| Line: |
Status: |
Comments: |
Actions: |
C:\WINDOWS\System32\smss.exe More info about file smss.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\winlogon.exe More info about file winlogon.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\services.exe More info about file services.exe |
Legitimate |
In most of cases it is legitimate system process, only sometimes can be used by malicious software |
Change status |
C:\WINDOWS\system32\lsass.exe More info about file lsass.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\System32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe More info about file ccevtmgr.exe |
Legitimate |
Item found in 2-spyware.com library ccEvtMgr.exe is an event logging application and runs at startup. It monitors virus alerts, virus... |
Change status |
C:\WINDOWS\system32\spoolsv.exe More info about file spoolsv.exe |
Legitimate |
Process found in system process library |
Change status |
| C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\WINDOWS\VXNlcg\command.exe More info about file command.exe |
Dangerous |
Item found in 2-spyware.com library command.exe is an executable file that is responsible for launching parasites, loading main... |
Change status |
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe More info about file mdm.exe |
Legitimate |
Item found in 2-spyware.com library mdm.exe is a system process - Machine Debug Manager. Used by developers. Located in "C:\PROGRAM... |
Change status |
C:\Program Files\Norton AntiVirus\navapsvc.exe More info about file navapsvc.exe |
Legitimate |
Item found in 2-spyware.com library Norton AntiVirus application that provides auto-protection of the system. NAVAPSVC.EXE runs on... |
Change status |
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE More info about file nprotect.exe |
Legitimate |
Item found in 2-spyware.com library NPROTECT.EXE is part of Norton Antivirus. NPROTECT.EXE is located in "C:\PROGRAM FILES\NORTON... |
Change status |
C:\WINDOWS\system32\nvsvc32.exe More info about file nvsvc32.exe |
Legitimate |
Item found in 2-spyware.com library NVIDIA related software. nvsvc32.exe is an executable file that is responsible for launching... |
Change status |
C:\WINDOWS\System32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe More info about file symwsc.exe |
Legitimate |
Item found in 2-spyware.com library File symwsc.exe is included in Norton Antivirus program. It runs background process, which... |
Change status |
C:\WINDOWS\Explorer.EXE More info about file explorer.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Common Files\Symantec Shared\ccApp.exe More info about file ccapp.exe |
Legitimate |
Item found in 2-spyware.com library From Symantec: "ccApp.exe is the common hosting application that is used for both NAV and NIS.... |
Change status |
C:\Program Files\Microsoft IntelliType Pro\type32.exe More info about file type32.exe |
Legitimate |
Item found in 2-spyware.com library Related to Microsoft Keyboards. Necessary if you have customized the Hot Keys. Default location is... |
Change status |
C:\Program Files\Microsoft IntelliPoint\point32.exe More info about file point32.exe |
Legitimate |
Item found in 2-spyware.com library Microsoft IntelliPoint Mouse Software. |
Change status |
C:\Program Files\iTunes\iTunesHelper.exe More info about file ituneshelper.exe |
Legitimate |
Item found in 2-spyware.com library Related to Apple's iTunes for Windows. Located in "C:\Program Files\iTunes\". |
Change status |
C:\WINDOWS\system32\devldr32.exe More info about file devldr32.exe |
Legitimate |
Item found in 2-spyware.com library File devldr32.exe, started by an executable with the same name, is a standard component of the... |
Change status |
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe More info about file apdproxy.exe |
Legitimate |
Item found in 2-spyware.com library The file is related to Adobe Photoshop Album software. |
Change status |
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe More info about file jusched.exe |
Legitimate |
Item found in 2-spyware.com library Checks if there are new versions of Java available. |
Change status |
| C:\Program Files\Network\ipnetwork.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\WINDOWS\system32\RUNDLL32.EXE More info about file rundll32.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\ctfmon.exe More info about file ctfmon.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Common Files\VCClient\VCMain.exe More info about file vcmain.exe |
Dangerous |
Item found in 2-spyware.com library Related to VCClient adware program, which shows popups and other advertisements. |
Change status |
C:\Program Files\Common Files\Windows\services32.exe More info about file services32.exe |
Dangerous |
Item found in 2-spyware.com library services32.exe is an executable file which primary purpose is to start a parasite or launch some of... |
Change status |
C:\Program Files\iPod\bin\iPodService.exe More info about file ipodservice.exe |
Legitimate |
Item found in 2-spyware.com library This is a legitimate component of iTunes music program. It offers wide range of music playing and... |
Change status |
| C:\Program Files\iTunes\iTunes.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\Program Files\Internet Explorer\iexplore.exe More info about file iexplore.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Internet Explorer\iexplore.exe More info about file iexplore.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Messenger\msmsgs.exe More info about file msmsgs.exe |
