What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] slowing down, reproducing files and what ...

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Namaste CatBytes Sounds good to me, let's hope it is the way it appears to be. Listen, I have to follow some business outside. Here it is 12:45 pm. I will attend to it this evening. One thing I can tell you is that I didn't run flash desinfector over my E-drive. Shall I do this first thing tonight? So long. raphael
Post #18
I just found a short-cut-link in my > progam-file > autostart > is-63C4V.
Remember, we had that thing in the Virus Removal Tool: C:\ … \Desktop\Virus Removal Tool\\is-63C4V.startup.exe
But it's a link only. Can I just delete it? There shouldn't be anything in that actual Tool on my desktop.

ERUNT somehow has made it to my Program Files. On my desktop is only a shortcut icon. Thought I had it downloaded to my desktop.

What do you recomment to do with all these Anti-Ware on my desktop?
- ATF Cleaner: I am using CCleaner regularly. Do they do the same job?
- ERUNT: do I need from time to time do a new backup of my registry? And do I need to store it external, rather than on my C-drive?
- Flash Disinfect: USBs I normally format regularly. My 250-external I treat like my C-drive. What does Flash D. actually do?
- Virus Removal Tool: ?
- Tools Cleaner: ?

I am using ONLY Firefox, I don't trust IE too much. I will certainly download these 2 recommended ads.

I will check out 'Recovery Console' and 'SpywareBlaster '.
'SpywareGuard ': use only one real time! My present all-inclusive-anti-program is AVG network edition. Will that be sufficient? obviously not!?

Backups: I do a 'True Image' every month or so.

About the MVPS Hosts file I am not sure I like that idea. Nothing about 'buying a magazin', but I do not want to import a censor.

I went to >start >run > options > remove programs:
- Ad Aware SE Personal > could not open INSTALL.LOG file. Why could that be?
- I updated MS to Service Pack 3. Would it be wise to delete the following 3 items?
- Microsoft.Net Framework 1.1
- Microsoft.Net Framework 1.1 hotkeys
- Microsoft.Net Framework 2.0 Service Pack 1
I AM AWARE THAT MIGHT BE A VERY STUPID QUESTION and not wise at all.
- Microsoft Visuals C++2005 Redistributables: what is that, and do I need it?
- MSXML 4.0 SP2 (KB936181): what is that, and do I need it?
- MSXML 4.0 SP2 (KB954430): what is that, and do I need it?

okay, that's a lot of questions, I know. But that might be our last 'act' together. If you find the time please answer :D :blush: :wub:

One more: will that topic always be available on WhatTheTech or shall I download the info I like to keep to a file on my machine?
Post #19
Hi Raphael

Yes you should be able to delete anything left over that's on your desktop.


Backups: I do a 'True Image' every month or so


ERUNT just backs up the registry separately - might come in handy to keep - up to you

I prefer ATF over CC cleaner, your choice, but essentially they do the same job (don't use the registry cleaner function in CC cleaner there's no need and it can mess up your registry)

Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

It doesn't matter what AV protection you have if you don't change your browsing habits - just be more careful what you download in the future :blush:


MVPS Hosts file - your choice - it's just added protection.


- Ad Aware SE Personal > could not open INSTALL.LOG file. Why could that be? <– dont know - you can uninstall that program if you wish.
MalwareBytes is a much better program.

- I updated MS to Service Pack 3. Would it be wise to delete the following 3 items? -
Microsoft.Net Framework 1.1
- Microsoft.Net Framework 1.1 hotkeys
- Microsoft.Net Framework 2.0 Service Pack 1


No - keep them


- Microsoft Visuals C++2005 Redistributables: what is that, and do I need it?
- MSXML 4.0 SP2 (KB936181): what is that, and do I need it?
- MSXML 4.0 SP2 (KB954430): what is that, and do I need it?

Keep all this stuff - it's from Microsoft - I have it on my machine too - part of their security and bug fixes.


And lastly - the topic will always be available on WTT…to find it - go to the members tab top right > type in your name. under you title a subbox drops down > one of the choices is "find members topics' click that and this thread will pop up > click on the link and your there.

