Necessary At your option Useless Dangerous Application database
Startupapps.com recommends you:

Detect and remove hidden rootkits using UnHackMe UnHackMe - Rootkit Killer Free fully functional 30-days trial.


RegRun Security Suite = 24 system utilities for protecting your computer. Try now!

Buy Now!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

r?gedit.exe
r?gsvr32.exe
r090405.stub.exe
racert6t.exe
radio.exe
radnet32.exe
raggge.exe
rant.exe
rasmin.exe
rat10.exe
rat11.exe
rat20.exe
rat21.exe
rau001978.exe
rave.exe
ravideo.exe
ravmon.exe
ravmone.exe
rb.exe
rb32.exe
rbcalc.exe
rbenh.exe
rbot.exe
rcaviy.exe
rch.exe
rchubo.exe
rcs.exe
rdatasys2.exe
rdatdll5.exe
rdfx4.exe
rdfx4[1].exe
rdiv.sys
rdriv.sys
rdsdtv.exe
re_file.exe
readme.exe
readme.txt.exe
real joy.exe
realaudio.exe
realpaly.exe
realplays.exe
realschd.exe
realsled.exe
realteks.exe
realupdate.exe
rebatenation0.exe
recsl.exe
rectumunet.exe
recycle-bin.exe
recycler.exe
redire32.exe
redirect2.exe
redirect7.exe
redist.exe
redistributor.exe
redx.exe
reg32.exe
reg33.exe
reg66.exe
reg666.exe
regbhper.exe
regcheck.exe
regcle32.exe
regdata.dll
regdata.exe
regdll32.exe
regedif32.exe
regepsrvc.sys
reghost.exe
reginid_redux.exe
reginix86c.dll
reginix86d.dll
registry.exe
registry32.exe
registryreminder.exe
registryrepair.exe
regloadr.exe
regmen.exe
regobj.dll
regrun.exe
regs plus.exe
regscan.exe
regscaner32.exe
regserver.exe
regsrv32.com
regstrmon.exe
regsvclib.exe
regsvr.exe
regsvrcss32.exe
regsvs.exe
regsync.exe
regupdt32.exe
rejoice42.exe
release.exe
relive.dll
reloc32.exe
rem00001.dll
remie20.exe
remon.sys
remote.exe
remotecontrol.exe
remtsrv.exe
rep.exe
repairs.dll
repairs302972943.dll
repairs303169590.dll
replmap.dll
reporter.exe
requester.11.exe
restun.exe
resys.exe
retadpu.exe
retadpu1000272.exe
retadpu11.exe
retadpu206.exe
retadpu27.exe
retadpu72.exe
retailvistahelp.dll
rewrw.dll
rexename.exe
rfkampig.exe
rfmsuxes.exe
rgqqgy.dll
rgqqgy.exe
rhds.exe
rhrlb.exe
ricad3.exe
richdll.dll
richnotify.exe
ripserv.dll
rising.exe
rising198.exe
riva.model.dll
riva.ui.exe
rketbuy.exe
rkinstaller.exe
rldsregj.exe
rlid.exe
rlls.dll
rlmksem.exe
rlplregx.exe
rlvknlg.exe
rmaapp.exe
rmcomtb.exe
rmincon.exe
rmis.exe
rmk8ot.dll
rmmfvz.exe
rmvalid.exe
rmxview.exe
rnaapp32.exe
rncmd.exe
rnd32.exe
rntx.dll
rnvvra.exe
rnxntup.exe
roae33.sys
rock.exe
rockxp.exe
rofl.exe
rofl.sys
rolf.sys
romdrivers.dll
rootkit.exe
rosa.sys
route.exe
rpcc.dll
rpcc.exe
rpcc1.dll
rpccd.dll
rpcclient.exe
rpcecs.exe
rpcmon.exe
rpcrt3.dll
rpcscvb.exe
rpcsrv.exe
rpcsrvc.exe
rpcsss.exe
rpcsvc.exe
rpcsvr.exe
rptcrash.exe
rpxwrhv.exe
rqkukiwc.exe
rqqsnd.exe
rqron.dll
rqronkh.dll
rqrqoop.dll
rqrqrpo.dll
rraa.dll
rrimm.exe
rrtcany.dll
rsbmsc.exe
rscmtp.exe
rsen.dll
rsmb.exe
rsmpmon.exe
rsoprov.exe
rsrcload.exe
rsrcnrs.exe
rssauto.dll
rssp00x0.dll
rst.exe
rsuninstal.exe
rsvp32_2.dll
rsvp322.dll
rsvterm.exe
rsyncmon.dll
rtafwa.exe
rtanwjsa.exe
rtf32.exe
rtlfindval.exe
rtneg3.dll
rtnka.dll
ruarcxmf.dll
rubel.exe
ruby13.exe
ruler1-3.exe
runc.exe
rund11.exe
runddl22.exe
runddl32.exe
runddll32.exe
rundell32.exe
rundil.exe
rundil32 exe
rundil32.exe
rundl132.exe
rundl13a.exe
rundl32.exe
rundli32.exe
rundll.dll
rundll16.exe
rundll2000.exe
rundll32.exe "c:\windows\system32\bridge.dll",load
rundll32.exe axfilter.dll,rundll32
rundll32.exe c:/wi
rundll32.exe c:\program files\commonname\toolbar\cnbabe.dll
rundll32.exe d0ce0c16b1,d0ce0c16b1
rundll32.exe e6f1873b.dll,d9ebc318c
rundll32.exe egcomservice_1046.dll,instantaccess
rundll32.exe reg.dll ondll_reg
rundll32.exe stlb2.dll,dllrunmain
rundll32.vbs
rundll32i.exe
rundll64.exe
rundll95.exe
rundlll32.exe
rundllw.exe
runer.exe
runl32.exe
runload32.exe
runme.exe
runoledb32.exe
runowcp32.exe
runscv32.exe
runserv32.exe
runsvc32.exe
runtime.sys
runtime.sys_êîïèÿ
runtime2.sys
runvxd32.exe
runwin95.exe
rupxdnd.exe
rutisblv.exe
rvhost.exe
rvices~1.exe
rvshost.exe
rwinkpeh.exe
rwinmmdt.exe
rwinpoeg.exe
rwinpped.exe
rwinrpex.exe
rwnt.exe
rxbot.exe
rxx5ot.dll
rxzs.exe
ryg.exe
rzbvwset.exe

Dangerous  DANGEROUS - Q
Updated weekly. Last update: April 9 2018

Improve boot up time Run a free scan to diagnose your PC and identify the system boottle necks slowing you down. Start Test

Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.


r?gedit.exe
R?GEDIT.EXE is PurityScan/Clickspring Adware.
Kill the process R?GEDIT.EXE and remove R?GEDIT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

r?gsvr32.exe
R?GSVR32.EXE is PurityScan/Clickspring adware.
Read more:
http://atstake.com/avcenter/venc/data/ad...
Kill the process R?GSVR32.EXE and remove R?GSVR32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

r090405.stub.exe
R090405.Stub.exe is Trojan/Backdoor: Trojan.Downloader.Process.
Kill the process r090405.Stub.exe and remove r090405.Stub.exe from Windows startup.
http://www.superadblocker.com/definition...

racert6t.exe
Racert6t.exe is Trojan/Backdoor.
Kill the process racert6t.exe and remove racert6t.exe from Windows startup.

radio.exe
Radio.exe is Downloader.Centim.
Directory: %ProgramFiles%\Free Radio\
Read more:
http://securityresponse.symantec.com/avc...
Kill the process radio.exe and remove radio.exe from Windows startup using RegRun.
www.regrun.com

radnet32.exe
Radnet32.exe is Worm Ircbot Gen.
Directory: %WinDir%
Related files:
%DESKTOP%\TEST\4CE755B4002D46F3A08D0058CD4C.....EXE
%WINDIR%\SYSTEM32\ERASEME_02813.EXE
%WINDIR%\SYSTEM32\ERASEME_08580.EXE
%WINDIR%\SYSTEM32\ERASEME_14724.EXE
%WINDIR%\SYSTEM32\ERASEME_17866.EXE
%WINDIR%\SYSTEM32\ERASEME_23160.EXE
%WINDIR%\SYSTEM32\ERASEME_23615.EXE
%WINDIR%\SYSTEM32\ERASEME_26352.EXE
%WINDIR%\SYSTEM32\ERASEME_33335.EXE
%WINDIR%\SYSTEM32\ERASEME_52026.EXE
Read more:
http://fileinfo.prevx.com/QQ4ce714654800...
Kill the process radnet32.exe and remove radnet32.exe from Windows startup using RegRun.
www.regrun.com

raggge.exe
RAggge.exe is Trojan/Backdoor.
Kill the process rAggge.exe and remove rAggge.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rant.exe
Rant.exe is Trojan/Backdoor.
More info about Rant.exe:
http://www.sophos.com/virusinfo/analyses...
Kill the process rant.exe and remove rant.exe from Windows startup.

rasmin.exe
Destructive trojan
Rasmin uses up all the memory and the infected computer crashes regularly.

rat10.exe
Remote Access / AOL trojan
Can register under 40 different HKEYs.

rat11.exe
Remote Access / AOL trojan
Can register under 40 different HKEYs.

rat20.exe
Remote Access / AOL trojan
Can register under 40 different HKEYs.

rat21.exe
Remote Access / AOL trojan
Can register under 40 different HKEYs.

rau001978.exe
Rau001978.exe is Trojan/Backdoor.
Kill the process rau001978.exe and remove rau001978.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rave.exe
I-Worm.Magold.a
This worm spreads via the Internet as an attachment to infected emails.
It also spreads via IRC channels, local and file sharing networks.
The worm is able to spread in WinNT systems only (WinNT, Win2000, WinXP).

To send infected messages the worm connects directly to the default SMTP server.
The worm harvests email addresses from the WAB (Windows Address Book) database (Windows Address Book) and *.HTML files.

Infected messages:
From: erotika@lap.hu
Subject: Maya Gold-os kepernyokimelo!
Attachment: Maya Gold.scr

Also copies itself under the name "Maya Gold.scr" to the A: floppy drive.
Downloads and runs upgrades from "ftp.fw.hu".
May open the site "
http://www.offspring.com".
Searches for and terminates active anti-virus processes.

