Is this Spyware, a virus or something else?

[Sky_Captain]

BEagle, my appologies, I was meant to say goates, although thank you for the step through guides you posted, do you mind if I ask you for one other guide, how do you disable the SP2 firewall?
I'm not going to pretend I know about the differences in operating systems; But like Binoculars said, I am one of those people who didn't know there was an alternative to MS. Right now i'm in the market for something new for the home PC and need some options. Most people advise the standard from Dell, but some like Evo know it's not the best

Should I stick with MS compatible systems, or build to my own specs with an Athalon 64 processor and Linux to operate,or just change completly for the MAC.

Everybodys opinion on this would be greatly appreciated.

Land After, could I ask the silly question, to set up the connection between Thunderbird and Gmail, what do I need to do after I download the programme

S.C.

[BEagle]

S-C - go to 'Start', then 'Control Panel', then double click the 'Windows Firewall' icon. When the program opens, tick the option against the red shield symbol and then 'OK'.

Regarding the best option for your new computing needs, I wouldn't wish to comment as the real answer is "It depends upon what you want....."

Bill Gates brought computing to millions of people and for that he deserves thanks. The continual bitching and moaning and references to Micro$oft from the IT-knowledgeable are regrettable. Sure there are probably better systems and software for the real experts, but for everyday use I'm entirely happy with Microsoft!

[Evo]

S.C - I've been using Linux since '95, love it, and use it on my main 'Work' machine. However, I think that it's still not really a suitable general-purpose O/S, so if you have to ask "is it for me?" it probably isn't. There's just too much hands-on needed. Now if that sounds fun to you then give it a go (it's not hard, per se, just different).

As for Dell, you can usually do better - either from another more specialist maker, or by building yourself. The Dell outlet can be very cheap though, but you need to be quick, lucky and understand exactly what you're buying.

BEagle, it's a bit rich to complain that "The continual bitching and moaning and references to Micro$oft from the IT-knowledgeable are regrettable" when you referred earlier to "Linux, Godzilla, Bollux or whatever".

[goates]

Sky_Captain,

Evo is right about most people using Linux. Unless you want to get your hands dirty with computers and operating systems, it's best to avoid it for now.

I built my own Windows machine, and occasionally play around with Linux. Every time I end up dropping Linux as it takes too much time to just set up and keep running. When it comes to getting work done, I would much rather use a Mac.

It shouldn't just be the IT folks complaining about Windows. Everybody should be. Apple has developed a system that can do virtually everything Windows can, but better and more securely. Yes Microsoft can't control the hardware as well as Apple can, but they can control the quality and security of the operating system. And so far they have chosen not to.

The settings to use for Gmail POP access should be under the settings or preferences in your Gmail account. I can't check from work though to see if they give special instructions for Thunderbird though.

goates

PS - Here is a link looking at the cost of the Mac Minis compared to PCs. Basically there isn't much of a difference.

http://www.macworld.com/weblogs/edit...nges/index.php

[Land After]

Goates is right - download Thunderbird, then follow the instructions online in Gmail to configure it.

In Gmail choose Settings->Forwarding & POP.

I'd recommend choosing the option to Enable POP for all mail and to keep a copy of the mail in Gmail (You've got a Gig of store, may as well use it for backups!). Then click on the link for the cient confiiguration instructions and choose the one for Thunderbird 0.x (You'll have 1.0, but I can't see there being a bg problem)

[E-Liam]

Hi SC,

I don't know how far you've got with the clean up yet, but could you post up a new HJT log, and I'll give it the once over for you.

Oh, and the STHomePage BHO is almost certainly the cause of the hijack, keeping the home page as quickmetasearch, so well done Goates for spotting that.

Cheers

Liam

[Sky_Captain]

Liam, good to know your back on again, you were a great help before. Here's the current Report:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/notebookaccessories
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8D2A228-1B39-4447-9830-93F424F55D81}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Gear Security Service - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe


BEagle, thank you again for your step through help. As for what I want, well an all inclusive machine for personal and family use, aswell as use for gaming which rules out the MAC. I am the hands on sort of person, but I think I will go with the build your own approach as Evo mentioned. I hear wonderful things about the 64 processor, and am looking for some sort of system that is less likely to have problems with hacking, viruses or just poor performance.

Goates & Land After, thanks for the help with POP3 for Gmail, I'm about to download the programme now.

To hose in the know, for this laptop i'm on now, which is a HP, I have near everything i need to protect it from, virus, worm, trojan, spyware and adware, is there anything to block out specific hackers or is zone alarm pro enough?

S.C.

[rotorcraig]

ZoneAlarm Pro should be sufficient so long as it is configured and working correctly.

To test it go to www.grc.com and find the "Shields UP!!" page.

When you get there run the "All Service Ports" service.

If ZoneAlarm is working, everything should come up green (ie "Stealth").

RC

[goates]

S.C.

System for games -> Windows or cheap PC/Mac and XBox/PS2 or Gamecube

System resistant to viruses, spyware and hacking -> Just about anything but Windows or Windows loaded up with anti-virus, firewall and anti-spyware programs (which will hurt performance too)

Not really the best choices to have to make, but that's what we have.

There are 64 bit versions of Linux available that can fully utilise the Athlon 64 processors, and there will be a version of WindowsXP out soon too. Otherwise you can just run the current 32 bit versions of XP.

goates

[flystudent]

I use

pestpatrol You can download the scanner for free and it will tell you what's on your machine, it finds much more than adware etc and any others I have used.

I think for each one found it also has manual removal instruction (though you dont need them if you pay for the full version) which no doubt someone has on Kazaa.

FS

[Avtrician]

This one is pretty easy to fix. Just go to the website, find the help/faq button and select it. there is a link to a removal tool.

When the toolis run it will ask if you want to force delete the prog, select yes and it goes away.

The hijack probably came from an update to the msn mesenger program. Its very trickily worded so that you install my searchnow.

A search on google will show that its a common problem.

[E-Liam]

Hi SC,

Clean log. This one can go though, just as a bit of housekeeping..

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


Cheers

Liam

[Sky_Captain]

Thanks Liam for the Help, greatly appreciated as always. And a Big Thank You to everyone who responded to my initial and subsequent queries

If it wasn't for the help of the many great people on pprune i'd be lost

My sincerest Thanks to you all.

S.C.