Stay safe :wavey:
Post #20
Well mate, interesting three days with u. All I can do is to send u some of our abundant south-indian sun and warmth to probably thrilling cold Canada. If u ever pop down here (auroville.org.in) just ask for Raphael/Srima. I'll be happy to feast u dinner and a gallon of beer. :friends:

Just enabled to view Hidden Files. It works!
I will meditate about my 'browsinghabits' :whistling:

Keep Rollin'

RAPHaeL

:thumbup: :thumbup: :thumbup:
Post #21
Again me. Hope you will look at this topic again!

I just shoveled some data from my E to my C, after I formated E, and there remaines a file I have never seen before:

SYSTEM VOLUME INFORMATION
I can't delete it, I don't get access to it. So I googled and fonund many people having infections in this very file. So I thought we might have a closer look to it. Maybe 'our nasty friend' is hiding in here.

This blog here is one of many that deals with seriouse problems people have with it:

http://blogs.msdn.com/oldnewthing/archive/2003/11/20/55764.aspx

What do you think about? I really never saw this file before on my E or anywhere else. I feel unsecure again.
Post #22
Hi raphael,

Is this file on your C: drive? On which drive is your operating system installed?

What exactly is your E: drive, is it a USB stick or some other form of removable media or a partition of your harddrive?

You must have your hidden files and folders enabled somehow.

Please do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Click theRESTORE DEFAULTS BUTTON
Click Apply, and then click OK.

SYSTEM VOLUME INFORMATION is a 'hidden file' , it is where your operating system stores all the 'restore points'
you need to leave it alone.

read up on it HERE


Let me know if you have any further issues
Post #23
Okay, Okay, I did.

Because I have a german (language) system everything is named differently, but I think I did what you told me to do. My external harddrive does not show the SYSTEM VOLUME INFORMATION FILE anymore

This SVF was on my external harddrive (for the duration of our surgery it happened to be connected to the E:port) which is a total different unit. It is not a partition of my main C:harddrive. My operation system runs fully on my C-drive which has no other partitions. When I started computering I had no idea about partition (I still hardly have).

So I do not worry about it. That's what you are saying, right?

I would like you to have a look at the list of my running processes. I find it amasing long, but maybe that's how it's ought to be, I don't know. I am just wondering why my computer is getting more and more slow. Doesn't that has to do with the CPU usage. I read that some WINDOWS internal (spy7tracking/…) files use upto 100%.
How can I send you a copy of that list? Is it part of a HJT logfile?

R.
Post #24
Hi

Open HJT

click on Open the Misc Tools Section

click on GenerateStartupList log

A notepad will open with the list of running processes

Copy/paste that list here
Post #25
For some stupid reason my HJT had disappeared. I downloaded it anew (version 2.0.2). It doesn't let me copy the list of processes. I can mark them all, but it doesn't take it.
Post #26
Sorry, I hit the wrong button:

StartupList report, 26.03.2009, 15:32:36
StartupList version: 1.52.2
Started from : C:\Programme\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP3 (6.00.2900.5512)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Launch Manager\LaunchAp.exe
C:\Launch Manager\HotkeyApp.exe
C:\Launch Manager\OSD.exe
C:\Launch Manager\OSDCtrl.exe
C:\Launch Manager\Wbutton.exe
C:\Programme\Google\Google Talk\googletalk.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AVG\AVG8\avgcsrvx.exe
C:\Programme\OpenOffice.org 3\program\soffice.exe
C:\Programme\OpenOffice.org 3\program\soffice.bin
C:\Programme\Mozilla Firefox\firefox.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\explorer.exe
C:\Programme\ZTE CDMA1X MODEM\Bin\PcmciaApp.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\notepad.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Dokumente und Einstellungen\Ralph\Startmenü\Programme\Autostart]
OpenOffice.org 3.0.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ATIPTA = C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
SynTPEnh = C:\Programme\Synaptics\SynTP\SynTPEnh.exe
LaunchAp = C:\Launch Manager\LaunchAp.exe
HotkeyApp = C:\Launch Manager\HotkeyApp.exe
LMgrVolOSD = C:\Launch Manager\OSD.exe
LMgrOSD = C:\Launch Manager\OSDCtrl.exe
Wbutton = "C:\Launch Manager\Wbutton.exe"
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
CtrlVol = C:\Launch Manager\CtrlVol.exe
QuickTime Task = "C:\Programme\QuickTime\QTTask.exe" -atboottime
googletalk = C:\Programme\Google\Google Talk\googletalk.exe /autostart
AVG8_TRAY = C:\PROGRA~1\AVG\AVG8\avgtray.exe