Remove it by RegRun Startup Optimizer.

ravideo.exe
Ravideo.exe is Trojan/Backdoor.
Kill the process ravideo.exe and remove ravideo.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ravmon.exe
RavMon.exe is W32.Nomvar.
W32.Nomvar is a worm that copies itself to the root of all drives, including removable and shared drives, and downloads potentially malicious files on to the compromised computer.
Related files:
[DRIVE LETTER]:\RavMon.exe
[DRIVE LETTER]:\Autorun.inf
%Windir%\svchost.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process RavMon.exe and remove RavMon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ravmone.exe
Ravmone.exe is W32/RJump-G.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process ravmone.exe and remove ravmone.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rb.exe
Backdoor.Akak
This is a backdoor server that also creates a SOCKS proxy on the compromised system.
Opens an unauthorized backdoor to the compromised system.
May be installed when you visit a malicious Web site using Internet Explorer. These pages may contain code that exploits the Microsoft Internet Explorer Drag And Drop File Installation Vulnerability.
Creates a SOCKS proxy on TCP port 5555.
This allows the compromised computer to be used to proxy protocols such as HTTP.
Listens on TCP port 4321 for commands from the remote attacker.
The attacker can do any of the following:
- Obtain system information
- Download and execute files on the compromised computer
- Uninstall the back door
- Update the address of the master server

Use RegRun Startup Optimizer to automatically remove it from startup.

rb32.exe
Rapidblaster IE homepage hijacker (adult content).
Remove it from startup.
You should choose Optimize Startup and also Advanced Optimizer.

rbcalc.exe
RBCalc.exe is a Trojan.Checkraise.
RBCalc.exe opens a back door.
RBCalc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
RBCalc.exe
%System%\utlsrv.exe
%System%\comclg32.dll
%System%\d3dclsrv.dll
%System%\ndsdavsrv.sys
Adds the value:
"Comclg32" = "%System%\utlsrv.exe /Comclg32.dll"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill the process RBCalc.exe and remove RBCalc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rbenh.exe
Rbenh.exe is RapidBlaster malware.
Kill the process rbenh.exe and remove rbenh.exe from Windows startup.
http://www.doxdesk.com/parasite/RapidBla...

rbot.exe
rBot.exe is a Backdoor W32.Kelvir.R.
rBot.exe spreads by MSN Messenger and via open network shares .
rBot.exe tries to terminate antiviral programs installed on a user computer.
rBot.exe steals private information.
Related files:
%ProgramFiles%\KEVIN\rBot.exe
%ProgramFiles%\KEVIN\kevin.exe
%System%\svchost32.exe
Adds the value:
"Universal USB Service" = "svchost32.exe"
"load" = "C:\Program Files\KEVIN\Kevin.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill rBot.exe process and remove rBot.exe from Windows startup using RegRun Startup Optimizer.

rcaviy.exe
RCAVIY.exe is a Backdoor/Trojan.
Removal:
Kill RCAVIY.exe process and remove RCAVIY.exe from Windows startup using RegRun Startup Optimizer.

rch.exe
HTTP server / Remote Access

rchubo.exe
HTTP server / Remote Access

rcs.exe
RCS.exe is W32.Falgna.
Related files:
%System%\MSINSCK.OCX
%System%\Rtmp.bat
%System%\Rtmp.log
%System%\Rtmp.scr
%System%\Rtemp.bat
%System%\ALMV.exe
%System%\DLMVT.exe
%System%\DLMVD.exe
%System%\DLMVX.exe
%System%\DLMVP.exe
%System%\RCS.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process RCS.exe and remove RCS.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rdatasys2.exe
Rdatasys2.exe is Trojan/Backdoor.
Kill the process rdatasys2.exe and remove rdatasys2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rdatdll5.exe
We suggest you to remove RDATDLL5.EXE from your computer as soon as possible.
RDATDLL5.EXE is Trojan/Backdoor.
Kill the process RDATDLL5.EXE and remove RDATDLL5.EXE from Windows startup.

rdfx4.exe
Rdfx4.exe is ZQuest adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process rdfx4.exe and remove rdfx4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rdfx4[1].exe
RDFX4[1].EXE is Downloader Drev A.
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process RDFX4[1].EXE and remove RDFX4[1].EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rdiv.sys
Rdiv.sys is Trojan/Backdoor.
Kill the file rdiv.sys and remove rdiv.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

rdriv.sys
Rdriv.sys is a Rootkit driver.
Rdriv.sys hides the process iTunesMusic.exe nad the service.
Use UnHackMe for removing Rdriv.sys.

rdsdtv.exe
Rdsdtv.exe is Trojan/Backdoor.
Kill the process rdsdtv.exe and remove rdsdtv.exe from Windows startup.

re_file.exe
Re_file.exe is a mass-mailing worm W32.Beagle.BO@mm.
Re_file.exe spreads by e-mail.
Re_file.exe opens a back door on TCP port 80.
Re_file.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svc.exe
%System%\re_file.exe
%Windir%\eml.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill re_file.exe process and remove re_file.exe from Windows startup using RegRun Startup Optimizer.

readme.exe
BackDoor Trojan.

readme.txt.exe
Readme.txt.exe is W32.Lashplay.
W32.Lashplay is a worm that copies itself to all drives on the compromised computer.
Related files:
[DRIVE LETTER]:\readme.txt.exe
[DRIVE LETTER]:\flashplay.dll
[DRIVE LETTER]:\autorun.inf
%System%\flashplay.dll
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process readme.txt.exe and remove readme.txt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

real joy.exe
Real joy.exe is Trojan/Backdoor.
Kill the process real joy.exe and remove real joy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

realaudio.exe
RealAudio.exe is a Trojan.Psyme-BF.
RealAudio.exe downloads code from the internet.
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill RealAudio.exe process and remove RealAudio.exe from Windows startup using RegRun Startup Optimizer.

realpaly.exe
Realpaly.exe is Trojan/Backdoor.
Kill the process realpaly.exe and remove realpaly.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

realplays.exe
REALPLAYS.EXE is Worm RBOT.
REALPLAYS.EXE works in the Windows system folder.
Adds to teh Windows startup registry keys:
Configuration Loader = realplays.exe
REALPLAYS.EXE works as IRC server.
It allows a remote user to take the full control on the infected computer.
Remova of REALPLAYS.EXE:
RegRun Startup Optimizer removes it.

realschd.exe
Realschd.exe is Trojan/Backdoor.
Kill the process realschd.exe and remove realschd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

realsled.exe
Realsled.exe is Trojan/Backdoor.
Kill the process realsled.exe and remove realsled.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

realteks.exe
Realteks.exe is Trojan/Backdoor.
Kill the process realteks.exe and remove realteks.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

realupdate.exe
Realupdate.exe is Trojan.Baiso.
Trojan.Baiso is a Trojan horse that downloads files from the Internet, which contain URLs that are used to display Web pages and download other threats.
Related files:
%Windir%\realupdate.exe - a file used to update itself
%Windir%\winampb.exe
%System%\A4\baisob\avpb.exe
%System%\A4\baisob\dllhostb.dll
%System%\A4\baisob\novel.exe
%System%\A4\baisob\up.dat
%System%\A4\baisob\verx.dat
Read more:
http://www.symantec.com/security_respons...
Kill the process realupdate.exe and remove realupdate.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rebatenation0.exe
Rebatenation0.exe is Adware.Avenue Media/Web Rebates (TopRebates).
Read more:
http://www.superadblocker.com/definition...
Kill the process rebatenation0.exe and remove rebatenation0.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

recsl.exe
Recsl.exe is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq13bc...
Kill the process recsl.exe and remove recsl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rectumunet.exe
Rectumunet.exe is Trojan/Backdoor SDBOT Win32.
Kill the process rectumunet.exe and remove rectumunet.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

recycle-bin.exe
Name: Shit Heep
Remote Access

recycler.exe
Recycler.exe is W32.Lecna.H.
W32.Lecna.H is a worm that spreads by copying itself to mapped drives. It also opens a back door and may download potentially malicious code on to the compromised computer.
Related files:
%System%\AUTORUN.INF
%System%\confi.exe
%System%\Config.ini
%System%\Recycler.exe
%System%\uninstx.exe
%System%\keyvect.dll
%System%\netscv.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process Recycler.exe and remove Recycler.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

redire32.exe
Remote Access
Alters Win.ini.

redirect2.exe
Redirect2.exe is a Spyware.Dotcomtoolbar.
Redirect2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
Redirect2.exe
Redirect7.exe
Redirect9a.exe
toolbar_nieuw14.dll
Adds the value:
"redirect" = "[path to adware file]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Redirect2.exe process and remove Redirect2.exe from Windows startup using RegRun Startup Optimizer.

redirect7.exe
Redirect7.exe is a Spyware.Dotcomtoolbar.
Redirect7.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
Redirect2.exe
Redirect7.exe
Redirect9a.exe
toolbar_nieuw14.dll
Adds the value:
"redirect" = "[path to adware file]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Redirect7.exe process and remove Redirect7.exe from Windows startup using RegRun Startup Optimizer.

redist.exe
REDIST.EXE is Trojan/Backdoor.
Read more:
http://spywarefiles.prevx.com/RRCJID6845...
Kill the process REDIST.EXE and remove REDIST.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

redistributor.exe
Redistributor.exe is Trojan Win32.Candebe.
Related files:
redist.dll
Read more:
http://www3.ca.com/be/securityadvisor/pe...
Kill the process redistributor.exe and remove redistributor.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

redx.exe
Redx.exe is Trojan/Backdoor.
Kill the process redx.exe and remove redx.exe from Windows startup.

reg32.exe
Troj/Regldr-A
It is a simple Trojan that copies itself to the windows folder as the file Reg32.exe and sets the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Reg32 = C:\Windows\Reg32.exe

This trojan will also set the registry entries listed below to point to the page secure.html located in the default Windows folder.
This HTML page claims that the system has been compromised by spyware and prompts the user to visit the URL
http://www.privacyoutpost.com/enter.html...
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Local Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKLM\Software\Microdoft\Internet Explorer\Main\Local Page
HKLM\Software\Microsoft\Internet explorer\Main\Start Page

Manual removal:
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
and delete this value: Reg32= C:\Windows\Reg32.exe

reg33.exe
Trojan program.
Remove it from startup by Start Control.
Reset Internet Explorer settings to default.
Open Start menu, Settings, Control Panel, Internet Settings.
Go to the "Programs" tab.
Click on the "Reset Web parameters" button.

