| Line: |
Status: |
Comments: |
Actions: |
C:\WINDOWS\System32\smss.exe More info about file smss.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\winlogon.exe More info about file winlogon.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\services.exe More info about file services.exe |
Legitimate |
In most of cases it is legitimate system process, only sometimes can be used by malicious software |
Change status |
C:\WINDOWS\system32\lsass.exe More info about file lsass.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\System32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\spoolsv.exe More info about file spoolsv.exe |
Legitimate |
Process found in system process library |
Change status |
| C:\Acer\eManager\anbmServ.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\ZONELABS\vsmon.exe More info about file vsmon.exe |
Legitimate |
Item found in 2-spyware.com library Related to the ZoneAlarm firewall from ZoneLabs. Located in "C:\WINDOWS\SYSTEM\ZONELABS\". |
Change status |
| C:\WINDOWS\system32\windowsautomaticupdates.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\WINDOWS\Explorer.EXE More info about file explorer.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\igfxtray.exe More info about file igfxtray.exe |
Legitimate |
Item found in 2-spyware.com library From a user: I just(hours ago) installed some newer Intel graphics drivers in my system(82810E),... |
Change status |
C:\WINDOWS\system32\hkcmd.exe More info about file hkcmd.exe |
Legitimate |
Item found in 2-spyware.com library Hotkey Command Module for Intel Graphics Contollers. Located in "C:\WINNT\System32\" on Windows... |
Change status |
C:\Programme\Synaptics\SynTP\SynTPLpr.exe More info about file syntplpr.exe |
Legitimate |
Item found in 2-spyware.com library Related to Synaptics touch pads. Located in "C:\Program Files\Synaptics\SynTP\".
created by:... |
Change status |
C:\Programme\Synaptics\SynTP\SynTPEnh.exe More info about file syntpenh.exe |
Legitimate |
Item found in 2-spyware.com library System tray access for Synaptics touch pads. Located in "C:\Program Files\Synaptics\SynTP\".
Change status |
|
| C:\Programme\Launch Manager\QtZgAcer.EXE |
Unknown |
No exact entries found |
Insert file into database
|
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe More info about file jusched.exe |
Legitimate |
Item found in 2-spyware.com library Checks if there are new versions of Java available. |
Change status |
C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe More info about file acrotray.exe |
Legitimate |
Item found in 2-spyware.com library Related to Adobe Acrobat Reader program. |
Change status |
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe More info about file zlclient.exe |
Legitimate |
Item found in 2-spyware.com library ZoneAlarm Firewall http://www.zonelabs.com |
Change status |
| C:\Programme\Babylon\Babylon-Pro\Babylon.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe More info about file realsched.exe |
Legitimate |
Item found in 2-spyware.com library Related to Real-One player. Located in "C:\Program Files\Common Files\Real\Update_OB\". |
Change status |
C:\Programme\Winamp\winampa.exe More info about file winampa.exe |
Legitimate |
Item found in 2-spyware.com library System tray icon for Winamp. |
Change status |
C:\WINDOWS\system32\ctfmon.exe More info about file ctfmon.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Programme\acer\eRecovery\Monitor.exe More info about file monitor.exe |
Legitimate |
Item found in 2-spyware.com library This file is a part of Monitor - it is a legitimate tool, which works in the command line. It is... |
Change status |
| C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe |
Unknown |
No exact entries found |
Insert file into database
|
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe More info about file nmbgmonitor.exe |
Legitimate |
Item found in 2-spyware.com library file for nero cd burning |
Change status |
C:\Programme\Skype\Phone\Skype.exe More info about file skype.exe |
Legitimate |
Item found in 2-spyware.com library The file belongs to Skype application. |
Change status |
| C:\Programme\GMX\GMX Upload-Manager\DAVSRV.EXE |
Unknown |
No exact entries found |
Insert file into database
|
C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE More info about file winword.exe |
Legitimate |
Item found in 2-spyware.com library Microsoft Word, which is started by winword.exe file, is a text processing program, included in... |
Change status |
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE More info about file outlook.exe |
Questionable |
This process is usually legitimate and related to Microsoft Office. But it also might be a part of parasite, depending on its location and other factors. Make some further research on it. |
Change status |
C:\WINDOWS\System32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE More info about file firefox.exe |
Legitimate |
Item found in 2-spyware.com library File firefox.exe launches Mozilla Firefox web browser, implements user interface and controls all... |
Change status |
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe More info about file avguard.exe |
Legitimate |
Item found in 2-spyware.com library AntiVir real-time Protection process. |
Change status |
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe More info about file avgnt.exe |
Legitimate |
Item found in 2-spyware.com library Used by AntiVir Anti Virus. |
Change status |
C:\Programme\AntiVir PersonalEdition Classic\sched.exe More info about file sched.exe |
Legitimate |
Item found in 2-spyware.com library Scheduler for AntiVir Anti Virus program. |
Change status |
C:\Programme\WinRAR\WinRAR.exe More info about file winrar.exe |
Dangerous |