Legitimate |
Item found in 2-spyware.com library Windows Messenger from Microsoft. Located in "C:\Program Files\Messenger\". If you don't use... |
Change status |
C:\Documents and Settings\User\Desktop\HijackThis.exe More info about file hijackthis.exe |
Legitimate |
Item found in 2-spyware.com library This is the main component of HijackThis security application, designed to perform system scans and... |
Change status |
| R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com |
Not necessary |
http://searchbar.findthewebsiteyouneed.com is your Default Search URL. If you do not like this fact, fix this item. |
Change status |
| R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com |
Not necessary |
http://searchbar.findthewebsiteyouneed.com is your Search Bar. If you do not like this fact, fix this item. |
Change status |
| R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com |
Not necessary |
http://searchbar.findthewebsiteyouneed.com is your Search Page. If you do not like this fact, fix this item. |
Change status |
| R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/ |
Not necessary |
http://google.co.uk/ is your start page. If you do not like this fact, fix this item. |
Change status |
| R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com |
Not necessary |
http://searchbar.findthewebsiteyouneed.com is your Search Page. If you do not like this fact, fix this item. |
Change status |
| R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = |
Not necessary |
Fix this item because it points to nowhere |
Change status |
| R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file) |
Not necessary |
Fix this item because it points to a file that cannot be found |
Change status |
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll More info about file navshext.dll |
Legitimate |
Application program item according to inner database Component of Norton Anti-virus. Located in "C:\Program Files\Norton AntiVirus\". Uses... |
Change status
|
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe More info about file ccapp.exe |
Legitimate |
System item according to inner database From Symantec: <i>"ccApp.exe is the common hosting application that is used for both NAV and NIS.... |
Change status
|
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe More info about file ccregvfy.exe |
Legitimate |
Application program item according to inner database ccRegVfy.exe is responsible for checking the integrity of the Norton product registry entries to... |
Change status
|
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE More info about file advchk.exe |
Legitimate |
Application program item according to inner database Warns you when you install a new version of a Norton product and did not uninstall all previous... |
Change status
|
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer More info about file sndmon.exe |
Legitimate |
Application program item according to inner database This is the main part of LiveUpdate tool, published by Symantec. It is required to update all... |
Change status
|
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" More info about file type32.exe |
Legitimate |
System item according to inner database Related to Microsoft Keyboards. Necessary if you have customized the Hot Keys. Default location is... |
Change status
|
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" More info about file point32.exe |
Legitimate |
System item according to inner database Microsoft IntelliPoint Mouse Software. |
Change status
|
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" More info about file ituneshelper.exe |
Legitimate |
Application program item according to inner database Related to Apple's iTunes for Windows. Located in "C:\Program Files\iTunes\". |
Change status
|
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime More info about file qttask.exe |
Legitimate |
Application program item according to inner database Provides system tray access to Apple's Quicktime Player. Located in "C:\Program Files\QuickTime\".... |
Change status
|
| O4 - HKLM\..\Run: [Glass2k] C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\5RVJTXGE\Glass2k[1].exe |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto More info about file winupdates.exe |
Dangerous |
Spyware related item according to inner database winupdates.exe is a process associated with the Rbot Worm |
Change status
|
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" More info about file apdproxy.exe |
Legitimate |
Application program item according to inner database The file is related to Adobe Photoshop Album software. |
Change status
|
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe More info about file jusched.exe |
Legitimate |
Application program item according to inner database Checks if there are new versions of Java available. |
Change status
|
| O4 - HKLM\..\Run: [winsysupd] c:\\winsysupd12.exe |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKLM\..\Run: [gimmygames] c:\\gimmygames12.exe |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup More info about file nvcpl.dll |
Legitimate |
System item according to inner database Related to nVidia cards. NvCpl.dll is located in "C:\WINDOWS\SYSTEM\" on Windows 95/98/ME,... |
Change status
|
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install More info about file nwiz.exe |
Legitimate |
System item according to inner database Nwiz.exe is Related to nVidia graphic cards drivers.
