PDA

View Full Version : My computer keeps connecting using the e-mail port..


j_r_2
2008-07-01, 20:07
AVG Free 8.0 detects my computer is connecting to an e-mail port, but I use webmail, and don't have any POP3 / IMAP accounts configured on my system. I don't know what program is doing this, but can I find out? I don't like it; I'm afraid it's e-mailing personal data somewhere (although I hope it's something else). The frequency is not predictable; I can never tell when it's going to connect, sometimes it does twice in ten minutes, sometimes I don't see it connecting for hours.

Any help appreciated. =]

I ran the Spybot S&D through, here's the results: (AVG 8 E-Mail scanner log and HJT log follow)


DuplicateFileKiller: [SBI $191EF06E] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Acezipsoft

DuplicateFileKiller: [SBI $32573E11] Uninstall settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Killer v1.8.5_is1

DuplicateFileKiller: [SBI $299D0DB7] Program group (Directory, fixed)
C:\Documents and Settings\All Users\Start Menu\Programs\Duplicate File Killer\

DuplicateFileKiller: [SBI $D219B0D6] Program directory (Directory, fixed)
C:\Program Files\Duplicate File Killer\

BurstMedia: Tracking cookie (Internet Explorer: jr2) (Cookie, fixed)


HitsLink: Tracking cookie (Opera 7+: jr2) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---

2008-01-28 blindman.exe (1.0.0.7)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-01-28 SDMain.exe (1.0.0.5)
2007-10-07 SDShred.exe (1.0.1.2)
2008-01-28 SDUpdate.exe (1.0.8.8)
2008-01-28 SDWinSec.exe (1.0.0.11)
2008-01-28 SpybotSD.exe (1.5.2.20)
2008-01-28 TeaTimer.exe (1.5.2.16)
2008-07-01 unins000.exe (51.49.0.0)
2008-01-28 Update.exe (1.4.0.6)
2008-01-28 advcheck.dll (1.5.4.5)
2007-04-02 aports.dll (2.1.0.0)
2007-11-17 DelZip179.dll (1.79.7.4)
2008-01-28 SDFiles.dll (1.5.1.19)
2008-01-28 SDHelper.dll (1.5.0.11)
2008-01-28 Tools.dll (2.1.3.3)
2008-06-17 Includes\Adware.sbi (*)
2008-06-18 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-06-03 Includes\Dialer.sbi (*)
2008-06-24 Includes\DialerC.sbi (*)
2008-06-03 Includes\HeavyDuty.sbi (*)
2008-06-16 Includes\Hijackers.sbi (*)
2008-06-17 Includes\HijackersC.sbi (*)
2008-06-25 Includes\Keyloggers.sbi (*)
2008-06-24 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-06-24 Includes\Malware.sbi (*)
2008-06-24 Includes\MalwareC.sbi (*)
2008-06-17 Includes\PUPS.sbi (*)
2008-06-24 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-10 Includes\Security.sbi (*)
2008-06-18 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-06-17 Includes\Spyware.sbi (*)
2008-06-17 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-06-24 Includes\Trojans.sbi (*)
2008-06-25 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll


Here's the AVG 8 log: (HJT log follows)


11.5.2008 23:35:57.288 AVG for E-mail [8.0.80] started
11.5.2008 23:35:57.694 [b84] Registered in WatchDog
11.5.2008 23:35:57.913 [b84] Using AVG Kernel: 8.0.100 [269.23.2/1392]
11.5.2008 23:35:58.007 [b84] AvgCfg: 0
11.5.2008 23:35:58 Using Cyrus SASL 2.1.13
11.5.2008 23:35:59 Starting the main loop
11.5.2008 23:35:59 Redirector version 80000
11.5.2008 23:35:59 AutoPOP3(10110): Starting server
11.5.2008 23:35:59 Queue processing started
11.5.2008 23:40:03 End of program
11.5.2008 23:40:03 AVG for E-mail ended

12.5.2008 00:02:19.296 [734] AVG for E-mail [8.0.80] started
12.5.2008 00:02:19.562 [734] Registered in WatchDog
12.5.2008 00:02:19.937 [734] Using AVG Kernel: 8.0.100 [269.23.16/1427]
12.5.2008 00:02:19.937 [734] AvgCfg: 0
12.5.2008 00:02:20 Using Cyrus SASL 2.1.13
12.5.2008 00:02:20 Starting the main loop
12.5.2008 00:02:20 Redirector version 80000
12.5.2008 00:02:20 AutoPOP3(10110): Starting server
12.5.2008 00:02:20 Queue processing started
12.5.2008 01:07:04 AutoPOP3(10110): Connection from process 3676
12.5.2008 01:07:04 AutoPOP3(10110): Connection from 127.0.0.1:1928
12.5.2008 01:07:04 AutoPOP3(10110): Client connected
12.5.2008 01:07:33 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 01:07:33 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 01:07:33 AutoPOP3(10110): Client disconnected
12.5.2008 01:28:27 AutoPOP3(10110): Connection from process 3676
12.5.2008 01:28:27 AutoPOP3(10110): Connection from 127.0.0.1:3197
12.5.2008 01:28:27 AutoPOP3(10110): Client connected
12.5.2008 01:28:48 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 01:28:48 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 01:28:48 AutoPOP3(10110): Client disconnected
12.5.2008 01:42:47 AutoPOP3(10110): Connection from process 3676
12.5.2008 01:42:47 AutoPOP3(10110): Connection from 127.0.0.1:3956
12.5.2008 01:42:47 AutoPOP3(10110): Client connected
12.5.2008 01:43:08 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 01:43:08 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 01:43:08 AutoPOP3(10110): Client disconnected
12.5.2008 02:33:21 AutoPOP3(10110): Connection from process 3676
12.5.2008 02:33:21 AutoPOP3(10110): Connection from 127.0.0.1:2602
12.5.2008 02:33:21 AutoPOP3(10110): Client connected
12.5.2008 02:33:42 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 02:33:42 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 02:33:42 AutoPOP3(10110): Client disconnected
12.5.2008 02:49:04 AutoPOP3(10110): Connection from process 3676
12.5.2008 02:49:04 AutoPOP3(10110): Connection from 127.0.0.1:3383
12.5.2008 02:49:04 AutoPOP3(10110): Client connected
12.5.2008 02:49:25 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 02:49:25 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 02:49:25 AutoPOP3(10110): Client disconnected
12.5.2008 03:03:25 AutoPOP3(10110): Connection from process 3676
12.5.2008 03:03:25 AutoPOP3(10110): Connection from 127.0.0.1:4061
12.5.2008 03:03:25 AutoPOP3(10110): Client connected
12.5.2008 03:03:46 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 03:03:46 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 03:03:46 AutoPOP3(10110): Client disconnected
12.5.2008 03:28:42 AutoPOP3(10110): Connection from process 3676
12.5.2008 03:28:42 AutoPOP3(10110): Connection from 127.0.0.1:1359
12.5.2008 03:28:42 AutoPOP3(10110): Client connected
12.5.2008 03:29:03 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 03:29:03 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 03:29:03 AutoPOP3(10110): Client disconnected
12.5.2008 04:19:57 AutoPOP3(10110): Connection from process 3676
12.5.2008 04:19:57 AutoPOP3(10110): Connection from 127.0.0.1:3823
12.5.2008 04:19:57 AutoPOP3(10110): Client connected
12.5.2008 04:20:18 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 04:20:18 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 04:20:18 AutoPOP3(10110): Client disconnected
12.5.2008 06:01:05 AutoPOP3(10110): Connection from process 3676
12.5.2008 06:01:05 AutoPOP3(10110): Connection from 127.0.0.1:4623
12.5.2008 06:01:05 AutoPOP3(10110): Client connected
12.5.2008 06:01:26 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 06:01:26 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 06:01:26 AutoPOP3(10110): Client disconnected
12.5.2008 09:23:21 AutoPOP3(10110): Connection from process 3676
12.5.2008 09:23:21 AutoPOP3(10110): Connection from 127.0.0.1:2342
12.5.2008 09:23:21 AutoPOP3(10110): Client connected
12.5.2008 09:23:42 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 09:23:42 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 09:23:42 AutoPOP3(10110): Client disconnected
12.5.2008 16:07:54 AutoPOP3(10110): Connection from process 3676
12.5.2008 16:07:54 AutoPOP3(10110): Connection from 127.0.0.1:1807
12.5.2008 16:07:54 AutoPOP3(10110): Client connected
12.5.2008 16:08:15 AutoPOP3(10110): Cannot connect to 221.130.195.240:110
12.5.2008 16:08:15 AutoPOP3(10110): Connect: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (10060)
12.5.2008 16:08:15 AutoPOP3(10110): Client disconnected
12.5.2008 17:03:52 End of program
12.5.2008 17:03:52 AVG for E-mail ended