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

swg = C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

————————————————–

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

————————————————–

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /HideWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

[{8b15971b-5355-4c82-8c07-7e181ea07608}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

————————————————–

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

————————————————–

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registrierungs-Editor'

Registry check passed

————————————————–

Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
WormRadar.com IESiteBlocker.NavFilter - C:\Programme\AVG\AVG8\avgssie.dll - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
(no name) - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Programme\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

————————————————–

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job

————————————————–

Enumerating Download Program Files:

[Java Plug-in 1.6.0_07]
InProcServer32 = C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[Java Plug-in 1.6.0_07]
InProcServer32 = C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[Java Plug-in 1.6.0_07]
InProcServer32 = C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab

————————————————–

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll
Protocol #18: C:\WINDOWS\system32\mswsock.dll
Protocol #19: C:\WINDOWS\system32\mswsock.dll
Protocol #20: C:\WINDOWS\system32\mswsock.dll
Protocol #21: C:\WINDOWS\system32\mswsock.dll
Protocol #22: C:\WINDOWS\system32\mswsock.dll
Protocol #23: C:\WINDOWS\system32\mswsock.dll
Protocol #24: C:\WINDOWS\system32\mswsock.dll
Protocol #25: C:\WINDOWS\system32\mswsock.dll
Protocol #26: C:\WINDOWS\system32\mswsock.dll
Protocol #27: C:\WINDOWS\system32\mswsock.dll
Protocol #28: C:\WINDOWS\system32\mswsock.dll
Protocol #29: C:\WINDOWS\system32\mswsock.dll
Protocol #30: C:\WINDOWS\system32\mswsock.dll
Protocol #31: C:\WINDOWS\system32\mswsock.dll
Protocol #32: C:\WINDOWS\system32\mswsock.dll
Protocol #33: C:\WINDOWS\system32\mswsock.dll
Protocol #34: C:\WINDOWS\system32\mswsock.dll

