_WIN2K | Kurawas.exe | Added by the BHARAT.A WORM! |
| X | rpcc | rpcc.exe | Added by the SPAMMIT-E TROJAN! |
| X | rpcda Win32 | rpcda.exe | Added by the RBOT-AEE WORM! |
| X | RPCInstall | [path to trojan] | Added by the AGENT-DQM TROJAN! |
| X | RpcLocator | explorer.exe | Added by the RBOT-GSA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System% |
| X | RPCser32g | services.exe | Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | RPCser32g1 | services.exe | Added by the PREX.D WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | RPCser32g3 | services.exe | Added by the PREXOT.D BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | RPCser32g4 | services.exe | Added by the PREXOT.E BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | RPCserr32g | winlogon.exe | Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