reg66.exe
Remote Access / Keylogger
Alters Win.ini. Is been disguised as a Y2K system updater.

reg666.exe
Millenium trojan

regbhper.exe
We suggest you to remove REGBHPER.EXE from your computer as soon as possible.
REGBHPER.EXE is Trojan/Backdoor.
Kill the process REGBHPER.EXE and remove REGBHPER.EXE from Windows startup.

regcheck.exe
Remote Access / Steals passwords / EXE Binder
May alter Win.ini and/or System.ini. Based on SubSeven. Some of the files are packed with the UPX 1.01. It comes with several different skins and supports plug-ins, so features may change. With Undetected, the hacker is able to write and execute different types of scripts, such as .bat and .vbs files, on the infected machine.

regcle32.exe
Remote Access / Destructive trojan / Virus dropper
It copies itself to c:\recycled to avoid detection by some antivirus programs.

regdata.dll
Regdata.dll is Trojan Downloader.
Read more:
http://fileinfo.prevx.com/QQe71019910355...
Kill the file regdata.dll and remove regdata.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

regdata.exe
Regdata.exe is Trojan/Backdoor.
Kill the process regdata.exe and remove regdata.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regdll32.exe
Regdll32.exe is Troj/WebMoney-G.
Related files:
%WINDOWS%\regdll32.exe
%SYSTEM%\regsvr.exe
%SYSTEM%\vxddrv32.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process regdll32.exe and remove regdll32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regedif32.exe
Regedif32.exe is Trojan/Backdoor.
Kill the process regedif32.exe and remove regedif32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regepsrvc.sys
Regepsrvc.sys is Trojan/Backdoor.
Kill the file regepsrvc.sys and remove regepsrvc.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

reghost.exe
Reghost.exe is Spyware.SpyPal.
Spyware.SpyPal is a spyware program that monitors user activity on the computer.
Related files:
%System%\psreginf.ini
%UserProflie%\Local Settings\Temp\~DF[RANDOM CHARACTERS].tmp
%ProgramFiles%\SPSS\apsvc.exe
%ProgramFiles%\SPSS\data\data.dat
%ProgramFiles%\SPSS\data\ps_demo_report.html
%ProgramFiles%\SPSS\data\reginf.ini
%ProgramFiles%\SPSS\data\testftpok.html
%ProgramFiles%\SPSS\data\usrproc.exe
%ProgramFiles%\SPSS\data\winserv.exe
%ProgramFiles%\SPSS\help.chm
%ProgramFiles%\SPSS\License.txt
%ProgramFiles%\SPSS\readme.txt
%ProgramFiles%\SPSS\scrshot\[RANDOM FILE NAME].jpg
%ProgramFiles%\SPSS\unins000.dat
%ProgramFiles%\SPSS\unins000.exe
%System%\fltmc001.dat
%System%\fltmc002.dat
%System%\fltmc003.dat
%System%\reghost.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process reghost.exe and remove reghost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

reginid_redux.exe
Reginid_redux.exe is Trojan/Backdoor.
Kill the process reginid_redux.exe and remove reginid_redux.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

reginix86c.dll
Reginix86c.dll is Trojan/Backdoor.
Kill the file reginix86c.dll and remove reginix86c.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

reginix86d.dll
Reginix86d.dll is Trojan/Backdoor.
Kill the file reginix86d.dll and remove reginix86d.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

registry.exe
Troj/Zasil-A creates and executes the file registry.exe in the Windows folder and then displays a pornographic JPG image.
Create the following key in the system registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Registry Services
with the value: registry.exe
Each time registry.exe is executed the Trojan will attempt to download a text file from the internet that contains links to scripts that access pages from lists of website addresses contained in the scripts.
The Trojan may also access a spyware script that reports the IP address being used by the active Trojan.

Use RegRun to automatically remove this registry item.

registry32.exe
Remote Access / Steals passwords
Alters Win.ini and System.ini. Comes with a NetScanner to help finfing infected PCs.

registryreminder.exe
Steals passwords / AOL trojan
Alters Win.ini and System.ini. Steals passwords from AOL accounts and sends them one of several hotmail addresses.

registryrepair.exe
Registryrepair.exe is Spyware VirusBlast.
Read more:
http://fileinfo.prevx.com/QQb31419964496...
Kill the process registryrepair.exe and remove registryrepair.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regloadr.exe
Gaobot Trojan.
Spreads in local network via open shares.
Also it uses DCOM RPC vulnerability (135,445 ports) and WebDav vulnerability (port 80).
Allows to control the victim computer by IRC.
Terminates well known antiviral software.
Removal:
install the patches from Microsoft:
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
Set the strong passwords for network shares.
Use RegRun "Terminate" feature to erase the virus body files.
They are located in Windows\System32 folder.
Cavapsvc.exe
Csrrs.exe
Cvhost.exe
DIIhost.exe (with capital letter 'i')
Dosrun32.exe
Dos32.exe
Lsas.exe
Regloadr.exe
Schost.exe
Scvhost.exe
Service.exe
Servicess.exe
Sochost.exe
Swchost.exe
System.exe
Update.exe
Wdrun32.exe
Winhlpp32.exe
Winreg.exe
Winupdsdgm.exe

Free removal tool:
http://securityresponse.symantec.com/avc...

regmen.exe
Regmen.exe is Backdoor BDS/PoisonIvy.20.A.
Read more:
http://kb.mozillazine.org/Firefox.exe_al...
Kill the process regmen.exe and remove regmen.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regobj.dll
Regobj.dll is Backdoor.Win32.DSSdoor.c.
Related files:
MSINET.OCX
regobj.dll
SocketX.DLL
SocketX.OCX
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the file regobj.dll and remove regobj.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

regrun.exe
Regrun.exe is a Trojan Backdoor.Sdbot.
Regrun.exe spreads via Internet Relay Chat (IRC).
Regrun.exe tries to terminate antiviral programs installed on a user computer.
Regrun.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Cnfgldr.exe
%System%\cthelp.exe
%System%\Sysmon16.exe
%System%\Sys3f2.exe
%System%\Syscfg32.exe
%System%\Mssql.exe
%System%\Aim95.exe
%System%\Svchosts.exe
%System%\FB_PNU.EXE
%System%\Cmd32.exe
%System%\Sys32.exe
%System%\Explorer.exe
%System%\IEXPL0RE.EXE
%System%\iexplore.exe
%System%\sock32.exe
%System%\MSTasks.exe
%System%\service.exe
%System%\Regrun.exe
%System%\ipcl32.exe
%System%\syswin32.exe
%System%\CMagesta.exe
%System%\YahooMsgr.exe
%System%\vcvw.exe
%System%\spooler.exe
%System%\MSsrvs32.exe
%System%\svhost.exe
%System%\winupdate32.exe
%System%\quicktimeprom.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Regrun.exe process and remove Regrun.exe from Windows startup using RegRun Startup Optimizer.

regs plus.exe
Regs plus.exe is Trojan/Backdoor.
Kill the process regs plus.exe and remove regs plus.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regscan.exe
Regscan.exe is W32/Rbot-HA.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process regscan.exe and remove regscan.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regscaner32.exe
Regscaner32.exe is Trojan/Backdoor.
Kill the process regscaner32.exe and remove regscaner32.exe from Windows startup.

regserver.exe
Remote Access / Destructive trojan (?)

regsrv32.com
Regsrv32.com is Trojan/Backdoor SOUTHGHOST.
Kill the file regsrv32.com and remove regsrv32.com from Windows startup using RegRun Reanimator.
http://www.regrun.com

regstrmon.exe
Regstrmon.exe is Malware Trojan Backdoor Gen.
Related files:
%WINDIR%\ERASEME_41633.EXE
%WINDIR%\ERASEME_51173.EXE
%WINDIR%\ERASEME_52833.EXE
%WINDIR%\SYSTEM32\ERASEME_08166.EXE
%WINDIR%\SYSTEM32\ERASEME_20757.EXE
%WINDIR%\SYSTEM32\ERASEME_32287.EXE
%WINDIR%\SYSTEM32\ERASEME_42734.EXE
%WINDIR%\SYSTEM32\ERASEME_56718.EXE
%WINDIR%\SYSTEM32\ERASEME_77605.EXE
%WINDIR%\SYSTEM32\ERASEME_82324.EXE
Read more:
http://fileinfo.prevx.com/spyware/qq383b...
Kill the process regstrmon.exe and remove regstrmon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regsvclib.exe
Regsvclib.exe is Trojan/Backdoor.
Kill the process Regsvclib.exe and remove Regsvclib.exe from Windows startup.
Related files for W32.HLLW.Nautic:
* NTDLL.exe
* Win32.exe
* Explore.exe
* Kernel32.exe
* krnl286.exe
* Dllhost32.exe
* MSTCP.exe
* CRSS.exe
* Winlogon32.exe
* Winsrvc.exe
* Ntoskrn.exe
* Vmm32.exe
* Sysmon.exe
* System32.exe
* Sys.exe
* Win.exe
* Rundil32.exe
* Msrvcp.exe
* Msgmsr.exe
* Mscde32.exe
* Regsvclib.exe
* Reg32.exe
* Registry32.exe
* Service.exe
* Rpcsrvc.exe
More info:
http://securityresponse.symantec.com/avc...

regsvr.exe
Regsvr.exe is W32/Rbot-PR.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process regsvr.exe and remove regsvr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

regsvrcss32.exe
Regsvrcss32.exe is Trojan/Backdoor.
Kill the process regsvrcss32.exe and remove regsvrcss32.exe from Windows startup.

regsvs.exe
W32.Gaobot.YN is a variant of W32.HLLW.Gaobot.gen that attempts to spread to network shares and allows access to an infected computer through an IRC channel.

The worm uses multiple vulnerabilities to spread, including:
The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026), using TCP port 135
The RPC locator vulnerability (described in Microsoft Security Bulletin MS03-001), using TCP port 445
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007), using TCP port 80

Allows unauthorized remote access.
Steals CD keys of several popular computer games.
Ends processes belonging to antivirus and firewall software.
Accounts with weak passwords; systems not patched against the DCOM RPC vulnerability or the RPC locator vulnerability.

Copies itself as %System%\regsvs.exe.

