On 14 Sep 2003 16:04:42 -0700, yosponge@yahoo.com (sponge) wrote:

>On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
>wrote:
>
>How's your disk space? Windows gets real screwy when it gets low on
>disk space. And even half a gig is low by Windows standards. You can
>run scandisk (or whatever the equivalent is in XP) to check it out;
>sometimes you have a lot less than the OS reports.
>
>If that doesn't work, try shutting off the firewall for a bit. You can
>disable it from running at startup from the Adminstration - >
>Miscellaneous menu. This and the NetBIOS config is the only thing from
>my page that could potentially cause a system crash or reboot (short
>of something extraordinary, like a bad file write.)
>
>I'm also curious to know what you have running. Get HiJackThis! to
>find out and post a log here.
>
>Sponge
>Sponge's Anti-Spyware Source
>www.geocities.com/yosponge

First of all thank you for taking the time too help me try and figure
this out. I am pretty much a newbie but am trying too learn. I have
17.7GB of hard drive space. It is a confusing problem because it is so
random. Thank you again for any help.

Logfile of HijackThis v1.96.0
Scan saved at 7:50:44 PM, on 9/14/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\Evidence Eliminator\ee.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Pyrenean\DNSKong\DNSKong.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
C:\Program Files\Agent\agent.exe
C:\Documents and Settings\d and l\My
Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
IBEW
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyServer =
ftp=127.0.0.1:8080;gopher=127.0.0.1:8080;http=127. 0.0.1:8080;https=127.0.0.1:8080;socks=127.0.0.1:80 80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyOverride = <local>
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =
http://www.microsoft.com/isapi/redir...e5update&O1=b1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and
Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine",
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src");
(C:\Documents and Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} -
C:\Program Files\Zero Knowledge\Freedom\freebhor.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton
SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
-k
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [POINTER]
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\My Shared Folder\software\Norton
SystemWorks 2003-Retail\norton\FASTSAFE\QDCSFS.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
/STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [AVG7_RegCleaner]
C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero
Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence
Eliminator\ee.exe /m
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather
Channel\The Weather Channel.exe
O4 - Startup: DNSKong.lnk = C:\Program
Files\Pyrenean\DNSKong\DNSKong.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie
Software\MemTurbo\memturbo.exe
O4 - Startup: proxomitron.lnk = C:\Program Files\Proxomitron
Naoko-4\Proxomitron.exe
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone
Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.co...?1059844265546
O17 -
HKLM\System\CCS\Services\Tcpip\..\{5F3482F9-45D5-46AB-86E7-AFA29D8F6707}:
NameServer =
127.0.0.1,63.240.76.5,204.127.202.5,204.127.198.5, 216.148.227.75