————————————————–

Enumerating Windows NT/2000/XP services

IPv6-Hilfsdienst: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft ACPI-Treiber: system32\DRIVERS\ACPI.sys (system)
Microsoft Embedded Controllertreiber: system32\DRIVERS\ACPIEC.sys (system)
Adobe LM Service: "C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
Microsoft Kernel-Echounterdrückung: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Service for Realtek AC97 Audio (WDM): system32\drivers\ALCXWDM.SYS (manual start)
Warndienst: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Gatewaydienst auf Anwendungsebene: %SystemRoot%\System32\alg.exe (manual start)
AMD Processor Driver: system32\DRIVERS\AmdK8.sys (system)
Anwendungsverwaltung: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Atheros Wireless Network Adapter Service: system32\DRIVERS\ar5211.sys (manual start)
1394-ARP-Clientprotokoll: system32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
Asynchroner RAS -Medientreiber: system32\DRIVERS\asyncmac.sys (manual start)
Standard-IDE/ESDI-Festplattencontroller: system32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\system32\Ati2evxx.exe (autostart)
ati2mtag: system32\DRIVERS\ati2mtag.sys (manual start)
Protokoll für ATM ARP-Client: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audiostubtreiber: system32\DRIVERS\audstub.sys (manual start)
AVG8 E-mail Scanner: C:\PROGRA~1\AVG\AVG8\avgemc.exe (autostart)
AVG8 WatchDog: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (autostart)
AVG AVI Loader Driver x86: \SystemRoot\System32\Drivers\avgldx86.sys (system)
AVG On-access Scanner Minifilter Driver x86: \SystemRoot\System32\Drivers\avgmfx86.sys (system)
avgrkx86.sys: System32\Drivers\avgrkx86.sys (system)
AVG8 Network Redirector: \SystemRoot\System32\Drivers\avgtdix.sys (system)
Intelligenter Hintergrundübertragungsdienst: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Computerbrowser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Untertiteldecoder: system32\DRIVERS\CCDECODE.sys (manual start)
CD-ROM-Laufwerktreiber: system32\DRIVERS\cdrom.sys (system)
Indexdienst: %SystemRoot%\system32\cisvc.exe (manual start)
Ablagemappe: %SystemRoot%\system32\clipsrv.exe (disabled)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft-Netzteiltreiber: system32\DRIVERS\CmBatt.sys (manual start)
Microsoft Composite Battery-Treiber: system32\DRIVERS\compbatt.sys (system)
COM+-Systemanwendung: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Kryptografiedienste: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM-Server-Prozessstart: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP-Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Laufwerktreiber: system32\DRIVERS\disk.sys (system)
Verwaltungsdienst für die Verwaltung logischer Datenträger: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Verwaltung logischer Datenträger: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel-DLS-Synthesizer: system32\drivers\DMusic.sys (manual start)
DNS-Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Automatische Konfiguration (verkabelt): %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel-DRM-Audioentschlüsselung: system32\drivers\drmkaud.sys (manual start)
Extensible Authentication-Protokolldienst: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Fehlerberichterstattungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Ereignisprotokoll: %SystemRoot%\system32\services.exe (autostart)
COM+-Ereignissystem: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Kompatibilität für schnelle Benutzerumschaltung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Fax: %systemroot%\system32\fxssvc.exe (autostart)
FltMgr: system32\drivers\fltmgr.sys (system)
Treiber für Volume-Manager: system32\DRIVERS\ftdisk.sys (system)
Standardpaketklassifizierung: system32\DRIVERS\msgpc.sys (manual start)
Google Updater Service: "C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe" (autostart)
Hilfe und Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class-Treiber: system32\DRIVERS\hidusb.sys (manual start)
Integritätsschlüssel- und Zertifikatverwaltungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HSFHWATI: system32\DRIVERS\HSFHWATI.sys (manual start)
HSF_DP: system32\DRIVERS\HSF_DP.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP-SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042-Tastatur- und PS/2-Mausanschluss-Treiber: system32\DRIVERS\i8042prt.sys (system)
iaStor: system32\drivers\iaStor.sys (system)
Filtertreiber für CD-Brennen: system32\DRIVERS\imapi.sys (system)
IMAPI-CD-Brenn-COM-Dienste: C:\WINDOWS\system32\imapi.exe (manual start)
IPv6-Windows-Firewalltreiber: system32\drivers\ip6fw.sys (manual start)
Filtertreiber für IP-Verkehr: system32\DRIVERS\ipfltdrv.sys (manual start)
IP/IP-Tunneltreiber: system32\DRIVERS\ipinip.sys (manual start)
Übersetzer für IP-Netzwerkadressen: system32\DRIVERS\ipnat.sys (manual start)
RIP-Überwachung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
IPSEC-Treiber: system32\DRIVERS\ipsec.sys (system)
IR-Enumeratordienst: system32\DRIVERS\irenum.sys (manual start)
is-63C4Vdrv: system32\DRIVERS\86450436.sys (system)
PnP-ISA/EISA-Bus-Treiber: system32\DRIVERS\isapnp.sys (system)
Tastaturklassentreiber: system32\DRIVERS\kbdclass.sys (system)