Adds the value: "Compatibility Service Process" = "regsvs.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Opens a randomly selected TCP port to connect to an attacker.
Connects to a predefined IRC channel, using its own IRC client, and listens for the commands from an attacker.
Allows an attacker to remotely control a compromised computer, allowing him/her to perform any of the following actions:
- Manage the installation of the worm
- Dynamically update the installed worm
- Download and execute files
- Steal system information
- Send the worm to other IRC users
- Add new accounts

Automatic removal:
Use RegRun Startup Optimizer to remove it from startup.

regsync.exe
Regsync.exe is Spyware.
Kill the process regsync.exe and remove regsync.exe from Windows startup.

regupdt32.exe
Regupdt32.exe is Trojan.FakeAlert.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process regupdt32.exe and remove regupdt32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rejoice42.exe
Rejoice42.exe is Backdoor.Shangxing.
Related files:
%CommonProgramFiles%\Microsoft Shared\MSInfo\rejoice42.exe
%System%\SVKP.sys, which is used to unpack the file
Backdoor.Shangxing is a Trojan horse that opens a back door on the compromised computer.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rejoice42.exe and remove rejoice42.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

release.exe
Name: SkyDance
Remote Access
Among the information this trojans steals is a copy of all registrysettings.

relive.dll
Relive.dll is WORM_AGENT.AAMH.
Related files:
%Program Files%\COMMON FILES\Relive.dll
%Program Files%\INTERNET EXPLORER\msvcrt.dll
%Program Files%\INTERNET EXPLORER\msvcrt.ebk
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the file relive.dll and remove relive.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

reloc32.exe
Reloc32.exe is W32.Relfeer.
W32.Relfeer is a worm that spreads through network shares and file-sharing applications. It may also attempt to download potentially malicious files on to the compromised computer.
Related files:
C:\WINDOWS\reloc32.exe
C:\WINDOWS\system32\updates.exe
C:\WINDOWS\system32\wandrv.exe
C:\WINDOWS\system32\WAN_DR.ULD
C:\WINDOWS\svhst32.exe
%Temp%\config_.exe
%Temp%\sysutil.exe
%Start Menu%\Programs\Startup\[WORM FILE NAME].exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process reloc32.exe and remove reloc32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rem00001.dll
Rem00001.dll is an adware program Adware.Bookedspace.
Rem00001.dll downloads and displays advertisements.
Related files:
rem00001.dll
oo4.dll
bxxs5.dll
Adds the value:
"[name of .dll file]" = "RunDLL32.exe [path to .dll file], DllRun"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove rem00001.dll from Windows startup using RegRun Startup Optimizer.

remie20.exe
Remie20.exe is a Spyware.InlookExpress.
Remie20.exe logs keystrokes.
Related files:
%Windir%\inlook.exe
%Windir%\is-QV2PM.exe
%Windir%\is-QV2PM.lst
%Windir%\sds20.oca
C:\sds20\final.exe
C:\sds20\IEControl2.exe
C:\sds20\ijl11.dll
C:\sds20\remie20.exe
C:\sds20\settings.dat
C:\sds20\svchost.exe
C:\sds20\svchost32.exe
C:\sds20\TheHook.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill remie20.exe process and remove remie20.exe from Windows startup using RegRun Startup Optimizer.

remon.sys
Remon.sys is Trojan/Backdoor driver known as Hacktool Rootkit.
Kill the file remon.sys and remove remon.sys from Windows startup.

remote.exe
Prank trojan
Reboots a computer remotely

remotecontrol.exe
Remote Access / FTP server / Steals passwords

remtsrv.exe
Remtsrv.exe is Trojan/Backdoor.
Kill the process remtsrv.exe and remove remtsrv.exe from Windows startup.

rep.exe
rep.exe is a Adware.DuDuAccelerator.
rep.exe displays advertisements.
rep.exe monitors user Internet activity.
Related files:
%System%\mbprot.dll
%ProgramFiles%\DuDu\DDDClient\ddddl.dll
%ProgramFiles%\DuDu\DDDClient\dddiemon.dll
%ProgramFiles%\DuDu\DDDClient\dddmext.dll
%ProgramFiles%\DuDu\DDDClient\dddskin.dll
%ProgramFiles%\DuDu\DDDClient\ddddpocx.dll
%ProgramFiles%\DuDu\DDDClient\DuDuAcc.exe
%ProgramFiles%\DuDu\DDDClient\dudupros.exe
%ProgramFiles%\DuDu\DDDClient\DuDuProsvc.exe
%ProgramFiles%\DuDu\DDDClient\rep.exe
%ProgramFiles%\DuDu\DDDClient\rsen.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill rep.exe process and remove rep.exe from Windows startup using RegRun Startup Optimizer.

repairs.dll
Repairs.dll is SurSidekick Adware.
Kill the process repairs.dll and remove repairs.dll from Windows startup.

repairs302972943.dll
Repairs302972943.dll is SurfSidekick Adware.
Kill the process repairs302972943.dll and remove repairs302972943.dll from Windows startup.

repairs303169590.dll
Repairs303169590.dll is SurfSideKick Adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file repairs303169590.dll and remove repairs303169590.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

replmap.dll
Replmap.dll is Trojan.Zlob.
Read more:
http://www.superadblocker.com/definition...
Kill the file replmap.dll and remove replmap.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

reporter.exe
Remote Access

requester.11.exe
Requester.11.exe is Trojan/Backdoor Requester.
Kill the process requester.11.exe and remove requester.11.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

restun.exe
Restun.exe is Trojan/Downloader.ALQ.
Kill the process restun.exe and remove restun.exe from Windows startup using RegRun.
www.regrun.com

resys.exe
RESYS.EXE is W32/Baitap-A worm.
Related files:
\spoolsv.exe
\resys.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process RESYS.EXE and remove RESYS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu.exe
RETADPU.EXE is Trojan/Backdoor.
Kill the process RETADPU.EXE and remove RETADPU.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu1000272.exe
Retadpu1000272.exe is Trojan/Backdoor.
Kill the process retadpu1000272.exe and remove retadpu1000272.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu11.exe
Retadpu11.exe is Trojan/Backdoor.
Kill the process retadpu11.exe and remove retadpu11.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu206.exe
Retadpu206.exe is Trojan/Backdoor.
Kill the process retadpu206.exe and remove retadpu206.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu27.exe
Retadpu27.exe is Trojan-Downloader.Matcash.
Related files:
%SYSTEM%\ svchosts.exe
%windows%\ downloaded program files\ speedtest2.dll
b122.exe
install.exe
retadpu27.exe
updater.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process retadpu27.exe and remove retadpu27.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

retadpu72.exe
RETADPU72.EXE is Trojan/Backdoor.
Kill the process RETADPU72.EXE and remove RETADPU72.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

retailvistahelp.dll
RETAILVISTAHELP.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq1948...
Kill the file RETAILVISTAHELP.DLL and remove RETAILVISTAHELP.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rewrw.dll
Rewrw.dll is a Backdoor Trojan.Riler.D.
Rewrw.dll spreads via open network shares.
Related files:
%System%\winmedl.dll
%System%\sporder.dll
%System%\WinSSi.exe
%System%\rewrw.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove rewrw.dll from Windows startup using RegRun Startup Optimizer.

rexename.exe
REXENAME.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qqc3b0...
Kill the process REXENAME.EXE and remove REXENAME.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rfkampig.exe
Trojan.Gipma is a Trojan horse program that displays obscene messages and makes the desktop and task bar invisible.
Displays the %Windows%\pig.htm file in Internet Explorer. This page contains an obscene, anti-American message.

Moves itself to %System%\fkampig.exe.
Copies itself as %windows%\retime.exe.
Creates a file named %windows%\pig.htm.

Sets the value: "retime" = "%windows%\retime.exe"
in the registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Sets the value: "Windows-TCP-IP" = "%system%\rfkampig.exe"
in the registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Sets the value: "StartPage" = "%windows%\pig.htm"
in the registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_USERS\.Default\SOFTWARE\Microsoft\Internet Explorer\Main
so that the obscene message is the default start page for Internet Explorer.

May leave behind a file in the root of the C: drive, named killme.bat.

Use RegRun Startup Optimizer to remove it from startup.

rfmsuxes.exe
RFMSUXES.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq864b...
Kill the process RFMSUXES.EXE and remove RFMSUXES.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rgqqgy.dll
Rgqqgy.dll is Trojan/Backdoor.
Kill the file rgqqgy.dll and remove rgqqgy.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rgqqgy.exe
Rgqqgy.exe is Trojan/Backdoor.
Kill the process rgqqgy.exe and remove rgqqgy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rhds.exe
Rhds.exe is Trojan/Backdoor.
Kill the process rhds.exe and remove rhds.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rhrlb.exe
RHRLB.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq9673...
Kill the process RHRLB.EXE and remove RHRLB.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

ricad3.exe
RICAD3.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qqfde8...
Kill the process RICAD3.EXE and remove RICAD3.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

richdll.dll
RichDll.dll is W32.Looked.BK.
Read more:
%Windir%\uninstall\rundl132.exe
%Windir%\Logo1_.exe
%UserProfile%\Local Settings\Temp\$$a5.bat
%UserProfile%\Local Settings\Temp\$$ab.bat
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file RichDll.dll and remove RichDll.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

richnotify.exe
Richnotify.exe is Trojan.Dachri.
Trojan.Dachri is a Trojan horse that opens a back door and may display advertisements on the compromised computer.
Related files:
%System%\richnotify.exe
%System%\resPro.dll
%System%\resData.dat
%System%\tempinfo.dat
Read more:
http://www.symantec.com/security_respons...
Kill the process richnotify.exe and remove richnotify.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ripserv.dll
Ripserv.dll is a Trojan Backdoor.Ripgof.
Ripserv.dll spreads exploits the Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability (BID 12960).
Related files:
%System%\ripserv.dll
%System%\drivers\netcn.sys
%Temp%\JET45AF.tmp
Adds the value:
"ServiceDll" = "%System%\ripserv.dll"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove ripserv.dll from Windows startup using RegRun Startup Optimizer.

rising.exe
Rising.exe is W32.Popwin.
32.Popwin is a worm that attempts to spread through local and removable drives. It displays advertisements and downloads potentially malicious files on to the compromised computer.
Related files:
%System%\[RANDOM 8 DIGIT HEX NUMBER].EXE
%System%\[RANDOM 8 DIGIT HEX NUMBER].DLL
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rising.exe and remove rising.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rising198.exe
RISING198.EXE is Trojan.SystemPoser.
Read more:
http://fileinfo.prevx.com/spyware/qqc5fd...
Kill the process RISING198.EXE and remove RISING198.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

riva.model.dll
RIVA.MODEL.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file RIVA.MODEL.DLL and remove RIVA.MODEL.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

riva.ui.exe
RIVA.UI.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process RIVA.UI.EXE and remove RIVA.UI.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rketbuy.exe
Rketbuy.exe is Trojan/Backdoor.
Kill the process rketbuy.exe and remove rketbuy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rkinstaller.exe
Rkinstaller.exe is RelevantKnowledge D Spyware.
Related files:
osib0.tmp
rkinstaller.exe
rlls.dll
rlvknlg.exe
%system%\rkinstaller.exe
%system%\rlls.dll
Read more:
http://www.ca.com/us/securityadvisor/pes...
Kill the process rkinstaller.exe and remove rkinstaller.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rldsregj.exe
Rldsregj.exe is Trojan/Backdoor.
Kill the process rldsregj.exe and remove rldsregj.exe from Windows startup using RegRun.
www.regrun.com
Read more:
http://research.sunbelt-software.com/thr...

rlid.exe
Added as a result of the LIXY virus.

