| Line: |
Status: |
Comments: |
Actions: |
C:\WINDOWS\System32\smss.exe More info about file smss.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\winlogon.exe More info about file winlogon.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\services.exe More info about file services.exe |
Legitimate |
In most of cases it is legitimate system process, only sometimes can be used by malicious software |
Change status |
C:\WINDOWS\system32\lsass.exe More info about file lsass.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\Ati2evxx.exe More info about file ati2evxx.exe |
Legitimate |
Item found in 2-spyware.com library File ati2evxx.exe, which starts a process with the same name, is the standard component of video... |
Change status |
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Windows Defender\MsMpEng.exe More info about file msmpeng.exe |
Legitimate |
Item found in 2-spyware.com library Related to Windows Defender program. |
Change status |
C:\WINDOWS\System32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe More info about file ccsetmgr.exe |
Legitimate |
Item found in 2-spyware.com library An essential component of security-related Symantec software such as Norton AntiVirus and Norton... |
Change status |
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe More info about file spbbcsvc.exe |
Legitimate |
Item found in 2-spyware.com library Essential component of Symantec's Norton Internet Security suite. |
Change status |
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe More info about file ccevtmgr.exe |
Legitimate |
Item found in 2-spyware.com library ccEvtMgr.exe is an event logging application and runs at startup. It monitors virus alerts, virus... |
Change status |
C:\WINDOWS\system32\spoolsv.exe More info about file spoolsv.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe More info about file aluschedulersvc.exe |
Legitimate |
Item found in 2-spyware.com library Related to Symantec anti-virus software. |
Change status |
C:\Program Files\Norton AntiVirus\navapsvc.exe More info about file navapsvc.exe |
Legitimate |
Item found in 2-spyware.com library Norton AntiVirus application that provides auto-protection of the system. NAVAPSVC.EXE runs on... |
Change status |
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\iPod\bin\iPodService.exe More info about file ipodservice.exe |
Legitimate |
Item found in 2-spyware.com library This is a legitimate component of iTunes music program. It offers wide range of music playing and... |
Change status |
C:\WINDOWS\system32\svchost.exe More info about file svchost.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\wuauclt.exe More info about file wuauclt.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\system32\Ati2evxx.exe More info about file ati2evxx.exe |
Legitimate |
Item found in 2-spyware.com library File ati2evxx.exe, which starts a process with the same name, is the standard component of video... |
Change status |
C:\WINDOWS\Explorer.EXE More info about file explorer.exe |
Legitimate |
Process found in system process library |
Change status |
C:\WINDOWS\AGRSMMSG.exe More info about file agrsmmsg.exe |
Legitimate |
Item found in 2-spyware.com library Modem software from Agere.com. AGRSMMSG.exe is located in "C:\WINDOWS\" on Windows 95/98/ME/XP and... |
Change status |
C:\WINDOWS\Dit.exe More info about file dit.exe |
Legitimate |
Item found in 2-spyware.com library Drive Icon and Label utility, represented by running dit.exe file, is a specific component of the... |
Change status |
C:\WINDOWS\system32\RunDll32.exe More info about file rundll32.exe |
Legitimate |
Process found in system process library |
Change status |
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe More info about file pcmservice.exe |
Legitimate |
Item found in 2-spyware.com library From Dell: "The Dell Media Experience (DME) will ship on selected Dimension and Inspiron systems... |
Change status |
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe More info about file mmtask.exe |
Legitimate |
Item found in 2-spyware.com library Part of the Music Match Jukebox. Located in "C:\Program Files\MusicMatch\MusicMatch Jukebox\". A... |
Change status |
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe More info about file atiptaxx.exe |
Legitimate |
Item found in 2-spyware.com library ATI Desktop Control Panel from ATI Technologies, Inc. Located in "C:\Program Files\ATI... |
Change status |
C:\WINDOWS\mHotkey.exe More info about file mhotkey.exe |
Legitimate |
Item found in 2-spyware.com library The file is related to Chicony keyboard application. |
Change status |
C:\WINDOWS\CNYHKey.exe More info about file cnyhkey.exe |
Legitimate |
Item found in 2-spyware.com library The file is related to Chicony keyboard application. |
Change status |
C:\Program Files\Common Files\Symantec Shared\ccApp.exe More info about file ccapp.exe |
Legitimate |
Item found in 2-spyware.com library From Symantec: "ccApp.exe is the common hosting application that is used for both NAV and NIS.... |
Change status |
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe More info about file hpwuschd2.exe |
Legitimate |
Item found in 2-spyware.com library The file is related to Hewlett Packard software. |
Change status |
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe More info about file hpcmpmgr.exe |
Legitimate |
Item found in 2-spyware.com library File hpcmpmgr.exe is a part of Hewlett-Packard Component Manager tool, which comes preinstalled on... |
Change status |
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe More info about file jusched.exe |
Legitimate |
Item found in 2-spyware.com library Checks if there are new versions of Java available. |
Change status |
C:\Program Files\Windows Defender\MSASCui.exe More info about file msascui.exe |
Legitimate |
Item found in 2-spyware.com library The file is component of Microsoft Windows Defender application. |
Change status |
C:\Program Files\iTunes\iTunesHelper.exe More info about file ituneshelper.exe |
Legitimate |
Item found in 2-spyware.com library Related to Apple's iTunes for Windows. Located in "C:\Program Files\iTunes\". |
Change status |
C:\Program Files\MSN Messenger\MsnMsgr.Exe More info about file msnmsgr.exe |
Legitimate |
Item found in 2-spyware.com library Microsoft Windows Messenger chat client. |
Change status |
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe More info about file hpqtra08.exe |
Legitimate |