Tastatur-HID-Treiber: system32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel-Waveaudiomixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Arbeitsstationsdienst: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP-NetBIOS-Hilfsprogramm: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Machine Debug Manager: "C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
Nachrichtendienst: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting-Remotedesktop-Freigabe: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mausklassentreiber: system32\DRIVERS\mouclass.sys (system)
Maus-HID-Treiber: system32\DRIVERS\mouhid.sys (manual start)
Redirector für WebDav-Client: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Proxy für Streaming Clock: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Proxy für Streaming Quality Manager: system32\drivers\MSPQM.sys (manual start)
Microsoft-Systemverwaltungs-BIOS-Treiber: system32\DRIVERS\mssmbios.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink-Konvertierung: system32\drivers\MSTEE.sys (manual start)
NABTS/FEC VBI-Codec: system32\DRIVERS\NABTSFEC.sys (manual start)
NAP-Agent (Network Access Protection): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft TV-/Videoverbindung: system32\DRIVERS\NdisIP.sys (manual start)
RAS-NDIS-TAPI-Treiber: system32\DRIVERS\ndistapi.sys (manual start)
NDIS-Benutzermodus-E/A-Protokoll: system32\DRIVERS\ndisuio.sys (manual start)
RAS-NDIS-WAN-Treiber: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS-Schnittstelle: system32\DRIVERS\netbios.sys (system)
NetBios über TCP/IP: system32\DRIVERS\netbt.sys (system)
Netzwerk-DDE-Dienst: %SystemRoot%\system32\netdde.exe (disabled)
Netzwerk-DDE-Serverdienst: %SystemRoot%\system32\netdde.exe (disabled)
Anmeldedienst: %SystemRoot%\system32\lsass.exe (manual start)
Netzwerkverbindungen: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
1394-Netzwerktreiber: system32\DRIVERS\nic1394.sys (manual start)
NLA (Network Location Awareness): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT-LM-Sicherheitsdienst: %SystemRoot%\system32\lsass.exe (manual start)
Wechselmedien: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nvatabus: system32\drivers\nvatabus.sys (system)
nvraid: system32\drivers\nvraid.sys (system)
Filtertreiber für IPX-Verkehr: system32\DRIVERS\nwlnkflt.sys (manual start)
Treiber für IPX-Verkehrsweiterleitung: system32\DRIVERS\nwlnkfwd.sys (manual start)
Texas Instruments OHCI-konformer IEEE 1394-Hostcontroller: system32\DRIVERS\ohci1394.sys (system)
Peernetzwerk-Gruppenauthentifizierung: %SystemRoot%\system32\svchost.exe -k p2psvc (manual start)
Peernetzwerkidentitäts-Manager: %SystemRoot%\system32\svchost.exe -k p2psvc (manual start)
Peernetzwerk: %SystemRoot%\system32\svchost.exe -k p2psvc (manual start)
PCI-Bus-Treiber: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Pcmcia: system32\DRIVERS\pcmcia.sys (system)
Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
Plug & Play: %SystemRoot%\system32\services.exe (autostart)
Peer Name Resolution-Protokoll: %SystemRoot%\system32\svchost.exe -k p2psvc (manual start)
IPSEC-Dienste: %SystemRoot%\system32\lsass.exe (autostart)
WAN-Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Prozessortreiber: system32\DRIVERS\processr.sys (system)
Geschützter Speicher: %SystemRoot%\system32\lsass.exe (autostart)
QoS-Paketplaner: system32\DRIVERS\psched.sys (manual start)
Treiber für direkte Parallelverbindung: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
Treiber für automatische RAS-Verbindung: system32\DRIVERS\rasacd.sys (system)
Verwaltung für automatische RAS-Verbindung: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN-Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
RAS-Verbindungsverwaltung: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remotezugriff-PPPOE-Treiber: system32\DRIVERS\raspppoe.sys (manual start)
Parallelanschluss (direkt): system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Sitzungs-Manager für Remotedesktophilfe: C:\WINDOWS\system32\sessmgr.exe (manual start)
Filtertreiber für digitale CD-Audiowiedergabe: system32\DRIVERS\redbook.sys (system)
Routing und RAS: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
RPC-Locator: %SystemRoot%\system32\locator.exe (manual start)
Remoteprozeduraufruf (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS-RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver: system32\DRIVERS\Rtlnicxp.sys (manual start)
NT-Treiber für Realtek RTL8139(A/B/C)-basierten PCI-Fast Ethernet-Adapter: system32\DRIVERS\RTL8139.SYS (manual start)
Sicherheitskontenverwaltung: %SystemRoot%\system32\lsass.exe (autostart)
Smartcard: %SystemRoot%\System32\SCardSvr.exe (manual start)
Taskplaner: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Sekundäre Anmeldung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Systemereignisbenachrichtigung: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows-Firewall/Gemeinsame Nutzung der Internetverbindung: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shellhardwareerkennung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Einfache TCP/IP-Dienste: %SystemRoot%\system32\tcpsvcs.exe (autostart)
SiSRaid2: system32\drivers\SiSRaid2.sys (system)
BDA Slip De-Framer: system32\DRIVERS\SLIP.sys (manual start)
Acronis Snapshots Manager: system32\DRIVERS\snapman.sys (system)