Backdoor.Lixy is a Backdoor Trojan Horse that opens a proxy server on TCP port 1080.
Backdoor.Lixy consists of one .dll file and two .exe files.

The file names are usually the following:
- Rlid.exe: For setting up and running other Trojan files.
- Lid.exe: Contains the main routine of the backdoor.
- Lid.dll: A malicious Browser Helper Object that runs Lid.exe.

Backdoor.Lixy performs the following actions:
Adds the value:
"Key1"=""
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
so that the Trojan starts when you start Windows.

Adds the following keys in the registry:
HKEY_CLASSES_ROOT\CLSID\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}
HKEY_CLASSES_ROOT\HTMLEdit.SSocks5
HKEY_CLASSES_ROOT\HTMLEdit.SSocks5.1
HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks5
HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks5.1
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}
which adds Lid.dll as a Browser Helper Object.

Manual removal:
Delete the unneeded registry keys (see above).

Automatic removal:
Use RegRun Startup Optimizer to remove it from startup.

rlls.dll
RLLS.DLL is Malware.
Kill the file RLLS.DLL and remove RLLS.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rlmksem.exe
Rlmksem.exe is Trojan/Backdoor.
Kill the process rlmksem.exe and remove rlmksem.exe from Windows startup.

rlplregx.exe
RLPLREGX.EXE is Dropper.Payload.
Read more:
http://fileinfo.prevx.com/spyware/qq96e9...
Kill the process RLPLREGX.EXE and remove RLPLREGX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rlvknlg.exe
Rlvknlg.exe is Trojan/Backdoor.
Kill the process rlvknlg.exe and remove rlvknlg.exe from Windows startup.

rmaapp.exe
Remote Access

rmcomtb.exe
Rmcomtb.exe is a part of Spyinator software.
Spyinator is a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats.
Related files:
%ProgramFiles%\Spyinator\Alert.WAV
%ProgramFiles%\Spyinator\BlockedCookies.txt
%ProgramFiles%\Spyinator\ImmunizeDatabase
%ProgramFiles%\Spyinator\RegistrySpylist
%ProgramFiles%\Spyinator\rmcomtb.dat
%ProgramFiles%\Spyinator\rmcomtb.exe
%ProgramFiles%\Spyinator\Spyinator.exe
%ProgramFiles%\Spyinator\spyList
%ProgramFiles%\Spyinator\uninstal.log
C:\Documents and Settings\All Users\Start Menu\Programs\Spyinator v2.0\Remove Spyinator v2.0.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Spyinator v2.0\Spyinator v2.0.lnk
%UserProfile%\Desktop\Spyinator v2.0.lnk
%Windir%\SpyInator_IsFirstTime.txt
%UserProfile%\Local Settings\Temp\~DF[RANDOM HEXADECIMAL NUMBER].tmp
%System%\MSCOMCT2.OCX
%System%\Richtx32.ocx
%System%\TABCTL32.OCX
%Windir%\unvise32.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rmcomtb.exe and remove rmcomtb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmincon.exe
Rmincon.exe is Trojan.Realor.
Related files:
%System%\rmincon.exe
%System%\rmevents.exe
%System%\rmevents[RANDOM].exe
%System%\Tools\rmto3260.dll
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rmincon.exe and remove rmincon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmis.exe
RMIS.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qqce3d...
Kill the process RMIS.EXE and remove RMIS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmk8ot.dll
RMK8OT.DLL is Haxdoor variant.
Read more:
http://users.telenet.be/marcvn/spyware/1...
Kill the file RMK8OT.DLL and remove RMK8OT.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmmfvz.exe
Rmmfvz.exe is Adware.A Better Internet.
Read more:
http://www.nuker.com/container/details/a...
Kill the process rmmfvz.exe and remove rmmfvz.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmvalid.exe
Rmvalid.exe is MicroBillSys.
MicroBillSys is a potentially unwanted application that uses aggressive billing and collection service techniques to demand payment for Web site access after a three-day trial period has elapsed. It has been reported that these techniques may even result in a user no longer being able to browse the Internet.
Related files:
%System%\mbssm32.exe
%System%\mbsrm32.exe
%System%\mbsmon32.exe
%System%\mbsreg.exe
%System%\mbsreg32.exe
%System%\rmvalid.exe
%System%\smvalid.exe
%System%\Sexxxpassport.ico
%System%\my sex world.ico
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rmvalid.exe and remove rmvalid.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rmxview.exe
Rmxview.exe is Trojan/Backdoor.
Kill the process rmxview.exe and remove rmxview.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rnaapp32.exe
Backdoor.Leon allows a hacker to have full remote access to the infected computer.

When it runs, it installs the following files on the computer:
%system%\Msvbvm60.dll
%system%\Mswinsck.ocx
%system%\Rnaapp32.exe

Backdoor.Leon creates the value: Gxbviwvtl %system%\Rnaapp32.exe
under the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and the value: Aqc %system%\RNAAPP32.EXE
under the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Please, remove these values by RegRun Startup Optimizer.

rncmd.exe
Rncmd.exe is a mass mailing worm W32.Mediakill.A@mm.
Rncmd.exe tries to terminate antiviral programs installed on a user computer.
Rncmd.exe attempts to delete media files.
Related files:
%Windir%\SYMRND.LOG
%Windir%\c7052371.log
%Windir%\ORIN7.LOG
%Windir%\1004\syslw.exe
%Windir%\Drivers\winupd.exe
%Windir%\\Help\msop.exe
%Windir%\Cursors\rncmd.exe
%Windir%\ICS\mscs.exe
%Windir%\1004\lsrsa.exe
%Windir%\Drivers\msalph.exe
%Windir%\\Help\msrnd.exe
%Windir%\Cursors\symlg.exe
Adds the value:
"C7" = "[worm file name]"
"load" = "[worm file name]"
"Shell" = "Explorer.exe [worm file name]"
"(Default)" = "[worm file name] "%1" %*"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill rncmd.exe process and remove rncmd.exe from Windows startup using RegRun Startup Optimizer.

rnd32.exe
Rnd32.exe is Trojan/Backdoor.
Kill the process rnd32.exe and remove rnd32.exe from Windows startup.

rntx.dll
Rntx.dll is Bridge spyware.
Related files:
bridge.exe, bridge.inf, bridgew.exe, install.js, sbc_netscape.exe.
jao.dll, rntx.dll, rntx.inf in Windows\downloaded program files\
bridge.dll in Windows\downloaded program files\conflict.1\
a.exe, bridge.dll, jao.dll in Windows\system32\
bridge.dll in Windows\system\
Read more:
http://www.spywaredb.com/remove-bridge/
Kill the file rntx.dll and remove rntx.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rnvvra.exe
Rnvvra.exe is Trojan/Backdoor.
Kill the process rnvvra.exe and remove rnvvra.exe from Windows startup.

rnxntup.exe
We suggest you to remove rnxntup.exe from your computer as soon as possible.
Rnxntup.exe is Infostealer.Orcu.B.
Infostealer.Orcu.B is a Trojan horse that attempts to steal confidential information. It may arrive as a message spammed across the Orkut network or through Microsoft instant messaging clients.
Related files:
%Windir%\rnxntup.exe
%UserProfile%\Local Settings\Temp\manjwax.exe
%Windir%\xzmsa.adt
%Windir%\xzoka.adt
%Windir%\xzsui.adt
%Windir%\xzwok.adt
Read more:
http://www.symantec.com/business/securit...
Kill the process rnxntup.exe and remove rnxntup.exe from Windows startup.

roae33.sys
Roae33.sys is Trojan.Srizbi.
Trojan.Srizbi is a Trojan horse that sends spam and uses a rootkit to hide itself.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file Roae33.sys and remove Roae33.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

rock.exe
Rock.exe is Trojan LowZone-CR.
Directory:
"SysDir"
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process rock.exe and remove rock.exe from Windows startup using RegRun.
www.regrun.com

rockxp.exe
Rockxp.exe is Spyware.
Kill the process rockxp.exe and remove rockxp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rofl.exe
Rofl.exe is Trojan/Backdoor.
Kill the process rofl.exe and remove rofl.exe from Windows startup.

rofl.sys
Rofl.sys is Trojan/Backdoor - HackTool Rootkit/W32/Rbot-AUB.
Kill the file rofl.sys and remove rofl.sys from Windows startup.
http://www.sophos.com/virusinfo/analyses...

rolf.sys
Rolf.sys is WORM_MYTOB.NC.
Kill the file rolf.sys and remove rolf.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

romdrivers.dll
Romdrivers.dll is W32.Drom.
W32.Drom is a worm that downloads and executes malicious files on the compromised computer and spreads through removable storage devices.
Related files:
%ProgramFiles%\Internet Explorer\romdrivers.bak
%ProgramFiles%\Internet Explorer\romdrivers.dll
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file romdrivers.dll and remove romdrivers.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rootkit.exe
Rootkit.exe is AFX 2003 rootkit.
Use UnHackMe for remove Rootkit.exe and all its components.
http://www.unhackme.com

rosa.sys
Rosa.sys is Trojan/Backdoor.
Kill the file rosa.sys and remove rosa.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

route.exe
Route.exe is Trojan.Firpage.
Trojan.Firpage is a Trojan horse program that modifies the Start Page for Internet Explorer and the Home Page for Firefox.
Related files:
route.exe
update.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\vbe.vbe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process route.exe and remove route.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcc.dll
Rpcc.dll is Trojan RPCC Payload.
Read more:
http://fileinfo.prevx.com/spyware/qq4557...
Kill the file rpcc.dll and remove rpcc.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcc.exe
Rpcc.exe is Trojan VXGAME n.
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process rpcc.exe and remove rpcc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcc1.dll
Rpcc1.dll is Trojan/Backdoor.
Kill the file rpcc1.dll and remove rpcc1.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpccd.dll
Rpccd.dll is Trojan/Backdoor.
Kill the file rpccd.dll and remove rpccd.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcclient.exe
Rpcclient.exe is Trojan/Backdoor.
Kill the process rpcclient.exe and remove rpcclient.exe from Windows startup.

rpcecs.exe
RPCECS.EXE is Trojan/Backdoor.
Kill the process RPCECS.EXE and remove RPCECS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcmon.exe
W32.Randex.ATX is a network-aware worm that may be remotely controlled using IRC.