12.5.2008 17:05:07.765 [3e0] AVG for E-mail [8.0.80] started
12.5.2008 17:05:07.906 [3e0] Registered in WatchDog
12.5.2008 17:05:08.125 [3e0] Using AVG Kernel: 8.0.100 [269.23.16/1428]
12.5.2008 17:05:08.140 [3e0] AvgCfg: 0
12.5.2008 17:05:08 Using Cyrus SASL 2.1.13
12.5.2008 17:05:08 Starting the main loop
12.5.2008 17:05:08 Redirector version 80000
12.5.2008 17:05:08 AutoPOP3(10110): Starting server
12.5.2008 17:05:08 Queue processing started
[b]CONTENTS SNIPPED TO ALLOW POSTING; I CAN PROVIDE IF NECESSARY
29.6.2008 13:19:36 AutoPOP3(10110): Connection from process 2272
29.6.2008 13:19:36 AutoPOP3(10110): Connection from 127.0.0.1:4018
29.6.2008 13:19:36 AutoPOP3(10110): Client connected
29.6.2008 13:19:37 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 13:19:37 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 13:19:37 AutoPOP3(10110): Client disconnected
29.6.2008 16:37:40 End of program
29.6.2008 16:37:40 AVG for E-mail ended

29.6.2008 16:40:09.687 [4e0] AVG for E-mail [8.0.80] started
29.6.2008 16:40:09.984 [4e0] Registered in WatchDog
29.6.2008 16:40:10.281 [4e0] Using AVG Kernel: 8.0.101 [270.4.3/1524]
29.6.2008 16:40:10.312 [4e0] AvgCfg: 0
29.6.2008 16:40:10 Using Cyrus SASL 2.1.13
29.6.2008 16:40:10 Starting the main loop
29.6.2008 16:40:10 Redirector version 80000
29.6.2008 16:40:10 AutoPOP3(10110): Starting server
29.6.2008 16:40:10 Queue processing started
29.6.2008 17:10:04 AutoPOP3(10110): Connection from process 4012
29.6.2008 17:10:04 AutoPOP3(10110): Connection from 127.0.0.1:1567
29.6.2008 17:10:04 AutoPOP3(10110): Client connected
29.6.2008 17:10:05 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 17:10:05 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 17:10:05 AutoPOP3(10110): Client disconnected
29.6.2008 17:24:25 AutoPOP3(10110): Connection from process 4012
29.6.2008 17:24:25 AutoPOP3(10110): Connection from 127.0.0.1:2563
29.6.2008 17:24:25 AutoPOP3(10110): Client connected
29.6.2008 17:24:26 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 17:24:26 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 17:24:26 AutoPOP3(10110): Client disconnected
29.6.2008 17:39:27 AutoPOP3(10110): Connection from process 4012
29.6.2008 17:39:27 AutoPOP3(10110): Connection from 127.0.0.1:3389
29.6.2008 17:39:27 AutoPOP3(10110): Client connected
29.6.2008 17:39:28 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 17:39:28 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 17:39:28 AutoPOP3(10110): Client disconnected
29.6.2008 17:53:48 AutoPOP3(10110): Connection from process 4012
29.6.2008 17:53:48 AutoPOP3(10110): Connection from 127.0.0.1:4273
29.6.2008 17:53:48 AutoPOP3(10110): Client connected
29.6.2008 17:53:49 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 17:53:49 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 17:53:49 AutoPOP3(10110): Client disconnected
29.6.2008 18:22:30 AutoPOP3(10110): Connection from process 4012
29.6.2008 18:22:30 AutoPOP3(10110): Connection from 127.0.0.1:1681
29.6.2008 18:22:30 AutoPOP3(10110): Client connected
29.6.2008 18:22:31 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 18:22:31 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 18:22:31 AutoPOP3(10110): Client disconnected
29.6.2008 19:19:54 AutoPOP3(10110): Connection from process 4012
29.6.2008 19:19:54 AutoPOP3(10110): Connection from 127.0.0.1:4387
29.6.2008 19:19:54 AutoPOP3(10110): Client connected
29.6.2008 19:19:55 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 19:19:55 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 19:19:55 AutoPOP3(10110): Client disconnected
29.6.2008 21:14:42 AutoPOP3(10110): Connection from process 4012
29.6.2008 21:14:42 AutoPOP3(10110): Connection from 127.0.0.1:1875
29.6.2008 21:14:42 AutoPOP3(10110): Client connected
29.6.2008 21:14:43 AutoPOP3(10110): Cannot connect to localhost:110
29.6.2008 21:14:43 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
29.6.2008 21:14:43 AutoPOP3(10110): Client disconnected
30.6.2008 01:04:18 AutoPOP3(10110): Connection from process 4012
30.6.2008 01:04:18 AutoPOP3(10110): Connection from 127.0.0.1:4625
30.6.2008 01:04:18 AutoPOP3(10110): Client connected
30.6.2008 01:04:19 AutoPOP3(10110): Cannot connect to localhost:110
30.6.2008 01:04:19 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
30.6.2008 01:04:19 AutoPOP3(10110): Client disconnected
30.6.2008 08:43:58 AutoPOP3(10110): Connection from process 4012
30.6.2008 08:43:58 AutoPOP3(10110): Connection from 127.0.0.1:4744
30.6.2008 08:43:59 AutoPOP3(10110): Client connected
30.6.2008 08:44:05 AutoPOP3(10110): Cannot connect to localhost:110
30.6.2008 08:44:05 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
30.6.2008 08:44:20 AutoPOP3(10110): Client disconnected
30.6.2008 23:47:39 AutoPOP3(10110): Connection from process 4012
30.6.2008 23:47:39 AutoPOP3(10110): Connection from 127.0.0.1:2483
30.6.2008 23:47:39 AutoPOP3(10110): Client connected
30.6.2008 23:47:40 AutoPOP3(10110): Cannot connect to localhost:110
30.6.2008 23:47:40 AutoPOP3(10110): Connect: No connection could be made because the target machine actively refused it. (10061)
30.6.2008 23:47:40 AutoPOP3(10110): Client disconnected