SNMP-Dienst: %SystemRoot%\System32\snmp.exe (autostart)
SNMP-Trap-Dienst: %SystemRoot%\System32\snmptrap.exe (manual start)
Sony USB-Filtertreiber (SONYPVU1): system32\DRIVERS\SONYPVU1.SYS (manual start)
Microsoft Kernel-Audiosplitter: system32\drivers\splitter.sys (manual start)
Druckwarteschlange: %SystemRoot%\system32\spoolsv.exe (autostart)
Filtertreiber für Systemwiederherstellung: system32\DRIVERS\sr.sys (system)
Systemwiederherstellungsdienst: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP-Suchdienst: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows-Bilderfassung (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
BDA-IPSink: system32\DRIVERS\StreamIP.sys (manual start)
Software-Bus-Treiber: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetablesynthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{986E6425-5999-4F67-A438-9C5084F9C3A7} (manual start)
Synaptics TouchPad Driver: system32\DRIVERS\SynTP.sys (manual start)
Microsoft Kernel-Systemaudiogerät: system32\drivers\sysaudio.sys (manual start)
Leistungsdatenprotokolle und Warnungen: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telefonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP-Protokolltreiber: system32\DRIVERS\tcpip.sys (system)
Microsoft IPv6-Protokolltreiber: system32\DRIVERS\tcpip6.sys (system)
Terminal-Gerätetreiber: system32\DRIVERS\termdd.sys (system)
Terminaldienste: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Designs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
tifm21: system32\drivers\tifm21.sys (manual start)
Acronis TrueImage FS Filter: system32\DRIVERS\tifsfilt.sys (autostart)
Acronis TrueImage Backup Archive Explorer: system32\DRIVERS\timntr.sys (system)
Überwachung verteilter Verknüpfungen (Client): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun-Miniportadaptertreiber: system32\DRIVERS\tunmp.sys (manual start)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
Microcode Updatetreiber: system32\DRIVERS\update.sys (manual start)
Universeller Plug & Play-Gerätehost: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Unterbrechungsfreie Stromversorgung: %SystemRoot%\System32\ups.exe (manual start)
USB-Audiotreiber (WDM): system32\drivers\usbaudio.sys (manual start)
Microsoft Standard-USB-Haupttreiber: system32\DRIVERS\usbccgp.sys (manual start)
Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller: system32\DRIVERS\usbehci.sys (manual start)
Microsoft USB-Standardhubtreiber: system32\DRIVERS\usbhub.sys (manual start)
Miniporttreiber für Microsoft USB Open Host-Controller: system32\DRIVERS\usbohci.sys (manual start)
Microsoft USB-Druckerklasse: system32\DRIVERS\usbprint.sys (manual start)
USB-Scannertreiber: system32\DRIVERS\usbscan.sys (manual start)
USB-Massenspeichertreiber: system32\DRIVERS\USBSTOR.SYS (manual start)
VGA-Anzeigecontroller.: \SystemRoot\System32\drivers\vga.sys (system)
viamraid: system32\drivers\viamraid.sys (system)
Volumeschattenkopie: %SystemRoot%\System32\vssvc.exe (manual start)
Windows-Zeitgeber: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
RAS-IP-ARP-Treiber: system32\DRIVERS\wanarp.sys (manual start)
Wbutton: \SystemRoot\system32\drivers\Wbutton.sys (system)
Treiber für Microsoft WINMM-WDM-Audiokompatibilität: system32\drivers\wdmaud.sys (manual start)
Webclient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
winachsf: system32\DRIVERS\HSF_CNXT.sys (manual start)
Windows-Verwaltungsinstrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Dienst für Seriennummern der tragbaren Medien: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Windows-Verwaltungsschnittstelle für ACPI: system32\DRIVERS\wmiacpi.sys (system)
WMI-Leistungsadapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Sicherheitscenter: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
World Standard Teletext-Codec: system32\DRIVERS\WSTCODEC.SYS (manual start)
Automatische Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Konfigurationsfreie drahtlose Verbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Netzwerkversorgungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
ZTE USB Device for Legacy Serial Communication: system32\DRIVERS\zteusbser.sys (manual start)


————————————————–

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll

————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

————————————————–

End of report, 36.948 bytes
Report generated in 0,235 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Post #27
Honestly,

I don't see anything unusual there, but then I'm no tech guru

you have some outdated java, that's about all

Do this

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
Download and install the latest Java Runtime Environment (JRE) version for your computer. (version 6 update 13)

Check the items in this thread here

If that doesn't help then I suggest you post a new topic in our Windows forum and see if our tech gurus can improve your system's performance - link back to this topic so they can see you are clean of malware…good luck
CB
Post #28
That whole range of:

%SystemRoot%\system32\svchost.exe

has a lot of autostarts. I read through a few forums, and there seems to exist a lot of confusion and suspition about this autorun-processes. Many complain about 100% CPU usage, shutdowns and machine overheating.
Post #30
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI