Logfile of HijackThis v1.99.0
Scan saved at 11:48:39 PM, on 3/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HijackThis\HijackThis.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B83929BD-8FA0-4796-8529-137BE79CD62E}: NameServer = 216.165.129.157,134.215.200.126
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
Also I ran the netstat command and these are the open ports, this computer has not been reconnected to the internet at all since reinstall...Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\James>fport
'fport' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\James>cd c:\
C:\>fport
'fport' is not recognized as an internal or external command,
operable program or batch file.
C:\>netstat -an
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1028 0.0.0.0:0 LISTENING
TCP 127.0.0.1:10110 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:4500 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1900 *:*
C:\>
And one more thing I got processfinder fron systeminternals and this is what it shows is currently running...Process PID CPU Description Company Name
System Idle Process 0 100.00
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 396 Windows NT Session Manager Microsoft Corporation
csrss.exe 444 Client Server Runtime Process Microsoft Corporation
winlogon.exe 468 Windows NT Logon Application Microsoft Corporation
services.exe 512 Services and Controller app Microsoft Corporation
svchost.exe 680 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 748 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 784 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 828 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 852 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1040 Spooler SubSystem App Microsoft Corporation
avgamsvr.exe 1204 AVG Alert Manager GRISOFT, s.r.o.
avgupsvc.exe 1292 AVG Update Service GRISOFT, s.r.o.
DKService.exe 1328 DKSERVICE.EXE Executive Software International, Inc.
alg.exe 112 Application Layer Gateway Service Microsoft Corporation
lsass.exe 524 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 1168 Windows Explorer Microsoft Corporation
avgcc.exe 1488 AVG Control Center GRISOFT, s.r.o.
avgemc.exe 1524 AVG E-Mail Scanner GRISOFT, s.r.o.
SOUNDMAN.EXE 1532 Realtek Sound Manager Realtek Semiconductor Corp.
TeaTimer.exe 1540 System settings protector Safer Networking Limited
SpySweeper.exe 1552 Spy Sweeper Webroot Software, Inc.
procexp.exe 1912 Sysinternals Process Explorer Sysinternals
Process: Procexp Pid: -2
Type Name
My concern is that I again had to shutdown and saw the 'should not see me' program that had the end now window come up, but I did not get an option to look at it closer because windows closed it at shutdown... 
This topic is locked
I deleted the C:\ Partition, then formatted it and reinstalled XP Pro, installled only my spyware/virus programs and was able to get online to update things for about 1 hour. The connection just crawled, less than 100 bytes (not Kb or Mb, bytes) per second... Now I can't even ping my router or anything... 
Sign In
Create Account
