urbestfreind

I figured I would drop a HJT log file on here and see if anyone notices something odd. [hide=HTJ Log]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:28:40 PM, on 9/27/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss[Caution: Executable File] C:\WINDOWS\system32\winlogon[Caution: Executable File] C:\WINDOWS\system32\services[Caution: Executable File] C:\WINDOWS\system32\lsass[Caution: Executable File] C:\WINDOWS\system32\Ati2evxx[Caution: Executable File] C:\WINDOWS\system32\svchost[Caution: Executable File] C:\WINDOWS\System32\svchost[Caution: Executable File] C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: Executable File] C:\WINDOWS\system32\spoolsv[Caution: Executable File] C:\Program Files\Bonjour\mDNSResponder[Caution: Executable File] C:\WINDOWS\System32\svchost[Caution: Executable File] C:\PROGRA~1\McAfee\MSC\mcmscsvc[Caution: Executable File] c:\program files\common files\mcafee\mna\mcnasvc[Caution: Executable File] c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy[Caution: Executable File] C:\Program Files\McAfee\VirusScan\McShield[Caution: Executable File] C:\Program Files\McAfee\MPF\MPFSrv[Caution: Executable File] C:\WINDOWS\system32\o2flash[Caution: Executable File] C:\WINDOWS\system32\PhnxCDSvr[Caution: Executable File] C:\WINDOWS\system32\HPZipm12[Caution: Executable File] C:\WINDOWS\system32\svchost[Caution: Executable File] C:\Program Files\Viewpoint\Common\ViewpointService[Caution: Executable File] C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon[Caution: Executable File] C:\PROGRA~1\McAfee\VIRUSS~1\mcods[Caution: Executable File] C:\WINDOWS\system32\Ati2evxx[Caution: Executable File] C:\WINDOWS\Explorer[Caution: Executable File] C:\PROGRA~1\McAfee.com\Agent\mcagent[Caution: Executable File] c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld[Caution: Executable File] C:\WINDOWS\AGRSMMSG[Caution: Executable File] C:\Program Files\ATI Technologies\ATI.ACE\cli[Caution: Executable File] C:\Program Files\Phoenix Technologies\cME\Guard\Guard[Caution: Executable File] C:\Program Files\SiteAdvisor\6172\SiteAdv[Caution: Executable File] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon[Caution: Executable File] C:\Program Files\QuickTime\qttask[Caution: Executable File] C:\Program Files\CyberLink\PowerDVD\PDVDServ[Caution: Executable File] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: Executable File] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: Executable File] C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: Executable File] C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: Executable File] C:\WINDOWS\system32\ctfmon[Caution: Executable File] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480[Caution: Executable File] C:\Program Files\WhatPulse\WhatPulse[Caution: Executable File] C:\Program Files\Windows Media Player\WMPNSCFG[Caution: Executable File] C:\Program Files\Copernic Desktop Search 2\DesktopSearchService[Caution: Executable File] C:\WINDOWS\system32\wuauclt[Caution: Executable File] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: Executable File] C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: Executable File] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf[Caution: Executable File] C:\Program Files\Logitech\MouseWare\system\em_exec[Caution: Executable File] C:\Program Files\ATI Technologies\ATI.ACE\cli[Caution: Executable File] C:\Program Files\ATI Technologies\ATI.ACE\cli[Caution: Executable File] C:\Program Files\Mozilla Firefox\firefox[Caution: Executable File] C:\PROGRA~1\McAfee.com\Agent\mcupdate[Caution: Executable File] C:\PROGRA~1\McAfee\MSC\mcshell[Caution: Executable File] C:\Documents and Settings\Steven J Zutter Jr\Desktop\FireFox Downloads\HiJackThis[Caution: Executable File] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://comcast.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000018.dll O4 - HKLM\..\Run: [Alcmtr] ALCMTR[Caution: Executable File] O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: Executable File] O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp3[Caution: Executable File] O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli[Caution: Executable File]" runtime -Delay O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies\cME\RPro\ XP\VBPTASK[Caution: Executable File]" VBStart O4 - HKLM\..\Run: [Eval] "C:\Program Files\Phoenix Technologies\cME\RPro\Eval\Eval[Caution: Executable File]" O4 - HKLM\..\Run: [Guard] "C:\Program Files\Phoenix Technologies\cME\Guard\Guard[Caution: Executable File]" /background O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX[Caution: Executable File] O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv[Caution: Executable File] O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon[Caution: Executable File] O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent[Caution: Executable File] /runkey O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: Executable File]" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ[Caution: Executable File]" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: Executable File] O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: Executable File] O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: Executable File]" -osboot O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: Executable File]" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: Executable File]" /background O4 - HKCU\..\Run: [ctfmon[Caution: Executable File]] C:\WINDOWS\system32\ctfmon[Caution: Executable File] O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480[Caution: Executable File] O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse[Caution: Executable File] O4 - HKCU\..\Run: [uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster[Caution: Executable File] /S O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG[Caution: Executable File] O4 - HKCU\..\Run: [Copernic Desktop Search 2] "C:\Program Files\Copernic Desktop Search 2\DesktopSearchService[Caution: Executable File]" /tray O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: Executable File] O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: Executable File] O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl[Caution: Executable File] O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf[Caution: Executable File] O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: Executable File] O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: Executable File] O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File] O14 - IERESET.INF: START_PAGE_URL=http://www.averatec.com O16 - DPF: McAfee Wi-FiScan - http://download.mcafee.com/molbin/iss-l ... erCtrl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1164255281 O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-l ... cfscan.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: Executable File] O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx[Caution: Executable File] O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder[Caution: Executable File] O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService[Caution: Executable File] O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop[Caution: Executable File] (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: Executable File] O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: Executable File] O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc[Caution: Executable File] O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc[Caution: Executable File] O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods[Caution: Executable File] O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy[Caution: Executable File] O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield[Caution: Executable File] O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon[Caution: Executable File] O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv[Caution: Executable File] O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash[Caution: Executable File] O23 - Service: Phoenix VCD Service (PhnxVCDService) - Phoenix Technologies Ltd. - C:\WINDOWS\system32\PhnxCDSvr[Caution: Executable File] O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12[Caution: Executable File] O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService[Caution: Executable File] -- End of file - 10494 bytes[/hide]

