What Is rsEngineSvc and How to Remove It?

Noticing an unfamiliar process in your Task Manager, especially one that’s using a large portion of your RAM and CPU, is bound to rise some questions. Such is the case with rsEngineSvc – a process that (according to users on Reddit) can slow down the PC due to high RAM and CPU usage. Another common name for this process is “Reason Security Engine”, so if you see that one instead, know it’s the same thing. 

Most users who encounter the process aren’t sure where it comes from and what it does, which makes them worried. The truth is that rsEngineSvc is not a malicious process. It’s run by the legitimate RAV antivirus (also known as RAV Endpoint Protection). If it’s using a lot of system resources at any given moment, it’s probably because the antivirus is currently scanning your PC for malware.

If you want to learn more about this process and the program that runs it, check out the following article. At its end, we’ll also show you a removal guide that will help you uninstall the RAV antivirus in case you don’t want it on your PC.

What Is rsEngineSvc?

As mentioned, rsEngineSvc is a process run by the RAV Antivirus program. RAV AV is a security tool designed to protect your PC. In other words, if you notice the rsEngineSvc process in your Task Manager, there’s no need to worry. However, its high use of RAM and CPU during malware scans can slow down weaker computers, which is why some users may want to stop it. The way to stop this process is by uninstalling the RAV antivirus that runs it.

What Is RAV Antivirus?

RAV Antivirus is a security program developed by ReasonLabs. It is one of several security tools developed by the company, but this one is ReasonLabs’ main offering. Other ReasonLabs applications that are commonly distributed together with the RAV Antivirus are the RAV VPN and the Safer Web DNS filter. Both the company and its products are legitimate and safe.

One thing worth noting about the RAV Antivirus/RAV Endpoint Protection is that it has a free version and several paid ones. The free version is the one people usually end up with on their computers. This is because this variant of the antivirus is mainly distributed via file-bundling practices. In other words, the program is attached to the installer of another piece of software and gets installed alongside it unless the user manually deselects it in the installer. Many people don’t like this method of distribution because it leads them to install software that they don’t want. Of course, it should be said that there’s usually an option to leave out the extra software and only install the main program.

About ReasonLabs

During our research, we made sure to check ReasonLabs’ website and everything there looked in order. The company offers plenty of contact information, a detailed Privacy Policy, Product Policies, and Terms & Conditions page, as well as a rich resources section. We didn’t find too much specific technical information about its various products, but that isn’t something unusual for an antivirus website. 

The one thing that caught our attention is that we weren’t able to find a page for the free version of the RAV Antivirus (which is the one that most users get installed). We only came across a pricing page for the program’s paid variants. Other than that, there wasn’t anything unusual we noticed surrounding ReasonLabs. Therefore, we have no reason to suspect there’s anything illegitimate about this company or its software.

What Are the Users’ Complaints About the rsEngineSvc Process and the RAV Antivirus?

Other than the high CPU and RAM usage of the rsEngineSvc process and the resulting slow-downs on weaker PCs, there are several other user complaints related to this process and the program that runs it:

• Marketing pop-ups – Some users have complained that the free version of the RAV Antivirus generates pop-ups that promote its paid (Premium) version. However, when we tried the free version of the program, we didn’t see any promotional pop-ups.
• Frequent false-positives – According to Reddit users, another downside of RAV Endpoint Protection and its rsEngineSvc is that they often flag harmless files and programs as threats. This is a common flaw among antiviruses in general, but it’s still something we had to mention. However, we should also mention that in our experience with the program, we didn’t get any such false positives when we ran a full system scan.
• Incompatibility with other antiviruses – It’s common for security tools to detect one another as malware. This is because antiviruses require elevated system permissions to operate and another security tool could see this as a threat. So it’s not surprising that RAV can detect other antiviruses you have as malware. It’s also possible that another security tool could detect the rsEngineSvc process as a threat. It’s a false positive in either case. The solution here is to either whitelist all your antiviruses or leave only one installed on your PC.
• Crashes and errors – According to users on Reddit, the higher usage of CPU and RAM can cause the rsEngineSvc process to crash or hang, especially on weaker machines. If you are having this problem, you may need to quit the process by uninstalling its program. In our tests, we didn’t encounter any crashes or errors.

We should mention that some users report having difficulty with uninstalling RAV Antivirus. Reportedly, the dedicated uninstaller for RAV doesn’t always get rid of everything, so some manual cleanup might be required in some cases. When we tried to remove RAV, it was enough to follow the uninstallation steps shown on its website. However, if that isn’t enough for you, you can try the detailed removal guide we’ve provided at the end of this post.

How Does RAV Antivirus Get Installed on the Computer?

If the rsEngineSvc process is running in your Task Manager computer, but you don’t remember installing the RAV antivirus, you’ve likely installed a file bundle that contained the program. As we said above, this seems to be the most common way users get the free version of RAV on their computers. 

In theory, any program’s installer can have RAV attached to it, but several specific apps seem to be primarily responsible for distributing the antivirus. While researching the topic of how RAV Endpoint Protection and other ReasonLabs applications get distributed, we learned that it’s often bundled with the Cheat Engine program. 

Cheat Engine is a safe and legitimate software used for games as a means of debugging them. It’s common for some additional apps to be added as bonus components to its installer. Many users on Reddit and other forums report the rsEngineSvc process appeared after installing Cheat Engine. It appears ReasonLabs products are distributed via Cheat Engine.