Item found in 2-spyware.com library winrar.exe is an executable file that starts a malicious process, launches certain parasite... |
Change status |
C:\DOKUME~1\Juerg\LOKALE~1\Temp\Rar$EX00.953\HijackThis.exe More info about file hijackthis.exe |
Legitimate |
Item found in 2-spyware.com library This is the main component of HijackThis security application, designed to perform system scans and... |
Change status |
| R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.net/de/ |
Not necessary |
http://www.gmx.net/de/ is your start page. If you do not like this fact, fix this item. |
Change status |
| R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com |
Not necessary |
http://global.acer.com is your Default Page URL. If you do not like this fact, fix this item. |
Change status |
| R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ |
Not necessary |
http://global.acer.com/ is related to your Internet Connection Wizard. If you do not like this fact, fix this item. |
Change status |
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll More info about file acroiefavclient.dll |
Legitimate |
System item according to inner database The file belongs to Adobe Acrobat to display .pdf files in Internet Explorer. |
Change status
|
| O4 - HKLM\..\Run: [LaunchApp] Alaunch |
Questionable |
HKLM - Run: [LaunchApp], file: (params - 'ch') |
Change status
|
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe More info about file igfxtray.exe |
Legitimate |
System item according to inner database From a user: I just(hours ago) installed some newer Intel graphics drivers in my system(82810E),... |
Change status
|
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe More info about file hkcmd.exe |
Legitimate |
System item according to inner database Hotkey Command Module for Intel Graphics Contollers. Located in "C:\WINNT\System32\" on Windows... |
Change status
|
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe More info about file syntplpr.exe |
Legitimate |
System item according to inner database Related to Synaptics touch pads. Located in "C:\Program Files\Synaptics\SynTP\".
created by:... |
Change status
|
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe More info about file syntpenh.exe |
Legitimate |
System item according to inner database System tray access for Synaptics touch pads. Located in "C:\Program Files\Synaptics\SynTP\".<br... |
Change status
|
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 More info about file imjpmig.exe |
Legitimate |
System item according to inner database Related to Windows East Asian language support (Japanese keyboard entry). Located in... |
Change status
|
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC More info about file tintsetp.exe |
Legitimate |
System item according to inner database Translation component from Microsoft. Located in "C:\WINDOWS\System32\IME\TINTLGNT\". |
Change status
|
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName More info about file tintsetp.exe |
Legitimate |
System item according to inner database Translation component from Microsoft. Located in "C:\WINDOWS\System32\IME\TINTLGNT\". |
Change status
|
| O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe More info about file check.exe |
Dangerous |
Spyware related item according to inner database check.exe is an executable file that starts a malicious process, launches certain parasite... |
Change status
|
| O4 - HKLM\..\Run: [LSWin LaoKey] C:\Programme\LSWin\LaoKey.exe -a |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe More info about file jusched.exe |
Legitimate |
Application program item according to inner database Checks if there are new versions of Java available. |
Change status
|
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min More info about file avgnt.exe |
Legitimate |
Application program item according to inner database Used by AntiVir Anti Virus. |
Change status
|
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" More info about file acrotray.exe |
Legitimate |
Application program item according to inner database Related to Adobe Acrobat Reader program. |
Change status
|
O4 - HKLM\..\Run: [QuickTime Task] "C:\programme\quicktime\qttask.exe" -atboottime More info about file qttask.exe |
Legitimate |
Application program item according to inner database Provides system tray access to Apple's Quicktime Player. Located in "C:\Program Files\QuickTime\".... |
Change status
|
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" More info about file zlclient.exe |
Legitimate |
System item according to inner database ZoneAlarm Firewall http://www.zonelabs.com |
Change status
|
| O4 - HKLM\..\Run: [ScanRegistry] C:\W |
Questionable |
HKLM - Run: [ScanRegistry], file: (params - '') |
Change status
|
| O4 - HKLM\..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe -AutoStart |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot More info about file realsched.exe |
Legitimate |
Application program item according to inner database Related to Real-One player. Located in "C:\Program Files\Common Files\Real\Update_OB\". |
Change status
|
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe More info about file winampa.exe |
Legitimate |
Application program item according to inner database System tray icon for Winamp. |
Change status
|
| O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvmuh.dll,startup |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKLM\..\Run: [elwwlsg.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\elwwlsg.dll,yhpsxkb |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe More info about file ctfmon.exe |
Legitimate |
Application program item according to inner database When you run a Microsoft Office XP or Microsoft Office 2003 program, the file Ctfmon.exe (Ctfmon)... |
Change status