Pro: Easy way to store data, voltage on in a certain pattern equals this, off equals not this. Con: Not easily readable by humans. VGV4dCBlbmNvZGVycw== 01010100 01100101 01111000 01110100 00100000 01100101 01101110 01100011 01101111 01100100 01100101 01110010 01110011 - . -..- - . -. -.-. --- -.. . .-. ... 73x7 3n(0d3r5 Grkg rapbqref sredocne txeT

Pro: you can now carry large amounts of small particles, or larger amounts than you could by hand. Con: There's a hole in the bucket, dear liza, dear liza, there's a hole in the bucket, dear liza, a hole...Don't ask how I remembered that. (Link to song) Racism.

[hide=Rant]01001001 01110100 00100111 01110011 00100000 01101110 01101111 01110100 00100000 01101010 01110101 01110011 01110100 00100000 01100001 00100000 01110010 01100001 01101110 01100100 01101111 01101101 00100000 01110011 01110100 01110010 01101001 01101110 01100111 00100000 01101111 01100110 00100000 01101111 01101110 01100101 00100111 01110011 00100000 01100001 01101110 01100100 00100000 01111010 01100101 01110010 01101111 01100101 01110011 00101110 00100000 01010111 01101001 01110100 01101000 01101111 01110101 01110100 00100000 01110100 01101000 01101001 01110011 00100000 00100010 01010010 01100001 01101110 01100100 01101111 01101101 00100000 01110011 01110100 01110010 01101001 01101110 01100111 00100010 00100000 01111001 01101111 01110101 00100000 01110111 01101111 01110101 01101100 01100100 01101110 00100111 01110100 00100000 01100010 01100101 00100000 01100100 01101111 01101001 01101110 01100111 00100000 01100001 01101110 01111001 01110100 01101000 01101001 01101110 01100111 00100000 01101111 01101110 00100000 01111001 01101111 01110101 01110010 00100000 01100011 01101111 01101101 01110000 01110101 01110100 01100101 01110010 00101110 00101110 00101110 00101110[/hide] Pro:....None Con:....None Not understanding the complexities of using two numbers in a specific order.

@Chaos ^^ Seems like you got a copy of it in your restore point. Nobody is hacking you, just AVG being inferior again. http://wiki.answers.com/Q/How_do_you_de ... estore_EXE That pretty much has your answer. You could also go back and delete that restore point as well. That program has more false positives than Pamela Anderson has silicone in her breasts.

6.8/9.5

Milk and Soda with Pickles...sounds interesting, except I hate pickles...I must try this... But since I haven't had it, I'll assume I don't like it, and go with cookies and milk. TPUM hates Windows Vista (and they would be wrong in their hatred, as I was).