Other types of software that often carry the RAV Antivirus and other ReasonLabs products are emulator apps for different consoles and torrent programs. Emulators like MEmu and Cemu and torrent apps like uTorrent and BitTorrent Web are common examples of software that can get this antivirus installed on your PC. Like Cheat Engine, these programs are legitimate and safe, but they often tend to have other apps attached to their installers.

There are probably many other examples of programs that have RAV bundled with them, but these are the most commonly encountered ones. To avoid getting such additional apps on your computer, it’s not necessary to avoid software like Cheat Engine, uTorrent, or MEmu. Instead, you just need to carefully look through their installers and find the custom/advanced installation options. Once there, deselect anything you don’t want to leave it out of the installation process and then proceed with the installation of the main program. 

Obviously, this doesn’t apply to apps that you aren’t sure are safe or apps that don’t give you the option to leave out any bundled items. In such cases, you should simply not proceed with the installation for the sake of your virtual safety and privacy.

How to Remove the rsEngineSvc and RAV Antivirus (Tutorial)

If the rsEngineSvc and the RAV Antivirus got installed on your computer without your (knowing) consent, the next steps will help you. The tutorial shows you how to uninstall the ReasonLabs application or any other associated processes, and stop rsEngineSvc. 

Just a friendly reminder before we begin: you take the next steps at your own discretion and risk, as per our EULA. We did our research and tried to include steps that are 100% necessary. But we can’t be held responsible if anything goes wrong while you follow the tutorial. Some of these things change over time and we can’t do the research every couple of weeks.

Step 1: Uninstall the RAV App From Apps & Features

We will start by running the uninstaller for RAV Endpoint Protection. Although it might not always get rid of everything, this is still necessary to successfully perform the next steps. Obviously, if you get lucky and all traces of the ReasonLabs application and the rsEngineSvc are gone after this, there won’t be any need to continue with the rest of the guide (though you can still do it for just in case).

1. In the Start Menu, type Apps & Features and then click the first item that appears.
2. Then type “RAV” in the search box and see if anything shows up. If there are no results, try “ReasonLabs” or only “Reason”.
3. When you find the RAV/ReasonLabs application (or applications), click on the app, select Uninstall, and follow the on-screen prompts to delete it. If you are asked to allow the program to make changes to the system, click Yes.
4. Do the same for all ReasonLabs applications that you find in the Apps & Features list.

Important!: While going through the uninstallation, be careful with any prompts that may ask you to keep some components of the app or to install something new. If you encounter any such prompt, ensure you choose the option that will delete everything related to RAV.

Video walkthrough for this step:

Step 2: Quit the rsEngineSvc Processes and Delete Its Related Data

If the rsEngineSvc process and other related processes are still running in the background even after running the uninstaller, then you must complete this next step. Here, you must manually quit the processes and delete any files and folders related to them. For this, you might need to use the help of a free program called Lock Hunter. Here are the specific actions you must take:

1. Open the Task Manager (Ctrl + Shift + Esc from your keyboard) and click on the More details button if not all processes are shown.
2. Look for rsEngineSvc and for any other processes that have “RAV”, “ReasonLabs”, or “Reason” in their names. For example, you might see a process named “Reason Security Engine” alongside or instead of rsEngineSvc. 
3. Right-click the rsEngineSvc process, select Properties, and go to the Security tab. There, click on Advanced, click Disable inheritance, and select OK on the two open windows.
4. Right-click on rsEngineSvc again, and this time select Open file location.
5. Keep the file location folder open and for a third time right-click on rsEngineSvc and click on End Task.
6. Back in the rsEngineSvc file location folder, delete everything including the folder itself. 
7. If you aren’t allowed to delete something in this folder, you’ll need to use the LockHunter tool. Download and install it now if you haven’t done that already.
8. Then right-click the file/folder that you aren’t allowed to delete and select the “What’s locking this file/folder?” button.
9. In the newly-opened window, you’ll click the “Delete it” button to remove the file/folder, but first remember the process that is locking it.
10. Now return to the Task Manager, find that process, disable its inheritance, and delete its file location folder (as shown in Steps 3-5).

This should reliably quit the rsEngineSvc process and prevent it from restarting on its own. Perform Steps 3-9 for any other processes still running in your Task Manager from the ReasonLabs developer.

Video walkthrough for this step:

How to Delete Persistent Files with Lock Hunter

Step 3: Restore Your System’s Settings

The RAV Antivirus/RAV Endpoint Security has most likely made certain changes to some of your system settings that may still be in power even after uninstalling the program and quitting its process. It is recommended to manually check for and revoke any such changes:

1. Back in the Task Manager, check the Startup tab for any RAV/ReasonLabs entries. If you find any, select them and then select Disable in the bottom-right corner of the window.
2. Next, type Task Scheduler in the Start Menu search bar, and press Enter.
3. In the next window, select the Task Scheduler Library folder (top-right), and look at the listed entries.
4. If you see an RAV/ReasoLabs item, right-click it, and select the Delete option.
5. Finally, back in the Start Menu, search for regedit, right-click it, click Open as Administrator, and click Yes.
6. Then press Ctrl + F and search for “RAV”. If such an entry is found, delete it and repeat the search to look for more.
7. Once you’ve deleted all search results for “RAV”, repeat Step 6 when searching for “ReasonLabs”.

After you’ve deleted all Startup items, scheduled tasks, and Registry entries linked to the RAV Antivirus/RAV Endpoint Protection, rsEngineSvc should no longer be running.

Video walkthrough for this step:

How to Clear Your System Registry