Item found in 2-spyware.com library This is a legitimate component of Hewlett-Packard device drivers. It is also included in other HP... |
Change status |
C:\Program Files\Common Files\Symantec Shared\NMain.exe More info about file nmain.exe |
Legitimate |
Item found in 2-spyware.com library Executable nmain.exe is related to Norton Internet Security. It is used by the program to scan... |
Change status |
C:\Program Files\Symantec\LiveUpdate\LUALL.EXE More info about file luall.exe |
Legitimate |
Item found in 2-spyware.com library This is the main part of LiveUpdate tool, published by Symantec. It is required to update all... |
Change status |
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE More info about file lucoms~1.exe |
Legitimate |
Item found in 2-spyware.com library The file belongs to Symantecs Internet security suite application. |
Change status |
C:\WINDOWS\system32\msiexec.exe More info about file msiexec.exe |
Legitimate |
Item found in 2-spyware.com library This file is related to Microsoft Windows Installer - it is a system component, used to handle MSI... |
Change status |
C:\Program Files\Messenger\msmsgs.exe More info about file msmsgs.exe |
Legitimate |
Item found in 2-spyware.com library Windows Messenger from Microsoft. Located in "C:\Program Files\Messenger\". If you don't use... |
Change status |
C:\DOCUME~1\andrew\LOCALS~1\Temp\Temporary Directory 17 for hijackthis.zip\HijackThis.exe More info about file hijackthis.exe |
Legitimate |
Item found in 2-spyware.com library This is the main component of HijackThis security application, designed to perform system scans and... |
Change status |
| R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ |
Legitimate |
http://www.google.co.uk/ is your start page. This is a legitimate page. |
Change status |
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll More info about file acroiehelper.dll |
Legitimate |
Application program item according to inner database File related to Adobe Acrobat Reader program. |
Change status
|
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll More info about file ssv.dll |
Legitimate |
System item according to inner database Related to Java Virtual Machine software, which is legitimate. |
Change status
|
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll More info about file navshext.dll |
Legitimate |
Application program item according to inner database Component of Norton Anti-virus. Located in "C:\Program Files\Norton AntiVirus\". Uses... |
Change status
|
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll More info about file navshext.dll |
Legitimate |
Application program item according to inner database Component of Norton Anti-virus. Located in "C:\Program Files\Norton AntiVirus\". Uses... |
Change status
|
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE More info about file recguard.exe |
Legitimate |
Application program item according to inner database File recguard.exe can be found on some Hewlett-Packard computers. It is used to protect Windows XP... |
Change status
|
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe More info about file agrsmmsg.exe |
Legitimate |
System item according to inner database Modem software from Agere.com. AGRSMMSG.exe is located in "C:\WINDOWS\" on Windows 95/98/ME/XP and... |
Change status
|
O4 - HKLM\..\Run: [Dit] Dit.exe More info about file dit.exe |
Legitimate |
System item according to inner database Drive Icon and Label utility, represented by running dit.exe file, is a specific component of the... |
Change status
|
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd More info about file cmicnfg.cpl |
Legitimate |
System item according to inner database system tray access for C-Media sound cards. |
Change status
|
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe More info about file nerocheck.exe |
Legitimate |
Application program item according to inner database Related to Nero CD/DVD Burning software. From the publisher: "This program constantly checks for... |
Change status
|
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" More info about file pcmservice.exe |
Legitimate |
System item according to inner database From Dell: "The Dell Media Experience (DME) will ship on selected Dimension and Inspiron systems... |
Change status
|
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe More info about file mmtask.exe |
Legitimate |
Application program item according to inner database Part of the Music Match Jukebox. Located in "C:\Program Files\MusicMatch\MusicMatch Jukebox\". A... |
Change status
|
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe More info about file atiptaxx.exe |
Legitimate |
System item according to inner database ATI Desktop Control Panel from ATI Technologies, Inc. Located in "C:\Program Files\ATI... |
Change status
|
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe More info about file mhotkey.exe |
Legitimate |
Application program item according to inner database The file is related to Chicony keyboard application. |
Change status
|
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe More info about file cnyhkey.exe |
Legitimate |
Application program item according to inner database The file is related to Chicony keyboard application. |
Change status
|
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" More info about file ccapp.exe |
Legitimate |
System item according to inner database From Symantec: <i>"ccApp.exe is the common hosting application that is used for both NAV and NIS.... |
Change status
|
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" More info about file hpwuschd2.exe |
Legitimate |
Application program item according to inner database The file is related to Hewlett Packard software. |
Change status
|
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" More info about file hpcmpmgr.exe |
Legitimate |
Application program item according to inner database File hpcmpmgr.exe is a part of Hewlett-Packard Component Manager tool, which comes preinstalled on... |
Change status
|
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" More info about file jusched.exe |
Legitimate |
Application program item according to inner database Checks if there are new versions of Java available. |
Change status
|
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide More info about file msascui.exe |
Legitimate |
Application program item according to inner database The file is component of Microsoft Windows Defender application. |
Change status
|