Deletes the C$, D$, IPC$, and ADMIN$ shares.
Releases system information and CD keys from the compromised computer via IRC.
Installs an IRC backdoor on the computer.

Drops and executes the file, %Temp%\secure.bat, which deletes the C$, D$, IPC$ and ADMIN$ shares.
Starts a keylogger and logs keystrokes to the file, %System%\Ntfsvi.txt.
The worm will then connect to an IRC server, batwing.gotdns.com, and then listen for commands.

Some of the actions the worm can perform include:

Scanning for computers that have weak administrator passwords and copying itself to those computers.
Collecting the CD keys of many computer games and sending them back to the attacker, using the IRC channel.
Displaying information about the computer, such as the CPU speed and amount of memory.
Performing ping, SYN, and UDP flooding.
Downloading files, which may include updated versions of the worm, and then executing them.
Connecting to Trojan horses on other computers, based on a predetermined list of names. The names to which the Trojan attempts to connect are Kuang, NetDevil, MyDoom, Sub7, and Optix.
Acting as a proxy for SOCKS, HTTP, and TCP connections.

You may use RegRun Startup Optimizer to automatic remove it from startup.

rpcrt3.dll
Rpcrt3.dll is Trojan/Backdoor.
Kill the file rpcrt3.dll and remove rpcrt3.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcscvb.exe
RpcScvb.exe is Troj/Dropper-NA.
Related files:
%Temp%\delmeexe.bat
%System%\RpccvS.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the process RpcScvb.exe and remove RpcScvb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcsrv.exe
Lovgate worm (also known as Supnot)
Worm copies have the following names:
rpcsrv.exe, syshelp.exe, winrpc.exe, WinGate.exe, WinRpcsrv.exe
Installs backdoor program to your computer for remote control.
Remove it from startup.

rpcsrvc.exe
Rpcsrvc.exe is Trojan/Backdoor.
Kill the process Rpcsrvc.exe and remove Rpcsrvc.exe from Windows startup.
Related files for W32.HLLW.Nautic:
* NTDLL.exe
* Win32.exe
* Explore.exe
* Kernel32.exe
* krnl286.exe
* Dllhost32.exe
* MSTCP.exe
* CRSS.exe
* Winlogon32.exe
* Winsrvc.exe
* Ntoskrn.exe
* Vmm32.exe
* Sysmon.exe
* System32.exe
* Sys.exe
* Win.exe
* Rundil32.exe
* Msrvcp.exe
* Msgmsr.exe
* Mscde32.exe
* Regsvclib.exe
* Reg32.exe
* Registry32.exe
* Service.exe
* Rpcsrvc.exe
More info:
http://securityresponse.symantec.com/avc...

rpcsss.exe
RpcSss.exe is Troj/QQRob-ACI.
Related files:
%Temp%\delmeexe.bat
%System%\RpcSss.dll
%System%\RpcSss.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process RpcSss.exe and remove RpcSss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rpcsvc.exe
rpcsvc.exe is a Trojan.HacDef-AB.
rpcsvc.exe opens a back door.
Related files:
xmlsvc.exe
xmldata.dll
xmlsvc.dll
rpcsvc.exe
ioservice.exe
ioservice.ini
rpcsvr.exe
smap.exe
bitsm.exe
kern32.dll
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rpcsvc.exe process and remove rpcsvc.exe from Windows startup using RegRun Startup Optimizer.

rpcsvr.exe
rpcsvr.exe is a Trojan.HacDef-AB.
rpcsvr.exe opens a back door.
Related files:
xmlsvc.exe
xmldata.dll
xmlsvc.dll
rpcsvc.exe
ioservice.exe
ioservice.ini
rpcsvr.exe
smap.exe
bitsm.exe
kern32.dll
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rpcsvr.exe process and remove rpcsvr.exe from Windows startup using RegRun Startup Optimizer.

rptcrash.exe
RptCrash.exe is a Adware.GameSpyArcade.
RptCrash.exe download and display advertisements.
Related files:
Aphex.exe
fpupdate.exe
GSAPak.exe
RptCrash.exe
ArcRes.dll
gslan.dll
gsws.dll
pw32.dll
%Windir%\Downloaded Program Files\gsda.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill RptCrash.exe process and remove Aphex.exe from Windows startup using RegRun Startup Optimizer.

rpxwrhv.exe
Rpxwrhv.exe is Trojan/Backdoor.
Kill the process rpxwrhv.exe and remove rpxwrhv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rqkukiwc.exe
Remote Access
May alter System.ini and/or Win.ini. One can choose to let Mosucker randomly decide what autostart method to use. Produces an error message while installing ""Could not find setuplog.bat"" which apparently is used for autostarting. It copies itself to $temp first, as a file named pkg*.exe, ""pkg"" being a fix string. It also copied itself to $windows/unin0686.exe.

rqqsnd.exe
Rqqsnd.exe is Trojan Braban.
Kill the process rqqsnd.exe and remove rqqsnd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rqron.dll
Rqron.dll is Trojan/Backdoor.
Kill the file rqron.dll and remove rqron.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rqronkh.dll
RQRONKH.DLL is Trojan/Backdoor.
Kill the file RQRONKH.DLL and remove RQRONKH.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rqrqoop.dll
RQRQOOP.DLL is Adware.Virtumonde.
Kill the file RQRQOOP.DLL and remove RQRQOOP.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rqrqrpo.dll
Rqrqrpo.dll is SpywareQuake.
Read more:
http://spywaredlls.prevx.com/RRCBCB29409...
Kill the file rqrqrpo.dll and remove rqrqrpo.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rraa.dll
RRAA.DLL is Rootkit.Gromozon.Agent.
Read more:
http://fileinfo.prevx.com/spyware/qq218b...
Kill the file RRAA.DLL and remove RRAA.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rrimm.exe
RRIMM.EXE is Trojan/Backdoor.
Kill the process RRIMM.EXE and remove RRIMM.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rrtcany.dll
RRTCANY.DLL is Spyware VirusBurst.
Read more:
http://fileinfo.prevx.com/spyware/qqa856...
Kill the file RRTCANY.DLL and remove RRTCANY.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsbmsc.exe
Rsbmsc.exe is Trojan/Backdoor.
Kill the process rsbmsc.exe and remove rsbmsc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rscmtp.exe
Rscmtp.exe is Trojan/Remote Access.
Rscmtp takes the 100% of CPU.
Rscmtp spreads via LAN and by e-mail.

rsen.dll
rsen.dll is a Adware.DuDuAccelerator.
rsen.dll displays advertisements.
rsen.dll monitors user Internet activity.
Related files:
%System%\mbprot.dll
%ProgramFiles%\DuDu\DDDClient\ddddl.dll
%ProgramFiles%\DuDu\DDDClient\dddiemon.dll
%ProgramFiles%\DuDu\DDDClient\dddmext.dll
%ProgramFiles%\DuDu\DDDClient\dddskin.dll
%ProgramFiles%\DuDu\DDDClient\ddddpocx.dll
%ProgramFiles%\DuDu\DDDClient\DuDuAcc.exe
%ProgramFiles%\DuDu\DDDClient\dudupros.exe
%ProgramFiles%\DuDu\DDDClient\DuDuProsvc.exe
%ProgramFiles%\DuDu\DDDClient\rep.exe
%ProgramFiles%\DuDu\DDDClient\rsen.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove rsen.dll from Windows startup using RegRun Startup Optimizer.

rsmb.exe
Rsmb.exe is W32.Stration.C@mm.
Related files:
%Windir%\rsmb.exe
%Windir%\rsmb.dll
%Windir%\rsmb.wax
%Windir%\rsmb.gfx
%System%\acac.dll
%System%\corpdpvv.exe
%System%\d3diusp1.dll
%System%\fldrtsd3.dll
%System%\sisbmsxb.dll
~[RANDOM NUMBER].tmp
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rsmb.exe and remove rsmb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsmpmon.exe
Rsmpmon.exe is Trojan/Backdoor.
Kill the process rsmpmon.exe and remove rsmpmon.exe from Windows startup.

rsoprov.exe
RSOPROV.EXE is Trojan.Win32.Dialer.CJ.
Kill the process RSOPROV.EXE and remove RSOPROV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsrcload.exe
Remote Access / ICQ trojan
Sockets des Troie is French for Trojan Sockets and was one of the very first Remote Access trojans being published.

rsrcnrs.exe
Remote Access

rssauto.dll
Rssauto.dll is Trojan/Backdoor.
Kill the file rssauto.dll and remove rssauto.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rssp00x0.dll
RSSP00X0.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq2ef4...
Kill the file RSSP00X0.DLL and remove RSSP00X0.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rst.exe
Rst.exe is W32.Rinbot.L.
W32.Rinbot.L is a worm that spreads through network shares and by exploiting vulnerabilities. It also opens a back door on the compromised computer.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rst.exe and remove rst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsuninstal.exe
RSUNINSTAL.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq1688...
Kill the process RSUNINSTAL.EXE and remove RSUNINSTAL.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsvp32_2.dll
Rsvp32_2.dll is Proxy.Cimuz.bw.
Kill the file rsvp32_2.dll and remove rsvp32_2.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsvp322.dll
Rsvp322.dll is Troj/SpamToo-AM.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file rsvp322.dll and remove rsvp322.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsvterm.exe
Rsvterm.exe is Troj/Bdoor-ND.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process rsvterm.exe and remove rsvterm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rsyncmon.dll
RSYNCMON.DLL is Adware/Spyware component.
RSYNCMON.DLL is Browser Helper Object.
RSYNCMON.DLL monitors your Internet activity.
You need remove RSYNCMON.DLL from Windows startup by RegRun.