Long name - NVIDIA nView Wizard.<br... |
Change status
|
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit More info about file nvmctray.dll |
Legitimate |
System item according to inner database nVidia graphics cards related. NVMCTRAY.DLL is located in "C:\WINDOWS\SYSTEM\" on Windows 95/98/ME,... |
Change status
|
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe More info about file ctfmon.exe |
Legitimate |
Application program item according to inner database When you run a Microsoft Office XP or Microsoft Office 2003 program, the file Ctfmon.exe (Ctfmon)... |
Change status
|
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background More info about file msnmsgr.exe |
Legitimate |
System item according to inner database Microsoft Windows Messenger chat client. |
Change status
|
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe More info about file vcclient.exe |
Dangerous |
Spyware related item according to inner database Related to VCClient adware program, which shows popups and other advertisements. |
Change status
|
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe More info about file vcmain.exe |
Dangerous |
Spyware related item according to inner database Related to VCClient adware program, which shows popups and other advertisements. |
Change status
|
| O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000228.exe |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKCU\..\Run: [zrmk] C:\PROGRA~1\COMMON~1\zrmk\zrmkm.exe |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent More info about file steam.exe |
Legitimate |
Application program item according to inner database This file is a part of application that comes with most games, published by Valve Corporation. It... |
Change status
|
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe More info about file adobe gamma loader.exe |
Legitimate |
Application program item according to inner database From adobe: "The Adobe Gamma Control Panel is used to eliminate color casts in a monitor's display.... |
Change status
|
| O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe |
Unknown |
No exact entries found |
Insert file into database
|
| O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe |
Not necessary |
This item represents extra button in your IE toolbar with a name 'Messenger' and points to file 'C:\Program Files\Messenger\msmsgs.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe |
Not necessary |
This item represents extra menu item in your Tools menu in IE with a name 'Windows Messenger' and points to file 'C:\Program Files\Messenger\msmsgs.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab |
Questionable |
Are you using an ActiveX object with a name 'Creative Software AutoUpdate' located in 'http://www.creative.com/su/ocx/15026/CTSUEng.cab'? If not, fix this item. |
Change status
|
| O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmasterexe/drsmartload192a.exe |
Questionable |
Are you using an ActiveX object with no name located in 'http://promo.dollarrevenue.com/webmasterexe/drsmartload192a.exe'? If not, fix this item. |
Change status
|
| O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab |
Questionable |
Are you using an ActiveX object with a name 'MediaGatewayX' located in 'http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab'? If not, fix this item. |
Change status
|
| O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab |
Questionable |
Are you using an ActiveX object with a name 'Creative Software AutoUpdate Support Package' located in 'http://www.creative.com/su/ocx/15026/CTPID.cab'? If not, fix this item. |
Change status
|
| O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) |
Not necessary |
It is a protocol hijacker that points to nowhere. Fix this item. |
Change status
|
| O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe |
Legitimate |
Required for PhotoshopCS |
Change status
|
| O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe |
Unknown |
No exact entries found |
Insert file into database
|
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe More info about file ccevtmgr.exe |
Legitimate |
Item found in 2-spyware.com database. ccEvtMgr.exe is an event logging application and runs at startup. It monitors virus alerts, virus... |
Change status
|
| O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe |
Legitimate |
Runs Common Client Password Validation Service on every Windows startup. Used by legitimate Symantec software. |
Insert file into database
|
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VXNlcg\command.exe More info about file command.exe |
Dangerous |
Item found in 2-spyware.com database. command.exe is an executable file that is responsible for launching parasites, loading main... |
Change status
|
| O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe |
Legitimate |
Related to Macrovision Corporation. |
Change status
|
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe More info about file ipodservice.exe |
Legitimate |
Item found in 2-spyware.com database. This is a legitimate component of iTunes music program. It offers wide range of music playing and... |
Change status
|
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe More info about file navapsvc.exe |
Legitimate |
Item found in 2-spyware.com database. Norton AntiVirus application that provides auto-protection of the system. NAVAPSVC.EXE runs on... |
Change status
|
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE More info about file nprotect.exe |
Legitimate |
Item found in 2-spyware.com database. NPROTECT.EXE is part of Norton Antivirus. NPROTECT.EXE is located in "C:\PROGRAM FILES\NORTON... |
Change status
|
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe More info about file nvsvc32.exe |
Legitimate |
Item found in 2-spyware.com database. NVIDIA related software. nvsvc32.exe is an executable file that is responsible for launching... |
Change status
|
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe More info about file sbserv.exe |
Legitimate |
Item found in 2-spyware.com database. Part of Norton Anti-virus. SBServ.exe is located in "C:\Program Files\Common Files\Symantec... |
Change status
|
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe More info about file sndsrvc.exe |
Legitimate |
Item found in 2-spyware.com database. This is a part of Norton Internet Security and Norton Personal Firewall applications. It runs... |
Change status
|
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe More info about file symwsc.exe |
Legitimate |
Item found in 2-spyware.com database. File symwsc.exe is included in Norton Antivirus program. It runs background process, which... |
Change status
|