Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

12.0.122.172 5.00%
11.0.6300.541 5.00%
11.0.6200.513 15.00%
11.0.6100.463 5.00%
11.0.6070.422 25.00%
11.0.5002.290 5.00%
11.0.4010.14 5.00%
11.0.4000.2263 5.00%
11.0.3001.2198 5.00%
11.0.777.1008 5.00%
10.2.0.276 5.00%
10.1.9.9000 5.00%
10.1.6.6000 5.00%
10.0.0.846 5.00%

Relationships

PE structurePE file structure
Show functions
Import table
advapi32.dll
RevertToSelf, ImpersonateLoggedOnUser, DuplicateTokenEx, CheckTokenMembership, SetTokenInformation, GetSecurityInfo, MapGenericMask, GetFileSecurityW, AccessCheck, RegCreateKeyW, OpenSCManagerA, QueryServiceConfigA, LsaQueryInformationPolicy, LsaNtStatusToWinError, LsaFreeMemory, LsaClose, LsaOpenPolicy, RegDeleteKeyW, SetNamedSecurityInfoA, GetNamedSecurityInfoA, SetEntriesInAclA, RegQueryValueExW, LookupAccountSidA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerExA, GetUserNameA, SetServiceStatus, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, RegLoadKeyA, RegUnLoadKeyA, ReportEventA, GetTokenInformation, GetSidIdentifierAuthority, GetSidSubAuthorityCount, GetSidSubAuthority, EqualSid, ControlService, QueryServiceStatus, ChangeServiceConfigA, StartServiceA, OpenServiceA, CloseServiceHandle, GetAce, SetFileSecurityA, ImpersonateSelf, IsValidSid, LookupAccountNameA, DeregisterEventSource, RegisterEventSourceA, CopySid, OpenProcessToken, OpenThreadToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegEnumValueA, RegEnumKeyA, RegEnumKeyExW, RegOpenKeyW, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptGenRandom, CryptAcquireContextA, CryptDestroyHash, CryptReleaseContext, RegCreateKeyA, RegSetValueA, RegEnumValueW, RegOpenKeyExW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExA, GetAclInformation, DeleteAce, GetLengthSid, InitializeAcl, AddAccessDeniedAce, AddAccessAllowedAce, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, IsValidSecurityDescriptor, FreeSid, AllocateAndInitializeSid, RegNotifyChangeKeyValue, RegQueryInfoKeyA, RegSetValueExA, RegCreateKeyExA, RegDeleteValueA, RegDeleteKeyA, RegOpenKeyExA, RegEnumKeyExA, RegOpenKeyA, RegCloseKey, RegFlushKey, RegisterServiceCtrlHandlerA, CreateServiceA
crypt32.dll
CryptProtectData, CryptUnprotectData
i2ldvp3.dll
VEGetCurrentDefPath, VELoadPatternFile, VEInit, VEGetInfo, VEDeInit, VEFreePatternFiles, VEGetSignatureVirusCount, VEDecomposerInit, VEEnumSignatures, VEGetScanner
iphlpapi.dll
NotifyRouteChange, NotifyAddrChange
kernel32.dll
DllMain
mpr.dll
WNetGetUniversalNameW
msvcp71.dll
DllMain
msvcp80.dll
DllMain
msvcr71.dll
DllMain
msvcr80.dll
DllMain
navlu.dll
_DoLiveUpdate@12
netapi32.dll
NetApiBufferFree, NetMessageBufferSend, NetSessionEnum, NetWkstaGetInfo, Netbios
ole32.dll
CoInitializeEx, CoUninitialize, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, CoCreateGuid, OleRun, CoCreateInstance, CoDisconnectObject, CoInitialize, StringFromGUID2, CoRevokeClassObject, CoRegisterClassObject, CoSuspendClassObjects, CoResumeClassObjects, CoInitializeSecurity, CoFreeUnusedLibraries, StringFromCLSID, CreateBindCtx, CLSIDFromString, OleSaveToStream, GetHGlobalFromStream, CreateStreamOnHGlobal, OleLoadFromStream
pdh.dll
PdhCloseQuery, PdhRemoveCounter, PdhCollectQueryData, PdhAddCounterA, PdhValidatePathA, PdhOpenQueryA, PdhEnumObjectItemsA, PdhGetFormattedCounterValue
psapi.dll
EnumProcessModules, GetModuleBaseNameA, EnumProcesses, GetProcessMemoryInfo, GetModuleInformation
rpcrt4.dll
RpcStringFreeA, UuidToStringA, UuidCreate
secur32.dll
LsaFreeReturnBuffer, LsaGetLogonSessionData
shell32.dll
SHGetFolderPathA, SHGetSpecialFolderPathA, SHGetMalloc, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, SHCreateDirectoryExA
shlwapi.dll
SHDeleteKeyA, PathAddBackslashA, PathRemoveBackslashA
urlmon.dll
MkParseDisplayNameEx
user32.dll
CharUpperA, CharNextA, LoadStringA, DispatchMessageA, TranslateMessage, UnregisterClassA, PeekMessageA, PostThreadMessageA, SendMessageTimeoutA, SendMessageA, CharUpperW, wsprintfA, CharNextW, MessageBoxA, GetSystemMetrics, MsgWaitForMultipleObjects, CharPrevA, FindWindowA, IsWindow, DestroyWindow, DefWindowProcA, PostQuitMessage, GetMessageA, ShowWindow, CreateWindowExA, RegisterClassA, LoadCursorA, MsgWaitForMultipleObjectsEx, IsWindowUnicode, GetMessageW, DispatchMessageW, CharToOemA, GetSystemMenu, EnableMenuItem, PostMessageA, IsCharAlphaNumericA
userenv.dll
GetProfilesDirectoryA
version.dll
VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW, GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
wtsapi32.dll
WTSFreeMemory, WTSQuerySessionInformationA, WTSEnumerateSessionsA, WTSSendMessageA
Export table
SymSVM_ClientDataStruct
SymSVM_ScanControlStruct
SymSVM_VMEnvironmentInfo