I hate you for not realizing you had Caps Lock on before you hit submit, and then for blaming it on someone else.

Someone who is easily freaked, it turns scary movies into funny ones. I wouldn't mind either TBH. WYR play RuneScape or World of Warcraft (assuming both are free, and you can play at the same framerate on either).

Pro: Lets you know where your flaws are. Con: Reminds you you have flaws. 01000010 01101001 01101110 01100001 01110010 01111001 (Binary, for those lazy people).

00110000 On a related note: 00110001 00101000 01001111 01101110 01100101 00101001

aggravating.

Banned for assuming I play RuneScape.

Banned for paying JaGEx to make an inferior game.

Well, I just completed a full Ad-Aware scan, and it came up with nothing. I haven't changed anything in the BIOS, and I know this hasn't happened before. I checked, but I can't find anything. The boot order seems fine, security is fine, everything seems normal. I've found no programs in any of my scans, nothing is under quarentine, no system slowdowns or abnormal cpu usage...It seems my system is fine. I don't know what to do now, I've done pretty much everything. I'll put in a firewall but I don't know if that will help...McAfee, although inferior no doubt, would have shown if something was passing through connections, and making me restart...But nothing is in the allow list that I didn't specifically put there. I guess I'll get Comodo this weekend and configure it, and I'll call my friend tomorrow as well (he works in a computer shop, but he knows a lot about computer problems, especially security ones. Helped me a lot in the past). I'll just have to be more alert now.

Spybot S&D both found absolutely nothing. I'm going to run another Ad-Aware scan. The more I scan, the more I believe it's just windows being screwy, although I'm still getting a software firewall. Running towards my wit's end here, don't know of anything else I can scan with that would detect the malware..or nothing free anyways (that's right DVD, no NOD32 for me...yet).

It doesn't seem harmful, but I would do a spyware scan just in case.

Dude, epic. I definately have to get my hands on these, as I always eat pizza with ranch dressing (or garlic sauce, Hungry Howie's makes the best garlic sauce). I thank you for pointing this out, I can already tell I'll like them. snip

Agreed, unless: If you count all the flavors of Doritos (not sure, I hope you meant like chips, because I've never actually heard them referred to as crisps), then Spicy Sweet Chili wins all. [hide=Image of My Favorite Doritos][/hide]

I must thank Joe and sheep. I've been looking for a decent macro program and script for awhile. And I don't have to worry about breaking any rules. I don't play RS anymore, and the only other game I play is WoW, which already has a macro program built in (but you can only use it in WoW, hence the need for a third party program). Can you only hit one key at a time though? Or can I set it so I would hit like (enter) ? (Note that's just an example, as i happened to be working on writing a paragraph for my site.

Ignoring the epic bumpage, I quite enjoy a Snickerdoodle. They have to be my favorite.. Although I do enjoy White Chocolate Macadamia Nut, or Caramel Chocolate Chip...I used to love peanut butter cookies too, but nobody makes them like my grandmother did. I only ate hers.

I have a hardware firewall - my router...Apparently it didn't work too well. I'll do a Spybot scan in safe mode, and get anything out of the computer. Then I'll see if I have the same problem. If I do, I'll get the firewall. If I still have a problem, I'll go to the BIOS..The last thing I want to do is mess around in there. After all, I have my most important documents on here, and my other computer isn't usable atm. EDIT: Alright, I went into BIOS but I didn't see anything about WoL. I went into the device manager and checked the card, and the allow to restart the computer option wasn't checked (allow this to shutdown computer to save power or something like that was checked though, I didn't chant it). Soo...I guess someone really wants access to my system? I did notice that in the boot order, 4th was I think my ethernet card, should I like remove that from the boot order or what? I don't want to go into the BIOS at all. I'll run a normal Spybot scan, and if I find something, I'll do all my other scans in Safe Mode. Lets see if anything interesting comes up.

WOL? I don't really care if it's easy, I care about safety. I read up on Zone Alarm, and a lot of people said it causes problems with computers. Nobody said this about Comodo. I'll go with the safer option for now, i may move to ZA, but I've used it before and it was a pain to get off, along with being a bit of a resource hog (more than any firewall should be anyways), and annoying to use.

I tried the unhooking the network cable, and it didn't restart after shutdown. So now I'm getting Comodo and Spybot.

http://[Please Use QuickFind Code].com/p=kKmok3kJqO ... 4,57558517