rtafwa.exe
RtAfwa.exe is W97M.Kukudro.B.
Directory: C:\
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rtAfwa.exe and remove rtAfwa.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rtanwjsa.exe
RTANWJSA.EXE is Trojan.SysMon.
Read more:
http://fileinfo.prevx.com/spyware/qq45f3...
Kill the process RTANWJSA.EXE and remove RTANWJSA.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rtf32.exe
Rtf32.exe is Adware Adclicker.
Kill the process rtf32.exe and remove rtf32.exe from Windows startup.

rtlfindval.exe
RtlFindVal.exe is Trojan/Backdoor.
Kill the process RtlFindVal.exe and remove RtlFindVal.exe from Windows startup.

rtneg3.dll
Rtneg3.dll is Trojan/Backdoor.
Kill the file rtneg3.dll and remove rtneg3.dll from Windows startup.

rtnka.dll
We suggest you to remove rtnka.dll from your computer as soon as possible.
Rtnka.dll is XP Entertainments Malware.
Related files:
%SYSTEM%\ ge.dll
%SYSTEM%\ htbt.dll
%SYSTEM%\ rtnka.dll
%SYSTEM%\ soui.dll
file.exe
head.1.1.exe
head.exe
soui.dll
Read more:
http://research.sunbelt-software.com/thr...
Kill the file rtnka.dll and remove rtnka.dll from Windows startup.

ruarcxmf.dll
RUARCXMF.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq6a3a...
Kill the file RUARCXMF.DLL and remove RUARCXMF.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

rubel.exe
RubeL.exe is Trojan.Rubelor.
Trojan.Rubelor is a Trojan horse that reduces security settings on the compromised computer.
Related files:
%Windir%\system32\config\RubeL.exe
%Windir%\system32\RubeL.exe
%SystemDrive%\RB.EXE
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process RubeL.exe and remove RubeL.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ruby13.exe
W32.Mexer.E@mm is a mass-mailing worm that also spreads through several file-sharing networks.
Adds the value: "Dir0"="012345:c:\sysnet\" to the registry keys:
HKEY_CURRENT_USER\Software\Imesh\Client\LocalContent\
HKEY_CURRENT_USER\Software\Kazaa\LocalContent
HKEY_CURRENT_USER\Software\Kazaa\Transfer
to spread using the iMesh and KaZaA peer-to-peer file-sharing networks.
Gathers the email addresses from the files and sends itself to the email addresses found, using its own SMTP engine.

Automatic removal: Use RegRun Startup Optimizer to automatically remove it from startup.

ruler1-3.exe
Remote Access / IP scanner
The trojan displays a fake message stating ""This file was corrupted"".

runc.exe
Runc.exe is a Adware.MediaInject.
Runc.exe displays advertisements.
Runc.exe monitors user Internet activity.
Related files:
Micore.exe
Runc.exe
Expin.dll
Wrdget.dll
Adds the value:
"micore"= "%ProgramFiles%\micore\runc.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Runc.exe process and remove Runc.exe from Windows startup using RegRun Startup Optimizer.

rund11.exe
Troj/Domwis-L
Also known as Win32/Wisdoor.L trojan, Backdoor.Wisdoor.h, Backdoor.Domwis
It is an IRC backdoor Trojan that allows a malicious user remote access to an infected computer.

When first run, the Trojan copies itself to the Windows folder as a hidden file named RUND11.EXE.
Sets the following registry entry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Kaspersky Antivirus = \RUND11.EXE

This trojan can delete, download and execute remote files on the infected computer.
Also, it can be used to send files to other IRC users.
The Trojan can be used to flood other computers with internet traffic.
To evade detection, the Trojan can spoof the IP address of the infected computer.
Can steal system information, log keystrokes, create screen and webcam captures and send them to a malicious user.
The Trojan can be used to scan other computers for open ports and for vulnerabilities in web and database servers.

Remove it with RegRun.

runddl22.exe
RUNDDL22.EXE is Trojan/Backdoor.
Kill the process RUNDDL22.EXE and remove RUNDDL22.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

runddl32.exe
Runddl32.exe is Trojan RBOT.ACJ.
Read more:
http://www.spywaredata.com/spyware/threa...
Kill the process runddl32.exe and remove runddl32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

runddll32.exe
RUNDDLL32.EXE is Infostealer.Changgame.
Read more:
http://www.sarc.com/avcenter/venc/data/p...
Kill the process RUNDDLL32.EXE and remove RUNDDLL32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundell32.exe
Rundell32.exe is Trojan/Backdoor.
Kill the process rundell32.exe and remove rundell32.exe from Windows startup.

rundil.exe
RundIl.exe is W32.Wikedir@mm.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rundIl.exe and remove rundIl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundil32 exe
Rundil32 exe is Troj/LegMir-AW.
Related files:
%System%\rundIl32.exe,
%System%\??.exe
%System%\??NOTEPAD.EXE
Read more:
http://www.sophos.com/security/analyses/...
Kill the file rundil32 exe and remove rundil32 exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundil32.exe
Rundil32.exe is Trojan/Backdoor.
Kill the process Rundil32.exe and remove Rundil32.exe from Windows startup.
Related files for W32.HLLW.Nautic:
* NTDLL.exe
* Win32.exe
* Explore.exe
* Kernel32.exe
* krnl286.exe
* Dllhost32.exe
* MSTCP.exe
* CRSS.exe
* Winlogon32.exe
* Winsrvc.exe
* Ntoskrn.exe
* Vmm32.exe
* Sysmon.exe
* System32.exe
* Sys.exe
* Win.exe
* Rundil32.exe
* Msrvcp.exe
* Msgmsr.exe
* Mscde32.exe
* Regsvclib.exe
* Reg32.exe
* Registry32.exe
* Service.exe
* Rpcsrvc.exe
More info:
http://securityresponse.symantec.com/avc...

rundl132.exe
Rundl132.exe is W32.Looked.AH.
Related files:
%Windir%\rundl132.exe
%Windir%\Logo1_.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rundl132.exe and remove rundl132.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundl13a.exe
Rundl13a.exe is Trojan/Backdoor.
Kill the process rundl13a.exe and remove rundl13a.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundl32.exe
Rundl32.exe is Trojan/Backdoor.
Kill the process rundl32.exe and remove rundl32.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

rundli32.exe
It appears when you infected with the LADE VIRUS.

W32.Lade is a worm that spread itself through IRC.
It attempts to remove antivirus software installed on the PC and may attempt to format the hard drive partitions C, D, E, F, and G at system restart.
Also Known as Backdoor.IRC.Lade

W32.Lade performs the following actions:
1. Drops a copy of itself to %Windir%\System\rundli32.exe.
NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.

2. Checks whether mIRC is installed, and if found, drops its own version of Script.ini, which contains code to spread itself by mIRC, to the mIRC folder.

3. Drops the batch file, %Windir%\Winstart.bat, which contains code to remove antivirus software when you restart the computer.

4. Adds values for "w32.BeanLadean.B.worm" to the following registry keys:
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\Software\
HKEY_LOCAL_MACHINE\Software\Microsoft\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

5. Adds the value:
"rundli32"="%Windir%\System\rundli32.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

6. May edit the C:\Autoexec.bat to attempt to format hard drive partitions C, D, E, F, and G at system restart, depending on circumstances.

Removal instruction:
1. Run a full system scan with your antiviral programm.
If any files are detected as infected with W32.Lade, click Delete.

2. Deleting the values from the registry
Find the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
Delete the value:
"rundli32"="%Windir%\System\rundli32.exe"

Then go to the keys:
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\Software\
HKEY_LOCAL_MACHINE\Software\Microsoft\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
and delete any values that refer to:
"w32.BeanLadean.B.worm"

rundll.dll
Rundll.dll is Infostealer.Banpaes.D.
Related files:
%System%\rundll.exe
%System%\rundll.dll
%System%\rundll32.dll
Read more:
http://www.sarc.com/avcenter/venc/data/p...
Kill the file rundll.dll and remove rundll.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundll16.exe
This is a SubSeven 1.9 trojan:
http://www.norman.com/virus_info/subseve...
or another trojan
http://www.avp.ch/avpve/newexe/win95/zmo...

Recommendation: Suspend its running and check your computer by antiviral software.

rundll2000.exe
Rundll2000.exe is Trojan/Backdoor.
Kill the process rundll2000.exe and remove rundll2000.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundll32.exe "c:\windows\system32\bridge.dll",load

rundll32.exe axfilter.dll,rundll32
Rundll32.exe AxFilter.dll,Rundll32 is CnsMin Downloader.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file AxFilter.dll and remove AxFilter.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundll32.exe c:/wi
Rundll32.exe c:\wi is Trojan/Backdoor.
Kill the file c:\wi and remove 'rundll32.exe c:\wi' from Windows startup using RegRun Reanimator.
http://www.regrun.com

rundll32.exe c:\program files\commonname\toolbar\cnbabe.dll
Advertising spyware. Remove it.

rundll32.exe d0ce0c16b1,d0ce0c16b1
Rundll32.exe stlb2.dll,DllRunMain is BrowserAid/ABCSearch parasite.
Stlb2.dll display pop-up ads.
Removal: Open the Control Panel’s ‘Add/Remove Programs’ function. There should be an entry for ‘BrowserAid’ or ‘CashToolbar’ (CashToolbar variant), ‘Web Toolbar’ (ABCSearch variant) or ‘BrowserPal’ (BrowserPal variant).
http://www.doxdesk.com/parasite/BrowserA...
Manual removal:
use RegRun Startup Anti-Spyware component.

rundll32.exe e6f1873b.dll,d9ebc318c
Rundll32.exe stlb2.dll,DllRunMain is BrowserAid/ABCSearch parasite.
Stlb2.dll display pop-up ads.
Removal: Open the Control Panel’s ‘Add/Remove Programs’ function. There should be an entry for ‘BrowserAid’ or ‘CashToolbar’ (CashToolbar variant), ‘Web Toolbar’ (ABCSearch variant) or ‘BrowserPal’ (BrowserPal variant).
http://www.doxdesk.com/parasite/BrowserA...
Manual removal:
use RegRun Startup Anti-Spyware component.

rundll32.exe egcomservice_1046.dll,instantaccess
Trojan Instant Access.
Can download additional dangerous modules from Internet, send privacy
information to the bad gays.
Remove it from Windows startup.

rundll32.exe reg.dll ondll_reg
Lovegate worm.
Worm.Lovgate (aka Supnot ) is a worm virus spreading via the Internet as an attachment to infected emails. The worm also spreads through local area networks and has a "backdoor" routine. There are several worm variants known which are very similar to each other.
Remove it from startup.

rundll32.exe stlb2.dll,dllrunmain
Rundll32.exe stlb2.dll,DllRunMain is BrowserAid/ABCSearch parasite.
Stlb2.dll display pop-up ads.
Removal: Open the Control Panel’s ‘Add/Remove Programs’ function. There should be an entry for ‘BrowserAid’ or ‘CashToolbar’ (CashToolbar variant), ‘Web Toolbar’ (ABCSearch variant) or ‘BrowserPal’ (BrowserPal variant).
http://www.doxdesk.com/parasite/BrowserA...
Manual removal:
use RegRun Startup Anti-Spyware component.

rundll32.vbs
I-Worm.FireBurn
This is an Internet worm that spreads as a VBS file attached to e-mail messages.
To send infected messages, the worm uses MS Outlook. The worm also is able to send its copies to IRC channels by infecting an mIRC client.