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime More info about file qttask.exe |
Legitimate |
Application program item according to inner database Provides system tray access to Apple's Quicktime Player. Located in "C:\Program Files\QuickTime\".... |
Change status
|
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" More info about file ituneshelper.exe |
Legitimate |
Application program item according to inner database Related to Apple's iTunes for Windows. Located in "C:\Program Files\iTunes\". |
Change status
|
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer More info about file sndmon.exe |
Legitimate |
Application program item according to inner database This is the main part of LiveUpdate tool, published by Symantec. It is required to update all... |
Change status
|
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background More info about file msnmsgr.exe |
Legitimate |
System item according to inner database Microsoft Windows Messenger chat client. |
Change status
|
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe More info about file reader_sl.exe |
Legitimate |
A part of Adobe Acrobat Reader. Used to speed up the program's launch time. |
Change status
|
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe More info about file hpqtra08.exe |
Legitimate |
Application program item according to inner database This is a legitimate component of Hewlett-Packard device drivers. It is also included in other HP... |
Change status
|
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE More info about file osa.exe |
Legitimate |
Application program item according to inner database The Office Startup Assistant (Osa.exe or OSA) is a program that improves the performance of Office... |
Change status
|
| O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe |
Legitimate |
Legitimate extra button in your browser - related to windows messenger. |
Change status
|
| O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe |
Legitimate |
Legitimate extra tools menu item - related to Windows Messenger. |
Change status
|
| O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab |
Questionable |
Are you using an ActiveX object with a name 'Checkers Class' located in 'http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab'? If not, fix this item. |
Change status
|
| O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 |
Legitimate |
Legitimate ActiveX item from site http://go.microsoft.com/ |
Change status
|
| O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab |
Questionable |
Are you using an ActiveX object with a name 'Minesweeper Flags Class' located in 'http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab'? If not, fix this item. |
Change status
|
| O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab |
Questionable |
Are you using an ActiveX object with a name 'MessengerStatsClient Class' located in 'http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab'? If not, fix this item. |
Change status
|
| O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll |
Legitimate |
windows check |
Change status
|
| O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll |
Legitimate |
The file belongs to WMP11 Beta application. |
Change status
|
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe More info about file ati2evxx.exe |
Legitimate |
Item found in 2-spyware.com database. File ati2evxx.exe, which starts a process with the same name, is the standard component of video... |
Change status
|
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe More info about file aluschedulersvc.exe |
Legitimate |
Item found in 2-spyware.com database. Related to Symantec anti-virus... |
Change status
|
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe More info about file ccevtmgr.exe |
Legitimate |
Item found in 2-spyware.com database. ccEvtMgr.exe is an event logging application and runs at startup. It monitors virus alerts, virus... |
Change status
|
| O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe |
Legitimate |
Related to Norton/Symantec AntiVirus. |
Change status
|
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe More info about file ccsetmgr.exe |
Legitimate |
Item found in 2-spyware.com database. An essential component of security-related Symantec software such as Norton AntiVirus and Norton... |
Change status
|
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe More info about file ipodservice.exe |
Legitimate |
Item found in 2-spyware.com database. This is a legitimate component of iTunes music program. It offers wide range of music playing and... |
Change status
|
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE More info about file lucoms~1.exe |
Legitimate |
Item found in 2-spyware.com database. The file belongs to Symantecs Internet security suite... |
Change status
|
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe More info about file navapsvc.exe |
Legitimate |
Item found in 2-spyware.com database. Norton AntiVirus application that provides auto-protection of the system. NAVAPSVC.EXE runs on... |
Change status
|
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe More info about file hpzipm12.exe |
Legitimate |
Item found in 2-spyware.com database. This is a standard component of Hewlett-Packard device drivers. The presence of this file means,... |
Change status
|
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe More info about file savscan.exe |
Legitimate |
Item found in 2-spyware.com database. This executable file is a standard part of antivirus and security-related software, published by... |
Change status
|
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe More info about file sbserv.exe |
Legitimate |
Item found in 2-spyware.com database. Part of Norton Anti-virus. SBServ.exe is located in "C:\Program Files\Common Files\Symantec... |
Change status
|
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe More info about file sndsrvc.exe |
Legitimate |
Item found in 2-spyware.com database. This is a part of Norton Internet Security and Norton Personal Firewall applications. It runs... |
Change status
|
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe More info about file spbbcsvc.exe |
Legitimate |
Item found in 2-spyware.com database. Essential component of Symantec's Norton Internet Security... |
Change status
|
| O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe (file missing) |
Not necessary |
Fix this item because it points to a file that does not exist |
Change status
|