|
| O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet |
Unknown |
No exact entries found |
Insert file into database
|
| O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash |
Unknown |
No exact entries found |
Insert file into database
|
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" More info about file nmbgmonitor.exe |
Legitimate |
Application program item according to inner database file for nero cd burning |
Change status
|
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized More info about file skype.exe |
Legitimate |
Application program item according to inner database The file belongs to Skype application. |
Change status
|
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe More info about file adobe gamma loader.exe |
Legitimate |
Application program item according to inner database From adobe: "The Adobe Gamma Control Panel is used to eliminate color casts in a monitor's display.... |
Change status
|
| O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? |
Not necessary |
Fix this item because it points to nowhere |
Change status
|
| O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html |
Not necessary |
Do you want item 'Convert link target to Adobe PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html |
Not necessary |
Do you want item 'Convert link target to existing PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html |
Not necessary |
Do you want item 'Convert selected links to Adobe PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html |
Not necessary |
Do you want item 'Convert selected links to existing PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html |
Not necessary |
Do you want item 'Convert selection to Adobe PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html |
Not necessary |
Do you want item 'Convert selection to existing PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html |
Not necessary |
Do you want item 'Convert to Adobe PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O8 - Extra context menu item: Convert to existing PDF - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html |
Not necessary |
Do you want item 'Convert to existing PDF' to appear in your internet explorer context menu when you do the right click? If you don't, fix this item. |
Change status
|
| O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll |
Not necessary |
This item represents extra button in your IE toolbar without name and points to file 'C:\Programme\Java\jre1.5.0_06\bin\ssv.dll'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra ''Tools'' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll |
Not necessary |
This item represents extra menu item in your Tools menu in IE with a name 'Sun Java Konsole' and points to file 'C:\Programme\Java\jre1.5.0_06\bin\ssv.dll'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL |
Not necessary |
This item represents extra button in your IE toolbar with a name 'Recherchieren' and points to file 'C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programme\Yahoo!\Messenger\YahooMessenger.exe |
Not necessary |
This item represents extra button in your IE toolbar with a name 'Yahoo! Messenger' and points to file 'C:\Programme\Yahoo!\Messenger\YahooMessenger.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra ''Tools'' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programme\Yahoo!\Messenger\YahooMessenger.exe |
Not necessary |
This item represents extra menu item in your Tools menu in IE with a name 'Yahoo! Messenger' and points to file 'C:\Programme\Yahoo!\Messenger\YahooMessenger.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe |
Not necessary |
This item represents extra button in your IE toolbar with a name 'Messenger' and points to file 'C:\Programme\Messenger\msmsgs.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe |
Not necessary |
This item represents extra menu item in your Tools menu in IE with a name 'Windows Messenger' and points to file 'C:\Programme\Messenger\msmsgs.exe'. If you do not want it to be there, fix this item. |
Change status
|
| O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - |
Questionable |
Are you using an ActiveX object with no name located in ''? If not, fix this item. |
Change status
|
| O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL |
Questionable |
It may be a trace of dangerous protocol hijacker or a legitimate item. Make some research about the name "livecall" and file "C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL". |
Change status
|
| O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL |
Questionable |
It may be a trace of dangerous protocol hijacker or a legitimate item. Make some research about the name "msnim" and file "C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL". |
Change status
|
| O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe |
Legitimate |
Required for PhotoshopCS |
Change status
|
| O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe |
Unknown |
No exact entries found |
Insert file into database
|
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe More info about file sched.exe |
Legitimate |
Item found in 2-spyware.com database. Scheduler for AntiVir Anti Virus... |
Change status
|
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe More info about file avguard.exe |
Legitimate |
Item found in 2-spyware.com database. AntiVir real-time Protection... |
Change status
|
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe More info about file vsmon.exe |
Legitimate |
Item found in 2-spyware.com database. Related to the ZoneAlarm firewall from ZoneLabs. Located in... |
Change status
|
| O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe |
Unknown |
No exact entries found |
Insert file into database
|