And the HJT Log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:16 PM, on 7/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\NetDrive\wdService.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\D4\D4.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Ditto\Ditto.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\TClock\tclock.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\notepad.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Ditto] C:\Program Files\Ditto\Ditto.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Pidgin.lnk = C:\Program Files\Pidgin\pidgin.exe
O4 - Global Startup: DeskView.lnk = C:\Tools\DeskView\deskview.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O4 - Global Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O4 - Global Startup: TClock.lnk = C:\Program Files\TClock\tclock.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1200435103796
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200435021875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1209568152183
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F493790C-0A30-4E12-AE5E-EB64D2E005BE}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{FDB9E36E-68E0-4BBC-A3DF-F32D1EE94B5F}: NameServer = 24.92.226.9,24.92.226.102
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: FAH@C:+Tools+FAH+fah6-win-x86-console.exe - Unknown owner - C:\Tools\FAH\fah6-win-x86-console.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe
O24 - Desktop Component 1: (no name) - http://blog.pixelbreaker.com/wp-content/flash/polarclock3/PolarClock3.swf

--
End of file - 16355 bytes
j_r_2
2008-07-03, 20:46
i couldnt reply in the malware removal forum, i think it is just security experts that can do this. i have seen the same on my computer when using avg, it was because i was using utorrent i think. i have read on other forums about this. i dont know, but i dont think it is dangerous. you can tell this in the malware removal forum so they know it. maybe you are using filsharing programs like i did when seeing this.

i am not allowed to help you with your logs, just wait for help.


I do use uTorrent... is this what is causing the alerts? If so, sorry for wasting your time. xD I know uTorrent is safe. Off the bat, does anyone know of a prog that would have been able to pinpoint which program was using that IP / port and tell me it was just uTorrent? TCPView from sysinternals kept crashing after logging for awhile.

Thx,

jr2