To spread to IRC channels, the worm creates a SCRIPT.INI mIRC system file in the mIRC directory (if it is installed).
This file contains a set of instructions that sends the worm file to everybody who enters an infected channel.

The payload routine is activated on June 20th. It disables the keyboard and mouse by modifying the following two system-registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Shut_Up = "rundll32 mouse,disable"
Shut_Up2 = "rundll32 keyboard,disable"

Use RegRun Startup Opimizer for removal.

rundll32i.exe
Rundll32i.exe is Trojan/Backdoor.
Kill the process rundll32i.exe and remove rundll32i.exe from Windows startup.

rundll64.exe
Worm / Mail trojan / Destructive trojan
When executed, the worm it pretends to hving problems with unpacking itself. On the 31st of everymonth the trojan tries to delete the C:\ drive.

rundll95.exe
Remote Access / FTP server
It installes a hidden FTP server on the victim´s computer.

rundlll32.exe
rundlll32.exe is a Trojan W32.Drivus.A.
rundlll32.exe spreads via open network shares.
Related files:
%System%\ cmdLine.exe
%Windir%windowsupdate.exe
%Windir%winlogon.exe
%Windir%netservice.exe
%Windir%rundlll32.exe
%Windir%scvhost.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill rundlll32.exe process and remove rundlll32.exe from Windows startup using RegRun Startup Optimizer.

rundllw.exe
Worm W32/Dumaru.j@MM.
You are infected by e-mail when you clicked on the attached file.
This worm constructs messages using its own SMTP engine.
Target e-mail addresses are extracted from files on your computer.
A password-stealing trojan is also dropped by the worm:
%WinDir%\GUID32.DLL (4096 bytes)
WinDir is the "c:\windows" on default.
Removal:
Delete the next files:
%WinDir%\DLLREG.EXE
%SysDir%\LOAD32.EXE
%SysDir%\VXDMGR32.EXE
%WinDir%\Start Menu\Programs\Startup\RUNDLLW.EXE

Sysdir is the Windows\System or Windows\System32 folder.

Remove these files from startup.

Read more:
http://vil.nai.com/vil/content/Print1006...

runer.exe
Runer.exe is W32.Mysamurai.
W32.Mysamurai is a worm that spreads by copying itself to shared drives.
Related files:
%Temp%\[TEMP NAME].tmp
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
%User Profile%\Start Menu\Programs\Startup\AdobeGama.pif
C:\System Volume Information\_Resto~1\htSystem.cfg
%Windir%\explore.exe
%System%\CommandPrompt.Sysm
%System%\NvMedia.sysm
%System%\Restoration.msd
%System%\Windows 3D.scr
%System%\odbcad32.dll
%System%\shareNet.msd
%System%\Ngsys.exe
%System%\runer.exe
%System%\rvshost.exe
%System%\system31.exe
%System%\userint.exe
%System%\windxp.exe
%System%\winzipt.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process runer.exe and remove runer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

runl32.exe
Runl32.exe is Trojan/Backdoor.
Kill the process runl32.exe and remove runl32.exe from Windows startup.

runload32.exe
Runload32.exe is Trojan/Backdoor.
Kill the process runload32.exe and remove runload32.exe from Windows startup.

runme.exe
FTP server / Downloading trojan
Downloads a second trojan and then deletes itself.

runoledb32.exe
Runoledb32.exe is Troj/Spyre-B.
Related files:
%Windir%\srpcsrv32.dll
%Windir%\txfdb32.dll
%Windir%\spoolsrv32.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process runoledb32.exe and remove runoledb32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

runowcp32.exe
RUNOWCP32.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq002a...
Kill the process RUNOWCP32.EXE and remove RUNOWCP32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

runscv32.exe
Runscv32.exe is Trojan/Backdoor.
Kill the process runscv32.exe and remove runscv32.exe from Windows startup.

runserv32.exe
Runserv32.exe is Trojan/Backdoor.
Kill the process runserv32.exe and remove runserv32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

runsvc32.exe
W32/Agobot-MP is a network worm and an IRC backdoor Trojan.
It establishes an IRC channel to a remote server to give an unauthorised access to the compromised computer.
It moves itself into the Windows system folder as RUNSVC32.EXE and creates the following registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\RunServices = runsvc32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\RunServices = runsvc32.exe

It may attempt to terminate anti-virus and other security-related processes, in addition to other viruses, worms or Trojans.
Also, may search for shared folders on a network with weak passwords and copy itself into them.
A text file named HOSTS in C:\ Most of them are antivirus sites.

Please, remove it from startup with RegRun Startup Optimizer.

runtime.sys
Runtime.sys is Trojan/Backdoor.
Kill the file runtime.sys and remove runtime.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

runtime.sys_êîïèÿ
Runtime.sys is Troj/Pushdo-B.
Related files:
%Windows%\system32\drivers\ip6fw.sys
%Windows%\system32\drivers\netdtect.sys
%System%\drivers\runtime.sys
%System%\drivers\secdrv.sys
Read more:
http://www.sophos.com/security/analyses/...
Kill the file runtime.sys and remove runtime.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

runtime2.sys
Runtime2.sys is Trojan/Backdoor.
Kill the file runtime2.sys and remove runtime2.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

runvxd32.exe
Remote Access / Downloading trojan
Alters System.ini.

runwin95.exe
Runwin95.exe is a Spyware.AllInOne.
Runwin95.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill runwin95.exe process and remove runwin95.exe from Windows startup using RegRun Startup Optimizer.

rupxdnd.exe
Rupxdnd.exe is Trojan/Backdoor.
Kill the process rupxdnd.exe and remove rupxdnd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rutisblv.exe
RUTISBLV.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq67d9...
Kill the process RUTISBLV.EXE and remove RUTISBLV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rvhost.exe
RVHOST.exe is W32.Yautoit.N.
Related files:
%System%\new folder.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process RVHOST.exe and remove RVHOST.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rvices~1.exe
RVICES~1.EXE is Adware.ClickSpring.
Read more:
http://www.popupsentry.com/R/RVICES~1.EX...
Kill the process RVICES~1.EXE and remove RVICES~1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rvshost.exe
Rvshost.exe is W32.Mysamurai.
W32.Mysamurai is a worm that spreads by copying itself to shared drives.
Related files:
%Temp%\[TEMP NAME].tmp
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
%User Profile%\Start Menu\Programs\Startup\AdobeGama.pif
C:\System Volume Information\_Resto~1\htSystem.cfg
%Windir%\explore.exe
%System%\CommandPrompt.Sysm
%System%\NvMedia.sysm
%System%\Restoration.msd
%System%\Windows 3D.scr
%System%\odbcad32.dll
%System%\shareNet.msd
%System%\Ngsys.exe
%System%\runer.exe
%System%\rvshost.exe
%System%\system31.exe
%System%\userint.exe
%System%\windxp.exe
%System%\winzipt.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process rvshost.exe and remove rvshost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwinkpeh.exe
RWINKPEH.EXE is Trojan.VCClient.
Read more:
http://fileinfo.prevx.com/spyware/qq894e...
Kill the process RWINKPEH.EXE and remove RWINKPEH.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwinmmdt.exe
RWINMMDT.EXE is Trojan/Backdoor.
Kill the process RWINMMDT.EXE and remove RWINMMDT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwinpoeg.exe
RWINPOEG.EXE is Malware.
Read more:
http://fileinfo.prevx.com/spyware/qq3fb2...
Kill the process RWINPOEG.EXE and remove RWINPOEG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwinpped.exe
RWINPPED.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qqd8ef...
Kill the process RWINPPED.EXE and remove RWINPPED.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwinrpex.exe
RWINRPEX.EXE is Trojan/Backdoor.
Kill the process RWINRPEX.EXE and remove RWINRPEX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

rwnt.exe
Rwnt.exe is Backdoor.Win32.Rbot.gen.
Read more:
http://info.ahnlab.com/securityinfo/viru...
Kill the process rwnt.exe and remove rwnt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rxbot.exe
rxBot.exe is a worm W32.Kelvir.W.
rxBot.exe spreads by MSN Messenger and via open network shares .
rxBot.exe tries to terminate antiviral programs installed on a user computer.
rxBot.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\ACS-Style\rxBot.exe
%ProgramFiles%\ACS-Style\acs.exe
%system%\winsystem32xp.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill rxBot.exe process and remove rxBot.exe from Windows startup using RegRun Startup Optimizer.

rxx5ot.dll
Rxx5ot.dll is Haxdoor.Fam.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file rxx5ot.dll and remove rxx5ot.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

rxzs.exe
Rxzs.exe is Frethog BH Trojan.
Related files:
rxzs.dll
rxzs.exe
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process rxzs.exe and remove rxzs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ryg.exe
Ryg.exe is Trojan/Backdoor.
Kill the process ryg.exe and remove ryg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

rzbvwset.exe
RZBVWSET.EXE is Trojan.URDVXC.
Read more:
http://fileinfo.prevx.com/spyware/qqc83d...
Kill the process RZBVWSET.EXE and remove RZBVWSET.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com


Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous

Copyright © 1998-2010 Greatis Software