RTVScan.exe

Symantec AntiVirus by Symantec Corporation (Signed)

Remove RTVScan.exe
Version:   11.0.777.1008
MD5:   4953eb254d217d8ccff0912e642807cd
SHA1:   ca47d7d646734a65ff47f582622e4ca4b04c1a49

Overview

rtvscan.exe runs as a service under the name Symantec Endpoint Protection (Symantec AntiVirus) with extensive SYSTEM privileges (full administrator access). This is typically installed with the program Symantec Endpoint Protection published by Symantec Corporation. The file is digitally signed by Symantec Corporation which was issued by the VeriSign certificate authority (CA).

DetailsDetails

File name:rtvscan.exe
Publisher:Symantec Corporation
Product name:Symantec AntiVirus
Typical file path:C:\Program Files\symantec client security\symantec antivirus\rtvscan.exe
File version:11.0.777.1008
Size:2.08 MB (2,177,464 bytes)
Build date:9/6/2007 4:46 AM
Certificate
Issued to:Symantec Corporation
Authority (CA):VeriSign
Effective date:Tuesday, October 30, 2007
Expiration date:Wednesday, November 24, 2010
Digital DNA
PE subsystem:Windows Console
File packed:No
Code language:Microsoft Visual C++ 8.0
.NET CLR:No
More details

ResourcesPrograms

The following program will install this file
Symantec Endpoint Protection
 Symantec Corporation
9% remove
“Customers have embraced Symantec Endpoint Protection 12 faster than any previous release. In Symantec Endpoint Protection 12.1.2, we've worked hard to further the Unrivaled Security, Blazing Performance and support for Virtual Environments. By layering technologies like Insight and SONAR, antivirus scans are reduced and maximum performance is achieved while stopping cyber-criminals and even zero-day threats in their tracks. Endpoint pro...”

BehaviorsBehaviors

Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'Symantec AntiVirus'

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00036428%
0.028634%
Kernel CPU:0.00020769%
0.013761%
User CPU:0.00015659%
0.014873%
Kernel CPU time:3,183,938 ms/min
100,923,805ms/min
Context switches:34/sec
284/sec
Memory
Private memory:74.35 MB
21.59 MB
Private (maximum):349.14 MB
Private (minimum):748 KB
Non-paged memory:74.35 MB
21.59 MB
Virtual memory:582.32 MB
140.96 MB
Virtual memory (peak):899.84 MB
169.69 MB
Working set:2.91 MB
18.61 MB
Working set (peak):357.95 MB
37.95 MB
Page faults:94,787,912/min
2,039/min
I/O
I/O read transfer:146.59 MB/sec
1.02 MB/min
I/O read operations:45,054/sec
343/min
I/O write transfer:5.07 MB/sec
274.99 KB/min
I/O write operations:658/sec
227/min
I/O other transfer:1.51 MB/sec
448.09 KB/min
I/O other operations:16,114/sec
1,671/min
Resource allocations
Threads:53
12
Handles:806
600
GUI GDI count:4
103
GUI USER count:2
49

BehaviorsProcess properties

Integrety level:Undefined
Platform:32-bit
Command line:"C:\Program Files\symantec antivirus\rtvscan.exe"
Owner:SYSTEM
Windows Service
Service name:Symantec AntiVirus
Display name:Symantec Endpoint Protection
Description:“Provides real-time virus scanning, reporting, and management functionality for Symantec AntiVirus.”
Type:Win32OwnProcess, InteractiveProcess
Parent process:services.exe (Services and Controller app by Microsoft)

ResourcesThreads

Averages
 
MSVCR80.dll
Total CPU:0.23886104%
0.272967%
Kernel CPU:0.05917327%
0.107585%
User CPU:0.17968777%
0.165382%
Context switches:2/sec
79/sec
Memory:620 KB
1.16 MB
ADVAPI32.dll
Total CPU:0.00635142%
Kernel CPU:0.00258140%
User CPU:0.00377002%
Memory:620 KB
Rtvscan.exe (main module)
Total CPU:0.00017506%
Kernel CPU:0.00016533%
User CPU:0.00000973%
Memory:2.79 MB
xpsp2res.dll
Total CPU:0.00011184%
Kernel CPU:0.00003890%
User CPU:0.00007294%
Context switches:1/sec
Memory:2.77 MB
cceraser.dll (ERASER ENGINE by Symantec)
Total CPU:0.00004813%
Kernel CPU:0.00004813%
User CPU:0.00000000%
Memory:2.89 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Microsoft Windows XP 47.37%
Windows 7 Home Premium 26.32%
Windows 7 Enterprise 10.53%
Windows Vista Home Premium 5.26%
Windows Vista Ultimate 5.26%
Windows 7 Professional 5.26%

Distribution by countryDistribution by country

United States installs about 57.89% of Symantec AntiVirus.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 47.62%
Hewlett-Packard 23.81%
Lenovo 19.05%
Intel 9.52%
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE